I have enough evidence. Here is the audit.
The 504 boundary is a real, tested mechanism, not an aspiration. QueryTimeoutExceptionMapper (src/main/java/de/idigath/exception/QueryTimeoutExceptionMapper.java:30-35) maps exactly one exception type to 504, and QueryTimeoutExceptionMapperTest.mapper_handlesOnlyQueryTimeout_connectionFailureNotMappedTo504 pins the negative half of the contract — a JDBCConnectionException must not become a 504. That's the rare test that asserts what must not happen. ArticleEndpointTest.getArticle_tableLockedByOtherTransaction_returns504 then proves it end-to-end with a real LOCK TABLE articles IN ACCESS EXCLUSIVE MODE and a 1s statement_timeout, restoring state in a finally. This is the highest-value thing in the repo.
LIKE-injection is closed and regression-tested. Article.escapeLikePattern (entity/Article.java:100-107) escapes !, %, _ and the query declares escape '!' in both the named query (Article.java:44) an