feat(watchlist): bulk edit and remove

.graphifyignore

@@ -45,6 +45,26 @@ cmd/migration-check/testdata/
 # Frontend tooling config -- one node per JSON key, no architecture signal
 web/tsconfig.json
 web/components.json
+web/package.json
+
+# Tests and generated code: ~60% of graph edges were test plumbing (testing.T,
+# NewTestPool) and sqlc output, drowning real architecture. Source is findable by name.
+*_test.go
+*.test.ts
+*.test.tsx
+internal/db/sqlc/
+
+# Per-plan execution logs for every phase; CONTEXT/RESEARCH/UI-SPEC keep the decisions
+.planning/phases/*/*-PLAN.md
+.planning/phases/*/*-SUMMARY.md
+.planning/phases/*/*-REVIEW.md
+.planning/phases/*/*-REVIEW-FIX.md
+.planning/phases/*/*-UAT.md
+.planning/phases/*/*-PATTERNS.md
+.planning/phases/*/*-VERIFICATION.md
+.planning/phases/*/*-SECURITY.md
+.planning/phases/*/*-VALIDATION.md
+.planning/phases/*/*-DISCUSSION-LOG.md
 
 # Maintenance: when a milestone completes, add that milestone's phase
 # directory under .planning/milestones/ to this list before the next

.planning/REQUIREMENTS.md

@@ -35,11 +35,11 @@
 
 ### Bulk Edit
 
-- [ ] **BULK-01**: User can select multiple artists on the Watchlist, including "select all visible"
-- [ ] **BULK-02**: User can add or remove a tag on all selected artists in one action
-- [ ] **BULK-03**: User can set release-type filters and muted event types on all selected artists in one action
-- [ ] **BULK-04**: User can remove all selected artists after a confirmation stating the count; the removal is all-or-nothing
-- [ ] **BULK-05**: After a bulk action the selection clears and the watchlist reflects the result without a page reload
+- [x] **BULK-01**: User can select multiple artists on the Watchlist, including "select all visible"
+- [x] **BULK-02**: User can add or remove a tag on all selected artists in one action
+- [x] **BULK-03**: User can set release-type filters and muted event types on all selected artists in one action
+- [x] **BULK-04**: User can remove all selected artists after a confirmation stating the count; the removal is all-or-nothing
+- [x] **BULK-05**: After a bulk action the selection clears and the watchlist reflects the result without a page reload
 
 ### Bulk Add
 
@@ -96,11 +96,11 @@ Which phases cover which requirements. Updated during roadmap creation.
 | WLVW-05 | Phase 25 | Complete |
 | WLVW-06 | Phase 25 | Complete |
 | HIST-02 | Phase 25 | Complete |
-| BULK-01 | Phase 26 | Pending |
-| BULK-02 | Phase 26 | Pending |
-| BULK-03 | Phase 26 | Pending |
-| BULK-04 | Phase 26 | Pending |
-| BULK-05 | Phase 26 | Pending |
+| BULK-01 | Phase 26 | Complete |
+| BULK-02 | Phase 26 | Complete |
+| BULK-03 | Phase 26 | Complete |
+| BULK-04 | Phase 26 | Complete |
+| BULK-05 | Phase 26 | Complete |
 | IMPT-01 | Phase 27 | Pending |
 | IMPT-02 | Phase 27 | Pending |
 | IMPT-03 | Phase 27 | Pending |

.planning/ROADMAP.md

@@ -89,7 +89,7 @@ Full phase-by-phase detail for every shipped milestone is archived under `.plann
 
 - [x] **Phase 24: Artist Tags & Notes** - Free-form, case-insensitive tags with autocomplete and a plain-text note on each Watchlist card, global tag rename/merge/delete, and tags that belong to the artist so they survive a remove and re-add (completed 2026-10-06)
 - [x] **Phase 25: Find & Filter — Watchlist and History** - Client-side name search, stable sorts (including latest release), and tag/preference filters over the fully loaded watchlist, plus a retention-aware tag filter on the History feed (completed 2026-10-12)
-- [ ] **Phase 26: Bulk Edit & Remove** - Multi-select on the Watchlist with one-action tag add/remove, preference changes, and a count-confirmed all-or-nothing remove, backed by set-based transactional endpoints
+- [x] **Phase 26: Bulk Edit & Remove** - Multi-select on the Watchlist with one-action tag add/remove, preference changes, and a count-confirmed all-or-nothing remove, backed by set-based transactional endpoints (completed 2026-10-19)
 - [ ] **Phase 27: Paste-a-List Bulk Add** - Paste names one per line, watch them resolve one search at a time within the existing rate limits, review best matches by confidence, and add the confirmed set in one request
 - [ ] **Phase 28: Tags on Discord Notifications** - Tags on real-time embeds and digest lines, with markdown escaping added to the real-time path and the digest's chunking guarantees re-proven against longer lines
 
@@ -284,7 +284,48 @@ Plans:
   4. Removing the selection first asks for confirmation stating how many artists will be removed. Confirming removes all of them, or none of them if any part fails.
   5. After any bulk action the selection clears and the Watchlist shows the result immediately, with no page reload and no checkbox left pointing at a removed artist.
 
-**Plans**: TBD
+**Plans:** 12/12 plans complete
+
+Plans:
+**Wave 1**
+
+- [x] 26-01-PLAN.md — `POST /watchlist/bulk/delete` as one atomic DELETE (D-03), the `WatchlistBulkStore`/`WithWatchlistBulk` seam (D-20), shared id and body bounds, and gate/CSRF/503/precedence tests
+
+**Wave 2** *(blocked on Wave 1 completion)*
+
+- [x] 26-02-PLAN.md — `POST /watchlist/bulk/tags/add`: an ordered pre-lock plus a count-guarded insert that names at-cap artists and rolls back an orphan tag (D-01, D-19), concurrency tests, and the ADR 0004 amendment
+- [x] 26-03-PLAN.md — Card checkboxes, the sticky action bar, and the count-stating route-level remove confirm with its copy and failure paths (D-09, D-10, D-16, D-17)
+
+**Wave 3** *(blocked on Wave 2 completion)*
+
+- [x] 26-04-PLAN.md — `Select all visible`, the derived (not trimmed) selection with hidden selections inert, Shift ranges, and the in-flight lock (D-09, D-11)
+- [x] 26-05-PLAN.md — `PATCH /watchlist/bulk/preferences`: a locked-CTE per-type delta in canonical order with the nil-slice guard and the D-21 400s
+
+**Wave 4** *(blocked on Wave 3 completion)*
+
+- [x] 26-06-PLAN.md — Close → clear → focus fallback (U1), selection announcements and Esc, and the measured bar clearance for the page, toasts, and focus (U2, U3)
+- [x] 26-07-PLAN.md — `POST /watchlist/bulk/tags/remove` by tag id with a 404 for a missing tag (D-22) and an `applied`/`carried` outcome for Undo
+
+**Wave 5** *(blocked on Wave 4 completion)*
+
+- [x] 26-08-PLAN.md — Bulk add-tag from the bar's inline picker (D-12), with named cap skips, gone notes, and sticky cards (D-13)
+
+**Wave 6** *(blocked on Wave 5 completion)*
+
+- [x] 26-09-PLAN.md — The entry-free `TagCombobox` shared by card and bar, and the inline add-tag mode's Esc/Cancel, pending, and vocabulary contract (D-12)
+
+**Wave 7** *(blocked on Wave 6 completion)*
+
+- [x] 26-10-PLAN.md — The vendored popover and the tri-state Preferences editor, which sends only changed types (D-05…D-08)
+
+**Wave 8** *(blocked on Wave 7 completion)*
+
+- [x] 26-11-PLAN.md — Bulk remove-tag from the bar (carried tags with counts) and Undo through bulk add-tag (U4)
+
+**Wave 9** *(blocked on Wave 8 completion)*
+
+- [x] 26-12-PLAN.md — Embedded bundle rebuild, the phase-closing Definition of Done (`make db-up` + `make test`, or their recipes), and the blast-radius gate
+
 **UI hint**: yes
 
 **Notes for the phase planner**
@@ -363,10 +404,23 @@ Phases execute in numeric order: 24 → 25 → 26 → 27 → 28
 |-------|----------------|--------|-----------|
 | 24. Artist Tags & Notes | 14/14 | Complete    | 2026-10-06 |
 | 25. Find & Filter — Watchlist and History | 21/21 | Complete    | 2026-10-12 |
-| 26. Bulk Edit & Remove | 0/? | Not started | - |
+| 26. Bulk Edit & Remove | 12/12 | Complete    | 2026-10-19 |
 | 27. Paste-a-List Bulk Add | 0/? | Not started | - |
 | 28. Tags on Discord Notifications | 0/? | Not started | - |
 
 ## Backlog
 
-*(none currently)*
+### Phase 999.1: Terraform + Azure ephemeral deploy (BACKLOG)
+
+**Goal:** Terraform-managed Azure environment (Container Apps + Postgres Flexible Server) run as an apply -> smoke test -> destroy cycle, locally first, then from GitHub Actions. Gives the deferred Phase 17 deploy/health-gate work a target without a VPS or domain.
+
+**Plans**: TBD (proposed slices)
+
+- (a) Bootstrap module: state storage account + GitHub OIDC app registration, never destroyed
+- (b) Root module: resource group, Container App, Postgres Flexible Server, budget alert; applied locally
+- (c) Smoke-test script: `/health` + `/ready`, then POST /watchlist and re-GET
+- (d) CI: `terraform fmt`/`validate`, tflint, config scan, plan comment on PRs
+- (e) `workflow_dispatch` cycle: apply, smoke test, destroy under `if: always()`, image tag from the release job
+- (f) README/ADR covering cost and teardown
+
+Context: `.planning/notes/2026-10-17-terraform-azure-ephemeral-deploy.md`; open questions in `.planning/research/questions.md`.

.planning/STATE.md

@@ -2,20 +2,20 @@
 gsd_state_version: "1.0"
 milestone: v1.6
 milestone_name: Watchlist Organization
-current_phase: 26
-current_phase_name: Bulk Edit & Remove
+current_phase: 27
+current_phase_name: Paste-a-List Bulk Add
 status: planning
-stopped_at: Phase 25 complete, ready to plan Phase 26
-last_updated: "2026-10-13T02:17:52.713Z"
-last_activity: 2026-10-12
-last_activity_desc: Phase 25 complete, transitioned to Phase 26
-state_head: aa235f1e00be1b78be6cbea284f996b550c2fd43
+stopped_at: Phase 26 complete, ready to plan Phase 27
+last_updated: "2026-10-19T18:12:58.677Z"
+last_activity: 2026-10-19
+last_activity_desc: Phase 26 complete, transitioned to Phase 27
+state_head: ad1cd5326e7e95181f3651ffae7d5644d0d39e38
 progress:
   total_phases: 5
-  completed_phases: 2
-  total_plans: 35
-  completed_plans: 35
-  percent: 40
+  completed_phases: 3
+  total_plans: 47
+  completed_plans: 47
+  percent: 60
 ---
 
 # Project State
@@ -25,20 +25,20 @@ progress:
 See: .planning/PROJECT.md (updated 2026-10-06)
 
 **Core value:** A single Go binary that reliably detects and notifies on new releases for watched artists, built and shipped through a CI/CD pipeline rigorous enough to demonstrate real DevOps practice.
-**Current focus:** Phase 25 — Find & Filter — Watchlist and History
+**Current focus:** Phase 26 — Bulk Edit & Remove
 
 ## Current Position
 
-Phase: 26 — Bulk Edit & Remove
+Phase: 27 — Paste-a-List Bulk Add
 Plan: Not started
 Status: Ready to plan
-Last activity: 2026-10-12 — Phase 25 complete, transitioned to Phase 26
+Last activity: 2026-10-19 — Phase 26 complete, transitioned to Phase 27
 
 ## Performance Metrics
 
 **Velocity:**
 
-- Total plans completed: 134
+- Total plans completed: 146
 - Average duration: - min
 - Total execution time: 0 hours
 
@@ -71,6 +71,7 @@ Last activity: 2026-10-12 — Phase 25 complete, transitioned to Phase 26
 | 23 | 4 | - | - |
 | 24 | 14 | - | - |
 | 25 | 21 | - | - |
+| 26 | 12 | - | - |
 
 **Recent Trend:**
 
@@ -184,6 +185,18 @@ Last activity: 2026-10-12 — Phase 25 complete, transitioned to Phase 26
 | Phase 25 P19 | 2 min | 2 tasks | 4 files |
 | Phase 25 P20 | 10 min | 3 tasks | 7 files |
 | Phase 25 P21 | 9 min | 3 tasks | 4 files |
+| Phase 26 P01 | 14 min | 3 tasks | 9 files |
+| Phase 26 P02 | 14min | 3 tasks | 10 files |
+| Phase 26 P03 | 8 min | 2 tasks | 8 files |
+| Phase 26 P04 | 10min | 3 tasks | 5 files |
+| Phase 26 P05 | 12min | 3 tasks | 8 files |
+| Phase 26 P06 | 12min | 3 tasks | 8 files |
+| Phase 26 P07 | 12 min | 2 tasks | 9 files |
+| Phase 26 P08 | 11 min | 2 tasks | 8 files |
+| Phase 26 P09 | 14min | 2 tasks | 6 files |
+| Phase 26 P10 | 35 min | 3 tasks | 9 files |
+| Phase 26 P11 | 40min | 3 tasks | 9 files |
+| Phase 26 P12 | 7 min | 2 tasks | 23 files |
 
 ## Accumulated Context
 
@@ -429,6 +442,18 @@ Recent decisions affecting current work:
 - [Phase 25]: [Phase 25-19]: G-25-11 scroll anchor fallback widened to the nearest surviving card (no distance cap, next before previous at each distance), user decision 2026-10-12
 - [Phase 25]: G-25-12 (2026-10-12): keyboard-only focus move (click detail 0) to fallback card's chip label, else Your artists heading, via useScrollAnchor onFocusLost/useEffectEvent
 - [Phase 25]: G-25-13 (user decision 2026-10-12): disabled Deezer button described via aria-describedby to a per-row useId sr-only hint; no visual change
+- [Phase 26]: 26-01: bulk delete is POST /watchlist/bulk/delete, max 1000 ids, 64 KiB body cap; max returned in the 400 body — Keeps the SPA independent of the constants; watchlist rows only, artists/tags/pending events survive (D-17, D-18)
+- [Phase 26]: [Phase 26-02] Bulk add-tag lives on tags.Service/TagStore; all-capped or all-gone batches roll back and report tag id 0 so no orphan tags row
+- [Phase 26]: 26-03: confirmRemove records the outcome in a ref; the dialog close handler applies it (close, then clear) so the route-hosted dialog never unmounts with the bar
+- [Phase 26]: 26-04: Select all visible name comes from its wrapping label text only; disabled Base UI checkboxes expose data-disabled
+- [Phase 26]: 26-05: bulk preferences is PATCH /watchlist/bulk/preferences; omitted axis means empty lists; validation precedes empty-ids shortcut
+- [Phase 26]: 26-06: finalFocus function reads a close-kind ref so focus target is chosen at close; pendingFocus effect is a backstop
+- [Phase 26]: 26-07: bulk remove-tag lives on tags.Service/TagStore with no transaction; missing tag is 404, applied is exactly what Undo re-adds
+- [Phase 26]: 26-08: bar picker onClose ignored while pending; Cancel exits on pointer-down and click; remember(tag) only when applied is non-empty
+- [Phase 26]: [26-09] Vocabulary memory in bar tests is observed via the reopened picker, not a provider spy
+- [Phase 26]: 26-10: popover.tsx hand-written from registry source; shadcn CLI tried to pnpm add a bogus cn package
+- [Phase 26]: 26-10: Add tag disabled while Preferences popover is open (one-surface rule)
+- [Phase 26]: 26-11: Remove-tag Undo re-adds by name to the remove response's applied ids only; picker owns its query and filters with filter={null}; DISMISS_REASONS shared from TagCombobox
 
 ### Pending Todos
 
@@ -489,6 +514,7 @@ _Closed 2026-09-05: Phase 16 gap G-16-1 (n1-boot guard-adoption skip) — quick
 | 261007-lc4 | Phase 24 comment cleanup: comment-only trim to 1-3 line why-notes with one doc ref, fixed inaccurate WithTags/merge-trigger/buildTagSuggestions comments, removed plan narration | 2026-10-07 | be98a62 | [261007-lc4-phase-24-comment-cleanup](./quick/261007-lc4-phase-24-comment-cleanup/) |
 | 261011-gq7 | Amend Phase 26 CONTEXT and UI-SPEC with grill decisions Q1–Q10 (derived selection, outcome-only bulk responses + refresh, ordered-lock bulk tag attach, single-statement remove/preferences, pending-alert disclosure) and add withdraw-pending-events todo | 2026-10-11 | 6408d28 | [261011-gq7-amend-phase-26-docs-with-grill-decisions](./quick/261011-gq7-amend-phase-26-docs-with-grill-decisions/) |
 | 261011-moj | Amend Phase 26 CONTEXT and UI-SPEC with UI review U1–U4 (route-level confirm + close→clear→focus order, scroll-padding focus clearance, one-row phone bar, remove-tag Undo) | 2026-10-11 | 9ac478c | [261011-moj-amend-phase-26-ui-spec-and-context-with-](./quick/261011-moj-amend-phase-26-ui-spec-and-context-with-/) |
+| 261019-jkv | Refactor phase 26 bulk UI: shared preference options, popover and outcome-messages modules, useBulkSelection hook | 2026-10-19 | 66e1990 | [261019-jkv-refactor-phase-26-bulk-ui-preferenceopti](./quick/261019-jkv-refactor-phase-26-bulk-ui-preferenceopti/) |
 
 ### Roadmap Evolution
 
@@ -524,8 +550,8 @@ Items acknowledged and carried forward from previous milestone close:
 
 ## Session Continuity
 
-Last session: 2026-10-12T22:25:32.998Z
-Stopped at: Phase 25 complete, ready to plan Phase 26
+Last session: 2026-10-16T23:59:43.847Z
+Stopped at: Phase 26 complete, ready to plan Phase 27
 Resume file: None
 
 ## Operator Next Steps