docs(14-02): complete RSS ingestion slice plan

.planning/STATE.md

@@ -2,18 +2,18 @@
 gsd_state_version: 1.0
 milestone: v1.1
 milestone_name: Ausschreibungs-Radar
-current_phase: 13
-current_phase_name: scraping-adapters-cross-source-dedup
-status: verifying
-stopped_at: Completed 14-01-PLAN.md
-last_updated: "2026-07-23T11:11:11.104Z"
+current_phase: 14
+current_phase_name: rss-email-alert-ingestion-module-rollout
+status: executing
+stopped_at: Completed 14-02-PLAN.md
+last_updated: "2026-07-23T11:32:49.968Z"
 last_activity: 2026-07-23
-last_activity_desc: Phase 13 execution started
+last_activity_desc: Completed 14-02-PLAN.md (RSS ingestion slice)
 progress:
   total_phases: 14
   completed_phases: 12
   total_plans: 67
-  completed_plans: 62
+  completed_plans: 63
 ---
 
 # Project State
@@ -23,16 +23,16 @@ progress:
 See: .planning/PROJECT.md (updated 2026-07-17)
 
 **Core value:** Eine zentrale Plattform, in der beliebige Workflow-Tools als Module lizenziert, aktiviert und genutzt werden koennen -- ohne zwischen verschiedenen Anwendungen wechseln zu muessen.
-**Current focus:** Phase 13 — scraping-adapters-cross-source-dedup
+**Current focus:** Phase 14 — rss-email-alert-ingestion-module-rollout
 
 ## Current Position
 
-Phase: 13 (scraping-adapters-cross-source-dedup) — EXECUTING
-Plan: 6 of 6
-Status: Phase complete — ready for verification
-Last activity: 2026-07-23 — Phase 13 execution started
+Phase: 14 (rss-email-alert-ingestion-module-rollout) — EXECUTING
+Plan: 3 of 5
+Status: Plan 14-02 complete
+Last activity: 2026-07-23 — Completed 14-02-PLAN.md (RSS ingestion slice)
 
-Progress: [█████████░] 93%
+Progress: [█████████░] 94%
 
 ## Performance Metrics
 
@@ -97,6 +97,7 @@ Progress: [█████████░] 93%
 | Phase 13 P04 | 55min | 3 tasks | 6 files |
 | Phase 13 P05 | 40min | 2 tasks | 4 files |
 | Phase 14 P01 | 13min | 2 tasks | 10 files |
+| Phase 14 P02 | 30min | 3 tasks | 21 files |
 
 ## Accumulated Context
 
@@ -211,6 +212,10 @@ Recent decisions affecting current work:
 - [Phase ?]: 14-01: DKV inbox providers moved verbatim into shared apps/api/src/inbox/ module; dkv.types.ts re-exports InboxConfig/InboxAttachment/InboxEmail so no DKV consumer import changed (D-01)
 - [Phase ?]: 14-01: fetchMessages() added as a sibling method (findBodyParts/getItemBodySoap) on both providers without touching fetchPdfAttachments (D-02); DKV not switched to it
 - [Phase ?]: 14-01: httpntlm loaded via raw require() bypasses vi.mock — tests seed require.cache with a stub before dynamically importing the provider
+- [Phase ?]: 14-02: fast-xml-parser does not decode numeric HTML entities (Ü) — added explicit decodeNumericEntities() in RssAdapter so service.bund.de titles render correctly
+- [Phase ?]: 14-02: TenderRssFeedSource save-time hostname/SSRF guard is a SEPARATE enforcement point from the code-level SourceRegistry denylist (RSS feed URLs are runtime admin input, not covered by the DI-boot-time gate)
+- [Phase ?]: 14-02: TenderSourcePollConfig.pollGranularity ('day'|'tick') added — 'day' sources keep the byte-unchanged lastIngestedDay gate, 'tick' sources (rss) fetch every active scheduler tick (D-15)
+- [Phase ?]: 14-02: seeded service.bund.de active-by-default RSS feed; zero subreport-elvis rows (no single canonical URL, admin adds relevant municipality feeds)
 
 ### Pending Todos
 
@@ -249,7 +254,7 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-07-23T11:11:11.091Z
-Stopped at: Completed 14-01-PLAN.md
+Last session: 2026-07-23T11:32:49.953Z
+Stopped at: Completed 14-02-PLAN.md
 Resume file: None
 Last activity: 2026-07-14 - Built LDAP per-user exclude/denylist filter (9d1323f), migration applied on live DB, verified via Playwright: sync deactivated 4 excluded service accounts (administrator/krbtgt/guest/dns-ldap), 2 real LDAP users stay active, 0 wrongly created