Merge branch 'feat/go-m6-7-embed-verify'

Reviewed-on: #35

CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## 2026-05-11 23:58 CEST — fix(reconcile): fill earliest month deficit first in multi-month allocations
+
+- Multi-month payment allocation now fills the earliest in-window deficit first and spills
+  any remainder to later months, accounting for prior transactions' contributions to each month.
+  Previously a single transaction was split proportionally to each month's total expected fee,
+  ignoring what earlier transactions had already paid — surfaced by Matyáš Thér's 200+550 case
+  showing 566/183 instead of 500/250.
+- Files: `scripts/match_payments.py`, `go/internal/domain/reconcile/reconcile.go`, tests, parity fixtures.
+
+## 2026-05-11 22:56 CEST — fix(python): parse Fio 2-digit-year dates + add `make sync-debug` dry-run tool
+
+- Fix: `scripts/fio_utils.py` `parse_czech_date` now accepts `DD.MM.YY` / `D.M.YY` in addition to the 4-digit-year variants. Fio's transparent page now mixes both forms in the same response; the 2-digit rows were being silently dropped, which caused `make sync-2026` to miss every recent transfer. Mirrors the Go-side fix from 2026-05-07 (CHANGELOG entry below).
+- Added `--dry-run` and `--print-fio-table` flags to `scripts/sync_fio_to_sheets.py`, plus a `make sync-debug [DAYS=N]` Makefile target. Mirrors `make go-sync-debug`: fetches from Fio and dedupes against the sheet, prints `STATUS=NEW/DUP` per transaction, and prints per-row `Dry run: would append …` lines + `would sort by date` instead of touching the sheet.
+- Added always-on stderr diagnostics in `scripts/fio_utils.py`: which fetcher was selected (authenticated API vs. transparent-page scraper with `FIO_API_TOKEN`-unset warning), and raw-vs-after-filter transaction counts on both paths — so this class of "scraper drops everything" bug surfaces immediately.
+## 2026-05-08 15:24 CEST — feat(go): M6.7 — single-binary embed verification
+
+- Confirmed `embed.FS` wiring is complete: templates parsed via `template.ParseFS(templateFS, ...)`, static assets served via `http.FileServerFS(fs.Sub(staticFS, "static"))`.
+- Added `go/internal/web/assets_test.go` with two tests: `TestEmbedCompleteness` (walks disk vs embed.FS to catch forgotten files) and `TestStaticAssetsServed` (hits `/static/css/app.css` and all JS files through the mux, asserts 200 + Content-Type + non-empty body + 404 for unknown paths).
+- Closes M6; single binary confirmed self-contained with no adjacent `templates/` or `static/` required at runtime.
+- Key files: `go/internal/web/assets_test.go` (new).
+
+## 2026-05-08 14:55 CEST — feat(go): M6.6.1 — Pay-button QR popup modal
+
+- Restored the Python `showPayQR` in-page modal UX that was lost in M6.6 (Pay buttons were navigating the tab to the raw `/qr` PNG).
+- Replaced `<a href="{{qrHref ...}}">Pay</a>` with `<button data-name|amount|month|raw-month>` on `/adults` and `/juniors`; click is handled by a new `static/js/payment-qr.js` IIFE module that opens `#qrModal` with title, account, amount, message, and the QR image.
+- Added `#qrModal` markup to both templates; CSS `display:none` / `.active{display:flex}` rules added (content rules were already present from M6.1). `Esc`, `[close]`, and outside-click all dismiss; coexists with the M6.5 member-detail modal.
+- Removed the now-dead `qrHref` / `qrHrefAll` template helpers from `render.go`.
+- Markup tests in `html_handler_test.go` assert modal IDs, script tag, `data-bank-account`, and that no bare `href="/qr"` links remain.
+- Key files: `go/internal/web/static/js/payment-qr.js`, `go/internal/web/templates/adults.tmpl`, `go/internal/web/templates/juniors.tmpl`, `go/internal/web/render.go`, `go/internal/web/static/css/app.css`.
+
+## 2026-05-08 13:57 CEST — feat(go): M6.6 — /qr, /sync-bank, /flush-cache, /version
+
+- Added `GET /qr`: generates Czech QR Platba PNG from SPD payload (account, amount, message query params); ports Python's `qr_code()` handler exactly including account validation, amount clamping, and `*` stripping.
+- Implemented `GET /sync-bank`: runs Fio sync → infer payments → cache flush, captures output into `sync.tmpl` page with success/error banner.
+- Implemented `GET /flush-cache` + `POST /flush-cache`: form + action that deletes cache files and shows deleted count.
+- Added `GET /version` as a JSON alias of `GET /api/version` (Python parity).
+- Added `FlushCache() (int, error)` to `membership.Sources` interface; implemented on `realSources` via `cache.FileCache.Flush()`.
+- Introduced `web.ActionHandlers{BankSync}` — closure-based dep injection for sync, constructed in `serverCmd` with fio + sheets clients.
+- New dependency: `github.com/skip2/go-qrcode`.
+- Key files: `go/internal/web/qr.go`, `go/internal/web/html_handler.go`, `go/internal/web/server.go`, `go/internal/services/membership/loader.go`, `go/internal/web/templates/sync.tmpl`, `go/internal/web/templates/flush_cache.tmpl`.
+
+## 2026-05-08 13:19 CEST — feat(go): M6.5 — member-detail modal JS module
+
+- Added `static/js/member-detail.js`: fetches `/api/adults` or `/api/juniors` once on page load, caches the response, renders a per-member detail modal on `[i]` row click.
+- Modal sections: status-per-month table, fee exceptions, other transactions, matched payment history, toggleable raw-payments debug view.
+- Keyboard nav: `Esc` closes, `↑`/`↓` walk visible (name-filtered) rows; click outside modal content closes it.
+- Added `[i]` info icon and `#memberModal` markup to `adults.tmpl` and `juniors.tmpl`; all CSS was already in place from M6.1.
+- Added `TestModalMarkup` assertions to `html_handler_test.go`.
+
 ## 2026-05-08 12:48 CEST — feat(go): M6.4 — Go-native /payments page
 
 - Extracted `AssemblePayments(ctx)` from the inlined JSON handler body, following the M6.2/M6.3 `AssembleAdults`/`AssembleJuniors` pattern.

Makefile

@@ -35,6 +35,7 @@ help:
 	@echo "  make sync        - Sync Fio transactions to Google Sheets"
 	@echo "  make sync-2025   - Sync Fio transactions for Q4 2025 (Oct-Dec)"
 	@echo "  make sync-2026   - Sync Fio transactions for the whole year of 2026"
+	@echo "  make sync-debug [DAYS=N] - Dry-run Python sync with Fio diagnostics and txn table (default DAYS=30)"
 	@echo "  make infer       - Infer payment details (Person, Purpose, Amount) in the sheet"
 	@echo "  make reconcile   - Show balance report using Google Sheets data"
 	@echo "  make venv        - Sync virtual environment with pyproject.toml"
@@ -125,6 +126,9 @@ sync-2025: $(PYTHON)
 sync-2026: $(PYTHON)
 	$(PYTHON) scripts/sync_fio_to_sheets.py --credentials .secret/fuj-management-bot-credentials.json --from 2026-01-01 --to 2026-12-31 --sort-by-date
 
+sync-debug: $(PYTHON)  ## Dry-run Python sync with Fio diagnostics and txn table (default DAYS=30)
+	$(PYTHON) scripts/sync_fio_to_sheets.py --credentials .secret/fuj-management-bot-credentials.json --days $(DAYS) --dry-run --print-fio-table
+
 infer: $(PYTHON)
 	$(PYTHON) scripts/infer_payments.py --credentials $(CREDENTIALS)
 

docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md

@@ -4,7 +4,7 @@ Companion to [2026-05-03-2349-go-backend-rewrite.md](2026-05-03-2349-go-backend-
 
 **Current milestone:** M6 — Go-native HTML frontend
 **Started:** 2026-05-04
-**Last updated:** 2026-05-08 (M6.4 merged)
+**Last updated:** 2026-05-08 (M6.6 + M6.6.1 merged)
 
 ## How to use
 
@@ -114,9 +114,10 @@ Goal: feature-equivalent UX on the Go side, designed cleanly. Not a Jinja port.
 - [x] **M6.2** `/adults` page: table, name filter input, month range filter, totals row, credits/debts/unmatched sections, Pay buttons that link to `/qr` — `c85748b`
 - [x] **M6.3** `/juniors` page: same structure + per-month J/A attendance breakdown + `"?"` sentinel rendering — `9564103`
 - [x] **M6.4** `/payments` page: grouped-by-person ledger view — `689f1c0`
-- [ ] **M6.5** Modal JS module (`static/js/member-detail.js`): fetches `/api/adults` (or juniors), renders status/exceptions/transactions on row click; keyboard nav (Esc, ↑/↓)
-- [ ] **M6.6** `/qr`, `/sync-bank`, `/flush-cache`, `/version` pages
-- [ ] **M6.7** Wire `embed.FS` into handlers; verify single-binary deployment includes all assets
+- [x] **M6.5** Modal JS module (`static/js/member-detail.js`): fetches `/api/adults` (or juniors), renders status/exceptions/transactions on row click; keyboard nav (Esc, ↑/↓) — `e53e238`
+- [x] **M6.6** `/qr`, `/sync-bank`, `/flush-cache`, `/version` pages — `f6ba85b`
+- [x] **M6.6.1** Pay-button QR popup modal (`payment-qr.js`); restores Python `showPayQR` UX lost in M6.6 — `4276d7b`
+- [ ] **M6.7** Wire `embed.FS` into handlers; verify single-binary deployment includes all assets — (pending merge)
 
 **Gate:** Browser smoke on :8080: all pages render, name+month filters work, modal opens with correct data, QR loads, sync/flush work end-to-end.
 

docs/plans/2026-05-08-1334-go-m6-6-action-pages.md

@@ -0,0 +1,124 @@
+# M6.6 — `/qr`, `/sync-bank`, `/flush-cache`, `/version` (Go parity)
+
+> On approval, relocate this file to `docs/plans/YYYY-MM-DD-HHMM-go-m6-6-action-pages.md` per the repo's `CLAUDE.md` "Plans" convention before starting work.
+
+## Context
+
+The Go-rewrite progress tracker ([2026-05-03-2349-go-backend-rewrite-progress.md:118](docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md#L118)) lists M6.6 as:
+
+> `/qr, /sync-bank, /flush-cache, /version pages`
+
+After M6.4 (payments page) and M6.5 (member-detail modal JS), the only remaining pre-deployment HTML/action endpoints in Python that the Go binary doesn't yet implement are these four. The adults/juniors templates already produce `/qr?...` URLs via the `qrHref` / `qrHrefAll` helpers ([render.go:47-71](go/internal/web/render.go#L47-L71)) — the matching handler is the missing piece. `sync` and `flush_cache` templates exist as "Coming in M6.6" stubs and need real markup + working handlers. `/api/version` already serves build metadata; `/version` just needs to alias it (Python parity).
+
+After M6.6 the M6 gate ("Browser smoke on :8080: all pages render … QR loads, sync/flush work end-to-end") is reachable.
+
+## Confirmed design choices
+
+- **`/sync-bank`**: Python-faithful — GET both renders and triggers the sync, captures stdout/stderr into a log buffer, surfaces success/failure via a flag. Matches existing nav `[Sync Bank Data]` link.
+- **`/version`**: JSON alias of `/api/version`. No HTML page.
+- **QR library**: `github.com/skip2/go-qrcode`. Default level `qrcode.Medium`, size 256.
+
+## Scope per endpoint
+
+### 1. `GET /qr` — PNG only
+
+Match Python ([app.py:321-356](app.py#L321-L356)) verbatim semantics:
+
+1. Read `account` (default `cfg.BankAccount`), `amount` (default `"0"`), `message` (default `""`).
+2. Validate account against `^[A-Z]{2}\d{2,34}$|^\d{1,16}/\d{4}$`; on miss, silently fall back to `cfg.BankAccount`.
+3. Parse amount as float64; clamp to `[0, 10_000_000]`; format `%.2f`; on parse error → `"0.00"`.
+4. Truncate message to 60 runes; strip all `*`.
+5. If account contains `/`, split into `{number}*BC:{bankcode}`; else use raw.
+6. SPD payload: `SPD*1.0*ACC:{acc}*AM:{amount}*CC:CZK*MSG:{msg}` (no `BC:` key when IBAN — Python doesn't either).
+7. `qrcode.Encode(payload, qrcode.Medium, 256)` → write bytes with `Content-Type: image/png`.
+
+No template, no HTML.
+
+### 2. `GET /sync-bank` — triggers + renders
+
+Match Python ([app.py:124-151](app.py#L124-L151)):
+
+1. Build a `*bytes.Buffer` to capture step output.
+2. For each step write a header line then call:
+   - `banksync.SyncToSheets(ctx, cfg.PaymentsSheetID, fioClient, sheetsClient, banksync.SyncOpts{From: jan1ThisYear, To: dec31ThisYear, Sort: true})`
+   - `banksync.InferPayments(ctx, cfg.PaymentsSheetID, sheetsClient, sources, banksync.InferOpts{})`
+   - `cacheFlusher.Flush()` — append `"%d cache files deleted"`.
+3. On any error: append `err.Error()` + a stack trace via `runtime/debug.Stack()`, set `success=false`, continue rendering.
+4. Render `sync` template with `SyncPageData{ PageData; Output string; Success bool }`.
+
+The `banksync` package's stdout-printing functions can be redirected by passing an `io.Writer` — confirm during implementation; if they only print to `os.Stdout`, capture by tee'ing through a `slog` handler or briefly swapping `os.Stdout` (or extend the package with a `*Writer` option). **Preferred**: add a `Logger io.Writer` field to `banksync.SyncOpts` / `InferOpts`. This is a minor extension to existing services, not a rewrite.
+
+### 3. `/flush-cache` — GET form, POST action
+
+Match Python ([app.py:117-122](app.py#L117-L122)):
+
+- `GET` → render `flush_cache` with `Flushed=false`.
+- `POST` → call `cacheFlusher.Flush()`, render with `Flushed=true, Deleted=n`.
+
+### 4. `GET /version` — JSON
+
+One-liner: register the existing `api.VersionHandler` (or its inline equivalent in [api/version.go](go/internal/web/api/version.go)) on the `/version` path as well as `/api/version`. Output: `{"tag", "commit", "build_date"}`.
+
+## Files to create / modify
+
+### New files
+
+- **[go/internal/web/templates/qr.tmpl](go/internal/web/templates/qr.tmpl)** — *not actually needed*; remove from plan if `/qr` is PNG-only. (Decision: skip — no template.)
+- Replace stub **[go/internal/web/templates/sync.tmpl](go/internal/web/templates/sync.tmpl)** with full markup: title, status banner colored by `Success`, `<pre>` of `Output`, "Run again" link.
+- Replace stub **[go/internal/web/templates/flush_cache.tmpl](go/internal/web/templates/flush_cache.tmpl)** with: form (`POST /flush-cache` → `<button>[Flush Cache]</button>`), success banner when `Flushed`.
+
+### Modified files
+
+- **[go/go.mod](go/go.mod)** / `go.sum` — add `github.com/skip2/go-qrcode`.
+- **[go/internal/web/server.go](go/internal/web/server.go)** — register `GET /qr`, `GET /sync-bank` (replace stub), `GET /flush-cache` (form), `POST /flush-cache` (action), `GET /version`. Widen `Run(...)` signature to accept `fio.Client`, `sheets.Client`, and a `cache.Flusher` — these flow into a new `Deps` struct on `HTMLHandler`.
+- **[go/internal/web/html_handler.go](go/internal/web/html_handler.go)** — add `ServeQR`, real `ServeSync`, split `ServeFlushCacheGET` / `ServeFlushCachePOST`, add `ServeVersion` (delegates to api package).
+- **[go/internal/web/render.go](go/internal/web/render.go)** — add `SyncPageData{ PageData; Output string; Success bool }` and `FlushPageData{ PageData; Flushed bool; Deleted int }` view-models. (`pageNames` already includes `"sync"` and `"flush_cache"`; no change.)
+- **[go/internal/web/qr.go](go/internal/web/qr.go)** *(new file)* — pure helper: `BuildSPD(account, amount, message string, defaultAccount string) (payload string)` + `RenderQRCode(payload string) ([]byte, error)`. Easier to unit-test than a method on the handler.
+- **[go/internal/services/membership/loader.go](go/internal/services/membership/loader.go)** — add a small `CacheFlusher` interface (`Flush() (int, error)`); have `Sources` aggregate include it. *Alternative considered*: pass `*cache.FileCache` straight into `web.Run`. Choose whichever needs fewer test-stub edits — likely the direct-pass approach, since stubs in tests don't need cache behavior. **Decision: pass `cache.Flusher` directly into `web.Run` as a separate dependency, not through `Sources`.** Simpler, fewer interface changes.
+- **[go/internal/services/banksync/sync.go](go/internal/services/banksync/sync.go)** + `infer.go` — accept an optional `io.Writer` (in `SyncOpts.Logger` / `InferOpts.Logger`) and route progress prints through it; default to `os.Stdout` when nil for CLI parity.
+- **[go/cmd/fuj/main.go](go/cmd/fuj/main.go)** — in the `server` subcommand, build `fio.Client`, `sheets.Client`, and `cache.Flusher` (already constructed inside `membership.NewSources` — expose it or construct a sibling) and pass them into `web.Run`.
+
+## Reuse (already in the codebase)
+
+- **Bank sync**: `banksync.SyncToSheets` ([go/internal/services/banksync/sync.go](go/internal/services/banksync/sync.go)) and `banksync.InferPayments` ([go/internal/services/banksync/infer.go](go/internal/services/banksync/infer.go)) — same calls the CLI `sync` / `infer` subcommands use ([go/cmd/fuj/main.go:184](go/cmd/fuj/main.go#L184), [:222](go/cmd/fuj/main.go#L222)).
+- **Cache flush**: `(*cache.FileCache).Flush() (int, error)` ([go/internal/io/cache/filecache.go:92](go/internal/io/cache/filecache.go#L92)) — already returns the deleted count.
+- **Build metadata**: `BuildInfo{Version, Commit, BuildDate}` ([go/internal/web/server.go:28-35](go/internal/web/server.go#L28-L35)) is already plumbed everywhere; `/api/version` JSON shape is already correct ([go/internal/web/api/version.go](go/internal/web/api/version.go)).
+- **Template render pattern**: `Renderer.Render(w, name, data)` ([go/internal/web/render.go:98-108](go/internal/web/render.go#L98-L108)).
+- **Test scaffolding**: `web.NewRenderer()` + `httptest.NewRequest/NewRecorder` ([go/internal/web/html_handler_test.go:52-94](go/internal/web/html_handler_test.go#L52-L94)).
+
+## Tests
+
+Add to `go/internal/web/html_handler_test.go` (and one new `qr_test.go` for the SPD builder):
+
+- **`TestQRBuildSPD`** *(unit, in [go/internal/web/qr_test.go](go/internal/web/qr_test.go))* — table-driven: invalid account → fallback; `/`-account → `{num}*BC:{bc}`; IBAN → raw; amount `-1` → `0.00`; amount `99999999` → `9999999.00`; amount `"abc"` → `0.00`; message with `*` stripped; message length-clamped to 60.
+- **`TestServeQR`** — request `/qr?account=…&amount=10&message=Hi`; assert 200, `Content-Type: image/png`, body starts with PNG magic `\x89PNG\r\n\x1a\n`.
+- **`TestServeFlushCacheGet`** — assert form rendered, no banner.
+- **`TestServeFlushCachePost`** — fixture flusher returns 3; assert banner says "3" and `Flushed`.
+- **`TestServeSync`** — fixture banksync stubs return `(2, nil)` and `(1, nil)`, fixture flusher returns 4; assert page renders, status is success, output contains the section headers.
+- **`TestServeVersion`** — assert `application/json`, body `{"tag":"v0","commit":"abc1234","build_date":"2026-01-01"}`.
+- Extend the `TestHTMLHandlerSmoke` table to cover `/qr` and `/version`.
+
+## Verification (end-to-end)
+
+1. `cd go && go build ./... && go test ./...`
+2. `cd go && go run ./cmd/fuj server` — open http://localhost:8080
+3. Smoke:
+   - **/adults** → click `Pay` next to any unpaid month → modal shows QR image (this exercises `/qr`). Confirm a Czech banking app can scan it (visual check).
+   - Direct `/qr?account=2702008874/2010&amount=700&message=Test` → PNG renders.
+   - **/sync-bank** → click `[Sync Bank Data]` in nav → page shows "Syncing…", then sections + "Inferred Payments", "Cache Flushed", green status banner.
+   - **/flush-cache** → click `[Flush Cache]` → success banner with file count.
+   - **/version** in browser → JSON visible.
+   - Adults / juniors / payments still render (no regressions from `Run` signature change).
+4. Run the parity diff: `go run ./cmd/parity` — `/api/version` must still match Python.
+5. Append a CHANGELOG entry per `CLAUDE.md`; tick `M6.6` in [docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md:118](docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md#L118).
+
+## Branch / MR
+
+Per `CLAUDE.md` workflow: `feat/go-m6-6-action-pages` off `main`, push with `-u`, open with `tea pr create --base main --head feat/go-m6-6-action-pages`.
+
+## Out of scope (deferred)
+
+- Auth / CSRF protection on `/sync-bank` and `/flush-cache` — Python has none either; deferred to M8 hardening.
+- M6.7 (single-binary embed verification) — separate ticket.
+- Streaming progress for `/sync-bank` (currently buffered until completion, like Python).
+- Configurable QR error-correction level / size.

docs/plans/2026-05-08-1439-go-m6-6-1-payment-qr-modal.md

@@ -0,0 +1,335 @@
+# M6.6.1 — Pay-button QR popup modal (`/adults`, `/juniors`)
+
+> Plan-mode note: per project convention this plan should live at
+> `docs/plans/2026-05-08-1439-go-m6-6-1-payment-qr-modal.md`. The first
+> execution step after approval is to copy this file there.
+> Branch: `feat/go-m6-6-1-payment-qr-modal` off `main`.
+
+## Context
+
+M6.6 ([docs/plans/2026-05-08-1334-go-m6-6-action-pages.md](docs/plans/2026-05-08-1334-go-m6-6-action-pages.md))
+landed the backend `/qr` PNG endpoint plus `/sync-bank`, `/flush-cache`,
+`/version`. While doing it, the **client-side** half of the Pay flow was
+collapsed from a modal-with-details into a plain `<a href="/qr?...">` —
+clicking Pay now navigates the whole tab to the raw PNG.
+
+The Python app instead opens an in-page `#qrModal` showing the QR image
+*plus* labelled details (account, amount, message, title), then closes
+the modal on outside-click or `[close]`
+([templates/adults.html:631-648](templates/adults.html#L631-L648),
+JS at [templates/adults.html:963-993](templates/adults.html#L963-L993)).
+This is the UX the user expects from the dashboard — staying on the
+table while displaying the QR is significantly more practical than
+losing context to a fullscreen image.
+
+M6.6.1 restores parity: the Pay/Pay-All buttons open an in-page
+`#qrModal`, identical in structure to the Python original, driven by a
+new vanilla-JS module `payment-qr.js` that mirrors the `member-detail.js`
+convention from M6.5.
+
+All the building blocks are already in place:
+
+- **`/qr` endpoint** ships PNGs ([go/internal/web/qr.go](go/internal/web/qr.go), tested by [TestServeQR](go/internal/web/html_handler_test.go#L207-L231)).
+- **CSS** for `#qrModal .modal-content`, `.qr-image`, `.qr-details` is
+  already in [go/internal/web/static/css/app.css:445-478](go/internal/web/static/css/app.css#L445-L478) — lifted during M6.1.
+- **Template helpers** `qrHref` / `qrHrefAll` ([go/internal/web/render.go:63-85](go/internal/web/render.go#L63-L85))
+  already produce the correct query string + Czech `MM/YYYY` format
+  for the `message=` param. They're useful for sanity (and for any
+  no-JS fallback) but become dead code post-M6.6.1 — see §Out of scope.
+- **Bank account** is already exposed as `$.Data.BankAccount` to every
+  template that has a Pay button.
+- **JS module convention**: `member-detail.js` is the M6.5 baseline —
+  IIFE, `'use strict'`, event delegation off `data-*` attributes, no
+  inline `onclick`, no globals leaked.
+
+## Approach
+
+### 1. Replace `<a href="{{qrHref ...}}">` with `<button data-...>`
+
+In [go/internal/web/templates/adults.tmpl](go/internal/web/templates/adults.tmpl)
+and [go/internal/web/templates/juniors.tmpl](go/internal/web/templates/juniors.tmpl)
+(both have identical Pay markup at lines 65 and 72):
+
+```gotmpl
+<button type="button" class="pay-btn"
+        data-name="{{$row.Name}}"
+        data-amount="{{$cell.Amount}}"
+        data-month="{{$cell.Month}}"
+        data-raw-month="{{$cell.RawMonth}}">Pay</button>
+```
+
+```gotmpl
+<button type="button" class="pay-btn"
+        data-name="{{$row.Name}}"
+        data-amount="{{$row.PayableAmount}}"
+        data-month="{{$row.UnpaidPeriods}}"
+        data-raw-month="{{$row.RawUnpaidPeriods}}"
+        data-pay-all="1">Pay All</button>
+```
+
+Why `<button type="button">` and not `<a>`: the click no longer
+navigates — the JS handles it. `type="button"` prevents accidental form
+submission. A no-JS fallback could be added later by re-introducing
+`href="{{qrHref ...}}"` and letting the JS call `e.preventDefault()` —
+deferred until anyone actually asks (see §Out of scope).
+
+`data-month` carries the human-readable period (e.g. `January 2026`,
+or `January 2026 + February 2026` for Pay-All) which the modal title
+displays. `data-raw-month` carries the machine format (`2026-01`,
+`2026-01+2026-02`) which the JS converts to `MM/YYYY` for the QR
+message — same conversion Python's `showPayQR` does at
+[templates/adults.html:966-968](templates/adults.html#L966-L968).
+`data-pay-all` is purely informational; the JS doesn't actually need
+it (the same code path handles single + multi-period), but keeping it
+helps debugging and any future analytics.
+
+### 2. Add `#qrModal` markup
+
+Append after the `#memberModal` block in both `adults.tmpl` and
+`juniors.tmpl` (around line 185 of adults, line 165 of juniors), mirroring
+[templates/adults.html:631-648](templates/adults.html#L631-L648) but
+using `class="active"` toggling (the convention M6.5 picked) instead of
+`style.display = 'block'`:
+
+```gotmpl
+<div id="qrModal" onclick="if(event.target===this)this.classList.remove('active')">
+  <div class="modal-content">
+    <div class="modal-header">
+      <div class="modal-title" id="qrTitle">Payment for —</div>
+      <div class="close-btn" onclick="document.getElementById('qrModal').classList.remove('active')">[close]</div>
+    </div>
+    <div class="qr-image">
+      <img id="qrImg" src="" alt="Payment QR Code">
+    </div>
+    <div class="qr-details">
+      <div>Account: <span id="qrAccount"></span></div>
+      <div>Amount: <span id="qrAmount"></span> CZK</div>
+      <div>Message: <span id="qrMessage"></span></div>
+    </div>
+  </div>
+</div>
+```
+
+The CSS already targets `#qrModal .modal-content` directly. To make the
+"hidden by default / visible when `.active`" toggle behave the same
+way `#memberModal` does, the existing CSS rules for `#memberModal`
+(`display:none`, `#memberModal.active { display: flex; }`) need a
+sibling pair for `#qrModal`. Audit `app.css` during implementation:
+- if `#qrModal` already has both rules, no change.
+- if it has only `display:none`, add `#qrModal.active { display: flex; }`.
+- if it has neither, add both.
+
+This is a 2-line CSS adjustment at most; tracked under §Critical files.
+
+### 3. Bank account on the page
+
+The modal needs the bank account string for the `qrAccount` label and
+for building the `/qr?account=…` URL. Two clean options:
+
+**(a)** Read it from the `<button>`'s `data-bank-account` attribute.
+Per-button duplication, but trivially done in templates and keeps the JS
+module's surface tiny.
+
+**(b)** Stamp it once on the page as `<body data-bank-account="…">`
+(or on the existing `#filterContainer`).
+
+**Decision: (b)** — single stamping site, follows the same pattern
+M6.5 used for `data-page` on `#filterContainer`. Add
+`data-bank-account="{{.Data.BankAccount}}"` to `#filterContainer` in
+both templates (one-line edit each).
+
+### 4. Create [go/internal/web/static/js/payment-qr.js](go/internal/web/static/js/payment-qr.js)
+
+A new module loaded with `<script src="/static/js/payment-qr.js" defer></script>`
+right after `member-detail.js` in both templates. Pure ES, no build
+step, IIFE, `'use strict'`. Skeleton — port of Python's `showPayQR`
+([templates/adults.html:963-986](templates/adults.html#L963-L986))
+plus event wiring:
+
+```js
+(function () {
+  'use strict';
+
+  const container = document.getElementById('filterContainer');
+  if (!container) return;
+  const bankAccount = container.dataset.bankAccount || '';
+
+  const modal      = document.getElementById('qrModal');
+  const titleEl    = document.getElementById('qrTitle');
+  const imgEl      = document.getElementById('qrImg');
+  const accountEl  = document.getElementById('qrAccount');
+  const amountEl   = document.getElementById('qrAmount');
+  const messageEl  = document.getElementById('qrMessage');
+  if (!modal || !titleEl || !imgEl || !accountEl || !amountEl || !messageEl) return;
+
+  // Convert "YYYY-MM" → "MM/YYYY"; "+"-joined ranges are converted piece-wise.
+  // Mirrors templates/adults.html:966-968.
+  function toCzechMonth(rawMonth) {
+    return rawMonth.split('+')
+      .map(p => p.replace(/^(\d{4})-(\d{2})$/, '$2/$1'))
+      .join('+');
+  }
+
+  function showQR(name, amount, month, rawMonth) {
+    const numericMonth = toCzechMonth(rawMonth);
+    const message = `${name}: ${numericMonth}`;
+
+    titleEl.innerText   = `Payment for ${month}`;
+    accountEl.innerText = bankAccount;
+    amountEl.innerText  = amount;
+    messageEl.innerText = message;
+
+    const url = '/qr?'
+      + 'account=' + encodeURIComponent(bankAccount)
+      + '&amount=' + encodeURIComponent(amount)
+      + '&message=' + encodeURIComponent(message);
+    imgEl.src = url;
+
+    modal.classList.add('active');
+  }
+
+  function closeQR() { modal.classList.remove('active'); }
+
+  // Event delegation: any .pay-btn click anywhere in the page.
+  document.addEventListener('click', ev => {
+    const btn = ev.target.closest('.pay-btn');
+    if (!btn) return;
+    ev.preventDefault();
+    showQR(
+      btn.dataset.name,
+      btn.dataset.amount,
+      btn.dataset.month,
+      btn.dataset.rawMonth,
+    );
+  });
+
+  document.addEventListener('keydown', e => {
+    if (e.key === 'Escape' && modal.classList.contains('active')) closeQR();
+  });
+}());
+```
+
+Notes:
+
+- **Event delegation** (single listener on `document`) handles both Pay
+  and Pay-All without enumerating buttons. It also survives any future
+  re-render of the table without needing rebinding.
+- **Coexistence with `member-detail.js`**: `member-detail.js` listens
+  for `Escape` too, but only acts when `#memberModal` is active; the
+  new module similarly only acts when `#qrModal` is active. No collision.
+- **Pre-warming**: nothing to pre-warm — `/qr` is a tiny on-demand PNG
+  and only fires when the user clicks.
+- **Inline `onclick`** on `[close]` and outside-click in the markup are
+  carried over from the M6.5 modal style; consistent with `#memberModal`.
+  (Switching the project's modal close pattern to data attributes is a
+  separate cleanup, out of scope here.)
+
+### 5. Tests
+
+Extend [go/internal/web/html_handler_test.go](go/internal/web/html_handler_test.go)
+with markup-level checks. Headless-browser JS is out of scope (same
+rationale as M6.5).
+
+In `TestModalMarkup` (or a sibling test, e.g. `TestPaymentQRMarkup`):
+
+- Body for `/adults` and `/juniors` contains
+  `<script src="/static/js/payment-qr.js"`.
+- Body contains `id="qrModal"`, `id="qrImg"`, `id="qrAccount"`,
+  `id="qrAmount"`, `id="qrMessage"`, `id="qrTitle"`.
+- The fixture row's Pay button is rendered as
+  `<button … class="pay-btn" … data-name="Test Member" data-amount="…" data-raw-month="2026-01"`.
+- The fixture row's `.pay-btn` does **not** include `href=`.
+- `#filterContainer` has `data-bank-account="CZ0000000000000000000000"`
+  (matching the test's `fixtureHandler` config).
+
+### 6. Decide fate of `qrHref` / `qrHrefAll` template helpers
+
+Once Pay/Pay-All buttons are JS-driven, the helpers in
+[render.go:63-85](go/internal/web/render.go#L63-L85) have no callers.
+**Decision: delete them**, plus their entries in `tmplFuncs`. A
+no-JS fallback is not on the roadmap; if it ever becomes one, the
+helpers are easy to resurrect from git.
+
+The unit-test file currently has no direct tests for these helpers —
+nothing to remove from tests.
+
+## Critical files
+
+| Action | Path |
+|--------|------|
+| edit   | [go/internal/web/templates/adults.tmpl](go/internal/web/templates/adults.tmpl) — Pay/Pay-All → `<button data-…>`; add `#qrModal`; add `data-bank-account` on filter container; add `<script src="/static/js/payment-qr.js" defer>` |
+| edit   | [go/internal/web/templates/juniors.tmpl](go/internal/web/templates/juniors.tmpl) — same |
+| new    | `go/internal/web/static/js/payment-qr.js` — modal module |
+| edit   | [go/internal/web/render.go](go/internal/web/render.go) — drop `qrHref`, `qrHrefAll`, and their `tmplFuncs` entries (and the `net/url`, `strconv` imports if no longer needed) |
+| edit   | [go/internal/web/static/css/app.css](go/internal/web/static/css/app.css) — verify / add `#qrModal { display:none; }` + `#qrModal.active { display:flex; }` rules |
+| edit   | [go/internal/web/html_handler_test.go](go/internal/web/html_handler_test.go) — markup assertions |
+
+No changes to: `assets.go` (`embed.FS` glob picks up new JS automatically),
+`server.go`, `html_handler.go`, the `/qr` handler, `cmd/fuj/main.go`, the
+API handlers, or any domain code.
+
+## Reused existing infrastructure
+
+- [go/internal/web/qr.go](go/internal/web/qr.go) — `/qr?account=…&amount=…&message=…` endpoint serves the PNG already
+- [go/internal/web/static/css/app.css:445-478](go/internal/web/static/css/app.css#L445-L478) — modal CSS already lifted whole
+- [go/internal/web/static/js/member-detail.js](go/internal/web/static/js/member-detail.js) — IIFE / `'use strict'` / `data-*` style to mirror
+- [go/internal/web/api/types.go](go/internal/web/api/types.go) — `MemberRow.UnpaidPeriods` and `RawUnpaidPeriods` already populated for Pay-All
+- [templates/adults.html:631-648,963-986](templates/adults.html#L631-L648) — Python reference for both modal markup and `showPayQR` JS (logic to port, not literal copy)
+
+## Verification
+
+End-to-end, after copying the plan into `docs/plans/`:
+
+1. `cd go && make go-build go-test go-lint` — all green.
+2. `make web-go &` — boot Go on `:8080`.
+3. Browser: `http://localhost:8080/adults`
+   - Click `Pay` on any unpaid month → `#qrModal` opens with
+     - title `Payment for <Month YYYY>`,
+     - `qrAccount` matching `BANK_ACCOUNT`,
+     - `qrAmount` matching the cell amount,
+     - `qrMessage` formatted as `<Name>: MM/YYYY`,
+     - QR image rendered from `/qr?…` (Network tab shows PNG response).
+   - Tab does **not** navigate; URL stays `/adults`.
+   - Click `Pay All` → modal opens with `+`-joined `MM/YYYY+MM/YYYY` message.
+   - Click outside the modal-content → modal closes.
+   - Click `[close]` → modal closes.
+   - Press `Esc` → modal closes.
+   - Open `[i]` member-detail modal first, then `Esc` → only that closes
+     (verify both modals don't fight each other).
+4. Browser: `http://localhost:8080/juniors` — same checks. Verify Pay
+   on a `"?"`-expected row doesn't appear (Pay button is conditional on
+   `unpaid`/`partial` cells).
+5. Cross-check against Python: `make web-py &` →
+   `http://localhost:5001/adults` modal looks visually equivalent for
+   the same fixture (modulo any nav / theme differences already accepted
+   in M6).
+6. Scan a QR with a Czech banking app (or `zbarimg` on the saved PNG) —
+   payload starts with `SPD*1.0*ACC:` and the message decodes to
+   `<Name>: MM/YYYY`.
+7. After the user merges in Gitea: append CHANGELOG entry (timestamp via
+   `date "+%Y-%m-%d %H:%M %Z"`); add a new tick line for **M6.6.1** in
+   [docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md](docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md)
+   immediately under the M6.6 line, in the same format as the other
+   sub-bullets.
+
+## Branching
+
+Per [CLAUDE.md](CLAUDE.md): create `feat/go-m6-6-1-payment-qr-modal` off
+`main`, commit with `Co-Authored-By` trailer, push with `-u`, open MR via
+`tea pr create`. Do not merge or delete from CLI.
+
+## Out of scope (deferred)
+
+- **Pay button no-JS fallback** — feasible to keep `qrHref` and have
+  the JS `preventDefault` an `<a>`, but no current need. Resurrect the
+  helpers if asked.
+- **Modal pattern unification** — `#memberModal` and `#qrModal` use
+  inline `onclick` for `[close]` and outside-click. Consistent with
+  M6.5 but worth a follow-up to delegate-event everything.
+- **Pay-from-modal inside `#memberModal`** — Python doesn't have it, and
+  no one's asked for it on the Go side.
+- **Per-button QR error-correction / size** — `/qr` is fixed at
+  Medium/256, same as M6.6. Configurable via query param can be added if
+  printing larger physical posters becomes a use case.
+- **`/payments` Pay buttons** — the payments page is a ledger view; it
+  doesn't render Pay buttons in either backend.

docs/plans/2026-05-08-1457-go-m6-7-single-binary-embed-verify.md

@@ -0,0 +1,184 @@
+# M6.7 — Single-binary embed verification
+
+## Context
+
+M6.7 is the final task in M6 (Go-native HTML frontend). Per the
+[progress tracker](2026-05-03-2349-go-backend-rewrite-progress.md): "Wire
+`embed.FS` into handlers; verify single-binary deployment includes all
+assets."
+
+The wiring is **already in place** from M6.1 onward:
+
+- [go/internal/web/assets.go](../../go/internal/web/assets.go) declares
+  `//go:embed templates` → `templateFS` and `//go:embed static` → `staticFS`.
+- [go/internal/web/render.go:66](../../go/internal/web/render.go#L66)
+  parses every page template via `template.New(...).ParseFS(templateFS, ...)`.
+- [go/internal/web/server.go:48-68](../../go/internal/web/server.go#L48-L68)
+  serves `/static/*` via `http.FileServerFS(fs.Sub(staticFS, "static"))`.
+- [go/build/Dockerfile](../../go/build/Dockerfile) copies only the compiled
+  binary into the `alpine:3` runtime image — no `templates/` or `static/`
+  directory ever lands beside it.
+
+What is missing is **proof** the embed is complete and stays complete:
+
+1. Nothing fails the build/test if a contributor adds a new file under
+   `internal/web/templates/` or `internal/web/static/` that isn't matched
+   by an `//go:embed` glob (or, more realistically, adds a sibling
+   directory like `static/img/` and the glob still picks it up — but a
+   typo'd directive would silently drop it).
+2. No automated test exercises the `/static/*` route against the embedded
+   FS — current tests in
+   [html_handler_test.go](../../go/internal/web/html_handler_test.go)
+   render templates (which proves `templateFS` is good) but never hit a
+   static URL through the mux.
+3. The "single binary, no working-dir assets" property is undocumented —
+   if it ever broke, no one would notice until the Docker image started
+   500'ing in prod.
+
+The intended outcome: a small test file plus a documented manual
+verification step, after which M6.7 can be ticked and M6 closed.
+
+## Plan
+
+### 1. Add `go/internal/web/assets_test.go`
+
+One new file, two tests, no production code changes.
+
+**Test A — embed completeness regression guard.** Walks the on-disk
+`templates/` and `static/` directories and asserts every regular file is
+also present in the corresponding embedded FS. Catches:
+
+- A new template added without updating the `//go:embed` directive
+  (current globs are `templates` and `static` — recursive by default for
+  directories, so this is a low-probability regression, but the test
+  doubles as living documentation of the contract).
+- A typo in the directive (e.g. someone renames `static` → `assets` in
+  one place but not the other).
+
+Implementation sketch:
+
+```go
+func TestEmbedCompleteness(t *testing.T) {
+    cases := []struct {
+        name   string
+        diskFS fs.FS         // os.DirFS("templates") / os.DirFS("static")
+        embed  fs.FS         // exported helper or via internal test in package web
+        root   string
+    }{...}
+    for _, tc := range cases {
+        _ = fs.WalkDir(tc.diskFS, ".", func(path string, d fs.DirEntry, err error) error {
+            if err != nil || d.IsDir() { return err }
+            embPath := tc.root + "/" + path
+            if _, err := fs.Stat(tc.embed, embPath); err != nil {
+                t.Errorf("file %q on disk but missing in embed.FS: %v", embPath, err)
+            }
+            return nil
+        })
+    }
+}
+```
+
+Because `templateFS` and `staticFS` are unexported package vars, this
+test lives in `package web` (not `web_test`) — sibling to
+[assets.go](../../go/internal/web/assets.go). All the existing handler
+tests are in `package web_test`; that's fine, this one is internal.
+
+**Test B — `/static/*` end-to-end via the mux.** Builds an `http.ServeMux`
+with the same wiring as
+[server.go:68](../../go/internal/web/server.go#L68), fires httptest
+requests, asserts:
+
+- `GET /static/css/app.css` → 200, `Content-Type: text/css; charset=utf-8`,
+  body contains a known string from app.css (e.g. a CSS selector).
+- `GET /static/js/member-detail.js` → 200, `Content-Type` starts with
+  `text/javascript` or `application/javascript`, body non-empty.
+- `GET /static/js/payment-qr.js` → 200, body non-empty.
+- `GET /static/css/missing.css` → 404 (sanity: the file server actually
+  rejects unknown paths instead of returning some default).
+
+Rather than duplicate the mux assembly, factor a tiny helper (or test the
+existing mux). The cleanest move: extract `staticHandler()` from
+[server.go:48-50,68](../../go/internal/web/server.go#L48-L68) into a small
+exported-from-package function or just `staticFS` / `fs.Sub` helper, and
+have the test call it. Smallest delta: keep production code unchanged and
+replicate the two-line wiring inside the test file (acceptable — it's
+two lines and the test exists precisely to lock that contract).
+
+### 2. Manual / one-shot verification (no code; documented in plan only)
+
+Run once locally and tick M6.7. Command transcript:
+
+```bash
+make go-build                  # → ./bin/fuj
+cp bin/fuj /tmp/fuj-standalone
+cd /tmp                        # working dir has no templates/ or static/
+./fuj-standalone server &
+SERVER_PID=$!
+sleep 1
+curl -sf http://localhost:8080/adults | grep -q "Adults Dashboard"
+curl -sf http://localhost:8080/juniors | grep -q "Juniors"
+curl -sf http://localhost:8080/payments | grep -q "Payments Ledger"
+curl -sf -o /tmp/app.css http://localhost:8080/static/css/app.css \
+  && test -s /tmp/app.css
+curl -sf -o /tmp/qr.js http://localhost:8080/static/js/payment-qr.js \
+  && test -s /tmp/qr.js
+kill $SERVER_PID
+```
+
+`fuj server` will fail to talk to Sheets without credentials, so the
+`/adults` etc. pages will render with the `Error` field set — that's
+fine; the assertion is that the **template + static asset pipeline** is
+self-contained, not that data loads. Each curl above only checks for
+markup present in every render path (header text and stylesheet body).
+
+### 3. Tracker + changelog
+
+- Tick `M6.7` in
+  [docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md:120](2026-05-03-2349-go-backend-rewrite-progress.md#L120),
+  append the merge SHA on the line.
+- Mark "Last updated" date and bump milestone status: M6 complete, next is
+  M7.
+- Append a `CHANGELOG.md` entry per CLAUDE.md convention (`date "+%Y-%m-%d %H:%M %Z"`).
+
+## Files touched
+
+| File | Change |
+| --- | --- |
+| [go/internal/web/assets_test.go](../../go/internal/web/assets_test.go) | **new** — two tests (embed completeness + `/static/*` mux) |
+| [docs/plans/2026-05-03-2349-go-backend-rewrite-progress.md](2026-05-03-2349-go-backend-rewrite-progress.md) | tick M6.7, bump "last updated" |
+| [CHANGELOG.md](../../CHANGELOG.md) | new top entry |
+
+No production source files change. (If extracting the static handler
+reads cleaner, a 4-line refactor in
+[server.go](../../go/internal/web/server.go) is acceptable but optional.)
+
+## Branch + MR
+
+Per project convention this is a feature, so:
+
+```bash
+git checkout -b feat/go-m6-7-embed-verify
+# … commits …
+git push -u origin feat/go-m6-7-embed-verify
+tea pr create --title "feat(go): M6.7 — single-binary embed verification" \
+  --description "<short body referencing M6.7>" --base main \
+  --head feat/go-m6-7-embed-verify
+```
+
+## Verification
+
+After implementation:
+
+1. `make go-test` → green (new `TestEmbedCompleteness` and `TestStaticAssetsServed` pass).
+2. `make go-lint` → clean.
+3. Run the manual transcript in §2 above — all curls succeed, no
+   "template not found" or 404 on static assets.
+4. `make go-build && docker build -f go/build/Dockerfile -t fuj-go:m6-7 go/` →
+   succeeds; `docker run --rm -p 8080:8080 fuj-go:m6-7` serves `/adults`
+   with stylesheet attached (visual smoke test in browser).
+
+## Out of scope
+
+- Re-architecting how templates are parsed or served.
+- Compressing / fingerprinting static assets (a separate concern).
+- Live integration test with real Sheets data — covered later in M7.

docs/plans/2026-05-11-2353-fill-first-multi-month-allocation.md

@@ -0,0 +1,184 @@
+# Fill-first multi-month payment allocation
+
+## Context
+
+Matyáš Thér paid in two transactions:
+
+| # | Amount | Purpose             |
+|---|--------|---------------------|
+| 1 | 200    | `2026-02`           |
+| 2 | 550    | `2026-02, 2026-03`  |
+
+Total 750 = his expected fee for the two months (likely 2026-02 = 500, 2026-03 = 250 — junior tier or exception-adjusted). The app currently shows 2026-02 = **566** paid, 2026-03 = **183** paid. The user wants:
+
+> First use the second payment for the rest of 2026-02 (no more, no less), then put the remainder toward 2026-03.
+
+Both Python ([scripts/match_payments.py](scripts/match_payments.py)) and Go ([go/internal/domain/reconcile/reconcile.go](go/internal/domain/reconcile/reconcile.go)) have the same bug: when a single transaction's `in_window_share` is less than the sum of in-window expected fees, both fall into a **proportional** branch that splits the new transaction across months in proportion to each month's *total* expected fee — never consulting what prior transactions already paid into earlier months.
+
+Trace for txn 2:
+
+- `in_window = [(2026-02, 500), (2026-03, 250)]`, `total_expected = 750`, `in_window_share = 550`.
+- `550 < 750` → proportional:
+  - 02 alloc = `550 × 500 / 750 = 366.67`
+  - 03 alloc = `550 − 366.67 = 183.33`
+- Combined with txn 1's 200 → 02 = 566.67, 03 = 183.33 → display `566 / 183`. ✓ matches reported numbers.
+
+The fix: replace the greedy + proportional branches with a single **fill-first** loop that iterates `in_window` in user-supplied order (already chronological by convention from [scripts/infer_payments.py:151](scripts/infer_payments.py#L151)) and allocates `min(remaining, max(0, expected − paid_so_far))` to each month, with any final surplus going to the credit bucket. This collapses three cases (greedy / proportional / pure overflow) into one and naturally consults the ledger's `paid` field which is already updated by prior transactions in the same reconcile pass.
+
+The even-split branch (`total_expected == 0`, prepayment before fees known) stays untouched — different semantic, folding it in would silently change behavior.
+
+## Changes
+
+### Python — [scripts/match_payments.py:471-498](scripts/match_payments.py#L471-L498)
+
+Replace both `total_expected > 0` branches (current lines 471–498) with a single unified loop. Keep lines 466–469 above and the even-split fallback below (lines 499–510) as-is.
+
+```python
+            if total_expected > 0:
+                # Fill-first: iterate in_window in matched_months order (chronological by
+                # convention), allocate min(remaining, deficit) to each month, where
+                # deficit accounts for prior transactions already credited to that month.
+                # Any surplus after all in-window deficits are covered → credit bucket.
+                remaining = in_window_share
+                for m, exp in in_window:
+                    paid_so_far = ledger[member_name][m]["paid"]
+                    deficit = max(0.0, float(exp) - paid_so_far)
+                    alloc = min(remaining, deficit)
+                    if alloc <= 0:
+                        continue
+                    ledger[member_name][m]["paid"] += alloc
+                    ledger[member_name][m]["transactions"].append({
+                        "amount": alloc,
+                        "date": tx["date"],
+                        "sender": tx["sender"],
+                        "message": tx["message"],
+                        "confidence": confidence,
+                    })
+                    remaining -= alloc
+                if remaining > 0:
+                    credits[member_name] = credits.get(member_name, 0) + int(remaining)
+            else:
+                # … existing even-split branch (lines 499–510) unchanged …
+```
+
+Note: skipping the `transactions.append` when `alloc <= 0` (e.g. month already fully paid by a prior txn) avoids zero-amount ghost rows in the per-month transaction list. This is a small UI-visible side effect; before committing, grep tests for assertions on `len(transactions)` per month to confirm nothing relies on the current "one row per (txn, month) regardless of alloc" behavior.
+
+### Go — [go/internal/domain/reconcile/reconcile.go:320-357](go/internal/domain/reconcile/reconcile.go#L320-L357)
+
+Same shape — replace both `totalExpected > 0` branches. Even-split branch (lines 358–372) stays.
+
+```go
+            if totalExpected > 0 {
+                // Fill-first; see Python reconcile() for rationale.
+                remaining := inWindowShare
+                for _, mw := range inWindow {
+                    md := ledger[memberName][mw.month]
+                    deficit := float64(mw.expected) - md.Paid
+                    if deficit < 0 {
+                        deficit = 0
+                    }
+                    alloc := remaining
+                    if deficit < alloc {
+                        alloc = deficit
+                    }
+                    if alloc <= 0 {
+                        continue
+                    }
+                    md.Paid += alloc
+                    md.Transactions = append(md.Transactions, TxEntry{
+                        Amount:     alloc,
+                        Date:       tx.Date,
+                        Sender:     tx.Sender,
+                        Message:    tx.Message,
+                        Confidence: string(m.Confidence),
+                    })
+                    ledger[memberName][mw.month] = md
+                    remaining -= alloc
+                }
+                if remaining > 0 {
+                    credits[memberName] += int(remaining)
+                }
+            } else {
+                // … existing even-split branch (lines 358–372) unchanged …
+            }
+```
+
+### Tests
+
+#### Python — [tests/test_reconcile_exceptions.py](tests/test_reconcile_exceptions.py)
+
+1. **Rewrite `test_proportional_underpayment`** ([line 96](tests/test_reconcile_exceptions.py#L96)) — its current assertions (`paid_02 < 750`, `paid_03 < 350`, `paid_04 < 750`, and 02/04 equal allocation) are incompatible with fill-first. Under fill-first with the same fixture (1250 across `02:750, 03:350, 04:750`):
+   - 02: `min(1250, 750) = 750` (full) → remaining 500
+   - 03: `min(500, 350) = 350` (full) → remaining 150
+   - 04: `min(150, 750) = 150` (partial) → remaining 0
+   
+   Replace assertions with these exact expected values, rename to `test_underpayment_fills_earliest_first`.
+
+2. **Add `test_fill_first_across_two_transactions`** — the Matyáš regression:
+
+   ```python
+   def test_fill_first_across_two_transactions(self):
+       """Prior txn fills 02 partially; later txn finishes 02 then spills to 03."""
+       members = [('Matyáš', 'A', {'2026-02': (500, 2), '2026-03': (250, 1)})]
+       sorted_months = ['2026-02', '2026-03']
+       tx1 = _tx('Matyáš', '2026-02', 200)
+       tx2 = _tx('Matyáš', '2026-02, 2026-03', 550)
+
+       result = reconcile(members, sorted_months, [tx1, tx2])
+       months = result['members']['Matyáš']['months']
+
+       self.assertAlmostEqual(months['2026-02']['paid'], 500, places=2)
+       self.assertAlmostEqual(months['2026-03']['paid'], 250, places=2)
+   ```
+
+3. `test_greedy_exact_match`, `test_greedy_overpayment_goes_to_credit`, `test_single_month_unchanged`, `test_two_members_multi_month` should pass unchanged — fill-first agrees with greedy when payment ≥ total expected.
+
+#### Go — [go/internal/domain/reconcile/reconcile_test.go](go/internal/domain/reconcile/reconcile_test.go)
+
+- Add `TestUnderpaymentFillsEarliestFirst` mirroring the rewritten Python test.
+- Add `TestFillFirstAcrossTwoTransactions` mirroring the Matyáš scenario.
+
+#### Parity — [go/tests/parity/reconcile/reconcile_parity_test.go](go/tests/parity/reconcile/reconcile_parity_test.go)
+
+Add a fixture for the Matyáš two-transaction case. Since both implementations change together and Python remains canonical, existing parity fixtures should continue to pass; verify after edits.
+
+### Changelog — [CHANGELOG.md](CHANGELOG.md)
+
+Append top entry (use `date "+%Y-%m-%d %H:%M %Z"` at commit time):
+
+```markdown
+## 2026-05-11 23:55 CET — fill-first multi-month payment allocation
+
+- Multi-month payment allocation now fills the earliest in-window deficit first
+  and spills the remainder to later months, accounting for prior transactions'
+  contributions. Previously a single transaction was split proportionally to
+  each month's total expected fee, ignoring earlier payments — surfaced by
+  Matyáš Thér's two-payment 200+550 case showing 566/183 instead of 500/250.
+- scripts/match_payments.py, go/internal/domain/reconcile/reconcile.go, tests.
+```
+
+## Critical files
+
+- [scripts/match_payments.py](scripts/match_payments.py) — Python reconcile (canonical)
+- [go/internal/domain/reconcile/reconcile.go](go/internal/domain/reconcile/reconcile.go) — Go reconcile (mirrors Python)
+- [tests/test_reconcile_exceptions.py](tests/test_reconcile_exceptions.py) — rewrite `test_proportional_underpayment` + add Matyáš test
+- [go/internal/domain/reconcile/reconcile_test.go](go/internal/domain/reconcile/reconcile_test.go) — add Go tests
+- [go/tests/parity/reconcile/reconcile_parity_test.go](go/tests/parity/reconcile/reconcile_parity_test.go) — add parity fixture
+- [CHANGELOG.md](CHANGELOG.md) — top entry
+
+## Verification
+
+1. `make test` — Python unit tests including the rewritten + new fill-first tests.
+2. `cd go && go test ./internal/domain/reconcile/... ./tests/parity/reconcile/...` — Go unit + parity tests.
+3. `make web` → load `/adults` or `/juniors` (whichever lists Matyáš Thér) → his 2026-02 row should be fully paid (no shortfall), 2026-03 fully paid, no leftover credit.
+4. Spot-check one other multi-month-purpose member to make sure fully-covered cases still look right.
+
+## Branch & MR (per CLAUDE.md)
+
+1. `git checkout -b fix/fill-first-multi-month-allocation`
+2. Apply edits + tests + CHANGELOG entry.
+3. `make test && (cd go && go test ./...)` — both green.
+4. Commit: `fix(reconcile): fill earliest month deficit first in multi-month allocations` with `Co-Authored-By` trailer.
+5. `git push -u origin fix/fill-first-multi-month-allocation`
+6. `tea pr create --title "fix(reconcile): fill earliest month deficit first" --description "<body>" --base main --head fix/fill-first-multi-month-allocation`
+7. Print MR URL. Do not merge from CLI.

go/cmd/fuj/main.go

@@ -11,6 +11,7 @@ import (
 	"fuj-management/go/internal/services/banksync"
 	"fuj-management/go/internal/services/membership"
 	"fuj-management/go/internal/web"
+	"io"
 	"log/slog"
 	"os"
 	"time"
@@ -82,9 +83,40 @@ func serverCmd(args []string) {
 		os.Exit(1)
 	}
 
+	sheetsCli, err := sheets.New(ctx, cfg.CredentialsPath, cfg.DriveTimeout)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "fuj server: sheets client for sync: %v\n", err)
+		os.Exit(1)
+	}
+	fioCli := fio.New(cfg.FioAPIToken, config.IBANAccountNum(cfg.BankAccount), nil)
+
+	actions := web.ActionHandlers{
+		BankSync: func(ctx context.Context, out io.Writer) error {
+			yr := time.Now().Year()
+			from := time.Date(yr, 1, 1, 0, 0, 0, 0, time.UTC)
+			to := time.Date(yr, 12, 31, 23, 59, 59, 0, time.UTC)
+
+			fmt.Fprintln(out, "=== Sync Fio Transactions ===")
+			n, err := banksync.SyncToSheets(ctx, config.PaymentsSheetID, fioCli, sheetsCli,
+				banksync.SyncOpts{From: from, To: to, Sort: true})
+			if err != nil {
+				return fmt.Errorf("sync: %w", err)
+			}
+			fmt.Fprintf(out, "Synced %d new transaction(s).\n\n", n)
+
+			fmt.Fprintln(out, "=== Infer Payments ===")
+			n, err = banksync.InferPayments(ctx, config.PaymentsSheetID, sheetsCli, sources, banksync.InferOpts{})
+			if err != nil {
+				return fmt.Errorf("infer: %w", err)
+			}
+			fmt.Fprintf(out, "Inferred %d row(s).\n", n)
+			return nil
+		},
+	}
+
 	build := web.BuildInfo{Version: version, Commit: commit, BuildDate: buildDate}
 
-	if err := web.Run(logger, cfg.ServerAddr, build, sources, cfg); err != nil {
+	if err := web.Run(logger, cfg.ServerAddr, build, sources, cfg, actions); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}

go/go.mod

@@ -5,6 +5,7 @@ go 1.26.1
 require (
 	github.com/google/go-cmp v0.7.0
 	github.com/invopop/jsonschema v0.14.0
+	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	golang.org/x/net v0.53.0
 	golang.org/x/text v0.36.0
 	google.golang.org/api v0.278.0

go/go.sum

@@ -37,6 +37,8 @@ github.com/pb33f/ordered-map/v2 v2.3.1 h1:5319HDO0aw4DA4gzi+zv4FXU9UlSs3xGZ40wcP
 github.com/pb33f/ordered-map/v2 v2.3.1/go.mod h1:qxFQgd0PkVUtOMCkTapqotNgzRhMPL7VvaHKbd1HnmQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
+github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=

go/internal/domain/reconcile/reconcile.go

@@ -115,10 +115,11 @@ type monthExpected struct {
 	expected int
 }
 
-// Reconcile matches transactions to members and months using three allocation phases:
-//  1. Greedy: payment ≥ total expected → fill each month exactly; overflow → credit.
-//  2. Proportional: payment < total → distribute by each month's share; last absorbs float remainder.
-//  3. Even-split fallback: all expected fees are 0 (prepayment) → divide equally.
+// Reconcile matches transactions to members and months using two allocation phases:
+//  1. Fill-first: iterate matched months in user-supplied order, allocating min(remaining,
+//     deficit) to each month where deficit = expected − already-paid. Surplus → credit.
+//     Handles both the "greedy" (payment covers all) and "partial" cases in one pass.
+//  2. Even-split fallback: all expected fees are 0 (prepayment) → divide equally.
 //
 // defaultYear seeds czech.ParseMonthReferences in the inference fallback.
 // Pass time.Now().Year() in production; pass a fixed year in tests.
@@ -317,34 +318,26 @@ func Reconcile(
 				totalExpected += mw.expected
 			}
 
-			if totalExpected > 0 && inWindowShare >= float64(totalExpected) {
-				// Greedy: payment covers all expected fees; overflow → credit
-				credits[memberName] += int(inWindowShare - float64(totalExpected))
-				for _, mw := range inWindow {
-					alloc := float64(mw.expected)
-					md := ledger[memberName][mw.month]
-					md.Paid += alloc
-					md.Transactions = append(md.Transactions, TxEntry{
-						Amount:     alloc,
-						Date:       tx.Date,
-						Sender:     tx.Sender,
-						Message:    tx.Message,
-						Confidence: string(m.Confidence),
-					})
-					ledger[memberName][mw.month] = md
-				}
-			} else if totalExpected > 0 {
-				// Proportional: distribute by each month's share; last month absorbs float remainder
+			if totalExpected > 0 {
+				// Fill-first: iterate inWindow in matched-months order (chronological by
+				// convention), allocating min(remaining, deficit) to each month. Deficit
+				// is net of what prior transactions already paid, so a second payment on
+				// the same months correctly fills only what remains due. Any surplus after
+				// all deficits are covered goes to the credit bucket.
 				remaining := inWindowShare
-				for i, mw := range inWindow {
-					var alloc float64
-					if i == len(inWindow)-1 {
-						alloc = remaining
-					} else {
-						alloc = inWindowShare * float64(mw.expected) / float64(totalExpected)
-					}
-					remaining -= alloc
+				for _, mw := range inWindow {
 					md := ledger[memberName][mw.month]
+					deficit := float64(mw.expected) - md.Paid
+					if deficit < 0 {
+						deficit = 0
+					}
+					alloc := remaining
+					if deficit < alloc {
+						alloc = deficit
+					}
+					if alloc <= 0 {
+						continue
+					}
 					md.Paid += alloc
 					md.Transactions = append(md.Transactions, TxEntry{
 						Amount:     alloc,
@@ -354,6 +347,10 @@ func Reconcile(
 						Confidence: string(m.Confidence),
 					})
 					ledger[memberName][mw.month] = md
+					remaining -= alloc
+				}
+				if remaining > 0 {
+					credits[memberName] += int(remaining)
 				}
 			} else {
 				// Even-split fallback: prepayment before attendance recorded

go/internal/domain/reconcile/reconcile_test.go

@@ -111,36 +111,26 @@ func TestReconcileGreedyOverpaymentGoesToCredit(t *testing.T) {
 	}
 }
 
-func TestReconcileProportionalUnderpayment(t *testing.T) {
+func TestReconcileUnderpaymentFillsEarliestFirst(t *testing.T) {
 	t.Parallel()
 	members := []Member{{
 		Name: "Alice", Tier: "A",
 		Fees: map[string]FeeData{"2026-02": {Expected: 750, Attendance: 3}, "2026-03": {Expected: 350, Attendance: 3}, "2026-04": {Expected: 750, Attendance: 3}},
 	}}
 	sortedMonths := []string{"2026-02", "2026-03", "2026-04"}
-	amount := 1250.0
 
-	result := Reconcile(members, sortedMonths, []Transaction{tx("Alice", "2026-02, 2026-03, 2026-04", amount)}, nil, defaultYear)
+	result := Reconcile(members, sortedMonths, []Transaction{tx("Alice", "2026-02, 2026-03, 2026-04", 1250)}, nil, defaultYear)
 
 	months := result.Members["Alice"].Months
-	paid02 := months["2026-02"].Paid
-	paid03 := months["2026-03"].Paid
-	paid04 := months["2026-04"].Paid
-
-	if paid02 >= 750 {
-		t.Errorf("2026-02 should be underpaid, got %f", paid02)
+	// 02 filled first (750), then 03 (350), then remainder 150 to 04
+	if math.Abs(months["2026-02"].Paid-750) > 0.01 {
+		t.Errorf("02: want 750, got %f", months["2026-02"].Paid)
 	}
-	if paid03 >= 350 {
-		t.Errorf("2026-03 should be underpaid, got %f", paid03)
+	if math.Abs(months["2026-03"].Paid-350) > 0.01 {
+		t.Errorf("03: want 350, got %f", months["2026-03"].Paid)
 	}
-	if paid04 >= 750 {
-		t.Errorf("2026-04 should be underpaid, got %f", paid04)
-	}
-	if math.Abs(paid02+paid03+paid04-amount) > 0.01 {
-		t.Errorf("sum of paid want %f, got %f", amount, paid02+paid03+paid04)
-	}
-	if math.Abs(paid02-paid04) > 0.01 {
-		t.Errorf("02 and 04 have equal expected, want equal paid: %f vs %f", paid02, paid04)
+	if math.Abs(months["2026-04"].Paid-150) > 0.01 {
+		t.Errorf("04: want 150, got %f", months["2026-04"].Paid)
 	}
 }
 
@@ -374,3 +364,52 @@ func TestReconcileNoTransactionsAllUnpaid(t *testing.T) {
 		t.Errorf("no txs: want empty unmatched, got %v", result.Unmatched)
 	}
 }
+
+// Payment < total expected → fill earliest months first, spill remainder to later.
+func TestUnderpaymentFillsEarliestFirst(t *testing.T) {
+	t.Parallel()
+	members := []Member{{Name: "Alice", Tier: "A", Fees: map[string]FeeData{
+		"2026-02": {Expected: 750, Attendance: 3},
+		"2026-03": {Expected: 350, Attendance: 3},
+		"2026-04": {Expected: 750, Attendance: 3},
+	}}}
+	txs := []Transaction{tx("Alice", "2026-02, 2026-03, 2026-04", 1250)}
+
+	result := Reconcile(members, []string{"2026-02", "2026-03", "2026-04"}, txs, nil, defaultYear)
+	months := result.Members["Alice"].Months
+
+	// 02 filled first (750), then 03 (350), then remainder 150 to 04
+	if math.Abs(months["2026-02"].Paid-750) > 0.01 {
+		t.Errorf("02: want 750, got %f", months["2026-02"].Paid)
+	}
+	if math.Abs(months["2026-03"].Paid-350) > 0.01 {
+		t.Errorf("03: want 350, got %f", months["2026-03"].Paid)
+	}
+	if math.Abs(months["2026-04"].Paid-150) > 0.01 {
+		t.Errorf("04: want 150, got %f", months["2026-04"].Paid)
+	}
+}
+
+// Prior txn fills 02 partially; later txn finishes 02 then spills to 03.
+func TestFillFirstAcrossTwoTransactions(t *testing.T) {
+	t.Parallel()
+	members := []Member{{Name: "Matyáš", Tier: "A", Fees: map[string]FeeData{
+		"2026-02": {Expected: 500, Attendance: 2},
+		"2026-03": {Expected: 250, Attendance: 1},
+	}}}
+	sortedMonths := []string{"2026-02", "2026-03"}
+	txs := []Transaction{
+		tx("Matyáš", "2026-02", 200),
+		tx("Matyáš", "2026-02, 2026-03", 550),
+	}
+
+	result := Reconcile(members, sortedMonths, txs, nil, defaultYear)
+	months := result.Members["Matyáš"].Months
+
+	if math.Abs(months["2026-02"].Paid-500) > 0.01 {
+		t.Errorf("02: want 500, got %f", months["2026-02"].Paid)
+	}
+	if math.Abs(months["2026-03"].Paid-250) > 0.01 {
+		t.Errorf("03: want 250, got %f", months["2026-03"].Paid)
+	}
+}

go/internal/services/membership/loader.go

@@ -25,11 +25,17 @@ type ExceptionLoader interface {
 	LoadExceptions(ctx context.Context) (map[reconcile.ExceptionKey]reconcile.Exception, error)
 }
 
+// CacheFlusher can invalidate all cached data.
+type CacheFlusher interface {
+	FlushCache() (int, error)
+}
+
 // Sources is the aggregate interface required by ReconcileReport.
 type Sources interface {
 	AttendanceLoader
 	TransactionLoader
 	ExceptionLoader
+	CacheFlusher
 }
 
 // NewStubSources returns a Sources whose every method returns ErrIOPending.
@@ -52,3 +58,5 @@ func (stubSources) LoadTransactions(_ context.Context) ([]reconcile.Transaction,
 func (stubSources) LoadExceptions(_ context.Context) (map[reconcile.ExceptionKey]reconcile.Exception, error) {
 	return nil, ErrIOPending
 }
+
+func (stubSources) FlushCache() (int, error) { return 0, nil }

go/internal/services/membership/reconcile_test.go

@@ -31,6 +31,8 @@ func (f fakeSources) LoadExceptions(_ context.Context) (map[reconcile.ExceptionK
 	return f.exceptions, nil
 }
 
+func (fakeSources) FlushCache() (int, error) { return 0, nil }
+
 func TestReconcileReport(t *testing.T) {
 	t.Parallel()
 	s := fakeSources{

go/internal/services/membership/sources.go

@@ -111,6 +111,9 @@ func (s *realSources) LoadTransactions(ctx context.Context) ([]reconcile.Transac
 	return parseTransactionRows(rows)
 }
 
+// FlushCache deletes all cached data files and resets in-memory cache state.
+func (s *realSources) FlushCache() (int, error) { return s.cache.Flush() }
+
 // LoadExceptions fetches the exceptions tab (cached).
 func (s *realSources) LoadExceptions(ctx context.Context) (map[reconcile.ExceptionKey]reconcile.Exception, error) {
 	rows, err := cache.Get(ctx, s.cache, "exceptions_dict",

go/internal/web/api/handler.go

@@ -23,6 +23,9 @@ type Handler struct {
 	Logger       *slog.Logger
 }
 
+// FlushCache invalidates all cached data via the underlying Sources.
+func (h *Handler) FlushCache() (int, error) { return h.Sources.FlushCache() }
+
 // ServeVersion handles GET /api/version.
 func (h *Handler) ServeVersion(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, VersionResponse{

go/internal/web/assets_test.go

@@ -0,0 +1,93 @@
+package web
+
+import (
+	"io/fs"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+)
+
+// TestEmbedCompleteness guards against a new template or static file being
+// added to disk but missing from the embedded FS (e.g. a new directory that
+// the //go:embed glob does not match).
+func TestEmbedCompleteness(t *testing.T) {
+	cases := []struct {
+		name      string
+		diskDir   string
+		embedFS   fs.FS
+		embedRoot string
+	}{
+		{"templates", "templates", templateFS, "templates"},
+		{"static", "static", staticFS, "static"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			diskFS := os.DirFS(tc.diskDir)
+			_ = fs.WalkDir(diskFS, ".", func(path string, d fs.DirEntry, err error) error {
+				if err != nil || d.IsDir() {
+					return err
+				}
+				embPath := tc.embedRoot + "/" + path
+				if _, statErr := fs.Stat(tc.embedFS, embPath); statErr != nil {
+					t.Errorf("file %q exists on disk but is missing from embed.FS (%v)", embPath, statErr)
+				}
+				return nil
+			})
+		})
+	}
+}
+
+// TestStaticAssetsServed verifies that /static/* is served from the embedded
+// FS through the same mux wiring used in server.go, so a standalone binary
+// with no adjacent static/ directory still delivers assets.
+func TestStaticAssetsServed(t *testing.T) {
+	subFS, err := fs.Sub(staticFS, "static")
+	if err != nil {
+		t.Fatalf("fs.Sub static: %v", err)
+	}
+	mux := http.NewServeMux()
+	mux.Handle("/static/", http.StripPrefix("/static/", http.FileServerFS(subFS)))
+
+	cases := []struct {
+		path        string
+		wantCT      string
+		wantSnippet string
+	}{
+		{"/static/css/app.css", "text/css", "body {"},
+		{"/static/js/member-detail.js", "javascript", "Member-detail modal"},
+		{"/static/js/filters.js", "javascript", ""},
+		{"/static/js/payment-qr.js", "javascript", ""},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.path, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, tc.path, nil)
+			w := httptest.NewRecorder()
+			mux.ServeHTTP(w, req)
+
+			if w.Code != http.StatusOK {
+				t.Fatalf("GET %s: status %d, want 200", tc.path, w.Code)
+			}
+			ct := w.Header().Get("Content-Type")
+			if !strings.Contains(ct, tc.wantCT) {
+				t.Errorf("GET %s: Content-Type %q, want it to contain %q", tc.path, ct, tc.wantCT)
+			}
+			if tc.wantSnippet != "" && !strings.Contains(w.Body.String(), tc.wantSnippet) {
+				t.Errorf("GET %s: body missing expected snippet %q", tc.path, tc.wantSnippet)
+			}
+		})
+	}
+
+	// Sanity: unknown path → 404 (file server doesn't fall through silently)
+	t.Run("missing-file", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodGet, "/static/css/nonexistent.css", nil)
+		w := httptest.NewRecorder()
+		mux.ServeHTTP(w, req)
+		if w.Code != http.StatusNotFound {
+			t.Errorf("unknown static path: status %d, want 404", w.Code)
+		}
+	})
+}

go/internal/web/html_handler.go

@@ -1,8 +1,11 @@
 package web
 
 import (
+	"bytes"
+	"fmt"
 	"fuj-management/go/internal/web/api"
 	"net/http"
+	"runtime/debug"
 )
 
 // HTMLHandler serves the Go-native HTML frontend.
@@ -10,11 +13,12 @@ type HTMLHandler struct {
 	renderer   *Renderer
 	build      BuildInfo
 	apiHandler *api.Handler
+	actions    ActionHandlers
 }
 
 // NewHTMLHandler constructs an HTMLHandler.
-func NewHTMLHandler(r *Renderer, b BuildInfo, ah *api.Handler) *HTMLHandler {
-	return &HTMLHandler{renderer: r, build: b, apiHandler: ah}
+func NewHTMLHandler(r *Renderer, b BuildInfo, ah *api.Handler, actions ActionHandlers) *HTMLHandler {
+	return &HTMLHandler{renderer: r, build: b, apiHandler: ah, actions: actions}
 }
 
 func (h *HTMLHandler) ServeAdults(w http.ResponseWriter, r *http.Request) {
@@ -62,10 +66,78 @@ func (h *HTMLHandler) ServePayments(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// ServeSync handles GET /sync-bank: runs sync+infer+flush then renders the result.
 func (h *HTMLHandler) ServeSync(w http.ResponseWriter, r *http.Request) {
-	h.renderer.Render(w, "sync", PageData{Active: "sync", Build: h.build})
+	pd := PageData{Active: "sync", Build: h.build}
+
+	if h.actions.BankSync == nil {
+		h.renderer.Render(w, "sync", SyncPageData{
+			PageData: pd,
+			Output:   "Bank sync is not configured.",
+			Success:  false,
+		})
+		return
+	}
+
+	var buf bytes.Buffer
+	success := true
+	if err := h.actions.BankSync(r.Context(), &buf); err != nil {
+		fmt.Fprintf(&buf, "\nError: %s\n\nStack trace:\n%s", err.Error(), debug.Stack())
+		success = false
+	}
+
+	fmt.Fprintln(&buf, "\n=== Flush Cache ===")
+	n, err := h.apiHandler.FlushCache()
+	if err != nil {
+		fmt.Fprintf(&buf, "flush error: %s\n", err.Error())
+		success = false
+	} else {
+		fmt.Fprintf(&buf, "%d cache file(s) deleted.\n", n)
+	}
+
+	h.renderer.Render(w, "sync", SyncPageData{
+		PageData: pd,
+		Output:   buf.String(),
+		Success:  success,
+	})
 }
 
-func (h *HTMLHandler) ServeFlushCache(w http.ResponseWriter, r *http.Request) {
-	h.renderer.Render(w, "flush_cache", PageData{Active: "flush", Build: h.build})
+// ServeFlushCacheGET handles GET /flush-cache: renders the confirmation form.
+func (h *HTMLHandler) ServeFlushCacheGET(w http.ResponseWriter, r *http.Request) {
+	h.renderer.Render(w, "flush_cache", FlushPageData{
+		PageData: PageData{Active: "flush", Build: h.build},
+	})
+}
+
+// ServeFlushCachePOST handles POST /flush-cache: flushes and re-renders with count.
+func (h *HTMLHandler) ServeFlushCachePOST(w http.ResponseWriter, r *http.Request) {
+	n, _ := h.apiHandler.FlushCache()
+	h.renderer.Render(w, "flush_cache", FlushPageData{
+		PageData: PageData{Active: "flush", Build: h.build},
+		Flushed:  true,
+		Deleted:  n,
+	})
+}
+
+// ServeQR handles GET /qr: generates and returns a Czech QR Platba PNG.
+func (h *HTMLHandler) ServeQR(w http.ResponseWriter, r *http.Request) {
+	q := r.URL.Query()
+	account := q.Get("account")
+	amount := q.Get("amount")
+	message := q.Get("message")
+	if account == "" {
+		account = h.apiHandler.Config.BankAccount
+	}
+	if amount == "" {
+		amount = "0"
+	}
+
+	payload := BuildSPD(account, amount, message, h.apiHandler.Config.BankAccount)
+	png, err := RenderQRCode(payload)
+	if err != nil {
+		http.Error(w, "qr encode: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "image/png")
+	_, _ = w.Write(png)
 }

go/internal/web/html_handler_test.go

@@ -1,12 +1,15 @@
 package web_test
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"fuj-management/go/internal/config"
 	"fuj-management/go/internal/domain/reconcile"
 	"fuj-management/go/internal/web"
 	"fuj-management/go/internal/web/api"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -41,6 +44,8 @@ func (fixtureSources) LoadExceptions(_ context.Context) (map[reconcile.Exception
 	return nil, nil
 }
 
+func (fixtureSources) FlushCache() (int, error) { return 0, nil }
+
 func fixtureHandler(t *testing.T) *api.Handler {
 	t.Helper()
 	return &api.Handler{
@@ -55,7 +60,7 @@ func TestHTMLHandlerSmoke(t *testing.T) {
 		t.Fatalf("NewRenderer: %v", err)
 	}
 	b := web.BuildInfo{Version: "v0", Commit: "abc1234", BuildDate: "2026-01-01"}
-	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t))
+	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t), web.ActionHandlers{})
 
 	cases := []struct {
 		path    string
@@ -65,7 +70,7 @@ func TestHTMLHandlerSmoke(t *testing.T) {
 		{"/juniors", h.ServeJuniors},
 		{"/payments", h.ServePayments},
 		{"/sync-bank", h.ServeSync},
-		{"/flush-cache", h.ServeFlushCache},
+		{"/flush-cache", h.ServeFlushCacheGET},
 	}
 
 	for _, tc := range cases {
@@ -99,7 +104,7 @@ func TestAdultsPage(t *testing.T) {
 		t.Fatalf("NewRenderer: %v", err)
 	}
 	b := web.BuildInfo{Version: "v0", Commit: "abc1234", BuildDate: "2026-01-01"}
-	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t))
+	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t), web.ActionHandlers{})
 
 	req := httptest.NewRequest(http.MethodGet, "/adults", nil)
 	w := httptest.NewRecorder()
@@ -133,7 +138,7 @@ func TestModalMarkup(t *testing.T) {
 		t.Fatalf("NewRenderer: %v", err)
 	}
 	b := web.BuildInfo{Version: "v0", Commit: "abc1234", BuildDate: "2026-01-01"}
-	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t))
+	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t), web.ActionHandlers{})
 
 	cases := []struct {
 		path    string
@@ -174,7 +179,7 @@ func TestPaymentsPage(t *testing.T) {
 		t.Fatalf("NewRenderer: %v", err)
 	}
 	b := web.BuildInfo{Version: "v0", Commit: "abc1234", BuildDate: "2026-01-01"}
-	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t))
+	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t), web.ActionHandlers{})
 
 	req := httptest.NewRequest(http.MethodGet, "/payments", nil)
 	w := httptest.NewRecorder()
@@ -198,3 +203,181 @@ func TestPaymentsPage(t *testing.T) {
 		}
 	}
 }
+
+func TestServeQR(t *testing.T) {
+	renderer, err := web.NewRenderer()
+	if err != nil {
+		t.Fatalf("NewRenderer: %v", err)
+	}
+	b := web.BuildInfo{Version: "v0", Commit: "abc1234", BuildDate: "2026-01-01"}
+	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t), web.ActionHandlers{})
+
+	req := httptest.NewRequest(http.MethodGet, "/qr?account=2702008874%2F2010&amount=700&message=Test", nil)
+	w := httptest.NewRecorder()
+	h.ServeQR(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+	if ct := w.Header().Get("Content-Type"); ct != "image/png" {
+		t.Errorf("Content-Type = %q, want image/png", ct)
+	}
+	// PNG magic bytes: \x89PNG\r\n\x1a\n
+	magic := []byte{0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a}
+	body := w.Body.Bytes()
+	if len(body) < len(magic) || !bytes.Equal(body[:len(magic)], magic) {
+		t.Error("response body does not start with PNG magic bytes")
+	}
+}
+
+func TestServeFlushCacheGET(t *testing.T) {
+	renderer, err := web.NewRenderer()
+	if err != nil {
+		t.Fatalf("NewRenderer: %v", err)
+	}
+	b := web.BuildInfo{Version: "v0", Commit: "abc1234", BuildDate: "2026-01-01"}
+	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t), web.ActionHandlers{})
+
+	req := httptest.NewRequest(http.MethodGet, "/flush-cache", nil)
+	w := httptest.NewRecorder()
+	h.ServeFlushCacheGET(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+	body := w.Body.String()
+	if !strings.Contains(body, "Flush Cache") {
+		t.Error("body missing Flush Cache heading")
+	}
+	if strings.Contains(body, "file(s) deleted") {
+		t.Error("GET should not show deleted count")
+	}
+}
+
+func TestServeFlushCachePOST(t *testing.T) {
+	renderer, err := web.NewRenderer()
+	if err != nil {
+		t.Fatalf("NewRenderer: %v", err)
+	}
+	b := web.BuildInfo{Version: "v0", Commit: "abc1234", BuildDate: "2026-01-01"}
+	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t), web.ActionHandlers{})
+
+	req := httptest.NewRequest(http.MethodPost, "/flush-cache", nil)
+	w := httptest.NewRecorder()
+	h.ServeFlushCachePOST(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+	body := w.Body.String()
+	// fixtureSources.FlushCache returns 0
+	if !strings.Contains(body, "file(s) deleted") {
+		t.Error("POST should show deleted count")
+	}
+}
+
+func TestServeSync(t *testing.T) {
+	renderer, err := web.NewRenderer()
+	if err != nil {
+		t.Fatalf("NewRenderer: %v", err)
+	}
+	b := web.BuildInfo{Version: "v0", Commit: "abc1234", BuildDate: "2026-01-01"}
+
+	actions := web.ActionHandlers{
+		BankSync: func(_ context.Context, out io.Writer) error {
+			fmt.Fprintln(out, "=== Sync Fio Transactions ===")
+			fmt.Fprintln(out, "Synced 3 new transaction(s).")
+			fmt.Fprintln(out, "=== Infer Payments ===")
+			fmt.Fprintln(out, "Inferred 2 row(s).")
+			return nil
+		},
+	}
+	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t), actions)
+
+	req := httptest.NewRequest(http.MethodGet, "/sync-bank", nil)
+	w := httptest.NewRecorder()
+	h.ServeSync(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+	body := w.Body.String()
+	for _, want := range []string{
+		"Sync Bank Data",
+		"Synced 3 new transaction(s).",
+		"Inferred 2 row(s).",
+		"Flush Cache",
+	} {
+		if !strings.Contains(body, want) {
+			t.Errorf("body missing %q", want)
+		}
+	}
+}
+
+func TestPaymentQRMarkup(t *testing.T) {
+	renderer, err := web.NewRenderer()
+	if err != nil {
+		t.Fatalf("NewRenderer: %v", err)
+	}
+	b := web.BuildInfo{Version: "v0", Commit: "abc1234", BuildDate: "2026-01-01"}
+	h := web.NewHTMLHandler(renderer, b, fixtureHandler(t), web.ActionHandlers{})
+
+	cases := []struct {
+		path    string
+		handler http.HandlerFunc
+	}{
+		{"/adults", h.ServeAdults},
+		{"/juniors", h.ServeJuniors},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.path, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, tc.path, nil)
+			w := httptest.NewRecorder()
+			tc.handler(w, req)
+			body := w.Body.String()
+
+			for _, want := range []string{
+				`id="qrModal"`,
+				`id="qrImg"`,
+				`id="qrTitle"`,
+				`id="qrAccount"`,
+				`id="qrAmount"`,
+				`id="qrMessage"`,
+				`/static/js/payment-qr.js`,
+				`data-bank-account="CZ0000000000000000000000"`,
+			} {
+				if !strings.Contains(body, want) {
+					t.Errorf("body missing %q", want)
+				}
+			}
+
+			// Pay buttons must use <button>, never a bare href to /qr.
+			if strings.Contains(body, `href="/qr`) {
+				t.Error("body must not contain href=/qr (Pay buttons should be <button>, not <a>)")
+			}
+		})
+	}
+}
+
+func TestServeVersion(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, "/api/version", nil)
+	w := httptest.NewRecorder()
+	fixtureHandler(t).ServeVersion(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+	if ct := w.Header().Get("Content-Type"); !strings.HasPrefix(ct, "application/json") {
+		t.Errorf("Content-Type = %q, want application/json", ct)
+	}
+	var raw map[string]json.RawMessage
+	if err := json.NewDecoder(w.Body).Decode(&raw); err != nil {
+		t.Fatalf("decode JSON: %v", err)
+	}
+	for _, key := range []string{"tag", "commit", "build_date"} {
+		if _, ok := raw[key]; !ok {
+			t.Errorf("JSON response missing key %q", key)
+		}
+	}
+}

go/internal/web/qr.go

@@ -0,0 +1,50 @@
+package web
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+	"unicode/utf8"
+
+	qrcode "github.com/skip2/go-qrcode"
+)
+
+var validAccount = regexp.MustCompile(`^[A-Z]{2}\d{2,34}$|^\d{1,16}/\d{4}$`)
+
+// BuildSPD builds a Czech QR Platba SPD string, matching Python's qr_code handler.
+// Invalid account falls back to defaultAccount.
+// Amount is clamped to [0, 10_000_000]; non-numeric input becomes "0.00".
+// Message is truncated to 60 runes and stripped of '*' characters.
+func BuildSPD(account, amount, message, defaultAccount string) string {
+	if !validAccount.MatchString(account) {
+		account = defaultAccount
+	}
+
+	var amtStr string
+	var f float64
+	if _, err := fmt.Sscanf(amount, "%f", &f); err != nil || f < 0 || f > 10_000_000 {
+		amtStr = "0.00"
+	} else {
+		amtStr = fmt.Sprintf("%.2f", f)
+	}
+
+	if utf8.RuneCountInString(message) > 60 {
+		runes := []rune(message)
+		message = string(runes[:60])
+	}
+	message = strings.ReplaceAll(message, "*", "")
+
+	var accStr string
+	if parts := strings.SplitN(account, "/", 2); len(parts) == 2 {
+		accStr = parts[0] + "*BC:" + parts[1]
+	} else {
+		accStr = account
+	}
+
+	return fmt.Sprintf("SPD*1.0*ACC:%s*AM:%s*CC:CZK*MSG:%s", accStr, amtStr, message)
+}
+
+// RenderQRCode encodes payload as a PNG QR code (256×256, error correction Medium).
+func RenderQRCode(payload string) ([]byte, error) {
+	return qrcode.Encode(payload, qrcode.Medium, 256)
+}

go/internal/web/qr_test.go

@@ -0,0 +1,91 @@
+package web
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestQRBuildSPD(t *testing.T) {
+	const def = "2702008874/2010"
+
+	cases := []struct {
+		name    string
+		account string
+		amount  string
+		message string
+		want    string
+	}{
+		{
+			name:    "czech account",
+			account: "2702008874/2010",
+			amount:  "700",
+			message: "Test Member: 01/2026",
+			want:    "SPD*1.0*ACC:2702008874*BC:2010*AM:700.00*CC:CZK*MSG:Test Member: 01/2026",
+		},
+		{
+			name:    "IBAN account",
+			account: "CZ6508000000192000145399",
+			amount:  "500",
+			message: "hi",
+			want:    "SPD*1.0*ACC:CZ6508000000192000145399*AM:500.00*CC:CZK*MSG:hi",
+		},
+		{
+			name:    "invalid account falls back to default",
+			account: "NOTANACCOUNT",
+			amount:  "100",
+			message: "x",
+			want:    "SPD*1.0*ACC:2702008874*BC:2010*AM:100.00*CC:CZK*MSG:x",
+		},
+		{
+			name:    "empty account falls back to default",
+			account: "",
+			amount:  "0",
+			message: "",
+			want:    "SPD*1.0*ACC:2702008874*BC:2010*AM:0.00*CC:CZK*MSG:",
+		},
+		{
+			name:    "negative amount clamped to 0.00",
+			account: def,
+			amount:  "-1",
+			message: "",
+			want:    "SPD*1.0*ACC:2702008874*BC:2010*AM:0.00*CC:CZK*MSG:",
+		},
+		{
+			name:    "amount over 10M clamped to 0.00",
+			account: def,
+			amount:  "99999999",
+			message: "",
+			want:    "SPD*1.0*ACC:2702008874*BC:2010*AM:0.00*CC:CZK*MSG:",
+		},
+		{
+			name:    "non-numeric amount becomes 0.00",
+			account: def,
+			amount:  "abc",
+			message: "",
+			want:    "SPD*1.0*ACC:2702008874*BC:2010*AM:0.00*CC:CZK*MSG:",
+		},
+		{
+			name:    "asterisks stripped from message",
+			account: def,
+			amount:  "100",
+			message: "pay*now",
+			want:    "SPD*1.0*ACC:2702008874*BC:2010*AM:100.00*CC:CZK*MSG:paynow",
+		},
+		{
+			name:    "message truncated to 60 runes",
+			account: def,
+			amount:  "0",
+			message: strings.Repeat("á", 65),
+			want:    "SPD*1.0*ACC:2702008874*BC:2010*AM:0.00*CC:CZK*MSG:" + strings.Repeat("á", 60),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := BuildSPD(tc.account, tc.amount, tc.message, def)
+			if got != tc.want {
+				t.Errorf("\ngot:  %s\nwant: %s", got, tc.want)
+			}
+		})
+	}
+}

go/internal/web/render.go

@@ -6,8 +6,6 @@ import (
 	"html/template"
 	"log/slog"
 	"net/http"
-	"net/url"
-	"strconv"
 )
 
 // PageData is the view model passed to every HTML template.
@@ -37,6 +35,20 @@ type PaymentsPageData struct {
 	Error string
 }
 
+// SyncPageData is the view model for the /sync-bank HTML page.
+type SyncPageData struct {
+	PageData
+	Output  string
+	Success bool
+}
+
+// FlushPageData is the view model for the /flush-cache HTML page.
+type FlushPageData struct {
+	PageData
+	Flushed bool
+	Deleted int
+}
+
 // Renderer parses and executes HTML templates from the embedded FS.
 type Renderer struct {
 	tmpls map[string]*template.Template
@@ -44,36 +56,7 @@ type Renderer struct {
 
 var pageNames = []string{"adults", "juniors", "payments", "sync", "flush_cache"}
 
-// qrHref builds the /qr query URL for a single-month Pay button.
-// rawMonth is "YYYY-MM"; it is converted to "MM/YYYY" in the QR message.
-func qrHref(account string, amount int, name, rawMonth string) string {
-	// Convert "YYYY-MM" → "MM/YYYY" to match Python's showPayQR JS.
-	if len(rawMonth) == 7 && rawMonth[4] == '-' {
-		rawMonth = rawMonth[5:] + "/" + rawMonth[:4]
-	}
-	msg := name + ": " + rawMonth
-	return "/qr?" + url.Values{
-		"account": {account},
-		"amount":  {strconv.Itoa(amount)},
-		"message": {msg},
-	}.Encode()
-}
-
-// qrHrefAll builds the /qr query URL for a Pay-All button.
-// rawPeriods is the "+" -joined MM/YYYY string from MemberRow.RawUnpaidPeriods.
-func qrHrefAll(account string, amount int, name, rawPeriods string) string {
-	msg := name + ": " + rawPeriods
-	return "/qr?" + url.Values{
-		"account": {account},
-		"amount":  {strconv.Itoa(amount)},
-		"message": {msg},
-	}.Encode()
-}
-
-var tmplFuncs = template.FuncMap{
-	"qrHref":    qrHref,
-	"qrHrefAll": qrHrefAll,
-}
+var tmplFuncs = template.FuncMap{}
 
 // NewRenderer parses all templates from the embedded FS.
 // A parse failure should be treated as a startup-time fatal error.

go/internal/web/server.go

@@ -1,11 +1,13 @@
 package web
 
 import (
+	"context"
 	"fmt"
 	"fuj-management/go/internal/config"
 	"fuj-management/go/internal/services/membership"
 	"fuj-management/go/internal/web/api"
 	"fuj-management/go/internal/web/middleware"
+	"io"
 	"io/fs"
 	"log/slog"
 	"net/http"
@@ -18,8 +20,16 @@ type BuildInfo struct {
 	BuildDate string
 }
 
+// ActionHandlers holds function closures for side-effectful operations that
+// require dependencies (fio, sheets) not present on the core API handler.
+type ActionHandlers struct {
+	// BankSync runs sync+infer and writes a human-readable log to out.
+	// nil disables the /sync-bank action (renders an error instead).
+	BankSync func(ctx context.Context, out io.Writer) error
+}
+
 // Run registers routes and starts the HTTP server on addr.
-func Run(logger *slog.Logger, addr string, build BuildInfo, sources membership.Sources, cfg config.Config) error {
+func Run(logger *slog.Logger, addr string, build BuildInfo, sources membership.Sources, cfg config.Config, actions ActionHandlers) error {
 	renderer, err := NewRenderer()
 	if err != nil {
 		return fmt.Errorf("init templates: %w", err)
@@ -33,7 +43,7 @@ func Run(logger *slog.Logger, addr string, build BuildInfo, sources membership.S
 		Config:       cfg,
 		Logger:       logger,
 	}
-	hh := NewHTMLHandler(renderer, build, ah)
+	hh := NewHTMLHandler(renderer, build, ah, actions)
 
 	staticSubFS, err := fs.Sub(staticFS, "static")
 	if err != nil {
@@ -50,13 +60,16 @@ func Run(logger *slog.Logger, addr string, build BuildInfo, sources membership.S
 	mux.HandleFunc("GET /juniors", hh.ServeJuniors)
 	mux.HandleFunc("GET /payments", hh.ServePayments)
 	mux.HandleFunc("GET /sync-bank", hh.ServeSync)
-	mux.HandleFunc("GET /flush-cache", hh.ServeFlushCache)
+	mux.HandleFunc("GET /flush-cache", hh.ServeFlushCacheGET)
+	mux.HandleFunc("POST /flush-cache", hh.ServeFlushCachePOST)
+	mux.HandleFunc("GET /qr", hh.ServeQR)
 
 	// Static files
 	mux.Handle("/static/", http.StripPrefix("/static/", http.FileServerFS(staticSubFS)))
 
 	// JSON API routes
 	mux.HandleFunc("GET /api/version", ah.ServeVersion)
+	mux.HandleFunc("GET /version", ah.ServeVersion)
 	mux.HandleFunc("GET /api/adults", ah.ServeAdults)
 	mux.HandleFunc("GET /api/juniors", ah.ServeJuniors)
 	mux.HandleFunc("GET /api/payments", ah.ServePayments)

go/internal/web/static/css/app.css

@@ -442,6 +442,23 @@ tr:hover {
 }
 
 /* QR Modal styles */
+#qrModal {
+    display: none !important;
+    position: fixed;
+    top: 0;
+    left: 0;
+    width: 100vw;
+    height: 100vh;
+    background-color: rgba(0, 0, 0, 0.9);
+    z-index: 9999;
+    justify-content: center;
+    align-items: center;
+}
+
+#qrModal.active {
+    display: flex !important;
+}
+
 #qrModal .modal-content {
     max-width: 400px;
     text-align: center;

go/internal/web/static/js/payment-qr.js

@@ -0,0 +1,60 @@
+(function () {
+  'use strict';
+
+  const container = document.getElementById('filterContainer');
+  if (!container) return;
+  const bankAccount = container.dataset.bankAccount || '';
+
+  const modal     = document.getElementById('qrModal');
+  const titleEl   = document.getElementById('qrTitle');
+  const imgEl     = document.getElementById('qrImg');
+  const accountEl = document.getElementById('qrAccount');
+  const amountEl  = document.getElementById('qrAmount');
+  const messageEl = document.getElementById('qrMessage');
+  if (!modal || !titleEl || !imgEl || !accountEl || !amountEl || !messageEl) return;
+
+  // Convert "YYYY-MM" → "MM/YYYY"; "+"-joined ranges converted piece-wise.
+  // Mirrors templates/adults.html showPayQR logic.
+  function toCzechMonth(rawMonth) {
+    return rawMonth.split('+')
+      .map(function (p) { return p.replace(/^(\d{4})-(\d{2})$/, '$2/$1'); })
+      .join('+');
+  }
+
+  function showQR(name, amount, month, rawMonth) {
+    var numericMonth = toCzechMonth(rawMonth);
+    var message = name + ': ' + numericMonth;
+
+    titleEl.innerText   = 'Payment for ' + month;
+    accountEl.innerText = bankAccount;
+    amountEl.innerText  = amount;
+    messageEl.innerText = message;
+
+    imgEl.src = '/qr?'
+      + 'account=' + encodeURIComponent(bankAccount)
+      + '&amount=' + encodeURIComponent(amount)
+      + '&message=' + encodeURIComponent(message);
+
+    modal.classList.add('active');
+  }
+
+  function closeQR() {
+    modal.classList.remove('active');
+  }
+
+  document.addEventListener('click', function (ev) {
+    var btn = ev.target.closest('.pay-btn');
+    if (!btn) return;
+    ev.preventDefault();
+    showQR(
+      btn.dataset.name,
+      btn.dataset.amount,
+      btn.dataset.month,
+      btn.dataset.rawMonth
+    );
+  });
+
+  document.addEventListener('keydown', function (e) {
+    if (e.key === 'Escape' && modal.classList.contains('active')) closeQR();
+  });
+}());

go/internal/web/templates/adults.tmpl

@@ -12,7 +12,7 @@
   <a href="{{.Data.PaymentsURL}}" target="_blank" rel="noopener">Payments Ledger</a>
 </div>
 
-<div class="filter-container" id="filterContainer" data-current-month="{{.Data.CurrentMonth}}" data-page="adults">
+<div class="filter-container" id="filterContainer" data-current-month="{{.Data.CurrentMonth}}" data-page="adults" data-bank-account="{{.Data.BankAccount}}">
   <div class="filter-item">
     <label class="filter-label" for="nameFilter">Member</label>
     <input id="nameFilter" class="filter-input" type="text" placeholder="Filter by name…">
@@ -62,14 +62,14 @@
           class="{{if eq $cell.Status "empty"}}cell-empty{{else if and (or (eq $cell.Status "unpaid") (eq $cell.Status "partial")) (ge $cell.RawMonth $.Data.CurrentMonth)}}cell-unpaid-current{{else if or (eq $cell.Status "unpaid") (eq $cell.Status "partial")}}cell-unpaid{{else if eq $cell.Status "ok"}}cell-ok{{end}}{{if $cell.Overridden}} cell-overridden{{end}}">
         {{$cell.Text}}
         {{if and (or (eq $cell.Status "unpaid") (eq $cell.Status "partial")) (lt $cell.RawMonth $.Data.CurrentMonth)}}
-        <a class="pay-btn" href="{{qrHref $.Data.BankAccount $cell.Amount $row.Name $cell.RawMonth}}">Pay</a>
+        <button type="button" class="pay-btn" data-name="{{$row.Name}}" data-amount="{{$cell.Amount}}" data-month="{{$cell.Month}}" data-raw-month="{{$cell.RawMonth}}">Pay</button>
         {{end}}
       </td>
       {{end}}
       <td class="{{if lt $row.Balance 0}}balance-neg{{else if gt $row.Balance 0}}balance-pos{{end}}" style="position: relative;">
         {{$row.Balance}}
         {{if gt $row.PayableAmount 0}}
-        <a class="pay-btn" href="{{qrHrefAll $.Data.BankAccount $row.PayableAmount $row.Name $row.RawUnpaidPeriods}}">Pay All</a>
+        <button type="button" class="pay-btn" data-name="{{$row.Name}}" data-amount="{{$row.PayableAmount}}" data-month="{{$row.UnpaidPeriods}}" data-raw-month="{{$row.RawUnpaidPeriods}}" data-pay-all="1">Pay All</button>
         {{end}}
       </td>
     </tr>
@@ -184,6 +184,24 @@
   </div>
 </div>
 
+<div id="qrModal" onclick="if(event.target===this)this.classList.remove('active')">
+  <div class="modal-content">
+    <div class="modal-header">
+      <div class="modal-title" id="qrTitle">Payment for —</div>
+      <div class="close-btn" onclick="document.getElementById('qrModal').classList.remove('active')">[close]</div>
+    </div>
+    <div class="qr-image">
+      <img id="qrImg" src="" alt="Payment QR Code">
+    </div>
+    <div class="qr-details">
+      <div>Account: <span id="qrAccount"></span></div>
+      <div>Amount: <span id="qrAmount"></span> CZK</div>
+      <div>Message: <span id="qrMessage"></span></div>
+    </div>
+  </div>
+</div>
+
 <script src="/static/js/filters.js" defer></script>
 <script src="/static/js/member-detail.js" defer></script>
+<script src="/static/js/payment-qr.js" defer></script>
 {{end}}

go/internal/web/templates/flush_cache.tmpl

@@ -1,5 +1,11 @@
 {{define "title"}}Flush Cache{{end}}
 {{define "content"}}
 <h1>Flush Cache</h1>
-<p class="description">Coming in M6.6</p>
+{{if .Flushed}}
+  <p class="status-ok">Cache flushed: {{.Deleted}} file(s) deleted.</p>
+{{end}}
+<p class="description">Deletes all cached data files so the next request fetches fresh data from Google Sheets.</p>
+<form method="POST" action="/flush-cache">
+  <button type="submit" class="btn">Flush Cache</button>
+</form>
 {{end}}

go/internal/web/templates/juniors.tmpl

@@ -12,7 +12,7 @@
   <a href="{{.Data.PaymentsURL}}" target="_blank" rel="noopener">Payments Ledger</a>
 </div>
 
-<div class="filter-container" id="filterContainer" data-current-month="{{.Data.CurrentMonth}}" data-page="juniors">
+<div class="filter-container" id="filterContainer" data-current-month="{{.Data.CurrentMonth}}" data-page="juniors" data-bank-account="{{.Data.BankAccount}}">
   <div class="filter-item">
     <label class="filter-label" for="nameFilter">Member</label>
     <input id="nameFilter" class="filter-input" type="text" placeholder="Filter by name…">
@@ -62,14 +62,14 @@
           class="{{if eq $cell.Status "empty"}}cell-empty{{else if and (or (eq $cell.Status "unpaid") (eq $cell.Status "partial")) (ge $cell.RawMonth $.Data.CurrentMonth)}}cell-unpaid-current{{else if or (eq $cell.Status "unpaid") (eq $cell.Status "partial")}}cell-unpaid{{else if eq $cell.Status "ok"}}cell-ok{{end}}{{if $cell.Overridden}} cell-overridden{{end}}">
         {{$cell.Text}}
         {{if and (or (eq $cell.Status "unpaid") (eq $cell.Status "partial")) (lt $cell.RawMonth $.Data.CurrentMonth)}}
-        <a class="pay-btn" href="{{qrHref $.Data.BankAccount $cell.Amount $row.Name $cell.RawMonth}}">Pay</a>
+        <button type="button" class="pay-btn" data-name="{{$row.Name}}" data-amount="{{$cell.Amount}}" data-month="{{$cell.Month}}" data-raw-month="{{$cell.RawMonth}}">Pay</button>
         {{end}}
       </td>
       {{end}}
       <td class="{{if lt $row.Balance 0}}balance-neg{{else if gt $row.Balance 0}}balance-pos{{end}}" style="position: relative;">
         {{$row.Balance}}
         {{if gt $row.PayableAmount 0}}
-        <a class="pay-btn" href="{{qrHrefAll $.Data.BankAccount $row.PayableAmount $row.Name $row.RawUnpaidPeriods}}">Pay All</a>
+        <button type="button" class="pay-btn" data-name="{{$row.Name}}" data-amount="{{$row.PayableAmount}}" data-month="{{$row.UnpaidPeriods}}" data-raw-month="{{$row.RawUnpaidPeriods}}" data-pay-all="1">Pay All</button>
         {{end}}
       </td>
     </tr>
@@ -164,6 +164,24 @@
   </div>
 </div>
 
+<div id="qrModal" onclick="if(event.target===this)this.classList.remove('active')">
+  <div class="modal-content">
+    <div class="modal-header">
+      <div class="modal-title" id="qrTitle">Payment for —</div>
+      <div class="close-btn" onclick="document.getElementById('qrModal').classList.remove('active')">[close]</div>
+    </div>
+    <div class="qr-image">
+      <img id="qrImg" src="" alt="Payment QR Code">
+    </div>
+    <div class="qr-details">
+      <div>Account: <span id="qrAccount"></span></div>
+      <div>Amount: <span id="qrAmount"></span> CZK</div>
+      <div>Message: <span id="qrMessage"></span></div>
+    </div>
+  </div>
+</div>
+
 <script src="/static/js/filters.js" defer></script>
 <script src="/static/js/member-detail.js" defer></script>
+<script src="/static/js/payment-qr.js" defer></script>
 {{end}}

go/internal/web/templates/sync.tmpl

@@ -1,5 +1,15 @@
 {{define "title"}}Sync Bank Data{{end}}
 {{define "content"}}
 <h1>Sync Bank Data</h1>
-<p class="description">Coming in M6.6</p>
+{{if .Output}}
+  {{if .Success}}
+    <p class="status-ok">Sync completed successfully.</p>
+  {{else}}
+    <p class="status-error">Sync failed — see log below.</p>
+  {{end}}
+  <pre class="sync-log{{if not .Success}} sync-log--error{{end}}">{{.Output}}</pre>
+{{else}}
+  <p class="description">Fetches Fio transactions for the current year, infers payment details, and flushes the cache.</p>
+{{end}}
+<p><a href="/sync-bank" class="btn">{{if .Output}}Run Again{{else}}Run Sync{{end}}</a></p>
 {{end}}

go/tests/fixtures/reconcile/03_proportional_remainder.json

@@ -1,7 +1,7 @@
 {
   "case": "03_proportional_remainder",
   "func": "scripts.match_payments.reconcile",
-  "captured_at": "2026-05-06",
+  "captured_at": "2026-05-11",
   "input": {
     "members": [
       {
@@ -54,10 +54,10 @@
             "original_expected": 750,
             "attendance_count": 3,
             "exception": null,
-            "paid": 324.3243243243243,
+            "paid": 750.0,
             "transactions": [
               {
-                "amount": 324.3243243243243,
+                "amount": 750.0,
                 "date": "2026-03-10",
                 "sender": "Member_d035d9f9",
                 "message": "",
@@ -70,10 +70,10 @@
             "original_expected": 750,
             "attendance_count": 2,
             "exception": null,
-            "paid": 324.3243243243243,
+            "paid": 50.0,
             "transactions": [
               {
-                "amount": 324.3243243243243,
+                "amount": 50.0,
                 "date": "2026-03-10",
                 "sender": "Member_d035d9f9",
                 "message": "",
@@ -86,25 +86,17 @@
             "original_expected": 350,
             "attendance_count": 2,
             "exception": null,
-            "paid": 151.35135135135135,
-            "transactions": [
-              {
-                "amount": 151.35135135135135,
-                "date": "2026-03-10",
-                "sender": "Member_d035d9f9",
-                "message": "",
-                "confidence": "auto"
-              }
-            ]
+            "paid": 0,
+            "transactions": []
           }
         },
         "other_transactions": [],
-        "total_balance": -1051
+        "total_balance": -1050
       }
     },
     "unmatched": [],
     "credits": {
-      "Member_d035d9f9": -1051
+      "Member_d035d9f9": -1050
     }
   }
 }

go/tests/fixtures/reconcile/09_multiperson_multimonth.json

@@ -1,7 +1,7 @@
 {
   "case": "09_multiperson_multimonth",
   "func": "scripts.match_payments.reconcile",
-  "captured_at": "2026-05-06",
+  "captured_at": "2026-05-11",
   "input": {
     "members": [
       {
@@ -63,10 +63,10 @@
             "original_expected": 750,
             "attendance_count": 3,
             "exception": null,
-            "paid": 500.0,
+            "paid": 750.0,
             "transactions": [
               {
-                "amount": 500.0,
+                "amount": 750.0,
                 "date": "2026-02-15",
                 "sender": "Member_d035d9f9",
                 "message": "",
@@ -79,10 +79,10 @@
             "original_expected": 750,
             "attendance_count": 2,
             "exception": null,
-            "paid": 500.0,
+            "paid": 250.0,
             "transactions": [
               {
-                "amount": 500.0,
+                "amount": 250.0,
                 "date": "2026-02-15",
                 "sender": "Member_d035d9f9",
                 "message": "",
@@ -102,10 +102,10 @@
             "original_expected": 750,
             "attendance_count": 2,
             "exception": null,
-            "paid": 681.8181818181819,
+            "paid": 750.0,
             "transactions": [
               {
-                "amount": 681.8181818181819,
+                "amount": 750.0,
                 "date": "2026-02-15",
                 "sender": "Member_d035d9f9",
                 "message": "",
@@ -118,10 +118,10 @@
             "original_expected": 350,
             "attendance_count": 2,
             "exception": null,
-            "paid": 318.18181818181813,
+            "paid": 250.0,
             "transactions": [
               {
-                "amount": 318.18181818181813,
+                "amount": 250.0,
                 "date": "2026-02-15",
                 "sender": "Member_d035d9f9",
                 "message": "",
@@ -131,13 +131,13 @@
           }
         },
         "other_transactions": [],
-        "total_balance": -101
+        "total_balance": -100
       }
     },
     "unmatched": [],
     "credits": {
       "Member_d035d9f9": -500,
-      "Member_f4a93e46": -101
+      "Member_f4a93e46": -100
     }
   }
 }

scripts/fio_utils.py

@@ -4,6 +4,7 @@
 import json
 import os
 import re
+import sys
 import urllib.request
 from datetime import datetime
 from html.parser import HTMLParser
@@ -89,9 +90,11 @@ def parse_czech_amount(s: str) -> float | None:
 
 
 def parse_czech_date(s: str) -> str | None:
-    """Parse 'DD.MM.YYYY' to 'YYYY-MM-DD'."""
+    """Parse a Czech date to 'YYYY-MM-DD'. Accepts 4-digit and 2-digit years
+    with dot or slash separators; Fio's transparent page mixes 'DD.MM.YYYY'
+    and 'DD.MM.YY' in the same response."""
     s = s.strip()
-    for fmt in ("%d.%m.%Y", "%d/%m/%Y"):
+    for fmt in ("%d.%m.%Y", "%d/%m/%Y", "%d.%m.%y", "%d/%m/%y"):
         try:
             return datetime.strptime(s, fmt).strftime("%Y-%m-%d")
         except ValueError:
@@ -146,6 +149,7 @@ def fetch_transactions_transparent(
             "bank_id": "", # HTML scraping doesn't give stable ID
         })
 
+    print(f"fio: transparent fetched {len(rows)} raw rows, {len(transactions)} transaction(s) after filtering", file=sys.stderr)
     return transactions
 
 
@@ -169,7 +173,8 @@ def fetch_transactions_api(
 
     transactions = []
     tx_list = data.get("accountStatement", {}).get("transactionList", {})
-    for tx in (tx_list.get("transaction") or []):
+    raw_list = tx_list.get("transaction") or []
+    for tx in raw_list:
         # Each field is {"value": ..., "name": ..., "id": ...} or null
         def val(col_id):
             col = tx.get(f"column{col_id}")
@@ -197,6 +202,7 @@ def fetch_transactions_api(
             "currency": str(val(14) or "CZK"), # column14 = Currency
         })
 
+    print(f"fio: api fetched {len(raw_list)} raw transaction(s), {len(transactions)} after filtering", file=sys.stderr)
     return transactions
 
 
@@ -204,8 +210,14 @@ def fetch_transactions(date_from: str, date_to: str) -> list[dict]:
     """Fetch transactions, using API if token available, else transparent page."""
     token = os.environ.get("FIO_API_TOKEN", "").strip()
     if token:
+        print(f"fio: using authenticated API, window {date_from}..{date_to}", file=sys.stderr)
         return fetch_transactions_api(token, date_from, date_to)
 
+    print(
+        f"fio: using transparent page (FIO_API_TOKEN unset — expect publishing lag), "
+        f"window {date_from}..{date_to}, account=2800359168",
+        file=sys.stderr,
+    )
     # Convert YYYY-MM-DD to DD.MM.YYYY for the transparent page URL
     from_dt = datetime.strptime(date_from, "%Y-%m-%d")
     to_dt = datetime.strptime(date_to, "%Y-%m-%d")

scripts/match_payments.py

@@ -468,26 +468,19 @@ def reconcile(
 
             total_expected = sum(e for _, e in in_window)
 
-            if total_expected > 0 and in_window_share >= total_expected:
-                # Greedy phase: payment covers all in-window fees; overflow → credit.
-                credits[member_name] = credits.get(member_name, 0) + int(in_window_share - total_expected)
-                for m, exp in in_window:
-                    alloc = float(exp)
-                    ledger[member_name][m]["paid"] += alloc
-                    ledger[member_name][m]["transactions"].append({
-                        "amount": alloc,
-                        "date": tx["date"],
-                        "sender": tx["sender"],
-                        "message": tx["message"],
-                        "confidence": confidence,
-                    })
-            elif total_expected > 0:
-                # Proportional phase: distribute in_window_share by each month's expected fee.
-                # Last month absorbs any float remainder so the sum equals in_window_share exactly.
+            if total_expected > 0:
+                # Fill-first: iterate in_window in matched_months order (chronological by
+                # convention from infer_payments.py), allocating min(remaining, deficit) to
+                # each month. Deficit is net of what prior transactions already paid, so a
+                # second payment on the same months correctly fills only what remains due.
+                # Any surplus after all deficits are covered goes to the credit bucket.
                 remaining = in_window_share
-                for i, (m, exp) in enumerate(in_window):
-                    alloc = remaining if i == len(in_window) - 1 else in_window_share * exp / total_expected
-                    remaining -= alloc
+                for m, exp in in_window:
+                    paid_so_far = ledger[member_name][m]["paid"]
+                    deficit = max(0.0, float(exp) - paid_so_far)
+                    alloc = min(remaining, deficit)
+                    if alloc <= 0:
+                        continue
                     ledger[member_name][m]["paid"] += alloc
                     ledger[member_name][m]["transactions"].append({
                         "amount": alloc,
@@ -496,6 +489,9 @@ def reconcile(
                         "message": tx["message"],
                         "confidence": confidence,
                     })
+                    remaining -= alloc
+                if remaining > 0:
+                    credits[member_name] = credits.get(member_name, 0) + int(remaining)
             else:
                 # Fallback: no expected fees (prepayment before attendance recorded); even split.
                 per_month = in_window_share / len(in_window)

scripts/sync_fio_to_sheets.py

@@ -77,6 +77,35 @@ def generate_sync_id(tx: dict) -> str:
     return hashlib.sha256(raw_str.encode("utf-8")).hexdigest()
 
 
+def _trunc(s: str, n: int = 40) -> str:
+    s = str(s)
+    return s if len(s) <= n else s[: n - 1] + "…"
+
+
+def _print_fio_table(transactions: list[dict], statuses: list[str]) -> None:
+    headers = ["DATE", "AMOUNT", "SENDER", "VS", "MESSAGE", "BANKID", "STATUS"]
+    rows = [
+        [
+            str(tx.get("date", "")),
+            f"{float(tx.get('amount', 0)):.2f}",
+            str(tx.get("sender", "")),
+            str(tx.get("vs", "")),
+            _trunc(str(tx.get("message", ""))),
+            str(tx.get("bank_id", "")),
+            status,
+        ]
+        for tx, status in zip(transactions, statuses)
+    ]
+    widths = [
+        max(len(headers[i]), max((len(r[i]) for r in rows), default=0))
+        for i in range(len(headers))
+    ]
+    sep = "  "
+    print(sep.join(h.ljust(w) for h, w in zip(headers, widths)))
+    for row in rows:
+        print(sep.join(cell.ljust(w) for cell, w in zip(row, widths)))
+
+
 def sort_sheet_by_date(service, spreadsheet_id):
     """Sort the sheet by the Date column (Column B)."""
     # Get the sheet ID (gid) of the first sheet
@@ -104,12 +133,21 @@ def sort_sheet_by_date(service, spreadsheet_id):
     print("Sheet sorted by date.")
 
 
-def sync_to_sheets(spreadsheet_id: str, credentials_path: str, days: int = None, date_from_str: str = None, date_to_str: str = None, sort_by_date: bool = False):
+def sync_to_sheets(
+    spreadsheet_id: str,
+    credentials_path: str,
+    days: int = None,
+    date_from_str: str = None,
+    date_to_str: str = None,
+    sort_by_date: bool = False,
+    dry_run: bool = False,
+    print_fio_table: bool = False,
+):
     print(f"Connecting to Google Sheets using {credentials_path}...")
     service = get_sheets_service(credentials_path)
     sheet = service.spreadsheets()
 
-    # 1. Fetch existing IDs from Column G (last column in A-G range)
+    # 1. Read existing sync IDs from Column K
     print(f"Reading existing sync IDs from sheet...")
     try:
         result = sheet.values().get(
@@ -117,19 +155,22 @@ def sync_to_sheets(spreadsheet_id: str, credentials_path: str, days: int = None,
             range="A1:K" # Include header and all columns to check Sync ID
         ).execute()
         values = result.get("values", [])
-        
+
         # Check and insert labels if missing
         if not values or values[0] != COLUMN_LABELS:
-            print("Inserting column labels...")
-            sheet.values().update(
-                spreadsheetId=spreadsheet_id,
-                range="A1",
-                valueInputOption="USER_ENTERED",
-                body={"values": [COLUMN_LABELS]}
-            ).execute()
+            if dry_run:
+                print("Dry run: would write header row")
+            else:
+                print("Inserting column labels...")
+                sheet.values().update(
+                    spreadsheetId=spreadsheet_id,
+                    range="A1",
+                    valueInputOption="USER_ENTERED",
+                    body={"values": [COLUMN_LABELS]}
+                ).execute()
             existing_ids = set()
         else:
-            # Sync ID is now the last column (index 10)
+            # Sync ID is the last column (index 10)
             existing_ids = {row[10] for row in values[1:] if len(row) > 10}
     except Exception as e:
         print(f"Error reading sheet (maybe empty?): {e}")
@@ -150,8 +191,12 @@ def sync_to_sheets(spreadsheet_id: str, credentials_path: str, days: int = None,
     transactions = fetch_transactions(df_str, dt_str)
     print(f"Found {len(transactions)} transactions.")
 
-    # 3. Filter for new transactions
+    if dry_run:
+        print(f"Dry run: window {df_str} to {dt_str}, fetched {len(transactions)} transaction(s) from Fio")
+
+    # 3. Determine NEW/DUP for each transaction
     new_rows = []
+    tx_statuses = []
     for tx in transactions:
         sync_id = generate_sync_id(tx)
         if sync_id not in existing_ids:
@@ -169,24 +214,48 @@ def sync_to_sheets(spreadsheet_id: str, credentials_path: str, days: int = None,
                 tx.get("bank_id", ""),
                 sync_id,
             ])
+            tx_statuses.append("NEW")
+        else:
+            tx_statuses.append("DUP")
+
+    # 4. Print table (before early-return so all transactions are shown including DUPs)
+    if print_fio_table and transactions:
+        _print_fio_table(transactions, tx_statuses)
 
     if not new_rows:
-        print("No new transactions to sync.")
+        if dry_run:
+            print("Dry run: would sync 0 new transaction(s).")
+        else:
+            print("No new transactions to sync.")
         return
 
-    # 4. Append to sheet
-    print(f"Appending {len(new_rows)} new transactions to the sheet...")
-    body = {"values": new_rows}
-    sheet.values().append(
-        spreadsheetId=spreadsheet_id,
-        range="A2", # Appends to the end of the sheet
-        valueInputOption="USER_ENTERED",
-        body=body
-    ).execute()
-    print("Sync completed successfully.")
-
-    if sort_by_date:
-        sort_sheet_by_date(service, spreadsheet_id)
+    # 5. Append to sheet or print dry-run would-write lines
+    if dry_run:
+        for tx, status in zip(transactions, tx_statuses):
+            if status == "NEW":
+                print(
+                    f"Dry run: would append"
+                    f" date={tx.get('date', '')}"
+                    f" amount={tx.get('amount', '')}"
+                    f" sender={tx.get('sender', '')}"
+                    f" vs={tx.get('vs', '')}"
+                    f" message={tx.get('message', '')}"
+                )
+        if sort_by_date:
+            print("Dry run: would sort by date")
+        print(f"Dry run: would sync {len(new_rows)} new transaction(s).")
+    else:
+        print(f"Appending {len(new_rows)} new transactions to the sheet...")
+        body = {"values": new_rows}
+        sheet.values().append(
+            spreadsheetId=spreadsheet_id,
+            range="A2", # Appends to the end of the sheet
+            valueInputOption="USER_ENTERED",
+            body=body
+        ).execute()
+        print("Sync completed successfully.")
+        if sort_by_date:
+            sort_sheet_by_date(service, spreadsheet_id)
 
 
 def main():
@@ -197,16 +266,20 @@ def main():
     parser.add_argument("--from", dest="date_from", help="Start date YYYY-MM-DD")
     parser.add_argument("--to", dest="date_to", help="End date YYYY-MM-DD")
     parser.add_argument("--sort-by-date", action="store_true", help="Sort the sheet by date after sync")
+    parser.add_argument("--dry-run", action="store_true", help="Fetch and dedup without writing to the sheet")
+    parser.add_argument("--print-fio-table", action="store_true", help="Print aligned table of all fetched transactions with NEW/DUP status (use with --dry-run)")
     args = parser.parse_args()
 
     try:
         sync_to_sheets(
-            spreadsheet_id=args.sheet_id, 
+            spreadsheet_id=args.sheet_id,
             credentials_path=args.credentials,
             days=args.days,
             date_from_str=args.date_from,
             date_to_str=args.date_to,
-            sort_by_date=args.sort_by_date
+            sort_by_date=args.sort_by_date,
+            dry_run=args.dry_run,
+            print_fio_table=args.print_fio_table,
         )
     except Exception as e:
         print(f"Sync failed: {e}")

tests/test_reconcile_exceptions.py

@@ -93,8 +93,8 @@ class TestMultiMonthAllocation(unittest.TestCase):
         self.assertEqual(int(months['2026-02']['paid']), 750)
         self.assertEqual(result['credits'].get('Alice', 0), 500)
 
-    def test_proportional_underpayment(self):
-        """Payment < total expected → proportional split; sum of paid == payment amount."""
+    def test_underpayment_fills_earliest_first(self):
+        """Payment < total expected → fill earliest months first, spill remainder to later."""
         members = [('Alice', 'A', {'2026-02': (750, 3), '2026-03': (350, 3), '2026-04': (750, 3)})]
         sorted_months = ['2026-02', '2026-03', '2026-04']
         amount = 1250
@@ -103,18 +103,28 @@ class TestMultiMonthAllocation(unittest.TestCase):
         result = reconcile(members, sorted_months, [tx])
         months = result['members']['Alice']['months']
 
-        paid_02 = months['2026-02']['paid']
-        paid_03 = months['2026-03']['paid']
-        paid_04 = months['2026-04']['paid']
+        # 02 filled first (750), then 03 (350), then remainder 150 to 04
+        self.assertAlmostEqual(months['2026-02']['paid'], 750, places=2)
+        self.assertAlmostEqual(months['2026-03']['paid'], 350, places=2)
+        self.assertAlmostEqual(months['2026-04']['paid'], 150, places=2)
+        # No CZK lost
+        self.assertAlmostEqual(
+            months['2026-02']['paid'] + months['2026-03']['paid'] + months['2026-04']['paid'],
+            amount, places=2,
+        )
 
-        # All months should be partial (underpaid)
-        self.assertLess(paid_02, 750)
-        self.assertLess(paid_03, 350)
-        self.assertLess(paid_04, 750)
-        # Sum must equal the original payment (no CZK lost)
-        self.assertAlmostEqual(paid_02 + paid_03 + paid_04, amount, places=2)
-        # 02 and 04 have equal expected → equal allocation
-        self.assertAlmostEqual(paid_02, paid_04, places=2)
+    def test_fill_first_across_two_transactions(self):
+        """Prior txn fills 02 partially; later txn finishes 02 then spills to 03."""
+        members = [('Matyáš', 'A', {'2026-02': (500, 2), '2026-03': (250, 1)})]
+        sorted_months = ['2026-02', '2026-03']
+        tx1 = _tx('Matyáš', '2026-02', 200)
+        tx2 = _tx('Matyáš', '2026-02, 2026-03', 550)
+
+        result = reconcile(members, sorted_months, [tx1, tx2])
+        months = result['members']['Matyáš']['months']
+
+        self.assertAlmostEqual(months['2026-02']['paid'], 500, places=2)
+        self.assertAlmostEqual(months['2026-03']['paid'], 250, places=2)
 
     def test_single_month_unchanged(self):
         """Single-month payment: full amount goes to that month (regression guard)."""