Link the card title instead of an extra button in the mail

The plain-text part gets the card URL on its own line. Bumps to 35.2.2.
Condense each moved card to one sentence in the mail
2026-09-30 11:05:22 +02:00 · 2026-09-30 11:02:04 +02:00 · 2026-09-30 10:41:20 +02:00 · 2026-09-30 10:39:12 +02:00 · 2026-09-30 10:31:45 +02:00 · 2026-09-30 10:27:13 +02:00
23 changed files with 1050 additions and 1283 deletions
@@ -1,220 +1,157 @@
 # CLAUDE.md
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+Leitfaden für Claude Code (claude.ai/code) in diesem Repository.
-## What this is
+## Worum es geht
-A Nextcloud app (`workflow_deck_automation`, namespace `WorkflowDeckAutomation`) targeting **Nextcloud Hub 26 Spring (server 34.x)**. It lets each user configure, from their personal settings, automation "workflows" that move [Deck](https://github.com/nextcloud/deck) cards from one stack to another once their due date or start date has passed, with optional assigned-user/label filters and an email notification. A background `Job` evaluates all enabled workflows on every cron pass.
+Nextcloud-App `workflow_deck_automation` (Namespace `WorkflowDeckAutomation`) für **Nextcloud 35** (`main`, `min-version="35" max-version="35"`). Jeder Nutzer legt in seinen persönlichen Einstellungen „Workflows“ an, die überfällige [Deck](https://github.com/nextcloud/deck)-Karten von einem Stack in einen anderen verschieben, optional mit Mail. Es gibt bewusst **keine Kartenfilter**: ein Workflow verschiebt *jede* überfällige Karte seines Quell-Stacks. Ein Hintergrund-`Job` wertet alle aktiven Workflows bei jedem Cron-Lauf aus.
-## Non-negotiable architectural constraint
+## Harte Vorgabe: keine HTTP/OCS-Aufrufe gegen Deck
-**No HTTP/OCS calls against Deck, anywhere.** Every read (boards, stacks, cards, labels, assigned users) and the card move itself must go through Deck's own internal PHP classes (`OCA\Deck\Service\CardService`, `StackService`, `BoardService`, `OCA\Deck\Db\CardMapper`, …), resolved in-process via `\OCP\Server::get()`. This was an explicit, repeated product requirement from the user — do not "fix" it by switching to `IClientService`/`curl` against `/ocs/...`, even though that would be the more conventional cross-app integration approach.
+Alle Lesezugriffe (Boards, Stacks, Karten) und das Verschieben laufen über Decks interne PHP-Klassen (`OCA\Deck\Service\*`, `OCA\Deck\Db\*`), in-process per `\OCP\Server::get()`. Das ist eine ausdrückliche, wiederholte Anforderung des Nutzers – nicht auf `IClientService`/`curl` gegen `/ocs/...` „umbauen“.
-All Deck access is funneled through `lib/Service/DeckIntegrationService.php` — it is the *only* class that references `OCA\Deck\*`. If you need new Deck data, extend that class rather than reaching into Deck internals from elsewhere. Every call in there is wrapped (`class_exists()` checks, `IAppManager::isEnabledForUser('deck', …)`, try/catch → `DeckUnavailableException`) because `OCA\Deck\*` is not a documented/stable public API — it has no `@since` markers and can change between Deck releases without notice.
+**Nur `lib/Service/DeckIntegrationService.php` referenziert `OCA\Deck\*`.** Neue Deck-Daten → diese Klasse erweitern. Jeder Aufruf dort ist abgesichert (`class_exists()`, `IAppManager::isEnabledForUser('deck', …)`, try/catch → `DeckUnavailableException`), weil `OCA\Deck\*` keine stabile, dokumentierte API ist (keine `@since`-Marker).
-## `method_exists()` cannot see Deck's getters — use `property_exists()`
+## Impersonation im Hintergrundjob – Decks eingefrorene `$userId`
-`Card`, `Board`, `Label`, `Acl` and `Assignment` declare **no getters as real code**. `getStartdate()`, `getDuedate()`, `getDeletedAt()`, `getArchived()`, even `getId()` are `@method` docblocks resolved by `OCP\AppFramework\Db\Entity::__call()` (`Entity` itself declares neither `getId()` nor `setId()`). `method_exists()` ignores `__call()` by definition, so **every `method_exists($deckEntity, 'getSomething')` probe in this app is permanently false**, on every Deck version, and the guarded branch is dead code that fails open or closed without a sound.
+`WorkflowRunner` gruppiert Workflows nach Owner und impersoniert jeden nacheinander, in zwei Schritten (beide im `finally` via `clearImpersonation()` zurückgesetzt):
-`DeckIntegrationService::getCardDate()` therefore probes `property_exists($card, 'startdate')` — the protected property declaration is visible, and it is exactly what `Entity::getter()` checks before throwing `BadFunctionCallException`. Use that shape for any new optional Deck field.
+1. `IUserSession::setUser()` + `IRootFolder::getUserFolder()` – für die wenigen Dienste, die die Session lesen. Nebensächlich.
 2. `DeckIntegrationService::beginUserContext()` – **der tragende Teil.**
-**Known dead probes still in the tree** (each one a separate fix, none of them yet made — verify against a live instance before touching, since the symptoms are silent):
+**Deck liest für Berechtigungen nie die Session.** `PermissionService` (hinter jeder Prüfung, auch in `CardService::reorder()`), `CardService`, `BoardService` und `ActivityManager` halten `private ?string $userId` aus dem `userId`-Service des Deck-Containers – *shared*, also einmal pro Prozess aufgelöst. Im Cron ist das nie der impersonierte Nutzer, sondern `null` (wenn vorher ein Deck-Job lief) oder der erste Owner. `null` lässt jede Prüfung mit `NoPermissionException` scheitern.
- `getCardLabelIds()` / `extractParticipantUid()` — always return `[]`/`null`, so **label and assigned-user filters cannot match any card**, and ACL participants never reach the settings dropdown. Only the board owner survives, because `RelationalObject::getPrimaryKey()` *is* real code — which is why the bug is invisible on a private board (empty ACL, owner = the user themselves) and looks fixed.
+`beginUserContext()` überschreibt daher das private Feld per Reflection und `endUserContext()` stellt es wieder her. `PermissionService` ist Pflicht: klappt das Pinnen nicht, wirft die Methode und der Runner **überspringt den Nutzer komplett**. Die anderen drei sind best effort (nur Activity-Zuordnung/Unread-Zähler).
 - `getActiveCardsInStack()`'s `getDeletedAt` check — trashed cards are moved.
 - `findStackIds()`'s `getDeletedAt` check — a board in the trash is not recognised as gone.
 - `isBoardHidden()` — dead, but masked by `getUserBoards(null, false)` doing the filtering server-side.
-## The Deck version floor lives in code, because info.xml cannot express it
+**Regel:** Bevor ein weiterer `OCA\Deck\*`-Dienst im Runner genutzt wird, prüfen, ob er eine eingefrorene `$userId` trägt – der Fehler ist still und nutzerübergreifend. Bevorzugt Mapper (QBMapper ohne Nutzerzustand) oder Methoden mit explizitem uid-Parameter verwenden. Deshalb wird `BoardService::getUserBoards()` nicht verwendet.
-`DeckIntegrationService::MIN_DECK_VERSION` (`1.18.0`) plus the `version_compare()` in `assertDeckAvailable()` is the *only* enforcement point for "this app needs a recent Deck". Neither the server's `resources/app-info.xsd` nor the app store's `info.xsd` has an app-to-app dependency element — `<dependencies>` takes only `php`, `database`, `command`, `lib`, `owncloud`, `nextcloud`, `architecture`, `backend`. Don't go looking for a `<app min-version=…>`; it does not exist in either schema.
+Die Fälligkeitslogik `WorkflowRunner::isOverdue()` und die Empfängerregel `NotificationPolicy::shouldNotify()` sind bewusst `static` und seiteneffektfrei, also ohne Deck unit-testbar (`tests/Unit/Service/`). Das sind die einzigen getesteten Teile der App. Neue reine Logik in dieser Form halten.
-`<nextcloud min-version="34" max-version="34"/>` already does most of the work and is the strictest pin available: **Deck 1.18.x is the only Deck release line declaring `>=34.0.0,<35.0.0`**, and 1.18.0 is exactly the release that added the card start date (`Card::$startdate`, PR #7749). So on any Nextcloud this app installs on, Deck already has that field, and 1.17.x cannot be enabled at all (its own `max-version` is 33, so a server upgrade to 34 disables it). What the version check still covers is a Deck dropped in by hand or checked out from git.
+## Workflows werden deaktiviert, wenn Board/Stack verschwinden
-`version_compare()` sorts `1.18.0-beta.x` *below* `1.18.0`. That is intended — pre-releases of that line may predate the field. Since `assertDeckAvailable()` is called from both the controller (→ `OCSPreconditionFailedException`, visible as an error on the settings page) and the runner (→ skip + info log), a too-old Deck degrades in both places instead of failing halfway through a card move.
+`WorkflowRunner::findBrokenTarget()` prüft vor jedem Lauf Board und Stacks; fehlt etwas, wird der Workflow abgeschaltet (`enabled = false`) und einmalig gemailt. Invarianten:
-## Per-user impersonation in the background job
+- **Nur positives Wissen deaktiviert.** `findStackIds()` liefert `null` nur bei „Board-Zeile weg“ (`DoesNotExistException`, Decks `NotFoundException`), „Board im Papierkorb“ (`deleted_at > 0`) oder „uid hat keine Leserechte“ – alles andere *wirft*, und der Runner überspringt den Workflow. Degradiert die Methode auf `[]`/`null`, deaktiviert ein Deck-Ausfall alle Workflows der Instanz und mailt alle Nutzer an.
 - **`findStackIds()` fragt nie einen Deck-Dienst, *wer* fragt.** Sie bekommt die uid als Argument und nutzt nur `BoardMapper`/`StackMapper` plus `PermissionService::getPermissions($boardId, $userId)` mit expliziter uid. Nicht zu `StackService::findAll($boardId)` „vereinfachen“ – genau das prüfte gegen die eingefrorene `null`-uid, warf `NoPermissionException`, wurde als „Board weg“ gelesen und verschickte Deaktivierungsmails für intakte Boards.
 - **`NoPermissionException` beweist nichts** und steht deshalb bewusst nicht in `isMissing()`.
 - **Die Deaktivierungsmail ignoriert `notifyMode`** (das betrifft verschobene Karten) und geht immer nur an den Owner. Sie bleibt einmalig, weil `findAllEnabled()` deaktivierte Workflows nicht mehr lädt.
-`RunWorkflowsJob` has no logged-in user by default and must evaluate workflows belonging to many different users within one PHP process. `lib/Service/WorkflowRunner.php` therefore groups workflows by owner and impersonates each owner in turn. **Impersonation here is two steps, and `IUserSession::setUser()` is the one that barely matters:**
+Archivierte Boards lösen das nicht aus (sie bleiben lesbar), werden aber in den Dropdowns ausgeblendet.
-1. `IUserSession::setUser()` — for the handful of Nextcloud services that do read the live session, plus `IRootFolder::getUserFolder()` for Deck helpers that expect an initialised user FS.
+## Ein Workflow gehört dem Board-Owner, nicht seinem Ersteller
 2. `DeckIntegrationService::beginUserContext()` — pins **Deck itself** to that user. This is the load-bearing half.
-Both are undone in a `finally` (`WorkflowRunner::clearImpersonation()`).
+Wird ein Board in Deck übertragen, wandern seine Workflows mit.
-**Deck does not read the session for permissions. At all.** `PermissionService` — the class behind every permission check, including the ones inside `CardService::reorder()` — takes the current user as `private ?string $userId`, and so do `CardService`, `BoardService` and `ActivityManager`. That string comes from the app container's `userId` service, which is `ISession::get('user_id')` registered via `registerService()`, i.e. **shared**: Pimple resolves it once and caches it for the whole process, and `ServerContainer` caches Deck's app container just as long. Whoever was active when Deck's container first built `PermissionService` is who every later check is evaluated against.
+- **„Meine Boards“** = `listOwnedBoards($uid)` → `BoardMapper::findAllByOwner($uid)` (keine geteilten Boards, keine eingefrorene uid). Diese Mapper-Methode filtert weder Papierkorb noch Archiv: Papierkorb-Boards werden verworfen, archivierte mit `archived: true` behalten (Workflows sichtbar, aber nicht im Dropdown, von `validate()` abgelehnt). Wirft statt `[]` zurückzugeben – `[]` würde alle Workflows des Nutzers verstecken.
 - **Auflisten/Bearbeiten/Löschen** nur über `board_id IN (listOwnedBoards)` (`WorkflowMapper::findAllForBoards()`, `WorkflowController::findOwnWorkflow()`). `user_id` spielt keine Rolle – keine `user_id`-Abfragen im Controller wieder einführen.
 - **Anlegen/Speichern** validiert gegen dieselbe Liste und setzt `user_id` auf den aktuellen Nutzer.
 - **Runner:** `followBoardOwner()` → `findBoardOwner()` (`BoardMapper::find()`) schreibt einen abweichenden Owner in `user_id` zurück. Lauf und Mails gehen also an den aktuellen Owner. Ein verschwundenes Board behält den letzten Owner, damit `findBrokenTarget()` ihn anmailen kann.
-In cron that is *never* the user being impersonated: `null` if any Deck-owned background job ran earlier in the same `cron.php` pass, otherwise the first workflow owner touched. `null` fails every check, so Deck answers `NoPermissionException` for perfectly intact boards. This produced a real bug — see the next section. `beginUserContext()` therefore swaps that private field directly (there is no API), records the old value, and `endUserContext()` puts it back. `PermissionService` is mandatory: if it can't be pinned, `beginUserContext()` throws and the runner **skips that user entirely** rather than acting under someone else's permissions. The other three are best-effort (they only affect activity attribution and unread counts).
+`user_id` heißt also nur „als wer läuft der Job / wer bekommt Mail“.
-Consequence for `getUserBoards()`: `listBoardsForCurrentUser()` stays **request-only** anyway — Deck may already have cached board lists behind that field, and the job has no use for a board *list*; it asks `findStackIds()` about one known board id. Before using any other `OCA\Deck\*` service from the runner, check whether it carries a frozen `$userId` — the failure mode is silent and user-crossing, not an error.
+## Mails über verschobene Karten folgen Decks Benachrichtigungseinstellung
-The filter logic (`WorkflowRunner::cardMatchesFilters()`, `::hasPassed()`, `::findDeadFilters()`) is deliberately `static` and side-effect-free so it's unit-testable without a real Deck installation — see `tests/Unit/Service/WorkflowRunnerFilterTest.php`. Keep new pure logic in that shape; it is the only part of this app that has tests at all.
+`notify_mode` (`NotificationPolicy::MODES`) ersetzt seit `Version1002…`/`Version1003…` das frühere `notify_email` (`true` → `owner`):
-## Due date or start date, per workflow
+- `off`: keine Mail. `owner`: nur der Board-Owner, ohne Rücksicht auf seine Deck-Einstellung (altes Verhalten).
 - `board`: alle Board-Berechtigten, gefiltert nach deren Deck-Nutzereinstellung `deck` / `board:<id>:notify-due` (`off`/`assigned`/`all`, Default `assigned`). `NotificationPolicy::shouldNotify()` bildet Decks Regel aus `NotificationHelper::sendCardDuedate()` nach und ist reine, getestete Logik. Dazu gehört: Der Owner eines ungeteilten Boards wird außer bei `off` immer benachrichtigt.
 - `DeckIntegrationService::findNotificationRecipients()` nutzt nur uid-explizite Bausteine: `PermissionService::findUsers($boardId, true)` (Owner + ACL, löst Gruppen/Circles auf, `true` umgeht den Prozess-Cache), `AssignmentMapper::isUserAssigned()` (auch Gruppen-/Circle-Zuweisungen) und `IConfig`. `FederatedUser` wird übersprungen. Bei jedem Fehler wirft die Methode, und der Runner verschickt dann **keine** Mail, statt an eine falsch aufgelöste Empfängerliste zu schicken.
 - Der Runner sammelt verschobene Karten in `$pendingMails` und verschickt **nach** der Nutzer-Schleife (also ohne Impersonation) eine Sammelmail pro Empfänger und Lauf.
-Each workflow carries a `date_field` (`'due'` | `'start'`, `Workflow::DATE_FIELD_*`) deciding which Deck card date it watches. `WorkflowRunner::hasPassed()` (formerly `isOverdue()`) is one function for both, because the comparison is identical — the raw timestamp against `$now` — and the whole argument against Deck's day-truncating `getDaysUntilDue()` applies unchanged to the start date. What differs is only the wording, in the UI and in `NotificationMailer`.
+## Nur Deutsch, keine Übersetzungen
-Three places keep an unknown value from becoming a surprise trigger, and all three resolve **towards the due date**, because that is what every workflow meant before the choice existed:
+Die App wird nur intern genutzt und spricht ausschließlich Deutsch. Oberfläche, Controller-Fehlermeldungen (erscheinen im Formular), Sektionsname und Mails sind direkt auf Deutsch geschrieben. Es gibt kein `IL10N` und keinen `l10n/`-Ordner. Nextclouds eigene Mail-Fußzeile wird per `addFooter('', 'de')` ebenfalls deutsch, sonst würde sie im Cron der Instanz-Standardsprache folgen. Log-Meldungen bleiben englisch. Neue nutzersichtbare Texte auf Deutsch schreiben, mit „du“ wie im Rest der App.
- the column default `'due'`, which is also the entire migration for existing rows (`Version1001Date20260825120000`, a separate step because `Version1000…` is wrapped in `hasTable()` and would never reach an existing install),
+## Fälligkeit wird als UTC-Zeitpunkt verglichen
 - `Workflow::getDateFieldOrDue()`, for entities that were never near the database and for hand-edited rows,
 - `DeckIntegrationService::CARD_DATE_PROPERTIES`'s `?? DEFAULT_CARD_DATE`.
-The controller is the exception: it *rejects* an unknown `dateField` instead of normalising it, since a client asking for a rule it would not get should hear about it.
+Decks `duedate` ist eine `DATETIME`-Spalte ohne Zeitzone mit UTC-Uhrzeit (Frontend sendet `toISOString()`). `Entity` baut daraus `new \DateTime($string)` in PHPs Standardzone, die Nextcloud auf UTC setzt. `WorkflowRunner::asStoredUtc()` legt die Uhrzeit trotzdem ausdrücklich auf UTC fest, damit das Ergebnis nicht von dieser Standardzone abhängt. Decks eigene Pfade `Card::getDaysUntilDue()` (tagesgenau) und `CardMapper::findOverdue()` (vergleicht mit dem `NOW()` der Datenbank, also Ortszeit) sind dafür ungeeignet und werden nicht verwendet.
-## Workflows are auto-disabled when their Deck targets vanish
+## Kartenfilter wurden entfernt
-`WorkflowRunner::findBrokenTarget()` checks board and stacks before every run and, if something is gone, switches the workflow off (`enabled = false`) and sends a one-off mail. Two invariants hold this together and must survive refactors:
+Die früheren Filter (`filter_user_ids`/`filter_label_ids`) wurden auf Wunsch entfernt. `Version1001Date20260930120000` löscht die Spalten, und gefilterte Workflows laufen seitdem *ungefiltert* weiter (bewusste Entscheidung). Die Spalten müssen gelöscht bleiben: `Entity::fromRow()` ruft pro Spalte einen Setter auf, den `Workflow` nicht mehr hat. Mit entfernt wurden: Labels-/Participants-Endpunkte, `listLabels()`/`listParticipants()`/`findFilterOptions()` und `CardService::enrichCards()` in `getActiveCardsInStack()` (lief über `BoardService::find()` mit eingefrorener uid). Die Karten dort sind also **nicht angereichert** (keine `assignedUsers`/Labels).
- **Only positive knowledge disables.** `DeckIntegrationService::findStackIds()` returns `null` only for "board row gone" (`DoesNotExistException`, Deck's `NotFoundException`), "board in the trash" (`deleted_at > 0`), or "this uid has no read permission" — and *throws* for everything else. The runner skips the workflow on a throw. If you make that method degrade to `[]`/`null` on generic errors, a Deck outage will disable every workflow on the instance and mail every user about it.
+## Der Job hat kein Intervall
 - **`findStackIds()` must never ask a Deck service to figure out *who* is asking.** It takes the uid as an argument and is assembled from pieces that cannot answer for the wrong user: `BoardMapper`/`StackMapper` are plain QBMappers with no user state, and `PermissionService::getPermissions($boardId, $userId)` is handed the uid explicitly instead of falling back to the frozen field. Do not "simplify" it back to a single `StackService::findAll($boardId)` — that is precisely what broke. `StackService::findAll()` runs `checkPermission()` with no uid, which falls through to the construction-time `$userId`; with that frozen to `null` in cron, Deck threw `NoPermissionException` for an untouched board, the old code read that as "board is gone", and users got "your workflow was deactivated" mails for boards sitting right in front of them. This layer stays correct even if `beginUserContext()` silently degrades.
 - **`NoPermissionException` is not evidence of anything.** It is deliberately *not* in `isMissing()`. Deck raises it for every failed check regardless of cause.
 - **The mail ignores the `notifyEmail` flag** — that flag is about moved cards; this is a notice that the user's configuration stopped working. It stays a one-off simply because a disabled workflow is not picked up by `findAllEnabled()` again.
-Archived boards deliberately do *not* trigger this (they stay readable, so `findStackIds()` succeeds), even though they're filtered out of the settings dropdowns.
+`RunWorkflowsJob` erweitert `OCP\BackgroundJob\Job`, **nicht** `TimedJob`: ein Lauf pro Cron-Durchgang, kein Intervall, keine Konfiguration (der frühere `config.php`-Schlüssel `workflow_deck_automation.interval` ist seit v0.2.0 weg). Nicht wieder einführen.
-## Dead filters are surfaced, never disabled
+**Zeitkritikalität entscheidet, ob der Job überhaupt läuft.** `CronService::runCli()` holt außerhalb des Wartungsfensters (`maintenance_window_start` … +4 h UTC) nur zeitkritische Jobs (`getNext($onlyTimeSensitive = true)`). Eine frühere Version war `TIME_INSENSITIVE` und lief auf Instanzen mit Wartungsfenster nie (`last_run = 1970-01-01`). Manuelle Tests (`background-job:worker '<Klasse>'`, Ajax/Webcron) umgehen dieses Gate, deshalb wirkt dort alles normal.
-`findBrokenTarget()` covers the board and the two stacks — **not** `filter_user_ids` / `filter_label_ids`. Those are plain id lists compared with `array_intersect()` in `cardMatchesFilters()`, so an entry that no longer exists simply stops matching. With three labels of which one was deleted that is exactly right, and disabling would be wrong.
+Als einfacher `Job` ist das ausgeschlossen: `JobList::add()` schreibt die Spalte `time_sensitive` nicht (Default `TIME_SENSITIVE`), und nur `JobList::setLastRun()` senkt sie – ausschließlich für `TimedJob && !isTimeSensitive()`, ohne Rückweg. Alte, einmal als insensitive gestempelte Zeilen bleiben es (auch nach App-Update). Einmalig reparieren:
 The pathological case is a filter whose entries are *all* gone: the workflow keeps running, updates `last_run`, and matches nothing — forever, with no mail, no log line and a healthy-looking row. It happens on deleted labels and just as easily on a user losing board access, because Deck's `BoardService::deleteAcl()` calls `assignedUsersMapper->deleteByParticipantOnBoard()` and wipes that user's card assignments.
 Two low-stakes signals, no state and no migration:
 - `WorkflowRunner::warnAboutDeadFilters()` logs a warning on every run.
 - `workflowIssues` in `src/PersonalSettings.vue` marks the row red.
 Both obey the same rule as the disable path: **only positive knowledge**. `DeckIntegrationService::findFilterOptions()` therefore *throws* instead of degrading to `[]` — unlike its siblings `listLabels()`/`listParticipants()`, which are wrapped in `call(…, [])` for the dropdowns, where an empty list is harmless. On the JS side the per-board caches store `null` for a failed request, and `isDeadFilter()` returns false for `null`; storing `[]` there would report every stack and filter of the board as deleted the moment one request fails. Don't collapse those two states back together.
 Deliberately no mail and no `enabled = false`: one board edit can revive the filter, and there is no "already warned" column to keep a mail one-off with (unlike the disable case, which is one-off for free because a disabled workflow is never picked up again).
 ## The job has no interval — one run per cron pass
 `RunWorkflowsJob` extends `OCP\BackgroundJob\Job`, **not** `TimedJob`, so it runs every time cron picks it up. There is no interval and no knob: the cadence *is* the instance's cron cadence. Don't reintroduce one — an earlier version read `workflow_deck_automation.interval` from `config.php` (default 300, 60s floor), and that config key is gone as of v0.2.0. `TimedJob` with `setInterval(0)` would behave nearly identically but keeps an interval concept nothing uses.
 **Time sensitivity is what actually decides whether the job runs at all.** `OC\Core\Service\CronService::runCli()` reads `maintenance_window_start` (default `100`, i.e. unset) and, whenever the current UTC hour is outside `[start, start+4]`, calls `jobList->getNext($onlyTimeSensitive = true)` — time-insensitive jobs are then skipped for the other 20 hours of the day. This app shipped `TIME_INSENSITIVE` once: on an instance with a maintenance window configured (Nextcloud's admin overview nags admins into setting one) the job simply never ran, showing `last_run = 1970-01-01` in `occ background-job:list` indefinitely. Note this gate only exists in `runCli()`, so it doesn't apply to ajax/webcron mode, and passing job classes explicitly (`occ background-job:worker '<class>'`) bypasses it — which is exactly why manual testing can look fine while cron does nothing.
 Being a plain `Job` makes that unreachable rather than merely declared. `getNext()` filters on the `time_sensitive` *column* of `oc_jobs`; `JobList::add()` doesn't write the column at all (it takes the `TIME_SENSITIVE` default), and the only place that ever lowers it is a one-way ratchet in `JobList::setLastRun()`:
 ```php
 if ($job instanceof TimedJob && !$job->isTimeSensitive()) {
    $query->set('time_sensitive', $query->createNamedParameter(IJob::TIME_INSENSITIVE));
 }
 ```
 There is no `else`, and a non-`TimedJob` never enters it. Note `setTimeSensitivity()`/`isTimeSensitive()` live on `TimedJob`, not on `Job` — so there is nothing to declare here, and nothing that can go wrong.
 **Rows written by an older version keep their stamp.** Once stamped `TIME_INSENSITIVE` it stays that way: re-registering an existing job (app update, `app:enable`) takes `add()`'s update branch, which leaves the column alone. An instance that ran the pre-v0.1.0-fix build still needs its row fixed once:
 ```sql
 UPDATE oc_jobs SET time_sensitive = 0
 WHERE class = 'OCA\\WorkflowDeckAutomation\\BackgroundJob\\RunWorkflowsJob';
 ```
-or, without DB access, `occ background-job:delete <id>` followed by `occ app:disable workflow_deck_automation && occ app:enable workflow_deck_automation` to get a freshly inserted row. Fresh installs are unaffected.
+oder `occ background-job:delete <id>`, dann `occ app:disable workflow_deck_automation && occ app:enable workflow_deck_automation`.
-To debug this job on a server: `occ background-job:list --class '<class>'` for its id and last run, then `occ background-job:execute <id> --force-execute` to run it right now without waiting for cron. `occ background-job:worker` takes **job classes**, not an app id.
+Debuggen: `occ background-job:list --class '<Klasse>'` (ID, letzter Lauf), dann `occ background-job:execute <id> --force-execute`. `background-job:worker` erwartet **Job-Klassen**, keine App-ID.
-## Registration is declarative, not Bootstrap-based
+## Registrierung deklarativ statt über Bootstrap
-Background jobs and classic personal settings are registered in `appinfo/info.xml` (`<background-jobs>`, `<settings><personal>/<personal-section>`), **not** via `IRegistrationContext` in `lib/AppInfo/Application.php` — that interface has no `registerBackgroundJob()`/`registerSettings()` methods on NC 34. `Application.php` is intentionally near-empty.
+Hintergrundjob und persönliche Einstellungen stehen in `appinfo/info.xml` (`<background-jobs>`, `<settings><personal>/<personal-section>`). `IRegistrationContext` hat dafür keine Methoden. `lib/AppInfo/Application.php` ist absichtlich fast leer.
-## Commands
+## Architektur
-**PHP and npm are not available in the local dev sandbox this repo is normally edited from.** Do not try to run `composer`, `php`, or `npm` locally to verify changes — they will fail with "command not found". Verification happens by pushing to `main` (or opening a PR) and checking the Gitea Actions run; the self-hosted runner tag is `gitea-runner-server03` (see `.gitea/workflows/*.yml`, all pinned to that `runs-on:` label).
+- **UI:** `src/PersonalSettings.vue` (Vue 3), gemountet aus `templates/settings/personal.php` (Sektion: `lib/Settings/PersonalSection.php` + `Personal.php`) → `src/api.js` → `lib/Controller/WorkflowController.php` (`OCSController`, Routen in `appinfo/routes.php`, `/ocs/v2.php/apps/workflow_deck_automation/api/v1/...`).
 - **Speicher:** `lib/Db/Workflow.php` / `WorkflowMapper.php`, Tabelle `wfda_workflows` (Migrationen in `lib/Migration/`).
 - **Automation:** `RunWorkflowsJob` → `WorkflowRunner` → `DeckIntegrationService` (alle Deck-Aufrufe) und `NotificationMailer` (`IMailer`, an die Account-Adressen der Empfänger, nie an eine eingegebene Adresse).
 - Controller (Dropdowns) und Runner (Karten lesen/verschieben) nutzen denselben `DeckIntegrationService`.
-Commands as they'd run in CI/on a machine that has the tools:
+## Befehle und Verifikation
 **Lokal gibt es kein PHP und kein npm** (Windows, siehe `CLAUDE.local.md`) – `composer`/`php`/`npm` nicht lokal ausführen. Verifiziert wird über Push/PR und den Gitea-Actions-Lauf (Runner `gitea-runner-server03`).
 ```bash
 composer install
-composer run lint       # php -l over lib/ and tests/
+composer run lint        # php -l über lib/ und tests/
-composer run cs:check   # nextcloud/coding-standard (php-cs-fixer); composer run cs:fix to auto-fix
+composer run cs:check    # nextcloud/coding-standard; cs:fix korrigiert
-composer run test:unit  # PHPUnit — pure logic only, no live Deck/Nextcloud instance needed
+composer run test:unit   # PHPUnit, nur reine Logik
 vendor/bin/phpunit --filter <testName> tests/Unit/Service/WorkflowRunnerTest.php
-npm install              # no package-lock.json is committed (gitignored) — use install, not `npm ci`
+npm install              # nicht `npm ci`: Lockfiles sind absichtlich nicht committet
-npm run build             # production build
+npm run build            # bzw. npm run watch
 npm run watch              # rebuild on change during development
 ```
-To run a single PHPUnit test: `vendor/bin/phpunit --filter testUserFilterIsOrAgainstAssignedUsers tests/Unit/Service/WorkflowRunnerFilterTest.php`.
+`composer.lock` und `package-lock.json` stehen in `.gitignore` → CI muss `composer install`/`npm install` verwenden (`npm ci` hat den Build schon einmal gebrochen). Die Deck-Integration lässt sich nur auf einer echten Nextcloud+Deck-Instanz testen.
-There is no meaningful way to test the Deck integration itself outside a real Nextcloud+Deck instance (`php occ background-job:worker 'OCA\WorkflowDeckAutomation\BackgroundJob\RunWorkflowsJob'` — the argument is a job *class*, not an app id) — the unit tests intentionally stop at the pure filter logic.
+## Release und CI
-### Release process
+**Versionsschema:** `<Nextcloud-Major>.<minor>.<patch>`. Die erste Zahl entspricht `min-/max-version` in `info.xml` und ändert sich nur mit der unterstützten NC-Major (dann `minor.patch` = `0.0`). `0.x`-Versionen stammen aus der Zeit davor. Die 34er-Linie existiert nur noch als Tags (`v34.*`). Kein Branch.
-**Versioning scheme (from 34.0.0 on): `<nextcloud-major>.<minor>.<patch>`.** The leading number tracks the minimum/maximum Nextcloud major version declared in `appinfo/info.xml`'s `<dependencies><nextcloud .../>` (currently `min-version="34" max-version="34"`), not this app's own feature history - so it only changes when the supported Nextcloud major changes (e.g. dropping/adding NC 34 support bumps to `35.0.0`), and resets `minor`/`patch` to `0.0` at that point. Ordinary fixes/features within the same supported NC major bump `minor`/`patch` as usual (semver-ish, without a leading `0.`). Versions before `34.0.0` (`0.1.x`/`0.2.x`) predate this scheme.
+1. `<version>` in `appinfo/info.xml` und `version` in `package.json` synchron erhöhen.
 2. Committen, nach `main` pushen, `build-main.yml` muss grün sein.
 3. `git tag vX.Y.Z && git push origin vX.Y.Z` → Checks, Frontend-Build, `make appstore`, Release mit `workflow_deck_automation.tar.gz`.
-1. Bump `<version>` in `appinfo/info.xml` and `version` in `package.json` (keep them in sync).
+Ist ein Tag-Build fehlgeschlagen und **nie ein Artefakt entstanden**, den Tag auf den Fix verschieben statt die Version zu erhöhen (`git tag -d vX.Y.Z && git tag -a vX.Y.Z -m "..." && git push origin :refs/tags/vX.Y.Z && git push origin vX.Y.Z`). Der Job löscht ein vorhandenes Release vorher. Nach einem veröffentlichten Artefakt den Tag nicht mehr verschieben.
 2. Commit, push to `main`, confirm the run of `.gitea/workflows/build-main.yml` is green.
 3. `git tag vX.Y.Z && git push origin vX.Y.Z` — this triggers the tag branch of the same workflow, which re-runs the checks, builds the frontend, runs `make appstore`, and attaches `workflow_deck_automation.tar.gz` as the asset on a normal (non-pre-) release for that tag.
-**If the tagged build fails and no artifact was ever produced**, fix the issue on `main` and *move* the existing tag to the fixed commit instead of bumping to a new version number (`git tag -d vX.Y.Z && git tag -a vX.Y.Z -m "..." && git push origin :refs/tags/vX.Y.Z && git push origin vX.Y.Z`) — this is how `v0.1.0` was handled through several build fixes before it first built successfully. The job deletes any pre-existing *release* for the tag before creating the new one, so a moved tag republishes cleanly instead of failing on a duplicate asset name. Once a version has actually produced a published artifact, don't move its tag anymore; bump normally instead.
+**`.gitea/workflows/build-main.yml` ist der einzige Workflow** (Checks `php-lint` 8.2–8.4, `xml-lint`, `unit-tests` + Job `package`), damit `needs:` das Release an grüne Checks koppelt. Nicht wieder aufteilen.
-**No `actions/upload-artifact` anywhere — and don't reintroduce it.** This self-hosted Gitea instance identifies as GHES to the official `actions/*` JS actions, which refuse to run `@actions/artifact` v2.0.0+ (used internally by `upload-artifact@v4` and later) against GHES: `GHESNotSupportedError`, which pinned us to `@v3` for a while. Publishing through the Gitea release REST API with `curl` sidesteps that version-specific backend API entirely, so the build workflow uses that instead. `actions/checkout` and `actions/setup-node` were never affected — only the artifact upload/download actions are, because they're the ones talking to a versioned backend rather than just running local commands — and can stay on their latest majors.
+- `package` baut *und* veröffentlicht in einem Job und braucht nur Node (`make appstore` ist reines `mkdir`/`tar`/`rm`).
 - Bei `pull_request` wird `Publish release` übersprungen (`if: gitea.event_name == 'push'`) und der Job ist nur ein Build-Check.
 - Push auf `main` → Pre-Release `latest-main`, Release *und* Tag werden jedes Mal neu erzeugt (Download-Link zeigt immer den neuesten Build). `v*`-Tag → normales Release. Dabei wird **nie der Tag** gelöscht (Flag `RECREATE_TAG`).
 - **Kein `actions/upload-artifact`:** Gitea gibt sich als GHES aus, `@actions/artifact` ≥ 2 verweigert dann (`GHESNotSupportedError`). Veröffentlicht wird per `curl` gegen die Gitea-Release-API. `checkout`/`setup-node` sind nicht betroffen.
 - **Kein PAT nötig:** Auth über das automatische `secrets.GITEA_TOKEN` mit `permissions: contents: write`. Bei 403: prüfen, ob die Token-Berechtigung des Repos/der Org auf *Restricted* steht (deckelt `permissions:`). Das ist eine Einstellung, kein Workflow-Bug.
-### One workflow for everything
+## Frontend-Build-Fallen (alle erst in CI aufgefallen)
-`.gitea/workflows/build-main.yml` is the *only* workflow: it carries the checks (`php-lint` across 8.2/8.3/8.4, `xml-lint`, `unit-tests`) and the `package` job that builds and publishes. They used to be four separate workflow files, which meant they all triggered independently on the same push and a `latest-main` release was published even when PHPUnit was red. `needs:` only works between jobs of the same workflow (and Gitea's `workflow_run` can depend on one workflow at a time), so gating the release on the checks required merging them into this file. Don't split them back out.
+- **`vite` muss zum Peer von `@nextcloud/vite-config` passen** (aktuell `vite@^7.3.6`), sonst `ERESOLVE`. Beim Update von `vite-config` dessen `peerDependencies.vite` prüfen.
 - **`"type": "module"` in `package.json`**, sonst scheitert `vite.config.js` am ESM-only-Paket.
 - **`tsconfig.json` und `typescript` als devDependency sind Pflicht**, obwohl es kein TypeScript gibt: `@nextcloud/vite-config` importiert über sein Barrel `vite-plugin-dts`, das `typescript` als Peer braucht. Ohne das Paket crasht es beim Laden (`Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')`). `typescript` nahe an der Version von `vite-config` halten (aktuell `^5.9.3`).
 - **`createAppConfig` stellt die App-ID vor jeden Entry-Namen:** `personal-settings` → `js/workflow_deck_automation-personal-settings.mjs`. `Util::addScript()`/`addStyle()` in `lib/Settings/Personal.php` brauchen diesen vollen Namen (`Application::APP_ID . '-personal-settings'`). Falsch → **leere Einstellungsseite**, nur `Could not find resource …` im Log. Umbenennungen in `vite.config.js` auch dort nachziehen.
 - Die eigentliche CSS steckt in einem gehashten `*.chunk.css`. Die Entry-CSS ist ein ~100-Byte-Stub (`createEmptyCSSEntryPoints`). Das ist korrekt, also Code-Splitting nicht abschalten.
-Consequences of that shape, all intentional:
+## `@nextcloud/vue` 9 (Vue 3) – v8-Idiome scheitern still
- **`package` builds *and* publishes in one job.** Handing the tarball to a separate publish job would need `actions/upload-artifact` (unusable here, see above) or `actions/cache` — a second Gitea backend API in the critical path for no gain.
+- **Kein `.sync`:** `NcTextField`/`NcCheckboxRadioSwitch` → `v-model`. `:value.sync` lässt den Wert auf dem Startwert stehen.
- **The workflow also runs on `pull_request`**, where the `Publish release` step is skipped via `if: gitea.event_name == 'push'` and the job degrades into a frontend-build check. That matters: `npm run build` used to run only on `main`, so no PR ever exercised it.
+- **`NcSelect`: `label` ist der Anzeige-Schlüssel der Optionen** (vue-select), die Beschriftung ist `input-label`. `label="Board"` rendert überall `undefined`.
- **Tags now get linted and tested too.** Previously the check workflows triggered only on `main` pushes and PRs, so a `v*` tag published completely unverified.
+- **`NcButton`: `variant` = Stil, `type` = nativer Button-Typ**, `native-type` gibt es nicht mehr. Ein übrig gebliebenes `type="primary"` wird zu `submit`, und Abbrechen schickt das Formular ab.
 - `NcSelect`s `reduce` erreicht vue-select nur per Attribut-Fallthrough (funktioniert, ist aber undokumentiert).
 - `NcNoteCard` nutzt weiterhin `type` (`success|info|warning|error`).
-It runs on pushes to `main` **and** on `v*` tags, and the publish step branches on `gitea.ref`:
+## Deck-Interna, die man kennen muss
- **`main`** → rolling pre-release tagged `latest-main`; both the release *and* the tag are deleted and recreated each run, so the download URL for `workflow_deck_automation.tar.gz` always serves the newest `main` build.
+- **Relationale Entities:** Auf angereicherten Entities liefern `$acl->getParticipant()`, `$board->getOwner()` oder Assignment-Teilnehmer ein `RelationalObject` statt einer uid (uid = `getPrimaryKey()`). Neue Teilnehmer-/Owner-Felder immer über `DeckIntegrationService::unwrapUid()` laufen lassen.
- **`v*`** → normal release on the tag that was just pushed. Only a stale release is deleted here — **never the tag**, since deleting it would destroy the ref that triggered the run. That's what the `RECREATE_TAG` flag guards.
+- Die ACL eines Boards enthält **nicht** den Owner (privates Board = leere ACL). ACL-Einträge können Gruppen (`type === 1`) oder Circles sein.
-
+- `StackMapper::findAll()` filtert `deleted_at = 0` selbst. Stacks haben keinen Archivstatus.
-The `latest-main` half exists so a build can be grabbed and copied onto the server (`nextcloud.gnilebein.de`) without cutting a version tag first — it produced `v0.1.0`-shaped raw-repo confusion once already when the app directory was populated by copying the git working tree instead of a built package; this gives a one-click alternative to that mistake.
+- Der Deck-Quellcode liegt lokal unter `C:\Users\pani\Documents\git-privat\nextcloud-deck` und dient zum Nachprüfen von Interna.
 Note that `make appstore` is pure `mkdir`/`tar`/`rm` — no `composer`, no `php`. The `package` job therefore needs Node only; a `setup-php` step *there* would be dead weight (the deleted release workflow had one). PHP is set up in the check jobs, which is a different job and a different container.
 **No manually created token is needed.** The publish step authenticates with `secrets.GITEA_TOKEN`, the token Gitea injects into every Actions job automatically (Gitea 1.27.1 here). The job declares `permissions: contents: write`, which Gitea maps to *Code: write* (needed to delete the `latest-main` tag) plus *Releases: write* (creating the release and uploading the asset).
 This replaced an earlier hand-made `RELEASE_TOKEN` repo secret. If the publish step ever starts returning 403s, check the repo/org **default token permission mode**: `permissions:` requests are clamped by `MaxTokenPermissions`, so a repository switched from *Permissive* (the backwards-compatible default) to *Restricted* silently downgrades releases to read-only and no `permissions:` block can raise it back. That's a repo setting, not a workflow bug — don't "fix" it by reintroducing a PAT before checking.
 ## Data flow / architecture map
 - **UI**: `src/PersonalSettings.vue` (Vue 3, mounted from `templates/settings/personal.php` into the section registered by `lib/Settings/PersonalSection.php` + `lib/Settings/Personal.php`) talks to `lib/Controller/WorkflowController.php` (an `OCSController`) via `src/api.js`, hitting OCS routes declared in `appinfo/routes.php` (`/ocs/v2.php/apps/workflow_deck_automation/api/v1/...`).
 - **Storage**: `lib/Db/Workflow.php` (Entity) / `lib/Db/WorkflowMapper.php` (QBMapper) over the `wfda_workflows` table, created in `lib/Migration/Version1000Date20260813120000.php`. Filter fields (`filter_user_ids`, `filter_label_ids`) are stored as JSON-encoded arrays in text columns, not join tables.
 - **Automation**: `lib/BackgroundJob/RunWorkflowsJob.php` (plain `Job`, one run per cron pass) → `lib/Service/WorkflowRunner.php` (per-user impersonation + filtering, both filters OR-within-themselves and AND-between-each-other) → `lib/Service/DeckIntegrationService.php` (all actual Deck class calls) and `lib/Service/NotificationMailer.php` (email via `OCP\Mail\IMailer` to the workflow owner's account address, never a manually-entered address).
 - Both the controller's board/stack/label/participant lookups (for populating the settings UI dropdowns) and the runner's card reads/moves go through the same `DeckIntegrationService` — there is no separate read path.
 ## Composer/npm lockfiles are intentionally not committed
 `.gitignore` excludes `composer.lock` and `package-lock.json`. This means CI must use `composer install`/`npm install`, not `composer install --no-dev` assumptions tied to a lock file or `npm ci` (which hard-requires a lock file and will fail otherwise — this has already broken the build workflow once). If you add a lockfile-dependent step, either commit the lockfile deliberately or keep using the non-`ci`/non-locked install form.
 ## Frontend build gotchas already hit (don't reintroduce)
 None of these were discoverable locally — there's no npm here (see "Local-only notes" below), so all three were only caught by an actual Gitea Actions run against the build workflow:
 - **`vite` version must satisfy `@nextcloud/vite-config`'s peer requirement.** `package.json` pins `@nextcloud/vite-config` to `^2.2.0`, which currently resolves to `2.5.4` and peer-requires `vite@^7.3.6`. If you bump `@nextcloud/vite-config`, check its `peerDependencies.vite` and bump our `vite` devDependency to match, or `npm install` fails with `ERESOLVE`.
 - **`package.json` needs `"type": "module"`.** `vite.config.js` uses `import`/`export` syntax and `@nextcloud/vite-config` is ESM-only; without `"type": "module"`, Node treats `.js` as CommonJS and `vite build` fails trying to `require()` an ESM-only package.
 - **A `tsconfig.json` must exist at the repo root, even though this project has no TypeScript source.** `@nextcloud/vite-config`'s `index.js` barrel statically re-exports `createLibConfig` from `libConfig.js`, which imports `vite-plugin-dts` at module scope — that import chain runs just from importing `createAppConfig`, regardless of whether `createLibConfig` is ever called. The minimal `tsconfig.json` in this repo exists to give that a config to resolve, not because we write TypeScript. On its own this did **not** fix the crash below — see the next bullet.
 - **`typescript` must be an explicit devDependency.** `vite-plugin-dts` (pulled in transitively by the bullet above, version `^4.5.4` as of `@nextcloud/vite-config@2.5.4`) peer-depends on `typescript: "*"` but doesn't install it itself. Without a `typescript` devDependency in our own `package.json`, nothing provides that package, and `vite-plugin-dts`'s `@volar/typescript` integration crashes at module-load time — before `vite.config.js`'s own code or `tsconfig.json` are ever consulted — with `Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')` (`proxyCreateProgram`). This is the actual fix; `tsconfig.json` existing is necessary but not sufficient. Keep `typescript` reasonably close to the version `@nextcloud/vite-config` itself develops against (currently `^5.9.3`) if you bump either.
 - **`createAppConfig` prefixes every entry name with the app id**, so the entry `personal-settings` is emitted as `js/workflow_deck_automation-personal-settings.mjs` and `css/workflow_deck_automation-personal-settings.css`. `Util::addScript()`/`addStyle()` take that *full on-disk basename* (minus extension), not the bare entry name — `lib/Settings/Personal.php` therefore passes `Application::APP_ID . '-personal-settings'`. Getting this wrong produces a **silently blank settings page**: the template's empty mount `<div>` renders fine, and the only symptom is `Could not find resource workflow_deck_automation/js/….js to load` (`jsresourceloader`) plus a matching `Could not find resource file "/apps/workflow_deck_automation/css/….css"` in `nextcloud.log`. If you rename the entry in `vite.config.js`, rename it in `Personal.php` too.
 - **The bulk of the CSS lives in a hashed `*.chunk.css`**, loaded at runtime by the `.mjs` bundle (`cssCodeSplit: true`). The `css/workflow_deck_automation-personal-settings.css` that `addStyle()` points at is the ~100-byte stub produced by `createEmptyCSSEntryPoints: true`. A near-empty entry CSS file is expected — don't "fix" it by turning off code splitting.
 ## `@nextcloud/vue` 9 component API (Vue 3) — the v8 idioms silently do nothing
 This app is on `@nextcloud/vue` ^9 / Vue 3. The v8 (Vue 2) prop spellings that most Nextcloud app code online still uses either fail silently or, worse, land as stray DOM attributes instead of erroring:
 - **No `.sync`.** Vue 3 removed it. `NcTextField` and `NcCheckboxRadioSwitch` both bind through `modelValue`/`update:modelValue`, so it's `v-model="x"` — `:value.sync="x"` / `:checked.sync="x"` leave the bound state permanently at its initial value. That's how `form.title` stayed `''` and every save died on "Bitte einen Titel angeben."
 - **`NcSelect`'s `label` prop is the *option display key*, not a caption** (it's vue-select's). Passing `label="Board"` makes it read `option.Board` on every option and render `undefined` for all of them. The visible caption prop is `input-label`.
 - **`NcButton`: `variant` is the style, `type` is the native button type**, and `native-type` no longer exists (v8's `type="primary"` + `native-type="submit"` → v9's `variant="primary"` + `type="submit"`). A leftover `type="primary"` renders `<button type="primary">`, which HTML treats as the invalid-value default `submit` — so a *cancel* button silently submits the form.
 - `NcSelect`'s `reduce` is not declared on `NcSelect` itself; it reaches vue-select through attribute fallthrough (NcSelect's root element *is* the `VueSelect` component and it doesn't set `inheritAttrs: false`). It works, but it's fallthrough, not a documented prop.
 - `NcNoteCard`'s prop is still `type` (`success|info|warning|error`) — not everything was renamed to `variant`.
 ## Deck entities are "relational": getters don't return the uid string
 Deck's `RelationalEntity` swaps resolved relations for an `OCA\Deck\Db\RelationalObject` once an entity is enriched. So on an enriched board/card, `$acl->getParticipant()`, `$board->getOwner()` and a card assignment's participant return a `RelationalObject` (wrapping `OCA\Deck\Db\User`/`Group`/`Circle`), **not** a uid — the uid is its `getPrimaryKey()`. Probing for `getUID()` on the returned object finds nothing and yields `null`, which is how the settings UI's user dropdown came up empty *and* why the runner's assigned-user filter could never match. `DeckIntegrationService::unwrapUid()` handles both shapes (bare string and `RelationalObject`); route any new participant/owner field through it.
 Two more Deck facts that bit us in the same pass: a board's ACL does **not** contain its owner (a private board has an empty ACL, so participants must be seeded with `$board->getOwner()`), and ACL entries can be groups (`type === 1`) whose members have to be expanded via `IGroupManager`.
 **`BoardService::getUserBoards()` defaults to `$includeArchived = true`, and that flag also gates the `deleted_at = 0` condition** — with the default you get archived *and* trashed boards back. We call `getUserBoards(null, false)` (with a fallback to the no-arg form if Deck ever changes the signature) and still dedupe by id afterwards, because it merges own/group/circle boards and can return the same board twice. Stacks need no such handling: `StackMapper::findAll()` filters `deleted_at = 0` unconditionally and stacks have no archived state.
 ## Local-only notes
 `CLAUDE.local.md` (gitignored) carries session-specific environment notes (e.g. "no PHP/npm available locally"). Check it at the start of work in this repo — it's not duplicated here since it can change independently of the committed guidance.
@@ -1,8 +1,6 @@
 # Deck Workflow-Automatisierung
-Nextcloud-App für **Nextcloud Hub 26 Spring (Server 34.x)**, die Karten der [Deck](https://github.com/nextcloud/deck)-App automatisch von einem Stapel in einen anderen verschiebt, sobald ihr Fälligkeits- oder Startdatum erreicht ist, und optional eine E-Mail-Benachrichtigung verschickt.
+Nextcloud-App für **Nextcloud Hub Summer 26 (Server 35.x)**, die überfällige Karten der [Deck](https://github.com/nextcloud/deck)-App automatisch von einem Stapel in einen anderen verschiebt und optional eine E-Mail-Benachrichtigung verschickt.
 Setzt **Deck ab 1.18.0** voraus (die Version, die das Startdatum eingeführt hat) — auf Nextcloud 34 ist das automatisch erfüllt, da 1.18.x die einzige dort freigegebene Deck-Reihe ist.
 Ersetzt das früher genutzte eigenständige PHP-Cron-Skript durch eine vollwertige App mit Oberfläche in den **persönlichen Einstellungen** — jeder Nutzer kann dort seine eigenen Regeln ("Workflows") anlegen, ohne Admin-Rechte oder Server-Zugriff zu benötigen.
@@ -11,20 +9,24 @@ Ersetzt das früher genutzte eigenständige PHP-Cron-Skript durch eine vollwerti
 Pro Workflow lässt sich konfigurieren:
 - Quell-Board und Quell-Stapel
- Ziel-Stapel, in den die Karten verschoben werden
+- Ziel-Stapel, in den **alle** überfälligen Karten des Quell-Stapels verschoben werden
- **auslösendes Datum: Fälligkeitsdatum oder Startdatum der Karte** (Karten ohne das gewählte Datum werden nie verschoben; Regeln aus älteren Versionen laufen unverändert auf dem Fälligkeitsdatum)
+- E-Mail-Benachrichtigung über verschobene Karten, in drei Stufen:
- optionaler Filter auf zugewiesene Benutzer (Karte muss **mindestens einem** der gewählten Benutzer zugewiesen sein)
+  - **Keine E-Mail**
- optionaler Filter auf Labels/Tags (Karte muss **mindestens eines** der gewählten Labels haben)
+  - **Nur an mich** – an den Board-Eigentümer, unabhängig von seinen Deck-Einstellungen
- Checkbox: E-Mail-Benachrichtigung an den Workflow-Besitzer, sobald eine Karte verschoben wurde
+  - **An Board-Mitglieder laut Deck-Einstellung** – an alle, die das Board sehen dürfen (Eigentümer, freigegebene Nutzer, Mitglieder freigegebener Gruppen und Teams), gefiltert nach deren eigener Deck-Einstellung *Benachrichtigungen* für dieses Board: *Alle Karten* → immer, *Zugewiesene Karten* (Deck-Standard) → nur wenn man der Karte direkt oder über eine Gruppe/ein Team zugewiesen ist, *Keine* → nie. Der Eigentümer eines nicht geteilten Boards bekommt wie in Deck jede Karte, außer er hat *Keine* gewählt.
-Ein Nutzer kann beliebig viele Workflows anlegen, bearbeiten, deaktivieren oder löschen.
+  Pro Lauf des Hintergrundjobs bekommt jeder Empfänger höchstens **eine** Sammelmail mit allen für ihn verschobenen Karten.
 Die App ist für den internen Einsatz gedacht und durchgehend **deutschsprachig** (Oberfläche, Fehlermeldungen, E-Mails). Es gibt keine Übersetzungsdateien.
 Workflows lassen sich nur für Boards anlegen, deren Eigentümer man ist. Ein Workflow gehört dem jeweiligen Board-Eigentümer, nicht dem, der ihn angelegt hat: Wird ein Board in Deck übertragen, sieht und verwaltet ab sofort der neue Eigentümer seine Workflows, und der Hintergrundjob läuft in dessen Namen. Ein Nutzer kann beliebig viele Workflows anlegen, bearbeiten, deaktivieren oder löschen.
 ## Architektur
- **Keine HTTP/OCS-Aufrufe gegen Deck.** Alles Lesen (Boards, Stapel, Karten, Labels, zugewiesene Benutzer) und das Verschieben von Karten läuft ausschließlich über Decks eigene interne PHP-Klassen (`OCA\Deck\Service\CardService`, `StackService`, `BoardService`, `OCA\Deck\Db\CardMapper`, …), aufgelöst per Dependency Injection direkt im selben PHP-Prozess. Sämtlicher Deck-Zugriff ist in [`lib/Service/DeckIntegrationService.php`](lib/Service/DeckIntegrationService.php) gebündelt.
+- **Keine HTTP/OCS-Aufrufe gegen Deck.** Alles Lesen (Boards, Stapel, Karten) und das Verschieben von Karten läuft ausschließlich über Decks eigene interne PHP-Klassen (`OCA\Deck\Service\CardService`, `StackService`, `BoardService`, `OCA\Deck\Db\CardMapper`, …), aufgelöst per Dependency Injection direkt im selben PHP-Prozess. Sämtlicher Deck-Zugriff ist in [`lib/Service/DeckIntegrationService.php`](lib/Service/DeckIntegrationService.php) gebündelt.
 - **Hintergrundjob statt Seitenaufruf.** [`lib/BackgroundJob/RunWorkflowsJob.php`](lib/BackgroundJob/RunWorkflowsJob.php) ist ein einfacher `Job` ohne eigenes Intervall: Er läuft bei jedem Cron-Durchlauf von Nextcloud (üblicherweise alle 5 Minuten) und ruft [`lib/Service/WorkflowRunner.php`](lib/Service/WorkflowRunner.php) auf.
 - **Rechte-Kontext je Nutzer.** Ein Hintergrundjob hat standardmäßig keinen eingeloggten Nutzer, muss aber die Regeln mehrerer Nutzer in einem einzigen Lauf auswerten. Der `WorkflowRunner` "verkörpert" deshalb für die Dauer der jeweiligen Workflows kurzzeitig den entsprechenden Besitzer. Dazu gehört mehr als `IUserSession::setUser()`: Decks Berechtigungsprüfungen lesen die Session gar nicht, sondern eine Benutzer-ID, die beim Bau des Deck-Containers einmal pro Prozess eingefroren wird. `DeckIntegrationService::beginUserContext()` setzt diesen Wert für die Dauer der Verkörperung auf den Workflow-Besitzer und stellt ihn danach wieder her; schlägt das fehl, wird der Nutzer in diesem Lauf übersprungen, statt unter fremden Rechten zu arbeiten.
- **E-Mail** läuft über Nextclouds eigenen `IMailer` (nutzt also den in der Nextcloud-Administration hinterlegten Mailserver) und geht an die im Profil des Workflow-Besitzers hinterlegte Adresse.
+- **E-Mail** läuft über Nextclouds eigenen `IMailer` (nutzt also den in der Nextcloud-Administration hinterlegten Mailserver) und geht an die im Profil der jeweiligen Empfänger hinterlegte Adresse. Die Empfänger und ihre Deck-Einstellungen ermittelt die App ebenfalls über Decks interne Klassen bzw. die Nutzereinstellung `deck` / `board:<id>:notify-due`.
 ### Wichtiger Hinweis zu Decks internen Klassen
@@ -39,7 +41,7 @@ Ein Nutzer kann beliebig viele Workflows anlegen, bearbeiten, deaktivieren oder
 ## Benutzung
-Jeder Nutzer findet die Einstellungen unter **Persönliche Einstellungen → Deck Workflow-Automatisierung**. Dort können neue Workflows angelegt, bestehende bearbeitet oder gelöscht werden. Die Dropdowns für Board/Stapel/Label/Benutzer werden live aus Deck geladen. Zur Auswahl stehen nur aktive Boards — archivierte und im Papierkorb liegende Boards sowie gelöschte Stapel blendet Deck bzw. die App aus.
+Jeder Nutzer findet die Einstellungen unter **Persönliche Einstellungen → Deck Workflow-Automatisierung**. Dort können neue Workflows angelegt, bestehende bearbeitet oder gelöscht werden. Die Dropdowns für Board und Stapel werden live aus Deck geladen. Zur Auswahl stehen nur aktive Boards, deren Eigentümer man ist — geteilte, archivierte und im Papierkorb liegende Boards sowie gelöschte Stapel blendet die App aus.
 ### Gelöschte Boards und Stapel
@@ -47,23 +49,10 @@ Ein Workflow verweist per ID auf ein Board und zwei Stapel. Wird eines davon in
 - **Beim Speichern** werden Board und Stapel geprüft; ein Workflow auf nicht mehr existierende Ziele lässt sich gar nicht erst anlegen.
 - **In der Übersicht** wird ein betroffener Workflow rot markiert („Board nicht mehr vorhanden", „Quell-Stapel nicht mehr vorhanden" …).
- **Im Hintergrundjob** wird der Workflow automatisch deaktiviert und der Besitzer einmalig per E-Mail informiert — unabhängig davon, ob für den Workflow „E-Mail senden" aktiviert ist, denn hier geht es nicht um verschobene Karten, sondern darum, dass die Automatisierung nicht mehr läuft. Danach bleibt es still: Ein deaktivierter Workflow wird nicht erneut ausgewertet.
+- **Im Hintergrundjob** wird der Workflow automatisch deaktiviert und der Besitzer einmalig per E-Mail informiert — unabhängig von der E-Mail-Einstellung des Workflows, denn hier geht es nicht um verschobene Karten, sondern darum, dass die Automatisierung nicht mehr läuft. Danach bleibt es still: Ein deaktivierter Workflow wird nicht erneut ausgewertet.
 Ist Deck vorübergehend nicht erreichbar, wird **nicht** deaktiviert — der Job überspringt den Workflow und versucht es beim nächsten Lauf erneut. Archivierte Boards lösen die Deaktivierung ebenfalls nicht aus, sie sind nur in den Auswahlfeldern ausgeblendet.
 ### Gelöschte Labels und entfernte Benutzer
 Filter sind ein anderer Fall: Sie werden **nicht** deaktiviert. Wird eines von drei ausgewählten Labels gelöscht, greifen die anderen beiden weiter — das abzuschalten wäre falsch.
 Problematisch ist nur der Grenzfall, dass **alle** Einträge eines Filters verschwunden sind. Der Workflow läuft dann weiter, kann aber keine einzige Karte mehr treffen. Das passiert bei gelöschten Labels und ebenso, wenn ein gefilterter Benutzer die Board-Freigabe verliert — Deck entfernt dabei alle seine Kartenzuweisungen auf diesem Board.
 Damit dieser Zustand nicht unsichtbar bleibt:
 - **In der Übersicht** wird der Workflow rot markiert („Label-Filter trifft keine Karte mehr", „Benutzer-Filter trifft keine Karte mehr").
 - **Im Hintergrundjob** landet bei jedem Lauf eine Warnung im `nextcloud.log`.
 Keine E-Mail und keine Deaktivierung: Ein einziger Board-Klick kann den Filter wieder lebendig machen. Und wie bei Board und Stapel gilt auch hier — lässt sich das Board gerade nicht abfragen, wird nichts gemeldet statt etwas Falsches.
 ## Ausführungstakt
 Der Hintergrundjob hat **kein eigenes Intervall** und ist auch nicht konfigurierbar: Er läuft bei **jedem** Cron-Durchlauf von Nextcloud. Der Takt ist damit exakt der des System-Crons — üblicherweise alle 5 Minuten, bei einem häufiger eingerichteten Cron entsprechend öfter.
@@ -110,7 +99,7 @@ npm run watch       # Entwicklung mit automatischem Rebuild
 ```bash
 composer run lint       # php -l über lib/ und tests/
 composer run cs:check   # nextcloud/coding-standard (php-cs-fixer)
-composer run test:unit  # PHPUnit — reine Filter-Logik, benötigt keine Deck-Installation
+composer run test:unit  # PHPUnit — reine Logik (Fälligkeitsprüfung), benötigt keine Deck-Installation
 ```
 Ein echter End-to-End-Test (Karte anlegen, Workflow konfigurieren, Hintergrundjob auslösen, Verschiebung + Mail prüfen) lässt sich nur gegen eine echte Nextcloud-34-Instanz mit installierter Deck-App durchführen, z. B. per:
@@ -147,7 +136,7 @@ In [`.gitea/workflows/`](.gitea/workflows/):
 ## Datenmodell
-Workflows werden in der Tabelle `wfda_workflows` gespeichert (siehe [`lib/Migration/Version1000Date20260813120000.php`](lib/Migration/Version1000Date20260813120000.php)): eine Zeile pro Workflow, mit `user_id`-Bezug, Board-/Stapel-IDs, JSON-kodierten Filterlisten sowie `enabled`/`notify_email`/`last_run`.
+Workflows werden in der Tabelle `wfda_workflows` gespeichert (siehe [`lib/Migration/Version1000Date20260813120000.php`](lib/Migration/Version1000Date20260813120000.php)): eine Zeile pro Workflow, mit Board-/Stapel-IDs, `user_id` (der Board-Eigentümer, in dessen Namen der Job läuft — wird bei jedem Lauf aus Deck aktualisiert) sowie `enabled`/`notify_mode`/`last_run`. Die früheren Filter-Spalten `filter_user_ids`/`filter_label_ids` entfernt [`Version1001Date20260930120000`](lib/Migration/Version1001Date20260930120000.php). [`Version1002Date20261001120000`](lib/Migration/Version1002Date20261001120000.php) ersetzt das frühere Ja/Nein-Feld `notify_email` durch `notify_mode` (`off`/`owner`/`board`; gesetztes Häkchen → `owner`), [`Version1003Date20261001120100`](lib/Migration/Version1003Date20261001120100.php) entfernt die alte Spalte.
 ## Lizenz
@@ -4,37 +4,27 @@
    <id>workflow_deck_automation</id>
    <name lang="de">Deck Workflow-Automatisierung</name>
    <name lang="en">Deck Workflow Automation</name>
-    <summary lang="de">Verschiebt Deck-Karten automatisch anhand konfigurierbarer Regeln</summary>
+    <summary lang="de">Verschiebt überfällige Deck-Karten automatisch anhand konfigurierbarer Regeln</summary>
-    <summary lang="en">Automatically moves Deck cards based on configurable rules</summary>
+    <summary lang="en">Automatically moves overdue Deck cards based on configurable rules</summary>
    <description lang="de"><![CDATA[
-Diese App erlaubt es jedem Nutzer, in den persönlichen Einstellungen eigene Automatisierungs-Workflows für die Deck-App anzulegen:
+Diese App erlaubt es jedem Nutzer, in den persönlichen Einstellungen Automatisierungs-Workflows für seine eigenen Deck-Boards anzulegen:
 * Quell-Board und Quell-Stapel wählen
-* Ziel-Stapel wählen, in den die Karten verschoben werden
+* Ziel-Stapel wählen, in den überfällige Karten verschoben werden
-* je Regel wählen, ob das Fälligkeits- oder das Startdatum der Karte ausgewertet wird
+* optional per E-Mail benachrichtigen: nur sich selbst oder alle Board-Mitglieder gemäß ihrer Deck-Benachrichtigungseinstellung
 * optional nach zugewiesenen Benutzern filtern
 * optional nach Labels/Tags filtern
 * optional eine E-Mail-Benachrichtigung an sich selbst aktivieren
-Ein Hintergrundjob prüft regelmäßig alle aktiven Workflows und verschiebt Karten, deren gewähltes Datum in der Vergangenheit liegt, ausschließlich über die internen PHP-Klassen der Deck-App (keine HTTP/OCS-Aufrufe).
+Ein Hintergrundjob prüft regelmäßig alle aktiven Workflows und verschiebt Karten, deren Fälligkeitsdatum überschritten wurde, ausschließlich über die internen PHP-Klassen der Deck-App (keine HTTP/OCS-Aufrufe).
 Voraussetzung: Nextcloud 34 und die Deck-App ab Version 1.18.0 – die einzige Deck-Reihe, die für Nextcloud 34 freigegeben ist.
 ]]></description>
    <description lang="en"><![CDATA[
-This app lets every user configure their own Deck automation workflows from Personal settings:
+This app lets every user configure Deck automation workflows for the boards they own from Personal settings:
 * pick a source board and source stack
-* pick a destination stack the cards get moved to
+* pick a destination stack overdue cards get moved to
-* pick, per rule, whether the card's due date or its start date is evaluated
+* optionally notify by email: themselves only, or every board member according to their Deck notification setting
 * optionally filter by assigned users
 * optionally filter by labels/tags
 * optionally enable an email notification to themselves
-A background job periodically evaluates all enabled workflows and moves cards whose chosen date lies in the past, using Deck's own internal PHP classes only (no HTTP/OCS calls).
+A background job periodically evaluates all enabled workflows and moves cards whose due date has passed, using Deck's own internal PHP classes only (no HTTP/OCS calls).
 Requires Nextcloud 34 and Deck 1.18.0 or newer - the only Deck release line supported on Nextcloud 34.
 ]]></description>
-    <version>34.1.0</version>
+    <version>35.2.2</version>
    <licence>agpl</licence>
    <author mail="patrick@niebel.ing">Patrick Niebeling</author>
    <namespace>WorkflowDeckAutomation</namespace>
@@ -46,7 +36,7 @@ Requires Nextcloud 34 and Deck 1.18.0 or newer - the only Deck release line supp
        <database min-version="9.4">pgsql</database>
        <database>sqlite</database>
        <database min-version="8.0">mysql</database>
-        <nextcloud min-version="34" max-version="34"/>
+        <nextcloud min-version="35" max-version="35"/>
    </dependencies>
    <background-jobs>
        <job>OCA\WorkflowDeckAutomation\BackgroundJob\RunWorkflowsJob</job>
@@ -11,7 +11,5 @@ return [
 		['name' => 'workflow#boards', 'url' => '/api/v1/boards', 'verb' => 'GET'],
 		['name' => 'workflow#stacks', 'url' => '/api/v1/boards/{boardId}/stacks', 'verb' => 'GET'],
 		['name' => 'workflow#labels', 'url' => '/api/v1/boards/{boardId}/labels', 'verb' => 'GET'],
 		['name' => 'workflow#participants', 'url' => '/api/v1/boards/{boardId}/participants', 'verb' => 'GET'],
 	],
 ];
@@ -8,6 +8,7 @@ use OCA\WorkflowDeckAutomation\Db\Workflow;
 use OCA\WorkflowDeckAutomation\Db\WorkflowMapper;
 use OCA\WorkflowDeckAutomation\Service\DeckIntegrationService;
 use OCA\WorkflowDeckAutomation\Service\DeckUnavailableException;
 use OCA\WorkflowDeckAutomation\Service\NotificationPolicy;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
@@ -33,47 +34,41 @@ class WorkflowController extends OCSController {
 	private function currentUserId(): string {
 		$user = $this->userSession->getUser();
 		if ($user === null) {
-			throw new OCSPreconditionFailedException('Not logged in');
+			throw new OCSPreconditionFailedException('Nicht angemeldet');
 		}
 		return $user->getUID();
 	}
 	/**
 	 * Every workflow on a board the user owns, no matter who created it: a
 	 * workflow belongs to its board's owner, and follows the board when
 	 * Deck transfers it.
 	 */
 	#[NoAdminRequired]
 	public function index(): DataResponse {
-		$workflows = $this->workflowMapper->findAllForUser($this->currentUserId());
+		$workflows = $this->workflowMapper->findAllForBoards($this->ownedBoardIds());
 		return new DataResponse(array_map(static fn (Workflow $w) => $w->jsonSerialize(), $workflows));
 	}
 	/**
 	 * @param string[] $filterUserIds
 	 * @param int[] $filterLabelIds
 	 */
 	#[NoAdminRequired]
 	public function create(
 		string $title,
 		int $boardId,
 		int $sourceStackId,
 		int $targetStackId,
-		array $filterUserIds = [],
+		string $notifyMode = NotificationPolicy::MODE_OFF,
 		array $filterLabelIds = [],
 		string $dateField = Workflow::DATE_FIELD_DUE,
 		bool $notifyEmail = false,
 		bool $enabled = true,
 	): DataResponse {
-		$this->validate($title, $boardId, $sourceStackId, $targetStackId, $dateField);
+		$this->validate($title, $boardId, $sourceStackId, $targetStackId, $notifyMode);
 		$workflow = new Workflow();
 		$workflow->setUserId($this->currentUserId());
-		$this->applyFields($workflow, $title, $boardId, $sourceStackId, $targetStackId, $filterUserIds, $filterLabelIds, $dateField, $notifyEmail, $enabled);
+		$this->applyFields($workflow, $title, $boardId, $sourceStackId, $targetStackId, $notifyMode, $enabled);
 		$workflow = $this->workflowMapper->insert($workflow);
 		return new DataResponse($workflow->jsonSerialize(), Http::STATUS_CREATED);
 	}
 	/**
 	 * @param string[] $filterUserIds
 	 * @param int[] $filterLabelIds
 	 */
 	#[NoAdminRequired]
 	public function update(
 		int $id,
@@ -81,21 +76,16 @@ class WorkflowController extends OCSController {
 		int $boardId,
 		int $sourceStackId,
 		int $targetStackId,
-		array $filterUserIds = [],
+		string $notifyMode = NotificationPolicy::MODE_OFF,
 		array $filterLabelIds = [],
 		string $dateField = Workflow::DATE_FIELD_DUE,
 		bool $notifyEmail = false,
 		bool $enabled = true,
 	): DataResponse {
-		$this->validate($title, $boardId, $sourceStackId, $targetStackId, $dateField);
+		$workflow = $this->findOwnWorkflow($id);
 		$this->validate($title, $boardId, $sourceStackId, $targetStackId, $notifyMode);
-		try {
+		// Kept in step with the board owner so the job runs as, and mails,
-			$workflow = $this->workflowMapper->findForUser($id, $this->currentUserId());
+		// the right user; validate() made sure the editor owns the board.
-		} catch (DoesNotExistException $e) {
+		$workflow->setUserId($this->currentUserId());
-			throw new OCSNotFoundException('Workflow not found');
+		$this->applyFields($workflow, $title, $boardId, $sourceStackId, $targetStackId, $notifyMode, $enabled);
 		}
 		$this->applyFields($workflow, $title, $boardId, $sourceStackId, $targetStackId, $filterUserIds, $filterLabelIds, $dateField, $notifyEmail, $enabled);
 		$workflow = $this->workflowMapper->update($workflow);
 		return new DataResponse($workflow->jsonSerialize());
@@ -103,12 +93,7 @@ class WorkflowController extends OCSController {
 	#[NoAdminRequired]
 	public function destroy(int $id): DataResponse {
-		try {
+		$workflow = $this->findOwnWorkflow($id);
 			$workflow = $this->workflowMapper->findForUser($id, $this->currentUserId());
 		} catch (DoesNotExistException $e) {
 			throw new OCSNotFoundException('Workflow not found');
 		}
 		$this->workflowMapper->delete($workflow);
 		return new DataResponse([]);
 	}
@@ -116,7 +101,7 @@ class WorkflowController extends OCSController {
 	#[NoAdminRequired]
 	public function boards(): DataResponse {
 		$this->assertDeck();
-		return new DataResponse($this->deckService->listBoardsForCurrentUser());
+		return new DataResponse($this->ownedBoards());
 	}
 	#[NoAdminRequired]
@@ -125,42 +110,61 @@ class WorkflowController extends OCSController {
 		return new DataResponse($this->deckService->listStacks($boardId));
 	}
-	#[NoAdminRequired]
+	private function findOwnWorkflow(int $id): Workflow {
-	public function labels(int $boardId): DataResponse {
+		try {
-		$this->assertDeck();
+			$workflow = $this->workflowMapper->findById($id);
-		return new DataResponse($this->deckService->listLabels($boardId));
+		} catch (DoesNotExistException $e) {
 			throw new OCSNotFoundException('Workflow nicht gefunden');
 		}
-	#[NoAdminRequired]
+		if (!in_array($workflow->getBoardId(), $this->ownedBoardIds(), true)) {
-	public function participants(int $boardId): DataResponse {
+			// Same answer as for a missing id: don't reveal other users' workflows.
 			throw new OCSNotFoundException('Workflow nicht gefunden');
 		}
 		return $workflow;
 	}
 	/**
 	 * @return array<int, array{id: int, title: string, archived: bool}>
 	 */
 	private function ownedBoards(): array {
 		$userId = $this->currentUserId();
 		$this->assertDeck();
-		return new DataResponse($this->deckService->listParticipants($boardId));
+		try {
 			return $this->deckService->listOwnedBoards($userId);
 		} catch (DeckUnavailableException $e) {
 			throw new OCSPreconditionFailedException('Deine Deck-Boards konnten nicht geladen werden: ' . $e->getMessage());
 		}
 	}
 	/**
 	 * @return int[]
 	 */
 	private function ownedBoardIds(): array {
 		return array_map(static fn (array $board) => $board['id'], $this->ownedBoards());
 	}
 	private function assertDeck(): void {
 		$user = $this->userSession->getUser();
 		if ($user === null) {
-			throw new OCSPreconditionFailedException('Not logged in');
+			throw new OCSPreconditionFailedException('Nicht angemeldet');
 		}
 		try {
 			$this->deckService->assertDeckAvailable($user);
 		} catch (DeckUnavailableException $e) {
-			throw new OCSPreconditionFailedException('Deck is not available: ' . $e->getMessage());
+			throw new OCSPreconditionFailedException('Deck ist nicht verfügbar: ' . $e->getMessage());
 		}
 	}
-	private function validate(string $title, int $boardId, int $sourceStackId, int $targetStackId, string $dateField): void {
+	private function validate(string $title, int $boardId, int $sourceStackId, int $targetStackId, string $notifyMode): void {
 		if (trim($title) === '') {
-			throw new OCSBadRequestException('Title must not be empty');
+			throw new OCSBadRequestException('Bitte einen Titel angeben.');
 		}
 		if ($sourceStackId === $targetStackId) {
-			throw new OCSBadRequestException('Source and target stack must differ');
+			throw new OCSBadRequestException('Quell- und Ziel-Stapel müssen sich unterscheiden.');
 		}
-		// Rejected rather than silently normalised to 'due': a client sending
+		if (!NotificationPolicy::isValidMode($notifyMode)) {
-		// something else is asking for a rule it would not get, and the runner
+			throw new OCSBadRequestException('Ungültige E-Mail-Einstellung, erlaubt sind: ' . implode(', ', NotificationPolicy::MODES));
 		// falls back to the due date without a word.
 		if (!in_array($dateField, Workflow::DATE_FIELDS, true)) {
 			throw new OCSBadRequestException('Unknown date field: ' . $dateField);
 		}
 		// Reject references to boards or stacks that are gone (or were never
@@ -169,12 +173,18 @@ class WorkflowController extends OCSController {
 		// not "Deck is unreachable".
 		$this->assertDeck();
-		$boardIds = array_map(
+		// Only boards the user owns are listed, so this also enforces the
-			static fn (array $board) => (int)$board['id'],
+		// owner rule. Archived boards stay listed (their workflows must stay
-			$this->deckService->listBoardsForCurrentUser(),
+		// visible) but are no target for a new or changed workflow.
-		);
+		$board = null;
-		if (!in_array($boardId, $boardIds, true)) {
+		foreach ($this->ownedBoards() as $candidate) {
-			throw new OCSBadRequestException('The selected board does not exist or is not accessible');
+			if ($candidate['id'] === $boardId) {
 				$board = $candidate;
 				break;
 			}
 		}
 		if ($board === null || $board['archived']) {
 			throw new OCSBadRequestException('Das gewählte Board existiert nicht, ist archiviert oder gehört dir nicht.');
 		}
 		$stackIds = array_map(
@@ -182,34 +192,24 @@ class WorkflowController extends OCSController {
 			$this->deckService->listStacks($boardId),
 		);
 		if (!in_array($sourceStackId, $stackIds, true) || !in_array($targetStackId, $stackIds, true)) {
-			throw new OCSBadRequestException('The selected stack does not exist on this board');
+			throw new OCSBadRequestException('Der gewählte Stapel existiert auf diesem Board nicht.');
 		}
 	}
 	/**
 	 * @param string[] $filterUserIds
 	 * @param int[] $filterLabelIds
 	 */
 	private function applyFields(
 		Workflow $workflow,
 		string $title,
 		int $boardId,
 		int $sourceStackId,
 		int $targetStackId,
-		array $filterUserIds,
+		string $notifyMode,
 		array $filterLabelIds,
 		string $dateField,
 		bool $notifyEmail,
 		bool $enabled,
 	): void {
 		$workflow->setTitle($title);
 		$workflow->setBoardId($boardId);
 		$workflow->setSourceStackId($sourceStackId);
 		$workflow->setTargetStackId($targetStackId);
-		$workflow->setFilterUserIds($filterUserIds === [] ? null : json_encode(array_values($filterUserIds)));
+		$workflow->setNotifyMode($notifyMode);
 		$workflow->setFilterLabelIds($filterLabelIds === [] ? null : json_encode(array_values($filterLabelIds)));
 		$workflow->setDateField($dateField);
 		$workflow->setNotifyEmail($notifyEmail);
 		$workflow->setEnabled($enabled);
 	}
 }
@@ -18,37 +18,20 @@ use OCP\DB\Types;
 * @method void setSourceStackId(int $sourceStackId)
 * @method int getTargetStackId()
 * @method void setTargetStackId(int $targetStackId)
- * @method string|null getFilterUserIds()
+ * @method string getNotifyMode()
- * @method void setFilterUserIds(?string $filterUserIds)
+ * @method void setNotifyMode(string $notifyMode)
 * @method string|null getFilterLabelIds()
 * @method void setFilterLabelIds(?string $filterLabelIds)
 * @method string|null getDateField()
 * @method void setDateField(string $dateField)
 * @method bool getNotifyEmail()
 * @method void setNotifyEmail(bool $notifyEmail)
 * @method bool getEnabled()
 * @method void setEnabled(bool $enabled)
 * @method \DateTime|null getLastRun()
 * @method void setLastRun(?\DateTime $lastRun)
 */
 class Workflow extends Entity implements \JsonSerializable {
 	/** Deck's `Card::$duedate` — the card is picked up once it is overdue. */
 	public const DATE_FIELD_DUE = 'due';
 	/** Deck's `Card::$startdate` — the card is picked up once its start date has been reached. */
 	public const DATE_FIELD_START = 'start';
 	public const DATE_FIELDS = [self::DATE_FIELD_DUE, self::DATE_FIELD_START];
 	protected $userId;
 	protected $title;
 	protected $boardId;
 	protected $sourceStackId;
 	protected $targetStackId;
-	protected $filterUserIds;
+	protected $notifyMode;
 	protected $filterLabelIds;
 	protected $dateField;
 	protected $notifyEmail;
 	protected $enabled;
 	protected $lastRun;
@@ -59,56 +42,11 @@ class Workflow extends Entity implements \JsonSerializable {
 		$this->addType('boardId', Types::INTEGER);
 		$this->addType('sourceStackId', Types::INTEGER);
 		$this->addType('targetStackId', Types::INTEGER);
-		$this->addType('filterUserIds', Types::STRING);
+		$this->addType('notifyMode', Types::STRING);
 		$this->addType('filterLabelIds', Types::STRING);
 		$this->addType('dateField', Types::STRING);
 		$this->addType('notifyEmail', Types::BOOLEAN);
 		$this->addType('enabled', Types::BOOLEAN);
 		$this->addType('lastRun', Types::DATETIME);
 	}
 	/**
 	 * The date field to evaluate, never anything else.
 	 *
 	 * Rows written before the column existed carry 'due' from the schema
 	 * default, but a freshly constructed entity holds `null` and a hand-edited
 	 * row could hold anything. Falling back to the due date keeps the old
 	 * behaviour for every value that is not explicitly the start date — the
 	 * safe direction, since 'due' is what every workflow meant before this
 	 * choice existed.
 	 *
 	 * @return self::DATE_FIELD_*
 	 */
 	public function getDateFieldOrDue(): string {
 		$field = $this->getDateField();
 		return in_array($field, self::DATE_FIELDS, true) ? $field : self::DATE_FIELD_DUE;
 	}
 	/**
 	 * @return string[]
 	 */
 	public function getFilterUserIdsArray(): array {
 		return $this->decodeIds($this->getFilterUserIds());
 	}
 	/**
 	 * @return int[]
 	 */
 	public function getFilterLabelIdsArray(): array {
 		return array_map('intval', $this->decodeIds($this->getFilterLabelIds()));
 	}
 	/**
 	 * @return string[]
 	 */
 	private function decodeIds(?string $json): array {
 		if ($json === null || $json === '') {
 			return [];
 		}
 		$decoded = json_decode($json, true);
 		return is_array($decoded) ? array_values($decoded) : [];
 	}
 	public function jsonSerialize(): array {
 		return [
 			'id' => $this->getId(),
@@ -117,10 +55,7 @@ class Workflow extends Entity implements \JsonSerializable {
 			'boardId' => $this->getBoardId(),
 			'sourceStackId' => $this->getSourceStackId(),
 			'targetStackId' => $this->getTargetStackId(),
-			'filterUserIds' => $this->getFilterUserIdsArray(),
+			'notifyMode' => (string)$this->getNotifyMode(),
 			'filterLabelIds' => $this->getFilterLabelIdsArray(),
 			'dateField' => $this->getDateFieldOrDue(),
 			'notifyEmail' => (bool)$this->getNotifyEmail(),
 			'enabled' => (bool)$this->getEnabled(),
 			'lastRun' => $this->getLastRun()?->format(\DateTimeInterface::ATOM),
 		];
@@ -22,24 +22,27 @@ class WorkflowMapper extends QBMapper {
 	 * @throws DoesNotExistException
 	 * @throws MultipleObjectsReturnedException
 	 */
-	public function findForUser(int $id, string $userId): Workflow {
+	public function findById(int $id): Workflow {
 		$qb = $this->db->getQueryBuilder();
 		$qb->select('*')
 			->from($this->getTableName())
-			->where($qb->expr()->eq('id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT)))
+			->where($qb->expr()->eq('id', $qb->createNamedParameter($id, IQueryBuilder::PARAM_INT)));
 			->andWhere($qb->expr()->eq('user_id', $qb->createNamedParameter($userId)));
 		return $this->findEntity($qb);
 	}
 	/**
 	 * @param int[] $boardIds
 	 * @return Workflow[]
 	 */
-	public function findAllForUser(string $userId): array {
+	public function findAllForBoards(array $boardIds): array {
 		if ($boardIds === []) {
 			return [];
 		}
 		$qb = $this->db->getQueryBuilder();
 		$qb->select('*')
 			->from($this->getTableName())
-			->where($qb->expr()->eq('user_id', $qb->createNamedParameter($userId)))
+			->where($qb->expr()->in('board_id', $qb->createNamedParameter($boardIds, IQueryBuilder::PARAM_INT_ARRAY)))
 			->orderBy('id', 'ASC');
 		return $this->findEntities($qb);
@@ -1,47 +0,0 @@
 <?php
 declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Migration;
 use Closure;
 use OCA\WorkflowDeckAutomation\Db\Workflow;
 use OCP\DB\ISchemaWrapper;
 use OCP\DB\Types;
 use OCP\Migration\IOutput;
 use OCP\Migration\SimpleMigrationStep;
 /**
 * Adds the per-workflow choice between Deck's due date and its start date.
 *
 * A separate migration rather than an edit to Version1000...: that one is
 * wrapped in `if (!$schema->hasTable(...))`, so changing it would only ever
 * reach fresh installs.
 *
 * The `default` is what migrates the existing rows — every workflow written
 * before this release was evaluated against the due date, and the column
 * default gives exactly that without a backfill step.
 */
 class Version1001Date20260825120000 extends SimpleMigrationStep {
 	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
 		/** @var ISchemaWrapper $schema */
 		$schema = $schemaClosure();
 		if (!$schema->hasTable('wfda_workflows')) {
 			return null;
 		}
 		$table = $schema->getTable('wfda_workflows');
 		if ($table->hasColumn('date_field')) {
 			return null;
 		}
 		$table->addColumn('date_field', Types::STRING, [
 			'notnull' => true,
 			'length' => 16,
 			'default' => Workflow::DATE_FIELD_DUE,
 		]);
 		return $schema;
 	}
 }
@@ -0,0 +1,40 @@
 <?php
 declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Migration;
 use Closure;
 use OCP\DB\ISchemaWrapper;
 use OCP\Migration\IOutput;
 use OCP\Migration\SimpleMigrationStep;
 /**
 * Drops the assigned-user and label filters. Workflows that had one keep
 * running, now unfiltered — that was an explicit product decision.
 *
 * The columns have to go rather than just be ignored: Entity::fromRow()
 * calls a setter for every selected column, and the Workflow entity no
 * longer has these properties.
 */
 class Version1001Date20260930120000 extends SimpleMigrationStep {
 	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
 		/** @var ISchemaWrapper $schema */
 		$schema = $schemaClosure();
 		if (!$schema->hasTable('wfda_workflows')) {
 			return null;
 		}
 		$table = $schema->getTable('wfda_workflows');
 		$changed = false;
 		foreach (['filter_user_ids', 'filter_label_ids'] as $column) {
 			if ($table->hasColumn($column)) {
 				$table->dropColumn($column);
 				$changed = true;
 			}
 		}
 		return $changed ? $schema : null;
 	}
 }
@@ -0,0 +1,64 @@
 <?php
 declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Migration;
 use Closure;
 use OCP\DB\ISchemaWrapper;
 use OCP\DB\QueryBuilder\IQueryBuilder;
 use OCP\DB\Types;
 use OCP\IDBConnection;
 use OCP\Migration\IOutput;
 use OCP\Migration\SimpleMigrationStep;
 /**
 * Replaces the yes/no `notify_email` flag with `notify_mode`
 * (off / owner / board, see NotificationPolicy::MODES).
 *
 * Existing workflows keep behaving exactly as before: a set flag becomes
 * `owner` — the only recipient the flag ever had — everything else `off`.
 * The old column is dropped by the next step, once the values are copied.
 */
 class Version1002Date20261001120000 extends SimpleMigrationStep {
 	public function __construct(
 		private IDBConnection $db,
 	) {
 	}
 	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
 		/** @var ISchemaWrapper $schema */
 		$schema = $schemaClosure();
 		if (!$schema->hasTable('wfda_workflows')) {
 			return null;
 		}
 		$table = $schema->getTable('wfda_workflows');
 		if ($table->hasColumn('notify_mode')) {
 			return null;
 		}
 		$table->addColumn('notify_mode', Types::STRING, [
 			'notnull' => true,
 			'length' => 16,
 			'default' => 'off',
 		]);
 		return $schema;
 	}
 	public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options): void {
 		/** @var ISchemaWrapper $schema */
 		$schema = $schemaClosure();
 		if (!$schema->hasTable('wfda_workflows') || !$schema->getTable('wfda_workflows')->hasColumn('notify_email')) {
 			return;
 		}
 		$qb = $this->db->getQueryBuilder();
 		$qb->update('wfda_workflows')
 			->set('notify_mode', $qb->createNamedParameter('owner'))
 			->where($qb->expr()->eq('notify_email', $qb->createNamedParameter(true, IQueryBuilder::PARAM_BOOL)));
 		$qb->executeStatement();
 	}
 }
@@ -0,0 +1,34 @@
 <?php
 declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Migration;
 use Closure;
 use OCP\DB\ISchemaWrapper;
 use OCP\Migration\IOutput;
 use OCP\Migration\SimpleMigrationStep;
 /**
 * Drops `notify_email` now that Version1002Date20261001120000 has copied it
 * into `notify_mode`. It has to go rather than be ignored: Entity::fromRow()
 * calls a setter per selected column, and Workflow no longer has one.
 */
 class Version1003Date20261001120100 extends SimpleMigrationStep {
 	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
 		/** @var ISchemaWrapper $schema */
 		$schema = $schemaClosure();
 		if (!$schema->hasTable('wfda_workflows')) {
 			return null;
 		}
 		$table = $schema->getTable('wfda_workflows');
 		if (!$table->hasColumn('notify_email')) {
 			return null;
 		}
 		$table->dropColumn('notify_email');
 		return $schema;
 	}
 }
@@ -4,7 +4,7 @@ declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Service;
-use DateTimeInterface;
+use OCA\Deck\Db\AssignmentMapper;
 use OCA\Deck\Db\BoardMapper;
 use OCA\Deck\Db\Card;
 use OCA\Deck\Db\CardMapper;
@@ -15,9 +15,8 @@ use OCA\Deck\Service\PermissionService;
 use OCA\Deck\Service\StackService;
 use OCP\App\IAppManager;
 use OCP\AppFramework\Db\DoesNotExistException;
-use OCP\IGroupManager;
+use OCP\IConfig;
 use OCP\IUser;
 use OCP\IUserManager;
 use OCP\Server;
 use Psr\Log\LoggerInterface;
 use ReflectionProperty;
@@ -37,35 +36,9 @@ class DeckIntegrationService {
 	private const DECK_APP_ID = 'deck';
 	/**
-	 * Oldest Deck this app will talk to.
+	 * Deck's Acl::PERMISSION_READ, inlined so a moved or renamed constant
-	 *
+	 * cannot fatal this class. It is the key under which
-	 * Deck 1.18.0 is the release that added the card start date
+	 * PermissionService::getPermissions() reports read access.
 	 * (`Card::$startdate`, PR #7749), which the start-date workflows read.
 	 * The floor cannot live in appinfo/info.xml: neither the server's
 	 * app-info.xsd nor the app store's info.xsd has an app-to-app dependency
 	 * element, only <nextcloud>.
 	 *
 	 * That pin does most of the work anyway — Deck 1.18.x is the only release
 	 * line declaring `>=34.0.0,<35.0.0`, so on the Nextcloud 34 this app
 	 * requires, every installable Deck already carries the field. What is left
 	 * for this check is a Deck put in place by hand or from git.
 	 *
 	 * version_compare() sorts `1.18.0-beta.x` *below* `1.18.0`, and that is
 	 * intended: the betas of that line may predate the field.
 	 */
 	private const MIN_DECK_VERSION = '1.18.0';
 	/**
 	 * Deck's Acl::PERMISSION_TYPE_* values, inlined so this class keeps
 	 * working (degrading to "treat it as a user") if Deck ever moves or
 	 * renames the constants.
 	 */
 	private const ACL_TYPE_USER = 0;
 	private const ACL_TYPE_GROUP = 1;
 	/**
 	 * Deck's Acl::PERMISSION_READ, inlined for the same reason. It is the key
 	 * under which PermissionService::getPermissions() reports read access.
 	 */
 	private const ACL_PERMISSION_READ = 0;
@@ -88,35 +61,14 @@ class DeckIntegrationService {
 		'OCA\Deck\Activity\ActivityManager',
 	];
 	/**
 	 * `Workflow::DATE_FIELD_*` mapped to the property on Deck's Card entity.
 	 * Kept here rather than on the Workflow so this class stays the only one
 	 * that has to know what Deck calls its columns.
 	 */
 	private const CARD_DATE_PROPERTIES = [
 		'due' => 'duedate',
 		'start' => 'startdate',
 	];
 	private const DEFAULT_CARD_DATE = 'due';
 	/**
 	 * @var list<array{ReflectionProperty, object, ?string}>
 	 */
 	private array $identityRestore = [];
 	/**
 	 * Card properties already reported as missing, so the warning in
 	 * getCardDate() is one line per process instead of one per card.
 	 *
 	 * @var array<string, true>
 	 */
 	private array $reportedMissingCardProperties = [];
 	public function __construct(
 		private IAppManager $appManager,
-		private IUserManager $userManager,
+		private IConfig $config,
 		private IGroupManager $groupManager,
 		private LoggerInterface $logger,
 	) {
 	}
@@ -206,71 +158,50 @@ class DeckIntegrationService {
 		if (!$this->appManager->isEnabledForUser(self::DECK_APP_ID, $user)) {
 			throw new DeckUnavailableException('Deck is not enabled for user ' . $user->getUID());
 		}
 		$version = $this->appManager->getAppVersion(self::DECK_APP_ID);
 		if ($version === '' || version_compare($version, self::MIN_DECK_VERSION, '<')) {
 			throw new DeckUnavailableException(sprintf(
 				'Deck %s is installed, but %s or newer is required',
 				$version !== '' ? $version : '(unknown version)',
 				self::MIN_DECK_VERSION,
 			));
 		}
 		if (!class_exists(CardService::class) || !class_exists(BoardService::class) || !class_exists(StackService::class)) {
 			throw new DeckUnavailableException('Deck internal classes are not available');
 		}
 	}
 	/**
-	 * @return array<int, array{id: int, title: string}>
+	 * The boards `$userId` owns — the only boards workflows may live on, and
 	 * the boards whose workflows that user sees and manages.
 	 *
-	 * Only ever call this from a *request*: getUserBoards() reads the uid
+	 * One query: BoardMapper::findAllByOwner() is `WHERE owner = :uid`, so
-	 * BoardService froze at construction time, and beginUserContext() cannot
+	 * shared boards never come back, and as a plain QBMapper it has none of
-	 * help here — it repoints that field, but Deck may already have cached
+	 * the frozen-uid state of BoardService::getUserBoards(). It does return
-	 * board lists behind it, and the job has no use for a board *list*
+	 * archived and trashed boards; trashed ones are dropped here, archived
-	 * anyway. It asks findStackIds() about one known board id instead.
+	 * ones are kept but flagged — their workflows still exist and must stay
 	 * visible, they just aren't offered as a new target.
 	 *
 	 * Throws instead of degrading to `[]`: an empty list would read as "you
 	 * own no boards" and hide every workflow the user has.
 	 *
 	 * @return array<int, array{id: int, title: string, archived: bool}>
 	 * @throws DeckUnavailableException
 	 */
-	public function listBoardsForCurrentUser(): array {
+	public function listOwnedBoards(string $userId): array {
-		$boards = $this->call(function () {
+		$boards = $this->call(
-			$boardService = $this->resolve(BoardService::class);
+			fn () => $this->resolve(BoardMapper::class)->findAllByOwner($userId),
-			try {
+			[],
-				// getUserBoards(?int $since, bool $includeArchived, …): with
+			true,
-				// the default $includeArchived = true, Deck skips the
+		);
 				// `archived = false AND deleted_at = 0` conditions entirely,
 				// so archived *and* trashed boards come back. Ask for the
 				// filtered query instead of sorting them out afterwards.
 				return $boardService->getUserBoards(null, false);
 			} catch (Throwable $e) {
 				// Older/newer Deck with a different signature: fall back to
 				// the unfiltered call, isBoardHidden() below still filters.
 				return $boardService->getUserBoards();
 			}
 		}, []);
 		// Deck merges own/group/circle boards, so the same board can come
 		// back more than once; and boards in the trash or archived ones are
 		// no useful automation target. Keyed by id => deduplicated.
 		$result = [];
 		foreach ($boards as $board) {
-			$id = (int)$board->getId();
+			if (method_exists($board, 'getDeletedAt') && (int)$board->getDeletedAt() > 0) {
 			if (isset($result[$id]) || $this->isBoardHidden($board)) {
 				continue;
 			}
 			$id = (int)$board->getId();
 			$title = $board->getTitle();
-			$result[$id] = [
+			$result[] = [
 				'id' => $id,
 				'title' => (is_string($title) && $title !== '') ? $title : ('#' . $id),
 				'archived' => method_exists($board, 'getArchived') && (bool)$board->getArchived(),
 			];
 		}
-		return array_values($result);
+		return $result;
 	}
 	private function isBoardHidden(mixed $board): bool {
 		if (method_exists($board, 'getDeletedAt') && (int)$board->getDeletedAt() > 0) {
 			return true;
 		}
 		return method_exists($board, 'getArchived') && $board->getArchived() === true;
 	}
 	/**
@@ -343,6 +274,112 @@ class DeckIntegrationService {
 		return array_map(static fn ($stack) => (int)$stack->getId(), $stacks);
 	}
 	/**
 	 * The uid of the board's current owner — the user a workflow on that
 	 * board belongs to. Workflows follow the board: when Deck transfers its
 	 * ownership, they move to the new owner along with it.
 	 *
 	 * Read through BoardMapper, a plain QBMapper without user state, so it
 	 * answers the same in a request and in cron. Trashed and archived boards
 	 * still report their owner. `null` only if the board row is gone; every
 	 * other failure throws, like findStackIds().
 	 *
 	 * @throws DeckUnavailableException
 	 */
 	public function findBoardOwner(int $boardId): ?string {
 		try {
 			$board = $this->resolve(BoardMapper::class)->find($boardId);
 		} catch (DeckUnavailableException $e) {
 			throw $e;
 		} catch (Throwable $e) {
 			if ($this->isMissing($e)) {
 				return null;
 			}
 			throw new DeckUnavailableException('Could not read owner of board ' . $boardId . ': ' . $e->getMessage(), 0, $e);
 		}
 		$owner = $this->unwrapUid($board->getOwner());
 		if ($owner === null) {
 			throw new DeckUnavailableException('Board ' . $boardId . ' has no readable owner');
 		}
 		return $owner;
 	}
 	/**
 	 * Who should hear about each of the given (moved) cards, according to
 	 * every board member's own Deck notification setting for this board —
 	 * the "Notifications: none / assigned cards / all cards" menu, stored as
 	 * the user preference `deck` / `board:<id>:notify-due`. The decision
 	 * itself is NotificationPolicy::shouldNotify(), a copy of Deck's rules.
 	 *
 	 * Like findStackIds(), assembled only from pieces that take the users
 	 * explicitly and never consult Deck's frozen `$userId`:
 	 * PermissionService::findUsers() reads the owner and ACL through mappers
 	 * and expands groups and circles itself; AssignmentMapper is a plain
 	 * mapper that also resolves group/circle assignments; the preference is
 	 * read straight from IConfig.
 	 *
 	 * Throws on any failure, so the caller can log and skip the mail instead
 	 * of mailing a half-resolved or wrong set of people.
 	 *
 	 * @param int[] $cardIds
 	 * @return array<int, list<string>> card id => uids to notify
 	 * @throws DeckUnavailableException
 	 */
 	public function findNotificationRecipients(int $boardId, array $cardIds): array {
 		try {
 			$board = $this->resolve(BoardMapper::class)->find($boardId, false, true);
 			$owner = $this->unwrapUid($board->getOwner());
 			// Deck notifies the owner of a board nobody else can see about
 			// every card: "assigned" means nothing there.
 			$unshared = count($board->getAcl() ?? []) === 0;
 			// `true` bypasses PermissionService's per-process cache, which
 			// would otherwise outlive ACL changes for the whole cron pass.
 			$participants = $this->resolve(PermissionService::class)->findUsers($boardId, true);
 			$assignments = $this->resolve(AssignmentMapper::class);
 			$settings = [];
 			foreach ($participants as $uid => $participant) {
 				// Users of other instances (FederatedUser) have no local
 				// account and no preference to read.
 				if (!is_a($participant, 'OCA\Deck\Db\User')) {
 					continue;
 				}
 				// Numeric uids come back as integer array keys.
 				$uid = (string)$uid;
 				$settings[$uid] = (string)$this->config->getUserValue(
 					$uid,
 					self::DECK_APP_ID,
 					'board:' . $boardId . ':notify-due',
 					NotificationPolicy::DECK_DEFAULT,
 				);
 			}
 			$recipients = [];
 			foreach ($cardIds as $cardId) {
 				$recipients[$cardId] = [];
 				foreach ($settings as $uid => $setting) {
 					$uid = (string)$uid;
 					$notify = NotificationPolicy::shouldNotify(
 						$setting,
 						$unshared && $uid === $owner,
 						static fn (): bool => (bool)$assignments->isUserAssigned($cardId, $uid),
 					);
 					if ($notify) {
 						$recipients[$cardId][] = $uid;
 					}
 				}
 			}
 		} catch (DeckUnavailableException $e) {
 			throw $e;
 		} catch (Throwable $e) {
 			throw new DeckUnavailableException('Could not resolve notification recipients for board ' . $boardId . ': ' . $e->getMessage(), 0, $e);
 		}
 		return $recipients;
 	}
 	/**
 	 * Deck's own exception classes are referenced by name: `is_a()` with a
 	 * string simply returns false when the class does not exist, so a missing
@@ -361,51 +398,6 @@ class DeckIntegrationService {
 		return is_a($e, 'OCA\Deck\NotFoundException');
 	}
 	/**
 	 * @return array<int, array{id: int, title: string, color: string|null}>
 	 */
 	public function listLabels(int $boardId): array {
 		$labels = $this->call(fn () => $this->readLabels($boardId), []);
 		return array_map(
 			static fn ($label) => ['id' => (int)$label->getId(), 'title' => $label->getTitle(), 'color' => $label->getColor()],
 			$labels,
 		);
 	}
 	/**
 	 * What a workflow's filters *could* legitimately refer to on this board.
 	 *
 	 * Unlike listLabels()/listParticipants() this throws instead of degrading
 	 * to an empty list, because its only caller draws a conclusion from
 	 * emptiness ("this filter cannot match anything any more"). Same rule as
 	 * findStackIds(): a Deck hiccup must never be read as positive knowledge.
 	 *
 	 * @return array{labelIds: int[], participantUids: string[]}
 	 * @throws DeckUnavailableException
 	 */
 	public function findFilterOptions(int $boardId): array {
 		try {
 			$board = $this->readBoard($boardId);
 			return [
 				'labelIds' => array_map(
 					static fn ($label) => (int)$label->getId(),
 					$board->getLabels() ?? [],
 				),
 				'participantUids' => array_values(array_unique($this->collectParticipantUids($board))),
 			];
 		} catch (DeckUnavailableException $e) {
 			throw $e;
 		} catch (Throwable $e) {
 			$this->logger->error('Could not read filter options of board ' . $boardId . ': ' . $e->getMessage(), [
 				'app' => 'workflow_deck_automation',
 				'exception' => $e,
 			]);
 			throw new DeckUnavailableException('Deck call failed: ' . $e->getMessage(), 0, $e);
 		}
 	}
 	/**
 	 * Titles of a workflow's board and stacks, for the notification mail.
 	 *
@@ -439,85 +431,9 @@ class DeckIntegrationService {
 		return $title !== '' ? $title : ('#' . $id);
 	}
 	/**
 	 * Everyone who can hold a card on this board: the board owner (who is
 	 * *not* part of the ACL — a private board has an empty ACL) plus every
 	 * ACL entry, with group shares expanded to their members.
 	 *
 	 * @return array<int, array{uid: string, displayName: string}>
 	 */
 	public function listParticipants(int $boardId): array {
 		$uids = $this->call(fn () => $this->collectParticipantUids($this->readBoard($boardId)), []);
 		$participants = [];
 		foreach ($uids as $uid) {
 			if (isset($participants[$uid])) {
 				continue;
 			}
 			$participants[$uid] = [
 				'uid' => $uid,
 				'displayName' => $this->userManager->get($uid)?->getDisplayName() ?? $uid,
 			];
 		}
 		return array_values($participants);
 	}
 	/**
 	 * The enriched board — `$fullDetails = true` is what populates labels and
 	 * the ACL. Shared by every caller that needs one so a single Deck read
 	 * serves them all.
 	 */
 	private function readBoard(int $boardId): mixed {
 		return $this->resolve(BoardService::class)->find($boardId, true);
 	}
 	private function readLabels(int $boardId): array {
 		return $this->readBoard($boardId)->getLabels() ?? [];
 	}
 	/**
 	 * @return string[] may contain duplicates
 	 */
 	private function collectParticipantUids(mixed $board): array {
 		$uids = [];
 		$owner = $this->unwrapUid($board->getOwner());
 		if ($owner !== null) {
 			$uids[] = $owner;
 		}
 		foreach ($board->getAcl() ?? [] as $entry) {
 			$principal = $this->extractParticipantUid($entry);
 			if ($principal === null) {
 				continue;
 			}
 			$type = method_exists($entry, 'getType') ? (int)$entry->getType() : self::ACL_TYPE_USER;
 			if ($type === self::ACL_TYPE_GROUP) {
 				array_push($uids, ...$this->groupMemberUids($principal));
 			} elseif ($type === self::ACL_TYPE_USER) {
 				$uids[] = $principal;
 			}
 			// Circles and federated shares are skipped: their members
 			// cannot be resolved to plain uids here.
 		}
 		return $uids;
 	}
 	/**
 	 * @return string[]
 	 */
 	private function groupMemberUids(string $groupId): array {
 		$group = $this->groupManager->get($groupId);
 		if ($group === null) {
 			return [];
 		}
 		return array_map(static fn (IUser $user) => $user->getUID(), $group->getUsers());
 	}
 	/**
 	 * Cards in the given stack that are neither archived, deleted nor marked
-	 * done, enriched so getAssignedUsers()/getLabels() are populated.
+	 * done.
 	 *
 	 * The `deletedAt` check is not redundant: Deck's
 	 * `CardMapper::findAllByStack()` filters on `stack_id` and
@@ -529,17 +445,12 @@ class DeckIntegrationService {
 	 */
 	public function getActiveCardsInStack(int $stackId): array {
 		return $this->call(function () use ($stackId) {
-			$cardMapper = $this->resolve(CardMapper::class);
+			// Deliberately not enriched: CardService::enrichCards() only adds
-			$cardService = $this->resolve(CardService::class);
+			// labels, assignees and comment counts, and runs
-
+			// BoardService::find(), a permission check against Deck's frozen
-			$cards = $cardMapper->findAllByStack($stackId);
+			// uid (see beginUserContext()). Assignments, where needed for
-			// enrichCards() mutates each $cards entry in place (labels, assigned users, ...) but
+			// mails, come from findNotificationRecipients() instead.
-			// *returns* CardDetails wrappers whose own fields (duedate, stackId, ...) were never
+			$cards = $this->resolve(CardMapper::class)->findAllByStack($stackId);
 			// copied from the wrapped card - only its overridden jsonSerialize() reads through to
 			// them. Capturing that return value here made every card's getDuedate()/getDaysUntilDue()
 			// resolve to null, so hasPassed() was always false and no workflow ever matched a card.
 			// Keep using the original, now-enriched $cards instead.
 			$cardService->enrichCards($cards);
 			return array_values(array_filter($cards, static function (Card $card) {
 				if (method_exists($card, 'getDeletedAt') && (int)$card->getDeletedAt() > 0) {
@@ -550,74 +461,6 @@ class DeckIntegrationService {
 		}, []);
 	}
 	/**
 	 * The card date a workflow is evaluated against: Deck's due date or its
 	 * start date, per `Workflow::DATE_FIELD_*`. Anything unrecognised reads the
 	 * due date, which is what every workflow meant before the choice existed.
 	 *
 	 * The guard is `property_exists()`, deliberately, and this is the one thing
 	 * to get right here: **`method_exists()` cannot see Deck's getters.**
 	 * `Card`, `Board`, `Label`, `Acl` and `Assignment` declare none of them as
 	 * real code — `getStartdate()`, `getDuedate()`, even `getId()` all go
 	 * through `OCP\AppFramework\Db\Entity::__call()`, and `method_exists()`
 	 * ignores `__call()` by definition. A `method_exists($card, 'getStartdate')`
 	 * probe would therefore be false on *every* Deck version and silently turn
 	 * every start-date workflow into a no-op. `property_exists()` sees the
 	 * protected `$startdate` declaration and is exactly what `Entity::getter()`
 	 * checks internally before throwing.
 	 *
 	 * In practice the property is always there — `assertDeckAvailable()`
 	 * enforces Deck >= MIN_DECK_VERSION, which is the release that added it —
 	 * so this branch is a backstop for a hand-installed Deck, loud enough to be
 	 * found in the log rather than silently matching nothing.
 	 */
 	public function getCardDate(Card $card, string $dateField): ?DateTimeInterface {
 		$property = self::CARD_DATE_PROPERTIES[$dateField] ?? self::CARD_DATE_PROPERTIES[self::DEFAULT_CARD_DATE];
 		if (!property_exists($card, $property)) {
 			if (!isset($this->reportedMissingCardProperties[$property])) {
 				$this->reportedMissingCardProperties[$property] = true;
 				$this->logger->warning(
 					'This Deck version has no Card::$' . $property . '; workflows using it cannot match any card',
 					['app' => 'workflow_deck_automation'],
 				);
 			}
 			return null;
 		}
 		$value = $property === 'startdate' ? $card->getStartdate() : $card->getDuedate();
 		return $value instanceof DateTimeInterface ? $value : null;
 	}
 	/**
 	 * @return string[]
 	 */
 	public function getCardAssignedUserIds(Card $card): array {
 		$assigned = $card->getAssignedUsers() ?? [];
 		$uids = [];
 		foreach ($assigned as $entry) {
 			$uid = $this->extractParticipantUid($entry);
 			if ($uid !== null) {
 				$uids[] = $uid;
 			}
 		}
 		return $uids;
 	}
 	/**
 	 * @return int[]
 	 */
 	public function getCardLabelIds(Card $card): array {
 		$labels = $card->getLabels() ?? [];
 		$ids = [];
 		foreach ($labels as $label) {
 			if (method_exists($label, 'getId')) {
 				$ids[] = (int)$label->getId();
 			}
 		}
 		return $ids;
 	}
 	/**
 	 * Moves a card to another stack using Deck's own reorder logic
 	 * (the exact same code path behind Deck's "move card" action).
@@ -664,31 +507,6 @@ class DeckIntegrationService {
 		return Server::get($class);
 	}
 	/**
 	 * Deck's assignment/ACL entries are internal, undocumented value
 	 * objects whose exact accessor shape has changed across versions, so
 	 * we probe the common accessor names defensively instead of relying
 	 * on one fixed method signature.
 	 */
 	private function extractParticipantUid(mixed $entry): ?string {
 		$uid = $this->unwrapUid($entry);
 		if ($uid !== null) {
 			return $uid;
 		}
 		if (!is_object($entry)) {
 			return null;
 		}
 		foreach (['getParticipant', 'getUid', 'getParticipantUid', 'getUserId'] as $method) {
 			if (method_exists($entry, $method)) {
 				$uid = $this->unwrapUid($entry->$method());
 				if ($uid !== null) {
 					return $uid;
 				}
 			}
 		}
 		return null;
 	}
 	/**
 	 * Turns whatever Deck hands out for a "participant"/"owner" field into
 	 * a plain uid.
@@ -6,7 +6,6 @@ namespace OCA\WorkflowDeckAutomation\Service;
 use OCA\Deck\Db\Card;
 use OCA\WorkflowDeckAutomation\Db\Workflow;
 use OCP\IL10N;
 use OCP\IURLGenerator;
 use OCP\IUser;
 use OCP\Mail\IEMailTemplate;
@@ -15,89 +14,120 @@ use OCP\Util;
 use Psr\Log\LoggerInterface;
 use Throwable;
 class NotificationMailer {
 /**
-	 * Descriptions are unbounded in Deck; keep the mail readable and well
+ * The app is used internally only and speaks German, like its settings
-	 * clear of any MTA size limits.
+ * page: texts are written in German directly instead of going through
 * IL10N with English source strings and a translation file.
 */
-	private const MAX_DESCRIPTION_LENGTH = 2000;
+class NotificationMailer {
 	private const APP_ID = 'workflow_deck_automation';
 	private const SENDER_NAME = 'Deck Workflow-Automatisierung';
 	/**
 	 * Language of Nextcloud's own footer text ("automatically sent email,
 	 * please do not reply"), which would otherwise follow the instance
 	 * default — in cron there is no request to take a language from.
 	 */
 	private const FOOTER_LANGUAGE = 'de';
 	public function __construct(
 		private IMailer $mailer,
 		private IURLGenerator $urlGenerator,
 		private IL10N $l10n,
 		private LoggerInterface $logger,
 	) {
 	}
 	/**
-	 * @param array{board: string, sourceStack: string, targetStack: string} $targets
+	 * One mail listing every card moved for $recipient in this run — they
-	 *        titles resolved by DeckIntegrationService::describeTargets()
+	 * may come from several workflows and boards.
 	 *
 	 * @param non-empty-list<array{workflow: Workflow, card: Card, targets: array{board: string, sourceStack: string, targetStack: string}}> $entries
 	 *        targets are the titles resolved by DeckIntegrationService::describeTargets()
 	 */
-	public function sendCardMovedNotification(IUser $user, Workflow $workflow, Card $card, array $targets): void {
+	public function sendCardsMovedNotification(IUser $recipient, array $entries): void {
-		$email = $user->getEMailAddress();
+		$email = $recipient->getEMailAddress();
 		if ($email === null || $email === '') {
-			$this->logger->info('Skipping notification for workflow ' . $workflow->getId() . ': user ' . $user->getUID() . ' has no email address', [
+			$this->logger->info('Skipping moved-cards mail: user ' . $recipient->getUID() . ' has no email address', [
-				'app' => 'workflow_deck_automation',
+				'app' => self::APP_ID,
 			]);
 			return;
 		}
-		try {
+		$count = count($entries);
 			$cardLink = $this->urlGenerator->getAbsoluteURL(
 				'/apps/deck/board/' . $workflow->getBoardId() . '/card/' . $card->getId(),
 			);
-			$template = $this->mailer->createEMailTemplate('workflow_deck_automation.CardMoved', [
+		try {
-				'cardTitle' => $card->getTitle(),
+			$template = $this->mailer->createEMailTemplate(self::APP_ID . '.CardsMoved', [
-				'workflowTitle' => $workflow->getTitle(),
+				'count' => $count,
 				'cardTitles' => array_map(static fn (array $entry) => $entry['card']->getTitle(), $entries),
 			]);
-			$template->setSubject($this->l10n->t('Deck card moved: %s', [$card->getTitle()]));
+			$template->setSubject($count === 1
 				? sprintf('Deck-Karte verschoben: %s', $entries[0]['card']->getTitle())
 				: sprintf('%d Deck-Karten verschoben', $count));
 			$template->addHeader();
-			$template->addHeading($this->l10n->t('A card was moved automatically'), false);
+			$template->addHeading($count === 1
-			// Two whole strings rather than one sentence with an interpolated
+				? 'Eine Karte wurde automatisch verschoben'
-			// reason: the trigger is the point of the mail, and a translator
+				: sprintf('%d Karten wurden automatisch verschoben', $count), false);
-			// needs to see it in the sentence to get the grammar right.
+
-			$reason = $workflow->getDateFieldOrDue() === Workflow::DATE_FIELD_START
+			foreach ($entries as $entry) {
-				? $this->l10n->t(
+				$this->addCard($template, $entry['workflow'], $entry['card'], $entry['targets']);
-					'The card "%1$s" was moved because its start date has been reached (workflow "%2$s").',
+			}
-					[$card->getTitle(), $workflow->getTitle()],
+
-				)
+			$template->addFooter('', self::FOOTER_LANGUAGE);
 				: $this->l10n->t(
 					'The card "%1$s" was moved because it is overdue (workflow "%2$s").',
 					[$card->getTitle(), $workflow->getTitle()],
 				);
 			$template->addBodyText($reason);
 			// Single-argument addBodyText() runs htmlspecialchars() itself, so
 			// these board- and stack-titles (user input) are safe as-is —
 			// unlike the description below, which passes both parts.
 			$template->addBodyText($this->l10n->t(
 				'Board "%1$s": moved from "%2$s" to "%3$s".',
 				[$targets['board'], $targets['sourceStack'], $targets['targetStack']],
 			));
 			$this->addCardDescription($template, $card);
 			$template->addBodyButton($this->l10n->t('Open card'), $cardLink);
 			$template->addFooter();
 			$message = $this->mailer->createMessage();
-			$message->setTo([$email => $user->getDisplayName()]);
+			$message->setTo([$email => $recipient->getDisplayName()]);
-			$message->setFrom([Util::getDefaultEmailAddress('noreply') => $this->l10n->t('Deck Workflow Automation')]);
+			$message->setFrom([Util::getDefaultEmailAddress('noreply') => self::SENDER_NAME]);
 			$message->useTemplate($template);
 			$failedRecipients = $this->mailer->send($message);
 			if (!empty($failedRecipients)) {
-				$this->logger->error('Notification mail for card ' . $card->getId() . ' failed for: ' . implode(', ', $failedRecipients), [
+				$this->logger->error('Moved-cards mail failed for: ' . implode(', ', $failedRecipients), [
-					'app' => 'workflow_deck_automation',
+					'app' => self::APP_ID,
 				]);
 			}
 		} catch (Throwable $e) {
-			$this->logger->error('Could not send notification mail for card ' . $card->getId() . ': ' . $e->getMessage(), [
+			$this->logger->error('Could not send moved-cards mail to ' . $recipient->getUID() . ': ' . $e->getMessage(), [
-				'app' => 'workflow_deck_automation',
+				'app' => self::APP_ID,
 				'exception' => $e,
 			]);
 		}
 	}
 	/**
 	 * @param array{board: string, sourceStack: string, targetStack: string} $targets
 	 */
 	private function addCard(IEMailTemplate $template, Workflow $workflow, Card $card, array $targets): void {
 		// The card description and the workflow's name are deliberately left
 		// out — the mail only says what moved where. The card title itself is
 		// the link to the card.
 		$sentence = '„%1$s“ (Board „%2$s“) ist überfällig und wurde von „%3$s“ nach „%4$s“ verschoben.';
 		$url = $this->urlGenerator->getAbsoluteURL('/apps/deck/board/' . $workflow->getBoardId() . '/card/' . $card->getId());
 		// With both parts passed, addBodyText() escapes nothing: every title
 		// is user input and has to be escaped here for the HTML part.
 		$html = sprintf(
 			$sentence,
 			'<a href="' . self::escape($url) . '">' . self::escape($card->getTitle()) . '</a>',
 			self::escape($targets['board']),
 			self::escape($targets['sourceStack']),
 			self::escape($targets['targetStack']),
 		);
 		$plain = sprintf(
 			$sentence,
 			$card->getTitle(),
 			$targets['board'],
 			$targets['sourceStack'],
 			$targets['targetStack'],
 		) . PHP_EOL . $url;
 		$template->addBodyText($html, $plain);
 	}
 	private static function escape(string $text): string {
 		return htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
 	}
 	/**
 	 * One-off notice that a workflow was switched off because the board or
 	 * stack it points at is gone.
@@ -108,81 +138,53 @@ class NotificationMailer {
 		$email = $user->getEMailAddress();
 		if ($email === null || $email === '') {
 			$this->logger->info('Cannot notify about disabled workflow ' . $workflow->getId() . ': user ' . $user->getUID() . ' has no email address', [
-				'app' => 'workflow_deck_automation',
+				'app' => self::APP_ID,
 			]);
 			return;
 		}
 		$reason = match ($brokenTarget) {
-			WorkflowRunner::TARGET_SOURCE_STACK => $this->l10n->t('its source stack no longer exists'),
+			WorkflowRunner::TARGET_SOURCE_STACK => 'sein Quell-Stapel nicht mehr existiert',
-			WorkflowRunner::TARGET_TARGET_STACK => $this->l10n->t('its target stack no longer exists'),
+			WorkflowRunner::TARGET_TARGET_STACK => 'sein Ziel-Stapel nicht mehr existiert',
-			default => $this->l10n->t('its board no longer exists or is no longer available to you'),
+			default => 'sein Board nicht mehr existiert oder für dich nicht mehr verfügbar ist',
 		};
 		try {
-			$settingsLink = $this->urlGenerator->getAbsoluteURL('/settings/user/workflow_deck_automation');
+			$settingsLink = $this->urlGenerator->getAbsoluteURL('/settings/user/' . self::APP_ID);
-			$template = $this->mailer->createEMailTemplate('workflow_deck_automation.WorkflowDisabled', [
+			$template = $this->mailer->createEMailTemplate(self::APP_ID . '.WorkflowDisabled', [
 				'workflowTitle' => $workflow->getTitle(),
 			]);
-			$template->setSubject($this->l10n->t('Deck workflow deactivated: %s', [$workflow->getTitle()]));
+			$template->setSubject(sprintf('Deck-Workflow deaktiviert: %s', $workflow->getTitle()));
 			$template->addHeader();
-			$template->addHeading($this->l10n->t('A workflow was deactivated'), false);
+			$template->addHeading('Ein Workflow wurde deaktiviert', false);
-			$template->addBodyText($this->l10n->t(
+			$template->addBodyText(sprintf(
-				'The workflow "%1$s" was switched off automatically because %2$s. No cards are being moved by it any more.',
+				'Der Workflow „%1$s“ wurde automatisch ausgeschaltet, weil %2$s. Er verschiebt keine Karten mehr.',
-				[$workflow->getTitle(), $reason],
+				$workflow->getTitle(),
 				$reason,
 			));
-			$template->addBodyText($this->l10n->t(
+			$template->addBodyText(
-				'Delete the workflow or point it at an existing board and stack to reactivate it. You will not be reminded about this workflow again.',
+				'Lösche den Workflow oder stelle ein vorhandenes Board und vorhandene Stapel ein, um ihn wieder zu aktivieren. An diesen Workflow wirst du nicht noch einmal erinnert.',
-			));
+			);
-			$template->addBodyButton($this->l10n->t('Open settings'), $settingsLink);
+			$template->addBodyButton('Einstellungen öffnen', $settingsLink);
-			$template->addFooter();
+			$template->addFooter('', self::FOOTER_LANGUAGE);
 			$message = $this->mailer->createMessage();
 			$message->setTo([$email => $user->getDisplayName()]);
-			$message->setFrom([Util::getDefaultEmailAddress('noreply') => $this->l10n->t('Deck Workflow Automation')]);
+			$message->setFrom([Util::getDefaultEmailAddress('noreply') => self::SENDER_NAME]);
 			$message->useTemplate($template);
 			$failedRecipients = $this->mailer->send($message);
 			if (!empty($failedRecipients)) {
 				$this->logger->error('Deactivation mail for workflow ' . $workflow->getId() . ' failed for: ' . implode(', ', $failedRecipients), [
-					'app' => 'workflow_deck_automation',
+					'app' => self::APP_ID,
 				]);
 			}
 		} catch (Throwable $e) {
 			$this->logger->error('Could not send deactivation mail for workflow ' . $workflow->getId() . ': ' . $e->getMessage(), [
-				'app' => 'workflow_deck_automation',
+				'app' => self::APP_ID,
 				'exception' => $e,
 			]);
 		}
 	}
 	/**
 	 * Appends the card's description, if it has one.
 	 *
 	 * Deck stores the description as Markdown. It is sent as-is rather than
 	 * rendered: pulling a Markdown parser in just for the mail would be a
 	 * lot of machinery, and unrendered Markdown still reads fine.
 	 */
 	private function addCardDescription(IEMailTemplate $template, Card $card): void {
 		$description = trim((string)$card->getDescription());
 		if ($description === '') {
 			return;
 		}
 		if (mb_strlen($description) > self::MAX_DESCRIPTION_LENGTH) {
 			$description = mb_substr($description, 0, self::MAX_DESCRIPTION_LENGTH) . ' […]';
 		}
 		$template->addBodyText($this->l10n->t('Card content:'));
 		// addBodyText() only runs htmlspecialchars() when it has to build the
 		// plain-text part itself. Passing both parts means escaping is on us
 		// -- and it has to be, because a card description is user input that
 		// would otherwise land unescaped in the HTML mail.
 		$template->addBodyText(
 			nl2br(htmlspecialchars($description, ENT_QUOTES, 'UTF-8'), false),
 			$description,
 		);
 	}
 }
@@ -0,0 +1,70 @@
 <?php
 declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Service;
 /**
 * Who gets a mail about a moved card — pure logic, no Nextcloud or Deck
 * dependencies, so it is unit-testable like WorkflowRunner::isOverdue().
 */
 class NotificationPolicy {
 	/** No mail at all. */
 	public const MODE_OFF = 'off';
 	/** Only the workflow's owner (the board owner), regardless of Deck settings. */
 	public const MODE_OWNER = 'owner';
 	/** Everyone with access to the board, filtered by their own Deck setting. */
 	public const MODE_BOARD = 'board';
 	public const MODES = [self::MODE_OFF, self::MODE_OWNER, self::MODE_BOARD];
 	/**
 	 * Values of Deck's per-user, per-board preference
 	 * `deck` / `board:<boardId>:notify-due` (Deck's
 	 * ConfigService::SETTING_BOARD_NOTIFICATION_DUE_*), inlined so a renamed
 	 * constant cannot fatal this app. It is the board's "Notifications" menu
 	 * in Deck — the due-date reminder setting, which is exactly what fits a
 	 * card being moved because it fell due.
 	 */
 	public const DECK_OFF = 'off';
 	public const DECK_ASSIGNED = 'assigned';
 	public const DECK_ALL = 'all';
 	/** What Deck assumes for a user who never touched the setting. */
 	public const DECK_DEFAULT = self::DECK_ASSIGNED;
 	public static function isValidMode(string $mode): bool {
 		return in_array($mode, self::MODES, true);
 	}
 	/**
 	 * Mirrors Deck's own decision in NotificationHelper::sendCardDuedate():
 	 *
 	 * - `off` never notifies — not even the owner of an unshared board;
 	 * - `all` always notifies;
 	 * - the owner of an unshared board is notified for every card, since on a
 	 *   board nobody else can see "assigned" would otherwise mean nothing;
 	 * - `assigned` notifies users assigned to the card, directly or through a
 	 *   group or circle.
 	 *
 	 * An unknown value is treated as Deck's default. Deck rejects anything
 	 * else when storing the setting, so that only happens if the preference
 	 * was edited by hand.
 	 *
 	 * @param bool|callable(): bool $isAssigned a callable is only invoked when
 	 *        the answer actually depends on it — it costs a query per user
 	 */
 	public static function shouldNotify(string $deckSetting, bool $isOwnerOfUnsharedBoard, bool|callable $isAssigned): bool {
 		if (!in_array($deckSetting, [self::DECK_OFF, self::DECK_ASSIGNED, self::DECK_ALL], true)) {
 			$deckSetting = self::DECK_DEFAULT;
 		}
 		if ($deckSetting === self::DECK_OFF) {
 			return false;
 		}
 		if ($deckSetting === self::DECK_ALL || $isOwnerOfUnsharedBoard) {
 			return true;
 		}
 		return is_callable($isAssigned) ? (bool)$isAssigned() : $isAssigned;
 	}
 }
@@ -4,7 +4,9 @@ declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Service;
 use DateTimeImmutable;
 use DateTimeInterface;
 use DateTimeZone;
 use OCA\Deck\Db\Card;
 use OCA\WorkflowDeckAutomation\Db\Workflow;
 use OCA\WorkflowDeckAutomation\Db\WorkflowMapper;
@@ -17,8 +19,7 @@ use Psr\Log\LoggerInterface;
 use Throwable;
 /**
- * Evaluates all enabled workflows and moves the cards whose watched date -
+ * Evaluates all enabled workflows and moves overdue cards.
 * Deck's due date or its start date, per workflow - has passed.
 *
 * This runner has to evaluate rules for many different users within a
 * single background-job process, so workflows are grouped by owner and
@@ -37,6 +38,13 @@ class WorkflowRunner {
 	private ?IUser $impersonationRestore = null;
 	/**
 	 * Moved cards per recipient uid, collected over the whole run.
 	 *
 	 * @var array<string, list<array{workflow: Workflow, card: Card, targets: array{board: string, sourceStack: string, targetStack: string}}>>
 	 */
 	private array $pendingMails = [];
 	public function __construct(
 		private WorkflowMapper $workflowMapper,
 		private DeckIntegrationService $deckService,
@@ -55,8 +63,11 @@ class WorkflowRunner {
 			return;
 		}
 		$this->pendingMails = [];
 		$byUser = [];
 		$owners = [];
 		foreach ($workflows as $workflow) {
 			$this->followBoardOwner($workflow, $owners);
 			$byUser[$workflow->getUserId()][] = $workflow;
 		}
@@ -77,6 +88,57 @@ class WorkflowRunner {
 				]);
 			}
 		}
 		$this->sendPendingMails();
 	}
 	/**
 	 * A workflow belongs to its board's owner, not to whoever created it: if
 	 * Deck transferred the board, the workflow moves along to the new owner —
 	 * it then runs as them, and they get its mails.
 	 *
 	 * Only a known owner rewrites `user_id`. A board that is gone keeps its
 	 * last owner, so findBrokenTarget() can disable the workflow and mail
 	 * them; a Deck error keeps it too, and the run just goes ahead as before.
 	 *
 	 * @param array<int, ?string> $owners per-run cache, board id => owner
 	 */
 	private function followBoardOwner(Workflow $workflow, array &$owners): void {
 		$boardId = $workflow->getBoardId();
 		if (!array_key_exists($boardId, $owners)) {
 			try {
 				$owners[$boardId] = $this->deckService->findBoardOwner($boardId);
 			} catch (Throwable $e) {
 				$this->logger->warning('Could not determine the owner of board {board}: ' . $e->getMessage(), [
 					'app' => 'workflow_deck_automation',
 					'board' => $boardId,
 				]);
 				$owners[$boardId] = null;
 			}
 		}
 		$owner = $owners[$boardId];
 		if ($owner === null || $owner === $workflow->getUserId()) {
 			return;
 		}
 		$this->logger->info('Workflow {id} follows board {board} to its new owner {owner}.', [
 			'app' => 'workflow_deck_automation',
 			'id' => $workflow->getId(),
 			'board' => $boardId,
 			'owner' => $owner,
 		]);
 		$workflow->setUserId($owner);
 		try {
 			$this->workflowMapper->update($workflow);
 		} catch (Throwable $e) {
 			// Not persisted, but this run still goes to the right user; the
 			// next one tries again.
 			$this->logger->warning('Could not store the new owner of workflow {id}: ' . $e->getMessage(), [
 				'app' => 'workflow_deck_automation',
 				'id' => $workflow->getId(),
 			]);
 		}
 	}
 	/**
@@ -159,53 +221,112 @@ class WorkflowRunner {
 			return;
 		}
-		$filterUserIds = $workflow->getFilterUserIdsArray();
+		$moved = [];
 		$filterLabelIds = $workflow->getFilterLabelIdsArray();
 		$this->warnAboutDeadFilters($workflow, $filterUserIds, $filterLabelIds);
 		// Resolved at most once per run, and only if a card actually moves
 		// and the workflow wants a mail — this is decoration, not a check.
 		$targets = null;
 		$now = $this->timeFactory->getDateTime();
 		$dateField = $workflow->getDateFieldOrDue();
 		foreach ($cards as $card) {
-			if (!self::hasPassed($this->deckService->getCardDate($card, $dateField), $now)) {
+			if (!self::isOverdue($card->getDuedate(), $now)) {
 				continue;
 			}
-			$assignedUserIds = $this->deckService->getCardAssignedUserIds($card);
+			$this->logger->info('Card {card} ("{title}") matches workflow {id}; moving to stack {target}.', [
 			$labelIds = $this->deckService->getCardLabelIds($card);
 			if (!self::cardMatchesFilters($assignedUserIds, $labelIds, $filterUserIds, $filterLabelIds)) {
 				continue;
 			}
 			$this->logger->info('Card {card} ("{title}") matches workflow {id} on its {dateField} date; moving to stack {target}.', [
 				'app' => 'workflow_deck_automation',
 				'card' => $card->getId(),
 				'title' => $card->getTitle(),
 				'id' => $workflow->getId(),
 				'dateField' => $dateField,
 				'target' => $workflow->getTargetStackId(),
 			]);
-			if (!$this->moveCard($workflow, $card)) {
+			if ($this->moveCard($workflow, $card)) {
-				continue;
+				$moved[] = $card;
 			}
 			if ($workflow->getNotifyEmail()) {
 				$targets ??= $this->deckService->describeTargets(
 					$workflow->getBoardId(),
 					$workflow->getSourceStackId(),
 					$workflow->getTargetStackId(),
 				);
 				$this->mailer->sendCardMovedNotification($user, $workflow, $card, $targets);
 			}
 		}
 		$workflow->setLastRun($this->timeFactory->getDateTime());
 		$this->workflowMapper->update($workflow);
 		if ($moved !== []) {
 			$this->queueMails($user, $workflow, $moved);
 		}
 	}
 	/**
 	 * Works out who hears about the moved cards and parks them in
 	 * $pendingMails; sendPendingMails() delivers them once per recipient at
 	 * the end of the run.
 	 *
 	 * Mails are decoration, not part of the move: nothing in here may fail
 	 * the workflow, and if Deck cannot say who wants a mail, nobody gets one
 	 * rather than people who asked Deck for silence.
 	 *
 	 * @param Card[] $cards
 	 */
 	private function queueMails(IUser $owner, Workflow $workflow, array $cards): void {
 		$cardIds = array_map(static fn (Card $card): int => (int)$card->getId(), $cards);
 		switch ($workflow->getNotifyMode()) {
 			case NotificationPolicy::MODE_OWNER:
 				$recipients = array_fill_keys($cardIds, [$owner->getUID()]);
 				break;
 			case NotificationPolicy::MODE_BOARD:
 				try {
 					$recipients = $this->deckService->findNotificationRecipients($workflow->getBoardId(), $cardIds);
 				} catch (DeckUnavailableException $e) {
 					$this->logger->warning('No mails for workflow {id}: ' . $e->getMessage(), [
 						'app' => 'workflow_deck_automation',
 						'id' => $workflow->getId(),
 					]);
 					return;
 				}
 				break;
 			default:
 				return;
 		}
 		$targets = $this->deckService->describeTargets(
 			$workflow->getBoardId(),
 			$workflow->getSourceStackId(),
 			$workflow->getTargetStackId(),
 		);
 		foreach ($cards as $card) {
 			foreach ($recipients[(int)$card->getId()] ?? [] as $uid) {
 				$this->pendingMails[$uid][] = [
 					'workflow' => $workflow,
 					'card' => $card,
 					'targets' => $targets,
 				];
 			}
 		}
 	}
 	/**
 	 * One mail per recipient and run, however many cards and workflows it
 	 * covers — a board with twenty overdue cards and fifteen members would
 	 * otherwise send three hundred mails at once.
 	 *
 	 * Runs after the per-user loop, so no impersonation is active any more.
 	 */
 	private function sendPendingMails(): void {
 		$pending = $this->pendingMails;
 		$this->pendingMails = [];
 		foreach ($pending as $uid => $entries) {
 			// Same reasoning as in run(): nothing may escape.
 			try {
 				$recipient = $this->userManager->get((string)$uid);
 				if ($recipient === null || !$recipient->isEnabled()) {
 					continue;
 				}
 				$this->mailer->sendCardsMovedNotification($recipient, $entries);
 			} catch (Throwable $e) {
 				$this->logger->error('Could not send the moved-cards mail to {user}: ' . $e->getMessage(), [
 					'app' => 'workflow_deck_automation',
 					'user' => $uid,
 					'exception' => $e,
 				]);
 			}
 		}
 	}
 	/**
@@ -249,7 +370,7 @@ class WorkflowRunner {
 			'target' => $brokenTarget,
 		]);
-		// Sent regardless of the workflow's notifyEmail setting: that flag is
+		// Sent to the owner regardless of the workflow's notifyMode: that is
 		// about moved cards, this is a one-off notice that the automation the
 		// user configured has been switched off. It stays one-off because a
 		// disabled workflow is not picked up again.
@@ -280,125 +401,38 @@ class WorkflowRunner {
 	}
 	/**
-	 * A filter whose every entry has been deleted from the board is not an
+	 * Compares the card's actual due timestamp against $now instead of Deck's own
 	 * error — the workflow still runs, it just cannot match a single card any
 	 * more, forever, without anything in the UI or the log saying so. That is
 	 * the one failure mode of this app that is completely invisible, so it
 	 * gets a log line on every run.
 	 *
 	 * Explicitly *not* a reason to disable the workflow or mail the user: a
 	 * filter with three labels of which one was deleted still works as
 	 * intended, and even a fully dead filter may be one board edit away from
 	 * being live again. The settings page shows the same condition in red.
 	 *
 	 * @param string[] $filterUserIds
 	 * @param int[] $filterLabelIds
 	 */
 	private function warnAboutDeadFilters(Workflow $workflow, array $filterUserIds, array $filterLabelIds): void {
 		if ($filterUserIds === [] && $filterLabelIds === []) {
 			return;
 		}
 		try {
 			$options = $this->deckService->findFilterOptions($workflow->getBoardId());
 		} catch (DeckUnavailableException $e) {
 			// Same rule as everywhere else: no answer is not a bad answer.
 			$this->logger->debug('Could not check the filters of workflow {id}: ' . $e->getMessage(), [
 				'app' => 'workflow_deck_automation',
 				'id' => $workflow->getId(),
 			]);
 			return;
 		}
 		$dead = self::findDeadFilters($filterUserIds, $filterLabelIds, $options['participantUids'], $options['labelIds']);
 		if ($dead !== []) {
 			$this->logger->warning(
 				'Workflow {id} can no longer match any card: none of its ' . implode('/', $dead)
 				. ' filter entries exists on board {board} any more',
 				[
 					'app' => 'workflow_deck_automation',
 					'id' => $workflow->getId(),
 					'board' => $workflow->getBoardId(),
 				],
 			);
 		}
 	}
 	/**
 	 * Whether the card date a workflow watches - its due date or its start date,
 	 * see Workflow::DATE_FIELD_* - lies in the past. A card without that date set
 	 * is never picked up.
 	 *
 	 * Compares the card's actual timestamp against $now instead of Deck's own
 	 * Card::getDaysUntilDue(), which truncates both sides to midnight before diffing
 	 * (DateInterval's %a is a whole-day count) and therefore reports 0 - not overdue -
 	 * for any card whose due time has already passed today. That silently held back
 	 * every card for up to 24h after it actually fell due; comparing the raw datetime
 	 * instead matches what Deck's own UI shows (e.g. "vor 2 Stunden") and has no
-	 * day-rounding step to get wrong. The same reasoning applies unchanged to the
+	 * day-rounding step to get wrong.
-	 * start date, which is why this is one function and not two.
+	 *
 	 * Both sides are compared as absolute instants, and the due date is first
 	 * pinned to UTC via asStoredUtc() — see there for why.
 	 */
-	public static function hasPassed(?DateTimeInterface $cardDate, DateTimeInterface $now): bool {
+	public static function isOverdue(?DateTimeInterface $duedate, DateTimeInterface $now): bool {
-		return $cardDate !== null && $cardDate < $now;
+		return $duedate !== null && self::asStoredUtc($duedate) < $now;
 	}
 	/**
-	 * Which filters cannot match anything any more, because not one of their
+	 * Deck's `duedate` is a DATETIME column without a zone that holds UTC
-	 * entries is still offered by the board. An empty filter is not dead, it
+	 * wall-clock time: Deck's frontend sends `toISOString()`, and the value is
-	 * is "no restriction on this dimension" — the same reading as in
+	 * written as plain `Y-m-d H:i:s`. Entity hydrates it with
-	 * cardMatchesFilters(), and getting it backwards would report every
+	 * `new \DateTime($string)`, i.e. in PHP's *default* timezone — correct only
-	 * unfiltered workflow as broken.
+	 * because Nextcloud sets that default to UTC during bootstrap. Reading the
 	 * wall clock and pinning it to UTC explicitly makes the comparison
 	 * independent of that default, so a server or CLI running with a local
 	 * default zone cannot shift every due date by its UTC offset.
 	 *
-	 * Static and side-effect free for the same reason as the matching logic:
+	 * Deck itself has two timezone-sensitive paths this deliberately avoids:
-	 * testable without a Deck installation.
+	 * Card::getDaysUntilDue() (day-truncated, see isOverdue()) and
-	 *
+	 * CardMapper::findOverdue(), which compares the UTC column against the
-	 * @param string[] $filterUserIds
+	 * database's `NOW()` — the DB session's local time.
 	 * @param int[] $filterLabelIds
 	 * @param string[] $boardUserIds everyone who can hold a card on the board
 	 * @param int[] $boardLabelIds the board's remaining labels
 	 * @return string[] any of 'label', 'user', in that order
 	 */
-	public static function findDeadFilters(
+	private static function asStoredUtc(DateTimeInterface $duedate): DateTimeImmutable {
-		array $filterUserIds,
+		return new DateTimeImmutable($duedate->format('Y-m-d H:i:s.u'), new DateTimeZone('UTC'));
 		array $filterLabelIds,
 		array $boardUserIds,
 		array $boardLabelIds,
 	): array {
 		$dead = [];
 		if ($filterLabelIds !== [] && array_intersect($filterLabelIds, $boardLabelIds) === []) {
 			$dead[] = 'label';
 		}
 		if ($filterUserIds !== [] && array_intersect($filterUserIds, $boardUserIds) === []) {
 			$dead[] = 'user';
 		}
 		return $dead;
 	}
 	/**
 	 * Pure filter-matching logic (kept static/side-effect free so it can
 	 * be unit tested without real Deck objects). Both filters are OR
 	 * inside themselves and AND between each other: an empty filter list
 	 * means "no restriction on this dimension".
 	 *
 	 * @param string[] $cardAssignedUserIds
 	 * @param int[] $cardLabelIds
 	 * @param string[] $filterUserIds
 	 * @param int[] $filterLabelIds
 	 */
 	public static function cardMatchesFilters(
 		array $cardAssignedUserIds,
 		array $cardLabelIds,
 		array $filterUserIds,
 		array $filterLabelIds,
 	): bool {
 		if ($filterUserIds !== [] && array_intersect($filterUserIds, $cardAssignedUserIds) === []) {
 			return false;
 		}
 		if ($filterLabelIds !== [] && array_intersect($filterLabelIds, $cardLabelIds) === []) {
 			return false;
 		}
 		return true;
 	}
 	/**
@@ -5,13 +5,11 @@ declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Settings;
 use OCA\WorkflowDeckAutomation\AppInfo\Application;
 use OCP\IL10N;
 use OCP\IURLGenerator;
 use OCP\Settings\IIconSection;
 class PersonalSection implements IIconSection {
 	public function __construct(
 		private IL10N $l10n,
 		private IURLGenerator $urlGenerator,
 	) {
 	}
@@ -21,7 +19,8 @@ class PersonalSection implements IIconSection {
 	}
 	public function getName(): string {
-		return $this->l10n->t('Deck workflow automation');
+		// German only, like the rest of this internal app.
 		return 'Deck Workflow-Automatisierung';
 	}
 	public function getPriority(): int {
@@ -1,6 +1,6 @@
 {
 	"name": "workflow_deck_automation",
-	"version": "34.1.0",
+	"version": "35.2.2",
 	"private": true,
 	"type": "module",
 	"description": "Automates moving overdue Deck cards between stacks, configurable per user.",
@@ -1,7 +1,7 @@
 <template>
 	<NcSettingsSection
 		name="Deck Workflow-Automatisierung"
-		description="Verschiebt Karten automatisch aus einem Deck-Stapel in einen anderen, sobald ihr Fälligkeits- oder Startdatum erreicht ist. Ein Hintergrundjob prüft die Regeln alle paar Minuten.">
+		description="Verschiebt überfällige Karten aus einem Deck-Stapel automatisch in einen anderen Stapel. Ein Hintergrundjob prüft die Regeln alle paar Minuten.">
 		<NcNoteCard v-if="loadError" type="error">
 			{{ loadError }}
 		</NcNoteCard>
@@ -14,18 +14,18 @@
 			<table v-if="workflows.length" class="wfda-table">
 				<thead>
 					<tr>
 						<th>Board</th>
 						<th>Titel</th>
 						<th>Von Stapel</th>
 						<th>Nach Stapel</th>
 						<th>Auslöser</th>
 						<th>Filter</th>
 						<th>E-Mail</th>
 						<th>Aktiv</th>
 						<th />
 					</tr>
 				</thead>
 				<tbody>
-					<tr v-for="workflow in workflows" :key="workflow.id">
+					<tr v-for="workflow in sortedWorkflows" :key="workflow.id">
 						<td>{{ boardLabel(workflow.boardId) }}</td>
 						<td>
 							{{ workflow.title }}
 							<span v-if="workflowIssues[workflow.id]" class="wfda-issue">
@@ -34,17 +34,8 @@
 						</td>
 						<td>{{ stackLabel(workflow.boardId, workflow.sourceStackId) }}</td>
 						<td>{{ stackLabel(workflow.boardId, workflow.targetStackId) }}</td>
-						<td>{{ dateFieldLabel(workflow.dateField) }}</td>
+						<td>{{ notifyLabel(workflow.notifyMode) }}</td>
-						<td>
+						<td>{{ yesNo(workflow.enabled) }}</td>
 							<span v-if="!workflow.filterUserIds.length && !workflow.filterLabelIds.length">–</span>
 							<span v-else>
 								<span v-if="workflow.filterUserIds.length">{{ workflow.filterUserIds.length }} Benutzer</span>
 								<span v-if="workflow.filterUserIds.length && workflow.filterLabelIds.length">, </span>
 								<span v-if="workflow.filterLabelIds.length">{{ workflow.filterLabelIds.length }} Label</span>
 							</span>
 						</td>
 						<td>{{ workflow.notifyEmail ? 'Ja' : 'Nein' }}</td>
 						<td>{{ workflow.enabled ? 'Ja' : 'Nein' }}</td>
 						<td class="wfda-actions">
 							<NcButton variant="tertiary" @click="editWorkflow(workflow)">
 								Bearbeiten
@@ -77,6 +68,9 @@
 					:reduce="option => option.value"
 					placeholder="Board wählen"
 					@update:model-value="onBoardChange" />
 				<NcNoteCard v-if="!boardOptions.length" type="info">
 					Workflows können nur für Boards angelegt werden, deren Eigentümer du bist.
 				</NcNoteCard>
 				<NcSelect
 					v-model="form.sourceStackId"
@@ -94,56 +88,25 @@
 					:disabled="!form.boardId"
 					placeholder="Ziel-Stapel wählen" />
-				<fieldset class="wfda-fieldset">
+				<fieldset class="wfda-notify">
-					<legend>Auslösendes Datum</legend>
+					<legend>E-Mail bei verschobenen Karten</legend>
 					<!--
 						v-model + value + type="radio" + a shared name is the
 						@nextcloud/vue 9 radio API: v-model carries the group's
 						current value, value the one this button stands for. Do
 						not reach for :checked.sync here - Vue 3 dropped .sync,
 						and it would silently never update.
 					-->
 					<NcCheckboxRadioSwitch
-						v-model="form.dateField"
+						v-for="option in notifyOptions"
-						value="due"
+						:key="option.value"
-						name="wfda-date-field"
+						v-model="form.notifyMode"
-						type="radio">
+						type="radio"
-						Fälligkeitsdatum überschritten
+						name="wfda-notify-mode"
 						:value="option.value">
 						{{ option.label }}
 					</NcCheckboxRadioSwitch>
-					<NcCheckboxRadioSwitch
+					<p v-if="form.notifyMode === 'board'" class="wfda-hint">
-						v-model="form.dateField"
+						Jedes Board-Mitglied bekommt die E-Mail entsprechend seiner eigenen
-						value="start"
+						Deck-Einstellung „Benachrichtigungen“ für dieses Board: bei „Alle Karten“ immer,
-						name="wfda-date-field"
+						bei „Zugewiesene Karten“ nur für Karten, denen es zugewiesen ist, bei „Keine“ nie.
-						type="radio">
+						Mehrere Karten eines Laufs werden zu einer E-Mail zusammengefasst.
 						Startdatum erreicht
 					</NcCheckboxRadioSwitch>
 					<p class="wfda-hint">
 						Karten ohne das gewählte Datum werden nie verschoben.
 					</p>
 				</fieldset>
 				<NcSelect
 					v-model="form.filterUserIds"
 					input-label="Nur für zugewiesene Benutzer (optional)"
 					:options="participantOptions"
 					:reduce="option => option.value"
 					:disabled="!form.boardId"
 					multiple
 					placeholder="Alle Benutzer" />
 				<NcSelect
 					v-model="form.filterLabelIds"
 					input-label="Nur mit Label (optional)"
 					:options="labelOptions"
 					:reduce="option => option.value"
 					:disabled="!form.boardId"
 					multiple
 					placeholder="Alle Labels" />
 				<NcCheckboxRadioSwitch v-model="form.notifyEmail">
 					Benachrichtigungs-E-Mail an mich senden
 				</NcCheckboxRadioSwitch>
 				<NcCheckboxRadioSwitch v-model="form.enabled">
 					Workflow aktiv
 				</NcCheckboxRadioSwitch>
@@ -178,8 +141,6 @@ import {
 	createWorkflow,
 	deleteWorkflow,
 	fetchBoards,
 	fetchLabels,
 	fetchParticipants,
 	fetchStacks,
 	fetchWorkflows,
 	updateWorkflow,
@@ -191,8 +152,6 @@ const workflows = ref([])
 const boards = ref([])
 // Per board, and `null` whenever the request failed — see loadStacksFor().
 const stacksByBoard = reactive({})
 const labelsByBoard = reactive({})
 const participantsByBoard = reactive({})
 const showForm = ref(false)
 const saving = ref(false)
@@ -200,12 +159,44 @@ const formError = ref('')
 const editingId = ref(null)
 const stackOptions = ref([])
-const labelOptions = ref([])
+// Which board the list above currently belongs to.
 const participantOptions = ref([])
 // Which board the three lists above currently belong to.
 const loadedBoardId = ref(null)
-const boardOptions = computed(() => boards.value.map((board) => ({ value: board.id, label: board.title })))
+const collator = new Intl.Collator(undefined, { numeric: true, sensitivity: 'base' })
 // The backend only returns boards the user owns. Archived ones are in there
 // so their workflows keep a board name, but are no target for new ones.
 const boardOptions = computed(() => boards.value
 	.filter((board) => !board.archived || board.id === form.boardId)
 	.map((board) => ({ value: board.id, label: board.title }))
 	.sort((a, b) => collator.compare(a.label, b.label)))
 /**
 * Alphabetical by the columns as displayed, left to right: board, title,
 * source stack, target stack, e-mail, active.
 */
 const sortedWorkflows = computed(() => {
 	const sortKeys = (workflow) => [
 		boardLabel(workflow.boardId),
 		workflow.title,
 		stackLabel(workflow.boardId, workflow.sourceStackId),
 		stackLabel(workflow.boardId, workflow.targetStackId),
 		notifyLabel(workflow.notifyMode),
 		yesNo(workflow.enabled),
 	]
 	return workflows.value
 		.map((workflow) => ({ workflow, keys: sortKeys(workflow) }))
 		.sort((a, b) => {
 			for (let i = 0; i < a.keys.length; i++) {
 				const result = collator.compare(a.keys[i], b.keys[i])
 				if (result !== 0) {
 					return result
 				}
 			}
 			return a.workflow.id - b.workflow.id
 		})
 		.map((entry) => entry.workflow)
 })
 // Source and target must differ, so each dropdown hides what the other one
 // already holds — the error message on save stays as the backstop for
@@ -214,15 +205,9 @@ const sourceStackOptions = computed(() => stackOptions.value.filter((option) =>
 const targetStackOptions = computed(() => stackOptions.value.filter((option) => option.value !== form.sourceStackId))
 /**
- * Workflows that stopped working, keyed by id. Two different kinds:
+ * Workflows whose board or stacks were deleted in Deck, keyed by id. The
- *
+ * background job switches these off by itself, but a row that just stopped
- * - Board or stacks deleted in Deck. The background job switches these off
+ * working needs to say so instead of looking healthy.
 *   by itself, but a row that just stopped working needs to say so instead
 *   of looking healthy.
 * - Every entry of a filter deleted from the board. Nothing switches those
 *   off — deliberately, since one deleted label out of three is harmless —
 *   yet a filter that cannot match a single card any more is otherwise
 *   completely invisible: the workflow keeps running and moves nothing.
 */
 const workflowIssues = computed(() => {
 	const issues = {}
@@ -244,39 +229,13 @@ const workflowIssues = computed(() => {
 			}
 			if (missing.length) {
 				issues[workflow.id] = `${missing.join(' und ')} nicht mehr vorhanden`
 				continue
 			}
 		}
 		const dead = []
 		if (isDeadFilter(workflow.filterLabelIds, labelsByBoard[workflow.boardId], 'id')) {
 			dead.push('Label-Filter')
 		}
 		if (isDeadFilter(workflow.filterUserIds, participantsByBoard[workflow.boardId], 'uid')) {
 			dead.push('Benutzer-Filter')
 		}
 		if (dead.length > 1) {
 			issues[workflow.id] = `${dead.join(' und ')} treffen keine Karte mehr`
 		} else if (dead.length) {
 			issues[workflow.id] = `${dead[0]} trifft keine Karte mehr`
 		}
 	}
 	return issues
 })
 /**
 * True only on positive knowledge: the filter has entries, the board's list
 * was actually loaded, and not one entry is still on it. A failed request
 * (null) says nothing and must not turn a healthy row red.
 */
 function isDeadFilter(selected, available, key) {
 	if (!selected.length || !available) {
 		return false
 	}
 	return !selected.some((value) => available.some((entry) => entry[key] === value))
 }
 const form = reactive(emptyForm())
 function emptyForm() {
@@ -285,16 +244,29 @@ function emptyForm() {
 		boardId: null,
 		sourceStackId: null,
 		targetStackId: null,
-		filterUserIds: [],
+		notifyMode: 'off',
 		filterLabelIds: [],
 		dateField: 'due',
 		notifyEmail: false,
 		enabled: true,
 	}
 }
-function dateFieldLabel(dateField) {
+// Values match NotificationPolicy::MODES on the server.
-	return dateField === 'start' ? 'Startdatum' : 'Fälligkeit'
+const notifyOptions = [
 	{ value: 'off', label: 'Keine E-Mail', short: 'Keine' },
 	{ value: 'owner', label: 'Nur an mich', short: 'Nur ich' },
 	{ value: 'board', label: 'An Board-Mitglieder laut ihrer Deck-Einstellung', short: 'Board-Mitglieder' },
 ]
 function notifyLabel(mode) {
 	return notifyOptions.find((option) => option.value === mode)?.short ?? mode
 }
 function boardLabel(boardId) {
 	const board = boards.value.find((entry) => entry.id === boardId)
 	return board ? board.title : `#${boardId}`
 }
 function yesNo(value) {
 	return value ? 'Ja' : 'Nein'
 }
 function stackLabel(boardId, stackId) {
@@ -316,23 +288,6 @@ async function loadStacksFor(boardId) {
 	stacksByBoard[boardId] = await fetchStacks(boardId).catch(() => null)
 }
 /**
 * Labels and participants of a board — needed only to judge whether a stored
 * filter can still match anything, so this is fetched just for the boards of
 * workflows that actually use filters.
 */
 async function loadFiltersFor(boardId) {
 	if (!boardId || labelsByBoard[boardId]) {
 		return
 	}
 	const [labels, participants] = await Promise.all([
 		fetchLabels(boardId).catch(() => null),
 		fetchParticipants(boardId).catch(() => null),
 	])
 	labelsByBoard[boardId] = labels
 	participantsByBoard[boardId] = participants
 }
 async function loadAll() {
 	loading.value = true
 	loadError.value = ''
@@ -340,13 +295,7 @@ async function loadAll() {
 		const [loadedWorkflows, loadedBoards] = await Promise.all([fetchWorkflows(), fetchBoards()])
 		workflows.value = loadedWorkflows
 		boards.value = loadedBoards
-		await Promise.all(loadedWorkflows.flatMap((workflow) => {
+		await Promise.all(loadedWorkflows.map((workflow) => loadStacksFor(workflow.boardId)))
 			const pending = [loadStacksFor(workflow.boardId)]
 			if (workflow.filterLabelIds.length || workflow.filterUserIds.length) {
 				pending.push(loadFiltersFor(workflow.boardId))
 			}
 			return pending
 		}))
 	} catch (e) {
 		loadError.value = 'Konnte Workflows oder Deck-Boards nicht laden. Ist die Deck-App aktiviert?'
 	} finally {
@@ -355,36 +304,25 @@ async function loadAll() {
 }
 /**
- * Fills the stack/label/user dropdowns for a board without touching the
+ * Fills the stack dropdowns for a board without touching the current
- * current selection — that separation matters: editing a workflow has to
+ * selection — that separation matters: editing a workflow has to load the
- * load the same options but must keep the stored stacks and filters.
+ * same options but must keep the stored stacks.
 */
 async function loadBoardOptions(boardId) {
 	stackOptions.value = []
 	labelOptions.value = []
 	participantOptions.value = []
 	loadedBoardId.value = boardId ?? null
 	if (!boardId) {
 		return
 	}
-	// One failing endpoint must not take the other two dropdowns down with it.
+	const stacks = await fetchStacks(boardId).catch(() => null)
 	const [stacks, labels, participants] = await Promise.all([
 		fetchStacks(boardId).catch(() => null),
 		fetchLabels(boardId).catch(() => null),
 		fetchParticipants(boardId).catch(() => null),
 	])
-	// Feed the overview's caches too, so its red markers agree with what the
+	// Feed the overview's cache too, so its red markers agree with what the
 	// form just loaded. `null` propagates on purpose: it means "unknown".
 	stacksByBoard[boardId] = stacks
 	labelsByBoard[boardId] = labels
 	participantsByBoard[boardId] = participants
 	stackOptions.value = (stacks ?? []).map((stack) => ({ value: stack.id, label: stack.title }))
 	labelOptions.value = (labels ?? []).map((label) => ({ value: label.id, label: label.title }))
 	participantOptions.value = (participants ?? []).map((participant) => ({ value: participant.uid, label: participant.displayName }))
 }
 /**
@@ -399,8 +337,6 @@ async function onBoardChange(boardId) {
 	form.sourceStackId = null
 	form.targetStackId = null
 	form.filterUserIds = []
 	form.filterLabelIds = []
 	await loadBoardOptions(boardId)
 }
@@ -419,11 +355,7 @@ async function editWorkflow(workflow) {
 		boardId: workflow.boardId,
 		sourceStackId: workflow.sourceStackId,
 		targetStackId: workflow.targetStackId,
-		filterUserIds: [...workflow.filterUserIds],
+		notifyMode: workflow.notifyMode,
 		filterLabelIds: [...workflow.filterLabelIds],
 		// Workflows stored before this field existed come back without it.
 		dateField: workflow.dateField || 'due',
 		notifyEmail: workflow.notifyEmail,
 		enabled: workflow.enabled,
 	})
 	editingId.value = workflow.id
@@ -531,23 +463,13 @@ onMounted(loadAll)
 	border-radius: var(--border-radius-large);
 }
-.wfda-form-actions {
+.wfda-notify {
 	display: flex;
 	gap: 8px;
 }
 .wfda-fieldset {
 	display: flex;
 	flex-direction: column;
 	gap: 4px;
 	/* The form already draws its own frame; the browser default would put a
 	   second box around just this group. */
 	border: none;
 	padding: 0;
 	margin: 0;
 }
-.wfda-fieldset legend {
+.wfda-notify legend {
 	font-weight: bold;
 	margin-bottom: 4px;
 }
@@ -557,16 +479,8 @@ onMounted(loadAll)
 	font-size: 0.9em;
 }
-/*
+.wfda-form-actions {
- * NcSelect positions the clear/open icons (.vs__actions) absolutely relative
+	display: flex;
- * to the outer .v-select wrapper, while the dropdown menu itself opens
+	gap: 8px;
 * relative to .vs__dropdown-toggle (its $refs.toggle) — normally the same
 * box, but any width mismatch between the two (e.g. from global Nextcloud
 * input styles bleeding into the scoped component) shifts the icons off the
 * visible border of single-value selects like Board/Quell-/Ziel-Stapel.
 * Anchoring both to .vs__dropdown-toggle keeps them in sync.
 */
 :deep(.v-select.select:not(.vs--multiple) .vs__dropdown-toggle) {
 	position: relative;
 }
 </style>
@@ -33,13 +33,3 @@ export async function fetchStacks(boardId) {
 	const { data } = await axios.get(ocsUrl(`/boards/${boardId}/stacks`))
 	return data.ocs.data
 }
 export async function fetchLabels(boardId) {
 	const { data } = await axios.get(ocsUrl(`/boards/${boardId}/labels`))
 	return data.ocs.data
 }
 export async function fetchParticipants(boardId) {
 	const { data } = await axios.get(ocsUrl(`/boards/${boardId}/participants`))
 	return data.ocs.data
 }
@@ -1,43 +0,0 @@
 <?php
 declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Tests\Unit\Db;
 use OCA\WorkflowDeckAutomation\Db\Workflow;
 use PHPUnit\Framework\TestCase;
 class WorkflowTest extends TestCase {
 	public function testDateFieldDefaultsToDueWhenUnset(): void {
 		// The column default covers rows written before date_field existed,
 		// but an entity built in PHP has never been near the database.
 		$this->assertSame(Workflow::DATE_FIELD_DUE, (new Workflow())->getDateFieldOrDue());
 	}
 	public function testDateFieldIsKeptWhenKnown(): void {
 		$workflow = new Workflow();
 		$workflow->setDateField(Workflow::DATE_FIELD_START);
 		$this->assertSame(Workflow::DATE_FIELD_START, $workflow->getDateFieldOrDue());
 		$workflow->setDateField(Workflow::DATE_FIELD_DUE);
 		$this->assertSame(Workflow::DATE_FIELD_DUE, $workflow->getDateFieldOrDue());
 	}
 	public function testUnknownDateFieldFallsBackToDue(): void {
 		// A hand-edited row must not silently switch a workflow to a trigger
 		// nobody configured; the due date is what every workflow meant before
 		// this choice existed.
 		$workflow = new Workflow();
 		$workflow->setDateField('whenever');
 		$this->assertSame(Workflow::DATE_FIELD_DUE, $workflow->getDateFieldOrDue());
 	}
 	public function testDateFieldIsSerialisedForTheSettingsUi(): void {
 		$workflow = new Workflow();
 		$workflow->setDateField(Workflow::DATE_FIELD_START);
 		$this->assertSame(Workflow::DATE_FIELD_START, $workflow->jsonSerialize()['dateField']);
 	}
 }
@@ -0,0 +1,56 @@
 <?php
 declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Tests\Unit\Service;
 use OCA\WorkflowDeckAutomation\Service\NotificationPolicy;
 use PHPUnit\Framework\TestCase;
 class NotificationPolicyTest extends TestCase {
 	public function testOffNeverNotifies(): void {
 		$this->assertFalse(NotificationPolicy::shouldNotify('off', false, true));
 		// Not even the owner of an unshared board — "off" is "off" in Deck too.
 		$this->assertFalse(NotificationPolicy::shouldNotify('off', true, true));
 	}
 	public function testAllAlwaysNotifies(): void {
 		$this->assertTrue(NotificationPolicy::shouldNotify('all', false, false));
 		$this->assertTrue(NotificationPolicy::shouldNotify('all', true, false));
 	}
 	public function testAssignedNotifiesOnlyAssignedUsers(): void {
 		$this->assertTrue(NotificationPolicy::shouldNotify('assigned', false, true));
 		$this->assertFalse(NotificationPolicy::shouldNotify('assigned', false, false));
 	}
 	public function testOwnerOfUnsharedBoardIsNotifiedWithAssigned(): void {
 		$this->assertTrue(NotificationPolicy::shouldNotify('assigned', true, false));
 	}
 	public function testUnknownSettingFallsBackToDeckDefault(): void {
 		$this->assertTrue(NotificationPolicy::shouldNotify('', false, true));
 		$this->assertFalse(NotificationPolicy::shouldNotify('bogus', false, false));
 		$this->assertTrue(NotificationPolicy::shouldNotify('bogus', true, false));
 	}
 	public function testAssignmentIsOnlyLookedUpWhenItMatters(): void {
 		$lookup = function (): bool {
 			$this->fail('assignment lookup must not run');
 		};
 		$this->assertFalse(NotificationPolicy::shouldNotify('off', false, $lookup));
 		$this->assertTrue(NotificationPolicy::shouldNotify('all', false, $lookup));
 		$this->assertTrue(NotificationPolicy::shouldNotify('assigned', true, $lookup));
 		$this->assertTrue(NotificationPolicy::shouldNotify('assigned', false, static fn (): bool => true));
 		$this->assertFalse(NotificationPolicy::shouldNotify('assigned', false, static fn (): bool => false));
 	}
 	public function testModes(): void {
 		foreach (['off', 'owner', 'board'] as $mode) {
 			$this->assertTrue(NotificationPolicy::isValidMode($mode));
 		}
 		$this->assertFalse(NotificationPolicy::isValidMode(''));
 		$this->assertFalse(NotificationPolicy::isValidMode('all'));
 	}
 }
@@ -1,83 +0,0 @@
 <?php
 declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Tests\Unit\Service;
 use DateTimeImmutable;
 use OCA\WorkflowDeckAutomation\Service\WorkflowRunner;
 use PHPUnit\Framework\TestCase;
 class WorkflowRunnerFilterTest extends TestCase {
 	public function testHasPassedReturnsFalseWithoutADate(): void {
 		$this->assertFalse(WorkflowRunner::hasPassed(null, new DateTimeImmutable('2026-01-15 12:00:00')));
 	}
 	public function testHasPassedReturnsFalseForAFutureDate(): void {
 		$now = new DateTimeImmutable('2026-01-15 12:00:00');
 		$this->assertFalse(WorkflowRunner::hasPassed($now->modify('+1 hour'), $now));
 		$this->assertFalse(WorkflowRunner::hasPassed($now->modify('+3 days'), $now));
 	}
 	public function testHasPassedReturnsTrueForAPastDate(): void {
 		$now = new DateTimeImmutable('2026-01-15 12:00:00');
 		$this->assertTrue(WorkflowRunner::hasPassed($now->modify('-1 hour'), $now));
 		$this->assertTrue(WorkflowRunner::hasPassed($now->modify('-30 days'), $now));
 	}
 	public function testHasPassedReturnsTrueForATimeEarlierTheSameDay(): void {
 		// Regression: comparing whole calendar days (as Deck's own
 		// Card::getDaysUntilDue() does) reports a card due earlier today as
 		// "0 days until due", not overdue, until the calendar date rolls
 		// over - holding every card back for up to 24h after it actually
 		// fell due. hasPassed() must compare the real timestamps instead.
 		$now = new DateTimeImmutable('2026-01-15 12:00:00');
 		$this->assertTrue(WorkflowRunner::hasPassed(new DateTimeImmutable('2026-01-15 06:00:00'), $now));
 	}
 	public function testNoFiltersMatchesAnyCard(): void {
 		$this->assertTrue(WorkflowRunner::cardMatchesFilters(['alice'], [1, 2], [], []));
 		$this->assertTrue(WorkflowRunner::cardMatchesFilters([], [], [], []));
 	}
 	public function testUserFilterIsOrAgainstAssignedUsers(): void {
 		$this->assertTrue(WorkflowRunner::cardMatchesFilters(['alice', 'bob'], [], ['bob', 'carol'], []));
 		$this->assertFalse(WorkflowRunner::cardMatchesFilters(['alice'], [], ['bob', 'carol'], []));
 	}
 	public function testLabelFilterIsOrAgainstCardLabels(): void {
 		$this->assertTrue(WorkflowRunner::cardMatchesFilters([], [1, 2], [], [2, 3]));
 		$this->assertFalse(WorkflowRunner::cardMatchesFilters([], [1], [], [2, 3]));
 	}
 	public function testUserAndLabelFiltersAreCombinedWithAnd(): void {
 		// user matches, label does not -> overall false
 		$this->assertFalse(WorkflowRunner::cardMatchesFilters(['alice'], [1], ['alice'], [99]));
 		// both match -> true
 		$this->assertTrue(WorkflowRunner::cardMatchesFilters(['alice'], [1], ['alice'], [1]));
 	}
 	public function testEmptyFiltersAreNeverDead(): void {
 		// "no restriction" must not be reported as a broken filter, however
 		// little the board has left to offer.
 		$this->assertSame([], WorkflowRunner::findDeadFilters([], [], [], []));
 		$this->assertSame([], WorkflowRunner::findDeadFilters([], [], ['alice'], [1]));
 	}
 	public function testFilterSurvivesAsLongAsOneEntryRemains(): void {
 		$this->assertSame([], WorkflowRunner::findDeadFilters(['alice', 'bob'], [1, 2], ['bob'], [2]));
 	}
 	public function testFilterIsDeadWhenEveryEntryIsGone(): void {
 		$this->assertSame(['label'], WorkflowRunner::findDeadFilters([], [1, 2], [], [3]));
 		$this->assertSame(['user'], WorkflowRunner::findDeadFilters(['alice'], [], ['bob'], []));
 		$this->assertSame(
 			['label', 'user'],
 			WorkflowRunner::findDeadFilters(['alice'], [1], ['bob'], [2]),
 		);
 	}
 	public function testAnEmptyBoardKillsOnlyTheFiltersThatAreSet(): void {
 		$this->assertSame(['label'], WorkflowRunner::findDeadFilters([], [1], [], []));
 	}
 }
@@ -0,0 +1,67 @@
 <?php
 declare(strict_types=1);
 namespace OCA\WorkflowDeckAutomation\Tests\Unit\Service;
 use DateTimeImmutable;
 use DateTimeZone;
 use OCA\WorkflowDeckAutomation\Service\WorkflowRunner;
 use PHPUnit\Framework\TestCase;
 class WorkflowRunnerTest extends TestCase {
 	private static function utc(string $time): DateTimeImmutable {
 		return new DateTimeImmutable($time, new DateTimeZone('UTC'));
 	}
 	public function testIsOverdueReturnsFalseWithoutDueDate(): void {
 		$this->assertFalse(WorkflowRunner::isOverdue(null, self::utc('2026-01-15 12:00:00')));
 	}
 	public function testIsOverdueReturnsFalseForFutureDueDate(): void {
 		$now = self::utc('2026-01-15 12:00:00');
 		$this->assertFalse(WorkflowRunner::isOverdue($now->modify('+1 hour'), $now));
 		$this->assertFalse(WorkflowRunner::isOverdue($now->modify('+3 days'), $now));
 	}
 	public function testIsOverdueReturnsTrueForPastDueDate(): void {
 		$now = self::utc('2026-01-15 12:00:00');
 		$this->assertTrue(WorkflowRunner::isOverdue($now->modify('-1 hour'), $now));
 		$this->assertTrue(WorkflowRunner::isOverdue($now->modify('-30 days'), $now));
 	}
 	public function testIsOverdueReturnsTrueForADueTimeEarlierTheSameDay(): void {
 		// Regression: comparing whole calendar days (as Deck's own
 		// Card::getDaysUntilDue() does) reports a card due earlier today as
 		// "0 days until due", not overdue, until the calendar date rolls
 		// over - holding every card back for up to 24h after it actually
 		// fell due. isOverdue() must compare the real timestamps instead.
 		$now = self::utc('2026-01-15 12:00:00');
 		$this->assertTrue(WorkflowRunner::isOverdue(self::utc('2026-01-15 06:00:00'), $now));
 	}
 	public function testIsOverdueReadsTheStoredWallClockAsUtc(): void {
 		// What Entity hydration produces if PHP's default zone is not UTC:
 		// the stored UTC wall clock "12:00", tagged with the local zone.
 		$due = new DateTimeImmutable('2026-07-15 12:00:00', new DateTimeZone('Europe/Berlin'));
 		// Taken at face value that would be 10:00 UTC and already overdue.
 		$this->assertFalse(WorkflowRunner::isOverdue($due, self::utc('2026-07-15 11:30:00')));
 		$this->assertTrue(WorkflowRunner::isOverdue($due, self::utc('2026-07-15 12:00:01')));
 	}
 	public function testIsOverdueComparesNowAsAnAbsoluteInstant(): void {
 		$due = self::utc('2026-07-15 12:00:00');
 		$berlin = new DateTimeZone('Europe/Berlin');
 		// 13:30 in Berlin (CEST) is 11:30 UTC - not yet due.
 		$this->assertFalse(WorkflowRunner::isOverdue($due, new DateTimeImmutable('2026-07-15 13:30:00', $berlin)));
 		// 14:30 in Berlin is 12:30 UTC - due.
 		$this->assertTrue(WorkflowRunner::isOverdue($due, new DateTimeImmutable('2026-07-15 14:30:00', $berlin)));
 	}
 	public function testIsOverdueIsFalseAtTheExactDueInstant(): void {
 		$now = self::utc('2026-01-15 12:00:00');
 		$this->assertFalse(WorkflowRunner::isOverdue($now, $now));
 	}
 }
Author	SHA1	Message	Date
Patrick Niebeling	ebf48b0707	Link the card title instead of an extra button in the mail Build package / xml-lint (push) Successful in 1m14s Details Build package / php-lint (8.4) (push) Successful in 2m14s Details Build package / php-lint (8.5) (push) Successful in 2m15s Details Build package / unit-tests (push) Successful in 2m17s Details Build package / package (push) Successful in 59s Details The plain-text part gets the card URL on its own line. Bumps to 35.2.2.	2026-09-30 11:05:22 +02:00
Patrick Niebeling	30e644a001	Condense each moved card to one sentence in the mail Build package / xml-lint (push) Successful in 1m36s Details Build package / php-lint (8.5) (push) Successful in 3m20s Details Build package / php-lint (8.4) (push) Successful in 3m26s Details Build package / unit-tests (push) Successful in 3m28s Details Build package / package (push) Canceled after 21s Details Drops the workflow name; the mail only says which card moved where. Bumps to 35.2.1.	2026-09-30 11:02:04 +02:00
Patrick Niebeling	860e8b7bbb	Leave the card description out of the moved-cards mail Build package / xml-lint (push) Successful in 30s Details Build package / unit-tests (push) Successful in 1m14s Details Build package / php-lint (8.4) (push) Successful in 55s Details Build package / php-lint (8.5) (push) Successful in 56s Details Build package / package (push) Successful in 1m17s Details	2026-09-30 10:41:20 +02:00
Patrick Niebeling	1ffc0765ea	Switch the app to German as its only language The app is used internally only and its settings page was German already. Mails, controller error messages (shown in the form), the settings section name and the mail sender are now written in German directly instead of going through IL10N without any translation files. Nextcloud's own mail footer is requested in German as well.	2026-09-30 10:39:12 +02:00
Patrick Niebeling	578b235f08	Notify board members about moved cards according to their Deck setting Build package / unit-tests (push) Failing after 20s Details Build package / xml-lint (push) Successful in 46s Details Build package / php-lint (8.4) (push) Successful in 1m30s Details Build package / php-lint (8.5) (push) Successful in 1m36s Details Build package / package (push) Skipped Details Replaces the yes/no notify_email flag with notify_mode: - off: no mail - owner: only the board owner, as before (migrated from notify_email=1) - board: everyone with access to the board, filtered by their own Deck "Notifications" setting for it (board:<id>:notify-due: off / assigned / all), mirroring Deck's NotificationHelper rules Recipients are resolved via PermissionService::findUsers() (owner, ACL, groups and circles expanded), AssignmentMapper::isUserAssigned() and IConfig, none of which reads Deck's frozen $userId. If they cannot be resolved, no mail is sent rather than one to the wrong people. Moved cards are collected over the whole run and each recipient gets a single digest mail afterwards, in their own language. Bumps to 35.2.0 so the migrations run.	2026-09-30 10:31:45 +02:00
Patrick Niebeling	27717205cd	Read Deck due dates as UTC regardless of PHP's default timezone Deck stores duedate as a zoneless DATETIME holding UTC wall-clock time, and Entity hydrates it in PHP's default zone. That is only correct because Nextcloud forces the default to UTC; pin the wall clock to UTC explicitly so the overdue check compares real instants either way.	2026-09-30 10:27:13 +02:00
Patrick Niebeling	ed684cca4f	Translate CLAUDE.md to German and condense it Drops history and duplicated explanations, fixes the stale branch description (nextcloud-35 was merged into main; the 34.x line only survives as tags) and the miscounted frontend gotchas.	2026-09-30 10:22:52 +02:00
Patrick Niebeling	0904292c73	Remove the assigned-user and label filters Build package / php-lint (8.4) (push) Successful in 1m33s Details Build package / php-lint (8.5) (push) Successful in 49s Details Build package / xml-lint (push) Successful in 13s Details Build package / unit-tests (push) Successful in 38s Details Build package / package (push) Successful in 1m44s Details Workflows now move every overdue card of their source stack. A new migration drops filter_user_ids and filter_label_ids; workflows that had a filter keep running unfiltered. The version goes to 35.1.0 so the migration runs on update. Removed along with the filters: the labels and participants endpoints and their Deck lookups, the dead-filter warnings and markers, and CardService::enrichCards() in the card read. enrichCards() only added labels, assignees and comment counts, and ran a permission check against Deck's frozen uid.	2026-09-30 09:55:54 +02:00
Patrick Niebeling	e84123654e	Tie workflows to the board owner instead of their creator Build package / php-lint (8.4) (push) Successful in 2m22s Details Build package / php-lint (8.5) (push) Successful in 57s Details Build package / xml-lint (push) Successful in 18s Details Build package / unit-tests (push) Successful in 1m5s Details Build package / package (push) Successful in 1m21s Details A workflow now belongs to whoever owns its board. The settings page lists, edits and deletes workflows by board ownership alone, using Deck's BoardMapper::findAllByOwner(), a single owner query that never returns shared boards and carries no frozen uid. A transferred board's workflows therefore show up for the new owner immediately. The background job still needs one user to run as and mail, so it looks up the board owner before every run and stores it in user_id when it changed. Archived boards stay listed so their workflows keep a name, but are no longer offered or accepted as a target.	2026-09-30 09:38:11 +02:00
Patrick Niebeling	ada16cb101	Only allow workflows on owned boards, and show the board in the table Build package / php-lint (8.4) (push) Successful in 1m7s Details Build package / php-lint (8.5) (push) Successful in 56s Details Build package / xml-lint (push) Successful in 17s Details Build package / unit-tests (push) Successful in 42s Details Build package / package (push) Successful in 1m4s Details The board list now only contains boards the current user owns, which also makes the controller's board validation enforce the owner rule. The workflow table gains a Board column (Board, Titel, Von Stapel, Nach Stapel, Filter, E-Mail, Aktiv) and is sorted alphabetically by those columns in that order.	2026-09-30 09:16:09 +02:00
gnilebein	7c7c52cb1c	Merge pull request 'Start a permanent Nextcloud 35 version line at 35.0.0' (#1 ) from nextcloud-35 into main Build package / php-lint (8.4) (push) Successful in 45s Details Build package / php-lint (8.5) (push) Successful in 41s Details Build package / xml-lint (push) Successful in 15s Details Build package / unit-tests (push) Successful in 41s Details Build package / package (push) Successful in 58s Details Reviewed-on: #1	2026-09-22 07:37:47 +02:00
Patrick Niebeling	dfec88d396	Start a permanent Nextcloud 35 version line at 35.0.0 Build package / php-lint (8.4) (push) Successful in 52s Details Build package / php-lint (8.5) (push) Successful in 49s Details Build package / xml-lint (push) Successful in 15s Details Build package / unit-tests (push) Successful in 45s Details Build package / php-lint (8.4) (pull_request) Successful in 47s Details Build package / php-lint (8.5) (pull_request) Successful in 45s Details Build package / xml-lint (pull_request) Successful in 13s Details Build package / unit-tests (pull_request) Successful in 49s Details Build package / package (push) Successful in 57s Details Build package / package (pull_request) Successful in 49s Details Nextcloud Hub Summer 26 (server 35.x) is declared as the sole supported major on this branch, per the existing versioning scheme (leading version number tracks the declared NC major). main keeps tracking Nextcloud 34 (Hub 26 Spring) at the 34.x.x line; the two are maintained in parallel rather than one replacing the other.	2026-09-22 07:36:15 +02:00
gnilebein	28b4edc811	revert `0e66319a06` Build package / php-lint (8.4) (push) Successful in 43s Details Build package / php-lint (8.5) (push) Successful in 40s Details Build package / xml-lint (push) Successful in 12s Details Build package / unit-tests (push) Successful in 38s Details Build package / package (push) Successful in 52s Details revert Let each workflow watch the due date or the start date Deck 1.18 added a start date to cards (Card::$startdate), so a workflow no longer has to mean "overdue". Each rule now carries a date_field ('due' \| 'start'), chosen in the settings form next to board and stacks. Existing rules keep the due date: the new column's default supplies it for every stored row, so there is no backfill step, and Workflow::getDateFieldOrDue() covers entities that were never near the database as well as hand-edited values. The controller is the one place that rejects an unknown value instead of normalising it - a client asking for a rule it would not get should hear about it. The probe for the field is property_exists(), not method_exists(): Deck's entities declare no getter as real code - getStartdate(), getDuedate(), even getId() all go through Entity::__call(), which method_exists() ignores by definition. A method_exists() guard would have been false on every Deck version and would have turned every start-date rule into a silent no-op. assertDeckAvailable() now also refuses Deck older than 1.18.0. That floor cannot live in appinfo/info.xml - neither the server's nor the app store's schema has an app-to-app dependency element - but <nextcloud min-version="34"> already implies it, since 1.18.x is the only Deck release line published for Nextcloud 34. isOverdue() becomes hasPassed(): one function for both dates, since the comparison and the argument against Deck's day-truncating getDaysUntilDue() are identical for either. Also carries a pending NcSelect icon-alignment fix that was already in the working tree. Bump to 34.1.0.	2026-08-26 07:10:55 +02:00