feat: server-driven configurator settings via qt_settings

Replaces hardcoded JS category filters and config-type buttons with
server-pushed settings synced from qt_settings (MariaDB) → local_qt_settings (SQLite).

- new table local_qt_settings (AutoMigrate) — synced after component sync
- GET /api/configurator-settings returns config_types, tab_config,
  always_visible_tabs, required_categories with hardcoded fallbacks
- new-config modal: type buttons rendered from server data (Сервер/СХД static fallback)
- configurator: TAB_CONFIG and category filter driven by server; required-category badge on tabs
- SyncQtSettings wired into SyncComponents and SyncAll handlers (non-fatal on old server)
- bible-local/server-contract-qt-settings.md — contract for server-side agent
- page titles: OFS → QFS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -1,5 +1,10 @@
 # QuoteForge
 config.yaml
+
+# Data exports and imports with real supplier/pricing data
+*_import.sql
+*_export.csv
+test_export.csv
 .env
 .env.*
 *.pem
@@ -75,7 +80,12 @@ Network Trash Folder
 Temporary Items
 .apdisk
 
-# Release artifacts (binaries, archives, checksums), but DO track releases/memory/ for changelog
+# Release artifacts (binaries, archives, checksums), but keep markdown notes tracked
 releases/*
+!releases/README.md
 !releases/memory/
 !releases/memory/**
+!releases/**/
+releases/**/*
+!releases/README.md
+!releases/*/RELEASE_NOTES.md

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "bible"]
+	path = bible
+	url = https://git.mchus.pro/mchus/bible.git

AGENTS.md

@@ -0,0 +1,11 @@
+# QuoteForge — Instructions for Codex
+
+## Shared Engineering Rules
+Read `bible/` — shared rules for all projects (CSV, logging, DB, tables, background tasks, code style).
+Start with `bible/rules/patterns/` for specific contracts.
+
+## Project Architecture
+Read `bible-local/` — QuoteForge specific architecture.
+Read order: `bible-local/README.md` → relevant files for the task.
+
+Every architectural decision specific to this project must be recorded in `bible-local/`.

CLAUDE.md

@@ -1,83 +1,17 @@
-# QuoteForge - Claude Code Instructions
+# QuoteForge — Instructions for Claude
 
-## Overview
-Корпоративный конфигуратор серверов с offline-first архитектурой.
-Приложение работает через локальную SQLite базу, синхронизация с MariaDB выполняется фоново.
+## Shared Engineering Rules
+Read `bible/` — shared rules for all projects (CSV, logging, DB, tables, background tasks, code style).
+Start with `bible/rules/patterns/` for specific contracts.
 
-## Product Scope
-- Конфигуратор компонентов и расчёт КП
-- Проекты и конфигурации
-- Read-only просмотр прайслистов из локального кэша
-- Sync (pull компонентов/прайслистов, push локальных изменений)
+## Project Architecture
+Read `bible-local/` — QuoteForge specific architecture.
+Read order: `bible-local/README.md` → relevant files for the task.
 
-Из области исключены:
-- admin pricing UI/API
-- stock import
-- alerts
-- cron/importer утилиты
+Every architectural decision specific to this project must be recorded in `bible-local/`.
 
-## Architecture
-- Local-first: чтение и запись происходят в SQLite
-- MariaDB используется как сервер синхронизации
-- Background worker: периодический sync push+pull
-
-## Guardrails
-- Не возвращать в проект удалённые legacy-разделы: cron jobs, importer utility, admin pricing, alerts, stock import.
-- Runtime-конфиг читается из user state (`config.yaml`) или через `-config` / `QFS_CONFIG_PATH`; не хранить рабочий `config.yaml` в репозитории.
-- `config.example.yaml` остаётся единственным шаблоном конфигурации в репо.
-- Любые изменения в sync должны сохранять local-first поведение: локальные CRUD не блокируются из-за недоступности MariaDB.
-
-## Key SQLite Data
-- `connection_settings`
-- `local_components`
-- `local_pricelists`, `local_pricelist_items`
-- `local_configurations`
-- `local_projects`
-- `pending_changes`
-
-## API Endpoints
-| Group | Endpoints |
-|-------|-----------|
-| Setup | `GET /setup`, `POST /setup`, `POST /setup/test`, `GET /setup/status` |
-| Components | `GET /api/components`, `GET /api/components/:lot_name`, `GET /api/categories` |
-| Quote | `POST /api/quote/validate`, `POST /api/quote/calculate`, `POST /api/quote/price-levels` |
-| Pricelists (read-only) | `GET /api/pricelists`, `GET /api/pricelists/latest`, `GET /api/pricelists/:id`, `GET /api/pricelists/:id/items`, `GET /api/pricelists/:id/lots` |
-| Configs | CRUD + refresh/clone/reactivate/rename/project binding via `/api/configs/*` |
-| Projects | CRUD + nested configs via `/api/projects/*` |
-| Sync | `GET /api/sync/status`, `GET /api/sync/readiness`, `GET /api/sync/info`, `GET /api/sync/users-status`, `POST /api/sync/components`, `POST /api/sync/pricelists`, `POST /api/sync/all`, `POST /api/sync/push`, `GET /api/sync/pending`, `GET /api/sync/pending/count` |
-| Export | `POST /api/export/csv` |
-
-## Web Routes
-- `/configs`
-- `/configurator`
-- `/projects`
-- `/projects/:uuid`
-- `/pricelists`
-- `/pricelists/:id`
-- `/setup`
-
-## Release Notes & Change Log
-Release notes are maintained in `releases/memory/` directory organized by version tags (e.g., `v1.2.1.md`).
-Before working on the codebase, review the most recent release notes to understand recent changes.
-- Check `releases/memory/` for detailed changelog between tags
-- Each release file documents commits, breaking changes, and migration notes
-
-## Commands
 ```bash
-# Development
-go run ./cmd/qfs
-make run
-
-# Build
-make build-release
-CGO_ENABLED=0 go build -o bin/qfs ./cmd/qfs
-
-# Verification
-go build ./cmd/qfs
-go vet ./...
+go build ./cmd/qfs && go vet ./...   # verify
+go run ./cmd/qfs                      # run
+make build-release                    # release build
 ```
-
-## Code Style
-- gofmt
-- structured logging (`slog`)
-- explicit error wrapping with context

README.md

@@ -1,475 +1,53 @@
 # QuoteForge
 
-**Server Configuration & Quotation Tool**
+Local-first desktop web app for server configuration, quotation, and project work.
 
-QuoteForge — корпоративный инструмент для конфигурирования серверов и формирования коммерческих предложений (КП).  
-Приложение работает в strict local-first режиме: пользовательские операции выполняются через локальную SQLite, MariaDB используется для синхронизации и серверного администрирования прайслистов.
+Runtime model:
+- user work is stored in local SQLite;
+- MariaDB is used only for setup checks and background sync;
+- HTTP server binds to loopback only.
 
-![Go Version](https://img.shields.io/badge/Go-1.22+-00ADD8?style=flat&logo=go)
-![License](https://img.shields.io/badge/License-Proprietary-red)
-![Status](https://img.shields.io/badge/Status-In%20Development-yellow)
+## What the app does
 
-## Возможности
+- configuration editor with price refresh from synced pricelists;
+- projects with variants and ordered configurations;
+- vendor BOM import and PN -> LOT resolution;
+- revision history with rollback;
+- rotating local backups.
 
-### Для пользователей
-- 📱 **Mobile-first интерфейс** — удобная работа с телефона и планшета
-- 🖥️ **Конфигуратор серверов** — пошаговый выбор компонентов с проверкой совместимости
-- 💰 **Автоматический расчёт цен** — актуальные цены на основе истории закупок
-- 📊 **Экспорт в CSV/XLSX** — готовые спецификации для клиентов
-- 💾 **Сохранение конфигураций** — история и шаблоны для повторного использования
-- 🔌 **Полная офлайн-работа** — можно продолжать работу без сети и синхронизировать позже
-- 🛡️ **Защищенная синхронизация** — sync блокируется preflight-проверкой, если локальная схема не готова
-
-### Для ценовых администраторов
-- 📈 **Умный расчёт цен** — медиана, взвешенная медиана, среднее
-- 🎯 **Система алертов** — уведомления о популярных компонентах с устаревшими ценами
-- 📉 **Аналитика использования** — какие компоненты востребованы в КП
-- ⚙️ **Гибкие настройки** — периоды расчёта, методы, ручные переопределения
-
-### Индикация актуальности цен
-| Цвет | Статус | Условие |
-|------|--------|---------|
-| 🟢 Зелёный | Свежая | < 30 дней, ≥ 3 источника |
-| 🟡 Жёлтый | Нормальная | 30-60 дней |
-| 🟠 Оранжевый | Устаревающая | 60-90 дней |
-| 🔴 Красный | Устаревшая | > 90 дней или нет данных |
-
-## Технологии
-
-- **Backend:** Go 1.22+, Gin, GORM
-- **Frontend:** HTML, Tailwind CSS, htmx
-- **Database:** SQLite (runtime/local-first), MariaDB 11+ (sync + server admin)
-- **Export:** excelize (XLSX), encoding/csv
-
-## Требования
-
-- Go 1.22 или выше
-- MariaDB 11.x (или MySQL 8.x)
-- ~50 MB дискового пространства
-
-## Установка
-
-### 1. Клонирование репозитория
+## Run
 
 ```bash
-git clone https://github.com/your-company/quoteforge.git
-cd quoteforge
+go run ./cmd/qfs
 ```
 
-### 2. Настройка runtime-конфига (опционально)
-
-`config.yaml` создаётся автоматически при первом старте в той же user-state папке, где находится `qfs.db`.
-Если найден старый формат, приложение автоматически мигрирует файл в актуальный runtime-формат
-(оставляя только используемые секции `server` и `logging`).
-
-При необходимости можно создать/отредактировать файл вручную:
-
-```yaml
-server:
-  host: "0.0.0.0"
-  port: 8080
-  mode: "release"
-
-logging:
-  level: "info"
-  format: "json"
-  output: "stdout"
-```
-
-### 3. Миграции базы данных
+Useful commands:
 
 ```bash
 go run ./cmd/qfs -migrate
+go test ./...
+go vet ./...
+make build-release
 ```
 
-### Мигратор OPS -> проекты (preview/apply)
+On first run the app creates a minimal `config.yaml`, starts on `http://127.0.0.1:8080`, and opens `/setup` if DB credentials were not saved yet.
 
-Переносит квоты, чьи названия начинаются с `OPS-xxxx` (где `x` — цифра), в проект `OPS-xxxx`.
-Если проекта нет, он будет создан; если архивный — реактивирован.
+## Documentation
 
-Сначала всегда смотрите preview:
+- Shared engineering rules: [bible/README.md](bible/README.md)
+- Project architecture: [bible-local/README.md](bible-local/README.md)
+- Release notes: `releases/<version>/RELEASE_NOTES.md`
 
-```bash
-go run ./cmd/migrate_ops_projects
-```
+`bible-local/` is the source of truth for QuoteForge-specific architecture. If code changes behavior, update the matching file there in the same commit.
 
-Применение изменений:
-
-```bash
-go run ./cmd/migrate_ops_projects -apply
-```
-
-Без интерактивного подтверждения:
-
-```bash
-go run ./cmd/migrate_ops_projects -apply -yes
-```
-
-### Права БД для пользователя приложения
-
-#### Полный набор прав для обычного пользователя
-
-Чтобы выдать существующему пользователю все необходимые права (без переоздания):
-
-```sql
--- Справочные таблицы (только чтение)
-GRANT SELECT ON RFQ_LOG.lot TO '<DB_USER>'@'%';
-GRANT SELECT ON RFQ_LOG.qt_lot_metadata TO '<DB_USER>'@'%';
-GRANT SELECT ON RFQ_LOG.qt_categories TO '<DB_USER>'@'%';
-GRANT SELECT ON RFQ_LOG.qt_pricelists TO '<DB_USER>'@'%';
-GRANT SELECT ON RFQ_LOG.qt_pricelist_items TO '<DB_USER>'@'%';
-
--- Таблицы конфигураций и проектов (чтение и запись)
-GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_configurations TO '<DB_USER>'@'%';
-GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_projects TO '<DB_USER>'@'%';
-
--- Таблицы синхронизации (только чтение для миграций, чтение+запись для статуса)
-GRANT SELECT ON RFQ_LOG.qt_client_local_migrations TO '<DB_USER>'@'%';
-GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_client_schema_state TO '<DB_USER>'@'%';
-GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_pricelist_sync_status TO '<DB_USER>'@'%';
-
--- Применить изменения
-FLUSH PRIVILEGES;
-
--- Проверка выданных прав
-SHOW GRANTS FOR '<DB_USER>'@'%';
-```
-
-#### Таблицы и их назначение
-
-| Таблица | Назначение | Права | Примечание |
-|---------|-----------|-------|-----------|
-| `lot` | Справочник компонентов | SELECT | Существующая таблица |
-| `qt_lot_metadata` | Расширенные данные компонентов | SELECT | Метаданные компонентов |
-| `qt_categories` | Категории компонентов | SELECT | Справочник |
-| `qt_pricelists` | Прайслисты | SELECT | Управляется сервером |
-| `qt_pricelist_items` | Позиции прайслистов | SELECT | Управляется сервером |
-| `qt_configurations` | Сохранённые конфигурации | SELECT, INSERT, UPDATE | Основная таблица работы |
-| `qt_projects` | Проекты | SELECT, INSERT, UPDATE | Для группировки конфигураций |
-| `qt_client_local_migrations` | Справочник миграций БД | SELECT | Только чтение (управляется админом) |
-| `qt_client_schema_state` | Состояние локальной схемы | SELECT, INSERT, UPDATE | Отслеживание примененных миграций |
-| `qt_pricelist_sync_status` | Статус синхронизации | SELECT, INSERT, UPDATE | Отслеживание активности синхронизации |
-
-#### При создании нового пользователя
-
-Если нужно создать нового пользователя с нуля:
-
-```sql
--- 1) Создать пользователя
-CREATE USER IF NOT EXISTS 'quote_user'@'%' IDENTIFIED BY '<DB_PASSWORD>';
-
--- 2) Выдать все необходимые права
-GRANT SELECT ON RFQ_LOG.lot TO 'quote_user'@'%';
-GRANT SELECT ON RFQ_LOG.qt_lot_metadata TO 'quote_user'@'%';
-GRANT SELECT ON RFQ_LOG.qt_categories TO 'quote_user'@'%';
-GRANT SELECT ON RFQ_LOG.qt_pricelists TO 'quote_user'@'%';
-GRANT SELECT ON RFQ_LOG.qt_pricelist_items TO 'quote_user'@'%';
-GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_configurations TO 'quote_user'@'%';
-GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_projects TO 'quote_user'@'%';
-GRANT SELECT ON RFQ_LOG.qt_client_local_migrations TO 'quote_user'@'%';
-GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_client_schema_state TO 'quote_user'@'%';
-GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_pricelist_sync_status TO 'quote_user'@'%';
-
--- 3) Применить изменения
-FLUSH PRIVILEGES;
-
--- 4) Проверить права
-SHOW GRANTS FOR 'quote_user'@'%';
-```
-
-#### Важные замечания
-
-- **Таблицы синхронизации** должны быть созданы администратором БД один раз. Приложение не требует прав CREATE TABLE.
-- **Прайслисты** (`qt_pricelists`, `qt_pricelist_items`) — справочные таблицы, управляются сервером, пользователь имеет только SELECT.
-- **Конфигурации и проекты** — таблицы, в которые пишет само приложение (INSERT, UPDATE при сохранении изменений).
-- **Таблицы миграций** нужны для синхронизации: приложение читает список миграций и отчитывается о применённых.
-- Если видите ошибку `Access denied for user ...@'<ip>'`, проверьте наличие конфликтующих записей пользователя с разными хостами (user@localhost vs user@'%').
-
-### 4. Импорт метаданных компонентов
-
-```bash
-go run ./cmd/importer
-```
-
-### 5. Запуск
-
-```bash
-# Development
-go run ./cmd/qfs
-
-# Production (with Makefile - recommended)
-make build-release    # Builds with version info
-./bin/qfs -version    # Check version
-
-# Production (manual)
-VERSION=$(git describe --tags --always --dirty)
-CGO_ENABLED=0 go build -ldflags="-s -w -X main.Version=$VERSION" -o bin/qfs ./cmd/qfs
-./bin/qfs -version
-```
-
-**Makefile команды:**
-```bash
-make build-release   # Оптимизированная сборка с версией
-make build-all       # Сборка для всех платформ (Linux, macOS, Windows)
-make build-windows   # Только для Windows
-make run             # Запуск dev сервера
-make test            # Запуск тестов
-make install-hooks   # Установить git hooks (блокировка коммита с секретами)
-make clean           # Очистка bin/
-make help            # Показать все команды
-```
-
-Приложение будет доступно по адресу: http://localhost:8080
-
-### Локальная SQLite база (state)
-
-Локальная база приложения хранится в профиле пользователя и не зависит от расположения бинарника.
-Имя файла: `qfs.db`.
-
-- macOS: `~/Library/Application Support/QuoteForge/qfs.db`
-- Linux: `$XDG_STATE_HOME/quoteforge/qfs.db` (или `~/.local/state/quoteforge/qfs.db`)
-- Windows: `%LOCALAPPDATA%\\QuoteForge\\qfs.db`
-
-Можно переопределить путь через `-localdb` или переменную окружения `QFS_DB_PATH`.
-
-#### Sync readiness guard
-
-Перед `push/pull` выполняется preflight-проверка:
-- доступен ли сервер (MariaDB);
-- можно ли проверить и применить централизованные миграции локальной БД;
-- подходит ли версия приложения под `min_app_version` миграций.
-
-Если проверка не пройдена:
-- локальная работа (CRUD) продолжается;
-- sync API возвращает `423 Locked` с `reason_code` и `reason_text`;
-- в UI показывается красный индикатор и причина блокировки в модалке синхронизации.
-
-#### Схема потоков данных синхронизации
+## Repository map
 
 ```text
-                          [ SERVER / MariaDB ]
-                     ┌───────────────────────────┐
-                     │ qt_projects               │
-                     │ qt_configurations         │
-                     │ qt_pricelists             │
-                     │ qt_pricelist_items        │
-                     │ qt_pricelist_sync_status  │
-                     └─────────────┬─────────────┘
-                                   │
-                    pull (projects/configs/pricelists)
-                                   │
-                ┌──────────────────┴──────────────────┐
-                │                                     │
-      [ CLIENT A / local SQLite ]           [ CLIENT B / local SQLite ]
-   ┌───────────────────────────────┐       ┌───────────────────────────────┐
-   │ local_projects                │       │ local_projects                │
-   │ local_configurations          │       │ local_configurations          │
-   │ local_pricelists              │       │ local_pricelists              │
-   │ local_pricelist_items         │       │ local_pricelist_items         │
-   │ pending_changes (proj/config) │       │ pending_changes (proj/config) │
-   └───────────────┬───────────────┘       └───────────────┬───────────────┘
-                   │                                       │
-      push (projects/configurations only)     push (projects/configurations only)
-                   │                                       │
-                   └──────────────────┬────────────────────┘
-                                      │
-                              [ SERVER / MariaDB ]
+cmd/                  entry points and migration tools
+internal/             application code
+web/                  templates and static assets
+bible/                shared engineering rules
+bible-local/          project architecture and contracts
+releases/             packaged release artifacts and release notes
+config.example.yaml   runtime config reference
 ```
-
-По сущностям:
-- Конфигурации: `Client <-> Server <-> Other Clients`
-- Проекты: `Client <-> Server <-> Other Clients`
-- Прайслисты: `Server -> Clients only` (локальный push отсутствует)
-- Локальная очистка прайслистов на клиенте: удаляются записи, которых нет на сервере и которые не используются активными локальными конфигурациями
-
-### Версионность конфигураций (local-first)
-
-Для `local_configurations` используется append-only versioning через полные snapshot-версии:
-
-- таблица: `local_configuration_versions`
-- для каждого изменения создаётся новая версия (`version_no = max + 1`)
-- `local_configurations.current_version_id` указывает на активную версию
-- старые версии не изменяются и не удаляются в обычном потоке
-- rollback не "перематывает" историю, а создаёт новую версию из выбранного snapshot
-
-При backfill (миграция `006_add_local_configuration_versions.sql`) для существующих конфигураций создаётся `v1` и проставляется `current_version_id`.
-
-#### Rollback
-
-Rollback выполняется API-методом:
-
-```bash
-POST /api/configs/:uuid/rollback
-{
-  "target_version": 3,
-  "note": "optional"
-}
-```
-
-Результат:
-- создаётся новая версия `vN` с `data` из целевой версии
-- `change_note = "rollback to v{target_version}"` (+ note, если передан)
-- `current_version_id` переключается на новую версию
-- конфигурация уходит в `sync_status = pending`
-
-### Локальный config.yaml
-
-По умолчанию `qfs` ищет `config.yaml` в той же user-state папке, где лежит `qfs.db` (а не рядом с бинарником).
-Если файла нет, он создаётся автоматически. Если формат устарел, он автоматически мигрируется в runtime-формат (`server` + `logging`).
-Можно переопределить путь через `-config` или `QFS_CONFIG_PATH`.
-
-## Docker
-
-```bash
-# Сборка образа
-docker build -t quoteforge .
-
-# Запуск с docker-compose
-docker-compose up -d
-```
-
-## Структура проекта
-
-```
-quoteforge/
-├── cmd/
-│   ├── server/main.go           # Main HTTP server
-│   └── importer/main.go         # Import metadata from lot table
-├── internal/
-│   ├── config/          # Конфигурация
-│   ├── models/          # GORM модели
-│   ├── handlers/        # HTTP handlers
-│   ├── services/        # Бизнес-логика
-│   ├── middleware/      # Auth, CORS, etc.
-│   └── repository/      # Работа с БД
-├── web/
-│   ├── templates/       # HTML шаблоны
-│   └── static/          # CSS, JS, изображения
-├── migrations/          # SQL миграции
-├── config.example.yaml  # Пример конфигурации
-├── releases/
-│   └── memory/         # Changelog между тегами (v1.2.1.md, v1.2.2.md, ...)
-└── go.mod
-```
-
-## Releases & Changelog
-
-Change log между версиями хранится в `releases/memory/` каталоге в файлах вида `v{major}.{minor}.{patch}.md`.
-
-Каждый файл содержит:
-- Список коммитов между версиями
-- Описание изменений и их влияния
-- Breaking changes и заметки о миграции
-
-**Перед работой над кодом проверьте последний файл в этой папке, чтобы понять текущее состояние проекта.**
-
-## Роли пользователей
-
-| Роль | Описание |
-|------|----------|
-| `viewer` | Просмотр, создание квот, экспорт |
-| `editor` | + сохранение конфигураций |
-| `pricing_admin` | + управление ценами и алертами |
-| `admin` | Полный доступ, управление пользователями |
-
-## API
-
-Документация API доступна по адресу `/api/docs` (в разработке).
-
-Основные endpoints:
-
-```
-POST /api/auth/login          # Авторизация
-GET  /api/components          # Список компонентов
-POST /api/quote/calculate     # Расчёт цены
-POST /api/export/xlsx         # Экспорт в Excel
-GET  /api/configs             # Сохранённые конфигурации
-GET  /api/configs/:uuid/versions            # Список версий конфигурации
-GET  /api/configs/:uuid/versions/:version   # Получить конкретную версию
-POST /api/configs/:uuid/rollback            # Rollback на указанную версию
-POST /api/configs/:uuid/reactivate          # Вернуть архивную конфигурацию в активные
-GET  /api/sync/readiness                   # Статус readiness guard (ready|blocked|unknown)
-GET  /api/sync/status                      # Сводный статус синхронизации
-GET  /api/sync/info                        # Данные для модалки синхронизации
-POST /api/sync/push                        # Push pending changes (423, если blocked)
-POST /api/sync/all                         # Full sync push+pull (423, если blocked)
-POST /api/sync/components                  # Pull components (423, если blocked)
-POST /api/sync/pricelists                  # Pull pricelists (423, если blocked)
-```
-
-### Краткая карта sync API
-
-| Endpoint | Назначение | Поток |
-|----------|------------|-------|
-| `POST /api/sync/push` | Отправить локальные pending-изменения | `SQLite -> MariaDB` |
-| `POST /api/sync/components` | Подтянуть справочник компонентов | `MariaDB -> SQLite` |
-| `POST /api/sync/pricelists` | Подтянуть прайслисты и позиции | `MariaDB -> SQLite` |
-| `POST /api/sync/all` | Полный цикл: push + pull + импорт проектов/конфигураций | `двунаправленно` |
-| `GET /api/sync/readiness` | Статус preflight/readiness | `read-only` |
-| `GET /api/sync/status` / `GET /api/sync/info` | Сводка статуса и данных синхронизации | `read-only` |
-
-#### Sync payload для versioning
-
-События в `pending_changes` для конфигураций содержат:
-- `configuration_uuid`
-- `operation` (`create` / `update` / `rollback`)
-- `current_version_id` и `current_version_no`
-- `snapshot` (текущее состояние конфигурации)
-- `idempotency_key` и `conflict_policy` (`last_write_wins`)
-
-Это позволяет push-слою отправлять на сервер актуальное состояние и готовит основу для будущего conflict resolution.
-
-## Разработка
-
-```bash
-# Запуск в режиме разработки (hot reload)
-go run ./cmd/qfs
-
-# Запуск тестов
-go test ./...
-
-# Сборка для Linux
-CGO_ENABLED=0 go build -ldflags="-s -w" -o bin/qfs ./cmd/qfs
-```
-
-## Переменные окружения
-
-| Переменная | Описание | По умолчанию |
-|------------|----------|--------------|
-| `QF_DB_HOST` | Хост базы данных | localhost |
-| `QF_DB_PORT` | Порт базы данных | 3306 |
-| `QF_DB_NAME` | Имя базы данных | RFQ_LOG |
-| `QF_DB_USER` | Пользователь БД | — |
-| `QF_DB_PASSWORD` | Пароль БД | — |
-| `QF_JWT_SECRET` | Секрет для JWT | — |
-| `QF_SERVER_PORT` | Порт сервера | 8080 |
-| `QFS_DB_PATH` | Полный путь к локальной SQLite БД | OS-specific user state dir |
-| `QFS_STATE_DIR` | Каталог state (если `QFS_DB_PATH` не задан) | OS-specific user state dir |
-| `QFS_CONFIG_PATH` | Полный путь к `config.yaml` | OS-specific user state dir |
-
-## Интеграция с существующей БД
-
-QuoteForge интегрируется с существующей базой RFQ_LOG:
-
-- `lot` — справочник компонентов (только чтение)
-- `lot_log` — история цен от поставщиков (только чтение)
-- `supplier` — справочник поставщиков (только чтение)
-
-Новые таблицы QuoteForge имеют префикс `qt_`:
-
-- `qt_users` — пользователи приложения
-- `qt_lot_metadata` — расширенные данные компонентов
-- `qt_configurations` — сохранённые конфигурации
-- `qt_pricing_alerts` — алерты для администраторов
-
-## Поддержка
-
-По вопросам работы приложения обращайтесь:
-- Email: mike@mchus.pro
-- Internal: @mchus
-
-## Лицензия
-
-Данное программное обеспечение является собственностью компании и предназначено исключительно для внутреннего использования. Распространение, копирование или модификация без письменного разрешения запрещены.
-
-См. файл [LICENSE](LICENSE) для подробностей.

bible-local/01-overview.md

@@ -0,0 +1,70 @@
+# 01 - Overview
+
+## Product
+
+QuoteForge is a local-first tool for server configuration, quotation, and project tracking.
+
+Core user flows:
+- create and edit configurations locally;
+- calculate prices from synced pricelists;
+- group configurations into projects and variants;
+- import vendor workspaces and map vendor PNs to internal LOTs;
+- review revision history and roll back safely.
+
+## Runtime model
+
+QuoteForge is a single-user thick client.
+
+Rules:
+- runtime HTTP binds to loopback only;
+- browser requests are treated as part of the same local user session;
+- MariaDB is not a live dependency for normal CRUD;
+- if non-loopback deployment is ever introduced, auth/RBAC must be added first.
+
+## Product scope
+
+In scope:
+- configurator and quote calculation;
+- projects, variants, and configuration ordering;
+- local revision history;
+- read-only pricelist browsing from SQLite cache;
+- background sync with MariaDB;
+- rotating local backups.
+
+Out of scope and intentionally removed:
+- admin pricing UI/API;
+- alerts and notification workflows;
+- stock import tooling;
+- cron jobs and importer utilities.
+
+## Tech stack
+
+| Layer | Stack |
+| --- | --- |
+| Backend | Go, Gin, GORM |
+| Frontend | HTML templates, htmx, Tailwind CSS |
+| Local storage | SQLite |
+| Sync transport | MariaDB |
+| Export | CSV and XLSX generation |
+
+## Repository map
+
+```text
+cmd/
+  qfs/                   main HTTP runtime
+  migrate/               server migration tool
+  migrate_ops_projects/  OPS project migration helper
+internal/
+  appstate/              backup and runtime state
+  config/                runtime config parsing
+  handlers/              HTTP handlers
+  localdb/               SQLite models and migrations
+  repository/            repositories
+  services/              business logic and sync
+web/
+  templates/             HTML templates
+  static/                static assets
+bible/                   shared engineering rules
+bible-local/             project-specific architecture
+releases/                release artifacts and notes
+```

bible-local/02-architecture.md

@@ -0,0 +1,149 @@
+# 02 - Architecture
+
+## Local-first rule
+
+SQLite is the runtime source of truth.
+MariaDB is sync transport plus setup and migration tooling.
+
+```text
+browser -> Gin handlers -> SQLite
+                        -> pending_changes
+background sync <------> MariaDB
+```
+
+Rules:
+- user CRUD must continue when MariaDB is offline;
+- runtime handlers and pages must read and write SQLite only;
+- MariaDB access in runtime code is allowed only inside sync and setup flows;
+- no live MariaDB fallback for reads that already exist in local cache.
+
+## Sync contract
+
+Bidirectional:
+- projects;
+- configurations;
+- `vendor_spec`;
+- pending change metadata.
+
+Pull-only:
+- components;
+- pricelists and pricelist items;
+- partnumber books and partnumber book items.
+
+Readiness guard:
+- every sync push/pull runs a preflight check;
+- blocked sync returns `423 Locked` with a machine-readable reason;
+- local work continues even when sync is blocked.
+- sync metadata updates must preserve project `updated_at`; sync time belongs in `synced_at`, not in the user-facing last-modified timestamp.
+- pricelist pull must persist a new local snapshot atomically: header and items appear together, and `last_pricelist_sync` advances only after item download succeeds.
+- UI sync status must distinguish "last sync failed" from "up to date"; if the app can prove newer server pricelist data exists, the indicator must say local cache is incomplete.
+
+## Pricing contract
+
+Prices come only from `local_pricelist_items`.
+
+Rules:
+- `local_components` is metadata-only;
+- quote calculation must not read prices from components;
+- latest pricelist selection ignores snapshots without items;
+- auto pricelist mode stays auto and must not be persisted as an explicit resolved ID.
+
+## Pricing tab layout
+
+The Pricing tab (Ценообразование) has two tables: Buy (Цена покупки) and Sale (Цена продажи).
+
+Column order (both tables):
+
+```
+PN вендора | Описание | LOT | Кол-во | Estimate | Склад | Конкуренты | Ручная цена
+```
+
+Per-LOT row expansion rules:
+- each `lot_mappings` entry in a BOM row becomes its own table row with its own quantity and prices;
+- `baseLot` (resolved LOT without an explicit mapping) is treated as the first sub-row with `quantity_per_pn` from `_getRowLotQtyPerPN`;
+- when one vendor PN expands into N LOT sub-rows, PN вендора and Описание cells use `rowspan="N"` and appear only on the first sub-row;
+- a visual top border (`border-t border-gray-200`) separates each vendor PN group.
+
+Vendor price attachment:
+- `vendorOrig` and `vendorOrigUnit` (BOM unit/total price) are attached to the first LOT sub-row only;
+- subsequent sub-rows carry empty `data-vendor-orig` so `setPricingCustomPriceFromVendor` counts each vendor PN exactly once.
+
+Controls terminology:
+- custom price input is labeled **Ручная цена** (not "Своя цена");
+- the button that fills custom price from BOM totals is labeled **BOM Цена** (not "Проставить цены BOM").
+
+CSV export reads PN вендора, Описание, and LOT from `data-vendor-pn`, `data-desc`, `data-lot` row attributes to bypass the rowspan cell offset problem.
+
+## Configuration versioning
+
+Configuration revisions are append-only snapshots stored in `local_configuration_versions`.
+
+Rules:
+- the editable working configuration is always the implicit head named `main`; UI must not switch the user to a numbered revision after save;
+- create a new revision when spec, BOM, or pricing content changes;
+- revision history is retrospective: the revisions page shows past snapshots, not the current `main` state;
+- rollback creates a new head revision from an old snapshot;
+- rename, reorder, project move, and similar operational edits do not create a new revision snapshot;
+- revision deduplication includes `items`, `server_count`, `total_price`, `custom_price`, `vendor_spec`, pricelist selectors, `disable_price_refresh`, and `only_in_stock`;
+- BOM updates must use version-aware save flow, not a direct SQL field update;
+- current revision pointer must be recoverable if legacy or damaged rows are found locally.
+
+## Sync UX
+
+UI-facing sync status must never block on live MariaDB calls.
+
+Rules:
+- navbar sync indicator and sync info modal read only local cached state from SQLite/app settings;
+- background/manual sync may talk to MariaDB, but polling endpoints must stay fast even on slow or broken connections;
+- any MariaDB timeout/invalid-connection during sync must invalidate the cached remote handle immediately so UI stops treating the connection as healthy.
+
+## Naming collisions
+
+UI-driven rename and copy flows use one suffix convention for conflicts.
+
+Rules:
+- configuration and variant names must auto-resolve collisions with `_копия`, then `_копия2`, `_копия3`, and so on;
+- copy checkboxes and copy modals must prefill `_копия`, not ` (копия)`;
+- the literal variant name `main` is reserved and must not be allowed for non-main variants.
+
+## Configuration types
+
+Configurations have a `config_type` field: `"server"` (default) or `"storage"`.
+
+Rules:
+- `config_type` defaults to `"server"` for all existing and new configurations unless explicitly set;
+- the configurator page is shared for both types; the SW tab is always visible regardless of type;
+- storage configurations use the same vendor_spec + PN→LOT + pricing flow as server configurations;
+- storage component categories map to existing tabs: `ENC`/`DKC`/`CTL` → Base, `HIC` → PCI (HIC-карты СХД; `HBA`/`NIC` — серверные, не смешивать), `SSD`/`HDD` → Storage (используют существующие серверные LOT), `ACC` → Accessories (используют существующие серверные LOT), `SW` → SW.
+- `DKC` = контроллерная полка (модель СХД + тип дисков + кол-во слотов + кол-во контроллеров); `CTL` = контроллер (кэш + встроенные порты); `ENC` = дисковая полка без контроллера.
+- the available config types and their localized names flow from `qt_settings.config_types` on the server;
+  QF falls back to hardcoded "server/Сервер" and "storage/СХД" when the setting is absent.
+
+## Server-driven configurator settings (`qt_settings`)
+
+QF reads four settings from `qt_settings` (MariaDB) and caches them in `local_qt_settings` (SQLite).
+They are synced during every component sync. See `bible-local/server-contract-qt-settings.md` for the
+full contract and JSON schemas.
+
+| Setting key | Effect in QF |
+|-------------|-------------|
+| `config_types` | New-config modal buttons; category allowlist per config type |
+| `tab_config` | Configurator tab structure, sections, singleSelect |
+| `always_visible_tabs` | Which tabs are shown even when empty |
+| `required_categories` | Per-config-type badge on tabs with unfilled required categories |
+
+Rules:
+- sync runs after `SyncComponents`; failure is non-fatal (Warn log only);
+- `local_qt_settings` is a read-only cache — never written by user actions;
+- absent or unparseable settings: QF uses hardcoded fallbacks for that key only;
+- `config_types[].categories` is an allowlist: a category absent from all types is shown everywhere;
+- `qt_categories.name` and `qt_categories.name_ru` are not used by QF runtime; do not depend on them.
+
+## Vendor BOM contract
+
+Vendor BOM is stored in `vendor_spec` on the configuration row.
+
+Rules:
+- PN to LOT resolution uses the active local partnumber book;
+- canonical persisted mapping is `lot_mappings[]`;
+- QuoteForge does not use legacy BOM tables such as `qt_bom`, `qt_lot_bundles`, or `qt_lot_bundle_items`.

bible-local/03-database.md

@@ -0,0 +1,420 @@
+# 03 - Database
+
+## SQLite
+
+SQLite is the local runtime database.
+
+Main tables:
+
+| Table | Purpose |
+| --- | --- |
+| `local_components` | synced component metadata |
+| `local_pricelists` | local pricelist headers |
+| `local_pricelist_items` | local pricelist rows, the only runtime price source |
+| `local_projects` | user projects |
+| `local_configurations` | user configurations |
+| `local_configuration_versions` | immutable revision snapshots |
+| `local_partnumber_books` | partnumber book headers |
+| `local_partnumber_book_items` | PN -> LOT catalog payload |
+| `pending_changes` | sync queue |
+| `connection_settings` | encrypted MariaDB connection settings |
+| `app_settings` | local app state |
+| `local_schema_migrations` | applied local migration markers |
+| `local_qt_settings` | server-pushed configurator settings cache (from `qt_settings`) |
+
+Rules:
+- cache tables may be rebuilt if local migration recovery requires it;
+- user-authored tables must not be dropped as a recovery shortcut;
+- `local_pricelist_items` is the only valid runtime source of prices;
+- configuration `items` and `vendor_spec` are stored as JSON payloads inside configuration rows.
+
+## MariaDB
+
+MariaDB is the central sync database (`RFQ_LOG`). Final schema as of 2026-04-15.
+
+### QuoteForge tables (qt_*)
+
+Runtime read:
+- `qt_categories` — pricelist categories (note: `name`/`name_ru` columns being removed; QF does not use them)
+- `qt_lot_metadata` — component metadata, price settings
+- `qt_pricelists` — pricelist headers (source: estimate / warehouse / competitor)
+- `qt_pricelist_items` — pricelist rows
+- `qt_partnumber_books` — partnumber book headers
+- `qt_partnumber_book_items` — PN→LOT catalog payload
+- `qt_settings` — server-pushed configurator settings; schema managed by server-side agent (see `bible-local/server-contract-qt-settings.md`)
+
+Runtime read/write:
+- `qt_projects` — projects
+- `qt_configurations` — configurations
+- `qt_client_schema_state` — per-client sync status and version tracking
+- `qt_pricelist_sync_status` — pricelist sync timestamps per user
+
+Insert-only tracking:
+- `qt_vendor_partnumber_seen` — vendor partnumbers encountered during sync; `lot_suggestion` column updated when user manually maps PN → LOT in vendor-spec UI
+
+Server-side only (not queried by client runtime):
+- `qt_component_usage_stats` — aggregated component popularity stats (written by server jobs)
+- `qt_pricing_alerts` — price anomaly alerts (models exist in Go; feature disabled in runtime)
+- `qt_schema_migrations` — server migration history (applied via `go run ./cmd/qfs -migrate`)
+- `qt_scheduler_runs` — server background job tracking (no Go code references it in this repo)
+
+### Competitor subsystem (server-side only, not used by QuoteForge Go code)
+
+- `qt_competitors` — competitor registry
+- `partnumber_log_competitors` — competitor price log (FK → qt_competitors)
+
+These tables exist in the schema and are maintained by another tool or workflow.
+QuoteForge references competitor pricelists only via `qt_pricelists` (source='competitor').
+
+### Legacy RFQ tables (pre-QuoteForge, no Go code references)
+
+- `lot` — original component registry (data preserved; superseded by `qt_lot_metadata`)
+- `lot_log` — original supplier price log
+- `supplier` — supplier registry (FK target for lot_log and machine_log)
+- `machine` — device model registry
+- `machine_log` — device price/quote log
+- `parts_log` — supplier partnumber log used by server-side import/pricing workflows, not by QuoteForge runtime
+
+These tables are retained for historical data. QuoteForge does not read or write them at runtime.
+
+Rules:
+- QuoteForge runtime must not depend on any legacy RFQ tables;
+- QuoteForge sync reads prices and categories from `qt_pricelists` / `qt_pricelist_items` only;
+- QuoteForge does not enrich local pricelist rows from `parts_log` or any other raw supplier log table;
+- normal UI requests must not query MariaDB tables directly;
+- `qt_client_local_migrations` exists in the 2026-04-15 schema dump, but runtime sync does not depend on it.
+
+## MariaDB Table Structures
+
+Full column reference as of 2026-03-21 (`RFQ_LOG` final schema).
+
+### qt_categories
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| code | varchar(20) UNIQUE NOT NULL | |
+| name | varchar(100) NOT NULL | being removed; QF does not use at runtime |
+| name_ru | varchar(100) | being removed; QF does not use at runtime |
+| display_order | bigint DEFAULT 0 | |
+| is_required | tinyint(1) DEFAULT 0 | |
+
+### qt_settings
+Managed by the server-side agent. QF has SELECT-only access.
+See `bible-local/server-contract-qt-settings.md` for full schema and value formats.
+| Column | Type | Notes |
+|--------|------|-------|
+| name | varchar(100) PK | setting key |
+| value | TEXT NOT NULL | JSON-encoded value |
+
+### local_qt_settings (SQLite)
+Read-only cache of `qt_settings`. Synced during component sync.
+| Column | Type | Notes |
+|--------|------|-------|
+| name | text PK | setting key |
+| value | text | JSON value as-is from server |
+
+### qt_client_schema_state
+PK: (username, hostname)
+| Column | Type | Notes |
+|--------|------|-------|
+| username | varchar(100) | |
+| hostname | varchar(255) DEFAULT '' | |
+| last_applied_migration_id | varchar(128) | |
+| app_version | varchar(64) | |
+| last_sync_at | datetime | |
+| last_sync_status | varchar(32) | |
+| pending_changes_count | int DEFAULT 0 | |
+| pending_errors_count | int DEFAULT 0 | |
+| configurations_count | int DEFAULT 0 | |
+| projects_count | int DEFAULT 0 | |
+| estimate_pricelist_version | varchar(128) | |
+| warehouse_pricelist_version | varchar(128) | |
+| competitor_pricelist_version | varchar(128) | |
+| last_sync_error_code | varchar(128) | |
+| last_sync_error_text | text | |
+| last_checked_at | datetime NOT NULL | |
+| updated_at | datetime NOT NULL | |
+
+### qt_component_usage_stats
+PK: lot_name
+| Column | Type | Notes |
+|--------|------|-------|
+| lot_name | varchar(255) | |
+| quotes_total | bigint DEFAULT 0 | |
+| quotes_last30d | bigint DEFAULT 0 | |
+| quotes_last7d | bigint DEFAULT 0 | |
+| total_quantity | bigint DEFAULT 0 | |
+| total_revenue | decimal(14,2) DEFAULT 0 | |
+| trend_direction | enum('up','stable','down') DEFAULT 'stable' | |
+| trend_percent | decimal(5,2) DEFAULT 0 | |
+| last_used_at | datetime(3) | |
+
+### qt_competitors
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| name | varchar(255) NOT NULL | |
+| code | varchar(100) UNIQUE NOT NULL | |
+| delivery_basis | varchar(50) DEFAULT 'DDP' | |
+| currency | varchar(10) DEFAULT 'USD' | |
+| column_mapping | longtext JSON | |
+| is_active | tinyint(1) DEFAULT 1 | |
+| created_at | timestamp | |
+| updated_at | timestamp ON UPDATE | |
+| price_uplift | decimal(8,4) DEFAULT 1.3 | effective_price = price / price_uplift |
+
+### qt_configurations
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| uuid | varchar(36) UNIQUE NOT NULL | |
+| user_id | bigint UNSIGNED | |
+| owner_username | varchar(100) NOT NULL | |
+| app_version | varchar(64) | |
+| project_uuid | char(36) | FK → qt_projects.uuid ON DELETE SET NULL |
+| name | varchar(200) NOT NULL | |
+| items | longtext JSON NOT NULL | component list |
+| total_price | decimal(12,2) | |
+| notes | text | |
+| is_template | tinyint(1) DEFAULT 0 | |
+| created_at | datetime(3) | |
+| custom_price | decimal(12,2) | |
+| server_count | bigint DEFAULT 1 | |
+| server_model | varchar(100) | |
+| support_code | varchar(20) | |
+| article | varchar(80) | |
+| pricelist_id | bigint UNSIGNED | FK → qt_pricelists.id |
+| warehouse_pricelist_id | bigint UNSIGNED | FK → qt_pricelists.id |
+| competitor_pricelist_id | bigint UNSIGNED | FK → qt_pricelists.id |
+| disable_price_refresh | tinyint(1) DEFAULT 0 | |
+| only_in_stock | tinyint(1) DEFAULT 0 | |
+| line_no | int | position within project |
+| price_updated_at | timestamp | |
+| vendor_spec | longtext JSON | |
+
+### qt_lot_metadata
+PK: lot_name
+| Column | Type | Notes |
+|--------|------|-------|
+| lot_name | varchar(255) | |
+| category_id | bigint UNSIGNED | FK → qt_categories.id |
+| vendor | varchar(50) | |
+| model | varchar(100) | |
+| specs | longtext JSON | |
+| current_price | decimal(12,2) | cached computed price |
+| price_method | enum('manual','median','average','weighted_median') DEFAULT 'median' | |
+| price_period_days | bigint DEFAULT 90 | |
+| price_updated_at | datetime(3) | |
+| request_count | bigint DEFAULT 0 | |
+| last_request_date | date | |
+| popularity_score | decimal(10,4) DEFAULT 0 | |
+| price_coefficient | decimal(5,2) DEFAULT 0 | markup % |
+| manual_price | decimal(12,2) | |
+| meta_prices | varchar(1000) | raw price samples JSON |
+| meta_method | varchar(20) | method used for last compute |
+| meta_period_days | bigint DEFAULT 90 | |
+| is_hidden | tinyint(1) DEFAULT 0 | |
+
+### qt_partnumber_books
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| version | varchar(30) UNIQUE NOT NULL | |
+| created_at | timestamp | |
+| created_by | varchar(100) | |
+| is_active | tinyint(1) DEFAULT 0 | only one active at a time |
+| partnumbers_json | longtext DEFAULT '[]' | flat list of partnumbers |
+
+### qt_partnumber_book_items
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| partnumber | varchar(255) UNIQUE NOT NULL | |
+| lots_json | longtext NOT NULL | JSON array of lot_names |
+| description | varchar(10000) | |
+
+### qt_pricelists
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| source | varchar(20) DEFAULT 'estimate' | 'estimate' / 'warehouse' / 'competitor' |
+| version | varchar(20) NOT NULL | UNIQUE with source |
+| created_at | datetime(3) | |
+| created_by | varchar(100) | |
+| is_active | tinyint(1) DEFAULT 1 | |
+| usage_count | bigint DEFAULT 0 | |
+| expires_at | datetime(3) | |
+| notification | varchar(500) | shown to clients on sync |
+
+### qt_pricelist_items
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| pricelist_id | bigint UNSIGNED NOT NULL | FK → qt_pricelists.id |
+| lot_name | varchar(255) NOT NULL | INDEX with pricelist_id |
+| lot_category | varchar(50) | |
+| price | decimal(12,2) NOT NULL | |
+| price_method | varchar(20) | |
+| price_period_days | bigint DEFAULT 90 | |
+| price_coefficient | decimal(5,2) DEFAULT 0 | |
+| manual_price | decimal(12,2) | |
+| meta_prices | varchar(1000) | |
+
+### qt_pricelist_sync_status
+PK: username
+| Column | Type | Notes |
+|--------|------|-------|
+| username | varchar(100) | |
+| last_sync_at | datetime NOT NULL | |
+| updated_at | datetime NOT NULL | |
+| app_version | varchar(64) | |
+
+### qt_pricing_alerts
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| lot_name | varchar(255) NOT NULL | |
+| alert_type | enum('high_demand_stale_price','price_spike','price_drop','no_recent_quotes','trending_no_price') | |
+| severity | enum('low','medium','high','critical') DEFAULT 'medium' | |
+| message | text NOT NULL | |
+| details | longtext JSON | |
+| status | enum('new','acknowledged','resolved','ignored') DEFAULT 'new' | |
+| created_at | datetime(3) | |
+
+### qt_projects
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| uuid | char(36) UNIQUE NOT NULL | |
+| owner_username | varchar(100) NOT NULL | |
+| code | varchar(100) NOT NULL | UNIQUE with variant |
+| variant | varchar(100) DEFAULT '' | UNIQUE with code |
+| name | varchar(200) | |
+| tracker_url | varchar(500) | |
+| is_active | tinyint(1) DEFAULT 1 | |
+| is_system | tinyint(1) DEFAULT 0 | |
+| created_at | timestamp | |
+| updated_at | timestamp ON UPDATE | |
+
+### qt_schema_migrations
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| filename | varchar(255) UNIQUE NOT NULL | |
+| applied_at | datetime(3) | |
+
+### qt_scheduler_runs
+PK: job_name
+| Column | Type | Notes |
+|--------|------|-------|
+| job_name | varchar(100) | |
+| last_started_at | datetime | |
+| last_finished_at | datetime | |
+| last_status | varchar(20) DEFAULT 'idle' | |
+| last_error | text | |
+| updated_at | timestamp ON UPDATE | |
+
+### qt_vendor_partnumber_seen
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| source_type | varchar(32) NOT NULL | |
+| vendor | varchar(255) DEFAULT '' | |
+| partnumber | varchar(255) UNIQUE NOT NULL | |
+| description | varchar(10000) | |
+| last_seen_at | datetime(3) NOT NULL | |
+| is_ignored | tinyint(1) DEFAULT 0 | |
+| is_pattern | tinyint(1) DEFAULT 0 | |
+| ignored_at | datetime(3) | |
+| ignored_by | varchar(100) | |
+| created_at | datetime(3) | |
+| updated_at | datetime(3) | |
+| lot_suggestion | longtext (JSON) | nullable; set when user manually maps PN → LOT in vendor-spec UI; same format as `qt_partnumber_book_items.lots_json`; see [11-lot-suggestions.md](11-lot-suggestions.md) |
+
+### stock_ignore_rules
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| target | varchar(20) NOT NULL | UNIQUE with match_type+pattern |
+| match_type | varchar(20) NOT NULL | |
+| pattern | varchar(500) NOT NULL | |
+| created_at | timestamp | |
+
+### stock_log
+| Column | Type | Notes |
+|--------|------|-------|
+| stock_log_id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| partnumber | varchar(255) NOT NULL | INDEX with date |
+| supplier | varchar(255) | |
+| date | date NOT NULL | |
+| price | decimal(12,2) NOT NULL | |
+| quality | varchar(255) | |
+| comments | text | |
+| vendor | varchar(255) | INDEX |
+| qty | decimal(14,3) | |
+
+### partnumber_log_competitors
+| Column | Type | Notes |
+|--------|------|-------|
+| id | bigint UNSIGNED PK AUTO_INCREMENT | |
+| competitor_id | bigint UNSIGNED NOT NULL | FK → qt_competitors.id |
+| partnumber | varchar(255) NOT NULL | |
+| description | varchar(500) | |
+| vendor | varchar(255) | |
+| price | decimal(12,2) NOT NULL | |
+| price_loccur | decimal(12,2) | local currency price |
+| currency | varchar(10) | |
+| qty | decimal(12,4) DEFAULT 1 | |
+| date | date NOT NULL | |
+| created_at | timestamp | |
+
+### Legacy tables (lot / lot_log / machine / machine_log / supplier)
+
+Retained for historical data only. Not queried by QuoteForge.
+
+**lot**: lot_name (PK, char 255), lot_category, lot_description
+**lot_log**: lot_log_id AUTO_INCREMENT, lot (FK→lot), supplier (FK→supplier), date, price double, quality, comments
+**supplier**: supplier_name (PK, char 255), supplier_comment
+**machine**: machine_name (PK, char 255), machine_description
+**machine_log**: machine_log_id AUTO_INCREMENT, date, supplier (FK→supplier), country, opty, type, machine (FK→machine), customer_requirement, variant, price_gpl, price_estimate, qty, quality, carepack, lead_time_weeks, prepayment_percent, price_got, Comment
+
+## MariaDB User Permissions
+
+The application user needs read-only access to reference tables and read/write access to runtime tables.
+
+```sql
+-- Read-only: reference and pricing data
+GRANT SELECT ON RFQ_LOG.qt_categories            TO 'qfs_user'@'%';
+GRANT SELECT ON RFQ_LOG.qt_lot_metadata          TO 'qfs_user'@'%';
+GRANT SELECT ON RFQ_LOG.qt_pricelists            TO 'qfs_user'@'%';
+GRANT SELECT ON RFQ_LOG.qt_pricelist_items       TO 'qfs_user'@'%';
+GRANT SELECT ON RFQ_LOG.qt_partnumber_books      TO 'qfs_user'@'%';
+GRANT SELECT ON RFQ_LOG.qt_partnumber_book_items TO 'qfs_user'@'%';
+GRANT SELECT ON RFQ_LOG.lot                      TO 'qfs_user'@'%';
+
+-- Read/write: runtime sync and user data
+GRANT SELECT, INSERT, UPDATE, DELETE ON RFQ_LOG.qt_projects              TO 'qfs_user'@'%';
+GRANT SELECT, INSERT, UPDATE, DELETE ON RFQ_LOG.qt_configurations        TO 'qfs_user'@'%';
+GRANT SELECT, INSERT, UPDATE         ON RFQ_LOG.qt_client_schema_state   TO 'qfs_user'@'%';
+GRANT SELECT, INSERT, UPDATE         ON RFQ_LOG.qt_vendor_partnumber_seen TO 'qfs_user'@'%';
+
+FLUSH PRIVILEGES;
+```
+
+Rules:
+- `qt_client_schema_state` requires INSERT + UPDATE for sync status tracking (uses `ON DUPLICATE KEY UPDATE`);
+- `qt_vendor_partnumber_seen` requires INSERT + UPDATE (vendor PN discovery during sync);
+- no DELETE is needed on sync/tracking tables — rows are never removed by the client;
+- `lot` SELECT is required for the connection validation probe in `/setup`;
+- the setup page shows `can_write: true` only when `qt_client_schema_state` INSERT succeeds.
+
+## Migrations
+
+SQLite:
+- schema creation and additive changes go through GORM `AutoMigrate`;
+- data fixes, index repair, and one-off rewrites go through `runLocalMigrations`;
+- local migration state is tracked in `local_schema_migrations`.
+
+MariaDB:
+- SQL files live in `migrations/`;
+- they are applied by `go run ./cmd/qfs -migrate`.

bible-local/04-api.md

@@ -0,0 +1,125 @@
+# 04 - API
+
+## Public web routes
+
+| Route | Purpose |
+| --- | --- |
+| `/` | configurator |
+| `/configs` | configuration list |
+| `/configs/:uuid/revisions` | revision history page |
+| `/projects` | project list |
+| `/projects/:uuid` | project detail |
+| `/pricelists` | pricelist list |
+| `/pricelists/:id` | pricelist detail |
+| `/partnumber-books` | partnumber book page |
+| `/setup` | DB setup page |
+
+## Setup and health
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `GET` | `/health` | process health |
+| `GET` | `/setup` | setup page |
+| `POST` | `/setup` | save tested DB settings |
+| `POST` | `/setup/test` | test DB connection |
+| `GET` | `/setup/status` | setup status |
+| `GET` | `/api/db-status` | current DB/sync status |
+| `GET` | `/api/current-user` | local user identity |
+| `GET` | `/api/ping` | lightweight API ping |
+
+`POST /api/restart` exists only in `debug` mode.
+
+## Reference data
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `GET` | `/api/components` | list component metadata |
+| `GET` | `/api/components/:lot_name` | one component |
+| `GET` | `/api/categories` | list categories |
+| `GET` | `/api/pricelists` | list local pricelists |
+| `GET` | `/api/pricelists/latest` | latest pricelist by source |
+| `GET` | `/api/pricelists/:id` | pricelist header |
+| `GET` | `/api/pricelists/:id/items` | pricelist rows |
+| `GET` | `/api/pricelists/:id/lots` | lot names in a pricelist |
+| `GET` | `/api/partnumber-books` | local partnumber books |
+| `GET` | `/api/partnumber-books/:id` | book items by `server_id` |
+
+## Quote and export
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `POST` | `/api/quote/validate` | validate config items |
+| `POST` | `/api/quote/calculate` | calculate quote totals |
+| `POST` | `/api/quote/price-levels` | resolve estimate/warehouse/competitor prices |
+| `POST` | `/api/export/csv` | export a single configuration |
+| `GET` | `/api/configs/:uuid/export` | export a stored configuration |
+| `GET` | `/api/projects/:uuid/export` | legacy project BOM export |
+| `POST` | `/api/projects/:uuid/export` | pricing-tab project export |
+
+## Configurations
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `GET` | `/api/configs` | list configurations |
+| `POST` | `/api/configs/import` | import configurations from server |
+| `POST` | `/api/configs` | create configuration |
+| `POST` | `/api/configs/preview-article` | preview article |
+| `GET` | `/api/configs/:uuid` | get configuration |
+| `PUT` | `/api/configs/:uuid` | update configuration |
+| `DELETE` | `/api/configs/:uuid` | archive configuration |
+| `POST` | `/api/configs/:uuid/reactivate` | reactivate configuration |
+| `PATCH` | `/api/configs/:uuid/rename` | rename configuration |
+| `POST` | `/api/configs/:uuid/clone` | clone configuration |
+| `POST` | `/api/configs/:uuid/refresh-prices` | refresh prices |
+| `PATCH` | `/api/configs/:uuid/project` | move configuration to project |
+| `GET` | `/api/configs/:uuid/versions` | list revisions |
+| `GET` | `/api/configs/:uuid/versions/:version` | get one revision |
+| `POST` | `/api/configs/:uuid/rollback` | rollback by creating a new head revision |
+| `PATCH` | `/api/configs/:uuid/server-count` | update server count |
+| `GET` | `/api/configs/:uuid/vendor-spec` | read vendor BOM |
+| `PUT` | `/api/configs/:uuid/vendor-spec` | replace vendor BOM |
+| `POST` | `/api/configs/:uuid/vendor-spec/resolve` | resolve PN -> LOT |
+| `POST` | `/api/configs/:uuid/vendor-spec/apply` | apply BOM to cart |
+
+## Projects
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `GET` | `/api/projects` | paginated project list |
+| `GET` | `/api/projects/all` | lightweight list for dropdowns |
+| `POST` | `/api/projects` | create project |
+| `GET` | `/api/projects/:uuid` | get project |
+| `PUT` | `/api/projects/:uuid` | update project |
+| `POST` | `/api/projects/:uuid/archive` | archive project |
+| `POST` | `/api/projects/:uuid/reactivate` | reactivate project |
+| `DELETE` | `/api/projects/:uuid` | delete project variant only |
+| `GET` | `/api/projects/:uuid/configs` | list project configurations |
+| `PATCH` | `/api/projects/:uuid/configs/reorder` | persist line order |
+| `POST` | `/api/projects/:uuid/configs` | create configuration inside project |
+| `POST` | `/api/projects/:uuid/configs/:config_uuid/clone` | clone config into project |
+| `POST` | `/api/projects/:uuid/vendor-import` | import CFXML workspace into project |
+
+Vendor import contract:
+- multipart field name is `file`;
+- file limit is `1 GiB`;
+- oversized payloads are rejected before XML parsing.
+
+## Sync
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `GET` | `/api/sync/status` | sync status |
+| `GET` | `/api/sync/readiness` | sync readiness |
+| `GET` | `/api/sync/info` | sync modal data |
+| `GET` | `/api/sync/users-status` | remote user status |
+| `GET` | `/api/sync/pending/count` | pending queue count |
+| `GET` | `/api/sync/pending` | pending queue rows |
+| `POST` | `/api/sync/components` | pull components |
+| `POST` | `/api/sync/pricelists` | pull pricelists |
+| `POST` | `/api/sync/partnumber-books` | pull partnumber books |
+| `POST` | `/api/sync/partnumber-seen` | report unresolved vendor PN |
+| `POST` | `/api/sync/all` | push and pull full sync |
+| `POST` | `/api/sync/push` | push pending changes |
+| `POST` | `/api/sync/repair` | repair broken pending rows |
+
+When readiness is blocked, sync write endpoints return `423 Locked`.

bible-local/05-config.md

@@ -0,0 +1,74 @@
+# 05 - Config
+
+## Runtime files
+
+| Artifact | Default location |
+| --- | --- |
+| `qfs.db` | OS-specific user state directory |
+| `config.yaml` | same state directory as `qfs.db` |
+| `local_encryption.key` | same state directory as `qfs.db` |
+| `backups/` | next to `qfs.db` unless overridden |
+
+The runtime state directory can be overridden with `QFS_STATE_DIR`.
+Direct paths can be overridden with `QFS_DB_PATH` and `QFS_CONFIG_PATH`.
+
+## Runtime config shape
+
+Runtime keeps `config.yaml` intentionally small:
+
+```yaml
+server:
+  host: "127.0.0.1"
+  port: 8080
+  mode: "release"
+  read_timeout: 30s
+  write_timeout: 30s
+
+backup:
+  time: "00:00"
+
+logging:
+  level: "info"
+  format: "json"
+  output: "stdout"
+```
+
+Rules:
+- QuoteForge creates this file automatically if it does not exist;
+- startup rewrites legacy config files into this minimal runtime shape;
+- startup normalizes any `server.host` value to `127.0.0.1` before saving the runtime config;
+- `server.host` must stay on loopback.
+
+Saved MariaDB credentials do not live in `config.yaml`.
+They are stored in SQLite and encrypted with `local_encryption.key` unless `QUOTEFORGE_ENCRYPTION_KEY` overrides the key material.
+
+## Environment variables
+
+| Variable | Purpose |
+| --- | --- |
+| `QFS_STATE_DIR` | override runtime state directory |
+| `QFS_DB_PATH` | explicit SQLite path |
+| `QFS_CONFIG_PATH` | explicit config path |
+| `QFS_BACKUP_DIR` | explicit backup root |
+| `QFS_BACKUP_DISABLE` | disable rotating backups |
+| `QUOTEFORGE_ENCRYPTION_KEY` | override encryption key |
+| `QF_SERVER_PORT` | override HTTP port |
+
+`QFS_BACKUP_DISABLE` accepts `1`, `true`, or `yes`.
+
+## CLI flags
+
+| Flag | Purpose |
+| --- | --- |
+| `-config <path>` | config file path |
+| `-localdb <path>` | SQLite path |
+| `-reset-localdb` | destructive local DB reset |
+| `-migrate` | apply server migrations and exit |
+| `-version` | print app version and exit |
+
+## First run
+
+1. runtime ensures `config.yaml` exists;
+2. runtime opens the local SQLite database;
+3. if no stored MariaDB credentials exist, `/setup` is served;
+4. after setup, runtime works locally and sync uses saved DB settings in the background.

bible-local/06-backup.md

@@ -0,0 +1,55 @@
+# 06 - Backup
+
+## Scope
+
+QuoteForge creates rotating local ZIP backups of:
+- a consistent SQLite snapshot saved as `qfs.db`;
+- `config.yaml` when present.
+
+The backup intentionally does not include `local_encryption.key`.
+
+## Location and naming
+
+Default root:
+- `<db dir>/backups`
+
+Subdirectories:
+- `daily/`
+- `weekly/`
+- `monthly/`
+- `yearly/`
+
+Archive name:
+- `qfs-backp-YYYY-MM-DD.zip`
+
+## Retention
+
+| Period | Keep |
+| --- | --- |
+| Daily | 7 |
+| Weekly | 4 |
+| Monthly | 12 |
+| Yearly | 10 |
+
+## Behavior
+
+- on startup, QuoteForge creates a backup if the current period has none yet;
+- a daily scheduler creates the next backup at `backup.time`;
+- duplicate snapshots inside the same period are prevented by a period marker file;
+- old archives are pruned automatically.
+
+## Safety rules
+
+- backup root must be outside the git worktree;
+- backup creation is blocked if the resolved backup root sits inside the repository;
+- SQLite snapshot must be created from a consistent database copy, not by copying live WAL files directly;
+- restore to another machine requires re-entering DB credentials unless the encryption key is migrated separately.
+
+## Restore
+
+1. stop QuoteForge;
+2. unpack the chosen archive outside the repository;
+3. replace `qfs.db`;
+4. replace `config.yaml` if needed;
+5. restart the app;
+6. re-enter MariaDB credentials if the original encryption key is unavailable.

bible-local/07-dev.md

@@ -0,0 +1,35 @@
+# 07 - Development
+
+## Common commands
+
+```bash
+go run ./cmd/qfs
+go run ./cmd/qfs -migrate
+go run ./cmd/migrate_project_updated_at
+go test ./...
+go vet ./...
+make build-release
+make install-hooks
+```
+
+## Guardrails
+
+- run `gofmt` before commit;
+- use `slog` for server logging;
+- keep runtime business logic SQLite-only;
+- limit MariaDB access to sync, setup, and migration tooling;
+- keep `config.yaml` out of git and use `config.example.yaml` only as a template;
+- update `bible-local/` in the same commit as architecture changes.
+
+## Removed features that must not return
+
+- admin pricing UI/API;
+- alerts and notification workflows;
+- stock import tooling;
+- cron jobs;
+- standalone importer utility.
+
+## Release notes
+
+Release history belongs under `releases/<version>/RELEASE_NOTES.md`.
+Do not keep temporary change summaries in the repository root.

bible-local/09-vendor-spec.md

@@ -0,0 +1,160 @@
+# 09 - Vendor BOM
+
+## Storage contract
+
+Vendor BOM is stored in `local_configurations.vendor_spec` and synced with `qt_configurations.vendor_spec`.
+
+Each row uses this canonical shape:
+
+```json
+{
+  "sort_order": 10,
+  "vendor_partnumber": "ABC-123",
+  "quantity": 2,
+  "description": "row description",
+  "unit_price": 4500.0,
+  "total_price": 9000.0,
+  "lot_mappings": [
+    { "lot_name": "LOT_A", "quantity_per_pn": 1 }
+  ]
+}
+```
+
+Rules:
+- `lot_mappings[]` is the only persisted PN -> LOT mapping contract;
+- QuoteForge does not use legacy BOM tables;
+- apply flow rebuilds cart rows from `lot_mappings[]`.
+
+## Partnumber books
+
+Partnumber books are pull-only snapshots from PriceForge.
+
+Local tables:
+- `local_partnumber_books`
+- `local_partnumber_book_items`
+
+Server tables:
+- `qt_partnumber_books`
+- `qt_partnumber_book_items`
+
+Resolution flow:
+1. load the active local book;
+2. find `vendor_partnumber`;
+3. copy `lots_json` into `lot_mappings[]`;
+4. keep unresolved rows editable in the UI.
+
+## CFXML import
+
+`POST /api/projects/:uuid/vendor-import` imports one vendor workspace into an existing project.
+
+Rules:
+- accepted file field is `file`;
+- maximum file size is `1 GiB`;
+- one `ProprietaryGroupIdentifier` becomes one QuoteForge configuration;
+- software rows stay inside their hardware group and never become standalone configurations;
+- primary group row is selected structurally, without vendor-specific SKU hardcoding;
+- imported configuration order follows workspace order.
+
+Imported configuration fields:
+- `name` from primary row `ProductName`
+- `server_count` from primary row `Quantity`
+- `server_model` from primary row `ProductDescription`
+- `article` or `support_code` from `ProprietaryProductIdentifier`
+
+Imported BOM rows become `vendor_spec` rows and are resolved through the active local partnumber book when possible.
+
+## Inspur BOM import
+
+The same endpoint `POST /api/projects/:uuid/vendor-import` also accepts Inspur text BOM exports.
+
+Format: one component per line, `<partnumber>*<quantity>`. A leading `|` character is optional and stripped. Trailing whitespace around `*` is normalised.
+
+Example:
+```
+|CPU_AMD_9535-EPYC2.4_64C_256M_300W*1
+|PowerSupply_1300W_Titanium_220VACor240VDC_GaN*2
+```
+
+Rules:
+- the entire file becomes a single configuration (`server_count = 1`);
+- configuration `name` is derived from the uploaded filename (without extension);
+- lines that do not contain `*<digits>` are skipped;
+- no price data is present in the format; `unit_price` and `total_price` are left nil.
+
+## Text BOM import
+
+The same endpoint `POST /api/projects/:uuid/vendor-import` also accepts a human-readable Russian text BOM.
+
+Format: an optional header line ending with `, в составе:` followed by one component per line as
+`<description> - <quantity> шт.`. The separator may be a hyphen, en-dash, or em-dash; the space before
+`шт` is optional; a trailing `.` after `шт` is optional. Quantities are anchored to the end of the line,
+so hyphens, commas, and digits inside the description (e.g. `8-GPU-2304GB`, `RAID0,1,10`) are preserved.
+
+Example:
+```
+Вычислительный GPU сервер G5500V7, в составе:
+GPU-NVIDIA HGX B300 8-GPU-2304GB HBM3E - 1 шт.
+CPU Intel 6760P Xeon 2.2GHz 64C 320M 330W - 2 шт.
+Mem 128G DDR5-6400MHz ECC-RDIMM - 16 шт.
+NVIDIA twin port transceiver, 800Gbps, OSFP - 8шт.
+```
+
+Rules:
+- the entire file becomes a single configuration (`server_count = 1`);
+- the header (any line ending with `, в составе:`) supplies `server_model` and `name`; the model is the
+  last whitespace-separated token before the comma (so both `Сервер X3` and `Вычислительный GPU сервер X3`
+  resolve to `X3`);
+- without a header, `name` falls back to the uploaded filename (without extension) and `server_model` is empty;
+- each line is trimmed, so leading/trailing whitespace never enters `vendor_partnumber`;
+- the format carries no partnumbers — each line's description is stored as both `vendor_partnumber` and
+  `description`, so rows resolve through the active partnumber book when matched and otherwise stay
+  unresolved and editable in the UI;
+- lines that do not match `<description> - <quantity> шт.` are skipped;
+- no price data is present in the format; `unit_price` and `total_price` are left nil.
+
+## Nx BOM import (quantity-first)
+
+The same endpoint `POST /api/projects/:uuid/vendor-import` also accepts a quantity-first BOM
+where each item line begins with `<qty>x <description>`.
+
+Format: an optional header line ending with `, в составе:` followed by one component per line as
+`<qty>x <description>`. The `x` separator is case-insensitive; parentheses, commas, and hyphens
+inside the description are preserved as-is.
+
+Example:
+```
+Сервер G893-SD1-AAX3, в составе:
+1x 8U 2CPU 8GPU Server System (32x DDR5 DIMM Slots,8x 2.5" Hot-Swap Drive Bays, 4+4 3000W, 2x 10Gb/s RJ45, 2x IPMI RJ45)
+2x Intel Xeon 8570 (56 cores, 2.1GHz, 300MB, 350W)
+32x 64GB DDR5 ECC RDIMM
+1x GPU Nvidia HGX H200 141GB 8GPU
+3x 1.92TB NVMe PCIe SFF RI
+5x 7.68TB NVMe PCIe SFF RI
+8x 1-port 400G NDR OSFP CX7
+2x 2-port 100GbE QSFP56 CX6
+1x 2-port 10GbE RJ45
+```
+
+Rules:
+- the entire file becomes a single configuration (`server_count = 1`);
+- the header (any line ending with `, в составе:`) supplies `server_model` and `name`; the model is the
+  last whitespace-separated token before the comma;
+- without a header, `name` falls back to the uploaded filename (without extension) and `server_model` is empty;
+- the format carries no partnumbers — each line's description is stored as both `vendor_partnumber` and
+  `description`, so rows resolve through the active partnumber book when matched and otherwise stay
+  unresolved and editable in the UI;
+- lines that do not match `<qty>x <description>` are skipped;
+- no price data is present in the format; `unit_price` and `total_price` are left nil;
+- detection runs before Text BOM in the format switch (Inspur → Nx → Text).
+
+## Pasted BOM text parsing
+
+`POST /api/vendor-spec/parse-text` is a stateless endpoint that parses pasted single-column text BOM
+(Inspur and Russian text BOM) into rows. Request body: `{"text": "..."}`. Response:
+`{"rows": [{vendor_partnumber, quantity, description}], "format": "Inspur"|"Text"|""}`.
+
+This shares the exact detectors and parsers used by the file-import path
+(`ParsePastedBOMText` → `IsInspurBOM`/`parseInspurBOM`, `IsNxBOM`/`parseNxBOM`, `IsTextBOM`/`parseTextBOM`),
+so paste and upload behave identically — there is no second parser in the frontend. The configurator's BOM
+paste box calls this endpoint; an empty `rows` result (or any payload containing tabs, i.e. a real
+spreadsheet table) falls back to the manual column-mapping grid.

bible-local/10-agent-api-guide.md

@@ -0,0 +1,563 @@
+# 10 - Agent API Guide: Pricing Servers from a TZ
+
+This guide is written for an AI agent that needs to price a server configuration
+(техническое задание, ТЗ) using the QuoteForge HTTP API.
+
+## Runtime assumptions
+
+- QuoteForge runs locally, binds to `127.0.0.1:8080` by default.
+- No authentication is required — the app is single-user, loopback-only.
+- All responses are JSON. All request bodies are JSON unless stated otherwise.
+- The port can be overridden with the `QF_SERVER_PORT` environment variable.
+
+Base URL for all examples: `http://127.0.0.1:8080`
+
+---
+
+## Configuration composition rules
+
+These rules are mandatory and must be respected before saving any configuration.
+
+### 1. Every configuration must belong to a project
+
+Configurations cannot be created in isolation. The correct sequence is:
+
+1. Create a project (`POST /api/projects`) and save the returned `uuid`.
+2. Create the configuration inside that project by passing `project_uuid` in the
+   config body, or by using `POST /api/projects/:uuid/configs`.
+
+If the project for a given TZ already exists, retrieve its `uuid` first:
+```
+GET /api/projects?page=1&per_page=100
+```
+then pass the matching `uuid` in `project_uuid`.
+
+### 2. Every server configuration must contain all four required component groups
+
+A configuration is not valid for pricing unless items from all four of the
+following category groups are present:
+
+| Category code | Meaning          | Notes                                             |
+|---------------|------------------|---------------------------------------------------|
+| `MB`          | Motherboard      | exactly one MB per configuration                  |
+| `CPU`         | Processor        | one or more CPUs                                  |
+| `MEM`         | Memory / RAM     | one or more memory modules                        |
+| `PS` / `PSU`  | Power supply     | `PSU` is the current code; `PS` is legacy — both are accepted |
+
+Before saving, verify the assembled BOM with `POST /api/quote/validate`:
+the response `errors` array will contain `"Component not found: …"` entries
+for unknown lot names, and `warnings` will list lots without a price.
+Reject the configuration and report back to the user if any of the four
+required categories is missing.
+
+### 3. Category codes to use when searching
+
+Use `category=<code>` in `GET /api/components` to narrow results:
+
+```
+GET /api/components?category=MB&search=X13&has_price=true
+GET /api/components?category=CPU&search=Xeon+Gold&has_price=true
+GET /api/components?category=MEM&search=32GB+DDR5&has_price=true
+GET /api/components?category=PSU&search=800W&has_price=true
+```
+
+Retrieve the full list of active categories at any time:
+```
+GET /api/categories
+```
+
+---
+
+## Typical workflow for pricing a server
+
+```
+1.  Check the app is up                 GET  /api/ping
+2.  Find or create a project            GET  /api/projects  →  POST /api/projects
+3.  Find the latest pricelist           GET  /api/pricelists/latest?source=estimate
+4.  Look up lot names for MB            GET  /api/components?category=MB&search=…
+5.  Look up lot names for CPU           GET  /api/components?category=CPU&search=…
+6.  Look up lot names for MEM           GET  /api/components?category=MEM&search=…
+7.  Look up lot names for PSU           GET  /api/components?category=PSU&search=…
+8.  (Repeat for other components)       GET  /api/components?category=…&search=…
+9.  Validate and calculate the quote    POST /api/quote/validate
+10. (Optional) Compare price tiers      POST /api/quote/price-levels
+11. Save configuration in the project   POST /api/projects/:uuid/configs
+```
+
+---
+
+## Step 1 — Verify the app is running
+
+```
+GET /api/ping
+```
+
+Response `200 OK`:
+```json
+{"status": "ok"}
+```
+
+---
+
+## Step 2 — Find or create a project
+
+Each TZ maps to one project. Use the TZ identifier as the `code` field.
+
+### Find an existing project
+
+```
+GET /api/projects?page=1&per_page=100
+```
+
+Response `200 OK`:
+```json
+{
+  "projects": [
+    {
+      "uuid": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+      "code": "TZ-123",
+      "variant": "",
+      "name": "Проект по ТЗ №123",
+      "tracker_url": "",
+      "is_active": true,
+      "created_at": "2026-06-01T00:00:00Z"
+    }
+  ],
+  "total": 1,
+  "page": 1,
+  "per_page": 100
+}
+```
+
+### Create a new project
+
+```
+POST /api/projects
+Content-Type: application/json
+```
+
+Request body:
+```json
+{
+  "code": "TZ-123",
+  "name": "Проект по ТЗ №123",
+  "tracker_url": ""
+}
+```
+
+Fields:
+
+| field         | type   | required | description                                                        |
+|---------------|--------|----------|--------------------------------------------------------------------|
+| `code`        | string | yes      | short identifier, unique per variant; use the TZ number or ticket  |
+| `variant`     | string | no       | variant label within the same `code`; default is empty string      |
+| `name`        | string | no       | human-readable title                                               |
+| `tracker_url` | string | no       | link to a ticket or issue tracker                                  |
+
+Response `201 Created`:
+```json
+{
+  "uuid": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+  "code": "TZ-123",
+  "variant": "",
+  "name": "Проект по ТЗ №123",
+  "is_active": true,
+  "created_at": "2026-06-11T10:00:00Z"
+}
+```
+
+Save the `uuid` — it is required to create configurations inside this project.
+
+---
+
+## Step 3 — Find the latest pricelist
+
+QuoteForge maintains three pricing tiers. The `source` values are:
+
+| source       | meaning                     |
+|--------------|-----------------------------|
+| `estimate`   | list / catalogue price      |
+| `warehouse`  | stock price (purchase cost) |
+| `competitor` | competitor reference price  |
+
+```
+GET /api/pricelists/latest?source=estimate
+```
+
+Response `200 OK`:
+```json
+{
+  "id": 42,
+  "source": "estimate",
+  "version": "2026-05-28",
+  "item_count": 12500,
+  "is_active": true,
+  "created_at": "2026-05-28T06:00:00Z"
+}
+```
+
+The `id` field is a numeric pricelist identifier. Pass it as `pricelist_id`
+when calculating a quote to pin pricing to a specific pricelist.
+
+To list all available pricelists:
+```
+GET /api/pricelists?source=estimate&active_only=true
+```
+
+---
+
+## Steps 4–8 — Look up component lot names
+
+Each component is identified by a `lot_name` (internal SKU). The TZ typically
+contains model names or descriptions; use the search endpoint to resolve them.
+
+```
+GET /api/components?search=Xeon+Gold+6342&category=CPU&has_price=true&page=1&per_page=20
+```
+
+Query parameters:
+
+| parameter        | default | description                                       |
+|------------------|---------|---------------------------------------------------|
+| `search`         | —       | free-text search in lot name and description      |
+| `category`       | —       | filter by category code (`MB`, `CPU`, `MEM`, `PSU`, …) |
+| `has_price`      | false   | return only components that have a price          |
+| `include_hidden` | false   | include hidden/retired components                 |
+| `page`           | 1       | page number                                       |
+| `per_page`       | 20      | page size                                         |
+
+Response `200 OK`:
+```json
+{
+  "components": [
+    {
+      "lot_name": "CPU-XEON-6342",
+      "description": "Intel Xeon Gold 6342, 24C/48T, 2.8 GHz, LGA4189",
+      "category": "CPU",
+      "category_name": "CPU",
+      "model": "Xeon Gold 6342"
+    }
+  ],
+  "total": 1,
+  "page": 1,
+  "per_page": 20
+}
+```
+
+To look up a single component by exact lot name:
+```
+GET /api/components/CPU-XEON-6342
+```
+
+To list all known categories:
+```
+GET /api/categories
+```
+
+---
+
+## Step 9 — Validate and calculate the quote
+
+Before saving, validate the assembled BOM. This catches unknown lot names and
+missing prices, and also confirms that all required categories are covered.
+
+```
+POST /api/quote/validate
+Content-Type: application/json
+```
+
+Request body:
+```json
+{
+  "items": [
+    {"lot_name": "MB-X13DAI-N",        "quantity": 1},
+    {"lot_name": "CPU-XEON-6342",       "quantity": 2},
+    {"lot_name": "RAM-32GB-DDR4-3200",  "quantity": 8},
+    {"lot_name": "SSD-480GB-SATA",      "quantity": 2},
+    {"lot_name": "PSU-800W-TITANIUM",   "quantity": 2}
+  ],
+  "pricelist_id": 42
+}
+```
+
+Response `200 OK`:
+```json
+{
+  "valid": true,
+  "items": [
+    {
+      "lot_name": "MB-X13DAI-N",
+      "quantity": 1,
+      "unit_price": 95000.00,
+      "total_price": 95000.00,
+      "description": "Supermicro X13DAi-N dual-socket server board",
+      "category": "MB",
+      "has_price": true
+    },
+    {
+      "lot_name": "CPU-XEON-6342",
+      "quantity": 2,
+      "unit_price": 87500.00,
+      "total_price": 175000.00,
+      "description": "Intel Xeon Gold 6342, 24C/48T, 2.8 GHz",
+      "category": "CPU",
+      "has_price": true
+    },
+    {
+      "lot_name": "RAM-32GB-DDR4-3200",
+      "quantity": 8,
+      "unit_price": 12000.00,
+      "total_price": 96000.00,
+      "description": "32 GB DDR4-3200 ECC RDIMM",
+      "category": "MEM",
+      "has_price": true
+    },
+    {
+      "lot_name": "PSU-800W-TITANIUM",
+      "quantity": 2,
+      "unit_price": 18500.00,
+      "total_price": 37000.00,
+      "description": "800W 80+ Titanium redundant PSU",
+      "category": "PSU",
+      "has_price": true
+    }
+  ],
+  "errors": [],
+  "warnings": [],
+  "total": 403000.00
+}
+```
+
+**Agent check after validation:**
+
+1. `valid` must be `true` — all lot names resolved.
+2. `errors` must be empty — no unknown components.
+3. The returned `items` array must contain at least one entry from each required
+   category: `MB`, `CPU`, `MEM`, and `PS` or `PSU`.
+4. Items with `has_price: false` are allowed but should be flagged to the user.
+
+If any check fails, do not save the configuration. Report the issue and ask the
+user to clarify or replace the problematic component.
+
+For simple price totals without validation metadata use `POST /api/quote/calculate`
+— identical request body, response contains only `items` and `total`.
+
+---
+
+## Step 10 (optional) — Compare price tiers
+
+To see estimate, warehouse, and competitor prices side-by-side for a BOM:
+
+```
+POST /api/quote/price-levels
+Content-Type: application/json
+```
+
+Request body:
+```json
+{
+  "items": [
+    {"lot_name": "CPU-XEON-6342", "quantity": 2},
+    {"lot_name": "RAM-32GB-DDR4-3200", "quantity": 8}
+  ],
+  "pricelist_ids": {
+    "estimate": 42,
+    "warehouse": 31,
+    "competitor": 15
+  },
+  "no_cache": false
+}
+```
+
+`pricelist_ids` is optional. When omitted the latest pricelist for each source
+is used automatically.
+
+Response `200 OK`:
+```json
+{
+  "items": [
+    {
+      "lot_name": "CPU-XEON-6342",
+      "quantity": 2,
+      "estimate_price": 87500.00,
+      "warehouse_price": 71000.00,
+      "competitor_price": 85000.00,
+      "delta_wh_estimate_abs": -16500.00,
+      "delta_wh_estimate_pct": -18.86,
+      "delta_comp_estimate_abs": -2500.00,
+      "delta_comp_estimate_pct": -2.86,
+      "delta_comp_wh_abs": 14000.00,
+      "delta_comp_wh_pct": 19.72,
+      "price_missing": []
+    }
+  ],
+  "resolved_pricelist_ids": {
+    "estimate": 42,
+    "warehouse": 31,
+    "competitor": 15
+  }
+}
+```
+
+`price_missing` lists the source names for which no price was found for that lot.
+Delta fields are `null` when either operand price is missing.
+
+---
+
+## Step 11 — Save a configuration inside the project
+
+Use the project-scoped endpoint so the configuration is immediately linked to
+the correct project without a separate move operation.
+
+```
+POST /api/projects/:project_uuid/configs
+Content-Type: application/json
+```
+
+The request body is identical to `POST /api/configs` — the `project_uuid` field
+in the body is ignored when using the project-scoped route; the URL parameter
+takes precedence.
+
+Request body:
+```json
+{
+  "name": "Сервер по ТЗ №123 — вариант А",
+  "items": [
+    {"lot_name": "MB-X13DAI-N",       "quantity": 1, "unit_price": 95000.00},
+    {"lot_name": "CPU-XEON-6342",      "quantity": 2, "unit_price": 87500.00},
+    {"lot_name": "RAM-32GB-DDR4-3200", "quantity": 8, "unit_price": 12000.00},
+    {"lot_name": "SSD-480GB-SATA",     "quantity": 2, "unit_price": 8500.00},
+    {"lot_name": "PSU-800W-TITANIUM",  "quantity": 2, "unit_price": 18500.00}
+  ],
+  "server_model": "2U",
+  "support_code": "NBD",
+  "server_count": 1,
+  "pricelist_id": 42,
+  "warehouse_pricelist_id": 31,
+  "competitor_pricelist_id": 15,
+  "config_type": "server",
+  "notes": "Автоматически создано агентом на основании ТЗ №123"
+}
+```
+
+Key fields:
+
+| field                    | type   | required | description                                         |
+|--------------------------|--------|----------|-----------------------------------------------------|
+| `name`                   | string | yes      | human-readable name                                 |
+| `items`                  | array  | yes      | `{lot_name, quantity, unit_price}` from validate    |
+| `server_model`           | string | no       | chassis/form-factor code; used for article generation |
+| `support_code`           | string | no       | support tier code; used for article generation      |
+| `server_count`           | int    | no       | number of identical servers; total is multiplied    |
+| `pricelist_id`           | uint   | no       | estimate pricelist to attach                        |
+| `warehouse_pricelist_id` | uint   | no       | warehouse pricelist to attach                       |
+| `competitor_pricelist_id`| uint   | no       | competitor pricelist to attach                      |
+| `config_type`            | string | no       | `"server"` (default) or `"storage"`                 |
+| `notes`                  | string | no       | free text                                           |
+| `custom_price`           | float  | no       | override total price                                |
+| `disable_price_refresh`  | bool   | no       | prevent automatic price refresh on open             |
+| `only_in_stock`          | bool   | no       | filter to in-stock components only                  |
+
+Response `201 Created`:
+```json
+{
+  "uuid": "550e8400-e29b-41d4-a716-446655440000",
+  "name": "Сервер по ТЗ №123 — вариант А",
+  "items": [...],
+  "total_price": 403000.00,
+  "server_count": 1,
+  "config_type": "server",
+  "article": "2U-6342x2-32GBx8-NBD",
+  "project_uuid": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+  "created_at": "2026-06-11T10:00:00Z"
+}
+```
+
+The `uuid` can be used for all subsequent operations on this configuration.
+
+---
+
+## Working with saved configurations
+
+```
+GET  /api/configs/:uuid                 — retrieve a saved configuration
+PUT  /api/configs/:uuid                 — full update (same body as create)
+POST /api/configs/:uuid/refresh-prices  — re-price from latest pricelist
+POST /api/configs/:uuid/clone           — duplicate: body {"name": "clone name"}
+GET  /api/configs/:uuid/versions        — revision history
+GET  /api/configs?page=1&per_page=20    — list all configurations
+```
+
+---
+
+## Error responses
+
+All error responses follow the same shape:
+
+```json
+{"error": "human-readable message"}
+```
+
+Common status codes:
+
+| code | meaning                                               |
+|------|-------------------------------------------------------|
+| 400  | invalid request body or validation failure            |
+| 404  | entity (component, pricelist, config) not found       |
+| 423  | sync readiness is blocked; retry after sync completes |
+| 500  | internal server error                                 |
+
+---
+
+## Minimal end-to-end example
+
+```bash
+BASE=http://127.0.0.1:8080
+
+# 1. Verify the app is up
+curl -s $BASE/api/ping
+
+# 2. Create a project for this TZ
+PROJECT_UUID=$(curl -s -X POST $BASE/api/projects \
+  -H "Content-Type: application/json" \
+  -d '{"code": "TZ-123", "name": "Проект по ТЗ №123"}' | jq -r .uuid)
+
+# 3. Get latest estimate pricelist
+PRICELIST_ID=$(curl -s "$BASE/api/pricelists/latest?source=estimate" | jq .id)
+
+# 4. Find lot names for required categories
+curl -s "$BASE/api/components?category=MB&search=X13&has_price=true"  | jq '.components[].lot_name'
+curl -s "$BASE/api/components?category=CPU&search=Xeon&has_price=true" | jq '.components[].lot_name'
+curl -s "$BASE/api/components?category=MEM&search=32GB&has_price=true" | jq '.components[].lot_name'
+curl -s "$BASE/api/components?category=PSU&search=800W&has_price=true" | jq '.components[].lot_name'
+
+# 5. Validate the BOM (must contain MB, CPU, MEM, PSU/PS)
+curl -s -X POST $BASE/api/quote/validate \
+  -H "Content-Type: application/json" \
+  -d "{
+    \"pricelist_id\": $PRICELIST_ID,
+    \"items\": [
+      {\"lot_name\": \"MB-X13DAI-N\",        \"quantity\": 1},
+      {\"lot_name\": \"CPU-XEON-6342\",       \"quantity\": 2},
+      {\"lot_name\": \"RAM-32GB-DDR4-3200\",  \"quantity\": 8},
+      {\"lot_name\": \"PSU-800W-TITANIUM\",   \"quantity\": 2}
+    ]
+  }" | jq '{valid, errors, warnings, total}'
+
+# 6. Save the configuration inside the project
+curl -s -X POST "$BASE/api/projects/$PROJECT_UUID/configs" \
+  -H "Content-Type: application/json" \
+  -d "{
+    \"name\": \"Сервер по ТЗ №123\",
+    \"pricelist_id\": $PRICELIST_ID,
+    \"server_model\": \"2U\",
+    \"server_count\": 1,
+    \"config_type\": \"server\",
+    \"items\": [
+      {\"lot_name\": \"MB-X13DAI-N\",        \"quantity\": 1,  \"unit_price\": 95000},
+      {\"lot_name\": \"CPU-XEON-6342\",       \"quantity\": 2,  \"unit_price\": 87500},
+      {\"lot_name\": \"RAM-32GB-DDR4-3200\",  \"quantity\": 8,  \"unit_price\": 12000},
+      {\"lot_name\": \"PSU-800W-TITANIUM\",   \"quantity\": 2,  \"unit_price\": 18500}
+    ]
+  }" | jq '{uuid, total_price, article}'
+```

bible-local/11-lot-suggestions.md

@@ -0,0 +1,161 @@
+# 11 - Lot Suggestions (qt_vendor_partnumber_seen)
+
+## Purpose
+
+`qt_vendor_partnumber_seen` records vendor partnumbers encountered during import
+that have no mapping in the active partnumber book. When a user manually maps
+such a partnumber to one or more LOT names in the QuoteForge UI, those mappings
+are written back to the server as **lot suggestions** — hints for the team that
+maintains `qt_partnumber_book_items`.
+
+## Schema Extension
+
+Add one nullable column to `qt_vendor_partnumber_seen`:
+
+```sql
+ALTER TABLE `qt_vendor_partnumber_seen`
+  ADD COLUMN `lot_suggestion` longtext DEFAULT NULL
+    COMMENT 'JSON array [{lot_name, qty}] — user-entered LOT mappings from the UI';
+```
+
+### Updated table contract (relevant columns only)
+
+| Column | Type | Notes |
+|--------|------|-------|
+| `partnumber` | varchar(255) UNIQUE NOT NULL | natural key |
+| `lot_suggestion` | longtext (JSON) | nullable; set when user maps the PN manually |
+
+`lot_suggestion` contains the same JSON shape as `qt_partnumber_book_items.lots_json`:
+
+```json
+[
+  { "lot_name": "LOT_A", "qty": 1 },
+  { "lot_name": "LOT_B", "qty": 2 }
+]
+```
+
+Rules:
+- `null` or absent means no suggestion has been entered yet;
+- an empty array `[]` is not a valid value — use `null` instead;
+- a single PN may map to multiple lots (`lot_name` entries), each with its own `qty`;
+- the array is ordered — the order reflects the order of `lot_mappings[]` in the
+  vendor spec row at the time of last user save;
+- `qty` must be a positive integer (≥ 1).
+
+## Write Contract (QuoteForge → MariaDB)
+
+QuoteForge writes `lot_suggestion` when all of the following are true:
+
+1. The user saves a vendor BOM via `PUT /api/configs/:uuid/vendor-spec`.
+2. At least one `vendor_spec` row has a non-empty `lot_mappings[]` array (manually
+   entered or confirmed by the user — not auto-resolved from a partnumber book).
+3. The MariaDB connection is available at the time of save.
+
+For each such row:
+
+```sql
+INSERT INTO qt_vendor_partnumber_seen
+    (source_type, vendor, partnumber, description, is_ignored, last_seen_at, lot_suggestion)
+VALUES
+    ('manual', '', ?, ?, 0, NOW(3), ?)
+ON DUPLICATE KEY UPDATE
+    lot_suggestion = VALUES(lot_suggestion),
+    last_seen_at   = IF(lot_suggestion IS NULL, last_seen_at, NOW(3))
+```
+
+- `lot_suggestion` value = JSON-marshalled `lot_mappings[]` from the vendor spec item,
+  reusing the same `{lot_name, qty}` shape.
+- If the PN row already exists and `lot_suggestion` is already set, it is **overwritten**
+  with the latest user input (the user is assumed to have corrected it).
+- If the user **clears** all lot_mappings for a PN (sets to empty), no update is sent —
+  the existing `lot_suggestion` on the server is left untouched.
+- Rows where `lot_mappings[]` is empty or nil are skipped entirely (no insert, no update).
+- Writes are best-effort: a MariaDB error for one row is logged and skipped; remaining
+  rows continue. A write failure does not fail the vendor-spec save.
+
+## Read Contract (Partnumber-Book Creation Tool → MariaDB)
+
+The tool that maintains `qt_partnumber_book_items` reads `qt_vendor_partnumber_seen`
+to discover new partnumbers and their suggested mappings.
+
+### Discovery query
+
+```sql
+SELECT
+    s.id,
+    s.partnumber,
+    s.description,
+    s.vendor,
+    s.lot_suggestion,
+    s.last_seen_at,
+    b.lots_json AS book_lots_json
+FROM qt_vendor_partnumber_seen s
+LEFT JOIN qt_partnumber_book_items b ON b.partnumber = s.partnumber
+WHERE s.is_ignored = 0
+  AND s.lot_suggestion IS NOT NULL
+ORDER BY s.last_seen_at DESC;
+```
+
+### Interpretation rules
+
+| Condition | Meaning | Suggested action |
+|-----------|---------|-----------------|
+| `book_lots_json IS NULL` AND `lot_suggestion IS NOT NULL` | No book entry yet; user suggested mapping | Create new `qt_partnumber_book_items` row with `lots_json = lot_suggestion` |
+| `book_lots_json IS NOT NULL` AND `lot_suggestion IS NOT NULL` AND they differ | User corrected or extended the existing mapping | Review diff and decide whether to update `qt_partnumber_book_items` |
+| `book_lots_json IS NOT NULL` AND `lot_suggestion IS NOT NULL` AND they match | Suggestion already applied | No action needed |
+
+### Suggestion format
+
+`lot_suggestion` is valid JSON (or `null`). Parse it as an array of objects:
+
+```json
+[
+  { "lot_name": "LOT_A", "qty": 1 },
+  { "lot_name": "LOT_B", "qty": 2 }
+]
+```
+
+Map directly to `qt_partnumber_book_items.lots_json` — the formats are identical.
+
+### Multiple lots per PN
+
+One PN may have multiple suggestion entries (e.g., a bundle). The array carries
+all of them. The book-creation tool must preserve the full array when writing
+`lots_json`, not just the first element.
+
+### Qty semantics
+
+`qty` in a lot suggestion means "how many of this LOT per one occurrence of the
+vendor PN". This matches `qt_partnumber_book_items.lots_json` exactly. Example:
+a server platform that comes with 4 PSUs would produce
+`[{"lot_name": "PS_1300W_Titanium", "qty": 4}]`.
+
+## Permissions
+
+The existing `qfs_user` grant covers this column — no new permission is required:
+
+```sql
+GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_vendor_partnumber_seen TO 'qfs_user'@'%';
+```
+
+The book-creation tool connects with its own credentials and needs at minimum:
+
+```sql
+GRANT SELECT ON RFQ_LOG.qt_vendor_partnumber_seen TO '<book_tool_user>'@'%';
+GRANT SELECT, INSERT, UPDATE ON RFQ_LOG.qt_partnumber_book_items TO '<book_tool_user>'@'%';
+```
+
+## Migration
+
+Migration is applied outside this repo (server-side DDL):
+
+```sql
+ALTER TABLE `qt_vendor_partnumber_seen`
+  ADD COLUMN IF NOT EXISTS `lot_suggestion` longtext DEFAULT NULL
+    COMMENT 'JSON [{lot_name, qty}] — user LOT suggestions from QuoteForge UI';
+```
+
+QuoteForge handles a missing column gracefully: if the migration has not run yet,
+the write with `lot_suggestion` fails with "Unknown column" (MariaDB 1054), a warning
+is logged, and the row is re-inserted without the column. The app never crashes on
+migration lag.

bible-local/README.md

@@ -0,0 +1,32 @@
+# QuoteForge Bible
+
+Project-specific architecture and operational contracts.
+
+## Files
+
+| File | Scope |
+| --- | --- |
+| [01-overview.md](01-overview.md) | Product scope, runtime model, repository map |
+| [02-architecture.md](02-architecture.md) | Local-first rules, sync, pricing, versioning |
+| [03-database.md](03-database.md) | SQLite and MariaDB data model, permissions, migrations |
+| [04-api.md](04-api.md) | HTTP routes and API contract |
+| [05-config.md](05-config.md) | Runtime config, paths, env vars, startup behavior |
+| [06-backup.md](06-backup.md) | Backup contract and restore workflow |
+| [07-dev.md](07-dev.md) | Development commands and guardrails |
+| [09-vendor-spec.md](09-vendor-spec.md) | Vendor BOM and CFXML import contract |
+| [10-agent-api-guide.md](10-agent-api-guide.md) | End-to-end API guide for agents pricing servers from a TZ |
+| [11-lot-suggestions.md](11-lot-suggestions.md) | lot_suggestion column in qt_vendor_partnumber_seen — write/read contract for manual UI mappings |
+
+## Rules
+
+- `bible-local/` is the source of truth for QuoteForge-specific behavior.
+- Keep these files in English.
+- Update the matching file in the same commit as any architectural change.
+- Remove stale documentation instead of preserving history in place.
+
+## Quick reference
+
+- Local DB path: see [05-config.md](05-config.md)
+- Runtime bind: loopback only
+- Local backups: see [06-backup.md](06-backup.md)
+- Release notes: `releases/<version>/RELEASE_NOTES.md`

bible-local/decisions/README.md

@@ -0,0 +1,31 @@
+# Architectural Decision Log
+
+One file per decision, named `YYYY-MM-DD-short-topic.md`.
+
+Write a new entry when:
+- Choosing between non-obvious implementation approaches.
+- Intentionally rejecting a feature or pattern.
+- A bug causes a rule change.
+- Freezing or deprecating something.
+
+Format:
+
+```markdown
+# Decision: <short title>
+
+**Date:** YYYY-MM-DD
+**Status:** active | superseded by YYYY-MM-DD-topic.md
+
+## Context
+Situation making this decision necessary.
+
+## Decision
+What was decided, stated clearly.
+
+## Consequences
+What this means going forward; what is forbidden or required.
+```
+
+When a decision is superseded: add "superseded by" to the old file and create the new one.
+Do NOT delete old entries.
+Record the decision in the SAME COMMIT as the implementation code.

bible-local/runtime-flows.md

@@ -0,0 +1,86 @@
+# Runtime Flows
+
+Critical mutation paths, deduplication logic, and cross-entity side effects.
+Update this file in the same commit as any change to the flows below.
+
+---
+
+## 1. Configuration save (create/update)
+
+1. Handler receives JSON body; validates via `ShouldBindJSON`.
+2. `LocalConfigurationService.Create` or `Update` is called.
+3. Service computes `total_price` from `req.Items.Total()` (sum of `unit_price * quantity` per item).
+4. A new revision snapshot is created via `createWithVersion`; revision number increments.
+5. `quoteService.RecordUsage` is called best-effort (warn on failure, do not abort save).
+6. Configuration row written to SQLite (`local_configurations`); version row appended to `local_configuration_versions`.
+7. Pending change queued in `pending_changes` for later sync push.
+
+**DO NOT** read prices from `local_components` during save - prices must already be on items.
+**DO NOT** skip version creation on rename/reorder/project-move - those operations call different paths that must NOT call `createWithVersion`.
+
+---
+
+## 2. Refresh prices (POST /api/configs/:uuid/refresh-prices)
+
+1. Handler calls `LocalConfigurationService.RefreshPricesNoAuth(uuid, pricelistServerID)`.
+2. If online, `SyncPricelistsIfNeeded` runs best-effort (warn on failure, do not block).
+3. Resolves target pricelist in order:
+   a. Explicitly requested pricelist (`pricelistServerID` param).
+   b. Pricelist stored in configuration row (`localCfg.PricelistID`).
+   c. Latest local pricelist as fallback.
+4. For each item in the config, looks up price from `local_pricelist_items` via `GetLocalPricesForLots` (batch, single query).
+5. Items with matching prices are updated; items with no price keep their existing `unit_price`.
+6. Updated configuration saved as a new version (same flow as §1 from step 4 onward).
+
+**DO NOT** read prices from `qt_pricelist_items` (MariaDB) directly - prices come from SQLite cache only.
+
+---
+
+## 3. Pricelist sync (POST /api/sync/pricelists)
+
+1. Readiness guard checked; returns 423 if guard blocks sync.
+2. `SyncService.SyncPricelists` pulls from `qt_pricelists` and `qt_pricelist_items` (MariaDB).
+3. For each pricelist: header upserted first, then items replaced atomically via `ReplaceLocalPricelistItems`.
+4. After all pricelists: `RecalculateAllLocalPricelistUsage` marks which pricelists are referenced by active configurations.
+5. Sync result (status, error, timestamp) written to `app_settings` via `SetPricelistSyncResult`.
+
+**DO NOT** write pricelist header without items in the same transaction - must be atomic.
+**DO NOT** query MariaDB from runtime handlers outside sync/setup flows.
+
+---
+
+## 4. Vendor spec apply (POST /api/configs/:uuid/vendor-spec/apply)
+
+1. Incoming `items[]` (lot_name, quantity, unit_price) replace the configuration's `items` entirely.
+2. New item list saved through `LocalConfigurationService.UpdateItemsNoAuth`.
+3. A new revision is created reflecting the BOM-derived item state.
+
+**DO NOT** apply vendor spec without going through the service layer - handler must not write items directly to DB.
+
+---
+
+## 5. Configuration versioning invariants
+
+- `local_configuration_versions` is append-only; rows are never updated or deleted.
+- Version deduplication: if new snapshot hash equals current head, no new version is created.
+- Rollback = create new HEAD revision from old snapshot data (does not restore version pointer to old row).
+- UI must always show "main" (implicit head) as the active state; never point to a numbered revision after save.
+- Operations that do NOT create a new version: rename, reorder within project, project move, pricelist selector change only.
+
+---
+
+## 6. Pending changes queue
+
+- Every local write (create/update/delete) appends a row to `pending_changes`.
+- `POST /api/sync/push` drains the queue by writing to MariaDB.
+- If a push fails, `increment_attempts` and `last_error` are updated; row stays in queue.
+- `RepairPendingChanges` reconciles orphaned changes (configuration/project deleted locally).
+
+---
+
+## 7. Error handling boundary rules
+
+- Handlers: log 500 responses with `slog.Error`; surface error message via `RespondError`.
+- Services: wrap errors with `fmt.Errorf("context: %w", err)`; do NOT log inside service.
+- Repositories: return raw errors; no logging.
+- Best-effort operations (usage stats, background sync): log `slog.Warn` and continue.

bible-local/server-contract-qt-settings.md

@@ -0,0 +1,165 @@
+# Server contract: qt_settings
+
+## Purpose
+
+`qt_settings` is a general-purpose key→JSON-value table that the price management
+application uses to push configuration into QuoteForge clients. QF reads it during
+component sync and caches the result in `local_qt_settings` (SQLite).
+
+## Required MariaDB changes (implemented by server-side agent)
+
+```sql
+CREATE TABLE IF NOT EXISTS qt_settings (
+    name  VARCHAR(100) NOT NULL PRIMARY KEY,
+    value TEXT         NOT NULL   -- JSON-encoded value
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+GRANT SELECT ON RFQ_LOG.qt_settings TO 'qfs_user'@'%';
+```
+
+## Settings consumed by QuoteForge
+
+All values are JSON. Missing or unparseable entries are silently skipped; QF
+falls back to hardcoded defaults for each missing key.
+
+---
+
+### `config_types`
+
+Defines the available device configuration types, their localized names, and the
+category codes that are allowed for each type. QF uses this for:
+- the new-config modal (button list + labels);
+- the configurator's category filter per `config_type`.
+
+**Value format:** JSON array of objects.
+
+```json
+[
+  {
+    "code":          "server",
+    "name_ru":       "Сервер",
+    "display_order": 10,
+    "categories":    [
+      "MB","CPU","MEM","RAID",
+      "SSD","HDD","M2","EDSFF","HHHL",
+      "GPU","NIC","HCA","DPU","HBA",
+      "PSU","PS","ACC","RISERS","CARD","BB"
+    ]
+  },
+  {
+    "code":          "storage",
+    "name_ru":       "СХД",
+    "display_order": 20,
+    "categories":    [
+      "DKC","CPU","MEM","PS",
+      "SSD","HDD","M2","EDSFF","HHHL",
+      "NIC","HBA","HCA","ACC","CARD"
+    ]
+  }
+]
+```
+
+Fields:
+| Field | Type | Description |
+|-------|------|-------------|
+| `code` | string | Identifier stored on `qt_configurations.config_type`. Must be stable. |
+| `name_ru` | string | Display name in Russian for the QF UI. |
+| `display_order` | int | Sort order for the modal button list. |
+| `categories` | string[] | Allowlist of LOT category codes visible in this config type. A category absent from ALL entries is visible in all types. |
+
+---
+
+### `tab_config`
+
+Defines the configurator tab layout: which tabs exist, which categories each tab
+contains, optional sub-sections within a tab, and whether the tab uses
+single-select mode.
+
+**Value format:** JSON array of tab objects (ordered — defines tab bar order).
+
+```json
+[
+  {
+    "key":           "base",
+    "label":         "Base",
+    "single_select": true,
+    "categories":    ["MB","CPU","MEM","ENC","DKC","CTL"],
+    "sections":      null
+  },
+  {
+    "key":           "storage",
+    "label":         "Storage",
+    "single_select": false,
+    "categories":    ["RAID","M2","SSD","HDD","EDSFF","HHHL"],
+    "sections": [
+      { "title": "RAID Контроллеры", "categories": ["RAID"] },
+      { "title": "Диски",            "categories": ["M2","SSD","HDD","EDSFF","HHHL"] }
+    ]
+  },
+  {
+    "key":           "pci",
+    "label":         "PCI",
+    "single_select": false,
+    "categories":    ["GPU","DPU","NIC","HCA","HBA","HIC"],
+    "sections": [
+      { "title": "GPU / DPU", "categories": ["GPU","DPU"] },
+      { "title": "NIC / HCA", "categories": ["NIC","HCA"] },
+      { "title": "HBA",       "categories": ["HBA"] },
+      { "title": "HIC",       "categories": ["HIC"] }
+    ]
+  },
+  { "key": "power",       "label": "Power",       "single_select": false, "categories": ["PS","PSU"] },
+  { "key": "accessories", "label": "Accessories", "single_select": false, "categories": ["ACC","CARD"] },
+  { "key": "sw",          "label": "SW",          "single_select": false, "categories": ["SW"] }
+]
+```
+
+The QF frontend always appends an "other" tab for any categories not listed here.
+
+---
+
+### `always_visible_tabs`
+
+Tab keys that are always shown in the configurator regardless of whether they
+contain any items. Other tabs are hidden when empty.
+
+**Value format:** JSON string array.
+
+```json
+["base", "storage", "pci"]
+```
+
+---
+
+### `required_categories`
+
+Category codes that must have at least one LOT selected for a configuration to
+be considered complete. Keyed by `config_type` code. QF uses this to show a
+badge on the tab label when required categories are missing.
+
+**Value format:** JSON object mapping config_type code → string array.
+
+```json
+{
+  "server":  ["CPU", "MEM", "BB"],
+  "storage": ["DKC", "CPU", "MEM"]
+}
+```
+
+---
+
+## Backward compatibility
+
+- If `qt_settings` does not exist (old server): QF logs `Warn` during sync and
+  leaves `local_qt_settings` empty. The frontend falls back to hardcoded defaults
+  for all four settings. No crash, no data loss.
+- If a specific key is absent from `qt_settings`: QF falls back to the hardcoded
+  default for that key only.
+- Old QF clients that do not know about `local_qt_settings` continue to use their
+  hardcoded JS constants unchanged.
+
+## Note on `qt_categories`
+
+`qt_categories.name` and `qt_categories.name_ru` are being removed.
+QF runtime does not depend on them — `GetCategories` derives `Name` from the
+category code string stored in `local_components`.

cmd/migrate/main.go

@@ -2,8 +2,8 @@ package main
 
 import (
 	"flag"
-	"fmt"
 	"log"
+	"log/slog"
 	"time"
 
 	"git.mchus.pro/mchus/quoteforge/internal/appstate"
@@ -153,7 +153,7 @@ func main() {
 	log.Printf("  Skipped:  %d", skipped)
 	log.Printf("  Errors:   %d", errors)
 
-	fmt.Println("\nDone! You can now run the server with: go run ./cmd/qfs")
+	slog.Info("Done! You can now run the server with: go run ./cmd/qfs")
 }
 
 func derefUint(v *uint) uint {

cmd/migrate_ops_projects/main.go

@@ -5,6 +5,7 @@ import (
 	"flag"
 	"fmt"
 	"log"
+	"log/slog"
 	"os"
 	"regexp"
 	"sort"
@@ -79,12 +80,12 @@ func main() {
 
 	printPlan(actions)
 	if len(actions) == 0 {
-		fmt.Println("Nothing to migrate.")
+		slog.Info("Nothing to migrate.")
 		return
 	}
 
 	if !*apply {
-		fmt.Println("\nPreview complete. Re-run with -apply to execute.")
+		slog.Info("Preview complete. Re-run with -apply to execute.")
 		return
 	}
 
@@ -94,7 +95,7 @@ func main() {
 			log.Fatalf("confirmation failed: %v", confirmErr)
 		}
 		if !ok {
-			fmt.Println("Aborted.")
+			slog.Info("Aborted.")
 			return
 		}
 	}
@@ -103,7 +104,7 @@ func main() {
 		log.Fatalf("migration failed: %v", err)
 	}
 
-	fmt.Println("Migration completed successfully.")
+	slog.Info("Migration completed successfully.")
 }
 
 func ensureProjectsTable(db *gorm.DB) error {
@@ -163,7 +164,7 @@ func buildPlan(db *gorm.DB, fallbackOwner string) ([]migrationAction, map[string
 		}
 		for i := range projects {
 			p := projects[i]
-			existingProjects[projectKey(p.OwnerUsername, p.Name)] = &p
+			existingProjects[projectKey(p.OwnerUsername, derefString(p.Name))] = &p
 		}
 	}
 
@@ -212,10 +213,8 @@ func printPlan(actions []migrationAction) {
 		}
 	}
 
-	fmt.Printf("Planned actions: %d\n", len(actions))
-	fmt.Printf("Projects to create: %d\n", createCount)
-	fmt.Printf("Projects to reactivate: %d\n", reactivateCount)
-	fmt.Println("\nDetails:")
+	slog.Info("Plan summary", "actions", len(actions), "create", createCount, "reactivate", reactivateCount)
+	slog.Info("Details:")
 
 	for _, a := range actions {
 		extra := ""
@@ -253,12 +252,13 @@ func executePlan(db *gorm.DB, actions []migrationAction, existingProjects map[st
 
 		for _, action := range actions {
 			key := projectKey(action.OwnerUsername, action.TargetProjectName)
-			project := projectCache[key]
+		project := projectCache[key]
 			if project == nil {
 				project = &models.Project{
 					UUID:          uuid.NewString(),
 					OwnerUsername: action.OwnerUsername,
-					Name:          action.TargetProjectName,
+					Code:          action.TargetProjectName,
+					Name:          ptrString(action.TargetProjectName),
 					IsActive:      true,
 					IsSystem:      false,
 				}
@@ -268,7 +268,7 @@ func executePlan(db *gorm.DB, actions []migrationAction, existingProjects map[st
 				projectCache[key] = project
 			} else if !project.IsActive {
 				if err := tx.Model(&models.Project{}).Where("uuid = ?", project.UUID).Update("is_active", true).Error; err != nil {
-					return fmt.Errorf("reactivate project %s (%s): %w", project.Name, project.UUID, err)
+					return fmt.Errorf("reactivate project %s (%s): %w", derefString(project.Name), project.UUID, err)
 				}
 				project.IsActive = true
 			}
@@ -294,3 +294,14 @@ func setKeys(set map[string]struct{}) []string {
 func projectKey(owner, name string) string {
 	return owner + "||" + name
 }
+
+func derefString(value *string) string {
+	if value == nil {
+		return ""
+	}
+	return *value
+}
+
+func ptrString(value string) *string {
+	return &value
+}

cmd/migrate_project_updated_at/main.go

@@ -0,0 +1,173 @@
+package main
+
+import (
+	"flag"
+	"log"
+	"log/slog"
+	"sort"
+	"time"
+
+	"git.mchus.pro/mchus/quoteforge/internal/appstate"
+	"git.mchus.pro/mchus/quoteforge/internal/localdb"
+	"git.mchus.pro/mchus/quoteforge/internal/models"
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+type projectTimestampRow struct {
+	UUID      string
+	UpdatedAt time.Time
+}
+
+type updatePlanRow struct {
+	UUID            string
+	Code            string
+	Variant         string
+	LocalUpdatedAt  time.Time
+	ServerUpdatedAt time.Time
+}
+
+func main() {
+	defaultLocalDBPath, err := appstate.ResolveDBPath("")
+	if err != nil {
+		log.Fatalf("failed to resolve default local SQLite path: %v", err)
+	}
+
+	localDBPath := flag.String("localdb", defaultLocalDBPath, "path to local SQLite database (default: user state dir or QFS_DB_PATH)")
+	apply := flag.Bool("apply", false, "apply updates to local SQLite (default is preview only)")
+	flag.Parse()
+
+	local, err := localdb.New(*localDBPath)
+	if err != nil {
+		log.Fatalf("failed to initialize local database: %v", err)
+	}
+	defer local.Close()
+
+	if !local.HasSettings() {
+		log.Fatalf("SQLite connection settings are not configured. Run qfs setup first.")
+	}
+
+	dsn, err := local.GetDSN()
+	if err != nil {
+		log.Fatalf("failed to build DSN from SQLite settings: %v", err)
+	}
+
+	db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		log.Fatalf("failed to connect to MariaDB: %v", err)
+	}
+
+	serverRows, err := loadServerProjects(db)
+	if err != nil {
+		log.Fatalf("failed to load server projects: %v", err)
+	}
+
+	localProjects, err := local.GetAllProjects(true)
+	if err != nil {
+		log.Fatalf("failed to load local projects: %v", err)
+	}
+
+	plan := buildUpdatePlan(localProjects, serverRows)
+	printPlan(plan, *apply)
+
+	if !*apply || len(plan) == 0 {
+		return
+	}
+
+	updated := 0
+	for i := range plan {
+		project, err := local.GetProjectByUUID(plan[i].UUID)
+		if err != nil {
+			log.Printf("skip %s: load local project: %v", plan[i].UUID, err)
+			continue
+		}
+		project.UpdatedAt = plan[i].ServerUpdatedAt
+		if err := local.SaveProjectPreservingUpdatedAt(project); err != nil {
+			log.Printf("skip %s: save local project: %v", plan[i].UUID, err)
+			continue
+		}
+		updated++
+	}
+
+	log.Printf("updated %d local project timestamps", updated)
+}
+
+func loadServerProjects(db *gorm.DB) (map[string]time.Time, error) {
+	var rows []projectTimestampRow
+	if err := db.Model(&models.Project{}).
+		Select("uuid, updated_at").
+		Find(&rows).Error; err != nil {
+		return nil, err
+	}
+
+	out := make(map[string]time.Time, len(rows))
+	for _, row := range rows {
+		if row.UUID == "" {
+			continue
+		}
+		out[row.UUID] = row.UpdatedAt
+	}
+	return out, nil
+}
+
+func buildUpdatePlan(localProjects []localdb.LocalProject, serverRows map[string]time.Time) []updatePlanRow {
+	plan := make([]updatePlanRow, 0)
+	for i := range localProjects {
+		project := localProjects[i]
+		serverUpdatedAt, ok := serverRows[project.UUID]
+		if !ok {
+			continue
+		}
+		if project.UpdatedAt.Equal(serverUpdatedAt) {
+			continue
+		}
+		plan = append(plan, updatePlanRow{
+			UUID:            project.UUID,
+			Code:            project.Code,
+			Variant:         project.Variant,
+			LocalUpdatedAt:  project.UpdatedAt,
+			ServerUpdatedAt: serverUpdatedAt,
+		})
+	}
+
+	sort.Slice(plan, func(i, j int) bool {
+		if plan[i].Code != plan[j].Code {
+			return plan[i].Code < plan[j].Code
+		}
+		return plan[i].Variant < plan[j].Variant
+	})
+
+	return plan
+}
+
+func printPlan(plan []updatePlanRow, apply bool) {
+	mode := "preview"
+	if apply {
+		mode = "apply"
+	}
+	log.Printf("project updated_at resync mode=%s changes=%d", mode, len(plan))
+	if len(plan) == 0 {
+		log.Printf("no local project timestamps need resync")
+		return
+	}
+	for _, row := range plan {
+		variant := row.Variant
+		if variant == "" {
+			variant = "main"
+		}
+		log.Printf("%s [%s] local=%s server=%s", row.Code, variant, formatStamp(row.LocalUpdatedAt), formatStamp(row.ServerUpdatedAt))
+	}
+	if !apply {
+		slog.Info("Re-run with -apply to write server updated_at into local SQLite.")
+	}
+}
+
+func formatStamp(value time.Time) string {
+	if value.IsZero() {
+		return "zero"
+	}
+	return value.Format(time.RFC3339)
+}

cmd/qfs/config_migration_test.go

@@ -39,6 +39,10 @@ logging:
 		t.Fatalf("load legacy config: %v", err)
 	}
 	setConfigDefaults(cfg)
+	cfg.Server.Host, _, err = normalizeLoopbackServerHost(cfg.Server.Host)
+	if err != nil {
+		t.Fatalf("normalize server host: %v", err)
+	}
 	if err := migrateConfigFileToRuntimeShape(path, cfg); err != nil {
 		t.Fatalf("migrate config: %v", err)
 	}
@@ -60,7 +64,43 @@ logging:
 	if !strings.Contains(text, "port: 9191") {
 		t.Fatalf("migrated config did not preserve server port:\n%s", text)
 	}
+	if !strings.Contains(text, "host: 127.0.0.1") {
+		t.Fatalf("migrated config did not normalize server host:\n%s", text)
+	}
 	if !strings.Contains(text, "level: debug") {
 		t.Fatalf("migrated config did not preserve logging level:\n%s", text)
 	}
 }
+
+func TestNormalizeLoopbackServerHost(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		host        string
+		want        string
+		wantChanged bool
+		wantErr     bool
+	}{
+		{host: "127.0.0.1", want: "127.0.0.1", wantChanged: false, wantErr: false},
+		{host: "localhost", want: "127.0.0.1", wantChanged: true, wantErr: false},
+		{host: "::1", want: "127.0.0.1", wantChanged: true, wantErr: false},
+		{host: "0.0.0.0", want: "127.0.0.1", wantChanged: true, wantErr: false},
+		{host: "192.168.1.10", want: "127.0.0.1", wantChanged: true, wantErr: false},
+	}
+
+	for _, tc := range cases {
+		got, changed, err := normalizeLoopbackServerHost(tc.host)
+		if tc.wantErr && err == nil {
+			t.Fatalf("expected error for host %q", tc.host)
+		}
+		if !tc.wantErr && err != nil {
+			t.Fatalf("unexpected error for host %q: %v", tc.host, err)
+		}
+		if got != tc.want {
+			t.Fatalf("unexpected normalized host for %q: got %q want %q", tc.host, got, tc.want)
+		}
+		if changed != tc.wantChanged {
+			t.Fatalf("unexpected changed flag for %q: got %t want %t", tc.host, changed, tc.wantChanged)
+		}
+	}
+}

cmd/qfs/request_logger_test.go

@@ -0,0 +1,48 @@
+package main
+
+import (
+	"bytes"
+	"errors"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestRequestLoggerDoesNotLogResponseBody(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	var logBuffer bytes.Buffer
+	previousLogger := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(&logBuffer, &slog.HandlerOptions{})))
+	defer slog.SetDefault(previousLogger)
+
+	router := gin.New()
+	router.Use(requestLogger())
+	router.GET("/fail", func(c *gin.Context) {
+		_ = c.Error(errors.New("root cause"))
+		c.JSON(http.StatusBadRequest, gin.H{"error": "do not log this body"})
+	})
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/fail?debug=1", nil)
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", rec.Code)
+	}
+
+	logOutput := logBuffer.String()
+	if !strings.Contains(logOutput, "request failed") {
+		t.Fatalf("expected request failure log, got %q", logOutput)
+	}
+	if strings.Contains(logOutput, "do not log this body") {
+		t.Fatalf("response body leaked into logs: %q", logOutput)
+	}
+	if !strings.Contains(logOutput, "root cause") {
+		t.Fatalf("expected error details in logs, got %q", logOutput)
+	}
+}

cmd/qfs/versioning_api_test.go

@@ -3,10 +3,12 @@ package main
 import (
 	"bytes"
 	"encoding/json"
+	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"git.mchus.pro/mchus/quoteforge/internal/config"
@@ -37,7 +39,7 @@ func TestConfigurationVersioningAPI(t *testing.T) {
 
 	cfg := &config.Config{}
 	setConfigDefaults(cfg)
-	router, _, err := setupRouter(cfg, local, connMgr, nil, "tester", nil)
+	router, _, err := setupRouter(cfg, local, connMgr, "tester", nil)
 	if err != nil {
 		t.Fatalf("setup router: %v", err)
 	}
@@ -77,7 +79,7 @@ func TestConfigurationVersioningAPI(t *testing.T) {
 	if err := json.Unmarshal(rbRec.Body.Bytes(), &rbResp); err != nil {
 		t.Fatalf("unmarshal rollback response: %v", err)
 	}
-	if rbResp.Message == "" || rbResp.CurrentVersion.VersionNo != 3 {
+	if rbResp.Message == "" || rbResp.CurrentVersion.VersionNo != 2 {
 		t.Fatalf("unexpected rollback response: %+v", rbResp)
 	}
 
@@ -144,12 +146,12 @@ func TestProjectArchiveHidesConfigsAndCloneIntoProject(t *testing.T) {
 
 	cfg := &config.Config{}
 	setConfigDefaults(cfg)
-	router, _, err := setupRouter(cfg, local, connMgr, nil, "tester", nil)
+	router, _, err := setupRouter(cfg, local, connMgr, "tester", nil)
 	if err != nil {
 		t.Fatalf("setup router: %v", err)
 	}
 
-	createProjectReq := httptest.NewRequest(http.MethodPost, "/api/projects", bytes.NewReader([]byte(`{"name":"P1"}`)))
+	createProjectReq := httptest.NewRequest(http.MethodPost, "/api/projects", bytes.NewReader([]byte(`{"name":"P1","code":"P1"}`)))
 	createProjectReq.Header.Set("Content-Type", "application/json")
 	createProjectRec := httptest.NewRecorder()
 	router.ServeHTTP(createProjectRec, createProjectReq)
@@ -238,12 +240,12 @@ func TestConfigMoveToProjectEndpoint(t *testing.T) {
 	local, connMgr, _ := newAPITestStack(t)
 	cfg := &config.Config{}
 	setConfigDefaults(cfg)
-	router, _, err := setupRouter(cfg, local, connMgr, nil, "tester", nil)
+	router, _, err := setupRouter(cfg, local, connMgr, "tester", nil)
 	if err != nil {
 		t.Fatalf("setup router: %v", err)
 	}
 
-	createProjectReq := httptest.NewRequest(http.MethodPost, "/api/projects", bytes.NewReader([]byte(`{"name":"Move Project"}`)))
+	createProjectReq := httptest.NewRequest(http.MethodPost, "/api/projects", bytes.NewReader([]byte(`{"name":"Move Project","code":"MOVE"}`)))
 	createProjectReq.Header.Set("Content-Type", "application/json")
 	createProjectRec := httptest.NewRecorder()
 	router.ServeHTTP(createProjectRec, createProjectReq)
@@ -290,6 +292,88 @@ func TestConfigMoveToProjectEndpoint(t *testing.T) {
 	}
 }
 
+func TestVendorImportRejectsOversizedUpload(t *testing.T) {
+	moveToRepoRoot(t)
+
+	prevLimit := vendorImportMaxBytes
+	vendorImportMaxBytes = 128
+	defer func() { vendorImportMaxBytes = prevLimit }()
+
+	local, connMgr, _ := newAPITestStack(t)
+	cfg := &config.Config{}
+	setConfigDefaults(cfg)
+	router, _, err := setupRouter(cfg, local, connMgr, "tester", nil)
+	if err != nil {
+		t.Fatalf("setup router: %v", err)
+	}
+
+	createProjectReq := httptest.NewRequest(http.MethodPost, "/api/projects", bytes.NewReader([]byte(`{"name":"Import Project","code":"IMP"}`)))
+	createProjectReq.Header.Set("Content-Type", "application/json")
+	createProjectRec := httptest.NewRecorder()
+	router.ServeHTTP(createProjectRec, createProjectReq)
+	if createProjectRec.Code != http.StatusCreated {
+		t.Fatalf("create project status=%d body=%s", createProjectRec.Code, createProjectRec.Body.String())
+	}
+
+	var project models.Project
+	if err := json.Unmarshal(createProjectRec.Body.Bytes(), &project); err != nil {
+		t.Fatalf("unmarshal project: %v", err)
+	}
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	part, err := writer.CreateFormFile("file", "huge.xml")
+	if err != nil {
+		t.Fatalf("create form file: %v", err)
+	}
+	payload := "<CFXML>" + strings.Repeat("A", int(vendorImportMaxBytes)+1) + "</CFXML>"
+	if _, err := part.Write([]byte(payload)); err != nil {
+		t.Fatalf("write multipart payload: %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close multipart writer: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/projects/"+project.UUID+"/vendor-import", &body)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for oversized upload, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "1 GiB") {
+		t.Fatalf("expected size limit message, got %s", rec.Body.String())
+	}
+}
+
+func TestCreateConfigMalformedJSONReturnsGenericError(t *testing.T) {
+	moveToRepoRoot(t)
+
+	local, connMgr, _ := newAPITestStack(t)
+	cfg := &config.Config{}
+	setConfigDefaults(cfg)
+	router, _, err := setupRouter(cfg, local, connMgr, "tester", nil)
+	if err != nil {
+		t.Fatalf("setup router: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/api/configs", bytes.NewReader([]byte(`{"name":`)))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for malformed json, got %d body=%s", rec.Code, rec.Body.String())
+	}
+	if strings.Contains(strings.ToLower(rec.Body.String()), "unexpected eof") {
+		t.Fatalf("expected sanitized error body, got %s", rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "invalid request") {
+		t.Fatalf("expected generic invalid request message, got %s", rec.Body.String())
+	}
+}
+
 func newAPITestStack(t *testing.T) (*localdb.LocalDB, *db.ConnectionManager, *services.LocalConfigurationService) {
 	t.Helper()
 

config.example.yaml

@@ -1,58 +1,18 @@
-# QuoteForge Configuration
-# Copy this file to config.yaml and update values
+# QuoteForge runtime config
+# Runtime creates a minimal config automatically on first start.
+# This file is only a reference template.
 
 server:
-  host: "127.0.0.1"  # Use 0.0.0.0 to listen on all interfaces
+  host: "127.0.0.1"  # Loopback only; remote HTTP binding is unsupported
   port: 8080
   mode: "release"  # debug | release
   read_timeout: "30s"
   write_timeout: "30s"
 
-database:
-  host: "localhost"
-  port: 3306
-  name: "RFQ_LOG"
-  user: "quoteforge"
-  password: "CHANGE_ME"
-  max_open_conns: 25
-  max_idle_conns: 5
-  conn_max_lifetime: "5m"
-
-auth:
-  jwt_secret: "CHANGE_ME_MIN_32_CHARACTERS_LONG"
-  token_expiry: "24h"
-  refresh_expiry: "168h"  # 7 days
-
-pricing:
-  default_method: "weighted_median"  # median | average | weighted_median
-  default_period_days: 90
-  freshness_green_days: 30
-  freshness_yellow_days: 60
-  freshness_red_days: 90
-  min_quotes_for_median: 3
-  popularity_decay_days: 180
-
-export:
-  temp_dir: "/tmp/quoteforge-exports"
-  max_file_age: "1h"
-  company_name: "Your Company Name"
-
-alerts:
-  enabled: true
-  check_interval: "1h"
-  high_demand_threshold: 5      # КП за 30 дней
-  trending_threshold_percent: 50 # % роста для алерта
-
-notifications:
-  email_enabled: false
-  smtp_host: "smtp.example.com"
-  smtp_port: 587
-  smtp_user: ""
-  smtp_password: ""
-  from_address: "quoteforge@example.com"
+backup:
+  time: "00:00"
 
 logging:
   level: "info"  # debug | info | warn | error
-  format: "json" # json | text
-  output: "stdout" # stdout | file
-  file_path: "/var/log/quoteforge/app.log"
+  format: "json"  # json | text
+  output: "stdout"  # stdout | stderr | /path/to/file

docs/storage-components-guide.md

@@ -0,0 +1,213 @@
+# Руководство по составлению каталога лотов СХД
+
+## Что такое LOT и зачем он нужен
+
+LOT — это внутренний идентификатор типа компонента в системе QuoteForge.
+
+Каждый LOT представляет одну рыночную позицию и хранит **средневзвешенную рыночную цену**, рассчитанную по историческим данным от поставщиков. Это позволяет получать актуальную оценку стоимости независимо от конкретного поставщика или прайс-листа.
+
+Партномера вендора (Part Number, Feature Code) сами по себе не имеют цены в системе — они **переводятся в LOT** через книгу партномеров. Именно через LOT происходит расценка конфигурации.
+
+**Пример:** Feature Code `B4B9` и Part Number `4C57A14368` — это два разных обозначения одной и той же HIC-карты от Lenovo. Оба маппируются на один LOT `HIC_4pFC32`, у которого есть рыночная цена.
+
+---
+
+## Категории и вкладки конфигуратора
+
+Категория LOT определяет, в какой вкладке конфигуратора он появится.
+
+| Код категории | Название | Вкладка | Что сюда относится |
+|---|---|---|---|
+| `ENC` | Storage Enclosure | **Base** | Дисковая полка без контроллера |
+| `DKC` | Disk/Controller Enclosure | **Base** | Контроллерная полка: модель СХД + тип дисков + кол-во слотов + кол-во контроллеров |
+| `CTL` | Storage Controller | **Base** | Контроллер СХД: объём кэша + встроенные хост-порты |
+| `HIC` | Host Interface Card | **PCI** | HIC-карты СХД: интерфейсы подключения (FC, iSCSI, SAS) |
+| `HDD` | HDD | **Storage** | Жёсткие диски (HDD) |
+| `SSD` | SSD | **Storage** | Твердотельные диски (SSD, NVMe) |
+| `ACC` | Accessories | **Accessories** | Кабели подключения, кабели питания |
+| `SW` | Software | **SW** | Программные лицензии |
+| *(прочее)* | — | **Other** | Гарантийные опции, инсталляция |
+
+---
+
+## Правила именования LOT
+
+Формат: `КАТЕГОРИЯ_МОДЕЛЬСХД_СПЕЦИФИКА`
+
+- только латиница, цифры и знак `_`
+- регистр — ВЕРХНИЙ
+- без пробелов, дефисов, точек
+- каждый LOT уникален — два разных компонента не могут иметь одинаковое имя
+
+### DKC — контроллерная полка
+
+Специфика: `ТИПДИСКА_СЛОТЫ_NCTRL`
+
+| Пример | Расшифровка |
+|---|---|
+| `DKC_DE4000H_SFF_24_2CTRL` | DE4000H, 24 слота SFF (2.5"), 2 контроллера |
+| `DKC_DE4000H_LFF_12_2CTRL` | DE4000H, 12 слотов LFF (3.5"), 2 контроллера |
+| `DKC_DE4000H_SFF_24_1CTRL` | DE4000H, 24 слота SFF, 1 контроллер (симплекс) |
+
+Обозначения типа диска: `SFF` — 2.5", `LFF` — 3.5", `NVMe` — U.2/U.3.
+
+### CTL — контроллер
+
+Специфика: `КЭШГБ_ПОРТЫТИП` (если встроенные порты есть) или `КЭШГБ_BASE` (если без портов, добавляются через HIC)
+
+| Пример | Расшифровка |
+|---|---|
+| `CTL_DE4000H_32GB_BASE` | 32GB кэш, без встроенных хост-портов |
+| `CTL_DE4000H_8GB_BASE` | 8GB кэш, без встроенных хост-портов |
+| `CTL_MSA2060_8GB_ISCSI10G_4P` | 8GB кэш, встроенные 4× iSCSI 10GbE |
+
+### HIC — HIC-карты (интерфейс подключения)
+
+Специфика: `NpПРОТОКОЛ` — без привязки к модели СХД, по аналогии с серверными `HBA_2pFC16`, `HBA_4pFC32_Gen6`.
+
+| Пример | Расшифровка |
+|---|---|
+| `HIC_4pFC32` | 4 порта FC 32Gb |
+| `HIC_4pFC16` | 4 порта FC 16G/10GbE |
+| `HIC_4p25G_iSCSI` | 4 порта 25G iSCSI |
+| `HIC_4p12G_SAS` | 4 порта SAS 12Gb |
+| `HIC_2p10G_BaseT` | 2 порта 10G Base-T |
+
+### HDD / SSD / NVMe — диски
+
+Диски **не привязываются к модели СХД** — используются существующие LOT из серверного каталога (`HDD_...`, `SSD_...`, `NVME_...`). Новые LOT для дисков СХД не создаются; партномера дисков маппируются на уже существующие серверные LOT.
+
+### ACC — кабели
+
+Кабели **не привязываются к модели СХД**. Формат: `ACC_CABLE_{ТИП}_{ДЛИНА}` — универсальные LOT, одинаковые для серверов и СХД.
+
+| Пример | Расшифровка |
+|---|---|
+| `ACC_CABLE_CAT6_10M` | Кабель CAT6 10м |
+| `ACC_CABLE_FC_OM4_3M` | Кабель FC LC-LC OM4 до 3м |
+| `ACC_CABLE_PWR_C13C14_15M` | Кабель питания C13–C14 1.5м |
+
+### SW — программные лицензии
+
+Специфика: краткое название функции.
+
+| Пример | Расшифровка |
+|---|---|
+| `SW_DE4000H_ASYNC_MIRROR` | Async Mirroring |
+| `SW_DE4000H_SNAPSHOT_512` | Snapshot 512 |
+
+---
+
+## Таблица лотов: DE4000H (пример заполнения)
+
+### DKC — контроллерная полка
+
+| lot_name | vendor | model | description | disk_slots | disk_type | controllers |
+|---|---|---|---|---|---|---|
+| `DKC_DE4000H_SFF_24_2CTRL` | Lenovo | DE4000H 2U24 | DE4000H, 24× SFF, 2 контроллера | 24 | SFF | 2 |
+| `DKC_DE4000H_LFF_12_2CTRL` | Lenovo | DE4000H 2U12 | DE4000H, 12× LFF, 2 контроллера | 12 | LFF | 2 |
+
+### CTL — контроллер
+
+| lot_name | vendor | model | description | cache_gb | host_ports |
+|---|---|---|---|---|---|
+| `CTL_DE4000H_32GB_BASE` | Lenovo | DE4000 Controller 32GB Gen2 | Контроллер DE4000, 32GB кэш, без встроенных портов | 32 | — |
+| `CTL_DE4000H_8GB_BASE` | Lenovo | DE4000 Controller 8GB Gen2 | Контроллер DE4000, 8GB кэш, без встроенных портов | 8 | — |
+
+### HIC — HIC-карты
+
+| lot_name | vendor | model | description |
+|---|---|---|---|
+| `HIC_2p10G_BaseT` | Lenovo | HIC 10GBASE-T 2-Ports | HIC 10GBASE-T, 2 порта |
+| `HIC_4p25G_iSCSI` | Lenovo | HIC 10/25GbE iSCSI 4-ports | HIC iSCSI 10/25GbE, 4 порта |
+| `HIC_4p12G_SAS` | Lenovo | HIC 12Gb SAS 4-ports | HIC SAS 12Gb, 4 порта |
+| `HIC_4pFC32` | Lenovo | HIC 32Gb FC 4-ports | HIC FC 32Gb, 4 порта |
+| `HIC_4pFC16` | Lenovo | HIC 16G FC/10GbE 4-ports | HIC FC 16G/10GbE, 4 порта |
+
+### HDD / SSD / NVMe / ACC — диски и кабели
+
+Для дисков и кабелей новые LOT не создаются. Партномера маппируются на существующие серверные LOT из каталога.
+
+### SW — программные лицензии
+
+| lot_name | vendor | model | description |
+|---|---|---|---|
+| `SW_DE4000H_ASYNC_MIRROR` | Lenovo | DE4000H Asynchronous Mirroring | Лицензия Async Mirroring |
+| `SW_DE4000H_SNAPSHOT_512` | Lenovo | DE4000H Snapshot Upgrade 512 | Лицензия Snapshot 512 |
+| `SW_DE4000H_SYNC_MIRROR` | Lenovo | DE4000 Synchronous Mirroring | Лицензия Sync Mirroring |
+
+---
+
+## Таблица партномеров: DE4000H (пример заполнения)
+
+Каждый Feature Code и Part Number должен быть привязан к своему LOT.
+Если у компонента есть оба — добавить две строки.
+
+| partnumber | lot_name | описание |
+|---|---|---|
+| `BEY7` | `ENC_2U24_CHASSIS` | Lenovo ThinkSystem Storage 2U24 Chassis |
+| `BQA0` | `CTL_DE4000H_32GB_BASE` | DE4000 Controller 32GB Gen2 |
+| `BQ9Z` | `CTL_DE4000H_8GB_BASE` | DE4000 Controller 8GB Gen2 |
+| `B4B1` | `HIC_2p10G_BaseT` | HIC 10GBASE-T 2-Ports |
+| `4C57A14376` | `HIC_2p10G_BaseT` | HIC 10GBASE-T 2-Ports |
+| `B4BA` | `HIC_4p25G_iSCSI` | HIC 10/25GbE iSCSI 4-ports |
+| `4C57A14369` | `HIC_4p25G_iSCSI` | HIC 10/25GbE iSCSI 4-ports |
+| `B4B8` | `HIC_4p12G_SAS` | HIC 12Gb SAS 4-ports |
+| `4C57A14367` | `HIC_4p12G_SAS` | HIC 12Gb SAS 4-ports |
+| `B4B9` | `HIC_4pFC32` | HIC 32Gb FC 4-ports |
+| `4C57A14368` | `HIC_4pFC32` | HIC 32Gb FC 4-ports |
+| `B4B7` | `HIC_4pFC16` | HIC 16G FC/10GbE 4-ports |
+| `4C57A14366` | `HIC_4pFC16` | HIC 16G FC/10GbE 4-ports |
+| `BW12` | `HDD_SAS_02.4TB` | 2.4TB 10K 2.5" HDD 2U24 |
+| `4XB7A88046` | `HDD_SAS_02.4TB` | 2.4TB 10K 2.5" HDD 2U24 |
+| `B4C0` | `HDD_SAS_01.8TB` | 1.8TB 10K 2.5" HDD SED FIPS |
+| `4XB7A14114` | `HDD_SAS_01.8TB` | 1.8TB 10K 2.5" HDD SED FIPS |
+| `BW13` | `HDD_SAS_02.4TB` | 2.4TB 10K 2.5" HDD FIPS |
+| `4XB7A88048` | `HDD_SAS_02.4TB` | 2.4TB 10K 2.5" HDD FIPS |
+| `BKUQ` | `SSD_SAS_0.960T` | 960GB 1DWD 2.5" SSD |
+| `4XB7A74948` | `SSD_SAS_0.960T` | 960GB 1DWD 2.5" SSD |
+| `BKUT` | `SSD_SAS_01.92T` | 1.92TB 1DWD 2.5" SSD |
+| `4XB7A74951` | `SSD_SAS_01.92T` | 1.92TB 1DWD 2.5" SSD |
+| `BKUK` | `SSD_SAS_03.84T` | 3.84TB 1DWD 2.5" SSD |
+| `4XB7A74955` | `SSD_SAS_03.84T` | 3.84TB 1DWD 2.5" SSD |
+| `B4RY` | `SSD_SAS_07.68T` | 7.68TB 1DWD 2.5" SSD |
+| `4XB7A14176` | `SSD_SAS_07.68T` | 7.68TB 1DWD 2.5" SSD |
+| `B4CD` | `SSD_SAS_15.36T` | 15.36TB 1DWD 2.5" SSD |
+| `4XB7A14110` | `SSD_SAS_15.36T` | 15.36TB 1DWD 2.5" SSD |
+| `BWCJ` | `SSD_SAS_03.84T` | 3.84TB 1DWD 2.5" SSD FIPS |
+| `4XB7A88469` | `SSD_SAS_03.84T` | 3.84TB 1DWD 2.5" SSD FIPS |
+| `BW2B` | `SSD_SAS_15.36T` | 15.36TB 1DWD 2.5" SSD SED |
+| `4XB7A88466` | `SSD_SAS_15.36T` | 15.36TB 1DWD 2.5" SSD SED |
+| `AVFW` | `ACC_CABLE_CAT6_1M` | CAT6 0.75-1.5m |
+| `A1MT` | `ACC_CABLE_CAT6_10M` | CAT6 10m |
+| `90Y3718` | `ACC_CABLE_CAT6_10M` | CAT6 10m |
+| `A1MW` | `ACC_CABLE_CAT6_25M` | CAT6 25m |
+| `90Y3727` | `ACC_CABLE_CAT6_25M` | CAT6 25m |
+| `39Y7937` | `ACC_CABLE_PWR_C13C14_15M` | C13–C14 1.5m |
+| `39Y7938` | `ACC_CABLE_PWR_C13C20_28M` | C13–C20 2.8m |
+| `4L67A08371` | `ACC_CABLE_PWR_C13C14_43M` | C13–C14 4.3m |
+| `C932` | `SW_DE4000H_ASYNC_MIRROR` | DE4000H Asynchronous Mirroring |
+| `00WE123` | `SW_DE4000H_ASYNC_MIRROR` | DE4000H Asynchronous Mirroring |
+| `C930` | `SW_DE4000H_SNAPSHOT_512` | DE4000H Snapshot Upgrade 512 |
+| `C931` | `SW_DE4000H_SYNC_MIRROR` | DE4000 Synchronous Mirroring |
+
+---
+
+## Шаблон для новых моделей СХД
+
+```
+DKC_МОДЕЛЬ_ТИПДИСКА_СЛОТЫ_NCTRL   — контроллерная полка
+CTL_МОДЕЛЬ_КЭШГБ_ПОРТЫ            — контроллер
+HIC_МОДЕЛЬ_ПРОТОКОЛ_СКОРОСТЬ_ПОРТЫ — HIC-карта (интерфейс подключения)
+SW_МОДЕЛЬ_ФУНКЦИЯ                 — лицензия
+```
+
+Диски (HDD/SSD/NVMe) и кабели (ACC) — маппируются на существующие серверные LOT, новые не создаются.
+
+Пример для HPE MSA 2060:
+```
+DKC_MSA2060_SFF_24_2CTRL
+CTL_MSA2060_8GB_ISCSI10G_4P
+HIC_MSA2060_FC32G_2P
+SW_MSA2060_REMOTE_SNAP
+```

go.mod

@@ -5,9 +5,8 @@ go 1.24.0
 require (
 	github.com/gin-gonic/gin v1.9.1
 	github.com/glebarez/sqlite v1.11.0
-	github.com/golang-jwt/jwt/v5 v5.3.0
+	github.com/go-sql-driver/mysql v1.7.1
 	github.com/google/uuid v1.6.0
-	golang.org/x/crypto v0.43.0
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/mysql v1.5.2
 	gorm.io/gorm v1.25.7
@@ -23,7 +22,6 @@ require (
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-playground/validator/v10 v10.14.0 // indirect
-	github.com/go-sql-driver/mysql v1.7.1 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
@@ -39,6 +37,7 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.11 // indirect
 	golang.org/x/arch v0.3.0 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
 	golang.org/x/net v0.46.0 // indirect
 	golang.org/x/sys v0.37.0 // indirect
 	golang.org/x/text v0.30.0 // indirect

go.sum

@@ -32,8 +32,6 @@ github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrt
 github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
-github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=

internal/appstate/backup.go

@@ -0,0 +1,393 @@
+package appstate
+
+import (
+	"archive/zip"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/glebarez/sqlite"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+type backupPeriod struct {
+	name      string
+	retention int
+	key       func(time.Time) string
+	date      func(time.Time) string
+}
+
+var backupPeriods = []backupPeriod{
+	{
+		name:      "daily",
+		retention: 7,
+		key: func(t time.Time) string {
+			return t.Format("2006-01-02")
+		},
+		date: func(t time.Time) string {
+			return t.Format("2006-01-02")
+		},
+	},
+	{
+		name:      "weekly",
+		retention: 4,
+		key: func(t time.Time) string {
+			y, w := t.ISOWeek()
+			return fmt.Sprintf("%04d-W%02d", y, w)
+		},
+		date: func(t time.Time) string {
+			return t.Format("2006-01-02")
+		},
+	},
+	{
+		name:      "monthly",
+		retention: 12,
+		key: func(t time.Time) string {
+			return t.Format("2006-01")
+		},
+		date: func(t time.Time) string {
+			return t.Format("2006-01-02")
+		},
+	},
+	{
+		name:      "yearly",
+		retention: 10,
+		key: func(t time.Time) string {
+			return t.Format("2006")
+		},
+		date: func(t time.Time) string {
+			return t.Format("2006-01-02")
+		},
+	},
+}
+
+const (
+	envBackupDisable = "QFS_BACKUP_DISABLE"
+	envBackupDir     = "QFS_BACKUP_DIR"
+)
+
+var backupNow = time.Now
+
+// EnsureRotatingLocalBackup creates or refreshes daily/weekly/monthly/yearly backups
+// for the local database and config. It keeps a limited number per period.
+func EnsureRotatingLocalBackup(dbPath, configPath string) ([]string, error) {
+	if isBackupDisabled() {
+		return nil, nil
+	}
+	if dbPath == "" {
+		return nil, nil
+	}
+
+	if _, err := os.Stat(dbPath); err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("stat db: %w", err)
+	}
+
+	root := resolveBackupRoot(dbPath)
+	if err := validateBackupRoot(root); err != nil {
+		return nil, err
+	}
+	now := backupNow()
+
+	created := make([]string, 0)
+	for _, period := range backupPeriods {
+		newFiles, err := ensurePeriodBackup(root, period, now, dbPath, configPath)
+		if err != nil {
+			return created, err
+		}
+		if len(newFiles) > 0 {
+			created = append(created, newFiles...)
+		}
+	}
+
+	return created, nil
+}
+
+func resolveBackupRoot(dbPath string) string {
+	if fromEnv := strings.TrimSpace(os.Getenv(envBackupDir)); fromEnv != "" {
+		return filepath.Clean(fromEnv)
+	}
+	return filepath.Join(filepath.Dir(dbPath), "backups")
+}
+
+func validateBackupRoot(root string) error {
+	absRoot, err := filepath.Abs(root)
+	if err != nil {
+		return fmt.Errorf("resolve backup root: %w", err)
+	}
+
+	if gitRoot, ok := findGitWorktreeRoot(absRoot); ok {
+		return fmt.Errorf("backup root must stay outside git worktree: %s is inside %s", absRoot, gitRoot)
+	}
+
+	return nil
+}
+
+func findGitWorktreeRoot(path string) (string, bool) {
+	current := filepath.Clean(path)
+	info, err := os.Stat(current)
+	if err == nil && !info.IsDir() {
+		current = filepath.Dir(current)
+	}
+
+	for {
+		gitPath := filepath.Join(current, ".git")
+		if _, err := os.Stat(gitPath); err == nil {
+			return current, true
+		}
+
+		parent := filepath.Dir(current)
+		if parent == current {
+			return "", false
+		}
+		current = parent
+	}
+}
+
+func isBackupDisabled() bool {
+	val := strings.ToLower(strings.TrimSpace(os.Getenv(envBackupDisable)))
+	return val == "1" || val == "true" || val == "yes"
+}
+
+func ensurePeriodBackup(root string, period backupPeriod, now time.Time, dbPath, configPath string) ([]string, error) {
+	key := period.key(now)
+	periodDir := filepath.Join(root, period.name)
+	if err := os.MkdirAll(periodDir, 0755); err != nil {
+		return nil, fmt.Errorf("create %s backup dir: %w", period.name, err)
+	}
+
+	if hasBackupForKey(periodDir, key) {
+		return nil, nil
+	}
+
+	archiveName := fmt.Sprintf("qfs-backp-%s.zip", period.date(now))
+	archivePath := filepath.Join(periodDir, archiveName)
+
+	if err := createBackupArchive(archivePath, dbPath, configPath); err != nil {
+		return nil, fmt.Errorf("create %s backup archive: %w", period.name, err)
+	}
+
+	if err := writePeriodMarker(periodDir, key); err != nil {
+		return []string{archivePath}, err
+	}
+
+	if err := pruneOldBackups(periodDir, period.retention); err != nil {
+		return []string{archivePath}, err
+	}
+
+	return []string{archivePath}, nil
+}
+
+func hasBackupForKey(periodDir, key string) bool {
+	marker := periodMarker{Key: ""}
+	data, err := os.ReadFile(periodMarkerPath(periodDir))
+	if err != nil {
+		return false
+	}
+	if err := json.Unmarshal(data, &marker); err != nil {
+		return false
+	}
+	return marker.Key == key
+}
+
+type periodMarker struct {
+	Key string `json:"key"`
+}
+
+func periodMarkerPath(periodDir string) string {
+	return filepath.Join(periodDir, ".period.json")
+}
+
+func writePeriodMarker(periodDir, key string) error {
+	data, err := json.MarshalIndent(periodMarker{Key: key}, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(periodMarkerPath(periodDir), data, 0644)
+}
+
+func pruneOldBackups(periodDir string, keep int) error {
+	entries, err := os.ReadDir(periodDir)
+	if err != nil {
+		return fmt.Errorf("read backups dir: %w", err)
+	}
+
+	files := make([]os.DirEntry, 0, len(entries))
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+		if strings.HasSuffix(entry.Name(), ".zip") {
+			files = append(files, entry)
+		}
+	}
+
+	if len(files) <= keep {
+		return nil
+	}
+
+	sort.Slice(files, func(i, j int) bool {
+		infoI, errI := files[i].Info()
+		infoJ, errJ := files[j].Info()
+		if errI != nil || errJ != nil {
+			return files[i].Name() < files[j].Name()
+		}
+		return infoI.ModTime().Before(infoJ.ModTime())
+	})
+
+	for i := 0; i < len(files)-keep; i++ {
+		path := filepath.Join(periodDir, files[i].Name())
+		if err := os.Remove(path); err != nil {
+			return fmt.Errorf("remove old backup %s: %w", path, err)
+		}
+	}
+
+	return nil
+}
+
+func createBackupArchive(destPath, dbPath, configPath string) error {
+	snapshotPath, cleanup, err := createSQLiteSnapshot(dbPath)
+	if err != nil {
+		return err
+	}
+	defer cleanup()
+
+	file, err := os.Create(destPath)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	zipWriter := zip.NewWriter(file)
+	if err := addZipFileAs(zipWriter, snapshotPath, filepath.Base(dbPath)); err != nil {
+		_ = zipWriter.Close()
+		return err
+	}
+
+	if strings.TrimSpace(configPath) != "" {
+		_ = addZipOptionalFile(zipWriter, configPath)
+	}
+
+	if err := zipWriter.Close(); err != nil {
+		return err
+	}
+	return file.Sync()
+}
+
+func createSQLiteSnapshot(dbPath string) (string, func(), error) {
+	tempFile, err := os.CreateTemp("", "qfs-backup-*.db")
+	if err != nil {
+		return "", func() {}, err
+	}
+	tempPath := tempFile.Name()
+	if err := tempFile.Close(); err != nil {
+		_ = os.Remove(tempPath)
+		return "", func() {}, err
+	}
+	if err := os.Remove(tempPath); err != nil && !os.IsNotExist(err) {
+		return "", func() {}, err
+	}
+
+	cleanup := func() {
+		_ = os.Remove(tempPath)
+	}
+
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		cleanup()
+		return "", func() {}, err
+	}
+
+	sqlDB, err := db.DB()
+	if err != nil {
+		cleanup()
+		return "", func() {}, err
+	}
+	defer sqlDB.Close()
+
+	if err := db.Exec("PRAGMA busy_timeout = 5000").Error; err != nil {
+		cleanup()
+		return "", func() {}, fmt.Errorf("configure sqlite busy_timeout: %w", err)
+	}
+
+	literalPath := strings.ReplaceAll(tempPath, "'", "''")
+	if err := vacuumIntoWithRetry(db, literalPath); err != nil {
+		cleanup()
+		return "", func() {}, err
+	}
+
+	return tempPath, cleanup, nil
+}
+
+func vacuumIntoWithRetry(db *gorm.DB, literalPath string) error {
+	var lastErr error
+	for attempt := 0; attempt < 3; attempt++ {
+		if err := db.Exec("VACUUM INTO '" + literalPath + "'").Error; err != nil {
+			lastErr = err
+			if !isSQLiteBusyError(err) {
+				return fmt.Errorf("create sqlite snapshot: %w", err)
+			}
+			time.Sleep(time.Duration(attempt+1) * 250 * time.Millisecond)
+			continue
+		}
+		return nil
+	}
+	return fmt.Errorf("create sqlite snapshot after retries: %w", lastErr)
+}
+
+func isSQLiteBusyError(err error) bool {
+	if err == nil {
+		return false
+	}
+	lower := strings.ToLower(err.Error())
+	return strings.Contains(lower, "database is locked") || strings.Contains(lower, "database is busy")
+}
+
+func addZipOptionalFile(writer *zip.Writer, path string) error {
+	if _, err := os.Stat(path); err != nil {
+		return nil
+	}
+	return addZipFile(writer, path)
+}
+
+func addZipFile(writer *zip.Writer, path string) error {
+	return addZipFileAs(writer, path, filepath.Base(path))
+}
+
+func addZipFileAs(writer *zip.Writer, path string, archiveName string) error {
+	in, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer in.Close()
+
+	info, err := in.Stat()
+	if err != nil {
+		return err
+	}
+
+	header, err := zip.FileInfoHeader(info)
+	if err != nil {
+		return err
+	}
+	header.Name = archiveName
+	header.Method = zip.Deflate
+
+	out, err := writer.CreateHeader(header)
+	if err != nil {
+		return err
+	}
+
+	_, err = io.Copy(out, in)
+	return err
+}

internal/appstate/backup_test.go

@@ -0,0 +1,157 @@
+package appstate
+
+import (
+	"archive/zip"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/glebarez/sqlite"
+	"gorm.io/gorm"
+)
+
+func TestEnsureRotatingLocalBackupCreatesAndRotates(t *testing.T) {
+	temp := t.TempDir()
+	dbPath := filepath.Join(temp, "qfs.db")
+	cfgPath := filepath.Join(temp, "config.yaml")
+
+	if err := writeTestSQLiteDB(dbPath); err != nil {
+		t.Fatalf("write sqlite db: %v", err)
+	}
+	if err := os.WriteFile(cfgPath, []byte("cfg"), 0644); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	prevNow := backupNow
+	defer func() { backupNow = prevNow }()
+	backupNow = func() time.Time { return time.Date(2026, 2, 11, 10, 0, 0, 0, time.UTC) }
+
+	created, err := EnsureRotatingLocalBackup(dbPath, cfgPath)
+	if err != nil {
+		t.Fatalf("backup: %v", err)
+	}
+	if len(created) == 0 {
+		t.Fatalf("expected backup to be created")
+	}
+
+	dailyArchive := filepath.Join(temp, "backups", "daily", "qfs-backp-2026-02-11.zip")
+	if _, err := os.Stat(dailyArchive); err != nil {
+		t.Fatalf("daily archive missing: %v", err)
+	}
+	assertZipContains(t, dailyArchive, "qfs.db", "config.yaml")
+
+	backupNow = func() time.Time { return time.Date(2026, 2, 12, 10, 0, 0, 0, time.UTC) }
+	created, err = EnsureRotatingLocalBackup(dbPath, cfgPath)
+	if err != nil {
+		t.Fatalf("backup rotate: %v", err)
+	}
+	if len(created) == 0 {
+		t.Fatalf("expected backup to be created for new day")
+	}
+
+	dailyArchive = filepath.Join(temp, "backups", "daily", "qfs-backp-2026-02-12.zip")
+	if _, err := os.Stat(dailyArchive); err != nil {
+		t.Fatalf("daily archive missing after rotate: %v", err)
+	}
+}
+
+func TestEnsureRotatingLocalBackupEnvControls(t *testing.T) {
+	temp := t.TempDir()
+	dbPath := filepath.Join(temp, "qfs.db")
+	cfgPath := filepath.Join(temp, "config.yaml")
+
+	if err := writeTestSQLiteDB(dbPath); err != nil {
+		t.Fatalf("write sqlite db: %v", err)
+	}
+	if err := os.WriteFile(cfgPath, []byte("cfg"), 0644); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	backupRoot := filepath.Join(temp, "custom_backups")
+	t.Setenv(envBackupDir, backupRoot)
+
+	if _, err := EnsureRotatingLocalBackup(dbPath, cfgPath); err != nil {
+		t.Fatalf("backup with env: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(backupRoot, "daily", ".period.json")); err != nil {
+		t.Fatalf("expected backup in custom dir: %v", err)
+	}
+
+	t.Setenv(envBackupDisable, "1")
+	if _, err := EnsureRotatingLocalBackup(dbPath, cfgPath); err != nil {
+		t.Fatalf("backup disabled: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(backupRoot, "daily", ".period.json")); err != nil {
+		t.Fatalf("backup should remain from previous run: %v", err)
+	}
+}
+
+func TestEnsureRotatingLocalBackupRejectsGitWorktree(t *testing.T) {
+	temp := t.TempDir()
+	repoRoot := filepath.Join(temp, "repo")
+	if err := os.MkdirAll(filepath.Join(repoRoot, ".git"), 0755); err != nil {
+		t.Fatalf("mkdir git dir: %v", err)
+	}
+
+	dbPath := filepath.Join(repoRoot, "data", "qfs.db")
+	cfgPath := filepath.Join(repoRoot, "data", "config.yaml")
+	if err := os.MkdirAll(filepath.Dir(dbPath), 0755); err != nil {
+		t.Fatalf("mkdir data dir: %v", err)
+	}
+	if err := writeTestSQLiteDB(dbPath); err != nil {
+		t.Fatalf("write sqlite db: %v", err)
+	}
+	if err := os.WriteFile(cfgPath, []byte("cfg"), 0644); err != nil {
+		t.Fatalf("write cfg: %v", err)
+	}
+
+	_, err := EnsureRotatingLocalBackup(dbPath, cfgPath)
+	if err == nil {
+		t.Fatal("expected git worktree backup root to be rejected")
+	}
+	if !strings.Contains(err.Error(), "outside git worktree") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func writeTestSQLiteDB(path string) error {
+	db, err := gorm.Open(sqlite.Open(path), &gorm.Config{})
+	if err != nil {
+		return err
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		return err
+	}
+	defer sqlDB.Close()
+
+	return db.Exec(`
+		CREATE TABLE sample_items (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			name TEXT NOT NULL
+		);
+		INSERT INTO sample_items(name) VALUES ('backup');
+	`).Error
+}
+
+func assertZipContains(t *testing.T, archivePath string, expected ...string) {
+	t.Helper()
+
+	reader, err := zip.OpenReader(archivePath)
+	if err != nil {
+		t.Fatalf("open archive: %v", err)
+	}
+	defer reader.Close()
+
+	found := make(map[string]bool, len(reader.File))
+	for _, file := range reader.File {
+		found[file.Name] = true
+	}
+	for _, name := range expected {
+		if !found[name] {
+			t.Fatalf("archive %s missing %s", archivePath, name)
+		}
+	}
+}

internal/article/categories.go

@@ -71,13 +71,31 @@ func ResolveLotCategoriesStrict(local *localdb.LocalDB, serverPricelistID uint,
 	if err != nil {
 		return nil, err
 	}
+	missing := make([]string, 0)
 	for _, lot := range lotNames {
 		cat := strings.TrimSpace(cats[lot])
 		if cat == "" {
-			return nil, &MissingCategoryForLotError{LotName: lot}
+			missing = append(missing, lot)
+			continue
 		}
 		cats[lot] = cat
 	}
+	if len(missing) > 0 {
+		fallback, err := local.GetLocalComponentCategoriesByLotNames(missing)
+		if err != nil {
+			return nil, err
+		}
+		for _, lot := range missing {
+			if cat := strings.TrimSpace(fallback[lot]); cat != "" {
+				cats[lot] = cat
+			}
+		}
+		for _, lot := range missing {
+			if strings.TrimSpace(cats[lot]) == "" {
+				return nil, &MissingCategoryForLotError{LotName: lot}
+			}
+		}
+	}
 	return cats, nil
 }
 

internal/article/categories_test.go

@@ -45,6 +45,49 @@ func TestResolveLotCategoriesStrict_MissingCategoryReturnsError(t *testing.T) {
 	}
 }
 
+func TestResolveLotCategoriesStrict_FallbackToLocalComponents(t *testing.T) {
+	local, err := localdb.New(filepath.Join(t.TempDir(), "local.db"))
+	if err != nil {
+		t.Fatalf("init local db: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	if err := local.SaveLocalPricelist(&localdb.LocalPricelist{
+		ServerID:  2,
+		Source:    "estimate",
+		Version:   "S-2026-02-11-002",
+		Name:      "test",
+		CreatedAt: time.Now(),
+		SyncedAt:  time.Now(),
+	}); err != nil {
+		t.Fatalf("save local pricelist: %v", err)
+	}
+	localPL, err := local.GetLocalPricelistByServerID(2)
+	if err != nil {
+		t.Fatalf("get local pricelist: %v", err)
+	}
+	if err := local.SaveLocalPricelistItems([]localdb.LocalPricelistItem{
+		{PricelistID: localPL.ID, LotName: "CPU_B", LotCategory: "", Price: 10},
+	}); err != nil {
+		t.Fatalf("save local items: %v", err)
+	}
+	if err := local.DB().Create(&localdb.LocalComponent{
+		LotName:        "CPU_B",
+		Category:       "CPU",
+		LotDescription: "cpu",
+	}).Error; err != nil {
+		t.Fatalf("save local components: %v", err)
+	}
+
+	cats, err := ResolveLotCategoriesStrict(local, 2, []string{"CPU_B"})
+	if err != nil {
+		t.Fatalf("expected fallback, got error: %v", err)
+	}
+	if cats["CPU_B"] != "CPU" {
+		t.Fatalf("expected CPU, got %q", cats["CPU_B"])
+	}
+}
+
 func TestGroupForLotCategory(t *testing.T) {
 	if g, ok := GroupForLotCategory("cpu"); !ok || g != GroupCPU {
 		t.Fatalf("expected cpu -> GroupCPU")
@@ -53,4 +96,3 @@ func TestGroupForLotCategory(t *testing.T) {
 		t.Fatalf("expected SFP to be excluded")
 	}
 }
-

internal/article/generator.go

@@ -22,24 +22,29 @@ type BuildResult struct {
 }
 
 var (
-	reMemGiB = regexp.MustCompile(`(?i)(\d+)\s*(GB|G)`)
-	reMemTiB = regexp.MustCompile(`(?i)(\d+)\s*(TB|T)`)
+	reMemGiB    = regexp.MustCompile(`(?i)(\d+)\s*(GB|G)`)
+	reMemTiB    = regexp.MustCompile(`(?i)(\d+)\s*(TB|T)`)
 	reCapacityT = regexp.MustCompile(`(?i)(\d+(?:[.,]\d+)?)T`)
 	reCapacityG = regexp.MustCompile(`(?i)(\d+(?:[.,]\d+)?)G`)
 	rePortSpeed = regexp.MustCompile(`(?i)(\d+)p(\d+)(GbE|G)`)
-	rePortFC = regexp.MustCompile(`(?i)(\d+)pFC(\d+)`)
-	reWatts = regexp.MustCompile(`(?i)(\d{3,5})\s*W`)
+	rePortFC    = regexp.MustCompile(`(?i)(\d+)pFC(\d+)`)
+	reWatts     = regexp.MustCompile(`(?i)(\d{3,5})\s*W`)
 )
 
+type namedSeg struct {
+	group string // "MODEL","CPU","MEM","GPU","DISK","NET","PSU","SUPPORT"
+	value string
+}
+
 func Build(local *localdb.LocalDB, items []models.ConfigItem, opts BuildOptions) (BuildResult, error) {
-	segments := make([]string, 0, 8)
+	segs := make([]namedSeg, 0, 8)
 	warnings := make([]string, 0)
 
 	model := NormalizeServerModel(opts.ServerModel)
 	if model == "" {
 		return BuildResult{}, fmt.Errorf("server_model required")
 	}
-	segments = append(segments, model)
+	segs = append(segs, namedSeg{"MODEL", model})
 
 	lotNames := make([]string, 0, len(items))
 	for _, it := range items {
@@ -55,41 +60,39 @@ func Build(local *localdb.LocalDB, items []models.ConfigItem, opts BuildOptions)
 		return BuildResult{}, err
 	}
 
-	cpuSeg := buildCPUSegment(items, cats)
-	if cpuSeg != "" {
-		segments = append(segments, cpuSeg)
+	if cpuSeg := buildCPUSegment(items, cats); cpuSeg != "" {
+		segs = append(segs, namedSeg{"CPU", cpuSeg})
 	}
 	memSeg, memWarn := buildMemSegment(items, cats)
 	if memWarn != "" {
 		warnings = append(warnings, memWarn)
 	}
 	if memSeg != "" {
-		segments = append(segments, memSeg)
+		segs = append(segs, namedSeg{"MEM", memSeg})
 	}
-	gpuSeg := buildGPUSegment(items, cats)
-	if gpuSeg != "" {
-		segments = append(segments, gpuSeg)
+	if gpuSeg := buildGPUSegment(items, cats); gpuSeg != "" {
+		segs = append(segs, namedSeg{"GPU", gpuSeg})
 	}
 	diskSeg, diskWarn := buildDiskSegment(items, cats)
 	if diskWarn != "" {
 		warnings = append(warnings, diskWarn)
 	}
 	if diskSeg != "" {
-		segments = append(segments, diskSeg)
+		segs = append(segs, namedSeg{"DISK", diskSeg})
 	}
 	netSeg, netWarn := buildNetSegment(items, cats)
 	if netWarn != "" {
 		warnings = append(warnings, netWarn)
 	}
 	if netSeg != "" {
-		segments = append(segments, netSeg)
+		segs = append(segs, namedSeg{"NET", netSeg})
 	}
 	psuSeg, psuWarn := buildPSUSegment(items, cats)
 	if psuWarn != "" {
 		warnings = append(warnings, psuWarn)
 	}
 	if psuSeg != "" {
-		segments = append(segments, psuSeg)
+		segs = append(segs, namedSeg{"PSU", psuSeg})
 	}
 
 	if strings.TrimSpace(opts.SupportCode) != "" {
@@ -97,12 +100,12 @@ func Build(local *localdb.LocalDB, items []models.ConfigItem, opts BuildOptions)
 		if !isSupportCodeValid(code) {
 			return BuildResult{}, fmt.Errorf("invalid_support_code")
 		}
-		segments = append(segments, code)
+		segs = append(segs, namedSeg{"SUPPORT", code})
 	}
 
-	article := strings.Join(segments, "-")
+	article := strings.Join(namedSegsValues(segs), "-")
 	if len([]rune(article)) > 80 {
-		article = compressArticle(segments)
+		article = compressArticle(segs)
 		warnings = append(warnings, "compressed")
 	}
 	if len([]rune(article)) > 80 {
@@ -112,6 +115,23 @@ func Build(local *localdb.LocalDB, items []models.ConfigItem, opts BuildOptions)
 	return BuildResult{Article: article, Warnings: warnings}, nil
 }
 
+func namedSegsValues(segs []namedSeg) []string {
+	out := make([]string, len(segs))
+	for i, s := range segs {
+		out[i] = s.value
+	}
+	return out
+}
+
+func findSegGroup(segs []namedSeg, group string) int {
+	for i, s := range segs {
+		if s.group == group {
+			return i
+		}
+	}
+	return -1
+}
+
 func isSupportCodeValid(code string) bool {
 	if len(code) < 3 {
 		return false
@@ -195,6 +215,9 @@ func buildGPUSegment(items []models.ConfigItem, cats map[string]string) string {
 		if !ok || group != GroupGPU {
 			continue
 		}
+		if strings.HasPrefix(strings.ToUpper(it.LotName), "MB_") {
+			continue
+		}
 		model := parseGPUModel(it.LotName)
 		if model == "" {
 			model = "UNK"
@@ -326,33 +349,60 @@ func parseGPUModel(lotName string) string {
 	}
 	parts := strings.Split(upper, "_")
 	model := ""
+	numSuffix := ""
 	mem := ""
 	for i, p := range parts {
 		if p == "" {
 			continue
 		}
 		switch p {
-		case "NV", "NVIDIA", "AMD", "RADEON", "PCIE", "PCI", "SXM", "SXMX":
+		case "NV", "NVIDIA", "INTEL", "AMD", "RADEON", "PCIE", "PCI", "SXM", "SXMX", "SFF", "LOVELACE":
+			continue
+		case "ADA", "AMPERE", "HOPPER", "BLACKWELL":
+			if model != "" {
+				archAbbr := map[string]string{
+					"ADA": "ADA", "AMPERE": "AMP", "HOPPER": "HOP", "BLACKWELL": "BWL",
+				}
+				numSuffix += archAbbr[p]
+			}
 			continue
 		default:
 			if strings.Contains(p, "GB") {
 				mem = p
 				continue
 			}
-			if model == "" && (i > 0) {
+			if model == "" && i > 0 {
 				model = p
+			} else if model != "" && numSuffix == "" && isNumeric(p) {
+				numSuffix = p
 			}
 		}
 	}
-	if model != "" && mem != "" {
-		return model + "_" + mem
+	full := model
+	if numSuffix != "" {
+		full = model + numSuffix
 	}
-	if model != "" {
-		return model
+	if full != "" && mem != "" {
+		return full + "_" + mem
+	}
+	if full != "" {
+		return full
 	}
 	return normalizeModelToken(lotName)
 }
 
+func isNumeric(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, r := range s {
+		if r < '0' || r > '9' {
+			return false
+		}
+	}
+	return true
+}
+
 func parseMemGiB(lotName string) int {
 	if m := reMemTiB.FindStringSubmatch(lotName); len(m) == 3 {
 		return atoi(m[1]) * 1024
@@ -454,60 +504,50 @@ func atoi(v string) int {
 	return n
 }
 
-func compressArticle(segments []string) string {
-	if len(segments) == 0 {
+func compressArticle(segs []namedSeg) string {
+	if len(segs) == 0 {
 		return ""
 	}
-	normalized := make([]string, 0, len(segments))
-	for _, s := range segments {
-		normalized = append(normalized, strings.ReplaceAll(s, "GbE", "G"))
+	for i, s := range segs {
+		segs[i].value = strings.ReplaceAll(s.value, "GbE", "G")
 	}
-	segments = normalized
-	article := strings.Join(segments, "-")
+	article := strings.Join(namedSegsValues(segs), "-")
 	if len([]rune(article)) <= 80 {
 		return article
 	}
 
-	// segment order: model, cpu, mem, gpu, disk, net, psu, support
-	index := func(i int) (int, bool) {
-		if i >= 0 && i < len(segments) {
-			return i, true
-		}
-		return -1, false
-	}
-
 	// 1) remove PSU
-	if i, ok := index(6); ok {
-		segments = append(segments[:i], segments[i+1:]...)
-		article = strings.Join(segments, "-")
+	if i := findSegGroup(segs, "PSU"); i >= 0 {
+		segs = append(segs[:i], segs[i+1:]...)
+		article = strings.Join(namedSegsValues(segs), "-")
 		if len([]rune(article)) <= 80 {
 			return article
 		}
 	}
 
 	// 2) compress NET/HBA/HCA
-	if i, ok := index(5); ok {
-		segments[i] = compressNetSegment(segments[i])
-		article = strings.Join(segments, "-")
+	if i := findSegGroup(segs, "NET"); i >= 0 {
+		segs[i].value = compressNetSegment(segs[i].value)
+		article = strings.Join(namedSegsValues(segs), "-")
 		if len([]rune(article)) <= 80 {
 			return article
 		}
 	}
 
 	// 3) compress DISK
-	if i, ok := index(4); ok {
-		segments[i] = compressDiskSegment(segments[i])
-		article = strings.Join(segments, "-")
+	if i := findSegGroup(segs, "DISK"); i >= 0 {
+		segs[i].value = compressDiskSegment(segs[i].value)
+		article = strings.Join(namedSegsValues(segs), "-")
 		if len([]rune(article)) <= 80 {
 			return article
 		}
 	}
 
 	// 4) compress GPU to vendor only (GPU_NV)
-	if i, ok := index(3); ok {
-		segments[i] = compressGPUSegment(segments[i])
+	if i := findSegGroup(segs, "GPU"); i >= 0 {
+		segs[i].value = compressGPUSegment(segs[i].value)
 	}
-	return strings.Join(segments, "-")
+	return strings.Join(namedSegsValues(segs), "-")
 }
 
 func compressNetSegment(seg string) string {

internal/article/generator_test.go

@@ -61,6 +61,79 @@ func TestBuild_ParsesNetAndPSU(t *testing.T) {
 	}
 }
 
+// TestBuild_CompressArticle_NoGPU_PSUNotNIC reproduces the bug where 2 PSUs produced
+// "2xNIC" in the article because compressArticle used hard-coded indices that assumed
+// GPU was always present.
+func TestBuild_CompressArticle_NoGPU_PSUNotNIC(t *testing.T) {
+	local, err := localdb.New(filepath.Join(t.TempDir(), "local.db"))
+	if err != nil {
+		t.Fatalf("init local db: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	if err := local.SaveLocalPricelist(&localdb.LocalPricelist{
+		ServerID:  2,
+		Source:    "estimate",
+		Version:   "S-2026-05-19-001",
+		Name:      "test",
+		CreatedAt: time.Now(),
+		SyncedAt:  time.Now(),
+	}); err != nil {
+		t.Fatalf("save local pricelist: %v", err)
+	}
+	localPL, err := local.GetLocalPricelistByServerID(2)
+	if err != nil {
+		t.Fatalf("get local pricelist: %v", err)
+	}
+
+	if err := local.SaveLocalPricelistItems([]localdb.LocalPricelistItem{
+		{PricelistID: localPL.ID, LotName: "CPU_INTEL_8358", LotCategory: "CPU", Price: 1},
+		{PricelistID: localPL.ID, LotName: "MEM_DDR4_64G_3200", LotCategory: "MEM", Price: 1},
+		{PricelistID: localPL.ID, LotName: "SSD_SATA_0.4T", LotCategory: "SSD", Price: 1},
+		{PricelistID: localPL.ID, LotName: "SSD_SATA_0.9T", LotCategory: "SSD", Price: 1},
+		{PricelistID: localPL.ID, LotName: "HDD_SATA_16T", LotCategory: "HDD", Price: 1},
+		{PricelistID: localPL.ID, LotName: "NIC_2p25G_MCX512A", LotCategory: "NIC", Price: 1},
+		{PricelistID: localPL.ID, LotName: "HBA_2pFC32_Gen6", LotCategory: "HBA", Price: 1},
+		{PricelistID: localPL.ID, LotName: "NIC_4p1G_I350", LotCategory: "NIC", Price: 1},
+		{PricelistID: localPL.ID, LotName: "PS_1500W_Platinum", LotCategory: "PS", Price: 1},
+	}); err != nil {
+		t.Fatalf("save local items: %v", err)
+	}
+
+	// PS_1500W → "2x1.5kW" (7 chars) brings uncompressed article to 81 chars, triggering
+	// compressArticle. Before the fix, compressArticle used hard-coded index 5 for NET, but
+	// without GPU the PSU sits at index 5, so compressNetSegment("2x1.5kW") returned "2xNIC".
+	items := models.ConfigItems{
+		{LotName: "CPU_INTEL_8358", Quantity: 2},
+		{LotName: "MEM_DDR4_64G_3200", Quantity: 16}, // 1024 GiB = 1T
+		{LotName: "SSD_SATA_0.4T", Quantity: 2},
+		{LotName: "SSD_SATA_0.9T", Quantity: 4},
+		{LotName: "HDD_SATA_16T", Quantity: 6},
+		{LotName: "NIC_2p25G_MCX512A", Quantity: 1},
+		{LotName: "HBA_2pFC32_Gen6", Quantity: 1},
+		{LotName: "NIC_4p1G_I350", Quantity: 1},
+		{LotName: "PS_1500W_Platinum", Quantity: 2},
+	}
+	result, err := Build(local, items, BuildOptions{
+		ServerModel:     "NF5280M6",
+		ServerPricelist: &localPL.ServerID,
+	})
+	if err != nil {
+		t.Fatalf("build article: %v", err)
+	}
+	if len([]rune(result.Article)) > 80 {
+		t.Fatalf("article too long (%d): %s", len([]rune(result.Article)), result.Article)
+	}
+	// PSU segment must not be mis-labeled as NIC during compression
+	// The correct behaviour: PSU is dropped, NET stays as-is or compressed to HBA/NIC labels
+	// Before the fix: article ended with "-2xNIC" (PSU turned into NIC)
+	// After the fix: article must not contain a standalone "NIC" that came from PSU wattage
+	if strings.HasSuffix(result.Article, "-2xNIC") {
+		t.Fatalf("PSU mis-labeled as NIC in article: %s", result.Article)
+	}
+	t.Logf("article: %s (warnings: %v)", result.Article, result.Warnings)
+}
+
 func contains(s, sub string) bool {
 	return strings.Contains(s, sub)
 }

internal/config/config.go

@@ -7,19 +7,14 @@ import (
 	"strconv"
 	"time"
 
-	mysqlDriver "github.com/go-sql-driver/mysql"
 	"gopkg.in/yaml.v3"
 )
 
 type Config struct {
-	Server        ServerConfig        `yaml:"server"`
-	Database      DatabaseConfig      `yaml:"database"`
-	Auth          AuthConfig          `yaml:"auth"`
-	Pricing       PricingConfig       `yaml:"pricing"`
-	Export        ExportConfig        `yaml:"export"`
-	Alerts        AlertsConfig        `yaml:"alerts"`
-	Notifications NotificationsConfig `yaml:"notifications"`
-	Logging       LoggingConfig       `yaml:"logging"`
+	Server  ServerConfig  `yaml:"server"`
+	Export  ExportConfig  `yaml:"export"`
+	Logging LoggingConfig `yaml:"logging"`
+	Backup  BackupConfig  `yaml:"backup"`
 }
 
 type ServerConfig struct {
@@ -30,70 +25,6 @@ type ServerConfig struct {
 	WriteTimeout time.Duration `yaml:"write_timeout"`
 }
 
-type DatabaseConfig struct {
-	Host            string        `yaml:"host"`
-	Port            int           `yaml:"port"`
-	Name            string        `yaml:"name"`
-	User            string        `yaml:"user"`
-	Password        string        `yaml:"password"`
-	MaxOpenConns    int           `yaml:"max_open_conns"`
-	MaxIdleConns    int           `yaml:"max_idle_conns"`
-	ConnMaxLifetime time.Duration `yaml:"conn_max_lifetime"`
-}
-
-func (d *DatabaseConfig) DSN() string {
-	cfg := mysqlDriver.NewConfig()
-	cfg.User = d.User
-	cfg.Passwd = d.Password
-	cfg.Net = "tcp"
-	cfg.Addr = net.JoinHostPort(d.Host, strconv.Itoa(d.Port))
-	cfg.DBName = d.Name
-	cfg.ParseTime = true
-	cfg.Loc = time.Local
-	cfg.Params = map[string]string{
-		"charset": "utf8mb4",
-	}
-	return cfg.FormatDSN()
-}
-
-type AuthConfig struct {
-	JWTSecret     string        `yaml:"jwt_secret"`
-	TokenExpiry   time.Duration `yaml:"token_expiry"`
-	RefreshExpiry time.Duration `yaml:"refresh_expiry"`
-}
-
-type PricingConfig struct {
-	DefaultMethod       string `yaml:"default_method"`
-	DefaultPeriodDays   int    `yaml:"default_period_days"`
-	FreshnessGreenDays  int    `yaml:"freshness_green_days"`
-	FreshnessYellowDays int    `yaml:"freshness_yellow_days"`
-	FreshnessRedDays    int    `yaml:"freshness_red_days"`
-	MinQuotesForMedian  int    `yaml:"min_quotes_for_median"`
-	PopularityDecayDays int    `yaml:"popularity_decay_days"`
-}
-
-type ExportConfig struct {
-	TempDir     string        `yaml:"temp_dir"`
-	MaxFileAge  time.Duration `yaml:"max_file_age"`
-	CompanyName string        `yaml:"company_name"`
-}
-
-type AlertsConfig struct {
-	Enabled                  bool          `yaml:"enabled"`
-	CheckInterval            time.Duration `yaml:"check_interval"`
-	HighDemandThreshold      int           `yaml:"high_demand_threshold"`
-	TrendingThresholdPercent int           `yaml:"trending_threshold_percent"`
-}
-
-type NotificationsConfig struct {
-	EmailEnabled bool   `yaml:"email_enabled"`
-	SMTPHost     string `yaml:"smtp_host"`
-	SMTPPort     int    `yaml:"smtp_port"`
-	SMTPUser     string `yaml:"smtp_user"`
-	SMTPPassword string `yaml:"smtp_password"`
-	FromAddress  string `yaml:"from_address"`
-}
-
 type LoggingConfig struct {
 	Level    string `yaml:"level"`
 	Format   string `yaml:"format"`
@@ -101,6 +32,14 @@ type LoggingConfig struct {
 	FilePath string `yaml:"file_path"`
 }
 
+// ExportConfig is kept for constructor compatibility in export services.
+// Runtime no longer persists an export section in config.yaml.
+type ExportConfig struct{}
+
+type BackupConfig struct {
+	Time string `yaml:"time"`
+}
+
 func Load(path string) (*Config, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
@@ -134,45 +73,6 @@ func (c *Config) setDefaults() {
 		c.Server.WriteTimeout = 30 * time.Second
 	}
 
-	if c.Database.Port == 0 {
-		c.Database.Port = 3306
-	}
-	if c.Database.MaxOpenConns == 0 {
-		c.Database.MaxOpenConns = 25
-	}
-	if c.Database.MaxIdleConns == 0 {
-		c.Database.MaxIdleConns = 5
-	}
-	if c.Database.ConnMaxLifetime == 0 {
-		c.Database.ConnMaxLifetime = 5 * time.Minute
-	}
-
-	if c.Auth.TokenExpiry == 0 {
-		c.Auth.TokenExpiry = 24 * time.Hour
-	}
-	if c.Auth.RefreshExpiry == 0 {
-		c.Auth.RefreshExpiry = 7 * 24 * time.Hour
-	}
-
-	if c.Pricing.DefaultMethod == "" {
-		c.Pricing.DefaultMethod = "weighted_median"
-	}
-	if c.Pricing.DefaultPeriodDays == 0 {
-		c.Pricing.DefaultPeriodDays = 90
-	}
-	if c.Pricing.FreshnessGreenDays == 0 {
-		c.Pricing.FreshnessGreenDays = 30
-	}
-	if c.Pricing.FreshnessYellowDays == 0 {
-		c.Pricing.FreshnessYellowDays = 60
-	}
-	if c.Pricing.FreshnessRedDays == 0 {
-		c.Pricing.FreshnessRedDays = 90
-	}
-	if c.Pricing.MinQuotesForMedian == 0 {
-		c.Pricing.MinQuotesForMedian = 3
-	}
-
 	if c.Logging.Level == "" {
 		c.Logging.Level = "info"
 	}
@@ -182,8 +82,12 @@ func (c *Config) setDefaults() {
 	if c.Logging.Output == "" {
 		c.Logging.Output = "stdout"
 	}
+
+	if c.Backup.Time == "" {
+		c.Backup.Time = "00:00"
+	}
 }
 
 func (c *Config) Address() string {
-	return fmt.Sprintf("%s:%d", c.Server.Host, c.Server.Port)
+	return net.JoinHostPort(c.Server.Host, strconv.Itoa(c.Server.Port))
 }

internal/db/connection.go

@@ -238,6 +238,22 @@ func (cm *ConnectionManager) Disconnect() {
 	cm.lastError = nil
 }
 
+// MarkOffline closes the current connection and preserves the last observed error.
+func (cm *ConnectionManager) MarkOffline(err error) {
+	cm.mu.Lock()
+	defer cm.mu.Unlock()
+
+	if cm.db != nil {
+		sqlDB, dbErr := cm.db.DB()
+		if dbErr == nil {
+			sqlDB.Close()
+		}
+	}
+	cm.db = nil
+	cm.lastError = err
+	cm.lastCheck = time.Now()
+}
+
 // GetLastError returns the last connection error (thread-safe)
 func (cm *ConnectionManager) GetLastError() error {
 	cm.mu.RLock()

internal/db/validate.go

@@ -0,0 +1,60 @@
+package db
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	gormmysql "gorm.io/driver/mysql"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+var errPermissionProbeRollback = errors.New("permission probe rollback")
+
+// ValidateMariaDBConnection opens a one-off connection using dsn, pings, checks
+// the required lot table exists, and probes write access to qt_client_schema_state.
+// Returns (lot row count, canWrite, error).
+func ValidateMariaDBConnection(dsn string) (int64, bool, error) {
+	db, err := gorm.Open(gormmysql.Open(dsn), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		return 0, false, fmt.Errorf("open MariaDB connection: %w", err)
+	}
+
+	sqlDB, err := db.DB()
+	if err != nil {
+		return 0, false, fmt.Errorf("get database handle: %w", err)
+	}
+	defer sqlDB.Close()
+
+	if err := sqlDB.Ping(); err != nil {
+		return 0, false, fmt.Errorf("ping MariaDB: %w", err)
+	}
+
+	var lotCount int64
+	if err := db.Table("lot").Count(&lotCount).Error; err != nil {
+		return 0, false, fmt.Errorf("check required table lot: %w", err)
+	}
+
+	return lotCount, testSyncWritePermission(db), nil
+}
+
+func testSyncWritePermission(db *gorm.DB) bool {
+	sentinel := fmt.Sprintf("quoteforge-permission-check-%d", time.Now().UnixNano())
+	err := db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Exec(`
+			INSERT INTO qt_client_schema_state (username, hostname, last_checked_at, updated_at)
+			VALUES (?, ?, NOW(), NOW())
+			ON DUPLICATE KEY UPDATE
+				last_checked_at = VALUES(last_checked_at),
+				updated_at = VALUES(updated_at)
+		`, sentinel, "setup-check").Error; err != nil {
+			return err
+		}
+		return errPermissionProbeRollback
+	})
+
+	return errors.Is(err, errPermissionProbeRollback)
+}

internal/handlers/auth.go

@@ -1,113 +0,0 @@
-package handlers
-
-import (
-	"net/http"
-
-	"github.com/gin-gonic/gin"
-	"git.mchus.pro/mchus/quoteforge/internal/middleware"
-	"git.mchus.pro/mchus/quoteforge/internal/repository"
-	"git.mchus.pro/mchus/quoteforge/internal/services"
-)
-
-type AuthHandler struct {
-	authService *services.AuthService
-	userRepo    *repository.UserRepository
-}
-
-func NewAuthHandler(authService *services.AuthService, userRepo *repository.UserRepository) *AuthHandler {
-	return &AuthHandler{
-		authService: authService,
-		userRepo:    userRepo,
-	}
-}
-
-type LoginRequest struct {
-	Username string `json:"username" binding:"required"`
-	Password string `json:"password" binding:"required"`
-}
-
-type LoginResponse struct {
-	AccessToken  string `json:"access_token"`
-	RefreshToken string `json:"refresh_token"`
-	ExpiresAt    int64  `json:"expires_at"`
-	User         UserResponse `json:"user"`
-}
-
-type UserResponse struct {
-	ID       uint   `json:"id"`
-	Username string `json:"username"`
-	Email    string `json:"email"`
-	Role     string `json:"role"`
-}
-
-func (h *AuthHandler) Login(c *gin.Context) {
-	var req LoginRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	tokens, user, err := h.authService.Login(req.Username, req.Password)
-	if err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, LoginResponse{
-		AccessToken:  tokens.AccessToken,
-		RefreshToken: tokens.RefreshToken,
-		ExpiresAt:    tokens.ExpiresAt,
-		User: UserResponse{
-			ID:       user.ID,
-			Username: user.Username,
-			Email:    user.Email,
-			Role:     string(user.Role),
-		},
-	})
-}
-
-type RefreshRequest struct {
-	RefreshToken string `json:"refresh_token" binding:"required"`
-}
-
-func (h *AuthHandler) Refresh(c *gin.Context) {
-	var req RefreshRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	tokens, err := h.authService.RefreshTokens(req.RefreshToken)
-	if err != nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, tokens)
-}
-
-func (h *AuthHandler) Me(c *gin.Context) {
-	claims := middleware.GetClaims(c)
-	if claims == nil {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "not authenticated"})
-		return
-	}
-
-	user, err := h.userRepo.GetByID(claims.UserID)
-	if err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "user not found"})
-		return
-	}
-
-	c.JSON(http.StatusOK, UserResponse{
-		ID:       user.ID,
-		Username: user.Username,
-		Email:    user.Email,
-		Role:     string(user.Role),
-	})
-}
-
-func (h *AuthHandler) Logout(c *gin.Context) {
-	// JWT is stateless, logout is handled on client by discarding tokens
-	c.JSON(http.StatusOK, gin.H{"message": "logged out"})
-}

internal/handlers/component.go

@@ -49,7 +49,7 @@ func (h *ComponentHandler) List(c *gin.Context) {
 	offset := (page - 1) * perPage
 	localComps, total, err := h.localDB.ListComponents(localFilter, offset, perPage)
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
 		return
 	}
 
@@ -64,11 +64,16 @@ func (h *ComponentHandler) List(c *gin.Context) {
 		}
 	}
 
+	totalPages := int((total + int64(perPage) - 1) / int64(perPage))
+	if totalPages < 1 {
+		totalPages = 1
+	}
 	c.JSON(http.StatusOK, &services.ComponentListResult{
-		Components: components,
-		Total:      total,
+		Items:      components,
+		TotalCount: total,
 		Page:       page,
 		PerPage:    perPage,
+		TotalPages: totalPages,
 	})
 }
 
@@ -90,6 +95,12 @@ func (h *ComponentHandler) Get(c *gin.Context) {
 }
 
 func (h *ComponentHandler) GetCategories(c *gin.Context) {
+	// Build display_order lookup from the canonical list.
+	orderMap := make(map[string]int, len(models.DefaultCategories))
+	for _, cat := range models.DefaultCategories {
+		orderMap[strings.ToUpper(cat.Code)] = cat.DisplayOrder
+	}
+
 	codes, err := h.localDB.GetLocalComponentCategories()
 	if err == nil && len(codes) > 0 {
 		categories := make([]models.Category, 0, len(codes))
@@ -98,7 +109,15 @@ func (h *ComponentHandler) GetCategories(c *gin.Context) {
 			if trimmed == "" {
 				continue
 			}
-			categories = append(categories, models.Category{Code: trimmed, Name: trimmed})
+			order := orderMap[strings.ToUpper(trimmed)]
+			if order == 0 {
+				order = models.MaxKnownDisplayOrder + 1
+			}
+			categories = append(categories, models.Category{
+				Code:         trimmed,
+				Name:         trimmed,
+				DisplayOrder: order,
+			})
 		}
 		c.JSON(http.StatusOK, categories)
 		return
@@ -106,3 +125,102 @@ func (h *ComponentHandler) GetCategories(c *gin.Context) {
 
 	c.JSON(http.StatusOK, models.DefaultCategories)
 }
+
+func (h *ComponentHandler) GetConfiguratorSettings(c *gin.Context) {
+	s, _ := h.localDB.GetConfiguratorSettings()
+	if s == nil {
+		s = &localdb.ConfiguratorSettings{}
+	}
+
+	if len(s.ConfigTypes) == 0 {
+		s.ConfigTypes = defaultConfigTypes()
+	}
+	if len(s.TabConfig) == 0 {
+		s.TabConfig = defaultTabConfig()
+	}
+	if len(s.AlwaysVisibleTabs) == 0 {
+		s.AlwaysVisibleTabs = []string{"base", "storage", "pci"}
+	}
+	if len(s.RequiredCategories) == 0 {
+		s.RequiredCategories = map[string][]string{"server": {"CPU", "MEM", "BB"}}
+	}
+
+	c.JSON(http.StatusOK, s)
+}
+
+func defaultConfigTypes() []localdb.ConfigTypeDef {
+	return []localdb.ConfigTypeDef{
+		{
+			Code:         "server",
+			NameRu:       "Сервер",
+			DisplayOrder: 10,
+			Categories: []string{
+				"MB", "CPU", "MEM", "RAID",
+				"SSD", "HDD", "M2", "EDSFF", "HHHL",
+				"GPU", "NIC", "HCA", "DPU", "HBA",
+				"PSU", "PS", "ACC", "RISERS", "CARD", "BB",
+			},
+		},
+		{
+			Code:         "storage",
+			NameRu:       "СХД",
+			DisplayOrder: 20,
+			Categories: []string{
+				"DKC", "CPU", "MEM", "PS",
+				"SSD", "HDD", "M2", "EDSFF", "HHHL",
+				"NIC", "HBA", "HCA", "ACC", "CARD",
+			},
+		},
+	}
+}
+
+func defaultTabConfig() []localdb.TabDef {
+	return []localdb.TabDef{
+		{
+			Key:          "base",
+			Label:        "Base",
+			SingleSelect: true,
+			Categories:   []string{"MB", "CPU", "MEM", "ENC", "DKC", "CTL"},
+		},
+		{
+			Key:          "storage",
+			Label:        "Storage",
+			SingleSelect: false,
+			Categories:   []string{"RAID", "M2", "SSD", "HDD", "EDSFF", "HHHL"},
+			Sections: []localdb.TabSection{
+				{Title: "RAID Контроллеры", Categories: []string{"RAID"}},
+				{Title: "Диски", Categories: []string{"M2", "SSD", "HDD", "EDSFF", "HHHL"}},
+			},
+		},
+		{
+			Key:          "pci",
+			Label:        "PCI",
+			SingleSelect: false,
+			Categories:   []string{"GPU", "DPU", "NIC", "HCA", "HBA", "HIC"},
+			Sections: []localdb.TabSection{
+				{Title: "GPU / DPU", Categories: []string{"GPU", "DPU"}},
+				{Title: "NIC / HCA", Categories: []string{"NIC", "HCA"}},
+				{Title: "HBA", Categories: []string{"HBA"}},
+				{Title: "HIC", Categories: []string{"HIC"}},
+			},
+		},
+		{
+			Key:          "power",
+			Label:        "Power",
+			SingleSelect: false,
+			Categories:   []string{"PS", "PSU"},
+		},
+		{
+			Key:          "accessories",
+			Label:        "Accessories",
+			SingleSelect: false,
+			Categories:   []string{"ACC", "CARD"},
+		},
+		{
+			Key:          "sw",
+			Label:        "SW",
+			SingleSelect: false,
+			Categories:   []string{"SW"},
+		},
+	}
+}

internal/handlers/configuration.go

@@ -1,239 +0,0 @@
-package handlers
-
-import (
-	"net/http"
-	"strconv"
-
-	"git.mchus.pro/mchus/quoteforge/internal/middleware"
-	"git.mchus.pro/mchus/quoteforge/internal/services"
-	"github.com/gin-gonic/gin"
-)
-
-type ConfigurationHandler struct {
-	configService *services.ConfigurationService
-	exportService *services.ExportService
-}
-
-func NewConfigurationHandler(
-	configService *services.ConfigurationService,
-	exportService *services.ExportService,
-) *ConfigurationHandler {
-	return &ConfigurationHandler{
-		configService: configService,
-		exportService: exportService,
-	}
-}
-
-func (h *ConfigurationHandler) List(c *gin.Context) {
-	username := middleware.GetUsername(c)
-	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
-	perPage, _ := strconv.Atoi(c.DefaultQuery("per_page", "20"))
-
-	configs, total, err := h.configService.ListByUser(username, page, perPage)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, gin.H{
-		"configurations": configs,
-		"total":          total,
-		"page":           page,
-		"per_page":       perPage,
-	})
-}
-
-func (h *ConfigurationHandler) Create(c *gin.Context) {
-	username := middleware.GetUsername(c)
-
-	var req services.CreateConfigRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	config, err := h.configService.Create(username, &req)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusCreated, config)
-}
-
-func (h *ConfigurationHandler) Get(c *gin.Context) {
-	username := middleware.GetUsername(c)
-	uuid := c.Param("uuid")
-
-	config, err := h.configService.GetByUUID(uuid, username)
-	if err != nil {
-		status := http.StatusNotFound
-		if err == services.ErrConfigForbidden {
-			status = http.StatusForbidden
-		}
-		c.JSON(status, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, config)
-}
-
-func (h *ConfigurationHandler) Update(c *gin.Context) {
-	username := middleware.GetUsername(c)
-	uuid := c.Param("uuid")
-
-	var req services.CreateConfigRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	config, err := h.configService.Update(uuid, username, &req)
-	if err != nil {
-		status := http.StatusInternalServerError
-		if err == services.ErrConfigNotFound {
-			status = http.StatusNotFound
-		} else if err == services.ErrConfigForbidden {
-			status = http.StatusForbidden
-		}
-		c.JSON(status, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, config)
-}
-
-func (h *ConfigurationHandler) Delete(c *gin.Context) {
-	username := middleware.GetUsername(c)
-	uuid := c.Param("uuid")
-
-	err := h.configService.Delete(uuid, username)
-	if err != nil {
-		status := http.StatusInternalServerError
-		if err == services.ErrConfigNotFound {
-			status = http.StatusNotFound
-		} else if err == services.ErrConfigForbidden {
-			status = http.StatusForbidden
-		}
-		c.JSON(status, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, gin.H{"message": "deleted"})
-}
-
-type RenameConfigRequest struct {
-	Name string `json:"name" binding:"required"`
-}
-
-func (h *ConfigurationHandler) Rename(c *gin.Context) {
-	username := middleware.GetUsername(c)
-	uuid := c.Param("uuid")
-
-	var req RenameConfigRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	config, err := h.configService.Rename(uuid, username, req.Name)
-	if err != nil {
-		status := http.StatusInternalServerError
-		if err == services.ErrConfigNotFound {
-			status = http.StatusNotFound
-		} else if err == services.ErrConfigForbidden {
-			status = http.StatusForbidden
-		}
-		c.JSON(status, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, config)
-}
-
-type CloneConfigRequest struct {
-	Name string `json:"name" binding:"required"`
-}
-
-func (h *ConfigurationHandler) Clone(c *gin.Context) {
-	username := middleware.GetUsername(c)
-	uuid := c.Param("uuid")
-
-	var req CloneConfigRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-		return
-	}
-
-	config, err := h.configService.Clone(uuid, username, req.Name)
-	if err != nil {
-		status := http.StatusInternalServerError
-		if err == services.ErrConfigNotFound {
-			status = http.StatusNotFound
-		} else if err == services.ErrConfigForbidden {
-			status = http.StatusForbidden
-		}
-		c.JSON(status, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusCreated, config)
-}
-
-func (h *ConfigurationHandler) RefreshPrices(c *gin.Context) {
-	username := middleware.GetUsername(c)
-	uuid := c.Param("uuid")
-
-	config, err := h.configService.RefreshPrices(uuid, username)
-	if err != nil {
-		status := http.StatusInternalServerError
-		if err == services.ErrConfigNotFound {
-			status = http.StatusNotFound
-		} else if err == services.ErrConfigForbidden {
-			status = http.StatusForbidden
-		}
-		c.JSON(status, gin.H{"error": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, config)
-}
-
-// func (h *ConfigurationHandler) ExportJSON(c *gin.Context) {
-// 	userID := middleware.GetUserID(c)
-// 	uuid := c.Param("uuid")
-//
-// 	config, err := h.configService.GetByUUID(uuid, userID)
-// 	if err != nil {
-// 		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
-// 		return
-// 	}
-//
-// 	data, err := h.configService.ExportJSON(uuid, userID)
-// 	if err != nil {
-// 		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
-// 		return
-// 	}
-//
-// 	filename := fmt.Sprintf("%s %s SPEC.json", config.CreatedAt.Format("2006-01-02"), config.Name)
-// 	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
-// 	c.Data(http.StatusOK, "application/json", data)
-// }
-
-// func (h *ConfigurationHandler) ImportJSON(c *gin.Context) {
-// 	userID := middleware.GetUserID(c)
-//
-// 	data, err := io.ReadAll(c.Request.Body)
-// 	if err != nil {
-// 		c.JSON(http.StatusBadRequest, gin.H{"error": "failed to read body"})
-// 		return
-// 	}
-//
-// 	config, err := h.configService.ImportJSON(userID, data)
-// 	if err != nil {
-// 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
-// 		return
-// 	}
-//
-// 	c.JSON(http.StatusCreated, config)
-// }

internal/handlers/export.go

@@ -6,38 +6,40 @@ import (
 	"strings"
 	"time"
 
-	"git.mchus.pro/mchus/quoteforge/internal/middleware"
+	"git.mchus.pro/mchus/quoteforge/internal/models"
 	"git.mchus.pro/mchus/quoteforge/internal/services"
 	"github.com/gin-gonic/gin"
 )
 
 type ExportHandler struct {
-	exportService    *services.ExportService
-	configService    services.ConfigurationGetter
-	componentService *services.ComponentService
-	projectService   *services.ProjectService
+	exportService  *services.ExportService
+	configService  services.ConfigurationGetter
+	projectService *services.ProjectService
+	dbUsername     string
 }
 
 func NewExportHandler(
 	exportService *services.ExportService,
 	configService services.ConfigurationGetter,
-	componentService *services.ComponentService,
 	projectService *services.ProjectService,
+	dbUsername string,
 ) *ExportHandler {
 	return &ExportHandler{
-		exportService:    exportService,
-		configService:    configService,
-		componentService: componentService,
-		projectService:   projectService,
+		exportService:  exportService,
+		configService:  configService,
+		projectService: projectService,
+		dbUsername:     dbUsername,
 	}
 }
 
 type ExportRequest struct {
-	Name         string `json:"name" binding:"required"`
-	ProjectName  string `json:"project_name"`
-	ProjectUUID  string `json:"project_uuid"`
-	Article      string `json:"article"`
-	Items        []struct {
+	Name        string `json:"name" binding:"required"`
+	ProjectName string `json:"project_name"`
+	ProjectUUID string `json:"project_uuid"`
+	Article     string `json:"article"`
+	ServerCount int    `json:"server_count"`
+	PricelistID *uint  `json:"pricelist_id"`
+	Items       []struct {
 		LotName   string  `json:"lot_name" binding:"required"`
 		Quantity  int     `json:"quantity" binding:"required,min=1"`
 		UnitPrice float64 `json:"unit_price"`
@@ -45,32 +47,40 @@ type ExportRequest struct {
 	Notes string `json:"notes"`
 }
 
+type ProjectExportOptionsRequest struct {
+	IncludeLOT        bool    `json:"include_lot"`
+	IncludeBOM        bool    `json:"include_bom"`
+	IncludeEstimate   bool    `json:"include_estimate"`
+	IncludeStock      bool    `json:"include_stock"`
+	IncludeCompetitor bool    `json:"include_competitor"`
+	Basis             string  `json:"basis"`       // "fob" or "ddp"
+	SaleMarkup        float64 `json:"sale_markup"` // DDP multiplier; 0 defaults to 1.3
+}
+
 func (h *ExportHandler) ExportCSV(c *gin.Context) {
 	var req ExportRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
 		return
 	}
 
 	data := h.buildExportData(&req)
 
 	// Validate before streaming (can return JSON error)
-	if len(data.Items) == 0 {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "no items to export"})
+	if len(data.Configs) == 0 || len(data.Configs[0].Items) == 0 {
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "no items to export"})
 		return
 	}
 
-	// Get project name if available
-	projectName := req.ProjectName
-	if projectName == "" && req.ProjectUUID != "" {
-		// Try to load project name from database
-		username := middleware.GetUsername(c)
-		if project, err := h.projectService.GetByUUID(req.ProjectUUID, username); err == nil && project != nil {
-			projectName = project.Name
+	// Get project code for filename
+	projectCode := req.ProjectName // legacy field: may contain code from frontend
+	if projectCode == "" && req.ProjectUUID != "" {
+		if project, err := h.projectService.GetByUUID(req.ProjectUUID, h.dbUsername); err == nil && project != nil {
+			projectCode = project.Code
 		}
 	}
-	if projectName == "" {
-		projectName = req.Name
+	if projectCode == "" {
+		projectCode = req.Name
 	}
 
 	// Set headers before streaming
@@ -79,7 +89,7 @@ func (h *ExportHandler) ExportCSV(c *gin.Context) {
 	if articleSegment == "" {
 		articleSegment = "BOM"
 	}
-	filename := fmt.Sprintf("%s (%s) %s %s.csv", exportDate.Format("2006-01-02"), projectName, req.Name, articleSegment)
+	filename := fmt.Sprintf("%s (%s) %s %s.csv", exportDate.Format("2006-01-02"), projectCode, req.Name, articleSegment)
 	c.Header("Content-Type", "text/csv; charset=utf-8")
 	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
 
@@ -90,44 +100,32 @@ func (h *ExportHandler) ExportCSV(c *gin.Context) {
 	}
 }
 
-func (h *ExportHandler) buildExportData(req *ExportRequest) *services.ExportData {
-	items := make([]services.ExportItem, len(req.Items))
-	var total float64
-
+// buildExportData converts an ExportRequest into a ProjectExportData using a temporary Configuration model
+// so that ExportService.ConfigToExportData can resolve categories via localDB.
+func (h *ExportHandler) buildExportData(req *ExportRequest) *services.ProjectExportData {
+	configItems := make(models.ConfigItems, len(req.Items))
 	for i, item := range req.Items {
-		itemTotal := item.UnitPrice * float64(item.Quantity)
-
-		// Получаем информацию о компоненте для заполнения категории и описания
-		componentView, err := h.componentService.GetByLotName(item.LotName)
-		if err != nil {
-			// Если не удалось получить информацию о компоненте, используем только основные данные
-			items[i] = services.ExportItem{
-				LotName:    item.LotName,
-				Quantity:   item.Quantity,
-				UnitPrice:  item.UnitPrice,
-				TotalPrice: itemTotal,
-			}
-		} else {
-			items[i] = services.ExportItem{
-				LotName:     item.LotName,
-				Description: componentView.Description,
-				Category:    componentView.Category,
-				Quantity:    item.Quantity,
-				UnitPrice:   item.UnitPrice,
-				TotalPrice:  itemTotal,
-			}
+		configItems[i] = models.ConfigItem{
+			LotName:   item.LotName,
+			Quantity:  item.Quantity,
+			UnitPrice: item.UnitPrice,
 		}
-		total += itemTotal
 	}
 
-	return &services.ExportData{
-		Name:      req.Name,
-		Article:   req.Article,
-		Items:     items,
-		Total:     total,
-		Notes:     req.Notes,
-		CreatedAt: time.Now(),
+	serverCount := req.ServerCount
+	if serverCount < 1 {
+		serverCount = 1
 	}
+
+	cfg := &models.Configuration{
+		Article:     req.Article,
+		ServerCount: serverCount,
+		PricelistID: req.PricelistID,
+		Items:       configItems,
+		CreatedAt:   time.Now(),
+	}
+
+	return h.exportService.ConfigToExportData(cfg)
 }
 
 func sanitizeFilenameSegment(value string) string {
@@ -149,29 +147,28 @@ func sanitizeFilenameSegment(value string) string {
 }
 
 func (h *ExportHandler) ExportConfigCSV(c *gin.Context) {
-	username := middleware.GetUsername(c)
 	uuid := c.Param("uuid")
 
 	// Get config before streaming (can return JSON error)
-	config, err := h.configService.GetByUUID(uuid, username)
+	config, err := h.configService.GetByUUIDNoAuth(uuid)
 	if err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusNotFound, "resource not found", err)
 		return
 	}
 
-	data := h.exportService.ConfigToExportData(config, h.componentService)
+	data := h.exportService.ConfigToExportData(config)
 
 	// Validate before streaming (can return JSON error)
-	if len(data.Items) == 0 {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "no items to export"})
+	if len(data.Configs) == 0 || len(data.Configs[0].Items) == 0 {
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "no items to export"})
 		return
 	}
 
-	// Get project name if configuration belongs to a project
-	projectName := config.Name // fallback: use config name if no project
+	// Get project code for filename
+	projectCode := config.Name // fallback: use config name if no project
 	if config.ProjectUUID != nil && *config.ProjectUUID != "" {
-		if project, err := h.projectService.GetByUUID(*config.ProjectUUID, username); err == nil && project != nil {
-			projectName = project.Name
+		if project, err := h.projectService.GetByUUID(*config.ProjectUUID, h.dbUsername); err == nil && project != nil {
+			projectCode = project.Code
 		}
 	}
 
@@ -181,7 +178,7 @@ func (h *ExportHandler) ExportConfigCSV(c *gin.Context) {
 	if config.PriceUpdatedAt != nil {
 		exportDate = *config.PriceUpdatedAt
 	}
-	filename := fmt.Sprintf("%s (%s) %s BOM.csv", exportDate.Format("2006-01-02"), projectName, config.Name)
+	filename := fmt.Sprintf("%s (%s) %s BOM.csv", exportDate.Format("2006-01-02"), projectCode, config.Name)
 	c.Header("Content-Type", "text/csv; charset=utf-8")
 	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
 
@@ -191,3 +188,153 @@ func (h *ExportHandler) ExportConfigCSV(c *gin.Context) {
 		return
 	}
 }
+
+// ExportProjectCSV exports all active configurations of a project as a single CSV file.
+func (h *ExportHandler) ExportProjectCSV(c *gin.Context) {
+	projectUUID := c.Param("uuid")
+
+	project, err := h.projectService.GetByUUID(projectUUID, h.dbUsername)
+	if err != nil {
+		RespondError(c, http.StatusNotFound, "resource not found", err)
+		return
+	}
+
+	result, err := h.projectService.ListConfigurations(projectUUID, h.dbUsername, "active")
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
+	if len(result.Configs) == 0 {
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "no configurations to export"})
+		return
+	}
+
+	data := h.exportService.ProjectToExportData(result.Configs)
+
+	// Filename: YYYY-MM-DD (ProjectCode) BOM.csv
+	filename := fmt.Sprintf("%s (%s) BOM.csv", time.Now().Format("2006-01-02"), project.Code)
+	c.Header("Content-Type", "text/csv; charset=utf-8")
+	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
+
+	if err := h.exportService.ToCSV(c.Writer, data); err != nil {
+		c.Error(err)
+		return
+	}
+}
+
+func (h *ExportHandler) ExportConfigPricingCSV(c *gin.Context) {
+	uuid := c.Param("uuid")
+
+	var req ProjectExportOptionsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
+		return
+	}
+
+	config, err := h.configService.GetByUUIDNoAuth(uuid)
+	if err != nil {
+		RespondError(c, http.StatusNotFound, "resource not found", err)
+		return
+	}
+
+	opts := services.ProjectPricingExportOptions{
+		IncludeLOT:        req.IncludeLOT,
+		IncludeBOM:        req.IncludeBOM,
+		IncludeEstimate:   req.IncludeEstimate,
+		IncludeStock:      req.IncludeStock,
+		IncludeCompetitor: req.IncludeCompetitor,
+		Basis:             req.Basis,
+		SaleMarkup:        req.SaleMarkup,
+	}
+
+	data, err := h.exportService.ConfigToPricingExportData(config, opts)
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
+	basisLabel := "FOB"
+	if strings.EqualFold(strings.TrimSpace(req.Basis), "ddp") {
+		basisLabel = "DDP"
+	}
+
+	projectCode := config.Name
+	if config.ProjectUUID != nil && *config.ProjectUUID != "" {
+		if project, err := h.projectService.GetByUUID(*config.ProjectUUID, h.dbUsername); err == nil && project != nil {
+			projectCode = project.Code
+		}
+	}
+
+	filename := fmt.Sprintf("%s (%s) %s %s SPEC.csv",
+		time.Now().Format("2006-01-02"),
+		projectCode,
+		config.Name,
+		basisLabel,
+	)
+	c.Header("Content-Type", "text/csv; charset=utf-8")
+	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
+
+	if err := h.exportService.ToPricingCSV(c.Writer, data, opts); err != nil {
+		c.Error(err)
+	}
+}
+
+func (h *ExportHandler) ExportProjectPricingCSV(c *gin.Context) {
+	projectUUID := c.Param("uuid")
+
+	var req ProjectExportOptionsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
+		return
+	}
+
+	project, err := h.projectService.GetByUUID(projectUUID, h.dbUsername)
+	if err != nil {
+		RespondError(c, http.StatusNotFound, "resource not found", err)
+		return
+	}
+
+	result, err := h.projectService.ListConfigurations(projectUUID, h.dbUsername, "active")
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+	if len(result.Configs) == 0 {
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "no configurations to export"})
+		return
+	}
+
+	opts := services.ProjectPricingExportOptions{
+		IncludeLOT:        req.IncludeLOT,
+		IncludeBOM:        req.IncludeBOM,
+		IncludeEstimate:   req.IncludeEstimate,
+		IncludeStock:      req.IncludeStock,
+		IncludeCompetitor: req.IncludeCompetitor,
+		Basis:             req.Basis,
+		SaleMarkup:        req.SaleMarkup,
+	}
+
+	data, err := h.exportService.ProjectToPricingExportData(result.Configs, opts)
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
+	basisLabel := "FOB"
+	if strings.EqualFold(strings.TrimSpace(req.Basis), "ddp") {
+		basisLabel = "DDP"
+	}
+	variantLabel := strings.TrimSpace(project.Variant)
+	if variantLabel == "" {
+		variantLabel = "main"
+	}
+	filename := fmt.Sprintf("%s (%s) %s %s.csv", time.Now().Format("2006-01-02"), project.Code, basisLabel, variantLabel)
+	c.Header("Content-Type", "text/csv; charset=utf-8")
+	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
+
+	if err := h.exportService.ToPricingCSV(c.Writer, data, opts); err != nil {
+		c.Error(err)
+		return
+	}
+}

internal/handlers/export_test.go

@@ -26,20 +26,20 @@ func (m *mockConfigService) GetByUUID(uuid string, ownerUsername string) (*model
 	return m.config, m.err
 }
 
+func (m *mockConfigService) GetByUUIDNoAuth(uuid string) (*models.Configuration, error) {
+	return m.config, m.err
+}
 
 func TestExportCSV_Success(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 
-	// Create a basic mock component service that doesn't panic
-	mockComponentService := &services.ComponentService{}
-
 	// Create handler with mocks
 	exportSvc := services.NewExportService(config.ExportConfig{}, nil)
 	handler := NewExportHandler(
 		exportSvc,
 		&mockConfigService{},
-		mockComponentService,
 		nil,
+		"testuser",
 	)
 
 	// Create JSON request body
@@ -88,7 +88,7 @@ func TestExportCSV_Success(t *testing.T) {
 
 	expectedBOM := []byte{0xEF, 0xBB, 0xBF}
 	actualBOM := responseBody[:3]
-	if bytes.Compare(actualBOM, expectedBOM) != 0 {
+	if !bytes.Equal(actualBOM, expectedBOM) {
 		t.Errorf("UTF-8 BOM mismatch. Expected %v, got %v", expectedBOM, actualBOM)
 	}
 
@@ -101,8 +101,8 @@ func TestExportCSV_Success(t *testing.T) {
 		t.Errorf("Failed to parse CSV header: %v", err)
 	}
 
-	if len(header) != 6 {
-		t.Errorf("Expected 6 columns, got %d", len(header))
+	if len(header) != 8 {
+		t.Errorf("Expected 8 columns, got %d", len(header))
 	}
 }
 
@@ -113,8 +113,8 @@ func TestExportCSV_InvalidRequest(t *testing.T) {
 	handler := NewExportHandler(
 		exportSvc,
 		&mockConfigService{},
-		&services.ComponentService{},
 		nil,
+		"testuser",
 	)
 
 	// Create invalid request (missing required field)
@@ -128,8 +128,8 @@ func TestExportCSV_InvalidRequest(t *testing.T) {
 	handler.ExportCSV(c)
 
 	// Should return 400 Bad Request
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("Expected status 400, got %d", w.Code)
+	if w.Code != http.StatusUnprocessableEntity {
+		t.Errorf("Expected status 422, got %d", w.Code)
 	}
 
 	// Should return JSON error
@@ -147,8 +147,8 @@ func TestExportCSV_EmptyItems(t *testing.T) {
 	handler := NewExportHandler(
 		exportSvc,
 		&mockConfigService{},
-		&services.ComponentService{},
 		nil,
+		"testuser",
 	)
 
 	// Create request with empty items array - should fail binding validation
@@ -162,8 +162,8 @@ func TestExportCSV_EmptyItems(t *testing.T) {
 	handler.ExportCSV(c)
 
 	// Should return 400 Bad Request (validation error from gin binding)
-	if w.Code != http.StatusBadRequest {
-		t.Logf("Status code: %d (expected 400 for empty items)", w.Code)
+	if w.Code != http.StatusUnprocessableEntity {
+		t.Logf("Status code: %d (expected 422 for empty items)", w.Code)
 	}
 }
 
@@ -189,8 +189,8 @@ func TestExportConfigCSV_Success(t *testing.T) {
 	handler := NewExportHandler(
 		exportSvc,
 		&mockConfigService{config: mockConfig},
-		&services.ComponentService{},
 		nil,
+		"testuser",
 	)
 
 	// Create HTTP request
@@ -203,9 +203,6 @@ func TestExportConfigCSV_Success(t *testing.T) {
 		{Key: "uuid", Value: "test-uuid"},
 	}
 
-	// Mock middleware.GetUsername
-	c.Set("username", "testuser")
-
 	handler.ExportConfigCSV(c)
 
 	// Check status code
@@ -227,7 +224,7 @@ func TestExportConfigCSV_Success(t *testing.T) {
 
 	expectedBOM := []byte{0xEF, 0xBB, 0xBF}
 	actualBOM := responseBody[:3]
-	if bytes.Compare(actualBOM, expectedBOM) != 0 {
+	if !bytes.Equal(actualBOM, expectedBOM) {
 		t.Errorf("UTF-8 BOM mismatch")
 	}
 }
@@ -239,8 +236,8 @@ func TestExportConfigCSV_NotFound(t *testing.T) {
 	handler := NewExportHandler(
 		exportSvc,
 		&mockConfigService{err: errors.New("config not found")},
-		&services.ComponentService{},
 		nil,
+		"testuser",
 	)
 
 	req, _ := http.NewRequest("GET", "/api/configs/nonexistent-uuid/export", nil)
@@ -251,8 +248,6 @@ func TestExportConfigCSV_NotFound(t *testing.T) {
 	c.Params = gin.Params{
 		{Key: "uuid", Value: "nonexistent-uuid"},
 	}
-	c.Set("username", "testuser")
-
 	handler.ExportConfigCSV(c)
 
 	// Should return 404 Not Found
@@ -284,8 +279,8 @@ func TestExportConfigCSV_EmptyItems(t *testing.T) {
 	handler := NewExportHandler(
 		exportSvc,
 		&mockConfigService{config: mockConfig},
-		&services.ComponentService{},
 		nil,
+		"testuser",
 	)
 
 	req, _ := http.NewRequest("GET", "/api/configs/test-uuid/export", nil)
@@ -296,13 +291,11 @@ func TestExportConfigCSV_EmptyItems(t *testing.T) {
 	c.Params = gin.Params{
 		{Key: "uuid", Value: "test-uuid"},
 	}
-	c.Set("username", "testuser")
-
 	handler.ExportConfigCSV(c)
 
 	// Should return 400 Bad Request
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("Expected status 400, got %d", w.Code)
+	if w.Code != http.StatusUnprocessableEntity {
+		t.Errorf("Expected status 422, got %d", w.Code)
 	}
 
 	// Should return JSON error

internal/handlers/partnumber_books.go

@@ -0,0 +1,113 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+
+	"git.mchus.pro/mchus/quoteforge/internal/localdb"
+	"git.mchus.pro/mchus/quoteforge/internal/repository"
+	"github.com/gin-gonic/gin"
+)
+
+// PartnumberBooksHandler provides read-only access to local partnumber book snapshots.
+type PartnumberBooksHandler struct {
+	localDB *localdb.LocalDB
+}
+
+func NewPartnumberBooksHandler(localDB *localdb.LocalDB) *PartnumberBooksHandler {
+	return &PartnumberBooksHandler{localDB: localDB}
+}
+
+// List returns all local partnumber book snapshots.
+// GET /api/partnumber-books
+func (h *PartnumberBooksHandler) List(c *gin.Context) {
+	bookRepo := repository.NewPartnumberBookRepository(h.localDB.DB())
+	books, err := bookRepo.ListBooks()
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
+	type bookSummary struct {
+		ID        uint   `json:"id"`
+		ServerID  int    `json:"server_id"`
+		Version   string `json:"version"`
+		CreatedAt string `json:"created_at"`
+		IsActive  bool   `json:"is_active"`
+		ItemCount int64  `json:"item_count"`
+	}
+
+	summaries := make([]bookSummary, 0, len(books))
+	for _, b := range books {
+		summaries = append(summaries, bookSummary{
+			ID:        b.ID,
+			ServerID:  b.ServerID,
+			Version:   b.Version,
+			CreatedAt: b.CreatedAt.Format("2006-01-02"),
+			IsActive:  b.IsActive,
+			ItemCount: bookRepo.CountBookItems(b.ID),
+		})
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"items":       summaries,
+		"total_count": len(summaries),
+		"page":        1,
+		"per_page":    len(summaries),
+		"total_pages": 1,
+	})
+}
+
+// GetItems returns items for a partnumber book by server ID.
+// GET /api/partnumber-books/:id
+func (h *PartnumberBooksHandler) GetItems(c *gin.Context) {
+	idStr := c.Param("id")
+	id, err := strconv.ParseUint(idStr, 10, 64)
+	if err != nil {
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "invalid book ID"})
+		return
+	}
+
+	bookRepo := repository.NewPartnumberBookRepository(h.localDB.DB())
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	perPage, _ := strconv.Atoi(c.DefaultQuery("per_page", "100"))
+	search := strings.TrimSpace(c.Query("search"))
+	if page < 1 {
+		page = 1
+	}
+	if perPage < 1 || perPage > 500 {
+		perPage = 100
+	}
+
+	book, err := h.localDB.GetLocalPartnumberBookByServerID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "partnumber book not found"})
+		return
+	}
+
+	items, total, err := bookRepo.GetBookItemsPage(book.ID, search, page, perPage)
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
+	totalPages := int((total + int64(perPage) - 1) / int64(perPage))
+	if totalPages < 1 {
+		totalPages = 1
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"book_id":     book.ServerID,
+		"version":     book.Version,
+		"is_active":   book.IsActive,
+		"partnumbers": book.PartnumbersJSON,
+		"items":       items,
+		"total_count": total,
+		"page":        page,
+		"per_page":    perPage,
+		"total_pages": totalPages,
+		"search":      search,
+		"book_total":  bookRepo.CountBookItems(book.ID),
+		"lot_count":   bookRepo.CountDistinctLots(book.ID),
+	})
+}

internal/handlers/pricelist.go

@@ -34,7 +34,7 @@ func (h *PricelistHandler) List(c *gin.Context) {
 
 	localPLs, err := h.localDB.GetLocalPricelists()
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
 		return
 	}
 	if source != "" {
@@ -46,8 +46,30 @@ func (h *PricelistHandler) List(c *gin.Context) {
 		}
 		localPLs = filtered
 	}
-	if activeOnly {
-		// Local cache stores only active snapshots for normal operations.
+	type pricelistWithCount struct {
+		pricelist  localdb.LocalPricelist
+		itemCount  int64
+		usageCount int
+	}
+	withCounts := make([]pricelistWithCount, 0, len(localPLs))
+	for _, lpl := range localPLs {
+		itemCount := h.localDB.CountLocalPricelistItems(lpl.ID)
+		if activeOnly && itemCount == 0 {
+			continue
+		}
+		usageCount := 0
+		if lpl.IsUsed {
+			usageCount = 1
+		}
+		withCounts = append(withCounts, pricelistWithCount{
+			pricelist:  lpl,
+			itemCount:  itemCount,
+			usageCount: usageCount,
+		})
+	}
+	localPLs = localPLs[:0]
+	for _, row := range withCounts {
+		localPLs = append(localPLs, row.pricelist)
 	}
 	sort.SliceStable(localPLs, func(i, j int) bool { return localPLs[i].CreatedAt.After(localPLs[j].CreatedAt) })
 	total := len(localPLs)
@@ -62,10 +84,14 @@ func (h *PricelistHandler) List(c *gin.Context) {
 	pageSlice := localPLs[start:end]
 	summaries := make([]map[string]interface{}, 0, len(pageSlice))
 	for _, lpl := range pageSlice {
-		itemCount := h.localDB.CountLocalPricelistItems(lpl.ID)
+		itemCount := int64(0)
 		usageCount := 0
-		if lpl.IsUsed {
-			usageCount = 1
+		for _, row := range withCounts {
+			if row.pricelist.ID == lpl.ID {
+				itemCount = row.itemCount
+				usageCount = row.usageCount
+				break
+			}
 		}
 		summaries = append(summaries, map[string]interface{}{
 			"id":          lpl.ServerID,
@@ -80,11 +106,16 @@ func (h *PricelistHandler) List(c *gin.Context) {
 		})
 	}
 
+	totalPages := (total + perPage - 1) / perPage
+	if totalPages < 1 {
+		totalPages = 1
+	}
 	c.JSON(http.StatusOK, gin.H{
-		"pricelists": summaries,
-		"total":      total,
-		"page":       page,
-		"per_page":   perPage,
+		"items":       summaries,
+		"total_count": total,
+		"page":        page,
+		"per_page":    perPage,
+		"total_pages": totalPages,
 	})
 }
 
@@ -93,7 +124,7 @@ func (h *PricelistHandler) Get(c *gin.Context) {
 	idStr := c.Param("id")
 	id, err := strconv.ParseUint(idStr, 10, 32)
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid pricelist ID"})
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "invalid pricelist ID"})
 		return
 	}
 
@@ -120,7 +151,7 @@ func (h *PricelistHandler) GetItems(c *gin.Context) {
 	idStr := c.Param("id")
 	id, err := strconv.ParseUint(idStr, 10, 32)
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid pricelist ID"})
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "invalid pricelist ID"})
 		return
 	}
 
@@ -139,40 +170,47 @@ func (h *PricelistHandler) GetItems(c *gin.Context) {
 	if perPage < 1 {
 		perPage = 50
 	}
-	var items []localdb.LocalPricelistItem
-	dbq := h.localDB.DB().Model(&localdb.LocalPricelistItem{}).Where("pricelist_id = ?", localPL.ID)
-	if strings.TrimSpace(search) != "" {
-		dbq = dbq.Where("lot_name LIKE ?", "%"+strings.TrimSpace(search)+"%")
-	}
-	var total int64
-	if err := dbq.Count(&total).Error; err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-	offset := (page - 1) * perPage
 
-	if err := dbq.Order("lot_name").Offset(offset).Limit(perPage).Find(&items).Error; err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+	items, total, err := h.localDB.GetLocalPricelistItemsPage(localPL.ID, strings.TrimSpace(search), page, perPage)
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
 		return
 	}
+
+	lotNames := make([]string, len(items))
+	for i, item := range items {
+		lotNames[i] = item.LotName
+	}
+	descMap, err := h.localDB.GetLocalComponentDescriptionsByLotNames(lotNames)
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
 	resultItems := make([]gin.H, 0, len(items))
 	for _, item := range items {
 		resultItems = append(resultItems, gin.H{
-			"id":            item.ID,
-			"lot_name":      item.LotName,
-			"price":         item.Price,
-			"category":      item.LotCategory,
-			"available_qty": item.AvailableQty,
-			"partnumbers":   []string(item.Partnumbers),
+			"id":               item.ID,
+			"lot_name":         item.LotName,
+			"lot_description":  descMap[item.LotName],
+			"price":            item.Price,
+			"category":         item.LotCategory,
+			"available_qty":    item.AvailableQty,
+			"partnumbers":      []string(item.Partnumbers),
+			"partnumber_qtys":  map[string]interface{}{},
+			"competitor_names": []string{},
+			"price_spread_pct": nil,
 		})
 	}
 
+	totalPages := int((total + int64(perPage) - 1) / int64(perPage))
 	c.JSON(http.StatusOK, gin.H{
-		"source":   localPL.Source,
-		"items":    resultItems,
-		"total":    total,
-		"page":     page,
-		"per_page": perPage,
+		"source":      localPL.Source,
+		"items":       resultItems,
+		"total_count": total,
+		"page":        page,
+		"per_page":    perPage,
+		"total_pages": totalPages,
 	})
 }
 
@@ -180,7 +218,7 @@ func (h *PricelistHandler) GetLotNames(c *gin.Context) {
 	idStr := c.Param("id")
 	id, err := strconv.ParseUint(idStr, 10, 32)
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid pricelist ID"})
+		c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "invalid pricelist ID"})
 		return
 	}
 
@@ -191,7 +229,7 @@ func (h *PricelistHandler) GetLotNames(c *gin.Context) {
 	}
 	items, err := h.localDB.GetLocalPricelistItems(localPL.ID)
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
 		return
 	}
 	lotNames := make([]string, 0, len(items))

internal/handlers/pricelist_test.go

@@ -82,3 +82,80 @@ func TestPricelistGetItems_ReturnsLotCategoryFromLocalPricelistItems(t *testing.
 	}
 }
 
+func TestPricelistList_ActiveOnlyExcludesPricelistsWithoutItems(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	local, err := localdb.New(filepath.Join(t.TempDir(), "local_active_only.db"))
+	if err != nil {
+		t.Fatalf("init local db: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	if err := local.SaveLocalPricelist(&localdb.LocalPricelist{
+		ServerID:  10,
+		Source:    "estimate",
+		Version:   "E-1",
+		Name:      "with-items",
+		CreatedAt: time.Now().Add(-time.Minute),
+		SyncedAt:  time.Now().Add(-time.Minute),
+	}); err != nil {
+		t.Fatalf("save with-items pricelist: %v", err)
+	}
+	withItems, err := local.GetLocalPricelistByServerID(10)
+	if err != nil {
+		t.Fatalf("load with-items pricelist: %v", err)
+	}
+	if err := local.SaveLocalPricelistItems([]localdb.LocalPricelistItem{
+		{
+			PricelistID: withItems.ID,
+			LotName:     "CPU_X",
+			LotCategory: "CPU",
+			Price:       100,
+		},
+	}); err != nil {
+		t.Fatalf("save with-items pricelist items: %v", err)
+	}
+
+	if err := local.SaveLocalPricelist(&localdb.LocalPricelist{
+		ServerID:  11,
+		Source:    "estimate",
+		Version:   "E-2",
+		Name:      "without-items",
+		CreatedAt: time.Now(),
+		SyncedAt:  time.Now(),
+	}); err != nil {
+		t.Fatalf("save without-items pricelist: %v", err)
+	}
+
+	h := NewPricelistHandler(local)
+
+	req, _ := http.NewRequest("GET", "/api/pricelists?source=estimate&active_only=true", nil)
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = req
+
+	h.List(c)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
+	}
+
+	var resp struct {
+		Items []struct {
+			ID uint `json:"id"`
+		} `json:"items"`
+		TotalCount int `json:"total_count"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	if resp.TotalCount != 1 {
+		t.Fatalf("expected total=1, got %d", resp.TotalCount)
+	}
+	if len(resp.Items) != 1 {
+		t.Fatalf("expected 1 pricelist, got %d", len(resp.Items))
+	}
+	if resp.Items[0].ID != 10 {
+		t.Fatalf("expected pricelist id=10, got %d", resp.Items[0].ID)
+	}
+}

internal/handlers/quote.go

@@ -18,13 +18,13 @@ func NewQuoteHandler(quoteService *services.QuoteService) *QuoteHandler {
 func (h *QuoteHandler) Validate(c *gin.Context) {
 	var req services.QuoteRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
 		return
 	}
 
 	result, err := h.quoteService.ValidateAndCalculate(&req)
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
 		return
 	}
 
@@ -34,13 +34,13 @@ func (h *QuoteHandler) Validate(c *gin.Context) {
 func (h *QuoteHandler) Calculate(c *gin.Context) {
 	var req services.QuoteRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
 		return
 	}
 
 	result, err := h.quoteService.ValidateAndCalculate(&req)
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
 		return
 	}
 
@@ -53,13 +53,13 @@ func (h *QuoteHandler) Calculate(c *gin.Context) {
 func (h *QuoteHandler) PriceLevels(c *gin.Context) {
 	var req services.PriceLevelsRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
 		return
 	}
 
 	result, err := h.quoteService.CalculatePriceLevels(&req)
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
 		return
 	}
 

internal/handlers/respond.go

@@ -0,0 +1,73 @@
+package handlers
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+func RespondError(c *gin.Context, status int, fallback string, err error) {
+	if err != nil {
+		_ = c.Error(err)
+	}
+	c.JSON(status, gin.H{"error": clientFacingErrorMessage(status, fallback, err)})
+}
+
+func clientFacingErrorMessage(status int, fallback string, err error) string {
+	if err == nil {
+		return fallback
+	}
+	if status >= 500 {
+		return fallback
+	}
+	if isRequestDecodeError(err) {
+		return fallback
+	}
+
+	message := strings.TrimSpace(err.Error())
+	if message == "" {
+		return fallback
+	}
+	if looksTechnicalError(message) {
+		return fallback
+	}
+	return message
+}
+
+func isRequestDecodeError(err error) bool {
+	var syntaxErr *json.SyntaxError
+	if errors.As(err, &syntaxErr) {
+		return true
+	}
+
+	var unmarshalTypeErr *json.UnmarshalTypeError
+	if errors.As(err, &unmarshalTypeErr) {
+		return true
+	}
+
+	return errors.Is(err, io.ErrUnexpectedEOF) || errors.Is(err, io.EOF)
+}
+
+func looksTechnicalError(message string) bool {
+	lower := strings.ToLower(strings.TrimSpace(message))
+	needles := []string{
+		"sql",
+		"gorm",
+		"driver",
+		"constraint",
+		"syntax error",
+		"unexpected eof",
+		"record not found",
+		"no such table",
+		"stack trace",
+	}
+	for _, needle := range needles {
+		if strings.Contains(lower, needle) {
+			return true
+		}
+	}
+	return false
+}

internal/handlers/respond_test.go

@@ -0,0 +1,41 @@
+package handlers
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestClientFacingErrorMessageKeepsDomain4xx(t *testing.T) {
+	t.Parallel()
+
+	got := clientFacingErrorMessage(400, "invalid request", &json.SyntaxError{Offset: 1})
+	if got != "invalid request" {
+		t.Fatalf("expected fallback for decode error, got %q", got)
+	}
+}
+
+func TestClientFacingErrorMessagePreservesBusinessMessage(t *testing.T) {
+	t.Parallel()
+
+	err := errString("main project variant cannot be deleted")
+	got := clientFacingErrorMessage(400, "invalid request", err)
+	if got != err.Error() {
+		t.Fatalf("expected business message, got %q", got)
+	}
+}
+
+func TestClientFacingErrorMessageHidesTechnical4xx(t *testing.T) {
+	t.Parallel()
+
+	err := errString("sql: no rows in result set")
+	got := clientFacingErrorMessage(404, "resource not found", err)
+	if got != "resource not found" {
+		t.Fatalf("expected fallback for technical error, got %q", got)
+	}
+}
+
+type errString string
+
+func (e errString) Error() string {
+	return string(e)
+}

internal/handlers/setup.go

@@ -6,19 +6,14 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
-	"os"
-	"path/filepath"
 	"strconv"
 	"time"
 
 	qfassets "git.mchus.pro/mchus/quoteforge"
 	"git.mchus.pro/mchus/quoteforge/internal/db"
 	"git.mchus.pro/mchus/quoteforge/internal/localdb"
-	mysqlDriver "github.com/go-sql-driver/mysql"
 	"github.com/gin-gonic/gin"
-	gormmysql "gorm.io/driver/mysql"
-	"gorm.io/gorm"
-	"gorm.io/gorm/logger"
+	mysqlDriver "github.com/go-sql-driver/mysql"
 )
 
 type SetupHandler struct {
@@ -28,7 +23,7 @@ type SetupHandler struct {
 	restartSig chan struct{}
 }
 
-func NewSetupHandler(localDB *localdb.LocalDB, connMgr *db.ConnectionManager, templatesPath string, restartSig chan struct{}) (*SetupHandler, error) {
+func NewSetupHandler(localDB *localdb.LocalDB, connMgr *db.ConnectionManager, _ string, restartSig chan struct{}) (*SetupHandler, error) {
 	funcMap := template.FuncMap{
 		"sub": func(a, b int) int { return a - b },
 		"add": func(a, b int) int { return a + b },
@@ -37,14 +32,9 @@ func NewSetupHandler(localDB *localdb.LocalDB, connMgr *db.ConnectionManager, te
 	templates := make(map[string]*template.Template)
 
 	// Load setup template (standalone, no base needed)
-	setupPath := filepath.Join(templatesPath, "setup.html")
 	var tmpl *template.Template
 	var err error
-	if stat, statErr := os.Stat(templatesPath); statErr == nil && stat.IsDir() {
-		tmpl, err = template.New("").Funcs(funcMap).ParseFiles(setupPath)
-	} else {
-		tmpl, err = template.New("").Funcs(funcMap).ParseFS(qfassets.TemplatesFS, "web/templates/setup.html")
-	}
+	tmpl, err = template.New("").Funcs(funcMap).ParseFS(qfassets.TemplatesFS, "web/templates/setup.html")
 	if err != nil {
 		return nil, fmt.Errorf("parsing setup template: %w", err)
 	}
@@ -71,7 +61,8 @@ func (h *SetupHandler) ShowSetup(c *gin.Context) {
 
 	tmpl := h.templates["setup.html"]
 	if err := tmpl.ExecuteTemplate(c.Writer, "setup.html", data); err != nil {
-		c.String(http.StatusInternalServerError, "Template error: %v", err)
+		_ = c.Error(err)
+		c.String(http.StatusInternalServerError, "Template error")
 	}
 }
 
@@ -96,49 +87,16 @@ func (h *SetupHandler) TestConnection(c *gin.Context) {
 	}
 
 	dsn := buildMySQLDSN(host, port, database, user, password, 5*time.Second)
-
-	db, err := gorm.Open(gormmysql.Open(dsn), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
+	lotCount, canWrite, err := db.ValidateMariaDBConnection(dsn)
 	if err != nil {
+		_ = c.Error(err)
 		c.JSON(http.StatusOK, gin.H{
 			"success": false,
-			"error":   fmt.Sprintf("Connection failed: %v", err),
+			"error":   "Connection check failed",
 		})
 		return
 	}
 
-	sqlDB, err := db.DB()
-	if err != nil {
-		c.JSON(http.StatusOK, gin.H{
-			"success": false,
-			"error":   fmt.Sprintf("Failed to get database handle: %v", err),
-		})
-		return
-	}
-	defer sqlDB.Close()
-
-	if err := sqlDB.Ping(); err != nil {
-		c.JSON(http.StatusOK, gin.H{
-			"success": false,
-			"error":   fmt.Sprintf("Ping failed: %v", err),
-		})
-		return
-	}
-
-	// Check for required tables
-	var lotCount int64
-	if err := db.Table("lot").Count(&lotCount).Error; err != nil {
-		c.JSON(http.StatusOK, gin.H{
-			"success": false,
-			"error":   fmt.Sprintf("Table 'lot' not found or inaccessible: %v", err),
-		})
-		return
-	}
-
-	// Check write permission
-	canWrite := testWritePermission(db)
-
 	c.JSON(http.StatusOK, gin.H{
 		"success":   true,
 		"lot_count": lotCount,
@@ -171,26 +129,21 @@ func (h *SetupHandler) SaveConnection(c *gin.Context) {
 
 	// Test connection first
 	dsn := buildMySQLDSN(host, port, database, user, password, 5*time.Second)
-
-	db, err := gorm.Open(gormmysql.Open(dsn), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
+	if _, _, err := db.ValidateMariaDBConnection(dsn); err != nil {
+		_ = c.Error(err)
 		c.JSON(http.StatusBadRequest, gin.H{
 			"success": false,
-			"error":   fmt.Sprintf("Connection failed: %v", err),
+			"error":   "Connection check failed",
 		})
 		return
 	}
 
-	sqlDB, _ := db.DB()
-	sqlDB.Close()
-
 	// Save settings
 	if err := h.localDB.SaveSettings(host, port, database, user, password); err != nil {
+		_ = c.Error(err)
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"success": false,
-			"error":   fmt.Sprintf("Failed to save settings: %v", err),
+			"error":   "Failed to save settings",
 		})
 		return
 	}
@@ -239,22 +192,6 @@ func (h *SetupHandler) GetStatus(c *gin.Context) {
 	})
 }
 
-func testWritePermission(db *gorm.DB) bool {
-	// Simple check: try to create a temporary table and drop it
-	testTable := fmt.Sprintf("qt_write_test_%d", time.Now().UnixNano())
-
-	// Try to create a test table
-	err := db.Exec(fmt.Sprintf("CREATE TABLE %s (id INT)", testTable)).Error
-	if err != nil {
-		return false
-	}
-
-	// Drop it immediately
-	db.Exec(fmt.Sprintf("DROP TABLE %s", testTable))
-
-	return true
-}
-
 func buildMySQLDSN(host string, port int, database, user, password string, timeout time.Duration) string {
 	cfg := mysqlDriver.NewConfig()
 	cfg.User = user
@@ -270,3 +207,4 @@ func buildMySQLDSN(host string, port int, database, user, password string, timeo
 	}
 	return cfg.FormatDSN()
 }
+

internal/handlers/support_bundle.go

@@ -0,0 +1,212 @@
+package handlers
+
+import (
+	"archive/zip"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/http"
+	"os"
+	"runtime"
+	"strconv"
+	"time"
+
+	"git.mchus.pro/mchus/quoteforge/internal/appmeta"
+	"git.mchus.pro/mchus/quoteforge/internal/db"
+	"git.mchus.pro/mchus/quoteforge/internal/localdb"
+	syncsvc "git.mchus.pro/mchus/quoteforge/internal/services/sync"
+	"github.com/gin-gonic/gin"
+)
+
+type SupportBundleHandler struct {
+	localDB     *localdb.LocalDB
+	connMgr     *db.ConnectionManager
+	syncService *syncsvc.Service
+	logFilePath string
+}
+
+func NewSupportBundleHandler(local *localdb.LocalDB, connMgr *db.ConnectionManager, svc *syncsvc.Service, logFilePath string) *SupportBundleHandler {
+	return &SupportBundleHandler{
+		localDB:     local,
+		connMgr:     connMgr,
+		syncService: svc,
+		logFilePath: logFilePath,
+	}
+}
+
+// DownloadBundle collects diagnostic data and streams a ZIP archive.
+// GET /api/support-bundle
+func (h *SupportBundleHandler) DownloadBundle(c *gin.Context) {
+	now := time.Now().UTC()
+	hostname, err := os.Hostname()
+	if err != nil {
+		slog.Warn("support bundle: could not get hostname", "err", err)
+	}
+
+	c.Header("Content-Type", "application/zip")
+	c.Header("Content-Disposition", fmt.Sprintf(`attachment; filename="qfs-bundle-%s.zip"`, now.Format("20060102-150405")))
+
+	zw := zip.NewWriter(c.Writer)
+	defer zw.Close()
+
+	writeJSON := func(name string, v any) {
+		w, err := zw.Create(name)
+		if err != nil {
+			return
+		}
+		enc := json.NewEncoder(w)
+		enc.SetIndent("", "  ")
+		_ = enc.Encode(v)
+	}
+
+	// app_info.json
+	writeJSON("app_info.json", map[string]any{
+		"app_version":  appmeta.Version(),
+		"go_version":   runtime.Version(),
+		"os":           runtime.GOOS,
+		"arch":         runtime.GOARCH,
+		"hostname":     hostname,
+		"db_user":      h.localDB.GetDBUser(),
+		"collected_at": now.Format(time.RFC3339),
+	})
+
+	// local_db_stats.json
+	writeJSON("local_db_stats.json", map[string]any{
+		"components":                   h.localDB.CountLocalComponents(),
+		"configurations":               h.localDB.CountConfigurations(),
+		"projects":                     h.localDB.CountProjects(),
+		"pricelists":                   h.localDB.CountLocalPricelists(),
+		"pending_changes":              h.localDB.GetPendingCount(),
+		"db_size_bytes":                h.localDB.DBFileSizeBytes(),
+		"last_pricelist_sync_time":     h.localDB.GetLastSyncTime(),
+		"last_pricelist_attempt":       h.localDB.GetLastPricelistSyncAttemptAt(),
+		"last_pricelist_status":        h.localDB.GetLastPricelistSyncStatus(),
+		"last_pricelist_error":         h.localDB.GetLastPricelistSyncError(),
+		"last_component_sync_attempt":  h.localDB.GetLastComponentSyncAttemptAt(),
+		"last_component_sync_status":   h.localDB.GetLastComponentSyncStatus(),
+		"last_component_sync_error":    h.localDB.GetLastComponentSyncError(),
+	})
+
+	// db_connection.json — includes TCP ping to DB host
+	connStatus := h.connMgr.GetStatus()
+	dbConnDoc := map[string]any{
+		"is_connected": connStatus.IsConnected,
+		"last_error":   connStatus.LastError,
+	}
+	if settings, err := h.localDB.GetSettings(); err == nil && settings.Host != "" {
+		addr := net.JoinHostPort(settings.Host, strconv.Itoa(settings.Port))
+		start := time.Now()
+		conn, dialErr := net.DialTimeout("tcp", addr, 3*time.Second)
+		pingMs := time.Since(start).Milliseconds()
+		if dialErr == nil {
+			conn.Close()
+			dbConnDoc["tcp_ping_ms"] = pingMs
+			dbConnDoc["tcp_ping_addr"] = addr
+		} else {
+			dbConnDoc["tcp_ping_error"] = dialErr.Error()
+			dbConnDoc["tcp_ping_addr"] = addr
+		}
+	}
+	writeJSON("db_connection.json", dbConnDoc)
+
+	// sync_readiness.json
+	if h.syncService != nil {
+		readiness, err := h.syncService.GetReadiness()
+		if err != nil {
+			writeJSON("sync_readiness.json", map[string]any{"error": err.Error()})
+		} else {
+			writeJSON("sync_readiness.json", readiness)
+		}
+	}
+
+	// system_metrics.json
+	writeJSON("system_metrics.json", collectSystemMetrics())
+
+	// sync_log.json — history of sync operations
+	if entries, err := h.localDB.GetSyncLog(200); err == nil {
+		writeJSON("sync_log.json", entries)
+	}
+
+	// pricelists.json — downloaded pricelists grouped by source
+	if pricelists, err := h.localDB.GetLocalPricelists(); err == nil {
+		type plEntry struct {
+			ServerID  uint      `json:"server_id"`
+			Source    string    `json:"source"`
+			Version   string    `json:"version"`
+			Name      string    `json:"name,omitempty"`
+			CreatedAt time.Time `json:"created_at"`
+			SyncedAt  time.Time `json:"synced_at"`
+			IsUsed    bool      `json:"is_used"`
+		}
+		bySource := map[string][]plEntry{}
+		for _, pl := range pricelists {
+			e := plEntry{
+				ServerID:  pl.ServerID,
+				Source:    pl.Source,
+				Version:   pl.Version,
+				Name:      pl.Name,
+				CreatedAt: pl.CreatedAt,
+				SyncedAt:  pl.SyncedAt,
+				IsUsed:    pl.IsUsed,
+			}
+			bySource[pl.Source] = append(bySource[pl.Source], e)
+		}
+		writeJSON("pricelists.json", bySource)
+	}
+
+	// schema_migrations.json
+	migrations, err := h.localDB.GetSchemaMigrations()
+	if err != nil {
+		slog.Warn("support bundle: could not load schema migrations", "err", err)
+	}
+	writeJSON("schema_migrations.json", migrations)
+
+	// app.log (tail 5 MiB)
+	if h.logFilePath != "" {
+		if f, err := os.Open(h.logFilePath); err == nil {
+			defer f.Close()
+			if info, err := f.Stat(); err == nil {
+				const maxLog = 5 << 20
+				offset := int64(0)
+				if info.Size() > maxLog {
+					offset = info.Size() - maxLog
+				}
+				if _, err := f.Seek(offset, io.SeekStart); err == nil {
+					if w, err := zw.Create("app.log"); err == nil {
+						if _, err := io.Copy(w, f); err != nil {
+							slog.Warn("support bundle: error copying log file", "err", err)
+						}
+					}
+				}
+			}
+		}
+	}
+
+	c.Status(http.StatusOK)
+}
+
+func collectSystemMetrics() map[string]any {
+	var ms runtime.MemStats
+	runtime.ReadMemStats(&ms)
+
+	m := map[string]any{
+		"goroutines":        runtime.NumGoroutine(),
+		"cpu_count":         runtime.NumCPU(),
+		"heap_alloc_bytes":  ms.HeapAlloc,
+		"heap_sys_bytes":    ms.HeapSys,
+		"heap_inuse_bytes":  ms.HeapInuse,
+		"stack_inuse_bytes": ms.StackInuse,
+		"gc_cycles":         ms.NumGC,
+		"next_gc_bytes":     ms.NextGC,
+	}
+
+	if wd, err := os.Getwd(); err == nil {
+		if info := diskUsage(wd); info != nil {
+			m["disk"] = info
+		}
+	}
+
+	return m
+}

internal/handlers/support_bundle_disk_unix.go

@@ -0,0 +1,20 @@
+//go:build linux || darwin
+
+package handlers
+
+import "syscall"
+
+func diskUsage(path string) map[string]any {
+	var stat syscall.Statfs_t
+	if err := syscall.Statfs(path, &stat); err != nil {
+		return nil
+	}
+	total := stat.Blocks * uint64(stat.Bsize)
+	free := stat.Bfree * uint64(stat.Bsize)
+	return map[string]any{
+		"total_bytes": total,
+		"free_bytes":  free,
+		"used_bytes":  total - free,
+		"path":        path,
+	}
+}

internal/handlers/support_bundle_disk_windows.go

@@ -0,0 +1,7 @@
+//go:build windows
+
+package handlers
+
+func diskUsage(_ string) map[string]any {
+	return nil
+}

internal/handlers/sync.go

@@ -6,8 +6,7 @@ import (
 	"html/template"
 	"log/slog"
 	"net/http"
-	"os"
-	"path/filepath"
+	"strings"
 	stdsync "sync"
 	"time"
 
@@ -32,16 +31,9 @@ type SyncHandler struct {
 }
 
 // NewSyncHandler creates a new sync handler
-func NewSyncHandler(localDB *localdb.LocalDB, syncService *sync.Service, connMgr *db.ConnectionManager, templatesPath string, autoSyncInterval time.Duration) (*SyncHandler, error) {
+func NewSyncHandler(localDB *localdb.LocalDB, syncService *sync.Service, connMgr *db.ConnectionManager, _ string, autoSyncInterval time.Duration) (*SyncHandler, error) {
 	// Load sync_status partial template
-	partialPath := filepath.Join(templatesPath, "partials", "sync_status.html")
-	var tmpl *template.Template
-	var err error
-	if stat, statErr := os.Stat(templatesPath); statErr == nil && stat.IsDir() {
-		tmpl, err = template.ParseFiles(partialPath)
-	} else {
-		tmpl, err = template.ParseFS(qfassets.TemplatesFS, "web/templates/partials/sync_status.html")
-	}
+	tmpl, err := template.ParseFS(qfassets.TemplatesFS, "web/templates/partials/sync_status.html")
 	if err != nil {
 		return nil, err
 	}
@@ -58,15 +50,20 @@ func NewSyncHandler(localDB *localdb.LocalDB, syncService *sync.Service, connMgr
 
 // SyncStatusResponse represents the sync status
 type SyncStatusResponse struct {
-	LastComponentSync *time.Time          `json:"last_component_sync"`
-	LastPricelistSync *time.Time          `json:"last_pricelist_sync"`
-	IsOnline          bool                `json:"is_online"`
-	ComponentsCount   int64               `json:"components_count"`
-	PricelistsCount   int64               `json:"pricelists_count"`
-	ServerPricelists  int                 `json:"server_pricelists"`
-	NeedComponentSync bool                `json:"need_component_sync"`
-	NeedPricelistSync bool                `json:"need_pricelist_sync"`
-	Readiness         *sync.SyncReadiness `json:"readiness,omitempty"`
+	LastComponentSync       *time.Time          `json:"last_component_sync"`
+	LastPricelistSync       *time.Time          `json:"last_pricelist_sync"`
+	LastPricelistAttemptAt  *time.Time          `json:"last_pricelist_attempt_at,omitempty"`
+	LastPricelistSyncStatus string              `json:"last_pricelist_sync_status,omitempty"`
+	LastPricelistSyncError  string              `json:"last_pricelist_sync_error,omitempty"`
+	HasIncompleteServerSync bool                `json:"has_incomplete_server_sync"`
+	KnownServerChangesMiss  bool                `json:"known_server_changes_missing"`
+	IsOnline                bool                `json:"is_online"`
+	ComponentsCount         int64               `json:"components_count"`
+	PricelistsCount         int64               `json:"pricelists_count"`
+	ServerPricelists        int                 `json:"server_pricelists"`
+	NeedComponentSync       bool                `json:"need_component_sync"`
+	NeedPricelistSync       bool                `json:"need_pricelist_sync"`
+	Readiness               *sync.SyncReadiness `json:"readiness,omitempty"`
 }
 
 type SyncReadinessResponse struct {
@@ -81,42 +78,34 @@ type SyncReadinessResponse struct {
 // GetStatus returns current sync status
 // GET /api/sync/status
 func (h *SyncHandler) GetStatus(c *gin.Context) {
-	// Check online status by pinging MariaDB
-	isOnline := h.checkOnline()
-
-	// Get sync times
+	connStatus := h.connMgr.GetStatus()
+	isOnline := connStatus.IsConnected && strings.TrimSpace(connStatus.LastError) == ""
 	lastComponentSync := h.localDB.GetComponentSyncTime()
 	lastPricelistSync := h.localDB.GetLastSyncTime()
-
-	// Get counts
 	componentsCount := h.localDB.CountLocalComponents()
 	pricelistsCount := h.localDB.CountLocalPricelists()
-
-	// Get server pricelist count if online
-	serverPricelists := 0
-	needPricelistSync := false
-	if isOnline {
-		status, err := h.syncService.GetStatus()
-		if err == nil {
-			serverPricelists = status.ServerPricelists
-			needPricelistSync = status.NeedsSync
-		}
-	}
-
-	// Check if component sync is needed (older than 24 hours)
+	lastPricelistAttemptAt := h.localDB.GetLastPricelistSyncAttemptAt()
+	lastPricelistSyncStatus := h.localDB.GetLastPricelistSyncStatus()
+	lastPricelistSyncError := h.localDB.GetLastPricelistSyncError()
+	hasFailedSync := strings.EqualFold(lastPricelistSyncStatus, "failed")
 	needComponentSync := h.localDB.NeedComponentSync(24)
-	readiness := h.getReadinessCached(10 * time.Second)
+	readiness := h.getReadinessLocal()
 
 	c.JSON(http.StatusOK, SyncStatusResponse{
-		LastComponentSync: lastComponentSync,
-		LastPricelistSync: lastPricelistSync,
-		IsOnline:          isOnline,
-		ComponentsCount:   componentsCount,
-		PricelistsCount:   pricelistsCount,
-		ServerPricelists:  serverPricelists,
-		NeedComponentSync: needComponentSync,
-		NeedPricelistSync: needPricelistSync,
-		Readiness:         readiness,
+		LastComponentSync:       lastComponentSync,
+		LastPricelistSync:       lastPricelistSync,
+		LastPricelistAttemptAt:  lastPricelistAttemptAt,
+		LastPricelistSyncStatus: lastPricelistSyncStatus,
+		LastPricelistSyncError:  lastPricelistSyncError,
+		HasIncompleteServerSync: hasFailedSync,
+		KnownServerChangesMiss:  hasFailedSync,
+		IsOnline:                isOnline,
+		ComponentsCount:         componentsCount,
+		PricelistsCount:         pricelistsCount,
+		ServerPricelists:        0,
+		NeedComponentSync:       needComponentSync,
+		NeedPricelistSync:       lastPricelistSync == nil || hasFailedSync,
+		Readiness:               readiness,
 	})
 }
 
@@ -125,9 +114,7 @@ func (h *SyncHandler) GetStatus(c *gin.Context) {
 func (h *SyncHandler) GetReadiness(c *gin.Context) {
 	readiness, err := h.syncService.GetReadiness()
 	if err != nil && readiness == nil {
-		c.JSON(http.StatusInternalServerError, gin.H{
-			"error": err.Error(),
-		})
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
 		return
 	}
 	if readiness == nil {
@@ -167,8 +154,9 @@ func (h *SyncHandler) ensureSyncReadiness(c *gin.Context) bool {
 
 	c.JSON(http.StatusInternalServerError, gin.H{
 		"success": false,
-		"error":   err.Error(),
+		"error":   "internal server error",
 	})
+	_ = c.Error(err)
 	_ = readiness
 	return false
 }
@@ -193,20 +181,31 @@ func (h *SyncHandler) SyncComponents(c *gin.Context) {
 	if err != nil {
 		c.JSON(http.StatusServiceUnavailable, gin.H{
 			"success": false,
-			"error":   "Database connection failed: " + err.Error(),
+			"error":   "database connection failed",
 		})
+		_ = c.Error(err)
 		return
 	}
 
+	now := time.Now()
 	result, err := h.localDB.SyncComponents(mariaDB)
 	if err != nil {
+		_ = h.localDB.SetComponentSyncResult("error", err.Error(), now)
+		h.localDB.AppendSyncLog("components", "error", err.Error(), 0, now, time.Since(now).Milliseconds())
 		slog.Error("component sync failed", "error", err)
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"success": false,
-			"error":   err.Error(),
+			"error":   "component sync failed",
 		})
+		_ = c.Error(err)
 		return
 	}
+	_ = h.localDB.SetComponentSyncResult("ok", "", now)
+	h.localDB.AppendSyncLog("components", "ok", "", result.TotalSynced, now, result.Duration.Milliseconds())
+
+	if err := h.localDB.SyncQtSettings(mariaDB); err != nil {
+		slog.Warn("qt_settings sync failed", "error", err)
+	}
 
 	c.JSON(http.StatusOK, SyncResultResponse{
 		Success:  true,
@@ -226,13 +225,20 @@ func (h *SyncHandler) SyncPricelists(c *gin.Context) {
 	startTime := time.Now()
 	synced, err := h.syncService.SyncPricelists()
 	if err != nil {
+		h.localDB.AppendSyncLog("pricelists", "error", err.Error(), 0, startTime, time.Since(startTime).Milliseconds())
 		slog.Error("pricelist sync failed", "error", err)
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"success": false,
-			"error":   err.Error(),
+			"error":   "pricelist sync failed",
 		})
+		_ = c.Error(err)
 		return
 	}
+	h.localDB.AppendSyncLog("pricelists", "ok", "", synced, startTime, time.Since(startTime).Milliseconds())
+
+	if _, err := h.syncService.PullPartnumberBooks(); err != nil {
+		slog.Warn("partnumber books pull failed after pricelist sync", "error", err)
+	}
 
 	c.JSON(http.StatusOK, SyncResultResponse{
 		Success:  true,
@@ -240,7 +246,33 @@ func (h *SyncHandler) SyncPricelists(c *gin.Context) {
 		Synced:   synced,
 		Duration: time.Since(startTime).String(),
 	})
-	h.syncService.RecordSyncHeartbeat()
+}
+
+// SyncPartnumberBooks syncs partnumber book snapshots from MariaDB to local SQLite.
+// POST /api/sync/partnumber-books
+func (h *SyncHandler) SyncPartnumberBooks(c *gin.Context) {
+	if !h.ensureSyncReadiness(c) {
+		return
+	}
+
+	startTime := time.Now()
+	pulled, err := h.syncService.PullPartnumberBooks()
+	if err != nil {
+		slog.Error("partnumber books pull failed", "error", err)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"success": false,
+			"error":   "partnumber books sync failed",
+		})
+		_ = c.Error(err)
+		return
+	}
+
+	c.JSON(http.StatusOK, SyncResultResponse{
+		Success:  true,
+		Message:  "Partnumber books synced successfully",
+		Synced:   pulled,
+		Duration: time.Since(startTime).String(),
+	})
 }
 
 // SyncAllResponse represents result of full sync
@@ -277,8 +309,9 @@ func (h *SyncHandler) SyncAll(c *gin.Context) {
 		slog.Error("pending push failed during full sync", "error", err)
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"success": false,
-			"error":   "Pending changes push failed: " + err.Error(),
+			"error":   "pending changes push failed",
 		})
+		_ = c.Error(err)
 		return
 	}
 
@@ -287,45 +320,65 @@ func (h *SyncHandler) SyncAll(c *gin.Context) {
 	if err != nil {
 		c.JSON(http.StatusServiceUnavailable, gin.H{
 			"success": false,
-			"error":   "Database connection failed: " + err.Error(),
+			"error":   "database connection failed",
 		})
+		_ = c.Error(err)
 		return
 	}
 
+	compNow := time.Now()
 	compResult, err := h.localDB.SyncComponents(mariaDB)
 	if err != nil {
+		_ = h.localDB.SetComponentSyncResult("error", err.Error(), compNow)
+		h.localDB.AppendSyncLog("components", "error", err.Error(), 0, compNow, time.Since(compNow).Milliseconds())
 		slog.Error("component sync failed during full sync", "error", err)
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"success": false,
-			"error":   "Component sync failed: " + err.Error(),
+			"error":   "component sync failed",
 		})
+		_ = c.Error(err)
 		return
 	}
+	_ = h.localDB.SetComponentSyncResult("ok", "", compNow)
+	h.localDB.AppendSyncLog("components", "ok", "", compResult.TotalSynced, compNow, compResult.Duration.Milliseconds())
 	componentsSynced = compResult.TotalSynced
 
+	if err := h.localDB.SyncQtSettings(mariaDB); err != nil {
+		slog.Warn("qt_settings sync failed", "error", err)
+	}
+
 	// Sync pricelists
+	plNow := time.Now()
 	pricelistsSynced, err = h.syncService.SyncPricelists()
 	if err != nil {
+		h.localDB.AppendSyncLog("pricelists", "error", err.Error(), 0, plNow, time.Since(plNow).Milliseconds())
 		slog.Error("pricelist sync failed during full sync", "error", err)
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"success":           false,
-			"error":             "Pricelist sync failed: " + err.Error(),
+			"error":             "pricelist sync failed",
 			"pending_pushed":    pendingPushed,
 			"components_synced": componentsSynced,
 		})
+		_ = c.Error(err)
 		return
 	}
+	h.localDB.AppendSyncLog("pricelists", "ok", "", pricelistsSynced, plNow, time.Since(plNow).Milliseconds())
+
+	if _, err := h.syncService.PullPartnumberBooks(); err != nil {
+		slog.Warn("partnumber books pull failed during full sync", "error", err)
+	}
 
 	projectsResult, err := h.syncService.ImportProjectsToLocal()
 	if err != nil {
 		slog.Error("project import failed during full sync", "error", err)
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"success":           false,
-			"error":             "Project import failed: " + err.Error(),
+			"error":             "project import failed",
 			"pending_pushed":    pendingPushed,
 			"components_synced": componentsSynced,
 			"pricelists_synced": pricelistsSynced,
 		})
+		_ = c.Error(err)
 		return
 	}
 
@@ -334,7 +387,7 @@ func (h *SyncHandler) SyncAll(c *gin.Context) {
 		slog.Error("configuration import failed during full sync", "error", err)
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"success":           false,
-			"error":             "Configuration import failed: " + err.Error(),
+			"error":             "configuration import failed",
 			"pending_pushed":    pendingPushed,
 			"components_synced": componentsSynced,
 			"pricelists_synced": pricelistsSynced,
@@ -342,6 +395,7 @@ func (h *SyncHandler) SyncAll(c *gin.Context) {
 			"projects_updated":  projectsResult.Updated,
 			"projects_skipped":  projectsResult.Skipped,
 		})
+		_ = c.Error(err)
 		return
 	}
 
@@ -359,7 +413,6 @@ func (h *SyncHandler) SyncAll(c *gin.Context) {
 		ConfigurationsSkipped:  configsResult.Skipped,
 		Duration:               time.Since(startTime).String(),
 	})
-	h.syncService.RecordSyncHeartbeat()
 }
 
 // checkOnline checks if MariaDB is accessible
@@ -380,8 +433,9 @@ func (h *SyncHandler) PushPendingChanges(c *gin.Context) {
 		slog.Error("push pending changes failed", "error", err)
 		c.JSON(http.StatusInternalServerError, gin.H{
 			"success": false,
-			"error":   err.Error(),
+			"error":   "pending changes push failed",
 		})
+		_ = c.Error(err)
 		return
 	}
 
@@ -391,7 +445,6 @@ func (h *SyncHandler) PushPendingChanges(c *gin.Context) {
 		Synced:   pushed,
 		Duration: time.Since(startTime).String(),
 	})
-	h.syncService.RecordSyncHeartbeat()
 }
 
 // GetPendingCount returns the number of pending changes
@@ -408,9 +461,7 @@ func (h *SyncHandler) GetPendingCount(c *gin.Context) {
 func (h *SyncHandler) GetPendingChanges(c *gin.Context) {
 	changes, err := h.localDB.GetPendingChanges()
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{
-			"error": err.Error(),
-		})
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
 		return
 	}
 
@@ -419,6 +470,27 @@ func (h *SyncHandler) GetPendingChanges(c *gin.Context) {
 	})
 }
 
+// RepairPendingChanges attempts to repair errored pending changes
+// POST /api/sync/repair
+func (h *SyncHandler) RepairPendingChanges(c *gin.Context) {
+	repaired, remainingErrors, err := h.localDB.RepairPendingChanges()
+	if err != nil {
+		slog.Error("repair pending changes failed", "error", err)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"success": false,
+			"error":   "pending changes repair failed",
+		})
+		_ = c.Error(err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success":          true,
+		"repaired":         repaired,
+		"remaining_errors": remainingErrors,
+	})
+}
+
 // SyncInfoResponse represents sync information for the modal
 type SyncInfoResponse struct {
 	// Connection
@@ -427,8 +499,13 @@ type SyncInfoResponse struct {
 	DBName string `json:"db_name"`
 
 	// Status
-	IsOnline   bool       `json:"is_online"`
-	LastSyncAt *time.Time `json:"last_sync_at"`
+	IsOnline                bool       `json:"is_online"`
+	LastSyncAt              *time.Time `json:"last_sync_at"`
+	LastPricelistAttemptAt  *time.Time `json:"last_pricelist_attempt_at,omitempty"`
+	LastPricelistSyncStatus string     `json:"last_pricelist_sync_status,omitempty"`
+	LastPricelistSyncError  string     `json:"last_pricelist_sync_error,omitempty"`
+	NeedPricelistSync       bool       `json:"need_pricelist_sync"`
+	HasIncompleteServerSync bool       `json:"has_incomplete_server_sync"`
 
 	// Statistics
 	LotCount     int64 `json:"lot_count"`
@@ -464,8 +541,8 @@ type SyncError struct {
 // GetInfo returns sync information for modal
 // GET /api/sync/info
 func (h *SyncHandler) GetInfo(c *gin.Context) {
-	// Check online status by pinging MariaDB
-	isOnline := h.checkOnline()
+	connStatus := h.connMgr.GetStatus()
+	isOnline := connStatus.IsConnected && strings.TrimSpace(connStatus.LastError) == ""
 
 	// Get DB connection info
 	var dbHost, dbUser, dbName string
@@ -477,19 +554,18 @@ func (h *SyncHandler) GetInfo(c *gin.Context) {
 
 	// Get sync times
 	lastPricelistSync := h.localDB.GetLastSyncTime()
-
-	// Get MariaDB counts (if online)
-	var lotCount, lotLogCount int64
-	if isOnline {
-		if mariaDB, err := h.connMgr.GetDB(); err == nil {
-			mariaDB.Table("lot").Count(&lotCount)
-			mariaDB.Table("lot_log").Count(&lotLogCount)
-		}
-	}
+	lastPricelistAttemptAt := h.localDB.GetLastPricelistSyncAttemptAt()
+	lastPricelistSyncStatus := h.localDB.GetLastPricelistSyncStatus()
+	lastPricelistSyncError := h.localDB.GetLastPricelistSyncError()
+	hasFailedSync := strings.EqualFold(lastPricelistSyncStatus, "failed")
+	needPricelistSync := lastPricelistSync == nil || hasFailedSync
+	hasIncompleteServerSync := hasFailedSync
 
 	// Get local counts
 	configCount := h.localDB.CountConfigurations()
 	projectCount := h.localDB.CountProjects()
+	componentCount := h.localDB.CountLocalComponents()
+	pricelistCount := h.localDB.CountLocalPricelists()
 
 	// Get error count (only changes with LastError != "")
 	errorCount := int(h.localDB.CountErroredChanges())
@@ -516,22 +592,27 @@ func (h *SyncHandler) GetInfo(c *gin.Context) {
 		syncErrors = syncErrors[:10]
 	}
 
-	readiness := h.getReadinessCached(10 * time.Second)
+	readiness := h.getReadinessLocal()
 
 	c.JSON(http.StatusOK, SyncInfoResponse{
-		DBHost:         dbHost,
-		DBUser:         dbUser,
-		DBName:         dbName,
-		IsOnline:       isOnline,
-		LastSyncAt:     lastPricelistSync,
-		LotCount:       lotCount,
-		LotLogCount:    lotLogCount,
-		ConfigCount:    configCount,
-		ProjectCount:   projectCount,
-		PendingChanges: changes,
-		ErrorCount:     errorCount,
-		Errors:         syncErrors,
-		Readiness:      readiness,
+		DBHost:                  dbHost,
+		DBUser:                  dbUser,
+		DBName:                  dbName,
+		IsOnline:                isOnline,
+		LastSyncAt:              lastPricelistSync,
+		LastPricelistAttemptAt:  lastPricelistAttemptAt,
+		LastPricelistSyncStatus: lastPricelistSyncStatus,
+		LastPricelistSyncError:  lastPricelistSyncError,
+		NeedPricelistSync:       needPricelistSync,
+		HasIncompleteServerSync: hasIncompleteServerSync,
+		LotCount:                componentCount,
+		LotLogCount:             pricelistCount,
+		ConfigCount:             configCount,
+		ProjectCount:            projectCount,
+		PendingChanges:          changes,
+		ErrorCount:              errorCount,
+		Errors:                  syncErrors,
+		Readiness:               readiness,
 	})
 }
 
@@ -552,14 +633,9 @@ func (h *SyncHandler) GetUsersStatus(c *gin.Context) {
 		return
 	}
 
-	// Keep current client heartbeat fresh so app version is available in the table.
-	h.syncService.RecordSyncHeartbeat()
-
 	users, err := h.syncService.ListUserSyncStatuses(threshold)
 	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{
-			"error": err.Error(),
-		})
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
 		return
 	}
 
@@ -588,15 +664,33 @@ func (h *SyncHandler) SyncStatusPartial(c *gin.Context) {
 
 	// Get pending count
 	pendingCount := h.localDB.GetPendingCount()
-	readiness := h.getReadinessCached(10 * time.Second)
+	readiness := h.getReadinessLocal()
 	isBlocked := readiness != nil && readiness.Blocked
+	lastPricelistSyncStatus := h.localDB.GetLastPricelistSyncStatus()
+	lastPricelistSyncError := h.localDB.GetLastPricelistSyncError()
+	hasFailedSync := strings.EqualFold(lastPricelistSyncStatus, "failed")
+	hasIncompleteServerSync := hasFailedSync
 
 	slog.Debug("rendering sync status", "is_offline", isOffline, "pending_count", pendingCount, "sync_blocked", isBlocked)
 
 	data := gin.H{
-		"IsOffline":    isOffline,
-		"PendingCount": pendingCount,
-		"IsBlocked":    isBlocked,
+		"IsOffline":               isOffline,
+		"PendingCount":            pendingCount,
+		"IsBlocked":               isBlocked,
+		"HasFailedSync":           hasFailedSync,
+		"HasIncompleteServerSync": hasIncompleteServerSync,
+		"SyncIssueTitle": func() string {
+			if hasIncompleteServerSync {
+				return "Последняя синхронизация прайслистов прервалась. На сервере есть изменения, которые не загружены локально."
+			}
+			if hasFailedSync {
+				if lastPricelistSyncError != "" {
+					return lastPricelistSyncError
+				}
+				return "Последняя синхронизация прайслистов завершилась ошибкой."
+			}
+			return ""
+		}(),
 		"BlockedReason": func() string {
 			if readiness == nil {
 				return ""
@@ -608,27 +702,78 @@ func (h *SyncHandler) SyncStatusPartial(c *gin.Context) {
 	c.Header("Content-Type", "text/html; charset=utf-8")
 	if err := h.tmpl.ExecuteTemplate(c.Writer, "sync_status", data); err != nil {
 		slog.Error("failed to render sync_status template", "error", err)
-		c.String(http.StatusInternalServerError, "Template error: "+err.Error())
+		_ = c.Error(err)
+		c.String(http.StatusInternalServerError, "Template error")
 	}
 }
 
-func (h *SyncHandler) getReadinessCached(maxAge time.Duration) *sync.SyncReadiness {
+func (h *SyncHandler) getReadinessLocal() *sync.SyncReadiness {
 	h.readinessMu.Lock()
-	if h.readinessCached != nil && time.Since(h.readinessCachedAt) < maxAge {
+	if h.readinessCached != nil && time.Since(h.readinessCachedAt) < 10*time.Second {
 		cached := *h.readinessCached
 		h.readinessMu.Unlock()
 		return &cached
 	}
 	h.readinessMu.Unlock()
 
-	readiness, err := h.syncService.GetReadiness()
-	if err != nil && readiness == nil {
+	state, err := h.localDB.GetSyncGuardState()
+	if err != nil || state == nil {
 		return nil
 	}
 
+	// OFFLINE_UNVERIFIED_SCHEMA is only valid while actually offline.
+	// Suppress it when the connection manager reports online so the stale
+	// blocked state from a previous disconnection doesn't linger in the UI.
+	if state.ReasonCode == "OFFLINE_UNVERIFIED_SCHEMA" && h.checkOnline() {
+		return nil
+	}
+
+	readiness := &sync.SyncReadiness{
+		Status:                state.Status,
+		Blocked:               state.Status == sync.ReadinessBlocked,
+		ReasonCode:            state.ReasonCode,
+		ReasonText:            state.ReasonText,
+		RequiredMinAppVersion: state.RequiredMinAppVersion,
+		LastCheckedAt:         state.LastCheckedAt,
+	}
+
 	h.readinessMu.Lock()
 	h.readinessCached = readiness
 	h.readinessCachedAt = time.Now()
 	h.readinessMu.Unlock()
 	return readiness
 }
+
+// ReportPartnumberSeen pushes unresolved vendor partnumbers to qt_vendor_partnumber_seen on MariaDB.
+// POST /api/sync/partnumber-seen
+func (h *SyncHandler) ReportPartnumberSeen(c *gin.Context) {
+	var body struct {
+		Items []struct {
+			Partnumber  string `json:"partnumber"`
+			Description string `json:"description"`
+			Ignored     bool   `json:"ignored"`
+		} `json:"items"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
+		return
+	}
+
+	items := make([]sync.SeenPartnumber, 0, len(body.Items))
+	for _, it := range body.Items {
+		if it.Partnumber != "" {
+			items = append(items, sync.SeenPartnumber{
+				Partnumber:  it.Partnumber,
+				Description: it.Description,
+				Ignored:     it.Ignored,
+			})
+		}
+	}
+
+	if err := h.syncService.PushPartnumberSeen(items); err != nil {
+		RespondError(c, http.StatusServiceUnavailable, "service unavailable", err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"reported": len(items)})
+}

internal/handlers/vendor_spec.go

@@ -0,0 +1,279 @@
+package handlers
+
+import (
+	"errors"
+	"log/slog"
+	"net/http"
+	"strings"
+
+	"git.mchus.pro/mchus/quoteforge/internal/localdb"
+	"git.mchus.pro/mchus/quoteforge/internal/repository"
+	"git.mchus.pro/mchus/quoteforge/internal/services"
+	syncsvc "git.mchus.pro/mchus/quoteforge/internal/services/sync"
+	"github.com/gin-gonic/gin"
+)
+
+// VendorSpecHandler handles vendor BOM spec operations for a configuration.
+type VendorSpecHandler struct {
+	localDB       *localdb.LocalDB
+	configService *services.LocalConfigurationService
+	syncService   *syncsvc.Service // optional; nil = no server push
+}
+
+func NewVendorSpecHandler(localDB *localdb.LocalDB, syncService *syncsvc.Service) *VendorSpecHandler {
+	return &VendorSpecHandler{
+		localDB:       localDB,
+		configService: services.NewLocalConfigurationService(localDB, nil, nil, func() bool { return false }),
+		syncService:   syncService,
+	}
+}
+
+// lookupConfig finds an active configuration by UUID using the standard localDB method.
+func (h *VendorSpecHandler) lookupConfig(uuid string) (*localdb.LocalConfiguration, error) {
+	cfg, err := h.localDB.GetConfigurationByUUID(uuid)
+	if err != nil {
+		return nil, err
+	}
+	if !cfg.IsActive {
+		return nil, errors.New("not active")
+	}
+	return cfg, nil
+}
+
+// ParseText parses a pasted single-column text BOM (Inspur or Russian text BOM)
+// using the same parsers as the vendor file-import path. It is stateless: no
+// configuration is required. Returns the parsed rows and the detected format, or
+// an empty result when the text is not a recognized single-column format (the
+// client then falls back to manual column mapping).
+// POST /api/vendor-spec/parse-text
+func (h *VendorSpecHandler) ParseText(c *gin.Context) {
+	var body struct {
+		Text string `json:"text"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
+		return
+	}
+
+	rows, format := services.ParsePastedBOMText(body.Text)
+	if rows == nil {
+		rows = []localdb.VendorSpecItem{}
+	}
+	c.JSON(http.StatusOK, gin.H{"rows": rows, "format": format})
+}
+
+// GetVendorSpec returns the vendor spec (BOM) for a configuration.
+// GET /api/configs/:uuid/vendor-spec
+func (h *VendorSpecHandler) GetVendorSpec(c *gin.Context) {
+	cfg, err := h.lookupConfig(c.Param("uuid"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "configuration not found"})
+		return
+	}
+
+	spec := cfg.VendorSpec
+	if spec == nil {
+		spec = localdb.VendorSpec{}
+	}
+	c.JSON(http.StatusOK, gin.H{"vendor_spec": spec})
+}
+
+// PutVendorSpec saves (replaces) the vendor spec for a configuration.
+// PUT /api/configs/:uuid/vendor-spec
+func (h *VendorSpecHandler) PutVendorSpec(c *gin.Context) {
+	cfg, err := h.lookupConfig(c.Param("uuid"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "configuration not found"})
+		return
+	}
+
+	var body struct {
+		VendorSpec []localdb.VendorSpecItem `json:"vendor_spec"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
+		return
+	}
+
+	for i := range body.VendorSpec {
+		if body.VendorSpec[i].SortOrder == 0 {
+			body.VendorSpec[i].SortOrder = (i + 1) * 10
+		}
+		// Persist canonical LOT mapping only.
+		body.VendorSpec[i].LotMappings = normalizeLotMappings(body.VendorSpec[i].LotMappings)
+		body.VendorSpec[i].ResolvedLotName = ""
+		body.VendorSpec[i].ResolutionSource = ""
+		body.VendorSpec[i].ManualLotSuggestion = ""
+		body.VendorSpec[i].LotQtyPerPN = 0
+		body.VendorSpec[i].LotAllocations = nil
+	}
+
+	spec := localdb.VendorSpec(body.VendorSpec)
+	if _, err := h.configService.UpdateVendorSpecNoAuth(cfg.UUID, spec); err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
+	// Push manual lot mappings as suggestions to the server (best-effort, non-blocking).
+	h.pushLotSuggestions(body.VendorSpec)
+
+	c.JSON(http.StatusOK, gin.H{"vendor_spec": spec})
+}
+
+// pushLotSuggestions sends manual PN→LOT mappings to qt_vendor_partnumber_seen.lot_suggestion.
+// Errors are logged and silently dropped — they must not affect the HTTP response.
+func (h *VendorSpecHandler) pushLotSuggestions(spec []localdb.VendorSpecItem) {
+	if h.syncService == nil {
+		return
+	}
+
+	var items []syncsvc.SeenPartnumber
+	for _, row := range spec {
+		if row.VendorPartnumber == "" || len(row.LotMappings) == 0 {
+			continue
+		}
+		suggestion := make([]syncsvc.LotSuggestionEntry, 0, len(row.LotMappings))
+		for _, m := range row.LotMappings {
+			if m.LotName == "" {
+				continue
+			}
+			qty := m.QuantityPerPN
+			if qty < 1 {
+				qty = 1
+			}
+			suggestion = append(suggestion, syncsvc.LotSuggestionEntry{
+				LotName: m.LotName,
+				Qty:     qty,
+			})
+		}
+		if len(suggestion) == 0 {
+			continue
+		}
+		items = append(items, syncsvc.SeenPartnumber{
+			Partnumber:    row.VendorPartnumber,
+			Description:   row.Description,
+			LotSuggestion: suggestion,
+		})
+	}
+
+	if len(items) == 0 {
+		return
+	}
+
+	if err := h.syncService.PushPartnumberSeen(items); err != nil {
+		slog.Warn("vendor_spec: failed to push lot suggestions to server", "error", err)
+	}
+}
+
+func normalizeLotMappings(in []localdb.VendorSpecLotMapping) []localdb.VendorSpecLotMapping {
+	if len(in) == 0 {
+		return nil
+	}
+	merged := make(map[string]int, len(in))
+	order := make([]string, 0, len(in))
+	for _, m := range in {
+		lot := strings.TrimSpace(m.LotName)
+		if lot == "" {
+			continue
+		}
+		qty := m.QuantityPerPN
+		if qty < 1 {
+			qty = 1
+		}
+		if _, exists := merged[lot]; !exists {
+			order = append(order, lot)
+		}
+		merged[lot] += qty
+	}
+	out := make([]localdb.VendorSpecLotMapping, 0, len(order))
+	for _, lot := range order {
+		out = append(out, localdb.VendorSpecLotMapping{
+			LotName:       lot,
+			QuantityPerPN: merged[lot],
+		})
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+// ResolveVendorSpec resolves vendor PN → LOT without modifying the cart.
+// POST /api/configs/:uuid/vendor-spec/resolve
+func (h *VendorSpecHandler) ResolveVendorSpec(c *gin.Context) {
+	if _, err := h.lookupConfig(c.Param("uuid")); err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "configuration not found"})
+		return
+	}
+
+	var body struct {
+		VendorSpec []localdb.VendorSpecItem `json:"vendor_spec"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
+		return
+	}
+
+	bookRepo := repository.NewPartnumberBookRepository(h.localDB.DB())
+	resolver := services.NewVendorSpecResolver(bookRepo)
+
+	resolved, err := resolver.Resolve(body.VendorSpec)
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
+	book, err := bookRepo.GetActiveBook()
+	if err != nil {
+		slog.Warn("vendor spec resolve: no active partnumber book", "err", err)
+		book = nil
+	}
+	aggregated, err := services.AggregateLOTs(resolved, book, bookRepo)
+	if err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"resolved":   resolved,
+		"aggregated": aggregated,
+	})
+}
+
+// ApplyVendorSpec applies the resolved BOM to the cart (Estimate items).
+// POST /api/configs/:uuid/vendor-spec/apply
+func (h *VendorSpecHandler) ApplyVendorSpec(c *gin.Context) {
+	cfg, err := h.lookupConfig(c.Param("uuid"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "configuration not found"})
+		return
+	}
+
+	var body struct {
+		Items []struct {
+			LotName   string  `json:"lot_name"`
+			Quantity  int     `json:"quantity"`
+			UnitPrice float64 `json:"unit_price"`
+		} `json:"items"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		RespondError(c, http.StatusUnprocessableEntity, "invalid request", err)
+		return
+	}
+
+	newItems := make(localdb.LocalConfigItems, 0, len(body.Items))
+	for _, it := range body.Items {
+		newItems = append(newItems, localdb.LocalConfigItem{
+			LotName:   it.LotName,
+			Quantity:  it.Quantity,
+			UnitPrice: it.UnitPrice,
+		})
+	}
+
+	if _, err := h.configService.ApplyVendorSpecItemsNoAuth(cfg.UUID, newItems); err != nil {
+		RespondError(c, http.StatusInternalServerError, "internal server error", err)
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"items": newItems})
+}

internal/handlers/web.go

@@ -1,23 +1,24 @@
 package handlers
 
 import (
+	"fmt"
 	"html/template"
-	"os"
-	"path/filepath"
 	"strconv"
+	"strings"
 
 	qfassets "git.mchus.pro/mchus/quoteforge"
-	"git.mchus.pro/mchus/quoteforge/internal/repository"
-	"git.mchus.pro/mchus/quoteforge/internal/services"
+	"git.mchus.pro/mchus/quoteforge/internal/appmeta"
+	"git.mchus.pro/mchus/quoteforge/internal/localdb"
+	"git.mchus.pro/mchus/quoteforge/internal/models"
 	"github.com/gin-gonic/gin"
 )
 
 type WebHandler struct {
-	templates        map[string]*template.Template
-	componentService *services.ComponentService
+	templates map[string]*template.Template
+	localDB   *localdb.LocalDB
 }
 
-func NewWebHandler(templatesPath string, componentService *services.ComponentService) (*WebHandler, error) {
+func NewWebHandler(_ string, localDB *localdb.LocalDB) (*WebHandler, error) {
 	funcMap := template.FuncMap{
 		"sub": func(a, b int) int { return a - b },
 		"add": func(a, b int) int { return a + b },
@@ -60,27 +61,16 @@ func NewWebHandler(templatesPath string, componentService *services.ComponentSer
 	}
 
 	templates := make(map[string]*template.Template)
-	basePath := filepath.Join(templatesPath, "base.html")
-	useDisk := false
-	if stat, statErr := os.Stat(templatesPath); statErr == nil && stat.IsDir() {
-		useDisk = true
-	}
-
 	// Load each page template with base
-	simplePages := []string{"login.html", "configs.html", "projects.html", "project_detail.html", "pricelists.html", "pricelist_detail.html"}
+	simplePages := []string{"configs.html", "projects.html", "project_detail.html", "pricelists.html", "pricelist_detail.html", "config_revisions.html", "partnumber_books.html"}
 	for _, page := range simplePages {
-		pagePath := filepath.Join(templatesPath, page)
 		var tmpl *template.Template
 		var err error
-		if useDisk {
-			tmpl, err = template.New("").Funcs(funcMap).ParseFiles(basePath, pagePath)
-		} else {
-			tmpl, err = template.New("").Funcs(funcMap).ParseFS(
-				qfassets.TemplatesFS,
-				"web/templates/base.html",
-				"web/templates/"+page,
-			)
-		}
+		tmpl, err = template.New("").Funcs(funcMap).ParseFS(
+			qfassets.TemplatesFS,
+			"web/templates/base.html",
+			"web/templates/"+page,
+		)
 		if err != nil {
 			return nil, err
 		}
@@ -88,20 +78,14 @@ func NewWebHandler(templatesPath string, componentService *services.ComponentSer
 	}
 
 	// Index page needs components_list.html as well
-	indexPath := filepath.Join(templatesPath, "index.html")
-	componentsListPath := filepath.Join(templatesPath, "components_list.html")
 	var indexTmpl *template.Template
 	var err error
-	if useDisk {
-		indexTmpl, err = template.New("").Funcs(funcMap).ParseFiles(basePath, indexPath, componentsListPath)
-	} else {
-		indexTmpl, err = template.New("").Funcs(funcMap).ParseFS(
-			qfassets.TemplatesFS,
-			"web/templates/base.html",
-			"web/templates/index.html",
-			"web/templates/components_list.html",
-		)
-	}
+	indexTmpl, err = template.New("").Funcs(funcMap).ParseFS(
+		qfassets.TemplatesFS,
+		"web/templates/base.html",
+		"web/templates/index.html",
+		"web/templates/components_list.html",
+	)
 	if err != nil {
 		return nil, err
 	}
@@ -110,17 +94,12 @@ func NewWebHandler(templatesPath string, componentService *services.ComponentSer
 	// Load partial templates (no base needed)
 	partials := []string{"components_list.html"}
 	for _, partial := range partials {
-		partialPath := filepath.Join(templatesPath, partial)
 		var tmpl *template.Template
 		var err error
-		if useDisk {
-			tmpl, err = template.New("").Funcs(funcMap).ParseFiles(partialPath)
-		} else {
-			tmpl, err = template.New("").Funcs(funcMap).ParseFS(
-				qfassets.TemplatesFS,
-				"web/templates/"+partial,
-			)
-		}
+		tmpl, err = template.New("").Funcs(funcMap).ParseFS(
+			qfassets.TemplatesFS,
+			"web/templates/"+partial,
+		)
 		if err != nil {
 			return nil, err
 		}
@@ -128,60 +107,55 @@ func NewWebHandler(templatesPath string, componentService *services.ComponentSer
 	}
 
 	return &WebHandler{
-		templates:        templates,
-		componentService: componentService,
+		templates: templates,
+		localDB:   localDB,
 	}, nil
 }
 
 func (h *WebHandler) render(c *gin.Context, name string, data gin.H) {
+	data["AppVersion"] = appmeta.Version()
 	c.Header("Content-Type", "text/html; charset=utf-8")
 	tmpl, ok := h.templates[name]
 	if !ok {
-		c.String(500, "Template not found: %s", name)
+		_ = c.Error(fmt.Errorf("template %q not found", name))
+		c.String(500, "Template error")
 		return
 	}
 	// Execute the page template which will use base
 	if err := tmpl.ExecuteTemplate(c.Writer, name, data); err != nil {
-		c.String(500, "Template error: %v", err)
+		_ = c.Error(err)
+		c.String(500, "Template error")
 	}
 }
 
 func (h *WebHandler) Index(c *gin.Context) {
-	// Redirect to configs page - configurator is accessed via /configurator?uuid=...
-	c.Redirect(302, "/configs")
+	// Redirect to projects page - configurator is accessed via /configurator?uuid=...
+	c.Redirect(302, "/projects")
 }
 
 func (h *WebHandler) Configurator(c *gin.Context) {
-	categories, _ := h.componentService.GetCategories()
 	uuid := c.Query("uuid")
-
-	filter := repository.ComponentFilter{}
-	result, err := h.componentService.List(filter, 1, 20)
+	categories, _ := h.localCategories()
+	components, total, err := h.localDB.ListComponents(localdb.ComponentFilter{}, 0, 20)
 
 	data := gin.H{
 		"ActivePage": "configurator",
 		"Categories": categories,
-		"Components": []interface{}{},
+		"Components": []localComponentView{},
 		"Total":      int64(0),
 		"Page":       1,
 		"PerPage":    20,
 		"ConfigUUID": uuid,
 	}
 
-	if err == nil && result != nil {
-		data["Components"] = result.Components
-		data["Total"] = result.Total
-		data["Page"] = result.Page
-		data["PerPage"] = result.PerPage
+	if err == nil {
+		data["Components"] = toLocalComponentViews(components)
+		data["Total"] = total
 	}
 
 	h.render(c, "index.html", data)
 }
 
-func (h *WebHandler) Login(c *gin.Context) {
-	h.render(c, "login.html", nil)
-}
-
 func (h *WebHandler) Configs(c *gin.Context) {
 	h.render(c, "configs.html", gin.H{"ActivePage": "configs"})
 }
@@ -197,6 +171,13 @@ func (h *WebHandler) ProjectDetail(c *gin.Context) {
 	})
 }
 
+func (h *WebHandler) ConfigRevisions(c *gin.Context) {
+	h.render(c, "config_revisions.html", gin.H{
+		"ActivePage": "configs",
+		"ConfigUUID": c.Param("uuid"),
+	})
+}
+
 func (h *WebHandler) Pricelists(c *gin.Context) {
 	h.render(c, "pricelists.html", gin.H{"ActivePage": "pricelists"})
 }
@@ -205,29 +186,38 @@ func (h *WebHandler) PricelistDetail(c *gin.Context) {
 	h.render(c, "pricelist_detail.html", gin.H{"ActivePage": "pricelists"})
 }
 
+func (h *WebHandler) PartnumberBooks(c *gin.Context) {
+	h.render(c, "partnumber_books.html", gin.H{"ActivePage": "partnumber-books"})
+}
+
 // Partials for htmx
 
 func (h *WebHandler) ComponentsPartial(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	if page < 1 {
+		page = 1
+	}
 
-	filter := repository.ComponentFilter{
+	filter := localdb.ComponentFilter{
 		Category: c.Query("category"),
 		Search:   c.Query("search"),
 	}
+	if c.Query("has_price") == "true" {
+		filter.HasPrice = true
+	}
+	offset := (page - 1) * 20
 
 	data := gin.H{
-		"Components": []interface{}{},
+		"Components": []localComponentView{},
 		"Total":      int64(0),
 		"Page":       page,
 		"PerPage":    20,
 	}
 
-	result, err := h.componentService.List(filter, page, 20)
-	if err == nil && result != nil {
-		data["Components"] = result.Components
-		data["Total"] = result.Total
-		data["Page"] = result.Page
-		data["PerPage"] = result.PerPage
+	components, total, err := h.localDB.ListComponents(filter, offset, 20)
+	if err == nil {
+		data["Components"] = toLocalComponentViews(components)
+		data["Total"] = total
 	}
 
 	c.Header("Content-Type", "text/html; charset=utf-8")
@@ -235,3 +225,46 @@ func (h *WebHandler) ComponentsPartial(c *gin.Context) {
 		tmpl.ExecuteTemplate(c.Writer, "components_list.html", data)
 	}
 }
+
+type localComponentView struct {
+	LotName      string
+	Description  string
+	Category     string
+	CategoryName string
+	Model        string
+	CurrentPrice *float64
+}
+
+func toLocalComponentViews(items []localdb.LocalComponent) []localComponentView {
+	result := make([]localComponentView, 0, len(items))
+	for _, item := range items {
+		result = append(result, localComponentView{
+			LotName:      item.LotName,
+			Description:  item.LotDescription,
+			Category:     item.Category,
+			CategoryName: item.Category,
+			Model:        item.Model,
+		})
+	}
+	return result
+}
+
+func (h *WebHandler) localCategories() ([]models.Category, error) {
+	codes, err := h.localDB.GetLocalComponentCategories()
+	if err != nil || len(codes) == 0 {
+		return []models.Category{}, err
+	}
+
+	categories := make([]models.Category, 0, len(codes))
+	for _, code := range codes {
+		trimmed := strings.TrimSpace(code)
+		if trimmed == "" {
+			continue
+		}
+		categories = append(categories, models.Category{
+			Code: trimmed,
+			Name: trimmed,
+		})
+	}
+	return categories, nil
+}

internal/handlers/web_test.go

@@ -0,0 +1,47 @@
+package handlers
+
+import (
+	"errors"
+	"html/template"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestWebHandlerRenderHidesTemplateExecutionError(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	tmpl := template.Must(template.New("broken.html").Funcs(template.FuncMap{
+		"boom": func() (string, error) {
+			return "", errors.New("secret template failure")
+		},
+	}).Parse(`{{define "broken.html"}}{{boom}}{{end}}`))
+
+	handler := &WebHandler{
+		templates: map[string]*template.Template{
+			"broken.html": tmpl,
+		},
+	}
+
+	rec := httptest.NewRecorder()
+	ctx, _ := gin.CreateTestContext(rec)
+	ctx.Request = httptest.NewRequest(http.MethodGet, "/broken", nil)
+
+	handler.render(ctx, "broken.html", gin.H{})
+
+	if rec.Code != http.StatusInternalServerError {
+		t.Fatalf("expected 500, got %d", rec.Code)
+	}
+	if body := strings.TrimSpace(rec.Body.String()); body != "Template error" {
+		t.Fatalf("expected generic template error, got %q", body)
+	}
+	if len(ctx.Errors) != 1 {
+		t.Fatalf("expected logged template error, got %d", len(ctx.Errors))
+	}
+	if !strings.Contains(ctx.Errors.String(), "secret template failure") {
+		t.Fatalf("expected original error in gin context, got %q", ctx.Errors.String())
+	}
+}

internal/localdb/components.go

@@ -28,8 +28,9 @@ type ComponentSyncResult struct {
 func (l *LocalDB) SyncComponents(mariaDB *gorm.DB) (*ComponentSyncResult, error) {
 	startTime := time.Now()
 
-	// Query to join lot with qt_lot_metadata (metadata only, no pricing)
-	// Use LEFT JOIN to include lots without metadata
+	// Build the component catalog from every runtime source of LOT names.
+	// Storage lots may exist in qt_lot_metadata / qt_pricelist_items before they appear in lot,
+	// so the sync cannot start from lot alone.
 	type componentRow struct {
 		LotName        string
 		LotDescription string
@@ -40,15 +41,29 @@ func (l *LocalDB) SyncComponents(mariaDB *gorm.DB) (*ComponentSyncResult, error)
 	var rows []componentRow
 	err := mariaDB.Raw(`
 		SELECT
-			l.lot_name,
-			l.lot_description,
-			COALESCE(c.code, SUBSTRING_INDEX(l.lot_name, '_', 1)) as category,
-			m.model
-		FROM lot l
-		LEFT JOIN qt_lot_metadata m ON l.lot_name = m.lot_name
+			src.lot_name,
+			COALESCE(MAX(NULLIF(TRIM(l.lot_description), '')), '') AS lot_description,
+			COALESCE(
+				MAX(NULLIF(TRIM(c.code), '')),
+				MAX(NULLIF(TRIM(l.lot_category), '')),
+				SUBSTRING_INDEX(src.lot_name, '_', 1)
+			) AS category,
+			MAX(NULLIF(TRIM(m.model), '')) AS model
+		FROM (
+			SELECT lot_name FROM lot
+			UNION
+			SELECT lot_name FROM qt_lot_metadata
+			WHERE is_hidden = FALSE OR is_hidden IS NULL
+			UNION
+			SELECT lot_name FROM qt_pricelist_items
+		) src
+		LEFT JOIN lot l ON l.lot_name = src.lot_name
+		LEFT JOIN qt_lot_metadata m
+			ON m.lot_name = src.lot_name
+			AND (m.is_hidden = FALSE OR m.is_hidden IS NULL)
 		LEFT JOIN qt_categories c ON m.category_id = c.id
-		WHERE m.is_hidden = FALSE OR m.is_hidden IS NULL
-		ORDER BY l.lot_name
+		GROUP BY src.lot_name
+		ORDER BY src.lot_name
 	`).Scan(&rows).Error
 	if err != nil {
 		return nil, fmt.Errorf("querying components from MariaDB: %w", err)
@@ -71,18 +86,25 @@ func (l *LocalDB) SyncComponents(mariaDB *gorm.DB) (*ComponentSyncResult, error)
 		existingMap[c.LotName] = true
 	}
 
-	// Prepare components for batch insert/update
+	// Prepare components for batch insert/update.
+	// Source joins may duplicate the same lot_name, so collapse them before insert.
 	syncTime := time.Now()
 	components := make([]LocalComponent, 0, len(rows))
+	componentIndex := make(map[string]int, len(rows))
 	newCount := 0
 
 	for _, row := range rows {
+		lotName := strings.TrimSpace(row.LotName)
+		if lotName == "" {
+			continue
+		}
+
 		category := ""
 		if row.Category != nil {
-			category = *row.Category
+			category = strings.TrimSpace(*row.Category)
 		} else {
 			// Parse category from lot_name (e.g., "CPU_AMD_9654" -> "CPU")
-			parts := strings.SplitN(row.LotName, "_", 2)
+			parts := strings.SplitN(lotName, "_", 2)
 			if len(parts) >= 1 {
 				category = parts[0]
 			}
@@ -90,18 +112,34 @@ func (l *LocalDB) SyncComponents(mariaDB *gorm.DB) (*ComponentSyncResult, error)
 
 		model := ""
 		if row.Model != nil {
-			model = *row.Model
+			model = strings.TrimSpace(*row.Model)
 		}
 
 		comp := LocalComponent{
-			LotName:        row.LotName,
-			LotDescription: row.LotDescription,
+			LotName:        lotName,
+			LotDescription: strings.TrimSpace(row.LotDescription),
 			Category:       category,
 			Model:          model,
 		}
+
+		if idx, exists := componentIndex[lotName]; exists {
+			// Keep the first row, but fill any missing metadata from duplicates.
+			if components[idx].LotDescription == "" && comp.LotDescription != "" {
+				components[idx].LotDescription = comp.LotDescription
+			}
+			if components[idx].Category == "" && comp.Category != "" {
+				components[idx].Category = comp.Category
+			}
+			if components[idx].Model == "" && comp.Model != "" {
+				components[idx].Model = comp.Model
+			}
+			continue
+		}
+
+		componentIndex[lotName] = len(components)
 		components = append(components, comp)
 
-		if !existingMap[row.LotName] {
+		if !existingMap[lotName] {
 			newCount++
 		}
 	}
@@ -242,6 +280,31 @@ func (l *LocalDB) GetLocalComponent(lotName string) (*LocalComponent, error) {
 	return &component, nil
 }
 
+// GetLocalComponentCategoriesByLotNames returns category for each lot_name in the local component cache.
+// Missing lots are not included in the map; caller is responsible for strict validation.
+func (l *LocalDB) GetLocalComponentCategoriesByLotNames(lotNames []string) (map[string]string, error) {
+	result := make(map[string]string, len(lotNames))
+	if len(lotNames) == 0 {
+		return result, nil
+	}
+
+	type row struct {
+		LotName  string `gorm:"column:lot_name"`
+		Category string `gorm:"column:category"`
+	}
+	var rows []row
+	if err := l.db.Model(&LocalComponent{}).
+		Select("lot_name, category").
+		Where("lot_name IN ?", lotNames).
+		Find(&rows).Error; err != nil {
+		return nil, err
+	}
+	for _, r := range rows {
+		result[r.LotName] = r.Category
+	}
+	return result, nil
+}
+
 // GetLocalComponentCategories returns distinct categories from local components
 func (l *LocalDB) GetLocalComponentCategories() ([]string, error) {
 	var categories []string
@@ -302,4 +365,3 @@ func (l *LocalDB) NeedComponentSync(maxAgeHours int) bool {
 	}
 	return time.Since(*syncTime).Hours() > float64(maxAgeHours)
 }
-

internal/localdb/configuration_business_fields_test.go

@@ -0,0 +1,154 @@
+package localdb
+
+import (
+	"testing"
+
+	"git.mchus.pro/mchus/quoteforge/internal/models"
+)
+
+func TestConfigurationConvertersPreserveBusinessFields(t *testing.T) {
+	estimateID := uint(11)
+	warehouseID := uint(22)
+	competitorID := uint(33)
+
+	cfg := &models.Configuration{
+		UUID:                  "cfg-1",
+		OwnerUsername:         "tester",
+		Name:                  "Config",
+		PricelistID:           &estimateID,
+		WarehousePricelistID:  &warehouseID,
+		CompetitorPricelistID: &competitorID,
+		DisablePriceRefresh:   true,
+		OnlyInStock:           true,
+	}
+
+	local := ConfigurationToLocal(cfg)
+	if local.WarehousePricelistID == nil || *local.WarehousePricelistID != warehouseID {
+		t.Fatalf("warehouse pricelist lost in ConfigurationToLocal: %+v", local.WarehousePricelistID)
+	}
+	if local.CompetitorPricelistID == nil || *local.CompetitorPricelistID != competitorID {
+		t.Fatalf("competitor pricelist lost in ConfigurationToLocal: %+v", local.CompetitorPricelistID)
+	}
+	if !local.DisablePriceRefresh {
+		t.Fatalf("disable_price_refresh lost in ConfigurationToLocal")
+	}
+
+	back := LocalToConfiguration(local)
+	if back.WarehousePricelistID == nil || *back.WarehousePricelistID != warehouseID {
+		t.Fatalf("warehouse pricelist lost in LocalToConfiguration: %+v", back.WarehousePricelistID)
+	}
+	if back.CompetitorPricelistID == nil || *back.CompetitorPricelistID != competitorID {
+		t.Fatalf("competitor pricelist lost in LocalToConfiguration: %+v", back.CompetitorPricelistID)
+	}
+	if !back.DisablePriceRefresh {
+		t.Fatalf("disable_price_refresh lost in LocalToConfiguration")
+	}
+}
+
+func TestConfigurationSnapshotPreservesBusinessFields(t *testing.T) {
+	estimateID := uint(11)
+	warehouseID := uint(22)
+	competitorID := uint(33)
+
+	cfg := &LocalConfiguration{
+		UUID:                  "cfg-1",
+		Name:                  "Config",
+		PricelistID:           &estimateID,
+		WarehousePricelistID:  &warehouseID,
+		CompetitorPricelistID: &competitorID,
+		DisablePriceRefresh:   true,
+		OnlyInStock:           true,
+		VendorSpec: VendorSpec{
+			{
+				SortOrder:        10,
+				VendorPartnumber: "PN-1",
+				Quantity:         1,
+				LotMappings: []VendorSpecLotMapping{
+					{LotName: "LOT_A", QuantityPerPN: 2},
+				},
+			},
+		},
+	}
+
+	raw, err := BuildConfigurationSnapshot(cfg)
+	if err != nil {
+		t.Fatalf("BuildConfigurationSnapshot: %v", err)
+	}
+
+	decoded, err := DecodeConfigurationSnapshot(raw)
+	if err != nil {
+		t.Fatalf("DecodeConfigurationSnapshot: %v", err)
+	}
+	if decoded.WarehousePricelistID == nil || *decoded.WarehousePricelistID != warehouseID {
+		t.Fatalf("warehouse pricelist lost in snapshot: %+v", decoded.WarehousePricelistID)
+	}
+	if decoded.CompetitorPricelistID == nil || *decoded.CompetitorPricelistID != competitorID {
+		t.Fatalf("competitor pricelist lost in snapshot: %+v", decoded.CompetitorPricelistID)
+	}
+	if !decoded.DisablePriceRefresh {
+		t.Fatalf("disable_price_refresh lost in snapshot")
+	}
+	if len(decoded.VendorSpec) != 1 || decoded.VendorSpec[0].VendorPartnumber != "PN-1" {
+		t.Fatalf("vendor_spec lost in snapshot: %+v", decoded.VendorSpec)
+	}
+	if len(decoded.VendorSpec[0].LotMappings) != 1 || decoded.VendorSpec[0].LotMappings[0].LotName != "LOT_A" {
+		t.Fatalf("lot mappings lost in snapshot: %+v", decoded.VendorSpec)
+	}
+}
+
+func TestConfigurationFingerprintIncludesPricingSelectorsAndVendorSpec(t *testing.T) {
+	estimateID := uint(11)
+	warehouseID := uint(22)
+	competitorID := uint(33)
+
+	base := &LocalConfiguration{
+		UUID:                  "cfg-1",
+		Name:                  "Config",
+		ServerCount:           1,
+		Items:                 LocalConfigItems{{LotName: "LOT_A", Quantity: 1, UnitPrice: 100}},
+		PricelistID:           &estimateID,
+		WarehousePricelistID:  &warehouseID,
+		CompetitorPricelistID: &competitorID,
+		DisablePriceRefresh:   true,
+		OnlyInStock:           true,
+		VendorSpec: VendorSpec{
+			{
+				SortOrder:        10,
+				VendorPartnumber: "PN-1",
+				Quantity:         1,
+			},
+		},
+	}
+
+	baseFingerprint, err := BuildConfigurationSpecPriceFingerprint(base)
+	if err != nil {
+		t.Fatalf("base fingerprint: %v", err)
+	}
+
+	changedPricelist := *base
+	newEstimateID := uint(44)
+	changedPricelist.PricelistID = &newEstimateID
+	pricelistFingerprint, err := BuildConfigurationSpecPriceFingerprint(&changedPricelist)
+	if err != nil {
+		t.Fatalf("pricelist fingerprint: %v", err)
+	}
+	if pricelistFingerprint == baseFingerprint {
+		t.Fatalf("expected pricelist selector to affect fingerprint")
+	}
+
+	changedVendorSpec := *base
+	changedVendorSpec.VendorSpec = VendorSpec{
+		{
+			SortOrder:        10,
+			VendorPartnumber: "PN-2",
+			Quantity:         1,
+		},
+	}
+	vendorFingerprint, err := BuildConfigurationSpecPriceFingerprint(&changedVendorSpec)
+	if err != nil {
+		t.Fatalf("vendor fingerprint: %v", err)
+	}
+	if vendorFingerprint == baseFingerprint {
+		t.Fatalf("expected vendor spec to affect fingerprint")
+	}
+}

internal/localdb/converters.go

@@ -18,31 +18,33 @@ func ConfigurationToLocal(cfg *models.Configuration) *LocalConfiguration {
 	}
 
 	local := &LocalConfiguration{
-		UUID:             cfg.UUID,
-		ProjectUUID:      cfg.ProjectUUID,
-		IsActive:         true,
-		Name:             cfg.Name,
-		Items:            items,
-		TotalPrice:       cfg.TotalPrice,
-		CustomPrice:      cfg.CustomPrice,
-		Notes:            cfg.Notes,
-		IsTemplate:       cfg.IsTemplate,
-		ServerCount:      cfg.ServerCount,
-		ServerModel:      cfg.ServerModel,
-		SupportCode:      cfg.SupportCode,
-		Article:          cfg.Article,
-		PricelistID:      cfg.PricelistID,
-		OnlyInStock:      cfg.OnlyInStock,
-		PriceUpdatedAt:   cfg.PriceUpdatedAt,
-		CreatedAt:        cfg.CreatedAt,
-		UpdatedAt:        time.Now(),
-		SyncStatus:       "pending",
-		OriginalUserID:   derefUint(cfg.UserID),
-		OriginalUsername: cfg.OwnerUsername,
-	}
-
-	if local.OriginalUsername == "" && cfg.User != nil {
-		local.OriginalUsername = cfg.User.Username
+		UUID:                  cfg.UUID,
+		ProjectUUID:           cfg.ProjectUUID,
+		IsActive:              true,
+		Name:                  cfg.Name,
+		Items:                 items,
+		TotalPrice:            cfg.TotalPrice,
+		CustomPrice:           cfg.CustomPrice,
+		Notes:                 cfg.Notes,
+		IsTemplate:            cfg.IsTemplate,
+		ServerCount:           cfg.ServerCount,
+		ServerModel:           cfg.ServerModel,
+		SupportCode:           cfg.SupportCode,
+		Article:               cfg.Article,
+		PricelistID:           cfg.PricelistID,
+		WarehousePricelistID:  cfg.WarehousePricelistID,
+		CompetitorPricelistID: cfg.CompetitorPricelistID,
+		ConfigType:            cfg.ConfigType,
+		VendorSpec:            modelVendorSpecToLocal(cfg.VendorSpec),
+		DisablePriceRefresh:   cfg.DisablePriceRefresh,
+		OnlyInStock:           cfg.OnlyInStock,
+		Line:                  cfg.Line,
+		PriceUpdatedAt:        cfg.PriceUpdatedAt,
+		CreatedAt:             cfg.CreatedAt,
+		UpdatedAt:             time.Now(),
+		SyncStatus:            "pending",
+		OriginalUserID:        derefUint(cfg.UserID),
+		OriginalUsername:      cfg.OwnerUsername,
 	}
 
 	if cfg.ID > 0 {
@@ -65,23 +67,29 @@ func LocalToConfiguration(local *LocalConfiguration) *models.Configuration {
 	}
 
 	cfg := &models.Configuration{
-		UUID:           local.UUID,
-		OwnerUsername:  local.OriginalUsername,
-		ProjectUUID:    local.ProjectUUID,
-		Name:           local.Name,
-		Items:          items,
-		TotalPrice:     local.TotalPrice,
-		CustomPrice:    local.CustomPrice,
-		Notes:          local.Notes,
-		IsTemplate:     local.IsTemplate,
-		ServerCount:    local.ServerCount,
-		ServerModel:    local.ServerModel,
-		SupportCode:    local.SupportCode,
-		Article:        local.Article,
-		PricelistID:    local.PricelistID,
-		OnlyInStock:    local.OnlyInStock,
-		PriceUpdatedAt: local.PriceUpdatedAt,
-		CreatedAt:      local.CreatedAt,
+		UUID:                  local.UUID,
+		OwnerUsername:         local.OriginalUsername,
+		ProjectUUID:           local.ProjectUUID,
+		Name:                  local.Name,
+		Items:                 items,
+		TotalPrice:            local.TotalPrice,
+		CustomPrice:           local.CustomPrice,
+		Notes:                 local.Notes,
+		IsTemplate:            local.IsTemplate,
+		ServerCount:           local.ServerCount,
+		ServerModel:           local.ServerModel,
+		SupportCode:           local.SupportCode,
+		Article:               local.Article,
+		PricelistID:           local.PricelistID,
+		WarehousePricelistID:  local.WarehousePricelistID,
+		CompetitorPricelistID: local.CompetitorPricelistID,
+		ConfigType:            local.ConfigType,
+		VendorSpec:            localVendorSpecToModel(local.VendorSpec),
+		DisablePriceRefresh:   local.DisablePriceRefresh,
+		OnlyInStock:           local.OnlyInStock,
+		Line:                  local.Line,
+		PriceUpdatedAt:        local.PriceUpdatedAt,
+		CreatedAt:             local.CreatedAt,
 	}
 
 	if local.ServerID != nil {
@@ -91,6 +99,9 @@ func LocalToConfiguration(local *LocalConfiguration) *models.Configuration {
 		userID := local.OriginalUserID
 		cfg.UserID = &userID
 	}
+	if local.CurrentVersion != nil {
+		cfg.CurrentVersionNo = local.CurrentVersion.VersionNo
+	}
 
 	return cfg
 }
@@ -102,10 +113,94 @@ func derefUint(v *uint) uint {
 	return *v
 }
 
+func modelVendorSpecToLocal(spec models.VendorSpec) VendorSpec {
+	if len(spec) == 0 {
+		return nil
+	}
+	out := make(VendorSpec, 0, len(spec))
+	for _, item := range spec {
+		row := VendorSpecItem{
+			SortOrder:           item.SortOrder,
+			VendorPartnumber:    item.VendorPartnumber,
+			Quantity:            item.Quantity,
+			Description:         item.Description,
+			UnitPrice:           item.UnitPrice,
+			TotalPrice:          item.TotalPrice,
+			ResolvedLotName:     item.ResolvedLotName,
+			ResolutionSource:    item.ResolutionSource,
+			ManualLotSuggestion: item.ManualLotSuggestion,
+			LotQtyPerPN:         item.LotQtyPerPN,
+		}
+		if len(item.LotAllocations) > 0 {
+			row.LotAllocations = make([]VendorSpecLotAllocation, 0, len(item.LotAllocations))
+			for _, alloc := range item.LotAllocations {
+				row.LotAllocations = append(row.LotAllocations, VendorSpecLotAllocation{
+					LotName:  alloc.LotName,
+					Quantity: alloc.Quantity,
+				})
+			}
+		}
+		if len(item.LotMappings) > 0 {
+			row.LotMappings = make([]VendorSpecLotMapping, 0, len(item.LotMappings))
+			for _, mapping := range item.LotMappings {
+				row.LotMappings = append(row.LotMappings, VendorSpecLotMapping{
+					LotName:       mapping.LotName,
+					QuantityPerPN: mapping.QuantityPerPN,
+				})
+			}
+		}
+		out = append(out, row)
+	}
+	return out
+}
+
+func localVendorSpecToModel(spec VendorSpec) models.VendorSpec {
+	if len(spec) == 0 {
+		return nil
+	}
+	out := make(models.VendorSpec, 0, len(spec))
+	for _, item := range spec {
+		row := models.VendorSpecItem{
+			SortOrder:           item.SortOrder,
+			VendorPartnumber:    item.VendorPartnumber,
+			Quantity:            item.Quantity,
+			Description:         item.Description,
+			UnitPrice:           item.UnitPrice,
+			TotalPrice:          item.TotalPrice,
+			ResolvedLotName:     item.ResolvedLotName,
+			ResolutionSource:    item.ResolutionSource,
+			ManualLotSuggestion: item.ManualLotSuggestion,
+			LotQtyPerPN:         item.LotQtyPerPN,
+		}
+		if len(item.LotAllocations) > 0 {
+			row.LotAllocations = make([]models.VendorSpecLotAllocation, 0, len(item.LotAllocations))
+			for _, alloc := range item.LotAllocations {
+				row.LotAllocations = append(row.LotAllocations, models.VendorSpecLotAllocation{
+					LotName:  alloc.LotName,
+					Quantity: alloc.Quantity,
+				})
+			}
+		}
+		if len(item.LotMappings) > 0 {
+			row.LotMappings = make([]models.VendorSpecLotMapping, 0, len(item.LotMappings))
+			for _, mapping := range item.LotMappings {
+				row.LotMappings = append(row.LotMappings, models.VendorSpecLotMapping{
+					LotName:       mapping.LotName,
+					QuantityPerPN: mapping.QuantityPerPN,
+				})
+			}
+		}
+		out = append(out, row)
+	}
+	return out
+}
+
 func ProjectToLocal(project *models.Project) *LocalProject {
 	local := &LocalProject{
 		UUID:          project.UUID,
 		OwnerUsername: project.OwnerUsername,
+		Code:          project.Code,
+		Variant:       project.Variant,
 		Name:          project.Name,
 		TrackerURL:    project.TrackerURL,
 		IsActive:      project.IsActive,
@@ -125,6 +220,8 @@ func LocalToProject(local *LocalProject) *models.Project {
 	project := &models.Project{
 		UUID:          local.UUID,
 		OwnerUsername: local.OwnerUsername,
+		Code:          local.Code,
+		Variant:       local.Variant,
 		Name:          local.Name,
 		TrackerURL:    local.TrackerURL,
 		IsActive:      local.IsActive,

internal/localdb/encryption.go

@@ -7,19 +7,104 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"errors"
+	"fmt"
 	"io"
 	"os"
+	"path/filepath"
+	"strings"
+
+	"git.mchus.pro/mchus/quoteforge/internal/appstate"
 )
 
-// getEncryptionKey derives a 32-byte key from environment variable or machine ID
-func getEncryptionKey() []byte {
+const encryptionKeyFileName = "local_encryption.key"
+
+// getEncryptionKey resolves the active encryption key.
+// Preference order:
+// 1. QUOTEFORGE_ENCRYPTION_KEY env var
+// 2. application-managed random key file in the user state directory
+func getEncryptionKey() ([]byte, error) {
 	key := os.Getenv("QUOTEFORGE_ENCRYPTION_KEY")
-	if key == "" {
-		// Fallback to a machine-based key (hostname + fixed salt)
-		hostname, _ := os.Hostname()
-		key = hostname + "quoteforge-salt-2024"
+	if key != "" {
+		hash := sha256.Sum256([]byte(key))
+		return hash[:], nil
 	}
-	// Hash to get exactly 32 bytes for AES-256
+
+	stateDir, err := resolveEncryptionStateDir()
+	if err != nil {
+		return nil, fmt.Errorf("resolve encryption state dir: %w", err)
+	}
+
+	return loadOrCreateEncryptionKey(filepath.Join(stateDir, encryptionKeyFileName))
+}
+
+func resolveEncryptionStateDir() (string, error) {
+	configPath, err := appstate.ResolveConfigPath("")
+	if err != nil {
+		return "", err
+	}
+	return filepath.Dir(configPath), nil
+}
+
+func loadOrCreateEncryptionKey(path string) ([]byte, error) {
+	if data, err := os.ReadFile(path); err == nil {
+		return parseEncryptionKeyFile(data)
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return nil, fmt.Errorf("read encryption key: %w", err)
+	}
+
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return nil, fmt.Errorf("create encryption key dir: %w", err)
+	}
+
+	raw := make([]byte, 32)
+	if _, err := io.ReadFull(rand.Reader, raw); err != nil {
+		return nil, fmt.Errorf("generate encryption key: %w", err)
+	}
+
+	encoded := base64.StdEncoding.EncodeToString(raw)
+	if err := writeKeyFile(path, []byte(encoded+"\n")); err != nil {
+		if errors.Is(err, os.ErrExist) {
+			data, readErr := os.ReadFile(path)
+			if readErr != nil {
+				return nil, fmt.Errorf("read concurrent encryption key: %w", readErr)
+			}
+			return parseEncryptionKeyFile(data)
+		}
+		return nil, err
+	}
+
+	return raw, nil
+}
+
+func writeKeyFile(path string, data []byte) error {
+	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+
+	if _, err := file.Write(data); err != nil {
+		return err
+	}
+
+	return file.Sync()
+}
+
+func parseEncryptionKeyFile(data []byte) ([]byte, error) {
+	trimmed := strings.TrimSpace(string(data))
+	decoded, err := base64.StdEncoding.DecodeString(trimmed)
+	if err != nil {
+		return nil, fmt.Errorf("decode encryption key file: %w", err)
+	}
+	if len(decoded) != 32 {
+		return nil, fmt.Errorf("invalid encryption key length: %d", len(decoded))
+	}
+	return decoded, nil
+}
+
+func getLegacyEncryptionKey() []byte {
+	hostname, _ := os.Hostname()
+	key := hostname + "quoteforge-salt-2024"
 	hash := sha256.Sum256([]byte(key))
 	return hash[:]
 }
@@ -30,7 +115,10 @@ func Encrypt(plaintext string) (string, error) {
 		return "", nil
 	}
 
-	key := getEncryptionKey()
+	key, err := getEncryptionKey()
+	if err != nil {
+		return "", err
+	}
 	block, err := aes.NewCipher(key)
 	if err != nil {
 		return "", err
@@ -56,12 +144,50 @@ func Decrypt(ciphertext string) (string, error) {
 		return "", nil
 	}
 
-	key := getEncryptionKey()
-	data, err := base64.StdEncoding.DecodeString(ciphertext)
+	key, err := getEncryptionKey()
 	if err != nil {
 		return "", err
 	}
+	plaintext, legacy, err := decryptWithKeys(ciphertext, key, getLegacyEncryptionKey())
+	if err != nil {
+		return "", err
+	}
+	_ = legacy
+	return plaintext, nil
+}
 
+func DecryptWithMetadata(ciphertext string) (string, bool, error) {
+	if ciphertext == "" {
+		return "", false, nil
+	}
+
+	key, err := getEncryptionKey()
+	if err != nil {
+		return "", false, err
+	}
+	return decryptWithKeys(ciphertext, key, getLegacyEncryptionKey())
+}
+
+func decryptWithKeys(ciphertext string, primaryKey, legacyKey []byte) (string, bool, error) {
+	data, err := base64.StdEncoding.DecodeString(ciphertext)
+	if err != nil {
+		return "", false, err
+	}
+
+	plaintext, err := decryptWithKey(data, primaryKey)
+	if err == nil {
+		return plaintext, false, nil
+	}
+
+	legacyPlaintext, legacyErr := decryptWithKey(data, legacyKey)
+	if legacyErr == nil {
+		return legacyPlaintext, true, nil
+	}
+
+	return "", false, err
+}
+
+func decryptWithKey(data, key []byte) (string, error) {
 	block, err := aes.NewCipher(key)
 	if err != nil {
 		return "", err

internal/localdb/encryption_test.go

@@ -0,0 +1,97 @@
+package localdb
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestEncryptCreatesPersistentKeyFile(t *testing.T) {
+	stateDir := t.TempDir()
+	t.Setenv("QFS_STATE_DIR", stateDir)
+	t.Setenv("QUOTEFORGE_ENCRYPTION_KEY", "")
+
+	ciphertext, err := Encrypt("secret-password")
+	if err != nil {
+		t.Fatalf("encrypt: %v", err)
+	}
+	if ciphertext == "" {
+		t.Fatal("expected ciphertext")
+	}
+
+	keyPath := filepath.Join(stateDir, encryptionKeyFileName)
+	info, err := os.Stat(keyPath)
+	if err != nil {
+		t.Fatalf("stat key file: %v", err)
+	}
+	if info.Mode().Perm() != 0600 {
+		t.Fatalf("expected 0600 key file, got %v", info.Mode().Perm())
+	}
+}
+
+func TestDecryptMigratesLegacyCiphertext(t *testing.T) {
+	stateDir := t.TempDir()
+	t.Setenv("QFS_STATE_DIR", stateDir)
+	t.Setenv("QUOTEFORGE_ENCRYPTION_KEY", "")
+
+	legacyCiphertext := encryptWithKeyForTest(t, getLegacyEncryptionKey(), "legacy-password")
+
+	plaintext, migrated, err := DecryptWithMetadata(legacyCiphertext)
+	if err != nil {
+		t.Fatalf("decrypt legacy: %v", err)
+	}
+	if plaintext != "legacy-password" {
+		t.Fatalf("unexpected plaintext: %q", plaintext)
+	}
+	if !migrated {
+		t.Fatal("expected legacy ciphertext to require migration")
+	}
+
+	currentCiphertext, err := Encrypt("legacy-password")
+	if err != nil {
+		t.Fatalf("encrypt current: %v", err)
+	}
+	plaintext, migrated, err = DecryptWithMetadata(currentCiphertext)
+	if err != nil {
+		t.Fatalf("decrypt current: %v", err)
+	}
+	if migrated {
+		t.Fatal("did not expect current ciphertext to require migration")
+	}
+}
+
+func encryptWithKeyForTest(t *testing.T, key []byte, plaintext string) string {
+	t.Helper()
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		t.Fatalf("new cipher: %v", err)
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		t.Fatalf("new gcm: %v", err)
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		t.Fatalf("read nonce: %v", err)
+	}
+
+	ciphertext := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
+	return base64.StdEncoding.EncodeToString(ciphertext)
+}
+
+func TestLegacyEncryptionKeyRemainsDeterministic(t *testing.T) {
+	hostname, _ := os.Hostname()
+	expected := sha256.Sum256([]byte(hostname + "quoteforge-salt-2024"))
+	actual := getLegacyEncryptionKey()
+	if string(actual) != string(expected[:]) {
+		t.Fatal("legacy key derivation changed")
+	}
+}

internal/localdb/local_migrations_test.go

@@ -4,6 +4,11 @@ import (
 	"path/filepath"
 	"testing"
 	"time"
+
+	"github.com/glebarez/sqlite"
+	"github.com/google/uuid"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
 )
 
 func TestRunLocalMigrationsBackfillsExistingConfigurations(t *testing.T) {
@@ -125,3 +130,466 @@ func TestRunLocalMigrationsFixesPricelistVersionUniqueIndex(t *testing.T) {
 		t.Fatalf("expected 2 pricelists, got %d", count)
 	}
 }
+
+func TestRunLocalMigrationsDeduplicatesConfigurationVersionsBySpecAndPrice(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "versions_dedup.db")
+
+	local, err := New(dbPath)
+	if err != nil {
+		t.Fatalf("open localdb: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	cfg := &LocalConfiguration{
+		UUID:             "dedup-cfg",
+		Name:             "Dedup",
+		Items:            LocalConfigItems{{LotName: "CPU_A", Quantity: 1, UnitPrice: 100}},
+		ServerCount:      1,
+		SyncStatus:       "pending",
+		OriginalUsername: "tester",
+		IsActive:         true,
+	}
+	if err := local.SaveConfiguration(cfg); err != nil {
+		t.Fatalf("save seed config: %v", err)
+	}
+
+	baseV1Data, err := BuildConfigurationSnapshot(cfg)
+	if err != nil {
+		t.Fatalf("build v1 snapshot: %v", err)
+	}
+	baseV1 := LocalConfigurationVersion{
+		ID:                uuid.NewString(),
+		ConfigurationUUID: cfg.UUID,
+		VersionNo:         1,
+		Data:              baseV1Data,
+		AppVersion:        "test",
+		CreatedAt:         time.Now(),
+	}
+	if err := local.DB().Create(&baseV1).Error; err != nil {
+		t.Fatalf("insert base v1: %v", err)
+	}
+	if err := local.DB().Model(&LocalConfiguration{}).
+		Where("uuid = ?", cfg.UUID).
+		Update("current_version_id", baseV1.ID).Error; err != nil {
+		t.Fatalf("set current_version_id to v1: %v", err)
+	}
+
+	v2 := LocalConfigurationVersion{
+		ID:                uuid.NewString(),
+		ConfigurationUUID: cfg.UUID,
+		VersionNo:         2,
+		Data:              baseV1.Data,
+		AppVersion:        "test",
+		CreatedAt:         time.Now().Add(1 * time.Second),
+	}
+	if err := local.DB().Create(&v2).Error; err != nil {
+		t.Fatalf("insert duplicate v2: %v", err)
+	}
+
+	modified := *cfg
+	modified.Items = LocalConfigItems{{LotName: "CPU_A", Quantity: 2, UnitPrice: 100}}
+	total := modified.Items.Total()
+	modified.TotalPrice = &total
+	modified.UpdatedAt = time.Now()
+	v3Data, err := BuildConfigurationSnapshot(&modified)
+	if err != nil {
+		t.Fatalf("build v3 snapshot: %v", err)
+	}
+
+	v3 := LocalConfigurationVersion{
+		ID:                uuid.NewString(),
+		ConfigurationUUID: cfg.UUID,
+		VersionNo:         3,
+		Data:              v3Data,
+		AppVersion:        "test",
+		CreatedAt:         time.Now().Add(2 * time.Second),
+	}
+	if err := local.DB().Create(&v3).Error; err != nil {
+		t.Fatalf("insert v3: %v", err)
+	}
+
+	v4 := LocalConfigurationVersion{
+		ID:                uuid.NewString(),
+		ConfigurationUUID: cfg.UUID,
+		VersionNo:         4,
+		Data:              v3Data,
+		AppVersion:        "test",
+		CreatedAt:         time.Now().Add(3 * time.Second),
+	}
+	if err := local.DB().Create(&v4).Error; err != nil {
+		t.Fatalf("insert duplicate v4: %v", err)
+	}
+
+	if err := local.DB().Model(&LocalConfiguration{}).
+		Where("uuid = ?", cfg.UUID).
+		Update("current_version_id", v4.ID).Error; err != nil {
+		t.Fatalf("point current_version_id to duplicate v4: %v", err)
+	}
+
+	if err := local.DB().Where("id = ?", "2026_02_19_configuration_versions_dedup_spec_price").
+		Delete(&LocalSchemaMigration{}).Error; err != nil {
+		t.Fatalf("delete dedup migration record: %v", err)
+	}
+
+	if err := runLocalMigrations(local.DB()); err != nil {
+		t.Fatalf("rerun local migrations: %v", err)
+	}
+
+	var versions []LocalConfigurationVersion
+	if err := local.DB().Where("configuration_uuid = ?", cfg.UUID).
+		Order("version_no ASC").
+		Find(&versions).Error; err != nil {
+		t.Fatalf("load versions after dedup: %v", err)
+	}
+	if len(versions) != 2 {
+		t.Fatalf("expected 2 versions after dedup, got %d", len(versions))
+	}
+	if versions[0].VersionNo != 1 || versions[1].VersionNo != 3 {
+		t.Fatalf("expected kept version numbers [1,3], got [%d,%d]", versions[0].VersionNo, versions[1].VersionNo)
+	}
+
+	var after LocalConfiguration
+	if err := local.DB().Where("uuid = ?", cfg.UUID).First(&after).Error; err != nil {
+		t.Fatalf("load config after dedup: %v", err)
+	}
+	if after.CurrentVersionID == nil || *after.CurrentVersionID != v3.ID {
+		t.Fatalf("expected current_version_id to point to kept latest version v3")
+	}
+}
+
+func TestRunLocalMigrationsBackfillsConfigurationLineNo(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "line_no_backfill.db")
+
+	local, err := New(dbPath)
+	if err != nil {
+		t.Fatalf("open localdb: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	projectUUID := "project-line"
+	cfg1 := &LocalConfiguration{
+		UUID:             "line-cfg-1",
+		ProjectUUID:      &projectUUID,
+		Name:             "Cfg 1",
+		Items:            LocalConfigItems{},
+		SyncStatus:       "pending",
+		OriginalUsername: "tester",
+		IsActive:         true,
+		CreatedAt:        time.Now().Add(-2 * time.Hour),
+	}
+	cfg2 := &LocalConfiguration{
+		UUID:             "line-cfg-2",
+		ProjectUUID:      &projectUUID,
+		Name:             "Cfg 2",
+		Items:            LocalConfigItems{},
+		SyncStatus:       "pending",
+		OriginalUsername: "tester",
+		IsActive:         true,
+		CreatedAt:        time.Now().Add(-1 * time.Hour),
+	}
+	if err := local.SaveConfiguration(cfg1); err != nil {
+		t.Fatalf("save cfg1: %v", err)
+	}
+	if err := local.SaveConfiguration(cfg2); err != nil {
+		t.Fatalf("save cfg2: %v", err)
+	}
+
+	if err := local.DB().Model(&LocalConfiguration{}).Where("uuid IN ?", []string{cfg1.UUID, cfg2.UUID}).Update("line_no", 0).Error; err != nil {
+		t.Fatalf("reset line_no: %v", err)
+	}
+	if err := local.DB().Where("id = ?", "2026_02_19_local_config_line_no").Delete(&LocalSchemaMigration{}).Error; err != nil {
+		t.Fatalf("delete migration record: %v", err)
+	}
+
+	if err := runLocalMigrations(local.DB()); err != nil {
+		t.Fatalf("rerun local migrations: %v", err)
+	}
+
+	var rows []LocalConfiguration
+	if err := local.DB().Where("uuid IN ?", []string{cfg1.UUID, cfg2.UUID}).Order("created_at ASC").Find(&rows).Error; err != nil {
+		t.Fatalf("load configurations: %v", err)
+	}
+	if len(rows) != 2 {
+		t.Fatalf("expected 2 configurations, got %d", len(rows))
+	}
+	if rows[0].Line != 10 || rows[1].Line != 20 {
+		t.Fatalf("expected line_no [10,20], got [%d,%d]", rows[0].Line, rows[1].Line)
+	}
+}
+
+func TestRunLocalMigrationsDeduplicatesCanonicalPartnumberCatalog(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "partnumber_catalog_dedup.db")
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+
+	firstLots := LocalPartnumberBookLots{
+		{LotName: "LOT-A", Qty: 1},
+	}
+	secondLots := LocalPartnumberBookLots{
+		{LotName: "LOT-B", Qty: 2},
+	}
+
+	if err := db.Exec(`
+		CREATE TABLE local_partnumber_book_items (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			partnumber TEXT NOT NULL,
+			lots_json TEXT NOT NULL,
+			description TEXT
+		)
+	`).Error; err != nil {
+		t.Fatalf("create dirty local_partnumber_book_items: %v", err)
+	}
+
+	if err := db.Create(&LocalPartnumberBookItem{
+		Partnumber:  "PN-001",
+		LotsJSON:    firstLots,
+		Description: "",
+	}).Error; err != nil {
+		t.Fatalf("insert first duplicate row: %v", err)
+	}
+	if err := db.Create(&LocalPartnumberBookItem{
+		Partnumber:  "PN-001",
+		LotsJSON:    secondLots,
+		Description: "Canonical description",
+	}).Error; err != nil {
+		t.Fatalf("insert second duplicate row: %v", err)
+	}
+
+	if err := migrateLocalPartnumberBookCatalog(db); err != nil {
+		t.Fatalf("migrate local partnumber catalog: %v", err)
+	}
+
+	var items []LocalPartnumberBookItem
+	if err := db.Order("partnumber ASC").Find(&items).Error; err != nil {
+		t.Fatalf("load migrated partnumber items: %v", err)
+	}
+	if len(items) != 1 {
+		t.Fatalf("expected 1 deduplicated item, got %d", len(items))
+	}
+	if items[0].Partnumber != "PN-001" {
+		t.Fatalf("unexpected partnumber: %s", items[0].Partnumber)
+	}
+	if items[0].Description != "Canonical description" {
+		t.Fatalf("expected merged description, got %q", items[0].Description)
+	}
+	if len(items[0].LotsJSON) != 2 {
+		t.Fatalf("expected merged lots from duplicates, got %d", len(items[0].LotsJSON))
+	}
+
+	var duplicateCount int64
+	if err := db.Model(&LocalPartnumberBookItem{}).
+		Where("partnumber = ?", "PN-001").
+		Count(&duplicateCount).Error; err != nil {
+		t.Fatalf("count deduplicated partnumber: %v", err)
+	}
+	if duplicateCount != 1 {
+		t.Fatalf("expected unique partnumber row after migration, got %d", duplicateCount)
+	}
+}
+
+func TestSanitizeLocalPartnumberBookCatalogRemovesRowsWithoutPartnumber(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "sanitize_partnumber_catalog.db")
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+
+	if err := db.Exec(`
+		CREATE TABLE local_partnumber_book_items (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			partnumber TEXT NULL,
+			lots_json TEXT NOT NULL,
+			description TEXT
+		)
+	`).Error; err != nil {
+		t.Fatalf("create local_partnumber_book_items: %v", err)
+	}
+	if err := db.Exec(`
+		INSERT INTO local_partnumber_book_items (partnumber, lots_json, description) VALUES
+		(NULL, '[]', 'null pn'),
+		('', '[]', 'empty pn'),
+		('PN-OK', '[]', 'valid pn')
+	`).Error; err != nil {
+		t.Fatalf("seed local_partnumber_book_items: %v", err)
+	}
+
+	if err := sanitizeLocalPartnumberBookCatalog(db); err != nil {
+		t.Fatalf("sanitize local partnumber catalog: %v", err)
+	}
+
+	var items []LocalPartnumberBookItem
+	if err := db.Order("id ASC").Find(&items).Error; err != nil {
+		t.Fatalf("load sanitized items: %v", err)
+	}
+	if len(items) != 1 {
+		t.Fatalf("expected 1 valid item after sanitize, got %d", len(items))
+	}
+	if items[0].Partnumber != "PN-OK" {
+		t.Fatalf("expected remaining partnumber PN-OK, got %q", items[0].Partnumber)
+	}
+}
+
+func TestNewMigratesLegacyPartnumberBookCatalogBeforeAutoMigrate(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "legacy_partnumber_catalog.db")
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+
+	if err := db.Exec(`
+		CREATE TABLE local_partnumber_book_items (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			partnumber TEXT NOT NULL UNIQUE,
+			lots_json TEXT NOT NULL,
+			is_primary_pn INTEGER NOT NULL DEFAULT 0,
+			description TEXT
+		)
+	`).Error; err != nil {
+		t.Fatalf("create legacy local_partnumber_book_items: %v", err)
+	}
+	if err := db.Exec(`
+		INSERT INTO local_partnumber_book_items (partnumber, lots_json, is_primary_pn, description)
+		VALUES ('PN-001', '[{"lot_name":"CPU_A","qty":1}]', 0, 'Legacy row')
+	`).Error; err != nil {
+		t.Fatalf("seed legacy local_partnumber_book_items: %v", err)
+	}
+
+	local, err := New(dbPath)
+	if err != nil {
+		t.Fatalf("open localdb with legacy catalog: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	var columns []struct {
+		Name string `gorm:"column:name"`
+	}
+	if err := local.DB().Raw(`SELECT name FROM pragma_table_info('local_partnumber_book_items')`).Scan(&columns).Error; err != nil {
+		t.Fatalf("load local_partnumber_book_items columns: %v", err)
+	}
+	for _, column := range columns {
+		if column.Name == "is_primary_pn" {
+			t.Fatalf("expected legacy is_primary_pn column to be removed before automigrate")
+		}
+	}
+
+	var items []LocalPartnumberBookItem
+	if err := local.DB().Find(&items).Error; err != nil {
+		t.Fatalf("load migrated local_partnumber_book_items: %v", err)
+	}
+	if len(items) != 1 || items[0].Partnumber != "PN-001" {
+		t.Fatalf("unexpected migrated rows: %#v", items)
+	}
+}
+
+func TestNewRecoversBrokenPartnumberBookCatalogCache(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "broken_partnumber_catalog.db")
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+
+	if err := db.Exec(`
+		CREATE TABLE local_partnumber_book_items (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			partnumber TEXT NOT NULL UNIQUE,
+			lots_json TEXT NOT NULL,
+			description TEXT
+		)
+	`).Error; err != nil {
+		t.Fatalf("create broken local_partnumber_book_items: %v", err)
+	}
+	if err := db.Exec(`
+		INSERT INTO local_partnumber_book_items (partnumber, lots_json, description)
+		VALUES ('PN-001', '{not-json}', 'Broken cache row')
+	`).Error; err != nil {
+		t.Fatalf("seed broken local_partnumber_book_items: %v", err)
+	}
+
+	local, err := New(dbPath)
+	if err != nil {
+		t.Fatalf("open localdb with broken catalog cache: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	var count int64
+	if err := local.DB().Model(&LocalPartnumberBookItem{}).Count(&count).Error; err != nil {
+		t.Fatalf("count recovered local_partnumber_book_items: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("expected empty recovered local_partnumber_book_items, got %d rows", count)
+	}
+
+	var quarantineTables []struct {
+		Name string `gorm:"column:name"`
+	}
+	if err := local.DB().Raw(`
+		SELECT name
+		FROM sqlite_master
+		WHERE type = 'table' AND name LIKE 'local_partnumber_book_items_broken_%'
+	`).Scan(&quarantineTables).Error; err != nil {
+		t.Fatalf("load quarantine tables: %v", err)
+	}
+	if len(quarantineTables) != 1 {
+		t.Fatalf("expected one quarantined broken catalog table, got %d", len(quarantineTables))
+	}
+}
+
+func TestCleanupStaleReadOnlyCacheTempTablesDropsShadowTempWhenBaseExists(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "stale_cache_temp.db")
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Silent),
+	})
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+
+	if err := db.Exec(`
+		CREATE TABLE local_pricelist_items (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			pricelist_id INTEGER NOT NULL,
+			partnumber TEXT,
+			brand TEXT NOT NULL DEFAULT '',
+			lot_name TEXT NOT NULL,
+			description TEXT,
+			price REAL NOT NULL DEFAULT 0,
+			quantity INTEGER NOT NULL DEFAULT 0,
+			reserve INTEGER NOT NULL DEFAULT 0,
+			available_qty REAL,
+			partnumbers TEXT,
+			lot_category TEXT,
+			created_at DATETIME,
+			updated_at DATETIME
+		)
+	`).Error; err != nil {
+		t.Fatalf("create local_pricelist_items: %v", err)
+	}
+	if err := db.Exec(`
+		CREATE TABLE local_pricelist_items__temp (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			legacy TEXT
+		)
+	`).Error; err != nil {
+		t.Fatalf("create local_pricelist_items__temp: %v", err)
+	}
+
+	if err := cleanupStaleReadOnlyCacheTempTables(db); err != nil {
+		t.Fatalf("cleanup stale read-only cache temp tables: %v", err)
+	}
+
+	if db.Migrator().HasTable("local_pricelist_items__temp") {
+		t.Fatalf("expected stale temp table to be dropped")
+	}
+	if !db.Migrator().HasTable("local_pricelist_items") {
+		t.Fatalf("expected base local_pricelist_items table to remain")
+	}
+}

internal/localdb/migration_projects_test.go

@@ -51,8 +51,8 @@ func TestRunLocalMigrationsBackfillsDefaultProject(t *testing.T) {
 	if err != nil {
 		t.Fatalf("get system project: %v", err)
 	}
-	if project.Name != "Без проекта" {
-		t.Fatalf("expected system project name, got %q", project.Name)
+	if project.Name == nil || *project.Name != "Без проекта" {
+		t.Fatalf("expected system project name, got %v", project.Name)
 	}
 	if !project.IsSystem {
 		t.Fatalf("expected system project flag")

internal/localdb/migrations.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"sort"
 	"strings"
 	"time"
 
@@ -88,6 +89,49 @@ var localMigrations = []localMigration{
 		name: "Add support_code to local_configurations",
 		run:  addLocalConfigurationSupportCode,
 	},
+	{
+		id:   "2026_02_13_local_project_code",
+		name: "Add project code to local_projects and backfill",
+		run:  addLocalProjectCode,
+	},
+	{
+		id:   "2026_02_13_local_project_variant",
+		name: "Add project variant to local_projects and backfill",
+		run:  addLocalProjectVariant,
+	},
+	{
+		id:   "2026_02_13_local_project_name_nullable",
+		name: "Allow NULL project names in local_projects",
+		run:  allowLocalProjectNameNull,
+	},
+	{
+		id:   "2026_02_19_configuration_versions_dedup_spec_price",
+		name: "Deduplicate configuration revisions by spec+price",
+		run:  deduplicateConfigurationVersionsBySpecAndPrice,
+	},
+	{
+		id:   "2026_02_19_local_config_line_no",
+		name: "Add line_no to local_configurations and backfill ordering",
+		run:  addLocalConfigurationLineNo,
+	},
+	{
+		id:   "2026_03_07_local_partnumber_book_catalog",
+		name: "Convert local partnumber book cache to book membership + deduplicated PN catalog",
+		run:  migrateLocalPartnumberBookCatalog,
+	},
+	{
+		id:   "2026_03_13_pricelist_items_dedup_unique",
+		name: "Deduplicate local_pricelist_items and add unique index on (pricelist_id, lot_name)",
+		run:  deduplicatePricelistItemsAndAddUniqueIndex,
+	},
+}
+
+type localPartnumberCatalogRow struct {
+	Partnumber  string
+	LotsJSON    LocalPartnumberBookLots
+	Description string
+	CreatedAt   time.Time
+	ServerID    int
 }
 
 func runLocalMigrations(db *gorm.DB) error {
@@ -224,7 +268,8 @@ func ensureDefaultProjectTx(tx *gorm.DB, ownerUsername string) (*LocalProject, e
 	project = LocalProject{
 		UUID:          uuid.NewString(),
 		OwnerUsername: ownerUsername,
-		Name:          "Без проекта",
+		Code:          "Без проекта",
+		Name:          ptrString("Без проекта"),
 		IsActive:      true,
 		IsSystem:      true,
 		CreatedAt:     now,
@@ -238,6 +283,139 @@ func ensureDefaultProjectTx(tx *gorm.DB, ownerUsername string) (*LocalProject, e
 	return &project, nil
 }
 
+func addLocalProjectCode(tx *gorm.DB) error {
+	if err := tx.Exec(`ALTER TABLE local_projects ADD COLUMN code TEXT`).Error; err != nil {
+		if !strings.Contains(strings.ToLower(err.Error()), "duplicate") &&
+			!strings.Contains(strings.ToLower(err.Error()), "exists") {
+			return err
+		}
+	}
+
+	// Drop unique index if it already exists to allow de-duplication updates.
+	if err := tx.Exec(`DROP INDEX IF EXISTS idx_local_projects_code`).Error; err != nil {
+		return err
+	}
+
+	// Copy code from current project name.
+	if err := tx.Exec(`
+UPDATE local_projects
+SET code = TRIM(COALESCE(name, ''))`).Error; err != nil {
+		return err
+	}
+
+	// Ensure any remaining blanks have a unique fallback.
+	if err := tx.Exec(`
+UPDATE local_projects
+SET code = 'P-' || uuid
+WHERE code IS NULL OR TRIM(code) = ''`).Error; err != nil {
+		return err
+	}
+
+	// De-duplicate codes: OPS-1948-2, OPS-1948-3...
+	if err := tx.Exec(`
+WITH ranked AS (
+	SELECT id, code,
+	       ROW_NUMBER() OVER (PARTITION BY code ORDER BY id) AS rn
+	FROM local_projects
+)
+UPDATE local_projects
+SET code = code || '-' || (SELECT rn FROM ranked WHERE ranked.id = local_projects.id)
+WHERE id IN (SELECT id FROM ranked WHERE rn > 1)`).Error; err != nil {
+		return err
+	}
+
+	// Create unique index for project codes (ignore if exists).
+	if err := tx.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_local_projects_code ON local_projects(code)`).Error; err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func addLocalProjectVariant(tx *gorm.DB) error {
+	if err := tx.Exec(`ALTER TABLE local_projects ADD COLUMN variant TEXT NOT NULL DEFAULT ''`).Error; err != nil {
+		if !strings.Contains(strings.ToLower(err.Error()), "duplicate") &&
+			!strings.Contains(strings.ToLower(err.Error()), "exists") {
+			return err
+		}
+	}
+
+	// Drop legacy code index if present.
+	if err := tx.Exec(`DROP INDEX IF EXISTS idx_local_projects_code`).Error; err != nil {
+		return err
+	}
+
+	// Reset code from name and clear variant.
+	if err := tx.Exec(`
+UPDATE local_projects
+SET code = TRIM(COALESCE(name, '')),
+    variant = ''`).Error; err != nil {
+		return err
+	}
+
+	// De-duplicate by assigning variant numbers: 2,3...
+	if err := tx.Exec(`
+WITH ranked AS (
+	SELECT id, code,
+	       ROW_NUMBER() OVER (PARTITION BY code ORDER BY id) AS rn
+	FROM local_projects
+)
+UPDATE local_projects
+SET variant = CASE
+	WHEN (SELECT rn FROM ranked WHERE ranked.id = local_projects.id) = 1 THEN ''
+	ELSE '-' || CAST((SELECT rn FROM ranked WHERE ranked.id = local_projects.id) AS TEXT)
+END`).Error; err != nil {
+		return err
+	}
+
+	if err := tx.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_local_projects_code_variant ON local_projects(code, variant)`).Error; err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func allowLocalProjectNameNull(tx *gorm.DB) error {
+	if err := tx.Exec(`ALTER TABLE local_projects RENAME TO local_projects_old`).Error; err != nil {
+		return err
+	}
+
+	if err := tx.Exec(`
+CREATE TABLE local_projects (
+	id INTEGER PRIMARY KEY AUTOINCREMENT,
+	uuid TEXT NOT NULL UNIQUE,
+	server_id INTEGER NULL,
+	owner_username TEXT NOT NULL,
+	code TEXT NOT NULL,
+	variant TEXT NOT NULL DEFAULT '',
+	name TEXT NULL,
+	tracker_url TEXT NULL,
+	is_active INTEGER NOT NULL DEFAULT 1,
+	is_system INTEGER NOT NULL DEFAULT 0,
+	created_at DATETIME,
+	updated_at DATETIME,
+	synced_at DATETIME NULL,
+	sync_status TEXT DEFAULT 'local'
+)`).Error; err != nil {
+		return err
+	}
+
+	_ = tx.Exec(`CREATE INDEX IF NOT EXISTS idx_local_projects_owner_username ON local_projects(owner_username)`).Error
+	_ = tx.Exec(`CREATE INDEX IF NOT EXISTS idx_local_projects_is_active ON local_projects(is_active)`).Error
+	_ = tx.Exec(`CREATE INDEX IF NOT EXISTS idx_local_projects_is_system ON local_projects(is_system)`).Error
+	_ = tx.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_local_projects_code_variant ON local_projects(code, variant)`).Error
+
+	if err := tx.Exec(`
+INSERT INTO local_projects (id, uuid, server_id, owner_username, code, variant, name, tracker_url, is_active, is_system, created_at, updated_at, synced_at, sync_status)
+SELECT id, uuid, server_id, owner_username, code, variant, name, tracker_url, is_active, is_system, created_at, updated_at, synced_at, sync_status
+FROM local_projects_old`).Error; err != nil {
+		return err
+	}
+
+	_ = tx.Exec(`DROP TABLE local_projects_old`).Error
+	return nil
+}
+
 func backfillConfigurationPricelists(tx *gorm.DB) error {
 	var latest LocalPricelist
 	if err := tx.Where("source = ?", "estimate").Order("created_at DESC").First(&latest).Error; err != nil {
@@ -279,6 +457,93 @@ func chooseNonZeroTime(candidate time.Time, fallback time.Time) time.Time {
 	return candidate
 }
 
+func deduplicateConfigurationVersionsBySpecAndPrice(tx *gorm.DB) error {
+	var configs []LocalConfiguration
+	if err := tx.Select("uuid", "current_version_id").Find(&configs).Error; err != nil {
+		return fmt.Errorf("load configurations for revision deduplication: %w", err)
+	}
+
+	var removedTotal int
+	for i := range configs {
+		cfg := configs[i]
+
+		var versions []LocalConfigurationVersion
+		if err := tx.Where("configuration_uuid = ?", cfg.UUID).
+			Order("version_no ASC, created_at ASC").
+			Find(&versions).Error; err != nil {
+			return fmt.Errorf("load versions for %s: %w", cfg.UUID, err)
+		}
+		if len(versions) < 2 {
+			continue
+		}
+
+		deleteIDs := make([]string, 0)
+		deleteSet := make(map[string]struct{})
+		kept := make([]LocalConfigurationVersion, 0, len(versions))
+		var prevKey string
+		hasPrev := false
+
+		for _, version := range versions {
+			snapshotCfg, err := DecodeConfigurationSnapshot(version.Data)
+			if err != nil {
+				// Keep malformed snapshots untouched and reset chain to avoid accidental removals.
+				kept = append(kept, version)
+				hasPrev = false
+				continue
+			}
+
+			key, err := BuildConfigurationSpecPriceFingerprint(snapshotCfg)
+			if err != nil {
+				kept = append(kept, version)
+				hasPrev = false
+				continue
+			}
+
+			if !hasPrev || key != prevKey {
+				kept = append(kept, version)
+				prevKey = key
+				hasPrev = true
+				continue
+			}
+
+			deleteIDs = append(deleteIDs, version.ID)
+			deleteSet[version.ID] = struct{}{}
+		}
+
+		if len(deleteIDs) == 0 {
+			continue
+		}
+
+		if err := tx.Where("id IN ?", deleteIDs).Delete(&LocalConfigurationVersion{}).Error; err != nil {
+			return fmt.Errorf("delete duplicate versions for %s: %w", cfg.UUID, err)
+		}
+		removedTotal += len(deleteIDs)
+
+		latestKeptID := kept[len(kept)-1].ID
+		if cfg.CurrentVersionID == nil || *cfg.CurrentVersionID == "" {
+			if err := tx.Model(&LocalConfiguration{}).
+				Where("uuid = ?", cfg.UUID).
+				Update("current_version_id", latestKeptID).Error; err != nil {
+				return fmt.Errorf("set missing current_version_id for %s: %w", cfg.UUID, err)
+			}
+			continue
+		}
+
+		if _, deleted := deleteSet[*cfg.CurrentVersionID]; deleted {
+			if err := tx.Model(&LocalConfiguration{}).
+				Where("uuid = ?", cfg.UUID).
+				Update("current_version_id", latestKeptID).Error; err != nil {
+				return fmt.Errorf("repair current_version_id for %s: %w", cfg.UUID, err)
+			}
+		}
+	}
+
+	if removedTotal > 0 {
+		slog.Info("deduplicated configuration revisions", "removed_versions", removedTotal)
+	}
+	return nil
+}
+
 func fixLocalPricelistIndexes(tx *gorm.DB) error {
 	type indexRow struct {
 		Name   string `gorm:"column:name"`
@@ -565,3 +830,293 @@ func addLocalConfigurationSupportCode(tx *gorm.DB) error {
 	}
 	return nil
 }
+
+func addLocalConfigurationLineNo(tx *gorm.DB) error {
+	type columnInfo struct {
+		Name string `gorm:"column:name"`
+	}
+	var columns []columnInfo
+	if err := tx.Raw(`
+		SELECT name FROM pragma_table_info('local_configurations')
+		WHERE name IN ('line_no')
+	`).Scan(&columns).Error; err != nil {
+		return fmt.Errorf("check local_configurations(line_no) existence: %w", err)
+	}
+	if len(columns) == 0 {
+		if err := tx.Exec(`
+			ALTER TABLE local_configurations
+			ADD COLUMN line_no INTEGER
+		`).Error; err != nil {
+			return fmt.Errorf("add local_configurations.line_no: %w", err)
+		}
+		slog.Info("added line_no to local_configurations")
+	}
+
+	if err := tx.Exec(`
+WITH ranked AS (
+	SELECT
+		id,
+		ROW_NUMBER() OVER (
+			PARTITION BY COALESCE(NULLIF(TRIM(project_uuid), ''), '__NO_PROJECT__')
+			ORDER BY created_at ASC, id ASC
+		) AS rn
+	FROM local_configurations
+	WHERE line_no IS NULL OR line_no <= 0
+)
+UPDATE local_configurations
+SET line_no = (
+	SELECT rn * 10
+	FROM ranked
+	WHERE ranked.id = local_configurations.id
+)
+WHERE id IN (SELECT id FROM ranked)
+`).Error; err != nil {
+		return fmt.Errorf("backfill local_configurations.line_no: %w", err)
+	}
+
+	if err := tx.Exec(`
+		CREATE INDEX IF NOT EXISTS idx_local_configurations_project_line_no
+		ON local_configurations(project_uuid, line_no)
+	`).Error; err != nil {
+		return fmt.Errorf("ensure idx_local_configurations_project_line_no: %w", err)
+	}
+
+	return nil
+}
+
+func migrateLocalPartnumberBookCatalog(tx *gorm.DB) error {
+	type columnInfo struct {
+		Name string `gorm:"column:name"`
+	}
+
+	hasBooksTable := tx.Migrator().HasTable(&LocalPartnumberBook{})
+	hasItemsTable := tx.Migrator().HasTable(&LocalPartnumberBookItem{})
+	if !hasItemsTable {
+		return nil
+	}
+
+	if hasBooksTable {
+		var bookCols []columnInfo
+		if err := tx.Raw(`SELECT name FROM pragma_table_info('local_partnumber_books')`).Scan(&bookCols).Error; err != nil {
+			return fmt.Errorf("load local_partnumber_books columns: %w", err)
+		}
+		hasPartnumbersJSON := false
+		for _, c := range bookCols {
+			if c.Name == "partnumbers_json" {
+				hasPartnumbersJSON = true
+				break
+			}
+		}
+		if !hasPartnumbersJSON {
+			if err := tx.Exec(`ALTER TABLE local_partnumber_books ADD COLUMN partnumbers_json TEXT NOT NULL DEFAULT '[]'`).Error; err != nil {
+				return fmt.Errorf("add local_partnumber_books.partnumbers_json: %w", err)
+			}
+		}
+	}
+
+	var itemCols []columnInfo
+	if err := tx.Raw(`SELECT name FROM pragma_table_info('local_partnumber_book_items')`).Scan(&itemCols).Error; err != nil {
+		return fmt.Errorf("load local_partnumber_book_items columns: %w", err)
+	}
+	hasBookID := false
+	hasLotName := false
+	hasLotsJSON := false
+	for _, c := range itemCols {
+		if c.Name == "book_id" {
+			hasBookID = true
+		}
+		if c.Name == "lot_name" {
+			hasLotName = true
+		}
+		if c.Name == "lots_json" {
+			hasLotsJSON = true
+		}
+	}
+	if !hasBookID && !hasLotName && !hasLotsJSON {
+		return nil
+	}
+
+	type legacyRow struct {
+		BookID      uint
+		Partnumber  string
+		LotName     string
+		Description string
+		CreatedAt   time.Time
+		ServerID    int
+	}
+	bookPNs := make(map[uint]map[string]struct{})
+	catalog := make(map[string]*localPartnumberCatalogRow)
+
+	if hasBookID || hasLotName {
+		var rows []legacyRow
+		if err := tx.Raw(`
+			SELECT
+				i.book_id,
+				i.partnumber,
+				i.lot_name,
+				COALESCE(i.description, '') AS description,
+				b.created_at,
+				b.server_id
+			FROM local_partnumber_book_items i
+			INNER JOIN local_partnumber_books b ON b.id = i.book_id
+			ORDER BY b.created_at DESC, b.id DESC, i.partnumber ASC, i.id ASC
+		`).Scan(&rows).Error; err != nil {
+			return fmt.Errorf("load legacy local partnumber book items: %w", err)
+		}
+
+		for _, row := range rows {
+			if _, ok := bookPNs[row.BookID]; !ok {
+				bookPNs[row.BookID] = make(map[string]struct{})
+			}
+			bookPNs[row.BookID][row.Partnumber] = struct{}{}
+
+			entry, ok := catalog[row.Partnumber]
+			if !ok {
+				entry = &localPartnumberCatalogRow{
+					Partnumber:  row.Partnumber,
+					Description: row.Description,
+					CreatedAt:   row.CreatedAt,
+					ServerID:    row.ServerID,
+				}
+				catalog[row.Partnumber] = entry
+			}
+			if row.CreatedAt.After(entry.CreatedAt) || (row.CreatedAt.Equal(entry.CreatedAt) && row.ServerID >= entry.ServerID) {
+				entry.Description = row.Description
+				entry.CreatedAt = row.CreatedAt
+				entry.ServerID = row.ServerID
+			}
+			found := false
+			for i := range entry.LotsJSON {
+				if entry.LotsJSON[i].LotName == row.LotName {
+					entry.LotsJSON[i].Qty += 1
+					found = true
+					break
+				}
+			}
+			if !found && row.LotName != "" {
+				entry.LotsJSON = append(entry.LotsJSON, LocalPartnumberBookLot{LotName: row.LotName, Qty: 1})
+			}
+		}
+
+		var books []LocalPartnumberBook
+		if err := tx.Find(&books).Error; err != nil {
+			return fmt.Errorf("load local partnumber books: %w", err)
+		}
+		for _, book := range books {
+			pnSet := bookPNs[book.ID]
+			partnumbers := make([]string, 0, len(pnSet))
+			for pn := range pnSet {
+				partnumbers = append(partnumbers, pn)
+			}
+			sort.Strings(partnumbers)
+			if err := tx.Model(&LocalPartnumberBook{}).
+				Where("id = ?", book.ID).
+				Update("partnumbers_json", LocalStringList(partnumbers)).Error; err != nil {
+				return fmt.Errorf("update partnumbers_json for local book %d: %w", book.ID, err)
+			}
+		}
+	} else {
+		var items []LocalPartnumberBookItem
+		if err := tx.Order("id DESC").Find(&items).Error; err != nil {
+			return fmt.Errorf("load canonical local partnumber book items: %w", err)
+		}
+		for _, item := range items {
+			entry, ok := catalog[item.Partnumber]
+			if !ok {
+				copiedLots := append(LocalPartnumberBookLots(nil), item.LotsJSON...)
+				catalog[item.Partnumber] = &localPartnumberCatalogRow{
+					Partnumber:  item.Partnumber,
+					LotsJSON:    copiedLots,
+					Description: item.Description,
+				}
+				continue
+			}
+			if entry.Description == "" && item.Description != "" {
+				entry.Description = item.Description
+			}
+			for _, lot := range item.LotsJSON {
+				merged := false
+				for i := range entry.LotsJSON {
+					if entry.LotsJSON[i].LotName == lot.LotName {
+						if lot.Qty > entry.LotsJSON[i].Qty {
+							entry.LotsJSON[i].Qty = lot.Qty
+						}
+						merged = true
+						break
+					}
+				}
+				if !merged {
+					entry.LotsJSON = append(entry.LotsJSON, lot)
+				}
+			}
+		}
+	}
+
+	return rebuildLocalPartnumberBookCatalog(tx, catalog)
+}
+
+func rebuildLocalPartnumberBookCatalog(tx *gorm.DB, catalog map[string]*localPartnumberCatalogRow) error {
+	if err := tx.Exec(`
+		CREATE TABLE local_partnumber_book_items_new (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			partnumber TEXT NOT NULL UNIQUE,
+			lots_json TEXT NOT NULL,
+			description TEXT
+		)
+	`).Error; err != nil {
+		return fmt.Errorf("create new local_partnumber_book_items table: %w", err)
+	}
+
+	orderedPartnumbers := make([]string, 0, len(catalog))
+	for pn := range catalog {
+		orderedPartnumbers = append(orderedPartnumbers, pn)
+	}
+	sort.Strings(orderedPartnumbers)
+	for _, pn := range orderedPartnumbers {
+		row := catalog[pn]
+		sort.Slice(row.LotsJSON, func(i, j int) bool {
+			return row.LotsJSON[i].LotName < row.LotsJSON[j].LotName
+		})
+		if err := tx.Table("local_partnumber_book_items_new").Create(&LocalPartnumberBookItem{
+			Partnumber:  row.Partnumber,
+			LotsJSON:    row.LotsJSON,
+			Description: row.Description,
+		}).Error; err != nil {
+			return fmt.Errorf("insert new local_partnumber_book_items row for %s: %w", pn, err)
+		}
+	}
+
+	if err := tx.Exec(`DROP TABLE local_partnumber_book_items`).Error; err != nil {
+		return fmt.Errorf("drop legacy local_partnumber_book_items: %w", err)
+	}
+	if err := tx.Exec(`ALTER TABLE local_partnumber_book_items_new RENAME TO local_partnumber_book_items`).Error; err != nil {
+		return fmt.Errorf("rename new local_partnumber_book_items table: %w", err)
+	}
+	if err := tx.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_local_partnumber_book_items_partnumber ON local_partnumber_book_items(partnumber)`).Error; err != nil {
+		return fmt.Errorf("create local_partnumber_book_items partnumber index: %w", err)
+	}
+	return nil
+}
+
+func deduplicatePricelistItemsAndAddUniqueIndex(tx *gorm.DB) error {
+	// Remove duplicate (pricelist_id, lot_name) rows keeping only the row with the lowest id.
+	if err := tx.Exec(`
+		DELETE FROM local_pricelist_items
+		WHERE id NOT IN (
+			SELECT MIN(id) FROM local_pricelist_items
+			GROUP BY pricelist_id, lot_name
+		)
+	`).Error; err != nil {
+		return fmt.Errorf("deduplicate local_pricelist_items: %w", err)
+	}
+
+	// Add unique index to prevent future duplicates.
+	if err := tx.Exec(`
+		CREATE UNIQUE INDEX IF NOT EXISTS idx_local_pricelist_items_pricelist_lot_unique
+		ON local_pricelist_items(pricelist_id, lot_name)
+	`).Error; err != nil {
+		return fmt.Errorf("create unique index on local_pricelist_items: %w", err)
+	}
+	slog.Info("deduplicated local_pricelist_items and added unique index")
+	return nil
+}

internal/localdb/models.go

@@ -83,35 +83,39 @@ func (s *LocalStringList) Scan(value interface{}) error {
 
 // LocalConfiguration stores configurations in local SQLite
 type LocalConfiguration struct {
-	ID               uint                        `gorm:"primaryKey;autoIncrement" json:"id"`
-	UUID             string                      `gorm:"uniqueIndex;not null" json:"uuid"`
-	ServerID         *uint                       `json:"server_id"` // ID on MariaDB server, NULL if local only
-	ProjectUUID      *string                     `gorm:"index" json:"project_uuid,omitempty"`
-	CurrentVersionID *string                     `gorm:"index" json:"current_version_id,omitempty"`
-	IsActive         bool                        `gorm:"default:true;index" json:"is_active"`
-	Name             string                      `gorm:"not null" json:"name"`
-	Items            LocalConfigItems            `gorm:"type:text" json:"items"` // JSON stored as text in SQLite
-	TotalPrice       *float64                    `json:"total_price"`
-	CustomPrice      *float64                    `json:"custom_price"`
-	Notes            string                      `json:"notes"`
-	IsTemplate       bool                        `gorm:"default:false" json:"is_template"`
-	ServerCount      int                         `gorm:"default:1" json:"server_count"`
-	ServerModel      string                      `gorm:"size:100" json:"server_model,omitempty"`
-	SupportCode      string                      `gorm:"size:20" json:"support_code,omitempty"`
-	Article          string                      `gorm:"size:80" json:"article,omitempty"`
+	ID                    uint                        `gorm:"primaryKey;autoIncrement" json:"id"`
+	UUID                  string                      `gorm:"uniqueIndex;not null" json:"uuid"`
+	ServerID              *uint                       `json:"server_id"` // ID on MariaDB server, NULL if local only
+	ProjectUUID           *string                     `gorm:"index" json:"project_uuid,omitempty"`
+	CurrentVersionID      *string                     `gorm:"index" json:"current_version_id,omitempty"`
+	IsActive              bool                        `gorm:"default:true;index" json:"is_active"`
+	Name                  string                      `gorm:"not null" json:"name"`
+	Items                 LocalConfigItems            `gorm:"type:text" json:"items"` // JSON stored as text in SQLite
+	TotalPrice            *float64                    `json:"total_price"`
+	CustomPrice           *float64                    `json:"custom_price"`
+	Notes                 string                      `json:"notes"`
+	IsTemplate            bool                        `gorm:"default:false" json:"is_template"`
+	ServerCount           int                         `gorm:"default:1" json:"server_count"`
+	ServerModel           string                      `gorm:"size:100" json:"server_model,omitempty"`
+	SupportCode           string                      `gorm:"size:20" json:"support_code,omitempty"`
+	Article               string                      `gorm:"size:80" json:"article,omitempty"`
 	PricelistID           *uint                       `gorm:"index" json:"pricelist_id,omitempty"`
 	WarehousePricelistID  *uint                       `gorm:"index" json:"warehouse_pricelist_id,omitempty"`
 	CompetitorPricelistID *uint                       `gorm:"index" json:"competitor_pricelist_id,omitempty"`
+	DisablePriceRefresh   bool                        `gorm:"default:false" json:"disable_price_refresh"`
 	OnlyInStock           bool                        `gorm:"default:false" json:"only_in_stock"`
-	PriceUpdatedAt   *time.Time                  `gorm:"type:timestamp" json:"price_updated_at,omitempty"`
-	CreatedAt        time.Time                   `json:"created_at"`
-	UpdatedAt        time.Time                   `json:"updated_at"`
-	SyncedAt         *time.Time                  `json:"synced_at"`
-	SyncStatus       string                      `gorm:"default:'local'" json:"sync_status"` // 'local', 'synced', 'modified'
-	OriginalUserID   uint                        `json:"original_user_id"`                   // UserID from MariaDB for reference
-	OriginalUsername string                      `gorm:"not null;default:'';index" json:"original_username"`
-	CurrentVersion   *LocalConfigurationVersion  `gorm:"foreignKey:CurrentVersionID;references:ID" json:"current_version,omitempty"`
-	Versions         []LocalConfigurationVersion `gorm:"foreignKey:ConfigurationUUID;references:UUID" json:"versions,omitempty"`
+	VendorSpec            VendorSpec                  `gorm:"type:text" json:"vendor_spec,omitempty"`
+	Line                  int                         `gorm:"column:line_no;index" json:"line"`
+	PriceUpdatedAt        *time.Time                  `gorm:"type:timestamp" json:"price_updated_at,omitempty"`
+	CreatedAt             time.Time                   `json:"created_at"`
+	UpdatedAt             time.Time                   `json:"updated_at"`
+	SyncedAt              *time.Time                  `json:"synced_at"`
+	ConfigType            string                      `gorm:"default:server" json:"config_type"` // "server" | "storage"
+	SyncStatus            string                      `gorm:"default:'local'" json:"sync_status"` // 'local', 'synced', 'modified'
+	OriginalUserID        uint                        `json:"original_user_id"`                   // UserID from MariaDB for reference
+	OriginalUsername      string                      `gorm:"not null;default:'';index" json:"original_username"`
+	CurrentVersion        *LocalConfigurationVersion  `gorm:"foreignKey:CurrentVersionID;references:ID" json:"current_version,omitempty"`
+	Versions              []LocalConfigurationVersion `gorm:"foreignKey:ConfigurationUUID;references:UUID" json:"versions,omitempty"`
 }
 
 func (LocalConfiguration) TableName() string {
@@ -123,7 +127,9 @@ type LocalProject struct {
 	UUID          string     `gorm:"uniqueIndex;not null" json:"uuid"`
 	ServerID      *uint      `json:"server_id,omitempty"`
 	OwnerUsername string     `gorm:"not null;index" json:"owner_username"`
-	Name          string     `gorm:"not null" json:"name"`
+	Code          string     `gorm:"not null;index:idx_local_projects_code_variant,priority:1" json:"code"`
+	Variant       string     `gorm:"default:'';index:idx_local_projects_code_variant,priority:2" json:"variant"`
+	Name          *string    `json:"name,omitempty"`
 	TrackerURL    string     `json:"tracker_url"`
 	IsActive      bool       `gorm:"default:true;index" json:"is_active"`
 	IsSystem      bool       `gorm:"default:false;index" json:"is_system"`
@@ -198,18 +204,6 @@ func (LocalComponent) TableName() string {
 	return "local_components"
 }
 
-// LocalRemoteMigrationApplied tracks remote SQLite migrations received from server and applied locally.
-type LocalRemoteMigrationApplied struct {
-	ID         string    `gorm:"primaryKey;size:128" json:"id"`
-	Checksum   string    `gorm:"size:128;not null" json:"checksum"`
-	AppVersion string    `gorm:"size:64" json:"app_version,omitempty"`
-	AppliedAt  time.Time `gorm:"not null" json:"applied_at"`
-}
-
-func (LocalRemoteMigrationApplied) TableName() string {
-	return "local_remote_migrations_applied"
-}
-
 // LocalSyncGuardState stores latest sync readiness decision for UI and preflight checks.
 type LocalSyncGuardState struct {
 	ID                    uint       `gorm:"primaryKey;autoIncrement" json:"id"`
@@ -240,3 +234,134 @@ type PendingChange struct {
 func (PendingChange) TableName() string {
 	return "pending_changes"
 }
+
+// LocalPartnumberBook stores a version snapshot of the PN→LOT mapping book (pull-only from PriceForge)
+type LocalPartnumberBook struct {
+	ID              uint            `gorm:"primaryKey;autoIncrement" json:"id"`
+	ServerID        int             `gorm:"uniqueIndex;not null" json:"server_id"`
+	Version         string          `gorm:"not null" json:"version"`
+	CreatedAt       time.Time       `gorm:"not null" json:"created_at"`
+	IsActive        bool            `gorm:"not null;default:true" json:"is_active"`
+	PartnumbersJSON LocalStringList `gorm:"column:partnumbers_json;type:text" json:"partnumbers_json"`
+}
+
+func (LocalPartnumberBook) TableName() string {
+	return "local_partnumber_books"
+}
+
+type LocalPartnumberBookLot struct {
+	LotName string  `json:"lot_name"`
+	Qty     float64 `json:"qty"`
+}
+
+type LocalPartnumberBookLots []LocalPartnumberBookLot
+
+func (l LocalPartnumberBookLots) Value() (driver.Value, error) {
+	return json.Marshal(l)
+}
+
+func (l *LocalPartnumberBookLots) Scan(value interface{}) error {
+	if value == nil {
+		*l = make(LocalPartnumberBookLots, 0)
+		return nil
+	}
+	var bytes []byte
+	switch v := value.(type) {
+	case []byte:
+		bytes = v
+	case string:
+		bytes = []byte(v)
+	default:
+		return errors.New("type assertion failed for LocalPartnumberBookLots")
+	}
+	return json.Unmarshal(bytes, l)
+}
+
+// LocalPartnumberBookItem stores the canonical PN composition pulled from PriceForge.
+type LocalPartnumberBookItem struct {
+	ID          uint                    `gorm:"primaryKey;autoIncrement" json:"id"`
+	Partnumber  string                  `gorm:"not null" json:"partnumber"`
+	LotsJSON    LocalPartnumberBookLots `gorm:"column:lots_json;type:text" json:"lots_json"`
+	Description string                  `json:"description,omitempty"`
+}
+
+func (LocalPartnumberBookItem) TableName() string {
+	return "local_partnumber_book_items"
+}
+
+// VendorSpecItem represents a single row in a vendor BOM specification
+type VendorSpecItem struct {
+	SortOrder           int                       `json:"sort_order"`
+	VendorPartnumber    string                    `json:"vendor_partnumber"`
+	Quantity            int                       `json:"quantity"`
+	Description         string                    `json:"description,omitempty"`
+	UnitPrice           *float64                  `json:"unit_price,omitempty"`
+	TotalPrice          *float64                  `json:"total_price,omitempty"`
+	ResolvedLotName     string                    `json:"resolved_lot_name,omitempty"`
+	ResolutionSource    string                    `json:"resolution_source,omitempty"` // "book", "manual", "unresolved"
+	ManualLotSuggestion string                    `json:"manual_lot_suggestion,omitempty"`
+	LotQtyPerPN         int                       `json:"lot_qty_per_pn,omitempty"`
+	LotAllocations      []VendorSpecLotAllocation `json:"lot_allocations,omitempty"`
+	LotMappings         []VendorSpecLotMapping    `json:"lot_mappings,omitempty"`
+}
+
+type VendorSpecLotAllocation struct {
+	LotName  string `json:"lot_name"`
+	Quantity int    `json:"quantity"` // quantity of LOT per 1 vendor PN
+}
+
+// VendorSpecLotMapping is the canonical persisted LOT mapping for a vendor PN row.
+// It stores all mapped LOTs (base + bundle) uniformly.
+type VendorSpecLotMapping struct {
+	LotName       string `json:"lot_name"`
+	QuantityPerPN int    `json:"quantity_per_pn"`
+}
+
+// SyncLogEntry records the outcome of a single sync operation for diagnostics.
+type SyncLogEntry struct {
+	ID          uint      `gorm:"primaryKey;autoIncrement" json:"id"`
+	SyncType    string    `gorm:"not null;index;size:32" json:"sync_type"`   // components | pricelists | push | full
+	Status      string    `gorm:"not null;size:16" json:"status"`            // ok | error | skipped
+	ErrorText   string    `gorm:"size:1000" json:"error_text,omitempty"`
+	SyncedCount int       `gorm:"default:0" json:"synced_count"`
+	StartedAt   time.Time `gorm:"not null;index" json:"started_at"`
+	DurationMs  int64     `gorm:"default:0" json:"duration_ms"`
+}
+
+func (SyncLogEntry) TableName() string { return "sync_log" }
+
+// VendorSpec is a JSON-encodable slice of VendorSpecItem
+type VendorSpec []VendorSpecItem
+
+func (v VendorSpec) Value() (driver.Value, error) {
+	if v == nil {
+		return nil, nil
+	}
+	return json.Marshal(v)
+}
+
+func (v *VendorSpec) Scan(value interface{}) error {
+	if value == nil {
+		*v = nil
+		return nil
+	}
+	var bytes []byte
+	switch val := value.(type) {
+	case []byte:
+		bytes = val
+	case string:
+		bytes = []byte(val)
+	default:
+		return errors.New("type assertion failed for VendorSpec")
+	}
+	return json.Unmarshal(bytes, v)
+}
+
+// LocalQtSetting caches server-pushed settings from qt_settings (MariaDB) into local SQLite.
+// Synced during component sync. Each row is a JSON-valued setting identified by name.
+type LocalQtSetting struct {
+	Name  string `gorm:"primaryKey;size:100"`
+	Value string `gorm:"type:text"`
+}
+
+func (LocalQtSetting) TableName() string { return "local_qt_settings" }

internal/localdb/pricelist_latest_test.go

@@ -0,0 +1,128 @@
+package localdb
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestGetLatestLocalPricelistBySource_SkipsPricelistWithoutItems(t *testing.T) {
+	local, err := New(filepath.Join(t.TempDir(), "latest_without_items.db"))
+	if err != nil {
+		t.Fatalf("open localdb: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	base := time.Now().Add(-time.Minute)
+	withItems := &LocalPricelist{
+		ServerID:  1001,
+		Source:    "estimate",
+		Version:   "E-1",
+		Name:      "with-items",
+		CreatedAt: base,
+		SyncedAt:  base,
+	}
+	if err := local.SaveLocalPricelist(withItems); err != nil {
+		t.Fatalf("save pricelist with items: %v", err)
+	}
+	storedWithItems, err := local.GetLocalPricelistByServerID(withItems.ServerID)
+	if err != nil {
+		t.Fatalf("load pricelist with items: %v", err)
+	}
+	if err := local.SaveLocalPricelistItems([]LocalPricelistItem{
+		{
+			PricelistID: storedWithItems.ID,
+			LotName:     "CPU_A",
+			Price:       100,
+		},
+	}); err != nil {
+		t.Fatalf("save pricelist items: %v", err)
+	}
+
+	withoutItems := &LocalPricelist{
+		ServerID:  1002,
+		Source:    "estimate",
+		Version:   "E-2",
+		Name:      "without-items",
+		CreatedAt: base.Add(2 * time.Second),
+		SyncedAt:  base.Add(2 * time.Second),
+	}
+	if err := local.SaveLocalPricelist(withoutItems); err != nil {
+		t.Fatalf("save pricelist without items: %v", err)
+	}
+
+	got, err := local.GetLatestLocalPricelistBySource("estimate")
+	if err != nil {
+		t.Fatalf("GetLatestLocalPricelistBySource: %v", err)
+	}
+	if got.ServerID != withItems.ServerID {
+		t.Fatalf("expected server_id=%d, got %d", withItems.ServerID, got.ServerID)
+	}
+}
+
+func TestGetLatestLocalPricelistBySource_TieBreaksByID(t *testing.T) {
+	local, err := New(filepath.Join(t.TempDir(), "latest_tie_break.db"))
+	if err != nil {
+		t.Fatalf("open localdb: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	base := time.Now().Add(-time.Minute)
+	first := &LocalPricelist{
+		ServerID:  2001,
+		Source:    "warehouse",
+		Version:   "S-1",
+		Name:      "first",
+		CreatedAt: base,
+		SyncedAt:  base,
+	}
+	if err := local.SaveLocalPricelist(first); err != nil {
+		t.Fatalf("save first pricelist: %v", err)
+	}
+	storedFirst, err := local.GetLocalPricelistByServerID(first.ServerID)
+	if err != nil {
+		t.Fatalf("load first pricelist: %v", err)
+	}
+	if err := local.SaveLocalPricelistItems([]LocalPricelistItem{
+		{
+			PricelistID: storedFirst.ID,
+			LotName:     "CPU_A",
+			Price:       101,
+		},
+	}); err != nil {
+		t.Fatalf("save first items: %v", err)
+	}
+
+	second := &LocalPricelist{
+		ServerID:  2002,
+		Source:    "warehouse",
+		Version:   "S-2",
+		Name:      "second",
+		CreatedAt: base,
+		SyncedAt:  base,
+	}
+	if err := local.SaveLocalPricelist(second); err != nil {
+		t.Fatalf("save second pricelist: %v", err)
+	}
+	storedSecond, err := local.GetLocalPricelistByServerID(second.ServerID)
+	if err != nil {
+		t.Fatalf("load second pricelist: %v", err)
+	}
+	if err := local.SaveLocalPricelistItems([]LocalPricelistItem{
+		{
+			PricelistID: storedSecond.ID,
+			LotName:     "CPU_A",
+			Price:       102,
+		},
+	}); err != nil {
+		t.Fatalf("save second items: %v", err)
+	}
+
+	got, err := local.GetLatestLocalPricelistBySource("warehouse")
+	if err != nil {
+		t.Fatalf("GetLatestLocalPricelistBySource: %v", err)
+	}
+	if got.ServerID != second.ServerID {
+		t.Fatalf("expected server_id=%d, got %d", second.ServerID, got.ServerID)
+	}
+}

internal/localdb/project_sync_timestamp_test.go

@@ -0,0 +1,53 @@
+package localdb
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestSaveProjectPreservingUpdatedAtKeepsProvidedTimestamp(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "project_sync_timestamp.db")
+
+	local, err := New(dbPath)
+	if err != nil {
+		t.Fatalf("open localdb: %v", err)
+	}
+	t.Cleanup(func() { _ = local.Close() })
+
+	createdAt := time.Date(2026, 2, 1, 10, 0, 0, 0, time.UTC)
+	updatedAt := time.Date(2026, 2, 3, 12, 30, 0, 0, time.UTC)
+	project := &LocalProject{
+		UUID:          "project-1",
+		OwnerUsername: "tester",
+		Code:          "OPS-1",
+		Variant:       "Lenovo",
+		IsActive:      true,
+		CreatedAt:     createdAt,
+		UpdatedAt:     updatedAt,
+		SyncStatus:    "synced",
+	}
+
+	if err := local.SaveProjectPreservingUpdatedAt(project); err != nil {
+		t.Fatalf("save project: %v", err)
+	}
+
+	syncedAt := time.Date(2026, 3, 16, 8, 45, 0, 0, time.UTC)
+	project.SyncedAt = &syncedAt
+	project.SyncStatus = "synced"
+
+	if err := local.SaveProjectPreservingUpdatedAt(project); err != nil {
+		t.Fatalf("save project second time: %v", err)
+	}
+
+	stored, err := local.GetProjectByUUID(project.UUID)
+	if err != nil {
+		t.Fatalf("get project: %v", err)
+	}
+	if !stored.UpdatedAt.Equal(updatedAt) {
+		t.Fatalf("updated_at changed during sync save: got %s want %s", stored.UpdatedAt, updatedAt)
+	}
+	if stored.SyncedAt == nil || !stored.SyncedAt.Equal(syncedAt) {
+		t.Fatalf("synced_at not updated correctly: got %+v want %s", stored.SyncedAt, syncedAt)
+	}
+}

internal/localdb/qt_settings.go

@@ -0,0 +1,122 @@
+package localdb
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+
+	"gorm.io/gorm"
+)
+
+// ConfigTypeDef describes one device configuration type as synced from qt_settings.
+type ConfigTypeDef struct {
+	Code         string   `json:"code"`
+	NameRu       string   `json:"name_ru"`
+	DisplayOrder int      `json:"display_order"`
+	Categories   []string `json:"categories"`
+}
+
+// TabSection is a named sub-group of categories within a configurator tab.
+type TabSection struct {
+	Title      string   `json:"title"`
+	Categories []string `json:"categories"`
+}
+
+// TabDef describes one tab in the configurator as synced from qt_settings.
+type TabDef struct {
+	Key          string       `json:"key"`
+	Label        string       `json:"label"`
+	SingleSelect bool         `json:"single_select"`
+	Categories   []string     `json:"categories"`
+	Sections     []TabSection `json:"sections,omitempty"`
+}
+
+// ConfiguratorSettings holds all four server-driven settings consumed by the configurator.
+// Fields are nil/empty when the corresponding qt_settings key is absent or unparseable;
+// callers are expected to apply hardcoded fallbacks in that case.
+type ConfiguratorSettings struct {
+	ConfigTypes        []ConfigTypeDef     `json:"config_types"`
+	TabConfig          []TabDef            `json:"tab_config"`
+	AlwaysVisibleTabs  []string            `json:"always_visible_tabs"`
+	RequiredCategories map[string][]string `json:"required_categories"`
+}
+
+// SyncQtSettings reads all rows from qt_settings on MariaDB and replaces the
+// local_qt_settings cache in a single SQLite transaction. Returns an error if
+// the qt_settings table doesn't exist on the server (old server without the
+// table) or on any query/write failure.
+func (l *LocalDB) SyncQtSettings(mariaDB *gorm.DB) error {
+	var rows []LocalQtSetting
+	if err := mariaDB.
+		Table("qt_settings").
+		Select("name, value").
+		Find(&rows).Error; err != nil {
+		return fmt.Errorf("reading qt_settings from MariaDB: %w", err)
+	}
+
+	return l.db.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Exec("DELETE FROM local_qt_settings").Error; err != nil {
+			return fmt.Errorf("clearing local_qt_settings: %w", err)
+		}
+		if len(rows) == 0 {
+			return nil
+		}
+		if err := tx.Create(&rows).Error; err != nil {
+			return fmt.Errorf("inserting local_qt_settings: %w", err)
+		}
+		slog.Info("qt_settings synced", "count", len(rows))
+		return nil
+	})
+}
+
+// GetQtSetting returns the raw JSON value for a named setting.
+// found is false when the key does not exist.
+func (l *LocalDB) GetQtSetting(name string) (value string, found bool, err error) {
+	var row LocalQtSetting
+	res := l.db.Where("name = ?", name).First(&row)
+	if res.Error != nil {
+		if res.Error == gorm.ErrRecordNotFound {
+			return "", false, nil
+		}
+		return "", false, res.Error
+	}
+	return row.Value, true, nil
+}
+
+// GetConfiguratorSettings reads all four known settings from local_qt_settings and
+// parses them. Any missing or unparseable key is left as nil/zero in the result;
+// the caller must apply fallbacks.
+func (l *LocalDB) GetConfiguratorSettings() (*ConfiguratorSettings, error) {
+	out := &ConfiguratorSettings{}
+
+	keys := []string{"config_types", "tab_config", "always_visible_tabs", "required_categories"}
+	for _, key := range keys {
+		raw, found, err := l.GetQtSetting(key)
+		if err != nil {
+			return out, fmt.Errorf("reading setting %q: %w", key, err)
+		}
+		if !found || raw == "" {
+			continue
+		}
+		switch key {
+		case "config_types":
+			if err := json.Unmarshal([]byte(raw), &out.ConfigTypes); err != nil {
+				slog.Warn("failed to parse config_types setting", "error", err)
+			}
+		case "tab_config":
+			if err := json.Unmarshal([]byte(raw), &out.TabConfig); err != nil {
+				slog.Warn("failed to parse tab_config setting", "error", err)
+			}
+		case "always_visible_tabs":
+			if err := json.Unmarshal([]byte(raw), &out.AlwaysVisibleTabs); err != nil {
+				slog.Warn("failed to parse always_visible_tabs setting", "error", err)
+			}
+		case "required_categories":
+			if err := json.Unmarshal([]byte(raw), &out.RequiredCategories); err != nil {
+				slog.Warn("failed to parse required_categories setting", "error", err)
+			}
+		}
+	}
+
+	return out, nil
+}

internal/localdb/snapshots.go

@@ -3,37 +3,43 @@ package localdb
 import (
 	"encoding/json"
 	"fmt"
+	"sort"
 	"time"
 )
 
 // BuildConfigurationSnapshot serializes the full local configuration state.
 func BuildConfigurationSnapshot(localCfg *LocalConfiguration) (string, error) {
 	snapshot := map[string]interface{}{
-		"id":                 localCfg.ID,
-		"uuid":               localCfg.UUID,
-		"server_id":          localCfg.ServerID,
-		"project_uuid":       localCfg.ProjectUUID,
-		"current_version_id": localCfg.CurrentVersionID,
-		"is_active":          localCfg.IsActive,
-		"name":               localCfg.Name,
-		"items":              localCfg.Items,
-		"total_price":        localCfg.TotalPrice,
-		"custom_price":       localCfg.CustomPrice,
-		"notes":              localCfg.Notes,
-		"is_template":        localCfg.IsTemplate,
-		"server_count":       localCfg.ServerCount,
-		"server_model":       localCfg.ServerModel,
-		"support_code":       localCfg.SupportCode,
-		"article":            localCfg.Article,
-		"pricelist_id":       localCfg.PricelistID,
-		"only_in_stock":      localCfg.OnlyInStock,
-		"price_updated_at":   localCfg.PriceUpdatedAt,
-		"created_at":         localCfg.CreatedAt,
-		"updated_at":         localCfg.UpdatedAt,
-		"synced_at":          localCfg.SyncedAt,
-		"sync_status":        localCfg.SyncStatus,
-		"original_user_id":   localCfg.OriginalUserID,
-		"original_username":  localCfg.OriginalUsername,
+		"id":                      localCfg.ID,
+		"uuid":                    localCfg.UUID,
+		"server_id":               localCfg.ServerID,
+		"project_uuid":            localCfg.ProjectUUID,
+		"current_version_id":      localCfg.CurrentVersionID,
+		"is_active":               localCfg.IsActive,
+		"name":                    localCfg.Name,
+		"items":                   localCfg.Items,
+		"total_price":             localCfg.TotalPrice,
+		"custom_price":            localCfg.CustomPrice,
+		"notes":                   localCfg.Notes,
+		"is_template":             localCfg.IsTemplate,
+		"server_count":            localCfg.ServerCount,
+		"server_model":            localCfg.ServerModel,
+		"support_code":            localCfg.SupportCode,
+		"article":                 localCfg.Article,
+		"pricelist_id":            localCfg.PricelistID,
+		"warehouse_pricelist_id":  localCfg.WarehousePricelistID,
+		"competitor_pricelist_id": localCfg.CompetitorPricelistID,
+		"disable_price_refresh":   localCfg.DisablePriceRefresh,
+		"only_in_stock":           localCfg.OnlyInStock,
+		"vendor_spec":             localCfg.VendorSpec,
+		"line":                    localCfg.Line,
+		"price_updated_at":        localCfg.PriceUpdatedAt,
+		"created_at":              localCfg.CreatedAt,
+		"updated_at":              localCfg.UpdatedAt,
+		"synced_at":               localCfg.SyncedAt,
+		"sync_status":             localCfg.SyncStatus,
+		"original_user_id":        localCfg.OriginalUserID,
+		"original_username":       localCfg.OriginalUsername,
 	}
 
 	data, err := json.Marshal(snapshot)
@@ -46,23 +52,28 @@ func BuildConfigurationSnapshot(localCfg *LocalConfiguration) (string, error) {
 // DecodeConfigurationSnapshot returns editable fields from one saved snapshot.
 func DecodeConfigurationSnapshot(data string) (*LocalConfiguration, error) {
 	var snapshot struct {
-		ProjectUUID      *string          `json:"project_uuid"`
-		IsActive         *bool            `json:"is_active"`
-		Name             string           `json:"name"`
-		Items            LocalConfigItems `json:"items"`
-		TotalPrice       *float64         `json:"total_price"`
-		CustomPrice      *float64         `json:"custom_price"`
-		Notes            string           `json:"notes"`
-		IsTemplate       bool             `json:"is_template"`
-		ServerCount      int              `json:"server_count"`
-		ServerModel      string           `json:"server_model"`
-		SupportCode      string           `json:"support_code"`
-		Article          string           `json:"article"`
-		PricelistID      *uint            `json:"pricelist_id"`
-		OnlyInStock      bool             `json:"only_in_stock"`
-		PriceUpdatedAt   *time.Time       `json:"price_updated_at"`
-		OriginalUserID   uint             `json:"original_user_id"`
-		OriginalUsername string           `json:"original_username"`
+		ProjectUUID           *string          `json:"project_uuid"`
+		IsActive              *bool            `json:"is_active"`
+		Name                  string           `json:"name"`
+		Items                 LocalConfigItems `json:"items"`
+		TotalPrice            *float64         `json:"total_price"`
+		CustomPrice           *float64         `json:"custom_price"`
+		Notes                 string           `json:"notes"`
+		IsTemplate            bool             `json:"is_template"`
+		ServerCount           int              `json:"server_count"`
+		ServerModel           string           `json:"server_model"`
+		SupportCode           string           `json:"support_code"`
+		Article               string           `json:"article"`
+		PricelistID           *uint            `json:"pricelist_id"`
+		WarehousePricelistID  *uint            `json:"warehouse_pricelist_id"`
+		CompetitorPricelistID *uint            `json:"competitor_pricelist_id"`
+		DisablePriceRefresh   bool             `json:"disable_price_refresh"`
+		OnlyInStock           bool             `json:"only_in_stock"`
+		VendorSpec            VendorSpec       `json:"vendor_spec"`
+		Line                  int              `json:"line"`
+		PriceUpdatedAt        *time.Time       `json:"price_updated_at"`
+		OriginalUserID        uint             `json:"original_user_id"`
+		OriginalUsername      string           `json:"original_username"`
 	}
 
 	if err := json.Unmarshal([]byte(data), &snapshot); err != nil {
@@ -75,22 +86,87 @@ func DecodeConfigurationSnapshot(data string) (*LocalConfiguration, error) {
 	}
 
 	return &LocalConfiguration{
-		IsActive:         isActive,
-		ProjectUUID:      snapshot.ProjectUUID,
-		Name:             snapshot.Name,
-		Items:            snapshot.Items,
-		TotalPrice:       snapshot.TotalPrice,
-		CustomPrice:      snapshot.CustomPrice,
-		Notes:            snapshot.Notes,
-		IsTemplate:       snapshot.IsTemplate,
-		ServerCount:      snapshot.ServerCount,
-		ServerModel:      snapshot.ServerModel,
-		SupportCode:      snapshot.SupportCode,
-		Article:          snapshot.Article,
-		PricelistID:      snapshot.PricelistID,
-		OnlyInStock:      snapshot.OnlyInStock,
-		PriceUpdatedAt:   snapshot.PriceUpdatedAt,
-		OriginalUserID:   snapshot.OriginalUserID,
-		OriginalUsername: snapshot.OriginalUsername,
+		IsActive:              isActive,
+		ProjectUUID:           snapshot.ProjectUUID,
+		Name:                  snapshot.Name,
+		Items:                 snapshot.Items,
+		TotalPrice:            snapshot.TotalPrice,
+		CustomPrice:           snapshot.CustomPrice,
+		Notes:                 snapshot.Notes,
+		IsTemplate:            snapshot.IsTemplate,
+		ServerCount:           snapshot.ServerCount,
+		ServerModel:           snapshot.ServerModel,
+		SupportCode:           snapshot.SupportCode,
+		Article:               snapshot.Article,
+		PricelistID:           snapshot.PricelistID,
+		WarehousePricelistID:  snapshot.WarehousePricelistID,
+		CompetitorPricelistID: snapshot.CompetitorPricelistID,
+		DisablePriceRefresh:   snapshot.DisablePriceRefresh,
+		OnlyInStock:           snapshot.OnlyInStock,
+		VendorSpec:            snapshot.VendorSpec,
+		Line:                  snapshot.Line,
+		PriceUpdatedAt:        snapshot.PriceUpdatedAt,
+		OriginalUserID:        snapshot.OriginalUserID,
+		OriginalUsername:      snapshot.OriginalUsername,
 	}, nil
 }
+
+type configurationSpecPriceFingerprint struct {
+	Items                 []configurationSpecPriceFingerprintItem `json:"items"`
+	ServerCount           int                                     `json:"server_count"`
+	TotalPrice            *float64                                `json:"total_price,omitempty"`
+	CustomPrice           *float64                                `json:"custom_price,omitempty"`
+	PricelistID           *uint                                   `json:"pricelist_id,omitempty"`
+	WarehousePricelistID  *uint                                   `json:"warehouse_pricelist_id,omitempty"`
+	CompetitorPricelistID *uint                                   `json:"competitor_pricelist_id,omitempty"`
+	DisablePriceRefresh   bool                                    `json:"disable_price_refresh"`
+	OnlyInStock           bool                                    `json:"only_in_stock"`
+	VendorSpec            VendorSpec                              `json:"vendor_spec,omitempty"`
+}
+
+type configurationSpecPriceFingerprintItem struct {
+	LotName   string  `json:"lot_name"`
+	Quantity  int     `json:"quantity"`
+	UnitPrice float64 `json:"unit_price"`
+}
+
+// BuildConfigurationSpecPriceFingerprint returns a stable JSON key based on
+// spec + price fields only, used for revision deduplication.
+func BuildConfigurationSpecPriceFingerprint(localCfg *LocalConfiguration) (string, error) {
+	items := make([]configurationSpecPriceFingerprintItem, 0, len(localCfg.Items))
+	for _, item := range localCfg.Items {
+		items = append(items, configurationSpecPriceFingerprintItem{
+			LotName:   item.LotName,
+			Quantity:  item.Quantity,
+			UnitPrice: item.UnitPrice,
+		})
+	}
+	sort.Slice(items, func(i, j int) bool {
+		if items[i].LotName != items[j].LotName {
+			return items[i].LotName < items[j].LotName
+		}
+		if items[i].Quantity != items[j].Quantity {
+			return items[i].Quantity < items[j].Quantity
+		}
+		return items[i].UnitPrice < items[j].UnitPrice
+	})
+
+	payload := configurationSpecPriceFingerprint{
+		Items:                 items,
+		ServerCount:           localCfg.ServerCount,
+		TotalPrice:            localCfg.TotalPrice,
+		CustomPrice:           localCfg.CustomPrice,
+		PricelistID:           localCfg.PricelistID,
+		WarehousePricelistID:  localCfg.WarehousePricelistID,
+		CompetitorPricelistID: localCfg.CompetitorPricelistID,
+		DisablePriceRefresh:   localCfg.DisablePriceRefresh,
+		OnlyInStock:           localCfg.OnlyInStock,
+		VendorSpec:            localCfg.VendorSpec,
+	}
+
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		return "", fmt.Errorf("marshal spec+price fingerprint: %w", err)
+	}
+	return string(raw), nil
+}

internal/lotmatch/resolver.go

@@ -1,238 +0,0 @@
-package lotmatch
-
-import (
-	"errors"
-	"regexp"
-	"sort"
-	"strings"
-
-	"git.mchus.pro/mchus/quoteforge/internal/models"
-	"gorm.io/gorm"
-)
-
-var (
-	ErrResolveConflict = errors.New("multiple lot matches")
-	ErrResolveNotFound = errors.New("lot not found")
-)
-
-type LotResolver struct {
-	partnumberToLots map[string][]string
-	exactLots        map[string]string
-	allLots          []string
-}
-
-type MappingMatcher struct {
-	exact    map[string][]string
-	exactLot map[string]string
-	wildcard []wildcardMapping
-}
-
-type wildcardMapping struct {
-	lotName string
-	re      *regexp.Regexp
-}
-
-func NewLotResolverFromDB(db *gorm.DB) (*LotResolver, error) {
-	mappings, lots, err := loadMappingsAndLots(db)
-	if err != nil {
-		return nil, err
-	}
-	return NewLotResolver(mappings, lots), nil
-}
-
-func NewMappingMatcherFromDB(db *gorm.DB) (*MappingMatcher, error) {
-	mappings, lots, err := loadMappingsAndLots(db)
-	if err != nil {
-		return nil, err
-	}
-	return NewMappingMatcher(mappings, lots), nil
-}
-
-func NewLotResolver(mappings []models.LotPartnumber, lots []models.Lot) *LotResolver {
-	partnumberToLots := make(map[string][]string, len(mappings))
-	for _, m := range mappings {
-		pn := NormalizeKey(m.Partnumber)
-		lot := strings.TrimSpace(m.LotName)
-		if pn == "" || lot == "" {
-			continue
-		}
-		partnumberToLots[pn] = append(partnumberToLots[pn], lot)
-	}
-	for key := range partnumberToLots {
-		partnumberToLots[key] = uniqueCaseInsensitive(partnumberToLots[key])
-	}
-
-	exactLots := make(map[string]string, len(lots))
-	allLots := make([]string, 0, len(lots))
-	for _, l := range lots {
-		name := strings.TrimSpace(l.LotName)
-		if name == "" {
-			continue
-		}
-		exactLots[NormalizeKey(name)] = name
-		allLots = append(allLots, name)
-	}
-	sort.Slice(allLots, func(i, j int) bool {
-		li := len([]rune(allLots[i]))
-		lj := len([]rune(allLots[j]))
-		if li == lj {
-			return allLots[i] < allLots[j]
-		}
-		return li > lj
-	})
-
-	return &LotResolver{
-		partnumberToLots: partnumberToLots,
-		exactLots:        exactLots,
-		allLots:          allLots,
-	}
-}
-
-func NewMappingMatcher(mappings []models.LotPartnumber, lots []models.Lot) *MappingMatcher {
-	exact := make(map[string][]string, len(mappings))
-	wildcards := make([]wildcardMapping, 0, len(mappings))
-	for _, m := range mappings {
-		pn := NormalizeKey(m.Partnumber)
-		lot := strings.TrimSpace(m.LotName)
-		if pn == "" || lot == "" {
-			continue
-		}
-		if strings.Contains(pn, "*") {
-			pattern := "^" + regexp.QuoteMeta(pn) + "$"
-			pattern = strings.ReplaceAll(pattern, "\\*", ".*")
-			re, err := regexp.Compile(pattern)
-			if err != nil {
-				continue
-			}
-			wildcards = append(wildcards, wildcardMapping{lotName: lot, re: re})
-			continue
-		}
-		exact[pn] = append(exact[pn], lot)
-	}
-	for key := range exact {
-		exact[key] = uniqueCaseInsensitive(exact[key])
-	}
-
-	exactLot := make(map[string]string, len(lots))
-	for _, l := range lots {
-		name := strings.TrimSpace(l.LotName)
-		if name == "" {
-			continue
-		}
-		exactLot[NormalizeKey(name)] = name
-	}
-
-	return &MappingMatcher{
-		exact:    exact,
-		exactLot: exactLot,
-		wildcard: wildcards,
-	}
-}
-
-func (r *LotResolver) Resolve(partnumber string) (string, string, error) {
-	key := NormalizeKey(partnumber)
-	if key == "" {
-		return "", "", ErrResolveNotFound
-	}
-
-	if mapped := r.partnumberToLots[key]; len(mapped) > 0 {
-		if len(mapped) == 1 {
-			return mapped[0], "mapping_table", nil
-		}
-		return "", "", ErrResolveConflict
-	}
-	if exact, ok := r.exactLots[key]; ok {
-		return exact, "article_exact", nil
-	}
-
-	best := ""
-	bestLen := -1
-	tie := false
-	for _, lot := range r.allLots {
-		lotKey := NormalizeKey(lot)
-		if lotKey == "" {
-			continue
-		}
-		if strings.HasPrefix(key, lotKey) {
-			l := len([]rune(lotKey))
-			if l > bestLen {
-				best = lot
-				bestLen = l
-				tie = false
-			} else if l == bestLen && !strings.EqualFold(best, lot) {
-				tie = true
-			}
-		}
-	}
-	if best == "" {
-		return "", "", ErrResolveNotFound
-	}
-	if tie {
-		return "", "", ErrResolveConflict
-	}
-	return best, "prefix", nil
-}
-
-func (m *MappingMatcher) MatchLots(partnumber string) []string {
-	if m == nil {
-		return nil
-	}
-	key := NormalizeKey(partnumber)
-	if key == "" {
-		return nil
-	}
-
-	lots := make([]string, 0, 2)
-	if exact := m.exact[key]; len(exact) > 0 {
-		lots = append(lots, exact...)
-	}
-	for _, wc := range m.wildcard {
-		if wc.re == nil || !wc.re.MatchString(key) {
-			continue
-		}
-		lots = append(lots, wc.lotName)
-	}
-	if lot, ok := m.exactLot[key]; ok && strings.TrimSpace(lot) != "" {
-		lots = append(lots, lot)
-	}
-	return uniqueCaseInsensitive(lots)
-}
-
-func NormalizeKey(v string) string {
-	s := strings.ToLower(strings.TrimSpace(v))
-	replacer := strings.NewReplacer(" ", "", "-", "", "_", "", ".", "", "/", "", "\\", "", "\"", "", "'", "", "(", "", ")", "")
-	return replacer.Replace(s)
-}
-
-func loadMappingsAndLots(db *gorm.DB) ([]models.LotPartnumber, []models.Lot, error) {
-	var mappings []models.LotPartnumber
-	if err := db.Find(&mappings).Error; err != nil {
-		return nil, nil, err
-	}
-	var lots []models.Lot
-	if err := db.Select("lot_name").Find(&lots).Error; err != nil {
-		return nil, nil, err
-	}
-	return mappings, lots, nil
-}
-
-func uniqueCaseInsensitive(values []string) []string {
-	seen := make(map[string]struct{}, len(values))
-	out := make([]string, 0, len(values))
-	for _, v := range values {
-		trimmed := strings.TrimSpace(v)
-		if trimmed == "" {
-			continue
-		}
-		key := strings.ToLower(trimmed)
-		if _, ok := seen[key]; ok {
-			continue
-		}
-		seen[key] = struct{}{}
-		out = append(out, trimmed)
-	}
-	sort.Slice(out, func(i, j int) bool {
-		return strings.ToLower(out[i]) < strings.ToLower(out[j])
-	})
-	return out
-}

internal/lotmatch/resolver_test.go

@@ -1,62 +0,0 @@
-package lotmatch
-
-import (
-	"testing"
-
-	"git.mchus.pro/mchus/quoteforge/internal/models"
-)
-
-func TestLotResolverPrecedence(t *testing.T) {
-	resolver := NewLotResolver(
-		[]models.LotPartnumber{
-			{Partnumber: "PN-1", LotName: "LOT_A"},
-		},
-		[]models.Lot{
-			{LotName: "CPU_X_LONG"},
-			{LotName: "CPU_X"},
-		},
-	)
-
-	lot, by, err := resolver.Resolve("PN-1")
-	if err != nil || lot != "LOT_A" || by != "mapping_table" {
-		t.Fatalf("expected mapping_table LOT_A, got lot=%s by=%s err=%v", lot, by, err)
-	}
-
-	lot, by, err = resolver.Resolve("CPU_X")
-	if err != nil || lot != "CPU_X" || by != "article_exact" {
-		t.Fatalf("expected article_exact CPU_X, got lot=%s by=%s err=%v", lot, by, err)
-	}
-
-	lot, by, err = resolver.Resolve("CPU_X_LONG_001")
-	if err != nil || lot != "CPU_X_LONG" || by != "prefix" {
-		t.Fatalf("expected prefix CPU_X_LONG, got lot=%s by=%s err=%v", lot, by, err)
-	}
-}
-
-func TestMappingMatcherWildcardAndExactLot(t *testing.T) {
-	matcher := NewMappingMatcher(
-		[]models.LotPartnumber{
-			{Partnumber: "R750*", LotName: "SERVER_R750"},
-			{Partnumber: "HDD-01", LotName: "HDD_01"},
-		},
-		[]models.Lot{
-			{LotName: "MEM_DDR5_16G_4800"},
-		},
-	)
-
-	check := func(partnumber string, want string) {
-		t.Helper()
-		got := matcher.MatchLots(partnumber)
-		if len(got) != 1 || got[0] != want {
-			t.Fatalf("partnumber %s: expected [%s], got %#v", partnumber, want, got)
-		}
-	}
-
-	check("R750XD", "SERVER_R750")
-	check("HDD-01", "HDD_01")
-	check("MEM_DDR5_16G_4800", "MEM_DDR5_16G_4800")
-
-	if got := matcher.MatchLots("UNKNOWN"); len(got) != 0 {
-		t.Fatalf("expected no matches for UNKNOWN, got %#v", got)
-	}
-}

internal/middleware/auth.go

@@ -1,110 +0,0 @@
-package middleware
-
-import (
-	"net/http"
-	"strings"
-
-	"git.mchus.pro/mchus/quoteforge/internal/models"
-	"git.mchus.pro/mchus/quoteforge/internal/services"
-	"github.com/gin-gonic/gin"
-)
-
-const (
-	AuthUserKey   = "auth_user"
-	AuthClaimsKey = "auth_claims"
-)
-
-func Auth(authService *services.AuthService) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		authHeader := c.GetHeader("Authorization")
-		if authHeader == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": "authorization header required",
-			})
-			return
-		}
-
-		parts := strings.SplitN(authHeader, " ", 2)
-		if len(parts) != 2 || parts[0] != "Bearer" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": "invalid authorization header format",
-			})
-			return
-		}
-
-		claims, err := authService.ValidateToken(parts[1])
-		if err != nil {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": err.Error(),
-			})
-			return
-		}
-
-		c.Set(AuthClaimsKey, claims)
-		c.Next()
-	}
-}
-
-func RequireRole(roles ...models.UserRole) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		claims, exists := c.Get(AuthClaimsKey)
-		if !exists {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
-				"error": "authentication required",
-			})
-			return
-		}
-
-		authClaims := claims.(*services.Claims)
-
-		for _, role := range roles {
-			if authClaims.Role == role {
-				c.Next()
-				return
-			}
-		}
-
-		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
-			"error": "insufficient permissions",
-		})
-	}
-}
-
-func RequireEditor() gin.HandlerFunc {
-	return RequireRole(models.RoleEditor, models.RolePricingAdmin, models.RoleAdmin)
-}
-
-func RequirePricingAdmin() gin.HandlerFunc {
-	return RequireRole(models.RolePricingAdmin, models.RoleAdmin)
-}
-
-func RequireAdmin() gin.HandlerFunc {
-	return RequireRole(models.RoleAdmin)
-}
-
-// GetClaims extracts auth claims from context
-func GetClaims(c *gin.Context) *services.Claims {
-	claims, exists := c.Get(AuthClaimsKey)
-	if !exists {
-		return nil
-	}
-	return claims.(*services.Claims)
-}
-
-// GetUserID extracts user ID from context
-func GetUserID(c *gin.Context) uint {
-	claims := GetClaims(c)
-	if claims == nil {
-		return 0
-	}
-	return claims.UserID
-}
-
-// GetUsername extracts username from context
-func GetUsername(c *gin.Context) string {
-	claims := GetClaims(c)
-	if claims == nil {
-		return ""
-	}
-	return claims.Username
-}

internal/models/alert.go

@@ -1,93 +0,0 @@
-package models
-
-import (
-	"database/sql/driver"
-	"encoding/json"
-	"errors"
-	"time"
-)
-
-type AlertType string
-
-const (
-	AlertHighDemandStalePrice AlertType = "high_demand_stale_price"
-	AlertPriceSpike           AlertType = "price_spike"
-	AlertPriceDrop            AlertType = "price_drop"
-	AlertNoRecentQuotes       AlertType = "no_recent_quotes"
-	AlertTrendingNoPrice      AlertType = "trending_no_price"
-)
-
-type AlertSeverity string
-
-const (
-	SeverityLow      AlertSeverity = "low"
-	SeverityMedium   AlertSeverity = "medium"
-	SeverityHigh     AlertSeverity = "high"
-	SeverityCritical AlertSeverity = "critical"
-)
-
-type AlertStatus string
-
-const (
-	AlertStatusNew          AlertStatus = "new"
-	AlertStatusAcknowledged AlertStatus = "acknowledged"
-	AlertStatusResolved     AlertStatus = "resolved"
-	AlertStatusIgnored      AlertStatus = "ignored"
-)
-
-type AlertDetails map[string]interface{}
-
-func (d AlertDetails) Value() (driver.Value, error) {
-	return json.Marshal(d)
-}
-
-func (d *AlertDetails) Scan(value interface{}) error {
-	if value == nil {
-		*d = make(AlertDetails)
-		return nil
-	}
-	bytes, ok := value.([]byte)
-	if !ok {
-		return errors.New("type assertion to []byte failed")
-	}
-	return json.Unmarshal(bytes, d)
-}
-
-type PricingAlert struct {
-	ID        uint          `gorm:"primaryKey;autoIncrement" json:"id"`
-	LotName   string        `gorm:"size:255;not null" json:"lot_name"`
-	AlertType AlertType     `gorm:"type:enum('high_demand_stale_price','price_spike','price_drop','no_recent_quotes','trending_no_price');not null" json:"alert_type"`
-	Severity  AlertSeverity `gorm:"type:enum('low','medium','high','critical');default:'medium'" json:"severity"`
-	Message   string        `gorm:"type:text;not null" json:"message"`
-	Details   AlertDetails  `gorm:"type:json" json:"details"`
-	Status    AlertStatus   `gorm:"type:enum('new','acknowledged','resolved','ignored');default:'new'" json:"status"`
-	CreatedAt time.Time     `gorm:"autoCreateTime" json:"created_at"`
-}
-
-func (PricingAlert) TableName() string {
-	return "qt_pricing_alerts"
-}
-
-type TrendDirection string
-
-const (
-	TrendUp     TrendDirection = "up"
-	TrendStable TrendDirection = "stable"
-	TrendDown   TrendDirection = "down"
-)
-
-type ComponentUsageStats struct {
-	LotName        string         `gorm:"column:lot_name;primaryKey;size:255" json:"lot_name"`
-	QuotesTotal    int            `gorm:"default:0" json:"quotes_total"`
-	QuotesLast30d  int            `gorm:"default:0" json:"quotes_last_30d"`
-	QuotesLast7d   int            `gorm:"default:0" json:"quotes_last_7d"`
-	TotalQuantity  int            `gorm:"default:0" json:"total_quantity"`
-	TotalRevenue   float64        `gorm:"type:decimal(14,2);default:0" json:"total_revenue"`
-	TrendDirection TrendDirection `gorm:"type:enum('up','stable','down');default:'stable'" json:"trend_direction"`
-	TrendPercent   float64        `gorm:"type:decimal(5,2);default:0" json:"trend_percent"`
-	LastUsedAt     *time.Time     `json:"last_used_at"`
-}
-
-func (ComponentUsageStats) TableName() string {
-	return "qt_component_usage_stats"
-}

internal/models/category.go

@@ -13,32 +13,32 @@ func (Category) TableName() string {
 	return "qt_categories"
 }
 
-// DefaultCategories defines the standard categories with display order
-// Order: BB, CPU, MEM, GPU, SSD, RAID, HBA, NIC, PSU, RISERS, ACC, and others
+// DefaultCategories defines the standard categories with display order.
+// Canonical order: MB, CPU, MEM, RAID, storage drives, PCIe GPU, PCIe NICs, HBA, PSU, accessories, other.
+// Display orders use gaps of 10 to allow future insertions without renumbering.
 var DefaultCategories = []Category{
-	{Code: "BB", Name: "Barebone", NameRu: "Шасси", DisplayOrder: 1, IsRequired: true},
-	{Code: "CPU", Name: "Processor", NameRu: "Процессор", DisplayOrder: 2, IsRequired: true},
-	{Code: "MEM", Name: "Memory", NameRu: "Оперативная память", DisplayOrder: 3, IsRequired: true},
-	{Code: "GPU", Name: "Graphics Card", NameRu: "Видеокарта", DisplayOrder: 4},
-	{Code: "SSD", Name: "SSD Storage", NameRu: "SSD накопитель", DisplayOrder: 5},
-	{Code: "RAID", Name: "RAID Controller", NameRu: "RAID контроллер", DisplayOrder: 6},
-	{Code: "HBA", Name: "HBA Adapter", NameRu: "HBA адаптер", DisplayOrder: 7},
-	{Code: "NIC", Name: "Network Card", NameRu: "Сетевая карта", DisplayOrder: 8},
-	{Code: "PSU", Name: "Power Supply", NameRu: "Блок питания", DisplayOrder: 9},
-	{Code: "RISERS", Name: "Risers", NameRu: "Райзеры", DisplayOrder: 10},
-	{Code: "ACC", Name: "Accessories", NameRu: "Аксессуары", DisplayOrder: 11},
-	// Additional categories
-	{Code: "MB", Name: "Motherboard", NameRu: "Материнская плата", DisplayOrder: 12},
-	{Code: "HDD", Name: "HDD Storage", NameRu: "HDD накопитель", DisplayOrder: 13},
-	{Code: "HCA", Name: "HCA Adapter", NameRu: "HCA адаптер", DisplayOrder: 14},
-	{Code: "DPU", Name: "DPU", NameRu: "DPU", DisplayOrder: 15},
-	{Code: "M2", Name: "M.2 Storage", NameRu: "M.2 накопитель", DisplayOrder: 16},
-	{Code: "EDSFF", Name: "EDSFF Storage", NameRu: "EDSFF накопитель", DisplayOrder: 17},
-	{Code: "HHHL", Name: "HHHL Storage", NameRu: "HHHL накопитель", DisplayOrder: 18},
-	{Code: "PS", Name: "Power Supply (Legacy)", NameRu: "Блок питания", DisplayOrder: 19},
-	{Code: "CARD", Name: "Cards", NameRu: "Карты", DisplayOrder: 20},
+	{Code: "MB", Name: "Motherboard", NameRu: "Материнская плата", DisplayOrder: 10},
+	{Code: "CPU", Name: "Processor", NameRu: "Процессор", DisplayOrder: 20, IsRequired: true},
+	{Code: "MEM", Name: "Memory", NameRu: "Оперативная память", DisplayOrder: 30, IsRequired: true},
+	{Code: "RAID", Name: "RAID Controller", NameRu: "RAID контроллер", DisplayOrder: 40},
+	{Code: "SSD", Name: "SSD Storage", NameRu: "SSD накопитель", DisplayOrder: 50},
+	{Code: "HDD", Name: "HDD Storage", NameRu: "HDD накопитель", DisplayOrder: 51},
+	{Code: "M2", Name: "M.2 Storage", NameRu: "M.2 накопитель", DisplayOrder: 52},
+	{Code: "EDSFF", Name: "EDSFF Storage", NameRu: "EDSFF накопитель", DisplayOrder: 53},
+	{Code: "HHHL", Name: "HHHL Storage", NameRu: "HHHL накопитель", DisplayOrder: 54},
+	{Code: "GPU", Name: "Graphics Card", NameRu: "Видеокарта", DisplayOrder: 60},
+	{Code: "NIC", Name: "Network Card", NameRu: "Сетевая карта", DisplayOrder: 70},
+	{Code: "HCA", Name: "HCA Adapter", NameRu: "HCA адаптер", DisplayOrder: 71},
+	{Code: "DPU", Name: "DPU", NameRu: "DPU", DisplayOrder: 72},
+	{Code: "HBA", Name: "HBA Adapter", NameRu: "HBA адаптер", DisplayOrder: 80},
+	{Code: "PSU", Name: "Power Supply", NameRu: "Блок питания", DisplayOrder: 90},
+	{Code: "PS", Name: "Power Supply (Legacy)", NameRu: "Блок питания", DisplayOrder: 91},
+	{Code: "ACC", Name: "Accessories", NameRu: "Аксессуары", DisplayOrder: 100},
+	{Code: "RISERS", Name: "Risers", NameRu: "Райзеры", DisplayOrder: 101},
+	{Code: "CARD", Name: "Cards", NameRu: "Карты", DisplayOrder: 110},
+	{Code: "BB", Name: "Barebone", NameRu: "Шасси", DisplayOrder: 120, IsRequired: true},
 }
 
-// MaxKnownDisplayOrder is the highest display order for known categories
-// New categories will get display order starting from this + 1
-const MaxKnownDisplayOrder = 100
+// MaxKnownDisplayOrder is the highest display order for known categories.
+// New categories will get display order starting from this + 1.
+const MaxKnownDisplayOrder = 200

internal/models/configuration.go

@@ -39,6 +39,57 @@ func (c ConfigItems) Total() float64 {
 	return total
 }
 
+type VendorSpecLotAllocation struct {
+	LotName  string `json:"lot_name"`
+	Quantity int    `json:"quantity"`
+}
+
+type VendorSpecLotMapping struct {
+	LotName       string `json:"lot_name"`
+	QuantityPerPN int    `json:"quantity_per_pn"`
+}
+
+type VendorSpecItem struct {
+	SortOrder           int                       `json:"sort_order"`
+	VendorPartnumber    string                    `json:"vendor_partnumber"`
+	Quantity            int                       `json:"quantity"`
+	Description         string                    `json:"description,omitempty"`
+	UnitPrice           *float64                  `json:"unit_price,omitempty"`
+	TotalPrice          *float64                  `json:"total_price,omitempty"`
+	ResolvedLotName     string                    `json:"resolved_lot_name,omitempty"`
+	ResolutionSource    string                    `json:"resolution_source,omitempty"`
+	ManualLotSuggestion string                    `json:"manual_lot_suggestion,omitempty"`
+	LotQtyPerPN         int                       `json:"lot_qty_per_pn,omitempty"`
+	LotAllocations      []VendorSpecLotAllocation `json:"lot_allocations,omitempty"`
+	LotMappings         []VendorSpecLotMapping    `json:"lot_mappings,omitempty"`
+}
+
+type VendorSpec []VendorSpecItem
+
+func (v VendorSpec) Value() (driver.Value, error) {
+	if v == nil {
+		return nil, nil
+	}
+	return json.Marshal(v)
+}
+
+func (v *VendorSpec) Scan(value interface{}) error {
+	if value == nil {
+		*v = nil
+		return nil
+	}
+	var bytes []byte
+	switch val := value.(type) {
+	case []byte:
+		bytes = val
+	case string:
+		bytes = []byte(val)
+	default:
+		return errors.New("type assertion failed for VendorSpec")
+	}
+	return json.Unmarshal(bytes, v)
+}
+
 type Configuration struct {
 	ID                    uint        `gorm:"primaryKey;autoIncrement" json:"id"`
 	UUID                  string      `gorm:"size:36;uniqueIndex;not null" json:"uuid"`
@@ -59,30 +110,17 @@ type Configuration struct {
 	PricelistID           *uint       `gorm:"index" json:"pricelist_id,omitempty"`
 	WarehousePricelistID  *uint       `gorm:"index" json:"warehouse_pricelist_id,omitempty"`
 	CompetitorPricelistID *uint       `gorm:"index" json:"competitor_pricelist_id,omitempty"`
+	VendorSpec            VendorSpec  `gorm:"type:json" json:"vendor_spec,omitempty"`
+	ConfigType            string      `gorm:"size:20;default:server" json:"config_type"` // "server" | "storage"
 	DisablePriceRefresh   bool        `gorm:"default:false" json:"disable_price_refresh"`
 	OnlyInStock           bool        `gorm:"default:false" json:"only_in_stock"`
+	Line                  int         `gorm:"column:line_no;index" json:"line"`
 	PriceUpdatedAt        *time.Time  `gorm:"type:timestamp" json:"price_updated_at,omitempty"`
 	CreatedAt             time.Time   `gorm:"autoCreateTime" json:"created_at"`
-
-	User *User `gorm:"foreignKey:UserID" json:"user,omitempty"`
+	CurrentVersionNo      int         `gorm:"-" json:"current_version_no,omitempty"`
 }
 
 func (Configuration) TableName() string {
 	return "qt_configurations"
 }
 
-type PriceOverride struct {
-	ID         uint       `gorm:"primaryKey;autoIncrement" json:"id"`
-	LotName    string     `gorm:"size:255;not null" json:"lot_name"`
-	Price      float64    `gorm:"type:decimal(12,2);not null" json:"price"`
-	ValidFrom  time.Time  `gorm:"type:date;not null" json:"valid_from"`
-	ValidUntil *time.Time `gorm:"type:date" json:"valid_until"`
-	Reason     string     `gorm:"type:text" json:"reason"`
-	CreatedBy  uint       `gorm:"not null" json:"created_by"`
-
-	Creator *User `gorm:"foreignKey:CreatedBy" json:"creator,omitempty"`
-}
-
-func (PriceOverride) TableName() string {
-	return "qt_price_overrides"
-}

internal/models/lot.go

@@ -1,7 +1,5 @@
 package models
 
-import "time"
-
 // Lot represents existing lot table
 type Lot struct {
 	LotName        string  `gorm:"column:lot_name;primaryKey;size:255" json:"lot_name"`
@@ -12,69 +10,3 @@ type Lot struct {
 func (Lot) TableName() string {
 	return "lot"
 }
-
-// LotLog represents existing lot_log table (READ-ONLY)
-type LotLog struct {
-	LotLogID uint      `gorm:"column:lot_log_id;primaryKey;autoIncrement"`
-	Lot      string    `gorm:"column:lot;size:255;not null"`
-	Supplier string    `gorm:"column:supplier;size:255;not null"`
-	Date     time.Time `gorm:"column:date;type:date;not null"`
-	Price    float64   `gorm:"column:price;not null"`
-	Quality  string    `gorm:"column:quality;size:255"`
-	Comments string    `gorm:"column:comments;size:15000"`
-}
-
-func (LotLog) TableName() string {
-	return "lot_log"
-}
-
-// Supplier represents existing supplier table (READ-ONLY)
-type Supplier struct {
-	SupplierName    string `gorm:"column:supplier_name;primaryKey;size:255"`
-	SupplierComment string `gorm:"column:supplier_comment;size:10000"`
-}
-
-func (Supplier) TableName() string {
-	return "supplier"
-}
-
-// StockLog stores warehouse stock snapshots imported from external files.
-type StockLog struct {
-	StockLogID uint      `gorm:"column:stock_log_id;primaryKey;autoIncrement"`
-	Partnumber string    `gorm:"column:partnumber;size:255;not null"`
-	Supplier   *string   `gorm:"column:supplier;size:255"`
-	Date       time.Time `gorm:"column:date;type:date;not null"`
-	Price      float64   `gorm:"column:price;not null"`
-	Quality    *string   `gorm:"column:quality;size:255"`
-	Comments   *string   `gorm:"column:comments;size:15000"`
-	Vendor     *string   `gorm:"column:vendor;size:255"`
-	Qty        *float64  `gorm:"column:qty"`
-}
-
-func (StockLog) TableName() string {
-	return "stock_log"
-}
-
-// LotPartnumber maps external part numbers to internal lots.
-type LotPartnumber struct {
-	Partnumber  string  `gorm:"column:partnumber;size:255;primaryKey" json:"partnumber"`
-	LotName     string  `gorm:"column:lot_name;size:255;primaryKey" json:"lot_name"`
-	Description *string `gorm:"column:description;size:10000" json:"description,omitempty"`
-}
-
-func (LotPartnumber) TableName() string {
-	return "lot_partnumbers"
-}
-
-// StockIgnoreRule contains import ignore pattern rules.
-type StockIgnoreRule struct {
-	ID        uint      `gorm:"column:id;primaryKey;autoIncrement" json:"id"`
-	Target    string    `gorm:"column:target;size:20;not null" json:"target"`         // partnumber|description
-	MatchType string    `gorm:"column:match_type;size:20;not null" json:"match_type"` // exact|prefix|suffix
-	Pattern   string    `gorm:"column:pattern;size:500;not null" json:"pattern"`
-	CreatedAt time.Time `gorm:"column:created_at;autoCreateTime" json:"created_at"`
-}
-
-func (StockIgnoreRule) TableName() string {
-	return "stock_ignore_rules"
-}

internal/models/models.go

@@ -10,14 +10,10 @@ import (
 // AllModels returns all models for auto-migration
 func AllModels() []interface{} {
 	return []interface{}{
-		&User{},
 		&Category{},
 		&LotMetadata{},
 		&Project{},
 		&Configuration{},
-		&PriceOverride{},
-		&PricingAlert{},
-		&ComponentUsageStats{},
 		&Pricelist{},
 		&PricelistItem{},
 	}
@@ -32,7 +28,9 @@ func Migrate(db *gorm.DB) error {
 			errStr := err.Error()
 			if strings.Contains(errStr, "Can't DROP") ||
 				strings.Contains(errStr, "Duplicate key name") ||
-				strings.Contains(errStr, "check that it exists") {
+				strings.Contains(errStr, "check that it exists") ||
+				strings.Contains(errStr, "Cannot change column") ||
+				strings.Contains(errStr, "used in a foreign key constraint") {
 				slog.Warn("migration warning (skipped)", "model", model, "error", errStr)
 				continue
 			}
@@ -42,64 +40,19 @@ func Migrate(db *gorm.DB) error {
 	return nil
 }
 
-// SeedCategories inserts default categories if not exist
+// SeedCategories upserts default categories, updating display_order on existing rows.
 func SeedCategories(db *gorm.DB) error {
 	for _, cat := range DefaultCategories {
-		result := db.Where("code = ?", cat.Code).FirstOrCreate(&cat)
-		if result.Error != nil {
-			return result.Error
+		var existing Category
+		if err := db.Where("code = ?", cat.Code).First(&existing).Error; err != nil {
+			if err := db.Create(&cat).Error; err != nil {
+				return err
+			}
+		} else {
+			if err := db.Model(&existing).Update("display_order", cat.DisplayOrder).Error; err != nil {
+				return err
+			}
 		}
 	}
 	return nil
 }
-
-// SeedAdminUser creates default admin user if not exists
-// Default credentials: admin / admin123
-func SeedAdminUser(db *gorm.DB, passwordHash string) error {
-	var count int64
-	db.Model(&User{}).Where("username = ?", "admin").Count(&count)
-	if count > 0 {
-		return nil
-	}
-
-	admin := &User{
-		Username:     "admin",
-		Email:        "admin@example.com",
-		PasswordHash: passwordHash,
-		Role:         RoleAdmin,
-		IsActive:     true,
-	}
-	return db.Create(admin).Error
-}
-
-// EnsureDBUser creates or returns the user corresponding to the database connection username.
-// This is used when RBAC is disabled - configurations are owned by the DB user.
-// Returns the user ID that should be used for all operations.
-func EnsureDBUser(db *gorm.DB, dbUsername string) (uint, error) {
-	if dbUsername == "" {
-		return 0, nil
-	}
-
-	var user User
-	err := db.Where("username = ?", dbUsername).First(&user).Error
-	if err == nil {
-		return user.ID, nil
-	}
-
-	// User doesn't exist, create it
-	user = User{
-		Username:     dbUsername,
-		Email:        dbUsername + "@db.local",
-		PasswordHash: "-", // No password - this is a DB user, not an app user
-		Role:         RoleAdmin,
-		IsActive:     true,
-	}
-
-	if err := db.Create(&user).Error; err != nil {
-		slog.Error("failed to create DB user", "username", dbUsername, "error", err)
-		return 0, err
-	}
-
-	slog.Info("created DB user for configurations", "username", dbUsername, "user_id", user.ID)
-	return user.ID, nil
-}

internal/models/project.go

@@ -6,7 +6,9 @@ type Project struct {
 	ID            uint      `gorm:"primaryKey;autoIncrement" json:"id"`
 	UUID          string    `gorm:"size:36;uniqueIndex;not null" json:"uuid"`
 	OwnerUsername string    `gorm:"size:100;not null;index" json:"owner_username"`
-	Name          string    `gorm:"size:200;not null" json:"name"`
+	Code          string    `gorm:"size:100;not null;index:idx_qt_projects_code_variant,priority:1" json:"code"`
+	Variant       string    `gorm:"size:100;not null;default:'';index:idx_qt_projects_code_variant,priority:2" json:"variant"`
+	Name          *string   `gorm:"size:200" json:"name,omitempty"`
 	TrackerURL    string    `gorm:"size:500" json:"tracker_url"`
 	IsActive      bool      `gorm:"default:true;index" json:"is_active"`
 	IsSystem      bool      `gorm:"default:false;index" json:"is_system"`

internal/models/qt_setting.go

@@ -0,0 +1,10 @@
+package models
+
+// QtSetting is the MariaDB-side model for qt_settings.
+// The table is managed by the server-side agent; QF only reads from it.
+type QtSetting struct {
+	Name  string `gorm:"primaryKey;size:100" json:"name"`
+	Value string `gorm:"type:text" json:"value"`
+}
+
+func (QtSetting) TableName() string { return "qt_settings" }

internal/models/user.go

@@ -1,39 +0,0 @@
-package models
-
-import "time"
-
-type UserRole string
-
-const (
-	RoleViewer       UserRole = "viewer"
-	RoleEditor       UserRole = "editor"
-	RolePricingAdmin UserRole = "pricing_admin"
-	RoleAdmin        UserRole = "admin"
-)
-
-type User struct {
-	ID           uint      `gorm:"primaryKey;autoIncrement" json:"id"`
-	Username     string    `gorm:"size:100;uniqueIndex;not null" json:"username"`
-	Email        string    `gorm:"size:255;uniqueIndex;not null" json:"email"`
-	PasswordHash string    `gorm:"size:255;not null" json:"-"`
-	Role         UserRole  `gorm:"type:enum('viewer','editor','pricing_admin','admin');default:'viewer'" json:"role"`
-	IsActive     bool      `gorm:"default:true" json:"is_active"`
-	CreatedAt    time.Time `gorm:"autoCreateTime" json:"created_at"`
-	UpdatedAt    time.Time `gorm:"autoUpdateTime" json:"updated_at"`
-}
-
-func (User) TableName() string {
-	return "qt_users"
-}
-
-func (u *User) CanEdit() bool {
-	return u.Role == RoleEditor || u.Role == RolePricingAdmin || u.Role == RoleAdmin
-}
-
-func (u *User) CanManagePricing() bool {
-	return u.Role == RolePricingAdmin || u.Role == RoleAdmin
-}
-
-func (u *User) CanManageUsers() bool {
-	return u.Role == RoleAdmin
-}

internal/repository/alert.go

@@ -1,91 +0,0 @@
-package repository
-
-import (
-	"git.mchus.pro/mchus/quoteforge/internal/models"
-	"gorm.io/gorm"
-)
-
-type AlertRepository struct {
-	db *gorm.DB
-}
-
-func NewAlertRepository(db *gorm.DB) *AlertRepository {
-	return &AlertRepository{db: db}
-}
-
-func (r *AlertRepository) Create(alert *models.PricingAlert) error {
-	return r.db.Create(alert).Error
-}
-
-func (r *AlertRepository) GetByID(id uint) (*models.PricingAlert, error) {
-	var alert models.PricingAlert
-	err := r.db.First(&alert, id).Error
-	if err != nil {
-		return nil, err
-	}
-	return &alert, nil
-}
-
-func (r *AlertRepository) Update(alert *models.PricingAlert) error {
-	return r.db.Save(alert).Error
-}
-
-type AlertFilter struct {
-	Status   models.AlertStatus
-	Severity models.AlertSeverity
-	Type     models.AlertType
-	LotName  string
-}
-
-func (r *AlertRepository) List(filter AlertFilter, offset, limit int) ([]models.PricingAlert, int64, error) {
-	var alerts []models.PricingAlert
-	var total int64
-
-	query := r.db.Model(&models.PricingAlert{})
-
-	if filter.Status != "" {
-		query = query.Where("status = ?", filter.Status)
-	}
-	if filter.Severity != "" {
-		query = query.Where("severity = ?", filter.Severity)
-	}
-	if filter.Type != "" {
-		query = query.Where("alert_type = ?", filter.Type)
-	}
-	if filter.LotName != "" {
-		query = query.Where("lot_name = ?", filter.LotName)
-	}
-
-	query.Count(&total)
-
-	err := query.
-		Order("FIELD(severity, 'critical', 'high', 'medium', 'low')").
-		Order("created_at DESC").
-		Offset(offset).
-		Limit(limit).
-		Find(&alerts).Error
-
-	return alerts, total, err
-}
-
-func (r *AlertRepository) CountByStatus(status models.AlertStatus) (int64, error) {
-	var count int64
-	err := r.db.Model(&models.PricingAlert{}).
-		Where("status = ?", status).
-		Count(&count).Error
-	return count, err
-}
-
-func (r *AlertRepository) UpdateStatus(id uint, status models.AlertStatus) error {
-	return r.db.Model(&models.PricingAlert{}).
-		Where("id = ?", id).
-		Update("status", status).Error
-}
-
-func (r *AlertRepository) ExistsByLotAndType(lotName string, alertType models.AlertType) (bool, error) {
-	var count int64
-	err := r.db.Model(&models.PricingAlert{}).
-		Where("lot_name = ? AND alert_type = ? AND status IN ('new', 'acknowledged')", lotName, alertType).
-		Count(&count).Error
-	return count > 0, err
-}

internal/repository/component.go

@@ -63,11 +63,6 @@ func (r *ComponentRepository) List(filter ComponentFilter, offset, limit int) ([
 			Order("current_price " + sortDir)
 	case "lot_name":
 		query = query.Order("lot_name " + sortDir)
-	case "quote_count":
-		// Sort by quote count from lot_log table
-		query = query.
-			Select("qt_lot_metadata.*, (SELECT COUNT(*) FROM lot_log WHERE lot_log.lot = qt_lot_metadata.lot_name) as quote_count_sort").
-			Order("quote_count_sort " + sortDir)
 	default:
 		// Default: sort by popularity, no price goes last
 		query = query.

internal/repository/configuration.go

@@ -1,6 +1,8 @@
 package repository
 
 import (
+	"strings"
+
 	"git.mchus.pro/mchus/quoteforge/internal/models"
 	"gorm.io/gorm"
 )
@@ -14,7 +16,13 @@ func NewConfigurationRepository(db *gorm.DB) *ConfigurationRepository {
 }
 
 func (r *ConfigurationRepository) Create(config *models.Configuration) error {
-	return r.db.Create(config).Error
+	if err := r.db.Create(config).Error; err != nil {
+		if isUnknownLineNoColumnError(err) {
+			return r.db.Omit("line_no").Create(config).Error
+		}
+		return err
+	}
+	return nil
 }
 
 func (r *ConfigurationRepository) GetByID(id uint) (*models.Configuration, error) {
@@ -36,7 +44,21 @@ func (r *ConfigurationRepository) GetByUUID(uuid string) (*models.Configuration,
 }
 
 func (r *ConfigurationRepository) Update(config *models.Configuration) error {
-	return r.db.Save(config).Error
+	if err := r.db.Save(config).Error; err != nil {
+		if isUnknownLineNoColumnError(err) {
+			return r.db.Omit("line_no").Save(config).Error
+		}
+		return err
+	}
+	return nil
+}
+
+func isUnknownLineNoColumnError(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "unknown column 'line_no'") || strings.Contains(msg, "no column named line_no")
 }
 
 func (r *ConfigurationRepository) Delete(id uint) error {

internal/repository/partnumber_book.go

@@ -0,0 +1,174 @@
+package repository
+
+import (
+	"git.mchus.pro/mchus/quoteforge/internal/localdb"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+// PartnumberBookRepository provides read-only access to local partnumber book snapshots.
+type PartnumberBookRepository struct {
+	db *gorm.DB
+}
+
+func NewPartnumberBookRepository(db *gorm.DB) *PartnumberBookRepository {
+	return &PartnumberBookRepository{db: db}
+}
+
+// GetActiveBook returns the most recently active local partnumber book.
+func (r *PartnumberBookRepository) GetActiveBook() (*localdb.LocalPartnumberBook, error) {
+	var book localdb.LocalPartnumberBook
+	err := r.db.Where("is_active = 1").Order("created_at DESC, id DESC").First(&book).Error
+	if err != nil {
+		return nil, err
+	}
+	return &book, nil
+}
+
+// GetBookItems returns all items for the given local book ID.
+func (r *PartnumberBookRepository) GetBookItems(bookID uint) ([]localdb.LocalPartnumberBookItem, error) {
+	book, err := r.getBook(bookID)
+	if err != nil {
+		return nil, err
+	}
+	items, _, err := r.listCatalogItems(book.PartnumbersJSON, "", 0, 0)
+	return items, err
+}
+
+// GetBookItemsPage returns items for the given local book ID with optional search and pagination.
+func (r *PartnumberBookRepository) GetBookItemsPage(bookID uint, search string, page, perPage int) ([]localdb.LocalPartnumberBookItem, int64, error) {
+	if page < 1 {
+		page = 1
+	}
+	if perPage < 1 {
+		perPage = 100
+	}
+
+	book, err := r.getBook(bookID)
+	if err != nil {
+		return nil, 0, err
+	}
+	return r.listCatalogItems(book.PartnumbersJSON, search, page, perPage)
+}
+
+// FindLotByPartnumber looks up a partnumber in the active book and returns the matching items.
+func (r *PartnumberBookRepository) FindLotByPartnumber(bookID uint, partnumber string) ([]localdb.LocalPartnumberBookItem, error) {
+	book, err := r.getBook(bookID)
+	if err != nil {
+		return nil, err
+	}
+	found := false
+	for _, pn := range book.PartnumbersJSON {
+		if pn == partnumber {
+			found = true
+			break
+		}
+	}
+	if !found {
+		return nil, nil
+	}
+	var items []localdb.LocalPartnumberBookItem
+	err = r.db.Where("partnumber = ?", partnumber).Find(&items).Error
+	return items, err
+}
+
+// ListBooks returns all local partnumber books ordered newest first.
+func (r *PartnumberBookRepository) ListBooks() ([]localdb.LocalPartnumberBook, error) {
+	var books []localdb.LocalPartnumberBook
+	err := r.db.Order("created_at DESC, id DESC").Find(&books).Error
+	return books, err
+}
+
+// SaveBook saves a new partnumber book snapshot.
+func (r *PartnumberBookRepository) SaveBook(book *localdb.LocalPartnumberBook) error {
+	return r.db.Save(book).Error
+}
+
+// SaveBookItems upserts canonical PN catalog rows.
+func (r *PartnumberBookRepository) SaveBookItems(items []localdb.LocalPartnumberBookItem) error {
+	if len(items) == 0 {
+		return nil
+	}
+	return r.db.Clauses(clause.OnConflict{
+		Columns: []clause.Column{{Name: "partnumber"}},
+		DoUpdates: clause.AssignmentColumns([]string{
+			"lots_json",
+			"description",
+		}),
+	}).CreateInBatches(items, 500).Error
+}
+
+// CountBookItems returns the number of items for a given local book ID.
+func (r *PartnumberBookRepository) CountBookItems(bookID uint) int64 {
+	book, err := r.getBook(bookID)
+	if err != nil {
+		return 0
+	}
+	return int64(len(book.PartnumbersJSON))
+}
+
+func (r *PartnumberBookRepository) CountDistinctLots(bookID uint) int64 {
+	items, err := r.GetBookItems(bookID)
+	if err != nil {
+		return 0
+	}
+	seen := make(map[string]struct{})
+	for _, item := range items {
+		for _, lot := range item.LotsJSON {
+			if lot.LotName == "" {
+				continue
+			}
+			seen[lot.LotName] = struct{}{}
+		}
+	}
+	return int64(len(seen))
+}
+
+func (r *PartnumberBookRepository) HasAllBookItems(bookID uint) bool {
+	book, err := r.getBook(bookID)
+	if err != nil {
+		return false
+	}
+	if len(book.PartnumbersJSON) == 0 {
+		return true
+	}
+	var count int64
+	if err := r.db.Model(&localdb.LocalPartnumberBookItem{}).
+		Where("partnumber IN ?", []string(book.PartnumbersJSON)).
+		Count(&count).Error; err != nil {
+		return false
+	}
+	return count == int64(len(book.PartnumbersJSON))
+}
+
+func (r *PartnumberBookRepository) getBook(bookID uint) (*localdb.LocalPartnumberBook, error) {
+	var book localdb.LocalPartnumberBook
+	if err := r.db.First(&book, bookID).Error; err != nil {
+		return nil, err
+	}
+	return &book, nil
+}
+
+func (r *PartnumberBookRepository) listCatalogItems(partnumbers localdb.LocalStringList, search string, page, perPage int) ([]localdb.LocalPartnumberBookItem, int64, error) {
+	if len(partnumbers) == 0 {
+		return []localdb.LocalPartnumberBookItem{}, 0, nil
+	}
+
+	query := r.db.Model(&localdb.LocalPartnumberBookItem{}).Where("partnumber IN ?", []string(partnumbers))
+	if search != "" {
+		trimmedSearch := "%" + search + "%"
+		query = query.Where("partnumber LIKE ? OR CAST(lots_json AS TEXT) LIKE ? OR description LIKE ?", trimmedSearch, trimmedSearch, trimmedSearch)
+	}
+
+	var total int64
+	if err := query.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+
+	var items []localdb.LocalPartnumberBookItem
+	if page > 0 && perPage > 0 {
+		query = query.Offset((page - 1) * perPage).Limit(perPage)
+	}
+	err := query.Order("partnumber ASC, id ASC").Find(&items).Error
+	return items, total, err
+}

internal/repository/price.go

@@ -1,124 +0,0 @@
-package repository
-
-import (
-	"time"
-
-	"git.mchus.pro/mchus/quoteforge/internal/models"
-	"gorm.io/gorm"
-)
-
-type PriceRepository struct {
-	db *gorm.DB
-}
-
-func NewPriceRepository(db *gorm.DB) *PriceRepository {
-	return &PriceRepository{db: db}
-}
-
-type PricePoint struct {
-	Price float64
-	Date  time.Time
-}
-
-// GetPriceHistory returns price history from lot_log for a component
-func (r *PriceRepository) GetPriceHistory(lotName string, periodDays int) ([]PricePoint, error) {
-	var points []PricePoint
-	since := time.Now().AddDate(0, 0, -periodDays)
-
-	err := r.db.Model(&models.LotLog{}).
-		Select("price, date").
-		Where("lot = ? AND date >= ?", lotName, since).
-		Order("date DESC").
-		Scan(&points).Error
-
-	return points, err
-}
-
-// GetLatestPrice returns the most recent price for a component
-func (r *PriceRepository) GetLatestPrice(lotName string) (*PricePoint, error) {
-	var point PricePoint
-	err := r.db.Model(&models.LotLog{}).
-		Select("price, date").
-		Where("lot = ?", lotName).
-		Order("date DESC").
-		First(&point).Error
-	if err != nil {
-		return nil, err
-	}
-	return &point, nil
-}
-
-// GetPriceOverride returns active override for a component
-func (r *PriceRepository) GetPriceOverride(lotName string) (*models.PriceOverride, error) {
-	var override models.PriceOverride
-	today := time.Now().Truncate(24 * time.Hour)
-
-	err := r.db.
-		Where("lot_name = ?", lotName).
-		Where("valid_from <= ?", today).
-		Where("valid_until IS NULL OR valid_until >= ?", today).
-		Order("valid_from DESC").
-		First(&override).Error
-
-	if err != nil {
-		return nil, err
-	}
-	return &override, nil
-}
-
-// CreatePriceOverride creates a new price override
-func (r *PriceRepository) CreatePriceOverride(override *models.PriceOverride) error {
-	return r.db.Create(override).Error
-}
-
-// GetPriceOverrides returns all overrides for a component
-func (r *PriceRepository) GetPriceOverrides(lotName string) ([]models.PriceOverride, error) {
-	var overrides []models.PriceOverride
-	err := r.db.
-		Where("lot_name = ?", lotName).
-		Order("valid_from DESC").
-		Find(&overrides).Error
-	return overrides, err
-}
-
-// DeletePriceOverride deletes an override
-func (r *PriceRepository) DeletePriceOverride(id uint) error {
-	return r.db.Delete(&models.PriceOverride{}, id).Error
-}
-
-// GetQuoteCount returns the number of quotes in lot_log for a period
-func (r *PriceRepository) GetQuoteCount(lotName string, periodDays int) (int64, error) {
-	var count int64
-	since := time.Now().AddDate(0, 0, -periodDays)
-
-	err := r.db.Model(&models.LotLog{}).
-		Where("lot = ? AND date >= ?", lotName, since).
-		Count(&count).Error
-
-	return count, err
-}
-
-// GetQuoteCounts returns quote counts for multiple lot names
-func (r *PriceRepository) GetQuoteCounts(lotNames []string) (map[string]int64, error) {
-	type Result struct {
-		Lot   string
-		Count int64
-	}
-	var results []Result
-
-	err := r.db.Model(&models.LotLog{}).
-		Select("lot, COUNT(*) as count").
-		Where("lot IN ?", lotNames).
-		Group("lot").
-		Scan(&results).Error
-
-	if err != nil {
-		return nil, err
-	}
-
-	counts := make(map[string]int64)
-	for _, r := range results {
-		counts[r.Lot] = r.Count
-	}
-	return counts, nil
-}

internal/repository/pricelist.go

@@ -3,12 +3,10 @@ package repository
 import (
 	"errors"
 	"fmt"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
 
-	"git.mchus.pro/mchus/quoteforge/internal/lotmatch"
 	"git.mchus.pro/mchus/quoteforge/internal/models"
 	"gorm.io/gorm"
 )
@@ -40,7 +38,7 @@ func (r *PricelistRepository) ListBySource(source string, offset, limit int) ([]
 	}
 
 	var pricelists []models.Pricelist
-	if err := query.Order("created_at DESC").Offset(offset).Limit(limit).Find(&pricelists).Error; err != nil {
+	if err := query.Order("created_at DESC, id DESC").Offset(offset).Limit(limit).Find(&pricelists).Error; err != nil {
 		return nil, 0, fmt.Errorf("listing pricelists: %w", err)
 	}
 
@@ -67,7 +65,7 @@ func (r *PricelistRepository) ListActiveBySource(source string, offset, limit in
 	}
 
 	var pricelists []models.Pricelist
-	if err := query.Order("created_at DESC").Offset(offset).Limit(limit).Find(&pricelists).Error; err != nil {
+	if err := query.Order("created_at DESC, id DESC").Offset(offset).Limit(limit).Find(&pricelists).Error; err != nil {
 		return nil, 0, fmt.Errorf("listing active pricelists: %w", err)
 	}
 
@@ -148,7 +146,11 @@ func (r *PricelistRepository) GetLatestActive() (*models.Pricelist, error) {
 // GetLatestActiveBySource returns the most recent active pricelist by source.
 func (r *PricelistRepository) GetLatestActiveBySource(source string) (*models.Pricelist, error) {
 	var pricelist models.Pricelist
-	if err := r.db.Where("is_active = ? AND source = ?", true, source).Order("created_at DESC").First(&pricelist).Error; err != nil {
+	if err := r.db.
+		Where("is_active = ? AND source = ?", true, source).
+		Where("EXISTS (SELECT 1 FROM qt_pricelist_items WHERE qt_pricelist_items.pricelist_id = qt_pricelists.id)").
+		Order("created_at DESC, id DESC").
+		First(&pricelist).Error; err != nil {
 		return nil, fmt.Errorf("getting latest pricelist: %w", err)
 	}
 	return &pricelist, nil
@@ -241,91 +243,9 @@ func (r *PricelistRepository) GetItems(pricelistID uint, offset, limit int, sear
 		items[i].Category = strings.TrimSpace(items[i].LotCategory)
 	}
 
-	if err := r.enrichItemsWithStock(items); err != nil {
-		return nil, 0, fmt.Errorf("enriching pricelist items with stock: %w", err)
-	}
-
 	return items, total, nil
 }
 
-func (r *PricelistRepository) enrichItemsWithStock(items []models.PricelistItem) error {
-	if len(items) == 0 {
-		return nil
-	}
-
-	resolver, err := lotmatch.NewLotResolverFromDB(r.db)
-	if err != nil {
-		return err
-	}
-
-	type stockRow struct {
-		Partnumber string   `gorm:"column:partnumber"`
-		Qty        *float64 `gorm:"column:qty"`
-	}
-	rows := make([]stockRow, 0)
-	if err := r.db.Raw(`
-		SELECT s.partnumber, s.qty
-		FROM stock_log s
-		INNER JOIN (
-			SELECT partnumber, MAX(date) AS max_date
-			FROM stock_log
-			GROUP BY partnumber
-		) latest ON latest.partnumber = s.partnumber AND latest.max_date = s.date
-		WHERE s.qty IS NOT NULL
-	`).Scan(&rows).Error; err != nil {
-		return err
-	}
-
-	lotTotals := make(map[string]float64, len(items))
-	lotPartnumbers := make(map[string][]string, len(items))
-	seenPartnumbers := make(map[string]map[string]struct{}, len(items))
-
-	for i := range rows {
-		row := rows[i]
-		if strings.TrimSpace(row.Partnumber) == "" {
-			continue
-		}
-		lotName, _, resolveErr := resolver.Resolve(row.Partnumber)
-		if resolveErr != nil || strings.TrimSpace(lotName) == "" {
-			continue
-		}
-
-		if row.Qty != nil {
-			lotTotals[lotName] += *row.Qty
-		}
-
-		pn := strings.TrimSpace(row.Partnumber)
-		if pn == "" {
-			continue
-		}
-		if _, ok := seenPartnumbers[lotName]; !ok {
-			seenPartnumbers[lotName] = make(map[string]struct{}, 4)
-		}
-		key := strings.ToLower(pn)
-		if _, exists := seenPartnumbers[lotName][key]; exists {
-			continue
-		}
-		seenPartnumbers[lotName][key] = struct{}{}
-		lotPartnumbers[lotName] = append(lotPartnumbers[lotName], pn)
-	}
-
-	for i := range items {
-		lotName := items[i].LotName
-		if qty, ok := lotTotals[lotName]; ok {
-			qtyCopy := qty
-			items[i].AvailableQty = &qtyCopy
-		}
-		if partnumbers := lotPartnumbers[lotName]; len(partnumbers) > 0 {
-			sort.Slice(partnumbers, func(a, b int) bool {
-				return strings.ToLower(partnumbers[a]) < strings.ToLower(partnumbers[b])
-			})
-			items[i].Partnumbers = partnumbers
-		}
-	}
-
-	return nil
-}
-
 // GetLotNames returns distinct lot names from pricelist items.
 func (r *PricelistRepository) GetLotNames(pricelistID uint) ([]string, error) {
 	var lotNames []string

internal/repository/pricelist_test.go

@@ -75,54 +75,98 @@ func TestGenerateVersion_IsolatedBySource(t *testing.T) {
 	}
 }
 
-func TestGetItems_WarehouseAvailableQtyUsesPrefixResolver(t *testing.T) {
+func TestGetLatestActiveBySource_SkipsPricelistsWithoutItems(t *testing.T) {
 	repo := newTestPricelistRepository(t)
 	db := repo.db
+	ts := time.Now().Add(-time.Minute)
+	source := "test-estimate-skip-empty"
 
-	warehouse := models.Pricelist{
-		Source:    string(models.PricelistSourceWarehouse),
-		Version:   "S-2026-02-07-001",
+	emptyLatest := models.Pricelist{
+		Source:    source,
+		Version:   "E-empty",
 		CreatedBy: "test",
 		IsActive:  true,
+		CreatedAt: ts.Add(2 * time.Second),
 	}
-	if err := db.Create(&warehouse).Error; err != nil {
-		t.Fatalf("create pricelist: %v", err)
+	if err := db.Create(&emptyLatest).Error; err != nil {
+		t.Fatalf("create empty pricelist: %v", err)
+	}
+
+	withItems := models.Pricelist{
+		Source:    source,
+		Version:   "E-with-items",
+		CreatedBy: "test",
+		IsActive:  true,
+		CreatedAt: ts,
+	}
+	if err := db.Create(&withItems).Error; err != nil {
+		t.Fatalf("create pricelist with items: %v", err)
 	}
 	if err := db.Create(&models.PricelistItem{
-		PricelistID: warehouse.ID,
-		LotName:     "SSD_NVME_03.2T",
+		PricelistID: withItems.ID,
+		LotName:     "CPU_A",
 		Price:       100,
 	}).Error; err != nil {
 		t.Fatalf("create pricelist item: %v", err)
 	}
-	if err := db.Create(&models.Lot{LotName: "SSD_NVME_03.2T"}).Error; err != nil {
-		t.Fatalf("create lot: %v", err)
+
+	got, err := repo.GetLatestActiveBySource(source)
+	if err != nil {
+		t.Fatalf("GetLatestActiveBySource: %v", err)
 	}
-	qty := 5.0
-	if err := db.Create(&models.StockLog{
-		Partnumber: "SSD_NVME_03.2T_GEN3_P4610",
-		Date:       time.Now(),
-		Price:      200,
-		Qty:        &qty,
+	if got.ID != withItems.ID {
+		t.Fatalf("expected pricelist with items id=%d, got id=%d", withItems.ID, got.ID)
+	}
+}
+
+func TestGetLatestActiveBySource_TieBreaksByID(t *testing.T) {
+	repo := newTestPricelistRepository(t)
+	db := repo.db
+	ts := time.Now().Add(-time.Minute)
+	source := "test-warehouse-tie-break"
+
+	first := models.Pricelist{
+		Source:    source,
+		Version:   "S-1",
+		CreatedBy: "test",
+		IsActive:  true,
+		CreatedAt: ts,
+	}
+	if err := db.Create(&first).Error; err != nil {
+		t.Fatalf("create first pricelist: %v", err)
+	}
+	if err := db.Create(&models.PricelistItem{
+		PricelistID: first.ID,
+		LotName:     "CPU_A",
+		Price:       101,
 	}).Error; err != nil {
-		t.Fatalf("create stock log: %v", err)
+		t.Fatalf("create first item: %v", err)
 	}
 
-	items, total, err := repo.GetItems(warehouse.ID, 0, 20, "")
+	second := models.Pricelist{
+		Source:    source,
+		Version:   "S-2",
+		CreatedBy: "test",
+		IsActive:  true,
+		CreatedAt: ts,
+	}
+	if err := db.Create(&second).Error; err != nil {
+		t.Fatalf("create second pricelist: %v", err)
+	}
+	if err := db.Create(&models.PricelistItem{
+		PricelistID: second.ID,
+		LotName:     "CPU_A",
+		Price:       102,
+	}).Error; err != nil {
+		t.Fatalf("create second item: %v", err)
+	}
+
+	got, err := repo.GetLatestActiveBySource(source)
 	if err != nil {
-		t.Fatalf("GetItems: %v", err)
+		t.Fatalf("GetLatestActiveBySource: %v", err)
 	}
-	if total != 1 {
-		t.Fatalf("expected total=1, got %d", total)
-	}
-	if len(items) != 1 {
-		t.Fatalf("expected 1 item, got %d", len(items))
-	}
-	if items[0].AvailableQty == nil {
-		t.Fatalf("expected available qty to be set")
-	}
-	if *items[0].AvailableQty != 5 {
-		t.Fatalf("expected available qty=5, got %v", *items[0].AvailableQty)
+	if got.ID != second.ID {
+		t.Fatalf("expected later inserted pricelist id=%d, got id=%d", second.ID, got.ID)
 	}
 }
 
@@ -133,7 +177,7 @@ func newTestPricelistRepository(t *testing.T) *PricelistRepository {
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	if err := db.AutoMigrate(&models.Pricelist{}, &models.PricelistItem{}, &models.Lot{}, &models.LotPartnumber{}, &models.StockLog{}); err != nil {
+	if err := db.AutoMigrate(&models.Pricelist{}, &models.PricelistItem{}, &models.Lot{}); err != nil {
 		t.Fatalf("migrate: %v", err)
 	}
 	return NewPricelistRepository(db)

internal/repository/project.go

@@ -27,6 +27,8 @@ func (r *ProjectRepository) UpsertByUUID(project *models.Project) error {
 		Columns: []clause.Column{{Name: "uuid"}},
 		DoUpdates: clause.AssignmentColumns([]string{
 			"owner_username",
+			"code",
+			"variant",
 			"name",
 			"tracker_url",
 			"is_active",

internal/repository/stats.go

@@ -1,115 +0,0 @@
-package repository
-
-import (
-	"time"
-
-	"git.mchus.pro/mchus/quoteforge/internal/models"
-	"gorm.io/gorm"
-)
-
-type StatsRepository struct {
-	db *gorm.DB
-}
-
-func NewStatsRepository(db *gorm.DB) *StatsRepository {
-	return &StatsRepository{db: db}
-}
-
-func (r *StatsRepository) GetByLotName(lotName string) (*models.ComponentUsageStats, error) {
-	var stats models.ComponentUsageStats
-	err := r.db.Where("lot_name = ?", lotName).First(&stats).Error
-	if err != nil {
-		return nil, err
-	}
-	return &stats, nil
-}
-
-func (r *StatsRepository) Upsert(stats *models.ComponentUsageStats) error {
-	return r.db.Save(stats).Error
-}
-
-func (r *StatsRepository) IncrementUsage(lotName string, quantity int, revenue float64) error {
-	now := time.Now()
-
-	result := r.db.Model(&models.ComponentUsageStats{}).
-		Where("lot_name = ?", lotName).
-		Updates(map[string]interface{}{
-			"quotes_total":    gorm.Expr("quotes_total + 1"),
-			"quotes_last_30d": gorm.Expr("quotes_last_30d + 1"),
-			"quotes_last_7d":  gorm.Expr("quotes_last_7d + 1"),
-			"total_quantity":  gorm.Expr("total_quantity + ?", quantity),
-			"total_revenue":   gorm.Expr("total_revenue + ?", revenue),
-			"last_used_at":    now,
-		})
-
-	if result.RowsAffected == 0 {
-		stats := &models.ComponentUsageStats{
-			LotName:       lotName,
-			QuotesTotal:   1,
-			QuotesLast30d: 1,
-			QuotesLast7d:  1,
-			TotalQuantity: quantity,
-			TotalRevenue:  revenue,
-			LastUsedAt:    &now,
-		}
-		return r.db.Create(stats).Error
-	}
-
-	return result.Error
-}
-
-func (r *StatsRepository) GetTopComponents(limit int) ([]models.ComponentUsageStats, error) {
-	var stats []models.ComponentUsageStats
-	err := r.db.
-		Order("quotes_last_30d DESC").
-		Limit(limit).
-		Find(&stats).Error
-	return stats, err
-}
-
-func (r *StatsRepository) GetTrendingComponents(limit int) ([]models.ComponentUsageStats, error) {
-	var stats []models.ComponentUsageStats
-	err := r.db.
-		Where("trend_direction = ? AND trend_percent > ?", models.TrendUp, 20).
-		Order("trend_percent DESC").
-		Limit(limit).
-		Find(&stats).Error
-	return stats, err
-}
-
-// ResetWeeklyCounters resets quotes_last_7d (run weekly via cron)
-func (r *StatsRepository) ResetWeeklyCounters() error {
-	return r.db.Model(&models.ComponentUsageStats{}).
-		Where("1 = 1").
-		Update("quotes_last_7d", 0).Error
-}
-
-// ResetMonthlyCounters resets quotes_last_30d (run monthly via cron)
-func (r *StatsRepository) ResetMonthlyCounters() error {
-	return r.db.Model(&models.ComponentUsageStats{}).
-		Where("1 = 1").
-		Update("quotes_last_30d", 0).Error
-}
-
-// UpdatePopularityScores recalculates popularity_score in qt_lot_metadata
-// based on supplier quotes from lot_log table
-func (r *StatsRepository) UpdatePopularityScores() error {
-	// Formula: popularity_score = quotes_last_30d * 3 + quotes_last_90d * 1 + quotes_total * 0.1
-	// This gives more weight to recent supplier activity
-	return r.db.Exec(`
-		UPDATE qt_lot_metadata m
-		LEFT JOIN (
-			SELECT
-				lot,
-				COUNT(*) as quotes_total,
-				SUM(CASE WHEN date >= DATE_SUB(NOW(), INTERVAL 30 DAY) THEN 1 ELSE 0 END) as quotes_last_30d,
-				SUM(CASE WHEN date >= DATE_SUB(NOW(), INTERVAL 90 DAY) THEN 1 ELSE 0 END) as quotes_last_90d
-			FROM lot_log
-			GROUP BY lot
-		) s ON m.lot_name = s.lot
-		SET m.popularity_score = COALESCE(
-			s.quotes_last_30d * 3 + s.quotes_last_90d * 1 + s.quotes_total * 0.1,
-			0
-		)
-	`).Error
-}

internal/repository/user.go

@@ -1,62 +0,0 @@
-package repository
-
-import (
-	"git.mchus.pro/mchus/quoteforge/internal/models"
-	"gorm.io/gorm"
-)
-
-type UserRepository struct {
-	db *gorm.DB
-}
-
-func NewUserRepository(db *gorm.DB) *UserRepository {
-	return &UserRepository{db: db}
-}
-
-func (r *UserRepository) Create(user *models.User) error {
-	return r.db.Create(user).Error
-}
-
-func (r *UserRepository) GetByID(id uint) (*models.User, error) {
-	var user models.User
-	err := r.db.First(&user, id).Error
-	if err != nil {
-		return nil, err
-	}
-	return &user, nil
-}
-
-func (r *UserRepository) GetByUsername(username string) (*models.User, error) {
-	var user models.User
-	err := r.db.Where("username = ?", username).First(&user).Error
-	if err != nil {
-		return nil, err
-	}
-	return &user, nil
-}
-
-func (r *UserRepository) GetByEmail(email string) (*models.User, error) {
-	var user models.User
-	err := r.db.Where("email = ?", email).First(&user).Error
-	if err != nil {
-		return nil, err
-	}
-	return &user, nil
-}
-
-func (r *UserRepository) Update(user *models.User) error {
-	return r.db.Save(user).Error
-}
-
-func (r *UserRepository) Delete(id uint) error {
-	return r.db.Delete(&models.User{}, id).Error
-}
-
-func (r *UserRepository) List(offset, limit int) ([]models.User, int64, error) {
-	var users []models.User
-	var total int64
-
-	r.db.Model(&models.User{}).Count(&total)
-	err := r.db.Offset(offset).Limit(limit).Find(&users).Error
-	return users, total, err
-}

internal/services/auth.go

@@ -1,180 +0,0 @@
-package services
-
-import (
-	"errors"
-	"time"
-
-	"github.com/golang-jwt/jwt/v5"
-	"git.mchus.pro/mchus/quoteforge/internal/config"
-	"git.mchus.pro/mchus/quoteforge/internal/models"
-	"git.mchus.pro/mchus/quoteforge/internal/repository"
-	"golang.org/x/crypto/bcrypt"
-)
-
-var (
-	ErrInvalidCredentials = errors.New("invalid username or password")
-	ErrUserNotFound       = errors.New("user not found")
-	ErrUserInactive       = errors.New("user account is inactive")
-	ErrInvalidToken       = errors.New("invalid token")
-	ErrTokenExpired       = errors.New("token expired")
-)
-
-type AuthService struct {
-	userRepo *repository.UserRepository
-	config   config.AuthConfig
-}
-
-func NewAuthService(userRepo *repository.UserRepository, cfg config.AuthConfig) *AuthService {
-	return &AuthService{
-		userRepo: userRepo,
-		config:   cfg,
-	}
-}
-
-type TokenPair struct {
-	AccessToken  string `json:"access_token"`
-	RefreshToken string `json:"refresh_token"`
-	ExpiresAt    int64  `json:"expires_at"`
-}
-
-type Claims struct {
-	UserID   uint            `json:"user_id"`
-	Username string          `json:"username"`
-	Role     models.UserRole `json:"role"`
-	jwt.RegisteredClaims
-}
-
-func (s *AuthService) Login(username, password string) (*TokenPair, *models.User, error) {
-	user, err := s.userRepo.GetByUsername(username)
-	if err != nil {
-		return nil, nil, ErrInvalidCredentials
-	}
-
-	if !user.IsActive {
-		return nil, nil, ErrUserInactive
-	}
-
-	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
-		return nil, nil, ErrInvalidCredentials
-	}
-
-	tokens, err := s.generateTokenPair(user)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	return tokens, user, nil
-}
-
-func (s *AuthService) RefreshTokens(refreshToken string) (*TokenPair, error) {
-	claims, err := s.ValidateToken(refreshToken)
-	if err != nil {
-		return nil, err
-	}
-
-	user, err := s.userRepo.GetByID(claims.UserID)
-	if err != nil {
-		return nil, ErrUserNotFound
-	}
-
-	if !user.IsActive {
-		return nil, ErrUserInactive
-	}
-
-	return s.generateTokenPair(user)
-}
-
-func (s *AuthService) ValidateToken(tokenString string) (*Claims, error) {
-	token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
-		return []byte(s.config.JWTSecret), nil
-	})
-
-	if err != nil {
-		if errors.Is(err, jwt.ErrTokenExpired) {
-			return nil, ErrTokenExpired
-		}
-		return nil, ErrInvalidToken
-	}
-
-	claims, ok := token.Claims.(*Claims)
-	if !ok || !token.Valid {
-		return nil, ErrInvalidToken
-	}
-
-	return claims, nil
-}
-
-func (s *AuthService) generateTokenPair(user *models.User) (*TokenPair, error) {
-	now := time.Now()
-	accessExpiry := now.Add(s.config.TokenExpiry)
-	refreshExpiry := now.Add(s.config.RefreshExpiry)
-
-	accessClaims := &Claims{
-		UserID:   user.ID,
-		Username: user.Username,
-		Role:     user.Role,
-		RegisteredClaims: jwt.RegisteredClaims{
-			ExpiresAt: jwt.NewNumericDate(accessExpiry),
-			IssuedAt:  jwt.NewNumericDate(now),
-			Subject:   user.Username,
-		},
-	}
-
-	accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
-	accessTokenString, err := accessToken.SignedString([]byte(s.config.JWTSecret))
-	if err != nil {
-		return nil, err
-	}
-
-	refreshClaims := &Claims{
-		UserID:   user.ID,
-		Username: user.Username,
-		Role:     user.Role,
-		RegisteredClaims: jwt.RegisteredClaims{
-			ExpiresAt: jwt.NewNumericDate(refreshExpiry),
-			IssuedAt:  jwt.NewNumericDate(now),
-			Subject:   user.Username,
-		},
-	}
-
-	refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256, refreshClaims)
-	refreshTokenString, err := refreshToken.SignedString([]byte(s.config.JWTSecret))
-	if err != nil {
-		return nil, err
-	}
-
-	return &TokenPair{
-		AccessToken:  accessTokenString,
-		RefreshToken: refreshTokenString,
-		ExpiresAt:    accessExpiry.Unix(),
-	}, nil
-}
-
-func (s *AuthService) HashPassword(password string) (string, error) {
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
-	if err != nil {
-		return "", err
-	}
-	return string(hash), nil
-}
-
-func (s *AuthService) CreateUser(username, email, password string, role models.UserRole) (*models.User, error) {
-	hash, err := s.HashPassword(password)
-	if err != nil {
-		return nil, err
-	}
-
-	user := &models.User{
-		Username:     username,
-		Email:        email,
-		PasswordHash: hash,
-		Role:         role,
-		IsActive:     true,
-	}
-
-	if err := s.userRepo.Create(user); err != nil {
-		return nil, err
-	}
-
-	return user, nil
-}

internal/services/component.go

@@ -2,6 +2,7 @@ package services
 
 import (
 	"fmt"
+	"log/slog"
 	"strings"
 
 	"git.mchus.pro/mchus/quoteforge/internal/models"
@@ -11,18 +12,15 @@ import (
 type ComponentService struct {
 	componentRepo *repository.ComponentRepository
 	categoryRepo  *repository.CategoryRepository
-	statsRepo     *repository.StatsRepository
 }
 
 func NewComponentService(
 	componentRepo *repository.ComponentRepository,
 	categoryRepo *repository.CategoryRepository,
-	statsRepo *repository.StatsRepository,
 ) *ComponentService {
 	return &ComponentService{
 		componentRepo: componentRepo,
 		categoryRepo:  categoryRepo,
-		statsRepo:     statsRepo,
 	}
 }
 
@@ -41,10 +39,11 @@ func ParsePartNumber(lotName string) (category, model string) {
 }
 
 type ComponentListResult struct {
-	Components []ComponentView `json:"components"`
-	Total      int64           `json:"total"`
+	Items      []ComponentView `json:"items"`
+	TotalCount int64           `json:"total_count"`
 	Page       int             `json:"page"`
 	PerPage    int             `json:"per_page"`
+	TotalPages int             `json:"total_pages"`
 }
 
 type ComponentView struct {
@@ -63,10 +62,11 @@ func (s *ComponentService) List(filter repository.ComponentFilter, page, perPage
 	// Components should be loaded via /api/sync/components first
 	if s.componentRepo == nil {
 		return &ComponentListResult{
-			Components: []ComponentView{},
-			Total:      0,
+			Items:      []ComponentView{},
+			TotalCount: 0,
 			Page:       page,
 			PerPage:    perPage,
+			TotalPages: 1,
 		}, nil
 	}
 
@@ -107,11 +107,16 @@ func (s *ComponentService) List(filter repository.ComponentFilter, page, perPage
 		views[i] = view
 	}
 
+	totalPages := int((total + int64(perPage) - 1) / int64(perPage))
+	if totalPages < 1 {
+		totalPages = 1
+	}
 	return &ComponentListResult{
-		Components: views,
-		Total:      total,
+		Items:      views,
+		TotalCount: total,
 		Page:       page,
 		PerPage:    perPage,
+		TotalPages: totalPages,
 	}, nil
 }
 
@@ -126,8 +131,10 @@ func (s *ComponentService) GetByLotName(lotName string) (*ComponentView, error)
 		return nil, err
 	}
 
-	// Track usage
-	_ = s.componentRepo.IncrementRequestCount(lotName)
+	// Track usage (best-effort)
+	if err := s.componentRepo.IncrementRequestCount(lotName); err != nil {
+		slog.Warn("component: could not increment request count", "lot", lotName, "err", err)
+	}
 
 	view := &ComponentView{
 		LotName:         c.LotName,

internal/services/configuration.go

@@ -18,6 +18,7 @@ var (
 // Used by handlers to work with both ConfigurationService and LocalConfigurationService
 type ConfigurationGetter interface {
 	GetByUUID(uuid string, ownerUsername string) (*models.Configuration, error)
+	GetByUUIDNoAuth(uuid string) (*models.Configuration, error)
 }
 
 type ConfigurationService struct {
@@ -45,18 +46,22 @@ func NewConfigurationService(
 }
 
 type CreateConfigRequest struct {
-	Name        string             `json:"name"`
-	Items       models.ConfigItems `json:"items"`
-	ProjectUUID *string            `json:"project_uuid,omitempty"`
-	CustomPrice *float64           `json:"custom_price"`
-	Notes       string             `json:"notes"`
-	IsTemplate  bool               `json:"is_template"`
-	ServerCount int                `json:"server_count"`
-	ServerModel string             `json:"server_model,omitempty"`
-	SupportCode string             `json:"support_code,omitempty"`
-	Article     string             `json:"article,omitempty"`
-	PricelistID *uint              `json:"pricelist_id,omitempty"`
-	OnlyInStock bool               `json:"only_in_stock"`
+	Name                  string             `json:"name"`
+	Items                 models.ConfigItems `json:"items"`
+	ProjectUUID           *string            `json:"project_uuid,omitempty"`
+	CustomPrice           *float64           `json:"custom_price"`
+	Notes                 string             `json:"notes"`
+	IsTemplate            bool               `json:"is_template"`
+	ServerCount           int                `json:"server_count"`
+	ServerModel           string             `json:"server_model,omitempty"`
+	SupportCode           string             `json:"support_code,omitempty"`
+	Article               string             `json:"article,omitempty"`
+	PricelistID           *uint              `json:"pricelist_id,omitempty"`
+	WarehousePricelistID  *uint              `json:"warehouse_pricelist_id,omitempty"`
+	CompetitorPricelistID *uint              `json:"competitor_pricelist_id,omitempty"`
+	ConfigType            string             `json:"config_type,omitempty"` // "server" | "storage"
+	DisablePriceRefresh   bool               `json:"disable_price_refresh"`
+	OnlyInStock           bool               `json:"only_in_stock"`
 }
 
 type ArticlePreviewRequest struct {
@@ -84,30 +89,34 @@ func (s *ConfigurationService) Create(ownerUsername string, req *CreateConfigReq
 	}
 
 	config := &models.Configuration{
-		UUID:          uuid.New().String(),
-		OwnerUsername: ownerUsername,
-		ProjectUUID:   projectUUID,
-		Name:          req.Name,
-		Items:         req.Items,
-		TotalPrice:    &total,
-		CustomPrice:   req.CustomPrice,
-		Notes:         req.Notes,
-		IsTemplate:    req.IsTemplate,
-		ServerCount:   req.ServerCount,
-		ServerModel:   req.ServerModel,
-		SupportCode:   req.SupportCode,
-		Article:       req.Article,
-		PricelistID:   pricelistID,
-		OnlyInStock:   req.OnlyInStock,
+		UUID:                  uuid.New().String(),
+		OwnerUsername:         ownerUsername,
+		ProjectUUID:           projectUUID,
+		Name:                  req.Name,
+		Items:                 req.Items,
+		TotalPrice:            &total,
+		CustomPrice:           req.CustomPrice,
+		Notes:                 req.Notes,
+		IsTemplate:            req.IsTemplate,
+		ServerCount:           req.ServerCount,
+		ServerModel:           req.ServerModel,
+		SupportCode:           req.SupportCode,
+		Article:               req.Article,
+		PricelistID:           pricelistID,
+		WarehousePricelistID:  req.WarehousePricelistID,
+		CompetitorPricelistID: req.CompetitorPricelistID,
+		ConfigType:            req.ConfigType,
+		DisablePriceRefresh:   req.DisablePriceRefresh,
+		OnlyInStock:           req.OnlyInStock,
+	}
+	if config.ConfigType == "" {
+		config.ConfigType = "server"
 	}
 
 	if err := s.configRepo.Create(config); err != nil {
 		return nil, err
 	}
 
-	// Record usage stats
-	_ = s.quoteService.RecordUsage(req.Items)
-
 	return config, nil
 }
 
@@ -163,6 +172,9 @@ func (s *ConfigurationService) Update(uuid string, ownerUsername string, req *Cr
 	config.SupportCode = req.SupportCode
 	config.Article = req.Article
 	config.PricelistID = pricelistID
+	config.WarehousePricelistID = req.WarehousePricelistID
+	config.CompetitorPricelistID = req.CompetitorPricelistID
+	config.DisablePriceRefresh = req.DisablePriceRefresh
 	config.OnlyInStock = req.OnlyInStock
 
 	if err := s.configRepo.Update(config); err != nil {
@@ -230,18 +242,24 @@ func (s *ConfigurationService) CloneToProject(configUUID string, ownerUsername s
 	}
 
 	clone := &models.Configuration{
-		UUID:          uuid.New().String(),
-		OwnerUsername: ownerUsername,
-		ProjectUUID:   resolvedProjectUUID,
-		Name:          newName,
-		Items:         original.Items,
-		TotalPrice:    &total,
-		CustomPrice:   original.CustomPrice,
-		Notes:         original.Notes,
-		IsTemplate:    false, // Clone is never a template
-		ServerCount:   original.ServerCount,
-		PricelistID:   original.PricelistID,
-		OnlyInStock:   original.OnlyInStock,
+		UUID:                  uuid.New().String(),
+		OwnerUsername:         ownerUsername,
+		ProjectUUID:           resolvedProjectUUID,
+		Name:                  newName,
+		Items:                 original.Items,
+		TotalPrice:            &total,
+		CustomPrice:           original.CustomPrice,
+		Notes:                 original.Notes,
+		IsTemplate:            false, // Clone is never a template
+		ServerCount:           original.ServerCount,
+		ServerModel:           original.ServerModel,
+		SupportCode:           original.SupportCode,
+		Article:               original.Article,
+		PricelistID:           original.PricelistID,
+		WarehousePricelistID:  original.WarehousePricelistID,
+		CompetitorPricelistID: original.CompetitorPricelistID,
+		DisablePriceRefresh:   original.DisablePriceRefresh,
+		OnlyInStock:           original.OnlyInStock,
 	}
 
 	if err := s.configRepo.Create(clone); err != nil {
@@ -314,7 +332,13 @@ func (s *ConfigurationService) UpdateNoAuth(uuid string, req *CreateConfigReques
 	config.Notes = req.Notes
 	config.IsTemplate = req.IsTemplate
 	config.ServerCount = req.ServerCount
+	config.ServerModel = req.ServerModel
+	config.SupportCode = req.SupportCode
+	config.Article = req.Article
 	config.PricelistID = pricelistID
+	config.WarehousePricelistID = req.WarehousePricelistID
+	config.CompetitorPricelistID = req.CompetitorPricelistID
+	config.DisablePriceRefresh = req.DisablePriceRefresh
 	config.OnlyInStock = req.OnlyInStock
 
 	if err := s.configRepo.Update(config); err != nil {
@@ -587,13 +611,7 @@ func (s *ConfigurationService) isOwner(config *models.Configuration, ownerUserna
 	if config == nil || ownerUsername == "" {
 		return false
 	}
-	if config.OwnerUsername != "" {
-		return config.OwnerUsername == ownerUsername
-	}
-	if config.User != nil {
-		return config.User.Username == ownerUsername
-	}
-	return false
+	return config.OwnerUsername == ownerUsername
 }
 
 // // Export configuration as JSON

internal/services/export_test.go

@@ -8,27 +8,42 @@ import (
 	"time"
 
 	"git.mchus.pro/mchus/quoteforge/internal/config"
+	"git.mchus.pro/mchus/quoteforge/internal/models"
 )
 
+func newTestProjectData(items []ExportItem, article string, serverCount int) *ProjectExportData {
+	var unitTotal float64
+	for _, item := range items {
+		unitTotal += item.UnitPrice * float64(item.Quantity)
+	}
+	if serverCount < 1 {
+		serverCount = 1
+	}
+	return &ProjectExportData{
+		Configs: []ConfigExportBlock{
+			{
+				Article:     article,
+				ServerCount: serverCount,
+				UnitPrice:   unitTotal,
+				Items:       items,
+			},
+		},
+		CreatedAt: time.Now(),
+	}
+}
 
 func TestToCSV_UTF8BOM(t *testing.T) {
 	svc := NewExportService(config.ExportConfig{}, nil)
 
-	data := &ExportData{
-		Name: "Test",
-		Items: []ExportItem{
-			{
-				LotName:     "LOT-001",
-				Description: "Test Item",
-				Category:    "CAT",
-				Quantity:    1,
-				UnitPrice:   100.0,
-				TotalPrice:  100.0,
-			},
+	data := newTestProjectData([]ExportItem{
+		{
+			LotName:    "LOT-001",
+			Category:   "CAT",
+			Quantity:   1,
+			UnitPrice:  100.0,
+			TotalPrice: 100.0,
 		},
-		Total:     100.0,
-		CreatedAt: time.Now(),
-	}
+	}, "TEST-ARTICLE", 1)
 
 	var buf bytes.Buffer
 	if err := svc.ToCSV(&buf, data); err != nil {
@@ -40,11 +55,9 @@ func TestToCSV_UTF8BOM(t *testing.T) {
 		t.Fatalf("CSV too short to contain BOM")
 	}
 
-	// Check UTF-8 BOM: 0xEF 0xBB 0xBF
 	expectedBOM := []byte{0xEF, 0xBB, 0xBF}
 	actualBOM := csvBytes[:3]
-
-	if bytes.Compare(actualBOM, expectedBOM) != 0 {
+	if !bytes.Equal(actualBOM, expectedBOM) {
 		t.Errorf("UTF-8 BOM mismatch. Expected %v, got %v", expectedBOM, actualBOM)
 	}
 }
@@ -52,28 +65,21 @@ func TestToCSV_UTF8BOM(t *testing.T) {
 func TestToCSV_SemicolonDelimiter(t *testing.T) {
 	svc := NewExportService(config.ExportConfig{}, nil)
 
-	data := &ExportData{
-		Name: "Test",
-		Items: []ExportItem{
-			{
-				LotName:     "LOT-001",
-				Description: "Test Item",
-				Category:    "CAT",
-				Quantity:    2,
-				UnitPrice:   100.50,
-				TotalPrice:  201.00,
-			},
+	data := newTestProjectData([]ExportItem{
+		{
+			LotName:    "LOT-001",
+			Category:   "CAT",
+			Quantity:   2,
+			UnitPrice:  100.50,
+			TotalPrice: 201.00,
 		},
-		Total:     201.00,
-		CreatedAt: time.Now(),
-	}
+	}, "TEST-ARTICLE", 1)
 
 	var buf bytes.Buffer
 	if err := svc.ToCSV(&buf, data); err != nil {
 		t.Fatalf("ToCSV failed: %v", err)
 	}
 
-	// Skip BOM and read CSV with semicolon delimiter
 	csvBytes := buf.Bytes()
 	reader := csv.NewReader(bytes.NewReader(csvBytes[3:]))
 	reader.Comma = ';'
@@ -84,125 +90,52 @@ func TestToCSV_SemicolonDelimiter(t *testing.T) {
 		t.Fatalf("Failed to read header: %v", err)
 	}
 
-	if len(header) != 6 {
-		t.Errorf("Expected 6 columns, got %d", len(header))
+	if len(header) != 8 {
+		t.Errorf("Expected 8 columns, got %d", len(header))
 	}
 
-	expectedHeader := []string{"Артикул", "Описание", "Категория", "Количество", "Цена за единицу", "Сумма"}
+	expectedHeader := []string{"Line", "Type", "p/n", "Description", "Qty (1 pcs.)", "Qty (total)", "Price (1 pcs.)", "Price (total)"}
 	for i, col := range expectedHeader {
 		if i < len(header) && header[i] != col {
 			t.Errorf("Column %d: expected %q, got %q", i, col, header[i])
 		}
 	}
 
-	// Read item row
+	// Read server row
+	serverRow, err := reader.Read()
+	if err != nil {
+		t.Fatalf("Failed to read server row: %v", err)
+	}
+	if serverRow[0] != "10" {
+		t.Errorf("Expected line number 10, got %s", serverRow[0])
+	}
+	if serverRow[2] != "TEST-ARTICLE" {
+		t.Errorf("Expected article TEST-ARTICLE, got %s", serverRow[2])
+	}
+
+	// Read component row
 	itemRow, err := reader.Read()
 	if err != nil {
 		t.Fatalf("Failed to read item row: %v", err)
 	}
-
-	if itemRow[0] != "LOT-001" {
-		t.Errorf("Lot name mismatch: expected LOT-001, got %s", itemRow[0])
+	if itemRow[2] != "LOT-001" {
+		t.Errorf("Lot name mismatch: expected LOT-001, got %s", itemRow[2])
 	}
-
-	if itemRow[3] != "2" {
-		t.Errorf("Quantity mismatch: expected 2, got %s", itemRow[3])
+	if itemRow[4] != "2" {
+		t.Errorf("Quantity mismatch: expected 2, got %s", itemRow[4])
 	}
-
-	if itemRow[4] != "100,50" {
-		t.Errorf("Unit price mismatch: expected 100,50, got %s", itemRow[4])
+	if itemRow[6] != "100,5" {
+		t.Errorf("Unit price mismatch: expected 100,5, got %s", itemRow[6])
 	}
 }
 
-func TestToCSV_TotalRow(t *testing.T) {
+func TestToCSV_ServerRow(t *testing.T) {
 	svc := NewExportService(config.ExportConfig{}, nil)
 
-	data := &ExportData{
-		Name: "Test",
-		Items: []ExportItem{
-			{
-				LotName:     "LOT-001",
-				Description: "Item 1",
-				Category:    "CAT",
-				Quantity:    1,
-				UnitPrice:   100.0,
-				TotalPrice:  100.0,
-			},
-			{
-				LotName:     "LOT-002",
-				Description: "Item 2",
-				Category:    "CAT",
-				Quantity:    2,
-				UnitPrice:   50.0,
-				TotalPrice:  100.0,
-			},
-		},
-		Total:     200.0,
-		CreatedAt: time.Now(),
-	}
-
-	var buf bytes.Buffer
-	if err := svc.ToCSV(&buf, data); err != nil {
-		t.Fatalf("ToCSV failed: %v", err)
-	}
-
-	csvBytes := buf.Bytes()
-	reader := csv.NewReader(bytes.NewReader(csvBytes[3:]))
-	reader.Comma = ';'
-
-	// Skip header and item rows
-	reader.Read()
-	reader.Read()
-	reader.Read()
-
-	// Read total row
-	totalRow, err := reader.Read()
-	if err != nil {
-		t.Fatalf("Failed to read total row: %v", err)
-	}
-
-	// Total row should have "ИТОГО:" in position 4 and total value in position 5
-	if totalRow[4] != "ИТОГО:" {
-		t.Errorf("Expected 'ИТОГО:' in column 4, got %q", totalRow[4])
-	}
-
-	if totalRow[5] != "200,00" {
-		t.Errorf("Expected total 200,00, got %s", totalRow[5])
-	}
-}
-
-func TestToCSV_CategorySorting(t *testing.T) {
-	// Test category sorting without category repo (items maintain original order)
-	svc := NewExportService(config.ExportConfig{}, nil)
-
-	data := &ExportData{
-		Name: "Test",
-		Items: []ExportItem{
-			{
-				LotName:     "LOT-001",
-				Category:    "CAT-A",
-				Quantity:    1,
-				UnitPrice:   100.0,
-				TotalPrice:  100.0,
-			},
-			{
-				LotName:     "LOT-002",
-				Category:    "CAT-C",
-				Quantity:    1,
-				UnitPrice:   100.0,
-				TotalPrice:  100.0,
-			},
-			{
-				LotName:     "LOT-003",
-				Category:    "CAT-B",
-				Quantity:    1,
-				UnitPrice:   100.0,
-				TotalPrice:  100.0,
-			},
-		},
-		Total:     300.0,
-		CreatedAt: time.Now(),
-	}
+	data := newTestProjectData([]ExportItem{
+		{LotName: "LOT-001", Category: "CAT", Quantity: 1, UnitPrice: 100.0, TotalPrice: 100.0},
+		{LotName: "LOT-002", Category: "CAT", Quantity: 2, UnitPrice: 50.0, TotalPrice: 100.0},
+	}, "DL380-ART", 10)
 
 	var buf bytes.Buffer
 	if err := svc.ToCSV(&buf, data); err != nil {
@@ -216,30 +149,75 @@ func TestToCSV_CategorySorting(t *testing.T) {
 	// Skip header
 	reader.Read()
 
+	// Read server row
+	serverRow, err := reader.Read()
+	if err != nil {
+		t.Fatalf("Failed to read server row: %v", err)
+	}
+
+	if serverRow[0] != "10" {
+		t.Errorf("Expected line 10, got %s", serverRow[0])
+	}
+	if serverRow[2] != "DL380-ART" {
+		t.Errorf("Expected article DL380-ART, got %s", serverRow[2])
+	}
+	if serverRow[5] != "10" {
+		t.Errorf("Expected server count 10, got %s", serverRow[5])
+	}
+	// UnitPrice = 100 + 100 = 200
+	if serverRow[6] != "200" {
+		t.Errorf("Expected unit price 200, got %s", serverRow[6])
+	}
+	// TotalPrice = 200 * 10 = 2000
+	if serverRow[7] != "2 000" {
+		t.Errorf("Expected total price '2 000', got %q", serverRow[7])
+	}
+}
+
+func TestToCSV_CategorySorting(t *testing.T) {
+	svc := NewExportService(config.ExportConfig{}, nil)
+
+	data := newTestProjectData([]ExportItem{
+		{LotName: "LOT-001", Category: "CAT-A", Quantity: 1, UnitPrice: 100.0, TotalPrice: 100.0},
+		{LotName: "LOT-002", Category: "CAT-C", Quantity: 1, UnitPrice: 100.0, TotalPrice: 100.0},
+		{LotName: "LOT-003", Category: "CAT-B", Quantity: 1, UnitPrice: 100.0, TotalPrice: 100.0},
+	}, "ART", 1)
+
+	var buf bytes.Buffer
+	if err := svc.ToCSV(&buf, data); err != nil {
+		t.Fatalf("ToCSV failed: %v", err)
+	}
+
+	csvBytes := buf.Bytes()
+	reader := csv.NewReader(bytes.NewReader(csvBytes[3:]))
+	reader.Comma = ';'
+
+	// Skip header and server row
+	reader.Read()
+	reader.Read()
+
 	// Without category repo, items maintain original order
 	row1, _ := reader.Read()
-	if row1[0] != "LOT-001" {
-		t.Errorf("Expected LOT-001 first, got %s", row1[0])
+	if row1[2] != "LOT-001" {
+		t.Errorf("Expected LOT-001 first, got %s", row1[2])
 	}
 
 	row2, _ := reader.Read()
-	if row2[0] != "LOT-002" {
-		t.Errorf("Expected LOT-002 second, got %s", row2[0])
+	if row2[2] != "LOT-002" {
+		t.Errorf("Expected LOT-002 second, got %s", row2[2])
 	}
 
 	row3, _ := reader.Read()
-	if row3[0] != "LOT-003" {
-		t.Errorf("Expected LOT-003 third, got %s", row3[0])
+	if row3[2] != "LOT-003" {
+		t.Errorf("Expected LOT-003 third, got %s", row3[2])
 	}
 }
 
 func TestToCSV_EmptyData(t *testing.T) {
 	svc := NewExportService(config.ExportConfig{}, nil)
 
-	data := &ExportData{
-		Name:      "Test",
-		Items:     []ExportItem{},
-		Total:     0.0,
+	data := &ProjectExportData{
+		Configs:   []ConfigExportBlock{},
 		CreatedAt: time.Now(),
 	}
 
@@ -252,44 +230,28 @@ func TestToCSV_EmptyData(t *testing.T) {
 	reader := csv.NewReader(bytes.NewReader(csvBytes[3:]))
 	reader.Comma = ';'
 
-	// Should have header and total row
 	header, err := reader.Read()
 	if err != nil {
 		t.Fatalf("Failed to read header: %v", err)
 	}
 
-	if len(header) != 6 {
-		t.Errorf("Expected 6 columns, got %d", len(header))
+	if len(header) != 8 {
+		t.Errorf("Expected 8 columns, got %d", len(header))
 	}
 
-	totalRow, err := reader.Read()
-	if err != nil {
-		t.Fatalf("Failed to read total row: %v", err)
-	}
-
-	if totalRow[4] != "ИТОГО:" {
-		t.Errorf("Expected ИТОГО: in total row, got %s", totalRow[4])
+	// No more rows expected
+	_, err = reader.Read()
+	if err != io.EOF {
+		t.Errorf("Expected EOF after header, got: %v", err)
 	}
 }
 
 func TestToCSVBytes_BackwardCompat(t *testing.T) {
 	svc := NewExportService(config.ExportConfig{}, nil)
 
-	data := &ExportData{
-		Name: "Test",
-		Items: []ExportItem{
-			{
-				LotName:     "LOT-001",
-				Description: "Test Item",
-				Category:    "CAT",
-				Quantity:    1,
-				UnitPrice:   100.0,
-				TotalPrice:  100.0,
-			},
-		},
-		Total:     100.0,
-		CreatedAt: time.Now(),
-	}
+	data := newTestProjectData([]ExportItem{
+		{LotName: "LOT-001", Category: "CAT", Quantity: 1, UnitPrice: 100.0, TotalPrice: 100.0},
+	}, "ART", 1)
 
 	csvBytes, err := svc.ToCSVBytes(data)
 	if err != nil {
@@ -300,10 +262,9 @@ func TestToCSVBytes_BackwardCompat(t *testing.T) {
 		t.Fatalf("CSV bytes too short")
 	}
 
-	// Verify BOM is present
 	expectedBOM := []byte{0xEF, 0xBB, 0xBF}
 	actualBOM := csvBytes[:3]
-	if bytes.Compare(actualBOM, expectedBOM) != 0 {
+	if !bytes.Equal(actualBOM, expectedBOM) {
 		t.Errorf("UTF-8 BOM mismatch in ToCSVBytes")
 	}
 }
@@ -311,23 +272,10 @@ func TestToCSVBytes_BackwardCompat(t *testing.T) {
 func TestToCSV_WriterError(t *testing.T) {
 	svc := NewExportService(config.ExportConfig{}, nil)
 
-	data := &ExportData{
-		Name: "Test",
-		Items: []ExportItem{
-			{
-				LotName:     "LOT-001",
-				Description: "Test",
-				Category:    "CAT",
-				Quantity:    1,
-				UnitPrice:   100.0,
-				TotalPrice:  100.0,
-			},
-		},
-		Total:     100.0,
-		CreatedAt: time.Now(),
-	}
+	data := newTestProjectData([]ExportItem{
+		{LotName: "LOT-001", Category: "CAT", Quantity: 1, UnitPrice: 100.0, TotalPrice: 100.0},
+	}, "ART", 1)
 
-	// Use a failing writer
 	failingWriter := &failingWriter{}
 
 	if err := svc.ToCSV(failingWriter, data); err == nil {
@@ -335,6 +283,278 @@ func TestToCSV_WriterError(t *testing.T) {
 	}
 }
 
+func TestToCSV_MultipleBlocks(t *testing.T) {
+	svc := NewExportService(config.ExportConfig{}, nil)
+
+	data := &ProjectExportData{
+		Configs: []ConfigExportBlock{
+			{
+				Article:     "ART-1",
+				ServerCount: 2,
+				UnitPrice:   500.0,
+				Items: []ExportItem{
+					{LotName: "LOT-A", Category: "CPU", Quantity: 1, UnitPrice: 500.0, TotalPrice: 500.0},
+				},
+			},
+			{
+				Article:     "ART-2",
+				ServerCount: 3,
+				UnitPrice:   1000.0,
+				Items: []ExportItem{
+					{LotName: "LOT-B", Category: "MEM", Quantity: 2, UnitPrice: 500.0, TotalPrice: 1000.0},
+				},
+			},
+		},
+		CreatedAt: time.Now(),
+	}
+
+	var buf bytes.Buffer
+	if err := svc.ToCSV(&buf, data); err != nil {
+		t.Fatalf("ToCSV failed: %v", err)
+	}
+
+	csvBytes := buf.Bytes()
+	reader := csv.NewReader(bytes.NewReader(csvBytes[3:]))
+	reader.Comma = ';'
+	reader.FieldsPerRecord = -1 // allow variable fields
+
+	// Header
+	reader.Read()
+
+	// Block 1: server row
+	srv1, _ := reader.Read()
+	if srv1[0] != "10" {
+		t.Errorf("Block 1 line: expected 10, got %s", srv1[0])
+	}
+	if srv1[7] != "1 000" {
+		t.Errorf("Block 1 total: expected '1 000', got %q", srv1[7])
+	}
+
+	// Block 1: component row
+	comp1, _ := reader.Read()
+	if comp1[2] != "LOT-A" {
+		t.Errorf("Block 1 component: expected LOT-A, got %s", comp1[2])
+	}
+
+	// Separator row
+	sep, _ := reader.Read()
+	allEmpty := true
+	for _, v := range sep {
+		if v != "" {
+			allEmpty = false
+		}
+	}
+	if !allEmpty {
+		t.Errorf("Expected empty separator row, got %v", sep)
+	}
+
+	// Block 2: server row
+	srv2, _ := reader.Read()
+	if srv2[0] != "20" {
+		t.Errorf("Block 2 line: expected 20, got %s", srv2[0])
+	}
+	if srv2[7] != "3 000" {
+		t.Errorf("Block 2 total: expected '3 000', got %q", srv2[7])
+	}
+}
+
+func TestProjectToExportData_SortsByLine(t *testing.T) {
+	svc := NewExportService(config.ExportConfig{}, nil)
+
+	configs := []models.Configuration{
+		{
+			UUID:        "cfg-1",
+			Line:        30,
+			Article:     "ART-30",
+			ServerCount: 1,
+			Items:       models.ConfigItems{{LotName: "LOT-30", Quantity: 1, UnitPrice: 300}},
+			CreatedAt:   time.Now().Add(-1 * time.Hour),
+		},
+		{
+			UUID:        "cfg-2",
+			Line:        10,
+			Article:     "ART-10",
+			ServerCount: 1,
+			Items:       models.ConfigItems{{LotName: "LOT-10", Quantity: 1, UnitPrice: 100}},
+			CreatedAt:   time.Now().Add(-2 * time.Hour),
+		},
+		{
+			UUID:        "cfg-3",
+			Line:        20,
+			Article:     "ART-20",
+			ServerCount: 1,
+			Items:       models.ConfigItems{{LotName: "LOT-20", Quantity: 1, UnitPrice: 200}},
+			CreatedAt:   time.Now().Add(-3 * time.Hour),
+		},
+	}
+
+	data := svc.ProjectToExportData(configs)
+	if len(data.Configs) != 3 {
+		t.Fatalf("expected 3 blocks, got %d", len(data.Configs))
+	}
+	if data.Configs[0].Article != "ART-10" || data.Configs[0].Line != 10 {
+		t.Fatalf("first block must be line 10, got article=%s line=%d", data.Configs[0].Article, data.Configs[0].Line)
+	}
+	if data.Configs[1].Article != "ART-20" || data.Configs[1].Line != 20 {
+		t.Fatalf("second block must be line 20, got article=%s line=%d", data.Configs[1].Article, data.Configs[1].Line)
+	}
+	if data.Configs[2].Article != "ART-30" || data.Configs[2].Line != 30 {
+		t.Fatalf("third block must be line 30, got article=%s line=%d", data.Configs[2].Article, data.Configs[2].Line)
+	}
+}
+
+func TestFormatPriceWithSpace(t *testing.T) {
+	tests := []struct {
+		input    float64
+		expected string
+	}{
+		{0, "0"},
+		{100, "100"},
+		{1000, "1 000"},
+		{10470, "10 470"},
+		{104700, "104 700"},
+		{1000000, "1 000 000"},
+	}
+
+	for _, tt := range tests {
+		result := formatPriceWithSpace(tt.input)
+		if result != tt.expected {
+			t.Errorf("formatPriceWithSpace(%v): expected %q, got %q", tt.input, tt.expected, result)
+		}
+	}
+}
+
+func TestFormatPriceComma(t *testing.T) {
+	tests := []struct {
+		input    float64
+		expected string
+	}{
+		{100.0, "100"},
+		{2074.5, "2074,5"},
+		{100.50, "100,5"},
+		{99.99, "99,99"},
+		{0, "0"},
+	}
+
+	for _, tt := range tests {
+		result := formatPriceComma(tt.input)
+		if result != tt.expected {
+			t.Errorf("formatPriceComma(%v): expected %q, got %q", tt.input, tt.expected, result)
+		}
+	}
+}
+
+func TestToPricingCSV_UsesSelectedColumns(t *testing.T) {
+	svc := NewExportService(config.ExportConfig{}, nil)
+	data := &ProjectPricingExportData{
+		Configs: []ProjectPricingExportConfig{
+			{
+				Name:        "Config A",
+				Article:     "ART-1",
+				Line:        10,
+				ServerCount: 2,
+				Rows: []ProjectPricingExportRow{
+					{
+						LotDisplay:  "LOT_A +1",
+						VendorPN:    "PN-001",
+						Description: "Bundle row",
+						Quantity:    2,
+						BOMTotal:    floatPtr(2400.5),
+						Estimate:    floatPtr(2000),
+						Stock:       floatPtr(1800.25),
+					},
+				},
+			},
+		},
+		CreatedAt: time.Now(),
+	}
+	opts := ProjectPricingExportOptions{
+		IncludeLOT:      true,
+		IncludeBOM:      true,
+		IncludeEstimate: true,
+		IncludeStock:    true,
+	}
+
+	var buf bytes.Buffer
+	if err := svc.ToPricingCSV(&buf, data, opts); err != nil {
+		t.Fatalf("ToPricingCSV failed: %v", err)
+	}
+
+	reader := csv.NewReader(bytes.NewReader(buf.Bytes()[3:]))
+	reader.Comma = ';'
+	reader.FieldsPerRecord = -1
+
+	header, err := reader.Read()
+	if err != nil {
+		t.Fatalf("read header row: %v", err)
+	}
+	expectedHeader := []string{"Line Item", "LOT", "PN вендора", "Описание", "Кол-во", "BOM", "Estimate", "Stock"}
+	for i, want := range expectedHeader {
+		if header[i] != want {
+			t.Fatalf("header[%d]: expected %q, got %q", i, want, header[i])
+		}
+	}
+
+	summary, err := reader.Read()
+	if err != nil {
+		t.Fatalf("read summary row: %v", err)
+	}
+	expectedSummary := []string{"10", "", "ART-1", "Config A", "2", "2 400,50", "2 000,00", "1 800,25"}
+	for i, want := range expectedSummary {
+		if summary[i] != want {
+			t.Fatalf("summary[%d]: expected %q, got %q", i, want, summary[i])
+		}
+	}
+
+	row, err := reader.Read()
+	if err != nil {
+		t.Fatalf("read data row: %v", err)
+	}
+	expectedRow := []string{"", "LOT_A +1", "PN-001", "Bundle row", "2", "2 400,50", "2 000,00", "1 800,25"}
+	for i, want := range expectedRow {
+		if row[i] != want {
+			t.Fatalf("row[%d]: expected %q, got %q", i, want, row[i])
+		}
+	}
+}
+
+func TestProjectToPricingExportData_UsesCartRowsWithoutBOM(t *testing.T) {
+	svc := NewExportService(config.ExportConfig{}, nil)
+	configs := []models.Configuration{
+		{
+			UUID:        "cfg-1",
+			Name:        "Config A",
+			Article:     "ART-1",
+			ServerCount: 1,
+			Items: models.ConfigItems{
+				{LotName: "LOT_A", Quantity: 2, UnitPrice: 300},
+			},
+			CreatedAt: time.Now(),
+		},
+	}
+
+	data, err := svc.ProjectToPricingExportData(configs, ProjectPricingExportOptions{
+		IncludeLOT:      true,
+		IncludeEstimate: true,
+	})
+	if err != nil {
+		t.Fatalf("ProjectToPricingExportData failed: %v", err)
+	}
+	if len(data.Configs) != 1 || len(data.Configs[0].Rows) != 1 {
+		t.Fatalf("unexpected rows count: %+v", data.Configs)
+	}
+	row := data.Configs[0].Rows[0]
+	if row.LotDisplay != "LOT_A" {
+		t.Fatalf("expected LOT_A, got %q", row.LotDisplay)
+	}
+	if row.VendorPN != "—" {
+		t.Fatalf("expected vendor dash, got %q", row.VendorPN)
+	}
+	if row.Estimate == nil || *row.Estimate != 600 {
+		t.Fatalf("expected estimate total 600, got %+v", row.Estimate)
+	}
+}
+
 // failingWriter always returns an error
 type failingWriter struct{}
 

internal/services/local_configuration.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"strings"
 	"time"
 
@@ -49,11 +50,13 @@ func NewLocalConfigurationService(
 
 // Create creates a new configuration in local SQLite and queues it for sync
 func (s *LocalConfigurationService) Create(ownerUsername string, req *CreateConfigRequest) (*models.Configuration, error) {
-	// If online, check for new pricelists first
+	// If online, trigger pricelist sync in the background — do not block config creation
 	if s.isOnline() {
-		if err := s.syncService.SyncPricelistsIfNeeded(); err != nil {
-			// Log but don't fail - we can still use local pricelists
-		}
+		go func() {
+			if err := s.syncService.SyncPricelistsIfNeeded(); err != nil {
+				// Log but don't fail - we can still use local pricelists
+			}
+		}()
 	}
 
 	projectUUID, err := s.resolveProjectUUID(ownerUsername, req.ProjectUUID)
@@ -83,22 +86,29 @@ func (s *LocalConfigurationService) Create(ownerUsername string, req *CreateConf
 	}
 
 	cfg := &models.Configuration{
-		UUID:          uuid.New().String(),
-		OwnerUsername: ownerUsername,
-		ProjectUUID:   projectUUID,
-		Name:          req.Name,
-		Items:         req.Items,
-		TotalPrice:    &total,
-		CustomPrice:   req.CustomPrice,
-		Notes:         req.Notes,
-		IsTemplate:    req.IsTemplate,
-		ServerCount:   req.ServerCount,
-		ServerModel:   req.ServerModel,
-		SupportCode:   req.SupportCode,
-		Article:       req.Article,
-		PricelistID:   pricelistID,
-		OnlyInStock:   req.OnlyInStock,
-		CreatedAt:     time.Now(),
+		UUID:                  uuid.New().String(),
+		OwnerUsername:         ownerUsername,
+		ProjectUUID:           projectUUID,
+		Name:                  req.Name,
+		Items:                 req.Items,
+		TotalPrice:            &total,
+		CustomPrice:           req.CustomPrice,
+		Notes:                 req.Notes,
+		IsTemplate:            req.IsTemplate,
+		ServerCount:           req.ServerCount,
+		ServerModel:           req.ServerModel,
+		SupportCode:           req.SupportCode,
+		Article:               req.Article,
+		PricelistID:           pricelistID,
+		WarehousePricelistID:  req.WarehousePricelistID,
+		CompetitorPricelistID: req.CompetitorPricelistID,
+		ConfigType:            req.ConfigType,
+		DisablePriceRefresh:   req.DisablePriceRefresh,
+		OnlyInStock:           req.OnlyInStock,
+		CreatedAt:             time.Now(),
+	}
+	if cfg.ConfigType == "" {
+		cfg.ConfigType = "server"
 	}
 
 	// Convert to local model
@@ -107,9 +117,7 @@ func (s *LocalConfigurationService) Create(ownerUsername string, req *CreateConf
 	if err := s.createWithVersion(localCfg, ownerUsername); err != nil {
 		return nil, fmt.Errorf("create configuration with version: %w", err)
 	}
-
-	// Record usage stats
-	_ = s.quoteService.RecordUsage(req.Items)
+	cfg.Line = localCfg.Line
 
 	return cfg, nil
 }
@@ -195,6 +203,9 @@ func (s *LocalConfigurationService) Update(uuid string, ownerUsername string, re
 	localCfg.SupportCode = req.SupportCode
 	localCfg.Article = req.Article
 	localCfg.PricelistID = pricelistID
+	localCfg.WarehousePricelistID = req.WarehousePricelistID
+	localCfg.CompetitorPricelistID = req.CompetitorPricelistID
+	localCfg.DisablePriceRefresh = req.DisablePriceRefresh
 	localCfg.OnlyInStock = req.OnlyInStock
 	localCfg.UpdatedAt = time.Now()
 	localCfg.SyncStatus = "pending"
@@ -303,28 +314,32 @@ func (s *LocalConfigurationService) CloneToProject(configUUID string, ownerUsern
 	}
 
 	clone := &models.Configuration{
-		UUID:          uuid.New().String(),
-		OwnerUsername: ownerUsername,
-		ProjectUUID:   resolvedProjectUUID,
-		Name:          newName,
-		Items:         original.Items,
-		TotalPrice:    &total,
-		CustomPrice:   original.CustomPrice,
-		Notes:         original.Notes,
-		IsTemplate:    false,
-		ServerCount:   original.ServerCount,
-		ServerModel:   original.ServerModel,
-		SupportCode:   original.SupportCode,
-		Article:       original.Article,
-		PricelistID:   original.PricelistID,
-		OnlyInStock:   original.OnlyInStock,
-		CreatedAt:     time.Now(),
+		UUID:                  uuid.New().String(),
+		OwnerUsername:         ownerUsername,
+		ProjectUUID:           resolvedProjectUUID,
+		Name:                  newName,
+		Items:                 original.Items,
+		TotalPrice:            &total,
+		CustomPrice:           original.CustomPrice,
+		Notes:                 original.Notes,
+		IsTemplate:            false,
+		ServerCount:           original.ServerCount,
+		ServerModel:           original.ServerModel,
+		SupportCode:           original.SupportCode,
+		Article:               original.Article,
+		PricelistID:           original.PricelistID,
+		WarehousePricelistID:  original.WarehousePricelistID,
+		CompetitorPricelistID: original.CompetitorPricelistID,
+		DisablePriceRefresh:   original.DisablePriceRefresh,
+		OnlyInStock:           original.OnlyInStock,
+		CreatedAt:             time.Now(),
 	}
 
 	localCfg := localdb.ConfigurationToLocal(clone)
 	if err := s.createWithVersion(localCfg, ownerUsername); err != nil {
 		return nil, fmt.Errorf("clone configuration with version: %w", err)
 	}
+	clone.Line = localCfg.Line
 
 	return clone, nil
 }
@@ -388,17 +403,31 @@ func (s *LocalConfigurationService) RefreshPrices(uuid string, ownerUsername str
 		return nil, ErrConfigForbidden
 	}
 
-	// Refresh local pricelists when online and use latest active/local pricelist for recalculation.
+	// Refresh local pricelists when online.
 	if s.isOnline() {
-		_ = s.syncService.SyncPricelistsIfNeeded()
+		if err := s.syncService.SyncPricelistsIfNeeded(); err != nil {
+			slog.Warn("local configuration: background pricelist sync failed", "err", err)
+		}
+	}
+
+	// Use the pricelist stored in the config; fall back to latest if unavailable.
+	var pricelist *localdb.LocalPricelist
+	if localCfg.PricelistID != nil && *localCfg.PricelistID > 0 {
+		if pl, err := s.localDB.GetLocalPricelistByServerID(*localCfg.PricelistID); err == nil {
+			pricelist = pl
+		}
+	}
+	if pricelist == nil {
+		if pl, err := s.localDB.GetLatestLocalPricelist(); err == nil {
+			pricelist = pl
+		}
 	}
-	latestPricelist, latestErr := s.localDB.GetLatestLocalPricelist()
 
 	// Update prices for all items from pricelist
 	updatedItems := make(localdb.LocalConfigItems, len(localCfg.Items))
 	for i, item := range localCfg.Items {
-		if latestErr == nil && latestPricelist != nil {
-			price, err := s.localDB.GetLocalPriceForLot(latestPricelist.ID, item.LotName)
+		if pricelist != nil {
+			price, err := s.localDB.GetLocalPriceForLot(pricelist.ID, item.LotName)
 			if err == nil && price > 0 {
 				updatedItems[i] = localdb.LocalConfigItem{
 					LotName:   item.LotName,
@@ -423,8 +452,8 @@ func (s *LocalConfigurationService) RefreshPrices(uuid string, ownerUsername str
 	}
 
 	localCfg.TotalPrice = &total
-	if latestErr == nil && latestPricelist != nil {
-		localCfg.PricelistID = &latestPricelist.ServerID
+	if pricelist != nil {
+		localCfg.PricelistID = &pricelist.ServerID
 	}
 
 	// Set price update timestamp and mark for sync
@@ -442,14 +471,14 @@ func (s *LocalConfigurationService) RefreshPrices(uuid string, ownerUsername str
 
 // GetByUUIDNoAuth returns configuration without ownership check
 func (s *LocalConfigurationService) GetByUUIDNoAuth(uuid string) (*models.Configuration, error) {
-	localCfg, err := s.localDB.GetConfigurationByUUID(uuid)
-	if err != nil {
+	var localCfg localdb.LocalConfiguration
+	if err := s.localDB.DB().Preload("CurrentVersion").Where("uuid = ?", uuid).First(&localCfg).Error; err != nil {
 		return nil, ErrConfigNotFound
 	}
 	if !localCfg.IsActive {
 		return nil, ErrConfigNotFound
 	}
-	return localdb.LocalToConfiguration(localCfg), nil
+	return localdb.LocalToConfiguration(&localCfg), nil
 }
 
 // UpdateNoAuth updates configuration without ownership check
@@ -461,9 +490,21 @@ func (s *LocalConfigurationService) UpdateNoAuth(uuid string, req *CreateConfigR
 
 	projectUUID := localCfg.ProjectUUID
 	if req.ProjectUUID != nil {
+		requestedProjectUUID := strings.TrimSpace(*req.ProjectUUID)
+		currentProjectUUID := ""
+		if localCfg.ProjectUUID != nil {
+			currentProjectUUID = strings.TrimSpace(*localCfg.ProjectUUID)
+		}
+
 		projectUUID, err = s.resolveProjectUUID(localCfg.OriginalUsername, req.ProjectUUID)
 		if err != nil {
-			return nil, err
+			// Allow save for legacy/orphaned configs when request keeps the same project UUID.
+			// This can happen for imported configs whose project is not present in local cache.
+			if errors.Is(err, ErrProjectNotFound) && requestedProjectUUID != "" && requestedProjectUUID == currentProjectUUID {
+				projectUUID = localCfg.ProjectUUID
+			} else {
+				return nil, err
+			}
 		}
 	}
 	pricelistID, err := s.resolvePricelistID(req.PricelistID)
@@ -507,6 +548,9 @@ func (s *LocalConfigurationService) UpdateNoAuth(uuid string, req *CreateConfigR
 	localCfg.SupportCode = req.SupportCode
 	localCfg.Article = req.Article
 	localCfg.PricelistID = pricelistID
+	localCfg.WarehousePricelistID = req.WarehousePricelistID
+	localCfg.CompetitorPricelistID = req.CompetitorPricelistID
+	localCfg.DisablePriceRefresh = req.DisablePriceRefresh
 	localCfg.OnlyInStock = req.OnlyInStock
 	localCfg.UpdatedAt = time.Now()
 	localCfg.SyncStatus = "pending"
@@ -571,10 +615,30 @@ func (s *LocalConfigurationService) CloneNoAuth(configUUID string, newName strin
 }
 
 func (s *LocalConfigurationService) CloneNoAuthToProject(configUUID string, newName string, ownerUsername string, projectUUID *string) (*models.Configuration, error) {
+	return s.CloneNoAuthToProjectFromVersion(configUUID, newName, ownerUsername, projectUUID, 0)
+}
+
+func (s *LocalConfigurationService) CloneNoAuthToProjectFromVersion(configUUID string, newName string, ownerUsername string, projectUUID *string, fromVersion int) (*models.Configuration, error) {
 	original, err := s.GetByUUIDNoAuth(configUUID)
 	if err != nil {
 		return nil, err
 	}
+
+	// If fromVersion specified, use snapshot from that version
+	if fromVersion > 0 {
+		version, vErr := s.GetVersion(configUUID, fromVersion)
+		if vErr != nil {
+			return nil, vErr
+		}
+		snapshot, decErr := s.decodeConfigurationSnapshot(version.Data)
+		if decErr != nil {
+			return nil, fmt.Errorf("decode version snapshot for clone: %w", decErr)
+		}
+		snapshotCfg := localdb.LocalToConfiguration(snapshot)
+		original = snapshotCfg
+		original.UUID = configUUID // preserve original UUID for project resolution
+	}
+
 	resolvedProjectUUID := original.ProjectUUID
 	if projectUUID != nil {
 		resolvedProjectUUID, err = s.resolveProjectUUID(ownerUsername, projectUUID)
@@ -589,25 +653,32 @@ func (s *LocalConfigurationService) CloneNoAuthToProject(configUUID string, newN
 	}
 
 	clone := &models.Configuration{
-		UUID:          uuid.New().String(),
-		OwnerUsername: ownerUsername,
-		ProjectUUID:   resolvedProjectUUID,
-		Name:          newName,
-		Items:         original.Items,
-		TotalPrice:    &total,
-		CustomPrice:   original.CustomPrice,
-		Notes:         original.Notes,
-		IsTemplate:    false,
-		ServerCount:   original.ServerCount,
-		PricelistID:   original.PricelistID,
-		OnlyInStock:   original.OnlyInStock,
-		CreatedAt:     time.Now(),
+		UUID:                  uuid.New().String(),
+		OwnerUsername:         ownerUsername,
+		ProjectUUID:           resolvedProjectUUID,
+		Name:                  newName,
+		Items:                 original.Items,
+		TotalPrice:            &total,
+		CustomPrice:           original.CustomPrice,
+		Notes:                 original.Notes,
+		IsTemplate:            false,
+		ServerCount:           original.ServerCount,
+		ServerModel:           original.ServerModel,
+		SupportCode:           original.SupportCode,
+		Article:               original.Article,
+		PricelistID:           original.PricelistID,
+		WarehousePricelistID:  original.WarehousePricelistID,
+		CompetitorPricelistID: original.CompetitorPricelistID,
+		DisablePriceRefresh:   original.DisablePriceRefresh,
+		OnlyInStock:           original.OnlyInStock,
+		CreatedAt:             time.Now(),
 	}
 
 	localCfg := localdb.ConfigurationToLocal(clone)
 	if err := s.createWithVersion(localCfg, ownerUsername); err != nil {
 		return nil, fmt.Errorf("clone configuration without auth with version: %w", err)
 	}
+	clone.Line = localCfg.Line
 
 	return clone, nil
 }
@@ -709,8 +780,10 @@ func (s *LocalConfigurationService) ListTemplates(page, perPage int) ([]models.C
 	return templates[start:end], total, nil
 }
 
-// RefreshPricesNoAuth updates all component prices in the configuration without ownership check
-func (s *LocalConfigurationService) RefreshPricesNoAuth(uuid string) (*models.Configuration, error) {
+// RefreshPricesNoAuth updates all component prices in the configuration without ownership check.
+// pricelistServerID optionally specifies which pricelist to use; if nil, the config's stored
+// pricelist is used; if that is also absent, the latest local pricelist is used as a fallback.
+func (s *LocalConfigurationService) RefreshPricesNoAuth(uuid string, pricelistServerID *uint) (*models.Configuration, error) {
 	// Get configuration from local SQLite
 	localCfg, err := s.localDB.GetConfigurationByUUID(uuid)
 	if err != nil {
@@ -718,15 +791,40 @@ func (s *LocalConfigurationService) RefreshPricesNoAuth(uuid string) (*models.Co
 	}
 
 	if s.isOnline() {
-		_ = s.syncService.SyncPricelistsIfNeeded()
+		if err := s.syncService.SyncPricelistsIfNeeded(); err != nil {
+			slog.Warn("local configuration: background pricelist sync failed", "err", err)
+		}
+	}
+
+	// Resolve which pricelist to use:
+	// 1. Explicitly requested pricelist (from UI selection)
+	// 2. Pricelist stored in the configuration
+	// 3. Latest local pricelist as last-resort fallback
+	var targetServerID *uint
+	if pricelistServerID != nil && *pricelistServerID > 0 {
+		targetServerID = pricelistServerID
+	} else if localCfg.PricelistID != nil && *localCfg.PricelistID > 0 {
+		targetServerID = localCfg.PricelistID
+	}
+
+	var pricelist *localdb.LocalPricelist
+	if targetServerID != nil {
+		if pl, err := s.localDB.GetLocalPricelistByServerID(*targetServerID); err == nil {
+			pricelist = pl
+		}
+	}
+	if pricelist == nil {
+		// Fallback: use latest local pricelist
+		if pl, err := s.localDB.GetLatestLocalPricelist(); err == nil {
+			pricelist = pl
+		}
 	}
-	latestPricelist, latestErr := s.localDB.GetLatestLocalPricelist()
 
 	// Update prices for all items from pricelist
 	updatedItems := make(localdb.LocalConfigItems, len(localCfg.Items))
 	for i, item := range localCfg.Items {
-		if latestErr == nil && latestPricelist != nil {
-			price, err := s.localDB.GetLocalPriceForLot(latestPricelist.ID, item.LotName)
+		if pricelist != nil {
+			price, err := s.localDB.GetLocalPriceForLot(pricelist.ID, item.LotName)
 			if err == nil && price > 0 {
 				updatedItems[i] = localdb.LocalConfigItem{
 					LotName:   item.LotName,
@@ -751,8 +849,8 @@ func (s *LocalConfigurationService) RefreshPricesNoAuth(uuid string) (*models.Co
 	}
 
 	localCfg.TotalPrice = &total
-	if latestErr == nil && latestPricelist != nil {
-		localCfg.PricelistID = &latestPricelist.ServerID
+	if pricelist != nil {
+		localCfg.PricelistID = &pricelist.ServerID
 	}
 
 	// Set price update timestamp and mark for sync
@@ -768,6 +866,143 @@ func (s *LocalConfigurationService) RefreshPricesNoAuth(uuid string) (*models.Co
 	return cfg, nil
 }
 
+// UpdateServerCount updates server count and recalculates total price without creating a new version.
+func (s *LocalConfigurationService) UpdateServerCount(configUUID string, serverCount int) (*models.Configuration, error) {
+	if serverCount < 1 {
+		return nil, fmt.Errorf("server count must be at least 1")
+	}
+
+	localCfg, err := s.localDB.GetConfigurationByUUID(configUUID)
+	if err != nil {
+		return nil, ErrConfigNotFound
+	}
+
+	localCfg.ServerCount = serverCount
+	total := localCfg.Items.Total()
+	if serverCount > 1 {
+		total *= float64(serverCount)
+	}
+	localCfg.TotalPrice = &total
+	localCfg.UpdatedAt = time.Now()
+	localCfg.SyncStatus = "pending"
+
+	var cfg *models.Configuration
+	err = s.localDB.DB().Transaction(func(tx *gorm.DB) error {
+		if err := tx.Save(localCfg).Error; err != nil {
+			return fmt.Errorf("save local configuration: %w", err)
+		}
+
+		version, err := s.loadVersionForPendingTx(tx, localCfg)
+		if err != nil {
+			return err
+		}
+
+		cfg = localdb.LocalToConfiguration(localCfg)
+		if err := s.enqueueConfigurationPendingChangeTx(tx, localCfg, "update", version, ""); err != nil {
+			return fmt.Errorf("enqueue server-count pending change: %w", err)
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return cfg, nil
+}
+
+func (s *LocalConfigurationService) ReorderProjectConfigurationsNoAuth(projectUUID string, orderedUUIDs []string) ([]models.Configuration, error) {
+	projectUUID = strings.TrimSpace(projectUUID)
+	if projectUUID == "" {
+		return nil, ErrProjectNotFound
+	}
+	if _, err := s.localDB.GetProjectByUUID(projectUUID); err != nil {
+		return nil, ErrProjectNotFound
+	}
+	if len(orderedUUIDs) == 0 {
+		return []models.Configuration{}, nil
+	}
+
+	seen := make(map[string]struct{}, len(orderedUUIDs))
+	normalized := make([]string, 0, len(orderedUUIDs))
+	for _, raw := range orderedUUIDs {
+		u := strings.TrimSpace(raw)
+		if u == "" {
+			return nil, fmt.Errorf("ordered_uuids contains empty uuid")
+		}
+		if _, exists := seen[u]; exists {
+			return nil, fmt.Errorf("ordered_uuids contains duplicate uuid: %s", u)
+		}
+		seen[u] = struct{}{}
+		normalized = append(normalized, u)
+	}
+
+	err := s.localDB.DB().Transaction(func(tx *gorm.DB) error {
+		var active []localdb.LocalConfiguration
+		if err := tx.Where("project_uuid = ? AND is_active = ?", projectUUID, true).
+			Find(&active).Error; err != nil {
+			return fmt.Errorf("load project active configurations: %w", err)
+		}
+		if len(active) != len(normalized) {
+			return fmt.Errorf("ordered_uuids count mismatch: expected %d got %d", len(active), len(normalized))
+		}
+
+		byUUID := make(map[string]*localdb.LocalConfiguration, len(active))
+		for i := range active {
+			cfg := active[i]
+			byUUID[cfg.UUID] = &cfg
+		}
+		for _, id := range normalized {
+			if _, ok := byUUID[id]; !ok {
+				return fmt.Errorf("configuration %s not found in project %s", id, projectUUID)
+			}
+		}
+
+		now := time.Now()
+		for idx, id := range normalized {
+			cfg := byUUID[id]
+			newLine := (idx + 1) * 10
+			if cfg.Line == newLine {
+				continue
+			}
+
+			cfg.Line = newLine
+			cfg.UpdatedAt = now
+			cfg.SyncStatus = "pending"
+
+			if err := tx.Save(cfg).Error; err != nil {
+				return fmt.Errorf("save reordered configuration %s: %w", cfg.UUID, err)
+			}
+
+			version, err := s.loadVersionForPendingTx(tx, cfg)
+			if err != nil {
+				return err
+			}
+			if err := s.enqueueConfigurationPendingChangeTx(tx, cfg, "update", version, ""); err != nil {
+				return fmt.Errorf("enqueue reorder pending change for %s: %w", cfg.UUID, err)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var localConfigs []localdb.LocalConfiguration
+	if err := s.localDB.DB().
+		Preload("CurrentVersion").
+		Where("project_uuid = ? AND is_active = ?", projectUUID, true).
+		Order("CASE WHEN COALESCE(line_no, 0) <= 0 THEN 2147483647 ELSE line_no END ASC, created_at DESC, id DESC").
+		Find(&localConfigs).Error; err != nil {
+		return nil, fmt.Errorf("load reordered configurations: %w", err)
+	}
+
+	result := make([]models.Configuration, 0, len(localConfigs))
+	for i := range localConfigs {
+		result = append(result, *localdb.LocalToConfiguration(&localConfigs[i]))
+	}
+	return result, nil
+}
+
 // ImportFromServer imports configurations from MariaDB to local SQLite cache.
 func (s *LocalConfigurationService) ImportFromServer() (*sync.ConfigImportResult, error) {
 	return s.syncService.ImportConfigurationsToLocal()
@@ -881,33 +1116,43 @@ func (s *LocalConfigurationService) isOwner(cfg *localdb.LocalConfiguration, own
 
 func (s *LocalConfigurationService) createWithVersion(localCfg *localdb.LocalConfiguration, createdBy string) error {
 	return s.localDB.DB().Transaction(func(tx *gorm.DB) error {
-		if err := tx.Create(localCfg).Error; err != nil {
-			return fmt.Errorf("create local configuration: %w", err)
-		}
-
-		version, err := s.appendVersionTx(tx, localCfg, "create", createdBy)
-		if err != nil {
-			return fmt.Errorf("append create version: %w", err)
-		}
-
-		if err := tx.Model(&localdb.LocalConfiguration{}).
-			Where("uuid = ?", localCfg.UUID).
-			Update("current_version_id", version.ID).Error; err != nil {
-			return fmt.Errorf("set current version id: %w", err)
-		}
-		localCfg.CurrentVersionID = &version.ID
-
-		if err := s.enqueueConfigurationPendingChangeTx(tx, localCfg, "create", version, createdBy); err != nil {
-			return fmt.Errorf("enqueue create pending change: %w", err)
-		}
-		if err := s.recalculateLocalPricelistUsageTx(tx); err != nil {
-			return fmt.Errorf("recalculate local pricelist usage: %w", err)
-		}
-
-		return nil
+		return s.createWithVersionTx(tx, localCfg, createdBy)
 	})
 }
 
+func (s *LocalConfigurationService) createWithVersionTx(tx *gorm.DB, localCfg *localdb.LocalConfiguration, createdBy string) error {
+	if localCfg.IsActive {
+		if err := s.ensureConfigurationLineTx(tx, localCfg); err != nil {
+			return err
+		}
+	}
+	if err := tx.Create(localCfg).Error; err != nil {
+		return fmt.Errorf("create local configuration: %w", err)
+	}
+
+	version, err := s.appendVersionTx(tx, localCfg, "create", createdBy)
+	if err != nil {
+		return fmt.Errorf("append create version: %w", err)
+	}
+
+	if err := tx.Model(&localdb.LocalConfiguration{}).
+		Where("uuid = ?", localCfg.UUID).
+		Update("current_version_id", version.ID).Error; err != nil {
+		return fmt.Errorf("set current version id: %w", err)
+	}
+	localCfg.CurrentVersionID = &version.ID
+	localCfg.CurrentVersion = version
+
+	if err := s.enqueueConfigurationPendingChangeTx(tx, localCfg, "create", version, createdBy); err != nil {
+		return fmt.Errorf("enqueue create pending change: %w", err)
+	}
+	if err := s.recalculateLocalPricelistUsageTx(tx); err != nil {
+		return fmt.Errorf("recalculate local pricelist usage: %w", err)
+	}
+
+	return nil
+}
+
 func (s *LocalConfigurationService) saveWithVersionAndPending(localCfg *localdb.LocalConfiguration, operation string, createdBy string) (*models.Configuration, error) {
 	var cfg *models.Configuration
 
@@ -922,6 +1167,45 @@ func (s *LocalConfigurationService) saveWithVersionAndPending(localCfg *localdb.
 			return fmt.Errorf("lock configuration row: %w", err)
 		}
 
+		if operation == "update" {
+			currentVersion, err := s.loadCurrentVersionTx(tx, &locked)
+			if err != nil {
+				return fmt.Errorf("load current version before save: %w", err)
+			}
+
+			// Legacy/orphaned rows may have empty or stale current_version_id.
+			// In that case we treat update as content-changing and append a fresh version.
+			if currentVersion != nil {
+				sameRevisionContent, err := s.hasSameRevisionContent(localCfg, currentVersion)
+				if err != nil {
+					return fmt.Errorf("compare revision content: %w", err)
+				}
+				if sameRevisionContent {
+					if !hasNonRevisionConfigurationChanges(&locked, localCfg) {
+						cfg = localdb.LocalToConfiguration(&locked)
+						return nil
+					}
+					if err := tx.Save(localCfg).Error; err != nil {
+						return fmt.Errorf("save local configuration (no new revision): %w", err)
+					}
+					cfg = localdb.LocalToConfiguration(localCfg)
+					if err := s.enqueueConfigurationPendingChangeTx(tx, localCfg, operation, currentVersion, createdBy); err != nil {
+						return fmt.Errorf("enqueue %s pending change without revision: %w", operation, err)
+					}
+					if err := s.recalculateLocalPricelistUsageTx(tx); err != nil {
+						return fmt.Errorf("recalculate local pricelist usage: %w", err)
+					}
+					return nil
+				}
+			}
+		}
+
+		if localCfg.IsActive {
+			if err := s.ensureConfigurationLineTx(tx, localCfg); err != nil {
+				return err
+			}
+		}
+
 		if err := tx.Save(localCfg).Error; err != nil {
 			return fmt.Errorf("save local configuration: %w", err)
 		}
@@ -937,6 +1221,7 @@ func (s *LocalConfigurationService) saveWithVersionAndPending(localCfg *localdb.
 			return fmt.Errorf("update current version id: %w", err)
 		}
 		localCfg.CurrentVersionID = &version.ID
+		localCfg.CurrentVersion = version
 
 		cfg = localdb.LocalToConfiguration(localCfg)
 		if err := s.enqueueConfigurationPendingChangeTx(tx, localCfg, operation, version, createdBy); err != nil {
@@ -955,6 +1240,193 @@ func (s *LocalConfigurationService) saveWithVersionAndPending(localCfg *localdb.
 	return cfg, nil
 }
 
+func hasNonRevisionConfigurationChanges(current *localdb.LocalConfiguration, next *localdb.LocalConfiguration) bool {
+	if current == nil || next == nil {
+		return true
+	}
+	if current.Name != next.Name ||
+		current.Notes != next.Notes ||
+		current.IsTemplate != next.IsTemplate ||
+		current.ServerModel != next.ServerModel ||
+		current.SupportCode != next.SupportCode ||
+		current.Article != next.Article ||
+		current.IsActive != next.IsActive ||
+		current.Line != next.Line {
+		return true
+	}
+	if !equalStringPtr(current.ProjectUUID, next.ProjectUUID) {
+		return true
+	}
+	return false
+}
+
+func (s *LocalConfigurationService) UpdateVendorSpecNoAuth(uuid string, spec localdb.VendorSpec) (*models.Configuration, error) {
+	localCfg, err := s.localDB.GetConfigurationByUUID(uuid)
+	if err != nil {
+		return nil, ErrConfigNotFound
+	}
+
+	localCfg.VendorSpec = spec
+	localCfg.UpdatedAt = time.Now()
+	localCfg.SyncStatus = "pending"
+
+	cfg, err := s.saveWithVersionAndPending(localCfg, "update", "")
+	if err != nil {
+		return nil, fmt.Errorf("update vendor spec without auth with version: %w", err)
+	}
+	return cfg, nil
+}
+
+func (s *LocalConfigurationService) ApplyVendorSpecItemsNoAuth(uuid string, items localdb.LocalConfigItems) (*models.Configuration, error) {
+	localCfg, err := s.localDB.GetConfigurationByUUID(uuid)
+	if err != nil {
+		return nil, ErrConfigNotFound
+	}
+
+	localCfg.Items = items
+	total := items.Total()
+	if localCfg.ServerCount > 1 {
+		total *= float64(localCfg.ServerCount)
+	}
+	localCfg.TotalPrice = &total
+	localCfg.UpdatedAt = time.Now()
+	localCfg.SyncStatus = "pending"
+
+	cfg, err := s.saveWithVersionAndPending(localCfg, "update", "")
+	if err != nil {
+		return nil, fmt.Errorf("apply vendor spec items without auth with version: %w", err)
+	}
+	return cfg, nil
+}
+
+func equalStringPtr(a, b *string) bool {
+	if a == nil && b == nil {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
+	return strings.TrimSpace(*a) == strings.TrimSpace(*b)
+}
+
+func equalUintPtr(a, b *uint) bool {
+	if a == nil && b == nil {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
+	return *a == *b
+}
+
+func (s *LocalConfigurationService) loadCurrentVersionTx(tx *gorm.DB, localCfg *localdb.LocalConfiguration) (*localdb.LocalConfigurationVersion, error) {
+	var version localdb.LocalConfigurationVersion
+	if localCfg.CurrentVersionID != nil && *localCfg.CurrentVersionID != "" {
+		if err := tx.Where("id = ?", *localCfg.CurrentVersionID).First(&version).Error; err == nil {
+			return &version, nil
+		} else if !errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, err
+		}
+	}
+
+	if err := tx.Where("configuration_uuid = ?", localCfg.UUID).
+		Order("version_no DESC").
+		First(&version).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return &version, nil
+}
+
+func (s *LocalConfigurationService) loadVersionForPendingTx(tx *gorm.DB, localCfg *localdb.LocalConfiguration) (*localdb.LocalConfigurationVersion, error) {
+	if localCfg.CurrentVersionID != nil && *localCfg.CurrentVersionID != "" {
+		var current localdb.LocalConfigurationVersion
+		if err := tx.Where("id = ?", *localCfg.CurrentVersionID).First(&current).Error; err == nil {
+			return &current, nil
+		}
+	}
+
+	var latest localdb.LocalConfigurationVersion
+	if err := tx.Where("configuration_uuid = ?", localCfg.UUID).
+		Order("version_no DESC").
+		First(&latest).Error; err != nil {
+		if !errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, fmt.Errorf("load version for pending change: %w", err)
+		}
+
+		// Legacy/imported rows may exist without local version history.
+		// Bootstrap the first version so pending sync payloads can reference a version.
+		version, createErr := s.appendVersionTx(tx, localCfg, "bootstrap", "")
+		if createErr != nil {
+			return nil, fmt.Errorf("bootstrap version for pending change: %w", createErr)
+		}
+		if err := tx.Model(&localdb.LocalConfiguration{}).
+			Where("uuid = ?", localCfg.UUID).
+			Update("current_version_id", version.ID).Error; err != nil {
+			return nil, fmt.Errorf("set current version id for bootstrapped pending change: %w", err)
+		}
+		localCfg.CurrentVersionID = &version.ID
+		return version, nil
+	}
+	return &latest, nil
+}
+
+func (s *LocalConfigurationService) ensureConfigurationLineTx(tx *gorm.DB, localCfg *localdb.LocalConfiguration) error {
+	if localCfg == nil || !localCfg.IsActive {
+		return nil
+	}
+
+	needsAssign := localCfg.Line <= 0
+	if !needsAssign {
+		query := tx.Model(&localdb.LocalConfiguration{}).
+			Where("is_active = ? AND line_no = ?", true, localCfg.Line)
+
+		if strings.TrimSpace(localCfg.UUID) != "" {
+			query = query.Where("uuid <> ?", strings.TrimSpace(localCfg.UUID))
+		}
+
+		if localCfg.ProjectUUID != nil && strings.TrimSpace(*localCfg.ProjectUUID) != "" {
+			query = query.Where("project_uuid = ?", strings.TrimSpace(*localCfg.ProjectUUID))
+		} else {
+			query = query.Where("project_uuid IS NULL OR TRIM(project_uuid) = ''")
+		}
+
+		var conflicts int64
+		if err := query.Count(&conflicts).Error; err != nil {
+			return fmt.Errorf("check line_no conflict for configuration %s: %w", localCfg.UUID, err)
+		}
+		needsAssign = conflicts > 0
+	}
+
+	if needsAssign {
+		line, err := localdb.NextConfigurationLineTx(tx, localCfg.ProjectUUID, localCfg.UUID)
+		if err != nil {
+			return fmt.Errorf("assign line_no for configuration %s: %w", localCfg.UUID, err)
+		}
+		localCfg.Line = line
+	}
+	return nil
+}
+
+func (s *LocalConfigurationService) hasSameRevisionContent(localCfg *localdb.LocalConfiguration, currentVersion *localdb.LocalConfigurationVersion) (bool, error) {
+	currentSnapshotCfg, err := s.decodeConfigurationSnapshot(currentVersion.Data)
+	if err != nil {
+		return false, fmt.Errorf("decode current version snapshot: %w", err)
+	}
+
+	currentFingerprint, err := localdb.BuildConfigurationSpecPriceFingerprint(currentSnapshotCfg)
+	if err != nil {
+		return false, fmt.Errorf("build current snapshot fingerprint: %w", err)
+	}
+	nextFingerprint, err := localdb.BuildConfigurationSpecPriceFingerprint(localCfg)
+	if err != nil {
+		return false, fmt.Errorf("build next snapshot fingerprint: %w", err)
+	}
+	return currentFingerprint == nextFingerprint, nil
+}
+
 func (s *LocalConfigurationService) appendVersionTx(
 	tx *gorm.DB,
 	localCfg *localdb.LocalConfiguration,
@@ -1049,8 +1521,18 @@ func (s *LocalConfigurationService) rollbackToVersion(configurationUUID string,
 		current.Notes = rollbackData.Notes
 		current.IsTemplate = rollbackData.IsTemplate
 		current.ServerCount = rollbackData.ServerCount
+		current.ServerModel = rollbackData.ServerModel
+		current.SupportCode = rollbackData.SupportCode
+		current.Article = rollbackData.Article
 		current.PricelistID = rollbackData.PricelistID
+		current.WarehousePricelistID = rollbackData.WarehousePricelistID
+		current.CompetitorPricelistID = rollbackData.CompetitorPricelistID
+		current.DisablePriceRefresh = rollbackData.DisablePriceRefresh
 		current.OnlyInStock = rollbackData.OnlyInStock
+		current.VendorSpec = rollbackData.VendorSpec
+		if rollbackData.Line > 0 {
+			current.Line = rollbackData.Line
+		}
 		current.PriceUpdatedAt = rollbackData.PriceUpdatedAt
 		current.UpdatedAt = time.Now()
 		current.SyncStatus = "pending"