docs(14-04): complete denylist transparency plan

.planning/STATE.md

@@ -5,15 +5,15 @@ milestone_name: Ausschreibungs-Radar
 current_phase: 14
 current_phase_name: rss-email-alert-ingestion-module-rollout
 status: executing
-stopped_at: "Paused mid-plan: 14-03 Tasks 1-3 complete, Task 4 (human-verify, live EWS mailbox) OPEN"
-last_updated: "2026-07-23T11:55:28.843Z"
+stopped_at: Completed 14-04-PLAN.md
+last_updated: "2026-07-23T12:01:07.009Z"
 last_activity: 2026-07-23
 last_activity_desc: Completed 14-02-PLAN.md (RSS ingestion slice)
 progress:
   total_phases: 14
   completed_phases: 12
   total_plans: 67
-  completed_plans: 64
+  completed_plans: 65
 ---
 
 # Project State
@@ -28,11 +28,11 @@ See: .planning/PROJECT.md (updated 2026-07-17)
 ## Current Position
 
 Phase: 14 (rss-email-alert-ingestion-module-rollout) — EXECUTING
-Plan: 3 of 5
+Plan: 4 of 5
 Status: Plan 14-02 complete
 Last activity: 2026-07-23 — Completed 14-02-PLAN.md (RSS ingestion slice)
 
-Progress: [█████████░] 94%
+Progress: [██████████] 97%
 
 ## Performance Metrics
 
@@ -98,6 +98,7 @@ Progress: [█████████░] 94%
 | Phase 13 P05 | 40min | 2 tasks | 4 files |
 | Phase 14 P01 | 13min | 2 tasks | 10 files |
 | Phase 14 P02 | 30min | 3 tasks | 21 files |
+| Phase 14 P04 | 25min | 2 tasks | 6 files |
 
 ## Accumulated Context
 
@@ -218,6 +219,8 @@ Recent decisions affecting current work:
 - [Phase ?]: 14-02: seeded service.bund.de active-by-default RSS feed; zero subreport-elvis rows (no single canonical URL, admin adds relevant municipality feeds)
 - [Phase ?]: 14-03: D-13 read filter fails CLOSED for an unresolved requesting tenant (no auth context) — only global tenders visible, never a private-tenant leak
 - [Phase ?]: 14-03: email-alert TenderSourcePollConfig seeded isActive=false (no safe default mailbox, unlike RSS's service.bund.de) — framework-ready-activation-deferred
+- [Phase ?]: PORTAL_URLS typed as Record<(typeof DENYLISTED_PORTALS)[number], string> so the compiler enforces a URL for every denylisted portal (no re-declared set, no silent gap)
+- [Phase ?]: CoverageBanner's denylist block is independent of the onlyDoe coverage-note condition — component renders when either block has content, not gated behind the DOE-only check
 
 ### Pending Todos
 
@@ -257,7 +260,7 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-07-23T11:55:28.829Z
-Stopped at: Paused mid-plan: 14-03 Tasks 1-3 complete, Task 4 (human-verify, live EWS mailbox) OPEN
-Resume file: .planning/phases/14-rss-email-alert-ingestion-module-rollout/14-03-PLAN.md
+Last session: 2026-07-23T12:01:06.995Z
+Stopped at: Completed 14-04-PLAN.md
+Resume file: None
 Last activity: 2026-07-14 - Built LDAP per-user exclude/denylist filter (9d1323f), migration applied on live DB, verified via Playwright: sync deactivated 4 excluded service accounts (administrator/krbtgt/guest/dns-ldap), 2 real LDAP users stay active, 0 wrongly created