diff --git a/.gitea/workflows/diag.yml b/.gitea/workflows/diag.yml
new file mode 100644
index 0000000..8c77a7d
--- /dev/null
+++ b/.gitea/workflows/diag.yml
@@ -0,0 +1,33 @@
+name: Diag
+on:
+  push:
+    branches: [diag/menu-500]
+jobs:
+  menu-500:
+    name: "Diag · public branch menu 500"
+    runs-on: self-hosted
+    timeout-minutes: 5
+    env:
+      PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
+    steps:
+      - name: API logs around public menu + exceptions
+        run: |
+          set -eu
+          echo "=== exception stack traces (last 48h) ==="
+          docker logs meezi-api --since 48h 2>&1 | grep -iE -A 30 "exception|unhandled|stack trace" | tail -200 || true
+          echo ""
+          echo "=== log lines mentioning /branches/.+/menu or public menu ==="
+          docker logs meezi-api --since 48h 2>&1 | grep -iE "branches/.*/menu|GetBranchMenu|public.*menu" | tail -40 || true
+      - name: DB integrity for menu/categories/branches
+        run: |
+          set -eu
+          U=$(docker exec meezi-db env | grep '^POSTGRES_USER=' | cut -d= -f2)
+          D=$(docker exec meezi-db env | grep '^POSTGRES_DB=' | cut -d= -f2)
+          echo "=== cafes (id, slug, plan) ==="
+          docker exec meezi-db psql -U "$U" -d "$D" -c 'SELECT "Id","Slug","PlanTier" FROM "Cafes" LIMIT 10;' || true
+          echo "=== branches ==="
+          docker exec meezi-db psql -U "$U" -d "$D" -c 'SELECT "Id","CafeId","Name","IsActive" FROM "Branches" LIMIT 10;' || true
+          echo "=== menu items with NULL/orphan CategoryId ==="
+          docker exec meezi-db psql -U "$U" -d "$D" -c 'SELECT mi."Id", mi."CafeId", mi."CategoryId" FROM "MenuItems" mi LEFT JOIN "MenuCategories" mc ON mc."Id"=mi."CategoryId" WHERE mi."CategoryId" IS NULL OR mc."Id" IS NULL LIMIT 10;' || true
+          echo "=== count menu items / categories per cafe ==="
+          docker exec meezi-db psql -U "$U" -d "$D" -c 'SELECT "CafeId", count(*) FROM "MenuItems" GROUP BY 1;' || true