Document the post-1.7.12 M365+GWS scan report and update checks

TODO.md: open entry for "M365 not scanning M365+GWS accounts after the
1.7.12 update" — symptom, what was verified, likely half-applied update,
server checks to run after an update, what to collect if it recurs,
rollback option, and two possible hardening steps.

routes/CLAUDE.md: note that half-applied updates look like code bugs and
to verify server state before debugging a post-update regression.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

TODO.md

@@ -45,6 +45,40 @@ Six root causes fixed in `scan_engine.py` and `document_scanner.py`:
 
 ## Pending
 
+### M365 not scanning M365+GWS accounts after the 1.7.12 update — ⏳ awaiting verification
+**Reported 2026-09-28.** After updating the server to 1.7.12, a scan did not cover the Microsoft 365 sources for accounts shown with the unified **M365 + GWS** pill, even though they were ticked. After running the update again the problem no longer appeared. Status: being tested by the maintainer; reopen with the details below if it comes back.
+
+**What was verified (against a copy of real profile data, scans intercepted, nothing actually scanned):**
+- Applying `STAFF-M365-GWS-FULL` and pressing Scan sends `POST /api/scan/start` with all 33 accounts (31 M365+GWS, 2 M365-only), each with its M365 GUID and no `google:` ids; the Google scan gets the 31 Google emails.
+- Server side, the only 1.7.12 change that filters accounts is `scan_engine._resolve_scan_users()`, which drops ids starting with `google:`. M365+GWS accounts are sent with their M365 GUID, so they pass. No other change since 1.7.9 filters accounts.
+
+**Likely cause: a half-applied update** (not proven — no logs from the first update):
+- `update_gdpr.sh` only restarts the process if a systemd unit named `gdprscanner` exists; otherwise it prints "restart GDPRScanner manually" and the old Python keeps running against the new static JS.
+- A browser tab left open through the update keeps running the old JS modules until reloaded.
+- Both update paths auto-stash local edits (`git stash`), silently removing any hotfix made directly on the server.
+
+**Checking a server after an update** (install dir `/opt/gdprscanner`):
+```bash
+git -C /opt/gdprscanner log --oneline -1          # expect the release commit on origin/main
+cat /opt/gdprscanner/VERSION                       # expect the released version
+git -C /opt/gdprscanner status --short             # expect no output
+git -C /opt/gdprscanner stash list                 # any entries = local changes the updater set aside
+systemctl show gdprscanner -p ActiveEnterTimestamp # must be after the update
+```
+Then hard-refresh the browser (Cmd+Shift+R) before scanning. Also confirm `git -C /opt/gdprscanner remote -v` points at `https://git.fejl40.nu/Fejl40.nu/GDPRScanner.git` (the repo moved from GitHub).
+
+**If it recurs, collect:** the log from "Starter scanning: …" onward (look for *"Ingen Microsoft 365-konti valgt"*, *"Sprang N konto(er) over, der kun findes i Google Workspace"*, or no Outlook/OneDrive lines at all); how the scan was started (profile / hand-ticked / scheduled job) and which profile; whether the Elev/Ansat filter or search was active; and the output of the checks above.
+
+**Rollback:** 1.7.11 (`v1.7.11`) doesn't have this symptom but still sends Google-only accounts to Graph (404s). Reverting `b547622` on `main` restores that behaviour.
+
+**Possible hardening (not started):**
+1. The page notices when the server's `VERSION` has changed since it loaded and asks the user to reload.
+2. `update_gdpr.sh` exits non-zero with a clear warning when it cannot restart the service, instead of only logging it.
+
+**Size:** Small · **Priority:** High until verified
+
+---
+
 ### #15 — Scan profiles ✅
 Named, reusable scan configurations. Full spec in SUGGESTIONS.md §15.  
 **Size:** Large · **Priority:** High

routes/CLAUDE.md

@@ -99,6 +99,7 @@ Optional AI-powered NER replacing spaCy. Activated via `config.json` keys `claud
 - **`apply_update()` never restarts itself** — callers decide. Tests patch `_schedule_restart`; the auto-update thread calls `_restart_self()` directly.
 - **Auto-update thread** — `start_auto_update_thread()` called from `gdpr_scanner.py` `__main__`. Hourly tick, applies at most once per 24 h when `config.json["auto_update"]` is true; skips (and retries next tick) while a scan runs.
 - **`update_gdpr.sh`** — standalone CLI/cron equivalent of the same logic; keep stash/ff-only/requirements behaviour in sync.
+- **Half-applied updates look like code bugs** — `update_gdpr.sh` restarts only if a `gdprscanner` systemd unit exists (else the old Python keeps running under the new static JS), open browser tabs keep old JS modules until reloaded, and both paths auto-stash local edits. Before debugging a post-update regression, verify the server state (HEAD, `VERSION`, clean `git status`, `git stash list`, service start time after the update) — see the "M365 not scanning M365+GWS accounts after the 1.7.12 update" entry in `TODO.md`.
 
 ## Viewer mode — routes/viewer.py