Fix code-review findings across domain, persistence, server and frontend

Full-codebase review turned up five real correctness/security bugs and
a dozen smaller inconsistencies; all are fixed here with matching test
coverage:

- BMK uniqueness silently allowed German-umlaut duplicates ("Ä1" vs
  "ä1") because the DB's normalized index only folds ASCII case. Added
  a shared Unicode-aware pre-check used by every circuit/component
  insert and rename path (one of which had no pre-check at all).
- CircuitDeviceRow.simultaneityFactor had no upper bound at the row
  level (command model and snapshot/restore schema), unlike every
  sibling entity, letting a bad value silently corrupt power totals.
- Grid cell editing silently misread German thousands-separator input
  ("1.500" parsed as 1.5); "." is now rejected outright with a clear
  message instead of guessing.
- The editor's shared command runner (runCommand/applyHistory) had no
  re-entrancy guard, so a double click/drop could fire the same
  command twice and race a BMK collision or revision conflict. Added a
  synchronous ref guard plus isSaving on the buttons that lacked it.
- GET .../next-identifier leaked circuit-numbering state for sections
  in other projects (no ownership check, 400 instead of 404). Moved
  under /projects/:projectId and scoped it.

Also: added the missing circuits.section_id / circuit_device_rows.
circuit_id indexes (migration 0006), gave FormModal a focus trap /
Escape-to-close / focus restore and rebuilt ProjectSettingsModal on
top of it instead of duplicated markup, removed dead code (3 orphaned
domain model files, an unused persistence helper, a wrapper only used
by its own test), pointed the project page at GET /projects/:id
instead of listing+filtering client-side, closed the gap between the
documented 18 MB CSV limit and the ~17.17 MiB actually enforced, added
missing upper bounds on several free-text fields, filled in nine
missing German labels in the revision timeline, replaced a
key-order-fragile JSON.stringify equality check with a real field
comparison, made an implicit sort-order assumption in three
renumbering helpers explicit, cleared the sidebar's target selection
when it no longer resolves after a tree reload, and fixed
updateGlobalDevice to check-then-write instead of write-then-check.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/db/repositories/circuit-device-row.persistence.ts

@@ -43,12 +43,6 @@ export interface CircuitDeviceRowPatchInput {
   overriddenFields?: string | null;
 }
 
-export interface CircuitDeviceRowCreateInput extends CircuitDeviceRowUpdateInput {
-  circuitId: string;
-  linkedProjectDeviceId?: string;
-  sortOrder: number;
-}
-
 export function toCircuitDeviceRowUpdateValues(input: CircuitDeviceRowUpdateInput) {
   return {
     linkedProjectDeviceId: input.linkedProjectDeviceId ?? null,
@@ -105,15 +99,3 @@ export function toCircuitDeviceRowPatchValues(input: CircuitDeviceRowPatchInput)
 
   return values;
 }
-
-export function toCircuitDeviceRowCreateValues(
-  id: string,
-  input: CircuitDeviceRowCreateInput
-) {
-  return {
-    id,
-    circuitId: input.circuitId,
-    sortOrder: input.sortOrder,
-    ...toCircuitDeviceRowUpdateValues(input),
-  };
-}

src/db/repositories/circuit-project-command.repository.ts

@@ -1,4 +1,4 @@
-import { and, eq, ne } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import {
   assertCircuitUpdateProjectCommand,
   createCircuitUpdateProjectCommand,
@@ -21,6 +21,7 @@ import {
 import { executeProjectCommandTransactionWithAppliedForward } from "./project-command-transaction.persistence.js";
 import { resolveCircuitVoltage } from "./project-voltage.persistence.js";
 import { circuitDeviceRows } from "../schema/circuit-device-rows.js";
+import { assertEquipmentIdentifierAvailable } from "./equipment-identifier-uniqueness.persistence.js";
 
 type CircuitRow = typeof circuits.$inferSelect;
 
@@ -166,20 +167,12 @@ export class CircuitProjectCommandRepository
     ) {
       return;
     }
-    const duplicate = database
-      .select({ id: circuits.id })
-      .from(circuits)
-      .where(
-        and(
-          eq(circuits.circuitListId, circuit.circuitListId),
-          eq(circuits.equipmentIdentifier, equipmentIdentifier),
-          ne(circuits.id, circuit.id)
-        )
-      )
-      .get();
-    if (duplicate) {
-      throw new Error("Duplicate equipmentIdentifier in circuit list.");
-    }
+    assertEquipmentIdentifierAvailable(
+      database,
+      circuit.circuitListId,
+      equipmentIdentifier,
+      circuit.id
+    );
   }
 }
 

src/db/repositories/circuit-structure-project-command.repository.ts

@@ -27,6 +27,7 @@ import {
 } from "./circuit-device-row-structure.persistence.js";
 import { executeProjectCommandTransaction } from "./project-command-transaction.persistence.js";
 import { resolveCircuitVoltage } from "./project-voltage.persistence.js";
+import { assertEquipmentIdentifierAvailable } from "./equipment-identifier-uniqueness.persistence.js";
 
 export class CircuitStructureProjectCommandRepository
   implements CircuitStructureProjectCommandStore
@@ -103,24 +104,11 @@ export class CircuitStructureProjectCommandRepository
     if (existingCircuit) {
       throw new Error("Circuit id already exists.");
     }
-    const duplicateIdentifier = database
-      .select({ id: circuits.id })
-      .from(circuits)
-      .where(
-        and(
-          eq(circuits.circuitListId, snapshot.circuitListId),
-          eq(
-            circuits.equipmentIdentifier,
-            snapshot.equipmentIdentifier
-          )
-        )
-      )
-      .get();
-    if (duplicateIdentifier) {
-      throw new Error(
-        "Duplicate equipmentIdentifier in circuit list."
-      );
-    }
+    assertEquipmentIdentifierAvailable(
+      database,
+      snapshot.circuitListId,
+      snapshot.equipmentIdentifier
+    );
 
     if (snapshot.deviceRows.length > 0) {
       const rowIds = snapshot.deviceRows.map((row) => row.id);

src/db/repositories/distribution-board-component-structure-project-command.repository.ts

@@ -22,6 +22,7 @@ import { circuitSections } from "../schema/circuit-sections.js";
 import { distributionBoardComponentProtectionDevices } from "../schema/distribution-board-component-protection-devices.js";
 import { distributionBoardComponents } from "../schema/distribution-board-components.js";
 import { executeProjectCommandTransaction } from "./project-command-transaction.persistence.js";
+import { assertEquipmentIdentifierAvailable } from "./equipment-identifier-uniqueness.persistence.js";
 
 export class DistributionBoardComponentStructureProjectCommandRepository
   implements DistributionBoardComponentStructureProjectCommandStore
@@ -94,6 +95,11 @@ export class DistributionBoardComponentStructureProjectCommandRepository
     if (existing) {
       throw new Error("Distribution-board component id already exists.");
     }
+    assertEquipmentIdentifierAvailable(
+      database,
+      snapshot.component.circuitListId,
+      snapshot.component.equipmentIdentifier
+    );
     database
       .insert(distributionBoardComponents)
       .values(snapshot.component)
@@ -187,6 +193,17 @@ export class DistributionBoardComponentStructureProjectCommandRepository
         "Distribution-board component changed before update."
       );
     }
+    if (
+      target.component.equipmentIdentifier !==
+      expected.component.equipmentIdentifier
+    ) {
+      assertEquipmentIdentifierAvailable(
+        database,
+        expected.component.circuitListId,
+        target.component.equipmentIdentifier,
+        expected.component.id
+      );
+    }
     database
       .update(distributionBoardComponents)
       .set(target.component)

src/db/repositories/equipment-identifier-uniqueness.persistence.ts

@@ -0,0 +1,41 @@
+import { eq } from "drizzle-orm";
+import type { AppDatabase } from "../database-context.js";
+import { circuitListEquipmentIdentifiers } from "../schema/circuit-list-equipment-identifiers.js";
+
+export function normalizeEquipmentIdentifier(value: string): string {
+  return value.trim().toLowerCase();
+}
+
+/**
+ * The DB-level normalized unique index uses SQLite's built-in lower(),
+ * which only folds ASCII a-z and leaves German characters (Ä/Ö/Ü/ß/…)
+ * untouched, so it alone would let e.g. "Ä1" and "ä1" coexist. This check
+ * normalizes with JS's Unicode-aware toLowerCase() against every
+ * identifier already registered for the circuit list (circuits and
+ * distribution-board components share one BMK namespace via
+ * circuit_list_equipment_identifiers), catching what the DB index cannot.
+ */
+export function assertEquipmentIdentifierAvailable(
+  database: AppDatabase,
+  circuitListId: string,
+  equipmentIdentifier: string,
+  excludeOwnerId?: string
+): void {
+  const candidate = normalizeEquipmentIdentifier(equipmentIdentifier);
+  const existing = database
+    .select({
+      ownerId: circuitListEquipmentIdentifiers.ownerId,
+      equipmentIdentifier: circuitListEquipmentIdentifiers.equipmentIdentifier,
+    })
+    .from(circuitListEquipmentIdentifiers)
+    .where(eq(circuitListEquipmentIdentifiers.circuitListId, circuitListId))
+    .all();
+  const duplicate = existing.some(
+    (row) =>
+      row.ownerId !== excludeOwnerId &&
+      normalizeEquipmentIdentifier(row.equipmentIdentifier) === candidate
+  );
+  if (duplicate) {
+    throw new Error("Duplicate equipmentIdentifier in circuit list.");
+  }
+}

src/db/repositories/external-initial-import-project-command.repository.ts

@@ -212,7 +212,9 @@ function replaceExternalState(
   if (target.roomMappings.length) {
     database.insert(externalRoomMappings).values(target.roomMappings).run();
   }
-  database.insert(externalModelObjects).values(target.objects).run();
+  if (target.objects.length) {
+    database.insert(externalModelObjects).values(target.objects).run();
+  }
 }
 
 function decodeCanonicalBase64(value: string) {

src/db/repositories/external-object-new-circuit-project-command.repository.ts

@@ -32,6 +32,7 @@ import {
   loadExpectedExternalObjectTransitions,
   snapshotsEqual,
 } from "./external-object-assignment.persistence.js";
+import { assertEquipmentIdentifierAvailable } from "./equipment-identifier-uniqueness.persistence.js";
 
 export class ExternalObjectNewCircuitProjectCommandRepository
   implements ExternalObjectNewCircuitProjectCommandStore
@@ -90,12 +91,11 @@ export class ExternalObjectNewCircuitProjectCommandRepository
       .where(eq(circuits.id, circuit.id)).get()) {
       throw new Error("External circuit id already exists.");
     }
-    if (database.select({ id: circuits.id }).from(circuits).where(and(
-      eq(circuits.circuitListId, circuit.circuitListId),
-      eq(circuits.equipmentIdentifier, circuit.equipmentIdentifier)
-    )).get()) {
-      throw new Error("Duplicate equipmentIdentifier in circuit list.");
-    }
+    assertEquipmentIdentifierAvailable(
+      database,
+      circuit.circuitListId,
+      circuit.equipmentIdentifier
+    );
     if (database.select({ id: circuitDeviceRows.id }).from(circuitDeviceRows)
       .where(eq(circuitDeviceRows.id, row.id)).get()) {
       throw new Error("External device-row id already exists.");