diff --git a/.llm/exports/.state/.gitkeep b/.cursor/hooks/.gitkeep
similarity index 100%
rename from .llm/exports/.state/.gitkeep
rename to .cursor/hooks/.gitkeep
diff --git a/.cursor/hooks/CURSOR-HOOKS.md b/.cursor/hooks/CURSOR-HOOKS.md
new file mode 100644
index 00000000..e5306926
--- /dev/null
+++ b/.cursor/hooks/CURSOR-HOOKS.md
@@ -0,0 +1,7 @@
+# `.cursor/hooks/`
+
+Optional Cursor project hook scripts. Add `.cursor/hooks.json` at the repo root when you enable hooks.
+
+- Scripts in this directory are referenced from `hooks.json` (not committed until you need hooks).
+- Prefer skills and rules for static guidance; hooks automate events (shell gates, session setup, and so on).
+- See Cursor hooks documentation and **abcmemory** skill.
diff --git a/.llm/exports/github-copilot/.gitkeep b/.cursor/prompts/.gitkeep
similarity index 100%
rename from .llm/exports/github-copilot/.gitkeep
rename to .cursor/prompts/.gitkeep
diff --git a/.cursor/prompts/CURSOR-PROMPTS.md b/.cursor/prompts/CURSOR-PROMPTS.md
new file mode 100644
index 00000000..b19e9e3b
--- /dev/null
+++ b/.cursor/prompts/CURSOR-PROMPTS.md
@@ -0,0 +1,8 @@
+# `.cursor/prompts/`
+
+Reusable agent-facing prompt snippets (abcmemory). One topic per kebab-case `.md` file.
+
+- Use for copy-paste or @-reference blocks that are not full skills or rules.
+- Do not put human plan/history templates here — use `.llm/templates/` instead.
+- When the user says **abcremember** with prompt-shaped guidance, prefer this directory.
+- See **abcmemory** skill and [LLM-TEMPLATES.md](/.llm/templates/LLM-TEMPLATES.md).
diff --git a/.cursor/rules/CURSOR-RULES.md b/.cursor/rules/CURSOR-RULES.md
new file mode 100644
index 00000000..94922355
--- /dev/null
+++ b/.cursor/rules/CURSOR-RULES.md
@@ -0,0 +1,7 @@
+# `.cursor/rules/`
+
+Cursor rules (`.mdc` files): always-applied or glob-scoped agent constraints.
+
+- Use `alwaysApply: true` for repo-wide conventions (for example `architecture-tier-dependencies.mdc`); use `globs` when rules apply only to certain paths.
+- Prefer skills for long workflow docs; keep rules focused.
+- See **llm-cursor-source** and [DOCS-DEVELOPMENT-LLM.md](/docs/development/llm/DOCS-DEVELOPMENT-LLM.md).
diff --git a/.cursor/rules/abcmemory-vocabulary.mdc b/.cursor/rules/abcmemory-vocabulary.mdc
new file mode 100644
index 00000000..629fd844
--- /dev/null
+++ b/.cursor/rules/abcmemory-vocabulary.mdc
@@ -0,0 +1,29 @@
+---
+description: User vocabulary abcmemory and abcremember for Cursor guidance files
+alwaysApply: true
+---
+
+# abcmemory / abcremember vocabulary
+
+## abcmemory
+
+**abcmemory** means the committed files Cursor uses for agent guidance in this repo — **only** under `.cursor/` and the repo root files Cursor reads:
+
+- `.cursor/skills/**`
+- `.cursor/rules/**`
+- `.cursor/prompts/**`
+- `.cursor/hooks/**` and `.cursor/hooks.json` (when present)
+- `.cursorrules`
+- `.cursorignore`
+
+## Not abcmemory
+
+**`.llm/`** (plans, history, templates, context) is a **planning workspace**, not agent memory. Do not treat it as a second abcmemory tree.
+
+Also not abcmemory unless you explicitly ask: `docs/`, `.github/`, and ad-hoc paths.
+
+## abcremember
+
+When the user says **abcremember**, **create or update** the best-fit abcmemory file(s) under **`.cursor/`** (or `.cursorrules` / `.cursorignore`): prefer updating existing guidance when the instruction extends the same topic; create a new skill, rule, or prompt only when no suitable file exists. Then follow that guidance in future work. Do **not** write to `.llm/` unless they explicitly say to remember something there.
+
+For placement and workflow details, see `.cursor/skills/abcmemory/SKILL.md`.
diff --git a/.cursor/rules/app-internal-import-aliases.mdc b/.cursor/rules/app-internal-import-aliases.mdc
new file mode 100644
index 00000000..749f75c7
--- /dev/null
+++ b/.cursor/rules/app-internal-import-aliases.mdc
@@ -0,0 +1,38 @@
+---
+description: App-internal TypeScript path aliases must match the full apps/<name>/ directory name
+globs:
+  - "apps/api/**/*.ts"
+  - "apps/management-api/**/*.ts"
+  - "apps/api/tsconfig*.json"
+  - "apps/management-api/tsconfig*.json"
+  - "apps/api/vitest.config.ts"
+  - "apps/management-api/vitest.config.ts"
+alwaysApply: false
+---
+
+# App internal import aliases
+
+Node apps under `apps/` use a **TypeScript path alias** for imports from their own `src/` tree. The alias prefix must match the **full app directory name** under `apps/` — not abbreviations.
+
+## Do
+
+| App directory           | Alias prefix          | Example                                                      |
+| ----------------------- | --------------------- | ------------------------------------------------------------ |
+| `apps/api/`             | `@api/*`              | `import { config } from '@api/config/index.js'`              |
+| `apps/management-api/`  | `@management-api/*`   | `import { config } from '@management-api/config/index.js'`   |
+
+Configure in each app's `tsconfig.json` `paths` and mirror the prefix root in `vitest.config.ts` for tests. When the build uses alias rewriting, keep `tsc` + alias rewrite aligned with dist output.
+
+## Don't
+
+- Do not abbreviate directory names (`@mgmt-api`, `@m-api`, etc.).
+- Do not use npm workspace names (`@metaboost/api/*`) for in-app imports — those are for cross-package deps only.
+
+## Distinction
+
+- **`@metaboost/*`** — published/workspace packages under `packages/`
+- **`@<app-dir-name>/*`** — internal imports within one deployable app
+
+## Note
+
+When adding or extending `paths` in an app, update this table if a new Node app is introduced under `apps/`.
diff --git a/.cursor/rules/app-local-ui-wrappers.mdc b/.cursor/rules/app-local-ui-wrappers.mdc
new file mode 100644
index 00000000..09bd762a
--- /dev/null
+++ b/.cursor/rules/app-local-ui-wrappers.mdc
@@ -0,0 +1,16 @@
+---
+description: Extract app-local thin wrappers when identical @metaboost/ui + i18n configuration repeats (2+ callsites in one app).
+globs:
+  - "apps/web/src/**/*.tsx"
+  - "apps/management-web/src/**/*.tsx"
+alwaysApply: false
+---
+
+# App-local configured UI wrappers
+
+When the **same** configured usage of `@metaboost/ui` (including **`next-intl`** strings for `aria-label`, titles, or messages) appears in **two or more** places **within** `apps/web` or **within** `apps/management-web`, extract a thin client component under that app’s `src/components/**` that wires translations and forwards props.
+
+- Keep wrappers **app-local** until **both** apps need the same wiring; then consider `packages/ui` plus app wrappers for copy (see workspace **i18n** rules).
+- Do **not** use bare `export { X } from '@metaboost/ui'` as a substitute — wrappers must bind meaningful app conventions.
+
+See **`reusable-components`** skill for the full rubric.
diff --git a/.cursor/rules/architecture-tier-dependencies.mdc b/.cursor/rules/architecture-tier-dependencies.mdc
new file mode 100644
index 00000000..4bea29bd
--- /dev/null
+++ b/.cursor/rules/architecture-tier-dependencies.mdc
@@ -0,0 +1,11 @@
+---
+description: Package tier dependency order — lower tiers cannot depend on higher
+alwaysApply: true
+---
+
+# Architecture tier dependencies
+
+Lower tiers cannot depend on higher tiers in the monorepo package graph.
+
+Full tier table, directory layout, and app descriptions:
+[.llm/context/architecture.md](/.llm/context/architecture.md) (contributor reference).
diff --git a/.cursor/rules/build-order-doc-sync.mdc b/.cursor/rules/build-order-doc-sync.mdc
new file mode 100644
index 00000000..2b3f7cbf
--- /dev/null
+++ b/.cursor/rules/build-order-doc-sync.mdc
@@ -0,0 +1,24 @@
+---
+description: Keep build order dependency-safe and docs synced when build orchestration changes.
+globs:
+  - package.json
+  - scripts/ci/run-workspaces.mjs
+  - .github/workflows/ci.yml
+alwaysApply: false
+---
+
+# Build order and docs sync
+
+Use the **build-order** skill (`.cursor/skills/build-order/SKILL.md`) and
+[AGENTS.md](/AGENTS.md) / [.llm/context/architecture.md](/.llm/context/architecture.md) for the
+current Metaboost sequence.
+
+## Required
+
+- Preserve dependency-safe staged build execution (`npm run build:packages` before apps).
+- Keep root `build` aligned with package/app build sequencing.
+- Update contributor docs when build orchestration behavior changes.
+
+## Prohibited
+
+- Do not reintroduce all-workspace root build execution that can violate workspace dependency order.
diff --git a/.cursor/rules/commands-from-metaboost-root.mdc b/.cursor/rules/commands-from-metaboost-root.mdc
index 1031c827..d49bc28f 100644
--- a/.cursor/rules/commands-from-metaboost-root.mdc
+++ b/.cursor/rules/commands-from-metaboost-root.mdc
@@ -10,6 +10,7 @@ Always provide runnable terminal commands relative to the Metaboost repository r
 ## Do
 
 - Use root-invoked workspace commands (for example `npm run <script> -w @metaboost/<workspace> -- [args]`).
+- Use root **`npm run test:unit`** for unit tests across workspaces (runs `scripts/ci/run-workspaces.mjs` with API integration workspaces excluded). Do **not** suggest `npm run test:unit -w apps/web` — `test:unit` is a root orchestration script.
 - For E2E commands, use `make` targets from repo root so dependencies and seed steps are handled.
 - Use `SPEC`/`WEB_SPEC`/`MGMT_SPEC` for one spec or comma-delimited spec lists.
 - Put runnable commands in fenced `bash` blocks so the editor shows copy buttons.
diff --git a/.cursor/rules/config-type-safety.mdc b/.cursor/rules/config-type-safety.mdc
new file mode 100644
index 00000000..310bd329
--- /dev/null
+++ b/.cursor/rules/config-type-safety.mdc
@@ -0,0 +1,66 @@
+---
+description: Config and type safety rules - no defaults, no non-null assertions outside config
+globs:
+  - "**/config/index.ts"
+  - "**/config/*.ts"
+alwaysApply: false
+---
+
+# Config and Type Safety Rules
+
+## Critical Requirements
+
+### 1. Never Set Default Values in Config Files
+
+**NEVER** set default values for environment variables in `config/index.ts` files. This includes:
+
+- Empty strings: `process.env.VAR || ''`
+- Fallback values: `process.env.VAR || 'default'`
+- Nullish coalescing: `process.env.VAR ?? ''`
+
+**Why**: Default values hide configuration errors and allow apps to start with invalid state.
+
+### 2. Use Non-Null Assertions (`!`) in Config Files Only
+
+Config files are the **one exception** where `!` assertions are allowed, because:
+
+- All env vars must pass through startup validation before config is used
+- Validation ensures required values exist before the app starts
+- This keeps config files clean and typed as `string` (not `string | undefined`)
+
+**Pattern for config files:**
+
+```typescript
+/* eslint-disable @typescript-eslint/no-non-null-assertion -- env vars validated at startup */
+
+export const config = {
+  nodeEnv: process.env.NODE_ENV!,
+  apiPort: process.env.API_PORT!,
+  database: {
+    host: process.env.DB_HOST!,
+  },
+};
+```
+
+### 3. Avoid Non-Null Assertions Elsewhere
+
+Outside of config files, **avoid** `!` assertions. Prefer proper null checks, optional chaining, or type guards.
+
+## Approved Patterns
+
+### Backend Apps (api, management-api)
+
+1. **Create startup validation** (`lib/startup/validation.ts`).
+2. **Call validation early in app startup** before importing config.
+3. **Use `!` in config with eslint-disable** (`config/index.ts`).
+
+### Next.js Apps (web, management-web)
+
+Validate at build time via app validate-env scripts and prebuild hooks where configured.
+
+## Summary
+
+| Location | `!` Allowed | Default Values |
+| -------- | ----------- | ---------------- |
+| `config/index.ts` | ✅ Yes (with eslint-disable) | ❌ Never |
+| Other files | ❌ Avoid | Use at point of use if needed |
diff --git a/.cursor/rules/css-custom-properties-no-var-fallbacks.mdc b/.cursor/rules/css-custom-properties-no-var-fallbacks.mdc
new file mode 100644
index 00000000..711f9004
--- /dev/null
+++ b/.cursor/rules/css-custom-properties-no-var-fallbacks.mdc
@@ -0,0 +1,25 @@
+---
+description: Do not use CSS var() fallback arguments in SCSS/CSS; rely on canonical theme tokens
+globs:
+  - "**/*.scss"
+  - "**/*.css"
+alwaysApply: false
+---
+
+# CSS custom properties — no `var()` fallbacks
+
+## Do not
+
+- Use the **second argument** to `var()` as a silent fallback: `var(--token, #hex)`, `var(--token, inherit)`, etc.
+- Use **nested fallbacks** such as `var(--a, var(--b))` to paper over a missing `--a` — the outer form still hides when `--a` is absent.
+
+Fallbacks mask missing or mistyped custom properties and make theme bugs hard to see in review.
+
+## Do
+
+- Reference tokens that are defined in **`packages/ui/src/styles/`** — especially `_variables.scss` (shared scale/mirrors) and `_themes.scss` (theme palettes on `[data-ui-theme]`, including `--color-border` and text/surface tokens).
+- If a value is missing, **add or extend a named token** in those files, then use `var(--your-token)` with **one** argument.
+
+## Inline styles (React `style`, Storybook decorators)
+
+Apply the same rule: no `var(--x, fallback)` in style object strings. (Repo convention avoids inline styles for layout; see **global** skill — when inline strings include `var()`, still omit fallbacks.)
diff --git a/.cursor/rules/documentation-updates.mdc b/.cursor/rules/documentation-updates.mdc
new file mode 100644
index 00000000..9555fb58
--- /dev/null
+++ b/.cursor/rules/documentation-updates.mdc
@@ -0,0 +1,15 @@
+---
+description: Doc updates for config changes
+globs:
+  - "package.json"
+  - "packages/*/package.json"
+  - "tsconfig.base.json"
+alwaysApply: false
+---
+
+# Documentation Updates
+
+When changing configs:
+
+- Update [docs/architecture/ARCHITECTURE.md](/docs/architecture/ARCHITECTURE.md) if deps or tier layout changed
+- Update `.llm/context/` files when conventions or architecture shift
diff --git a/.cursor/rules/e2e-seed-id-text-limits.mdc b/.cursor/rules/e2e-seed-id-text-limits.mdc
new file mode 100644
index 00000000..60794a48
--- /dev/null
+++ b/.cursor/rules/e2e-seed-id-text-limits.mdc
@@ -0,0 +1,22 @@
+---
+description: E2E seed fixture id_text values must fit nano_id_v2 (9–15 characters). Count length before adding IDs to seed scripts or E2E helpers.
+globs:
+  - "tools/**/seed-e2e.mjs"
+  - "apps/**/e2e/**/*.ts"
+alwaysApply: false
+---
+
+# E2E seed `id_text` length limits
+
+Postgres **`nano_id_v2`** is **`VARCHAR(15)`** with length **9–15** (see
+`infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql` and
+`packages/helpers/src/nanoid.ts`).
+
+When adding or renaming deterministic E2E fixture IDs in seed scripts or E2E helpers:
+
+- **Count characters** on every new `id_text` before commit (descriptive names often exceed 15).
+- Keep IDs in the **9–15** range; prefer existing short patterns like `e2eusr000001` (12).
+- Update **all** sync points together (seed, specs, helpers, docs).
+- Run `make e2e_seed_web` (or `make e2e_seed`) to verify inserts succeed.
+
+Full workflow: **e2e-seed-nano-id-limits** skill.
diff --git a/.cursor/rules/end-with-targeted-make-report-verify.mdc b/.cursor/rules/end-with-targeted-make-report-verify.mdc
index e09ee2ec..7e4cb803 100644
--- a/.cursor/rules/end-with-targeted-make-report-verify.mdc
+++ b/.cursor/rules/end-with-targeted-make-report-verify.mdc
@@ -1,5 +1,5 @@
 ---
-description: End implementation responses with targeted make screenshot-report verification commands.
+description: End implementation responses with targeted make screenshot-report verification commands for the operator.
 alwaysApply: true
 ---
 
@@ -7,33 +7,33 @@ alwaysApply: true
 
 For implementation responses in this repo:
 
+0. **Do not run tests during agent or plan work.** Never run test, lint, or verification commands as part of implementation. Only instruct the operator in a fenced `bash` block at the end of the response.
 1. **Give the user** one or more runnable `make` commands they can copy and run to verify the change; place them in a fenced `bash` code block at the end of your response.
-2. **MANDATORY when the change affects E2E:** If you modified UI (apps/web or apps/management-web), E2E spec files, or any code that E2E tests cover, you **MUST** end the response with a fenced `bash` block containing the **EXACT** command(s) needed to run the affected E2E test(s). No exception. Example: `make e2e_test_web_report_spec SPEC=e2e/settings-bucket-owner.spec.ts`.
-3. Prefer screenshot-report targets scoped to the changed feature area.
-3. Avoid suggesting unrelated full-suite runs by default.
-4. Use full-suite report mode only when the change scope is broad or cross-cutting.
-5. Place final verification commands in a fenced `bash` code block so copy-to-clipboard is available.
-6. Inside the code block, list plain commands (one per line), without bullets or inline backticks.
-7. **When the change includes files under `infra/k8s/`:** Add a sentence in the response that the user should push to the Argo CD–tracked branch (e.g. `develop`) for the cluster to sync. See **argocd-gitops-push** skill for details.
+2. **UI changes (apps/web, apps/management-web, packages/ui):** Instruct the operator to run the narrowest targeted screenshot report and where to open it (`.artifacts/e2e-reports/latest/web/index.html` or `.../management-web/index.html`). See **ui-e2e-screenshot-report** skill.
+3. **MANDATORY when the change affects E2E:** If you modified UI (apps/web or apps/management-web), E2E spec files, or any code that E2E tests cover, you **MUST** end the response with a fenced `bash` block containing the **EXACT** command(s) needed to run the affected E2E test(s). Example: `make e2e_test_web_report_spec SPEC=e2e/smoke.spec.ts`.
+4. Prefer screenshot-report targets scoped to the changed feature area.
+5. Avoid suggesting unrelated full-suite runs by default.
+6. Use full-suite report mode only when change scope is broad or cross-cutting.
+7. Place final verification commands in a fenced `bash` code block so copy-to-clipboard is available.
+8. Inside the code block, list plain commands (one per line), without bullets or inline backticks.
+9. **When the change includes files under `infra/k8s/`:** Add a sentence in the response that the operator should push to the Argo CD–tracked branch (e.g. `develop`) for the cluster to sync. See **argocd-gitops-push** skill for details.
 
 API gate (default: no API tests):
 
 - **Always** give E2E verification commands **without** `E2E_API_GATE_MODE` so the default applies: API integration tests are **skipped**. Do not add `E2E_API_GATE_MODE=on` unless the change affected API or integration tests.
 - To include API tests the user must pass the env var: `make E2E_API_GATE_MODE=on e2e_test_web_report_spec SPEC=...`
 
-Preferred command order:
+Preferred commands:
 
-- Web feature verification:
-  - `make e2e_test_web_report_spec SPEC=e2e/<web-spec>.spec.ts`
-- Management-web feature verification:
-  - `make e2e_test_management_web_report_spec SPEC=e2e/<management-spec>.spec.ts`
-- Cross-app web + management-web verification:
-  - `make e2e_test_report_scoped WEB_SPEC=e2e/<web-spec>.spec.ts MGMT_SPEC=e2e/<management-spec>.spec.ts`
-- Broad smoke:
-  - `make e2e_test_home_report`
-- Full regression (four reports: web default, web signup-enabled, web admin-only-email, management-web):
-  - `make e2e_test_report`
+- Web: `make e2e_test_web_report_spec SPEC=e2e/<spec>.spec.ts`
+- Management-web: `make e2e_test_management_web_report_spec SPEC=e2e/<spec>.spec.ts`
+- Both: `make e2e_test_report_scoped WEB_SPEC=e2e/<web>.spec.ts MGMT_SPEC=e2e/<mgmt>.spec.ts`
+- Broad smoke: `make e2e_test_home_report`
+- Full regression: `make e2e_test_report`
+- API only: `npm run test:e2e:api`
 
 Spec variables (`SPEC`, `WEB_SPEC`, `MGMT_SPEC`) may contain comma-separated spec paths when multiple related specs should run.
 
-Extended reference: **response-ending-make-verify** skill (command tree, API gate, multi-spec examples).
+**Final COPY-PASTA prompt:** When completing the last step in a plan set (`COPY-PASTA.md` / `00-EXECUTION-ORDER.md`), assume the operator ran all prompts without running tests until the end. List **all** cumulative verification commands for the whole set in one fenced `bash` block (dedupe; order: build/lint → unit → API → E2E). See **response-ending-make-verify**, **plan-completion**, and **plan-files-convention** skills.
+
+Extended reference: **response-ending-make-verify**, **ui-e2e-screenshot-report**, and **plan-completion** skills.
diff --git a/.cursor/rules/env-expiration-naming.mdc b/.cursor/rules/env-expiration-naming.mdc
new file mode 100644
index 00000000..e962090f
--- /dev/null
+++ b/.cursor/rules/env-expiration-naming.mdc
@@ -0,0 +1,13 @@
+---
+description: Names ending in _EXPIRATION (env + exported constants) use seconds only; no _SECONDS suffix on the symbol.
+globs:
+  - "**/*.env*"
+  - "**/parseEnv*.ts"
+  - "**/*Expiration*.ts"
+  - "**/productMembershipDefaults*.ts"
+alwaysApply: false
+---
+
+# Expiration naming
+
+Follow [`env-expiration-naming`](.cursor/skills/env-expiration-naming/SKILL.md): env keys and exported constants that denote expiration durations end with `_EXPIRATION`; values are seconds — do not append `_SECONDS` to those names.
diff --git a/.cursor/rules/env-file-formatting.mdc b/.cursor/rules/env-file-formatting.mdc
index 812cfdb2..22b24614 100644
--- a/.cursor/rules/env-file-formatting.mdc
+++ b/.cursor/rules/env-file-formatting.mdc
@@ -1,5 +1,5 @@
 ---
-description: Environment file formatting - non-empty values in double quotes, empty unset
+description: Node/Docker env formatting — double quotes for non-empty values; K8s source/*.env is unquoted
 globs:
   - "**/.env"
   - "**/.env.*"
@@ -12,9 +12,20 @@ alwaysApply: false
 
 # Environment File Formatting
 
+## Node / Docker env files
+
+Applies to app `.env.example`, `infra/config/env-templates/*.env.example`,
+`infra/config/local/*.env`, and `dev/env-overrides/**/*.env`.
+
 - **Non-empty values**: Use double quotes (e.g. `API_PORT="3000"`).
 - **Empty/unset values**: No value after `=` (e.g. `OPTIONAL_VAR=`).
-- **Alignment**: When creating or editing generated env files, follow variable order and grouping from canonical templates/examples in [`infra/config/env-templates/`](../../infra/config/env-templates/) and app `.env.example` files. Only values may differ.
+- **Alignment**: When creating or editing generated env files, follow variable order and grouping from canonical templates/examples in [`infra/config/env-templates/`](/infra/config/env-templates) and app `.env.example` files. Only values may differ.
 - **Order (mixed files)**: When a file mixes server-side keys with `NEXT_PUBLIC_*`, put **all non-`NEXT_PUBLIC_*` assignments first**, blank line, then all `NEXT_PUBLIC_*`. See `.cursor/skills/env-file-formatting/SKILL.md`.
 
 Correct: `DATABASE_HOST="localhost"`, `EMPTY_VALUE=`. Incorrect: `DATABASE_HOST=localhost`, `EMPTY_VALUE=""`.
+
+## K8s `source/*.env` (exception)
+
+`infra/k8s/**/source/*.env` is **not** covered by the double-quote rule above. Use **unquoted**
+values: `DB_PORT=5432`, `NODE_ENV=production`, `LOG_DIR=`. See
+`.cursor/skills/env-file-formatting/SKILL.md` and [infra/k8s/INFRA-K8S-BASE.md](/infra/k8s/INFRA-K8S-BASE.md).
diff --git a/.cursor/rules/github-actions-yaml.mdc b/.cursor/rules/github-actions-yaml.mdc
new file mode 100644
index 00000000..6c2ce795
--- /dev/null
+++ b/.cursor/rules/github-actions-yaml.mdc
@@ -0,0 +1,76 @@
+---
+description: GitHub Actions YAML best practices for workflow files
+globs:
+  - ".github/workflows/*.yml"
+  - ".github/workflows/*.yaml"
+alwaysApply: false
+---
+
+# GitHub Actions YAML Best Practices
+
+## Quote Style in YAML Files
+
+YAML files use **double quotes** for strings (configured via override in `.prettierrc.json`).
+
+- JavaScript/TypeScript use single quotes
+- YAML files use double quotes
+- This is enforced consistently by both IDE save and `npm run lint:fix`
+
+## Critical Rules
+
+### 1. Multi-line Shell Scripts with Special Characters
+
+When a `run:` block contains shell scripts that generate strings with markdown or special characters, use heredocs instead of quoted strings.
+
+**Problem:**
+
+```yaml
+run: |
+  BODY="## Title
+  **Bold**: value"  # ❌ ** interpreted as YAML alias
+```
+
+**Solution:**
+
+```yaml
+run: |
+  BODY=$(cat <<EOF
+  ## Title
+  **Bold**: value
+  EOF
+  )  # ✅ Heredoc prevents YAML parsing issues
+```
+
+### 2. YAML Special Characters to Watch
+
+These characters have special meaning in YAML and can cause parsing errors:
+
+- `*` - Alias reference (at start of line or value)
+- `&` - Anchor definition
+- `@` - Reserved for future use
+- `` ` `` - Reserved for future use
+- `{`, `}` - Flow mappings
+- `[`, `]` - Flow sequences
+
+### 3. When to Use Heredocs in GitHub Actions
+
+Use heredocs when:
+
+- Generating markdown with `**bold**`, `*italic*`, or lists
+- Creating multi-line content with variable interpolation
+- Building JSON or YAML within shell scripts
+- Concatenating multiple conditional sections
+
+### 4. Validation
+
+Always validate YAML syntax after editing workflows:
+
+```bash
+python3 -c "import yaml; yaml.safe_load(open('.github/workflows/file.yml'))"
+npm run lint:fix
+```
+
+## See Also
+
+- GitHub Actions syntax: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
+- YAML specification: https://yaml.org/spec/1.2.2/
diff --git a/.cursor/rules/import-specifiers-tiered.mdc b/.cursor/rules/import-specifiers-tiered.mdc
new file mode 100644
index 00000000..995b471a
--- /dev/null
+++ b/.cursor/rules/import-specifiers-tiered.mdc
@@ -0,0 +1,19 @@
+---
+description: Tier B Next.js apps and Tier C packages/ui — extensionless relatives; Tier A uses NodeNext .js
+globs:
+  - "apps/web/src/**/*.ts"
+  - "apps/web/src/**/*.tsx"
+  - "apps/management-web/src/**/*.ts"
+  - "apps/management-web/src/**/*.tsx"
+  - "packages/ui/**/*.ts"
+  - "packages/ui/**/*.tsx"
+alwaysApply: false
+---
+
+# Tiered import specifiers
+
+- **Tier A** (`packages/**` except `packages/ui`, Node apps, sidecars, `tools/**`, scripts): relative TS modules use **`.js` specifiers** (NodeNext). ESLint enforces this.
+- **Tier C** (`packages/ui`): **extensionless** relatives (bundler-transpiled shared UI). ESLint NodeNext rule is **off**. Do not add `.js` — breaks resolution to `.tsx` sources.
+- **Tier B** (`apps/web/src`, `apps/management-web/src`): keep **extensionless** relative imports unless you have confirmed **`next build`** succeeds with `.js` specifiers toward `.tsx` sources.
+
+Do not mass-refactor Tier B or Tier C imports to match Tier A without a green Turbopack production build. See [docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md](/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md) and [vercel/next.js#82945](https://github.com/vercel/next.js/issues/82945).
diff --git a/.cursor/rules/infra-k8s.mdc b/.cursor/rules/infra-k8s.mdc
new file mode 100644
index 00000000..2cba0b16
--- /dev/null
+++ b/.cursor/rules/infra-k8s.mdc
@@ -0,0 +1,43 @@
+---
+description: Kubernetes manifest patterns and conventions for infra/k8s
+globs:
+  - "infra/k8s/**/*.yaml"
+  - "infra/k8s/**/*.yml"
+alwaysApply: false
+---
+
+# Kubernetes Manifest Conventions
+
+## Linting and Formatting
+
+K8s YAML is formatted with Prettier using **k8s-specific overrides** (see root `.prettierrc.json`):
+
+- **Double quotes** for string values (`singleQuote: false`)
+- **2-space indentation** (`tabWidth: 2`)
+- **140-character line width** (`printWidth: 140`)
+
+**Do not** add `infra/k8s/` to `.prettierignore`.
+
+## ConfigMap Conventions
+
+- **Env sources:** Prefer `configMapGenerator` + `base/<component>/source/*.env`. Sync keys with
+  `infra/config/env-templates/*.env.example` and app `.env.example`; use **unquoted** values in
+  `source/*.env` (see **env-file-formatting** skill).
+- **No secrets in ConfigMaps:** Use SOPS / secret generators under `infra/k8s/scripts/secret-generators/`.
+
+## Kustomize
+
+Use `--load-restrictor LoadRestrictionsNone` when building remote bases:
+
+```bash
+kustomize build --load-restrictor LoadRestrictionsNone infra/k8s/alpha/api/
+```
+
+## Linear baseline
+
+Regenerate `0003a_*_linear_baseline.sql.gz` from SQL sources — do not hand-edit. See
+**linear-baseline-gz-sync** skill.
+
+## Full Documentation
+
+See **k8s** skill, [infra/k8s/INFRA-K8S-BASE.md](/infra/k8s/INFRA-K8S-BASE.md), and **argocd-gitops-push** for GitOps push reminders.
diff --git a/.cursor/rules/llm-cursor-source.mdc b/.cursor/rules/llm-cursor-source.mdc
index bacde223..d114bae3 100644
--- a/.cursor/rules/llm-cursor-source.mdc
+++ b/.cursor/rules/llm-cursor-source.mdc
@@ -1,8 +1,11 @@
 ---
-description: AI guidance source of truth is .cursor and .cursorrules; .llm/exports is machine-only
+description: AI guidance source of truth is under .cursor and .cursorrules
 globs:
   - ".cursor/skills/**"
   - ".cursor/rules/**"
+  - ".cursor/prompts/**"
+  - ".cursor/hooks/**"
+  - ".cursor/hooks.json"
   - ".cursorrules"
 alwaysApply: true
 ---
@@ -13,12 +16,11 @@ Committed **authoring** guidance for this repo lives only in:
 
 - `.cursor/skills/**`
 - `.cursor/rules/**`
+- `.cursor/prompts/**`
+- `.cursor/hooks/**` and `.cursor/hooks.json` (when present)
 - `.cursorrules`
+- `.cursorignore`
 
-**Do not** hand-edit the machine-generated tree at [`.llm/exports/`](.llm/exports/) (portable per-target exports). The **llm-exports-sync** and **llm-exports-full-sync** GitHub Actions produce and publish those files via the **`llm`** / **`llm-full`** branches and their PRs into **develop** — that is the normal path. **Do not** run `npm run llm:exports:sync` (or `export-from-cursor.mjs sync`) for routine `.cursor` work; the script is gated outside CI. Pull **develop** after the automation PR merges when you need updated exports locally.
+When you change AI guidance, commit and push only those **source** paths.
 
-**Exception — pipeline development only:** if you are changing [scripts/llm/](scripts/llm/) export code, you may set `LLM_EXPORT_ALLOW_LOCAL=1` to run a local sync; see [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md).
-
-If you use another LLM or editor, follow [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md) and, if needed, [docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md](docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md).
-
-When you change `.cursor` or `.cursorrules`, commit and push only those **source** files. Let automation refresh `.llm/exports` on the `llm` branch; do not mirror that with a local run unless you are editing the export pipeline.
+Contributor policy: [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md).
diff --git a/.cursor/rules/llm-exports-ci.mdc b/.cursor/rules/llm-exports-ci.mdc
deleted file mode 100644
index 8efc0dfa..00000000
--- a/.cursor/rules/llm-exports-ci.mdc
+++ /dev/null
@@ -1,13 +0,0 @@
----
-description: Machine exports are CI + develop only; source is .cursor
-globs:
-  - ".llm/exports/**"
-  - "scripts/llm/**"
-alwaysApply: false
----
-
-# LLM machine exports (`.llm/exports/*`)
-
-- Source of truth: `.cursor/`, `.cursorrules`. The **`llm-exports-sync`** Action (push to **`develop`**, or `workflow_dispatch`) runs incremental `sync` on the GitHub runner, then updates branch **`llm`**, and **`peter-evans/create-pull-request`** opens or updates a PR from **`llm`** into **`develop`**. Feature PRs are **not** blocked on export diffs; CI does not run `check` on the PR. The **`llm-exports-full`** Action (`workflow_dispatch` only) runs `sync --full` and updates branch **`llm-full`**. The workflow uses `git add -f` of ignored export paths on the runner. **Local** runs of the export script do **not** write unless `LLM_EXPORT_ALLOW_LOCAL=1` (for `scripts/llm/**` work only). Do not hand-mirror with ad-hoc commits; generated machine paths stay under ignore rules.
-- **Do not** hand-commit generated paths (`skills/`, `instructions/`, per-target `*-instructions.md` such as `copilot-instructions.md`) except allowlisted files (e.g. target `.gitkeep`); they are under ignore rules. See the **`llm-cursor-source`** and **`llm-exports-scripts`** skills, [docs/development/llm/EXPORT-TARGETS.md](../../docs/development/llm/EXPORT-TARGETS.md), and [`.llm/exports/LLM-EXPORTS.md`](../../.llm/exports/LLM-EXPORTS.md).
-- When editing files under `scripts/llm/**`, follow the **`llm-exports-scripts`** skill.
diff --git a/.cursor/rules/llm-history-tracking.mdc b/.cursor/rules/llm-history-tracking.mdc
deleted file mode 100644
index d59ffb55..00000000
--- a/.cursor/rules/llm-history-tracking.mdc
+++ /dev/null
@@ -1,31 +0,0 @@
----
-description: LLM history tracking — essential for any file-modifying response in this repo
-globs:
-  - "**/*"
-alwaysApply: true
----
-
-# History Tracking (Essential)
-
-When modifying **any** files in this workspace, update `.llm/history/active/[feature]/[feature]-part-01.md` (or the latest part file):
-
-```markdown
-### Session N - YYYY-MM-DD
-#### Prompt (Developer|Agent)
-[Exact verbatim prompt]
-#### Key Decisions
-- Decision 1
-#### Files Created/Modified
-- path/to/file.ts
-```
-
-## 10-Session Limit
-
-Each history file is limited to **10 sessions**. When adding session 11, create a new part file (e.g. `[feature]-part-02.md`).
-
-## File Naming
-
-- `.llm/history/active/[feature]/[feature]-part-01.md` (sessions 1-10)
-- `[feature]-part-02.md` (sessions 11-20), etc.
-
-End every file-modifying response with: **LLM History**: Updated `.llm/history/active/[feature]/[file].md` (Session N).
diff --git a/.cursor/rules/markdown-formatting.mdc b/.cursor/rules/markdown-formatting.mdc
index d98b2051..3804b415 100644
--- a/.cursor/rules/markdown-formatting.mdc
+++ b/.cursor/rules/markdown-formatting.mdc
@@ -12,3 +12,13 @@ alwaysApply: false
 - Blank lines around lists, headings, code blocks.
 - Use `-` for unordered lists. ATX headings (`#`). Code blocks with language identifier.
 - **Bold** with `**text**`, *italic* with `*text*`, inline `code` with backticks.
+
+## Links and References
+
+- Use `[text](url)` format
+- **Cross-tree** (different top-level dirs): repo-root path with leading `/`, e.g.
+  `[skill](/.cursor/skills/foo/SKILL.md)`, `[QUICK-START](/docs/QUICK-START.md)`
+- **Same subtree** (e.g. both under `docs/`): sibling-relative is fine, e.g.
+  `[ENV-REFERENCE](development/env/ENV-REFERENCE.md)` from `docs/QUICK-START.md`
+- **Do not** use deep `../../../` chains or machine paths (`/Users/...`)
+- See **documentation-conventions** skill for full link policy
diff --git a/.cursor/rules/openapi-sync.mdc b/.cursor/rules/openapi-sync.mdc
new file mode 100644
index 00000000..59ad3150
--- /dev/null
+++ b/.cursor/rules/openapi-sync.mdc
@@ -0,0 +1,43 @@
+---
+description: Require OpenAPI updates for API surface changes
+globs:
+  - "apps/api/src/routes/**/*.ts"
+  - "apps/management-api/src/routes/**/*.ts"
+  - "apps/api/src/app.ts"
+  - "apps/management-api/src/app.ts"
+  - "apps/api/src/controllers/**/*.ts"
+  - "apps/management-api/src/controllers/**/*.ts"
+  - "apps/api/src/lib/**/*.ts"
+  - "apps/management-api/src/lib/**/*.ts"
+alwaysApply: false
+---
+
+# OpenAPI Sync Rule
+
+When a change affects HTTP API behavior, update the matching OpenAPI spec in the same change:
+
+- `apps/api/openapi.yml`
+- `apps/management-api/openapi.yml`
+
+See **swagger-openapi** skill for Metaboost OpenAPI conventions.
+
+## Changes that require spec updates
+
+- New/removed/renamed routes or methods
+- Request validation changes (required fields, enums, limits, types)
+- Response shape or status-code changes
+- Authentication or authorization changes (including permission semantics)
+
+## Minimum update requirements
+
+- Add or update `operationId` (unique and stable)
+- Keep operation `security` accurate (`security: []` for public endpoints)
+- Ensure requestBody and responses are documented
+- Add or update at least one realistic example for mutating operations
+
+## Required PR evidence for route-related changes
+
+- When `openapi:check` exists in root `package.json`, include `./scripts/nix/with-env npm run openapi:check` output in the PR description
+- Route parity evidence for changed endpoints (path+method, `operationId`)
+- If auth behavior changed, include explicit 401 vs 403 behavior notes
+- If a route-related change does not require spec edits, PR includes explicit justification
diff --git a/.cursor/rules/operator-only-git-operations.mdc b/.cursor/rules/operator-only-git-operations.mdc
new file mode 100644
index 00000000..b642dadd
--- /dev/null
+++ b/.cursor/rules/operator-only-git-operations.mdc
@@ -0,0 +1,41 @@
+---
+description: Git and gh write operations are operator-only; agents implement locally and give copy-paste commands.
+alwaysApply: true
+---
+
+# Operator-only Git and publish operations
+
+Agents implement code and manifest changes locally. **Git operations are operator-only** — that includes both **`git`** and **`gh`**. Treat every `gh` command that creates, updates, or deletes remote repo state as a git write (same policy as `git push`).
+
+## Agents must not run
+
+**`git` writes** (unless the user explicitly asked for that exact command in that message):
+
+- `git commit`, `git push`, `git tag` / tag push, force push, remote branch delete
+- Merges, rebases, or checkouts that rewrite history for publish
+
+**`gh` writes** (same rule — `gh` is a git operation here):
+
+- `gh pr create`, `gh pr merge`, `gh pr close`, `gh pr reopen`, `gh pr edit`
+- `gh release create`, `gh api` calls that mutate refs, issues, or releases
+- Any `gh` subcommand that opens, merges, closes, or updates PRs/branches/tags/releases
+
+Also prohibited without explicit user request: admin merges to protected branches (`staging`, `main`, `develop`) and anything that triggers **Publish (staging)** / **Publish (main)** workflows or Metaboost signing publish.
+
+**Read-only is fine** when investigating: `git status`, `git diff`, `git log`, `gh pr view`, `gh issue view`, `gh run list`, read-only `gh api`.
+
+## Agents must do instead
+
+1. Leave changes in the working tree (or commit **only** when the user explicitly requested a commit).
+2. End with a fenced `bash` block of **exact `git` and `gh` commands for the operator** to review, commit, push, open PR, merge, and publish.
+3. State which branch the PR should target (e.g. `staging` for Metaboost publish tags) and what to wait for after merge (CI tag, image publish).
+
+## Why
+
+Protected branches and publish pipelines are operator-controlled. Agent-driven pushes and merges bypass review and can trigger unintended releases.
+
+## Related
+
+- User rule: commit only when explicitly requested
+- **github** skill — read-only `gh` examples; no agent merges (when adopted)
+- **argocd-gitops-push** — operator pushes GitOps repos for cluster sync
diff --git a/.cursor/rules/plan-creation.mdc b/.cursor/rules/plan-creation.mdc
index 37a74083..0192ca5f 100644
--- a/.cursor/rules/plan-creation.mdc
+++ b/.cursor/rules/plan-creation.mdc
@@ -10,7 +10,9 @@ alwaysApply: true
 When creating a plan, if it is too large, **do not implement it immediately**. Instead:
 
 1. Break it into separate files
-2. Save those files in `.llm/plans/active/`
+2. Save those files in the `.llm/plans/active/` directory (or appropriate subdirectory)
 3. Wait for the user to prompt you to complete them one-by-one
 
 Plans must be under 300 lines. For file layout (00-EXECUTION-ORDER, COPY-PASTA, etc.), use the **plan-files-convention** skill (`.cursor/skills/plan-files-convention/SKILL.md`).
+
+This ensures plans remain manageable and can be executed incrementally.
diff --git a/.cursor/rules/plan-execution-completion-tracking.mdc b/.cursor/rules/plan-execution-completion-tracking.mdc
index eefd379a..24e7ec55 100644
--- a/.cursor/rules/plan-execution-completion-tracking.mdc
+++ b/.cursor/rules/plan-execution-completion-tracking.mdc
@@ -14,5 +14,11 @@ When executing a plan set from `.llm/plans/active/**`:
 3. Move each completed numbered plan file from `active/` to the mirrored `completed/` directory path.
 4. Keep `COPY-PASTA.md` and `00-*` files in `active/` until all numbered prompts are complete.
 5. When all numbered prompts are complete, move the remaining plan-set files and directory to `completed/`.
+6. On the response that completes the **last** numbered prompt, end with **all** cumulative operator verification commands for the whole set in one fenced `bash` block (see **response-ending-make-verify** skill).
+7. Update cross-references in `.llm/LLM.md` or the project `00-SUMMARY.md` if the completed set is indexed there.
+
+**Plan lifecycle:** This rule is the authoritative plan-completion policy for Metaboost. Podverse
+`plan-lifecycle` is not duplicated here. See **plan-files-convention** for directory layout and
+**plan-completion** skill for archiving and final cumulative verification commands.
 
 This tracking is required for plan implementation responses so progress is durable and visible.
diff --git a/.cursor/rules/prefer-shared-ui-web-management.mdc b/.cursor/rules/prefer-shared-ui-web-management.mdc
new file mode 100644
index 00000000..5ab2535d
--- /dev/null
+++ b/.cursor/rules/prefer-shared-ui-web-management.mdc
@@ -0,0 +1,33 @@
+---
+description: Prefer @metaboost/ui for shared primitives; web-first style when web and management-web overlap
+globs:
+  - "apps/web/src/**/*.tsx"
+  - "apps/management-web/src/**/*.tsx"
+alwaysApply: false
+---
+
+# Prefer shared UI (web + management-web)
+
+When adding or changing UI in **web** or **management-web**:
+
+## Order
+
+1. **Check `@metaboost/ui` first** — reuse an existing export if it fits.
+2. **If both apps need the same generic behavior** — implement **once** in `packages/ui/src/components/**` (or hooks) and export from `packages/ui/src/index.ts`.
+3. **App-local components** — only for shell, routing, or product-specific behavior.
+
+## Style convergence
+
+When **web** and **management-web** already have overlapping patterns:
+
+- **Prefer the existing web app’s visual baseline** in the shared implementation unless there is a documented accessibility or product reason not to.
+- **Do not** fork near-duplicate components in each app when one shared primitive can serve both with props (`appearance`, `variant`, etc.).
+
+## Before adding anything new
+
+- Search `packages/ui` and `apps/web/src/components` for an existing pattern to promote or extend.
+- See **reusable-components** skill and **ui-component-promotion** skill (when adopted).
+
+## i18n
+
+- Shared primitives must not embed user-facing copy; apps pass localized strings (see **shared-ui-i18n** rule).
diff --git a/.cursor/rules/shared-ui-i18n.mdc b/.cursor/rules/shared-ui-i18n.mdc
new file mode 100644
index 00000000..c8785a86
--- /dev/null
+++ b/.cursor/rules/shared-ui-i18n.mdc
@@ -0,0 +1,27 @@
+---
+description: Shared UI (@metaboost/ui) — no embedded user-facing copy; apps localize via next-intl
+globs:
+  - "packages/ui/src/**/*.tsx"
+  - "packages/ui/src/**/*.ts"
+  - "apps/web/src/**/*.tsx"
+  - "apps/management-web/src/**/*.tsx"
+alwaysApply: false
+---
+
+# Shared UI and i18n
+
+## Do
+
+- Keep `packages/ui` **framework-agnostic**: do not import `next-intl` or read app message catalogs inside `@metaboost/ui`.
+- Pass **all** user-visible strings, `aria-label`, `title`, empty states, and loading text from the app via props.
+- When adding new copy-bearing props, add keys to `apps/web` and/or `apps/management-web` `i18n/originals/en-US.json` and keep other locales in sync (see **i18n** skill and **i18n-locale-language** rule).
+
+## Do not
+
+- Do not hardcode English — or any single locale — in shared components as **defaults** for text that end users or assistive tech will see.
+- Do not add “temporary” English defaults in `@metaboost/ui` to save app wiring; wire the app instead.
+
+## Review checklist
+
+- Any new string literal in `packages/ui` shown in the UI or read by AT → move to app props.
+- Formatting with ICU variables (`{name}`) stays in app `t(...)` calls, not inside `@metaboost/ui`.
diff --git a/.cursor/rules/startup-validation-env-order.mdc b/.cursor/rules/startup-validation-env-order.mdc
new file mode 100644
index 00000000..02323bca
--- /dev/null
+++ b/.cursor/rules/startup-validation-env-order.mdc
@@ -0,0 +1,21 @@
+---
+description: Align startup validation.ts push order with apps/*/.env.example when practical.
+globs:
+  - "apps/**/lib/startup/validation.ts"
+alwaysApply: false
+---
+
+# Startup validation order vs env files
+
+Use the **startup-validation-env-order** skill
+(`.cursor/skills/startup-validation-env-order/SKILL.md`) for full detail.
+
+## Do
+
+- Add new `results.push(...)` entries in the same **section order** as `apps/<app>/.env.example`.
+- Place vars from the **last** env section at the **end** of `validateAllEnvironmentVariables`, with a comment referencing that section.
+- Update validation when you add or move keys in `.env.example`.
+
+## Don't
+
+- Insert late-section env validations into an unrelated block just because the validation `category` label differs from the env header.
diff --git a/.cursor/rules/test-timeout-budget.mdc b/.cursor/rules/test-timeout-budget.mdc
new file mode 100644
index 00000000..d669b545
--- /dev/null
+++ b/.cursor/rules/test-timeout-budget.mdc
@@ -0,0 +1,33 @@
+---
+description: Test timeouts default to 10s; raise only as a documented one-off when necessary.
+globs:
+  - "apps/web/e2e/**/*.spec.ts"
+  - "apps/management-web/e2e/**/*.spec.ts"
+  - "apps/web/**/*.test.ts"
+  - "apps/web/**/*.test.tsx"
+  - "apps/management-web/**/*.test.ts"
+  - "apps/management-web/**/*.test.tsx"
+alwaysApply: false
+---
+
+# Test Timeout Budget
+
+Default test timeouts must stay at **10 seconds or less**. Longer waits waste operator time and hide real failures.
+
+## Playwright E2E
+
+- **Config default:** `apps/web/playwright.config.ts` and `apps/management-web/playwright.config.ts` use `timeout: 10_000`.
+- **Do not** add `test.setTimeout(...)` above 10s in specs unless a specific test genuinely needs it.
+- **Do not** set per-assertion `timeout:` (e.g. `toBeVisible({ timeout: 15_000 })`) above the test budget.
+- When a one-off exception is required, add a short inline comment explaining why (e.g. cold-start seed, known slow CI step).
+
+## Unit / integration (Vitest)
+
+- Prefer fast, deterministic tests. Do not add long `vi.waitFor` / polling loops to paper over flakiness.
+- Fix root causes (missing polyfills, unstable assets, remount churn) instead of raising timeouts.
+
+## When tests fail at 10s
+
+1. **Diagnose** whether the failure is slowness or instability (detached DOM, remount loops, bad fixtures) or a **wrong locator** (element never appears; common in `capturePageLoad` / `actionAndCapture` `scrollToElement` after assertions passed with a looser matcher).
+2. **Fix the cause** (correct locator, polyfill, narrower E2E scope, stable seed asset, unit-test the interaction). Do not raise timeouts to wait for elements that cannot match.
+3. **Raise timeout only** when the step is legitimately slow and stable — document it as a one-off in that test.
diff --git a/.cursor/skills/CURSOR-SKILLS.md b/.cursor/skills/CURSOR-SKILLS.md
new file mode 100644
index 00000000..bdf658fc
--- /dev/null
+++ b/.cursor/skills/CURSOR-SKILLS.md
@@ -0,0 +1,7 @@
+# `.cursor/skills/`
+
+Task- and domain-specific agent workflows. One skill folder per topic; each folder contains a `SKILL.md` with YAML frontmatter.
+
+- Add or edit skills when agents need repeatable patterns (API, E2E, K8s, and so on).
+- Skill `name` in frontmatter must match the folder name.
+- See **llm-cursor-source** and [DOCS-DEVELOPMENT-LLM.md](/docs/development/llm/DOCS-DEVELOPMENT-LLM.md).
diff --git a/.cursor/skills/INDEX.md b/.cursor/skills/INDEX.md
index 0870e8c0..8b186f38 100644
--- a/.cursor/skills/INDEX.md
+++ b/.cursor/skills/INDEX.md
@@ -1,24 +1,31 @@
 # Metaboost Cursor skills
 
-Skills are invoked when the task matches their "when to use" scope. **For task → skill mapping, see [AGENTS.md](../../AGENTS.md) § When to use which skill.**
+Skills are invoked when the task matches their "when to use" scope. **For task → skill mapping, see [AGENTS.md](/AGENTS.md) § When to use which skill.**
 
 ## Quick reference
 
-| Directory                   | When to use                                                                                               |
-| --------------------------- | --------------------------------------------------------------------------------------------------------- |
-| api                         | Express API patterns                                                                                      |
-| api-testing                 | Adding/changing API routes, auth, or integration tests                                                    |
-| argocd-gitops-push          | Changing infra/k8s/ or k8s sync targets; add push reminder                                                |
-| linear-db-migrations        | `infra/k8s/base/db/source/`, ops migration jobs, `scripts/database/`, admin env keys                      |
-| llm-cursor-source           | What to commit under `.cursor/`; `.llm/exports` automation (see `llm-exports-ci` rule)                    |
-| llm-exports-scripts         | `scripts/llm/**` export pipeline, adapters, vendor CLI; keep in sync with Podverse when matching behavior |
-| llm-history                 | Updating history or starting feature work                                                                 |
-| plan-files-convention       | Creating, saving, or completing multi-step plans (COPY-PASTA)                                             |
-| single-readme               | Adding index/overview docs – repo has only one README.md at root                                          |
-| web                         | Next.js app patterns                                                                                      |
-| e2e-page-tests              | Layout or behavior changes in web/management-web                                                          |
-| response-ending-make-verify | Ending implementation responses with E2E make commands                                                    |
-| i18n                        | Translation keys, locales, generating translations                                                        |
-| path-casing-imports         | Relative imports or CI module-not-found (casing)                                                          |
+| Directory                       | When to use                                                                                                |
+| ------------------------------- | ---------------------------------------------------------------------------------------------------------- |
+| api                             | Express API patterns                                                                                       |
+| api-testing                     | Adding/changing API routes, auth, or integration tests                                                     |
+| argocd-gitops-push              | Changing infra/k8s/ or k8s sync targets; add push reminder                                                 |
+| docker-runtime-workspace-parity | New/changed `packages/*`, `@metaboost/*` app deps, `infra/docker/local/**` Dockerfiles, container errors   |
+| linear-db-migrations            | `infra/k8s/base/db/source/`, ops migration jobs, `scripts/database/`, admin env keys                       |
+| llm-cursor-source               | What to commit under `.cursor/`, `.cursorrules`, and `.cursorignore`                                       |
+| plan-files-convention           | Creating, saving, or completing multi-step plans (COPY-PASTA)                                              |
+| single-readme                   | Adding index/overview docs – repo has only one README.md at root                                           |
+| web                             | Next.js app patterns                                                                                       |
+| e2e-page-tests                  | Layout or behavior changes in web/management-web                                                           |
+| response-ending-make-verify     | Ending implementation responses with E2E make commands                                                     |
+| ui-e2e-screenshot-report        | Targeted screenshot report after UI changes; report paths under `.artifacts/e2e-reports/`                  |
+| styles-source-of-truth          | Design tokens and themes in `packages/ui/src/styles/`                                                      |
+| modal-layout-contract           | `Modal` / `ModalDialogContent` dialog footer and overflow rules                                            |
+| ui-component-promotion          | Extract shared UI from web + management-web into `@metaboost/ui`                                           |
+| reusable-components             | Prefer `@metaboost/ui` over app-local duplicates                                                           |
+| i18n                            | Translation keys, locales, generating translations                                                         |
+| management-post-save-navigation | Dedicated management-web create/edit one-row pages; list redirect after primary save (exceptions in skill) |
+| k8s                             | `infra/k8s/` Kustomize bases vs overlays; shared bundles only in overlays with matching `?ref=`            |
+| path-casing-imports             | Relative imports or CI module-not-found (casing)                                                           |
+| import-specifiers-tiered        | Tier A `.js` vs Tier B extensionless Next `src`; codemods or cross-tier import edits                       |
 
 Other skills in this directory cover forms, tables, DB/ORM, management-web CRUD, documentation, and style. Rules (`.cursor/rules/*.mdc`) apply automatically by glob or always; see AGENTS.md.
diff --git a/.cursor/skills/abcmemory/SKILL.md b/.cursor/skills/abcmemory/SKILL.md
new file mode 100644
index 00000000..f6694a5c
--- /dev/null
+++ b/.cursor/skills/abcmemory/SKILL.md
@@ -0,0 +1,92 @@
+---
+name: abcmemory
+description: User vocabulary abcmemory and abcremember — where Cursor guidance lives and how to persist new instructions. Use when the user says abcmemory or abcremember.
+---
+
+# abcmemory / abcremember
+
+## One rule (Cursor-only)
+
+**abcmemory is only under `.cursor/`** (plus `.cursorrules` and `.cursorignore`). That is where Cursor loads standing agent guidance.
+
+**`.llm/` is a planning workspace** (plans, optional history, human templates, reference context). It is **not** abcmemory. Skills under `.cursor/` may _reference_ `.llm/plans/` for workflow, but **abcremember** writes to `.cursor/` unless you explicitly ask to store something under `.llm/`.
+
+## When to use
+
+- User says **abcmemory** — they mean the repo's Cursor guidance files (skills, rules, prompts, hooks, etc.).
+- User says **abcremember** — create or update abcmemory with what they told you, then apply it going forward.
+
+## Where abcmemory lives
+
+Committed guidance for this repo lives only in:
+
+- `.cursor/skills/**` — one `SKILL.md` per directory
+- `.cursor/rules/**` — Cursor rules (`.mdc`)
+- `.cursor/prompts/**` — reusable agent-facing prompt snippets
+- `.cursor/hooks/**` and `.cursor/hooks.json` — optional Cursor project hooks (when used)
+- `.cursorrules` — root-level rules
+- `.cursorignore` — path-level ignores for Cursor
+
+**Not abcmemory:** `.llm/plans/`, `.llm/history/`, `.llm/templates/`, and `.llm/context/` are operator workflow and reference material. See [.llm/LLM.md](/.llm/LLM.md).
+
+Do not duplicate the same guidance under `.github/`, docs, or `.llm/history/` unless the user explicitly asks.
+
+Contributor policy: [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](/docs/development/llm/DOCS-DEVELOPMENT-LLM.md). See also **llm-cursor-source**.
+
+## Prompts vs `.llm/templates/`
+
+- **`.cursor/prompts/`** — abcmemory; standing or reusable agent prompt snippets (kebab-case `.md` files).
+- **`.llm/templates/`** — human copy-paste templates for plans and optional history notes; not agent instruction source.
+
+## abcremember workflow
+
+1. **Understand** what the user wants remembered (scope, always-on vs path-specific vs task workflow).
+2. **Search** existing abcmemory (skills, rules, prompts, `.cursorrules`) for overlapping guidance — use the placement guide below plus grep/read, not guesswork.
+3. **Decide:**
+   - **Update** when the instruction refines, extends, or corrects existing guidance in the same domain.
+   - **Create** when the topic is new, cross-cutting enough to warrant its own skill/rule, or scoped globs need a new `.mdc`.
+4. **Write** minimally; do not duplicate the same rule in two abcmemory locations.
+5. **Report** which files were **created or updated** so the operator can commit.
+
+## How to abcremember (placement guide)
+
+Use this table to choose where to **create or update** abcmemory:
+
+| Kind of instruction                         | Prefer                                                                                                    |
+| ------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| Always-on repo convention                   | `.cursorrules` or new/updated always-applied `.cursor/rules/*.mdc`                                        |
+| Applies to specific paths/file types        | Scoped `.cursor/rules/*.mdc` with `globs`                                                                 |
+| Domain/task workflow (API, E2E, K8s, etc.)  | New or extended `.cursor/skills/<topic>/SKILL.md`                                                         |
+| Reusable prompt block for agents            | `.cursor/prompts/<topic>.md`                                                                              |
+| Cursor event automation (shell gates, etc.) | `.cursor/hooks.json` + `.cursor/hooks/*`                                                                  |
+| Path ignores for Cursor indexing            | `.cursorignore`                                                                                           |
+| Feature plan, session log, or one-off note  | `.llm/plans/` or `.llm/history/` — **not** abcremember unless you also want standing policy in `.cursor/` |
+
+## Rules when abremembering
+
+- One source of truth — do not duplicate the same guidance elsewhere unless the user explicitly asks.
+- Match existing repo style (frontmatter, skill `name` = folder name, blank line after closing `---`).
+- Keep changes minimal and focused on what the user asked to remember.
+- After abremembering, tell the user which abcmemory files were **created or updated** so they can commit them.
+
+## Build process + docs sync guardrail
+
+When build orchestration changes (`package.json` build scripts, CI validate sequencing, or workspace
+build runner behavior), abcremember requires updating build-order guidance in both:
+
+- `.cursor/skills/build-order/SKILL.md` (when adopted)
+- [AGENTS.md](/AGENTS.md) § Package Build Order
+
+Do not merge build-order changes that leave contributor build docs stale.
+
+## Theme fixture + docs sync guardrail
+
+When theme CSS variables are added, removed, or renamed (for example in `packages/ui/src/styles/_themes.scss`
+and related token files), keep theme examples and docs in lockstep.
+
+Required follow-ups in the same change:
+
+- Update maintained custom-theme fixture JSON under `tools/test-assets/assets/themes/` when present.
+- Update docs that reference those fixtures or remote custom-theme setup (`docs/development/env/ENV-REFERENCE.md`, `docs/STYLES-SCSS.md` when applicable).
+
+Do not merge theme-token changes until fixture paths are created and documented as canonical operator/E2E examples.
diff --git a/.cursor/skills/api/SKILL.md b/.cursor/skills/api/SKILL.md
index 6601131d..c3f4e03b 100644
--- a/.cursor/skills/api/SKILL.md
+++ b/.cursor/skills/api/SKILL.md
@@ -38,7 +38,7 @@ export default router;
 - **Startup validation**: `lib/startup/validation.ts` runs after loadEnv() and before importing config. It validates required env vars (e.g. API_PORT), logs results by category, and throws if any required are missing or invalid. **`WEB_BRAND_NAME`** is required only when **`ACCOUNT_SIGNUP_MODE`** uses email flows (with mailer vars), for transactional email copy. Pattern aligned with Podverse’s API startup validation.
 - Read env in `config/index.ts` only after validation has passed.
 - Use `.env.example` for documented variables; non-empty values in `.env` use double quotes; empty/unset use no value after `=`.
-- **Env alignment**: All `.env` files (including `infra/config/local/*.env`) must match the organization, section comments, and variable order of their authoritative `.env.example`; only values may differ. Generated files are filled by `make local_env_setup` (auto-generated secrets plus overrides from local override files when present). **`WEB_BRAND_NAME`** is set from dev/env-overrides/local/info.env (template contract workload **`info`**). See [docs/development/env/LOCAL-ENV-OVERRIDES.md](../../docs/development/env/LOCAL-ENV-OVERRIDES.md).
+- **Env alignment**: All `.env` files (including `infra/config/local/*.env`) must match the organization, section comments, and variable order of their authoritative `.env.example`; only values may differ. Generated files are filled by `make local_env_setup` (auto-generated secrets plus overrides from local override files when present). **`WEB_BRAND_NAME`** is set from dev/env-overrides/local/info.env (template contract workload **`info`**). See [docs/development/env/LOCAL-ENV-OVERRIDES.md](/docs/development/env/LOCAL-ENV-OVERRIDES.md).
 
 ### Async handlers
 
diff --git a/.cursor/skills/argocd-gitops-push/SKILL.md b/.cursor/skills/argocd-gitops-push/SKILL.md
index af9cd83c..c093b219 100644
--- a/.cursor/skills/argocd-gitops-push/SKILL.md
+++ b/.cursor/skills/argocd-gitops-push/SKILL.md
@@ -19,7 +19,7 @@ When adding or changing files under:
 ## What Argo CD syncs
 
 - **Alpha:** Root **`infra/k8s/alpha-application.yaml`** (when applied) points at **`infra/k8s/alpha/apps`**, which references **`infra/k8s/alpha/<component>/`** overlays.
-- **Remote environments:** Application CRs usually live in your **GitOps repo** and reference paths/branches you configure (see [docs/development/k8s/REMOTE-K8S-GITOPS.md](../../../docs/development/k8s/REMOTE-K8S-GITOPS.md)).
+- **Remote environments:** Application CRs usually live in your **GitOps repo** and reference paths/branches you configure (see [docs/development/k8s/REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md)).
 - Only the **remote** Git revision Argo CD tracks is authoritative; the agent does not push.
 
 ## When a push is required
@@ -39,6 +39,6 @@ When file-modifying work touches **`infra/k8s/`** or migration SQL under **`infr
 
 ## See also
 
-- [infra/k8s/INFRA-K8S.md](../../../infra/k8s/INFRA-K8S.md) – layout and consumption.
-- [docs/development/k8s/REMOTE-K8S-GITOPS.md](../../../docs/development/k8s/REMOTE-K8S-GITOPS.md) – remote cluster workflow.
-- [docs/development/k8s/K3D-ARGOCD-LOCAL.md](../../../docs/development/k8s/K3D-ARGOCD-LOCAL.md) – stub (local k3d removed).
+- [infra/k8s/INFRA-K8S.md](/infra/k8s/INFRA-K8S.md) – layout and consumption.
+- [docs/development/k8s/REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md) – remote cluster workflow.
+- [docs/development/k8s/K3D-ARGOCD-LOCAL.md](/docs/development/k8s/K3D-ARGOCD-LOCAL.md) – stub (local k3d removed).
diff --git a/.cursor/skills/build-order/SKILL.md b/.cursor/skills/build-order/SKILL.md
new file mode 100644
index 00000000..2ac1071e
--- /dev/null
+++ b/.cursor/skills/build-order/SKILL.md
@@ -0,0 +1,50 @@
+---
+name: build-order
+description: Keep monorepo build order dependency-safe and keep build-order docs in sync when build orchestration changes.
+---
+
+# Build Order
+
+Use this skill when you change root build orchestration, workspace build sequencing, or CI/local
+validation flows that affect build execution order.
+
+## Canonical sequence
+
+From repo root, build in this order:
+
+1. `npm run build:packages` — `@metaboost/helpers` first, then parallel helper packages, then
+   `orm` / `management-orm`, then `helpers-i18n` (see root `package.json` `build:packages` script)
+2. `npm run build:apps` — api, management-api, web, sidecars, management-web
+
+For local dev and CI, prefer **`build:packages` then `build:apps`**. Root `npm run build` runs
+`npm run build --workspaces --if-present`; do not rely on it alone for a clean first-time build when
+package `dist/` outputs are missing.
+
+## Why
+
+Package outputs (`dist/*.d.ts`) are required by downstream workspace builds. If order is broken,
+first-time builds can fail with `TS2307` module-resolution errors.
+
+## Keep in sync when build process changes
+
+When changing build order/process, update all relevant sources in the same PR:
+
+- Root `package.json` (`build`, `build:packages`, `build:apps`)
+- [AGENTS.md](/AGENTS.md) and [.llm/context/architecture.md](/.llm/context/architecture.md) if the
+  documented sequence changes
+- **build-order-doc-sync** rule targets (`package.json`, CI workflows)
+- Docker/workspace parity: **docker-runtime-workspace-parity** when new packages join `build:packages`
+
+Database bootstrap artifacts: when linear migration SQL changes, regenerate baselines per
+**linear-baseline-gz-sync** (not part of npm build, but often touched in the same infra PR).
+
+## Do
+
+- Use explicit workspace ordering for dependency-sensitive package builds.
+- Keep root build orchestration readable and staged.
+- Update contributor docs whenever orchestration behavior changes.
+
+## Don't
+
+- Do not add packages to apps without ensuring they are built in `build:packages` (or app-local build) first.
+- Do not change build sequencing without updating AGENTS.md / architecture context.
diff --git a/.cursor/skills/docker-runtime-workspace-parity/SKILL.md b/.cursor/skills/docker-runtime-workspace-parity/SKILL.md
new file mode 100644
index 00000000..45f5c797
--- /dev/null
+++ b/.cursor/skills/docker-runtime-workspace-parity/SKILL.md
@@ -0,0 +1,60 @@
+---
+name: docker-runtime-workspace-parity
+description: Prevents workspace package omissions in Docker images by verifying runtime-stage COPY coverage for every app dependency. Use when editing Dockerfiles, debugging ERR_MODULE_NOT_FOUND in containers, or changing workspace dependencies.
+---
+
+# Docker Runtime Workspace Parity (Metaboost)
+
+Use this skill when editing Metaboost Dockerfiles or workspace dependencies.
+
+## Why
+
+Builder stages can compile successfully while runtime stages fail if a workspace package is not copied into the final image.
+
+Typical failures:
+
+- `ERR_MODULE_NOT_FOUND`
+- Missing package like `@metaboost/orm` at container startup
+
+## Slim runtime stage (selective COPY)
+
+When a Dockerfile uses **selective** `COPY --from=builder` (not full `packages/`):
+
+1. Identify all `@metaboost/*` dependencies in the target app's `package.json`.
+2. In the runtime stage, verify each dependency package has both:
+   - `COPY --from=builder .../package.json ...`
+   - `COPY --from=builder .../dist/ ...`
+3. If a dependency is missing, add both COPY lines.
+4. Rebuild the image and confirm runtime startup/module import works.
+
+## Local Docker layout (`infra/docker/local/**`)
+
+Metaboost local Dockerfiles generally **`COPY packages/ ./packages/`** (whole tree). That still requires:
+
+1. **Root `package.json` workspaces** includes the new package path.
+2. **`package-lock.json`** updated after dependency changes.
+3. **`npm run build:packages`** includes the new package in dependency-safe order — see **build-order** skill and [.llm/context/architecture.md](/.llm/context/architecture.md).
+
+If a Dockerfile **does not** copy all of `packages/`, apply the slim runtime checklist above.
+
+## Scope
+
+Primary paths:
+
+- [`infra/docker/local/api/Dockerfile`](/infra/docker/local/api/Dockerfile)
+- [`infra/docker/local/management-api/Dockerfile`](/infra/docker/local/management-api/Dockerfile)
+- [`infra/docker/local/web/Dockerfile`](/infra/docker/local/web/Dockerfile)
+- [`infra/docker/local/management-web/Dockerfile`](/infra/docker/local/management-web/Dockerfile)
+- Sidecar Dockerfiles under the same directory
+
+Also apply to any new Metaboost Dockerfile or CI image that builds from this monorepo.
+
+## Fast verification pattern
+
+From monorepo root, after Dockerfile edits:
+
+```bash
+docker build -f infra/docker/local/api/Dockerfile -t metaboost-api:test .
+```
+
+Use the Dockerfile path for the app you changed.
diff --git a/.cursor/skills/documentation-conventions/SKILL.md b/.cursor/skills/documentation-conventions/SKILL.md
index 16529beb..af33980b 100644
--- a/.cursor/skills/documentation-conventions/SKILL.md
+++ b/.cursor/skills/documentation-conventions/SKILL.md
@@ -28,3 +28,24 @@ Pattern: `[FULL-PATH-WITH-HYPHENS].md`. Do not add multiple `README.md` files pe
 
 - The **only** `INDEX.md` in the repo is `.cursor/skills/INDEX.md` (skills quick reference). All other directory overviews use the full-path name (e.g. `INFRA-K8S.md`, `PACKAGES-UI.md`).
 - Plan-set indexes under `.llm/plans/` use `00-overview.md` or `00-master-plan.md`, not INDEX.md or README.md.
+
+## Cross-repo-tree links
+
+When linking to a file outside the current documentation subtree, use a **repo-root path**
+with a leading `/` (GitHub resolves these from the repository root):
+
+```markdown
+✅ Cross-tree:
+[api skill](/.cursor/skills/api/SKILL.md)
+[QUICK-START](/docs/QUICK-START.md)
+
+✅ Same subtree (e.g. both under docs/):
+[ENV-REFERENCE](development/env/ENV-REFERENCE.md)
+
+❌ Deep parent-relative chains:
+`../../../../../.cursor/skills/api/SKILL.md`
+```
+
+- **Do not** use machine-absolute paths (`/Users/...`).
+- **Avoid** `../../../` (or longer) for cross-tree targets; use `/path/from/repo/root` instead.
+- Preserve URL fragments: `/docs/FOO.md#section`.
diff --git a/.cursor/skills/e2e-page-tests/SKILL.md b/.cursor/skills/e2e-page-tests/SKILL.md
index c25efa88..d647fe7f 100644
--- a/.cursor/skills/e2e-page-tests/SKILL.md
+++ b/.cursor/skills/e2e-page-tests/SKILL.md
@@ -52,8 +52,8 @@ If the change is in **web**, add or update a spec in `apps/web/e2e/`. If it is i
 | apps/web (signup)   | `apps/web/e2e/`            | `apps/web/playwright.signup-enabled.config.ts` |
 | apps/management-web | `apps/management-web/e2e/` | `apps/management-web/playwright.config.ts`     |
 
-- **Default web E2E** uses `ACCOUNT_SIGNUP_MODE=admin_only` (signup disabled). For signup-enabled auth flows (signup, forgot-password, reset-password), use `make e2e_test_web_signup_enabled`; it starts Mailpit via `infra/docker/e2e/docker-compose.yml` and uses the signup-enabled config. `make test_clean` removes Mailpit with other test containers. See [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md) (“E2E and ACCOUNT_SIGNUP_MODE”).
-- Use the **deterministic E2E seed** for data (e.g. `e2e-bucket-owner@example.com` / `Test!1Aa` for web bucket-owner; management-web login is by username `e2e-superadmin` and password `Test!1Aa`). See [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md).
+- **Default web E2E** uses `ACCOUNT_SIGNUP_MODE=admin_only` (signup disabled). For signup-enabled auth flows (signup, forgot-password, reset-password), use `make e2e_test_web_signup_enabled`; it starts Mailpit via `infra/docker/e2e/docker-compose.yml` and uses the signup-enabled config. `make test_clean` removes Mailpit with other test containers. See [docs/testing/E2E-PAGE-TESTING.md](/docs/testing/E2E-PAGE-TESTING.md) (“E2E and ACCOUNT_SIGNUP_MODE”).
+- Use the **deterministic E2E seed** for data (e.g. `e2e-bucket-owner@example.com` / `Test!1Aa` for web bucket-owner; management-web login is by username `e2e-superadmin` and password `Test!1Aa`). See [docs/testing/E2E-PAGE-TESTING.md](/docs/testing/E2E-PAGE-TESTING.md).
 - **API gate**: E2E Make targets run API integration tests first; if they fail, Playwright does not run.
 - **Current startup model**: Playwright `webServer` now auto-starts the required API + web apps on dedicated E2E ports in production-like mode (`build` + `start`), so manual app startup is not part of normal E2E runs.
 
@@ -76,7 +76,7 @@ Page-level coverage is tracked in `.llm/plans/active/e2e-page-tests/` (e.g. `web
 - **Run report-focused home smoke (auto-opens HTML reports, captures step screenshots):** `make e2e_test_home_report`.
 - **Signup-enabled web E2E** (signup + forgot/reset auth pages; starts Mailpit, report to `web-signup-enabled/`): `make e2e_test_web_signup_enabled`.
 - **Admin-only-email web E2E (scoped report):** `make e2e_test_web_admin_only_email_report_spec SPEC=e2e/<spec>.spec.ts` (e.g. `SPEC=e2e/settings-bucket-owner-admin-only-email.spec.ts`). Full suite: `make e2e_test_web_admin_only_email`.
-- **Docs:** [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md).
+- **Docs:** [docs/testing/E2E-PAGE-TESTING.md](/docs/testing/E2E-PAGE-TESTING.md).
 
 Report mode uses a custom reporter (`scripts/e2e-html-steps-reporter.ts`) so each
 step screenshot is shown with its full "Step description" in an expandable block
diff --git a/.cursor/skills/e2e-report-order/SKILL.md b/.cursor/skills/e2e-report-order/SKILL.md
index e325dd73..6b49e2e4 100644
--- a/.cursor/skills/e2e-report-order/SKILL.md
+++ b/.cursor/skills/e2e-report-order/SKILL.md
@@ -40,5 +40,5 @@ When running one or more specs via `e2e_test_web_report_spec`, `e2e_test_managem
 
 ## Reference
 
-- Order semantics are documented in [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md) under "Report order".
+- Order semantics are documented in [docs/testing/E2E-PAGE-TESTING.md](/docs/testing/E2E-PAGE-TESTING.md) under "Report order".
 - The custom reporter (`scripts/e2e-html-steps-reporter.ts`) reads `E2E_SPEC_ORDER` (semicolon-separated spec paths) in `onEnd` and sorts `this.runs` by that order before generating the HTML, so report display matches the intended order regardless of Playwright execution order.
diff --git a/.cursor/skills/e2e-screenshot-verified-element/SKILL.md b/.cursor/skills/e2e-screenshot-verified-element/SKILL.md
index 8ed0ff3b..e3c00358 100644
--- a/.cursor/skills/e2e-screenshot-verified-element/SKILL.md
+++ b/.cursor/skills/e2e-screenshot-verified-element/SKILL.md
@@ -20,3 +20,7 @@ When the goal of the step is to document verification of a **specific element**,
 ## When not to pass
 
 Generic "page loaded" or "navigation completed" captures with no single asserted element do not need `scrollToElement`; leave the parameter omitted.
+
+## Sortable table column headers
+
+`Table.SortableHeaderCell` exposes the columnheader accessible name as `Sort by {label}. …`, not the bare column label. When passing a column header to `scrollToElement`, use a **substring** match (e.g. `/name/i`), not an exact anchor (`/^name$/i`). Reuse `expectPostLoginDashboardVisible` patterns from `e2e/helpers/advancedFixtures.ts` when asserting or centering dashboard bucket columns.
diff --git a/.cursor/skills/e2e-seed-nano-id-limits/SKILL.md b/.cursor/skills/e2e-seed-nano-id-limits/SKILL.md
new file mode 100644
index 00000000..22094718
--- /dev/null
+++ b/.cursor/skills/e2e-seed-nano-id-limits/SKILL.md
@@ -0,0 +1,58 @@
+---
+name: e2e-seed-nano-id-limits
+description: E2E seed and fixture id_text values must fit nano_id_v2 (9–15 chars). Use when adding or renaming IDs in seed scripts, E2E helpers, or fixtures that insert into id_text columns.
+---
+
+# E2E seed `id_text` limits (`nano_id_v2`)
+
+When adding deterministic E2E fixtures (`tools/**/seed-e2e.mjs`, E2E specs, or helpers), every
+**`id_text`** must satisfy the Postgres **`nano_id_v2`** domain.
+
+## Limits
+
+| Source     | Rule                                                                                  |
+| ---------- | ------------------------------------------------------------------------------------- |
+| DB domain  | `VARCHAR(15)` with `char_length` **9–15** (`0001_app_schema.sql`)                     |
+| TypeScript | `NANO_ID_V2_MIN_LENGTH` / `NANO_ID_V2_MAX_LENGTH` in `@metaboost/helpers` `nanoid.ts` |
+
+**Do not** assume descriptive strings are valid just because they look like other E2E IDs.
+Count characters before committing — a name one character too long fails at seed time with
+`value too long for type character varying(15)`.
+
+## Tables that use `nano_id_v2` for public IDs
+
+Common E2E fixture targets:
+
+- `user.id_text`
+- `bucket.id_text`
+- Management identities with public `id_text` where seeded
+
+## Naming pattern for E2E fixtures
+
+Follow existing short prefixes in `tools/web/seed-e2e.mjs`:
+
+- Good: `e2eusr000001` (12), `e2ebkt000001` (12), `e2ebkt000003` (12)
+- Bad: `e2eBucketOwner01` (16), `e2e-user-admin-01` (invalid length / characters)
+
+Prefer fixed-width numeric suffixes (`000001`, `000002`) so series stay ≤ 15.
+
+## Sync checklist
+
+When introducing or renaming a fixture `id_text`, update **all** references together:
+
+1. `tools/web/seed-e2e.mjs` and `tools/management-web/seed-e2e.mjs`
+2. E2E specs and helpers that hardcode the same `id_text` or route segments
+3. Any demo URLs or docs that list example IDs
+
+Prefer a single shared constant in the seed script; grep for stale literals after renames.
+
+## Verification
+
+After changing seed IDs, run:
+
+```bash
+make e2e_seed_web
+```
+
+Seed failure on insert is almost always an `id_text` length or sync mismatch — fix length first,
+then grep for stale string literals.
diff --git a/.cursor/skills/env-defaults-match-code/SKILL.md b/.cursor/skills/env-defaults-match-code/SKILL.md
new file mode 100644
index 00000000..5631a142
--- /dev/null
+++ b/.cursor/skills/env-defaults-match-code/SKILL.md
@@ -0,0 +1,50 @@
+---
+name: env-defaults-match-code
+description: Env vars with code fallbacks must show the default in .env.example and K8s env files. Use when adding or editing env vars that have fallback values in code.
+---
+
+# Env defaults match code
+
+## When to use
+
+When adding or editing environment variables that have fallback defaults in code (e.g.
+`readOptionalPositiveExpirationEnv('MEMBERSHIP_FREE_TRIAL_EXPIRATION', 2678400)` or helpers that
+treat unset as a documented default).
+
+**Exception:** App `config/index.ts` modules must **not** use `||` / `??` fallbacks — see
+**config-type-safety** rule. This skill applies to documented helper defaults and template parity,
+not to hiding missing required config.
+
+## Rules
+
+- **Non-empty defaults**: If code has a fallback value, the `.env.example` and K8s `source/*.env`
+  templates must include that default value — not an empty string unless unset is intentional.
+  - Example: `DEFAULT_FREE_TRIAL_EXPIRATION` / `MEMBERSHIP_FREE_TRIAL_EXPIRATION="2678400"` in
+    templates when helpers default to 31 days.
+  - Example: boolean env read as `process.env.FOO === 'true'` (default false) →
+    `.env.example` should show `FOO="false"` when documenting the default.
+
+- **Empty is intentional**: Only leave an env var empty (`KEY=`) when the "unset" state IS the
+  intended default (e.g. `LOG_DIR=` means console-only, optional mailer keys when signup mode
+  does not require mail).
+
+- **Conflicts — fix the right side**: When the code fallback differs from what's already
+  consistently set in env files:
+  - If all env files agree on a value and the code fallback is different, fix the code.
+  - If the code fallback is the established behavior and env files are inconsistent, fix the env files.
+  - Use **env-file-formatting** for formatting rules (double quotes in Node templates; unquoted in
+    K8s `source/*.env`).
+
+## Applies to
+
+- `apps/*/.env.example` and `apps/*/sidecar/.env.example`
+- `infra/config/env-templates/*.env.example`
+- `infra/k8s/base/*/source/*.env` files
+- `dev/env-overrides/local/*.env.example` (via home override stubs)
+
+## References
+
+- [env-file-formatting](/.cursor/skills/env-file-formatting/SKILL.md)
+- [env-expiration-naming](/.cursor/skills/env-expiration-naming/SKILL.md) — `*_EXPIRATION` keys
+- [ENV-REFERENCE.md](/docs/development/env/ENV-REFERENCE.md)
+- [AGENTS.md](/AGENTS.md) — project-wide conventions
diff --git a/.cursor/skills/env-expiration-naming/SKILL.md b/.cursor/skills/env-expiration-naming/SKILL.md
new file mode 100644
index 00000000..30e37311
--- /dev/null
+++ b/.cursor/skills/env-expiration-naming/SKILL.md
@@ -0,0 +1,29 @@
+---
+name: env-expiration-naming
+description: >-
+  Naming for env keys and TypeScript symbols that represent time-until-expiration or duration until
+  expiry. Use when adding or renaming MEMBERSHIP_FREE_TRIAL_EXPIRATION, JWT expiration env, or similar.
+---
+
+# Env and code: `*_EXPIRATION` naming
+
+## Rule
+
+- **Env keys** and **exported JS/TS constant names** that represent an expiration-related duration end with **`_EXPIRATION`** — not `_EXPIRATION_SECONDS`, `_SECONDS`, or other unit suffixes after `_EXPIRATION`.
+- For these names, **values are always in seconds**. Do not encode “seconds” again in the identifier; `_EXPIRATION` implies the unit.
+
+## Do
+
+- Env (membership bootstrap): `MEMBERSHIP_FREE_TRIAL_EXPIRATION`, plus premium list prices
+  `MEMBERSHIP_PREMIUM_COST_MONTHLY` / `MEMBERSHIP_PREMIUM_COST_ANNUALLY` (USD; non-expiration keys).
+- Env (JWT / tokens): management JWT expiration env vars documented with seconds.
+- Constants: `DEFAULT_FREE_TRIAL_EXPIRATION` (number of seconds when unset).
+
+## Don’t
+
+- `DEFAULT_FREE_TRIAL_EXPIRATION_SECONDS`
+- Duplicating the unit in the symbol name when `_EXPIRATION` already denotes “seconds duration.”
+
+## Related
+
+- `@metaboost/helpers` `membership/productMembershipDefaultsFromEnv.ts` uses `DEFAULT_FREE_TRIAL_EXPIRATION`.
diff --git a/.cursor/skills/env-file-formatting/SKILL.md b/.cursor/skills/env-file-formatting/SKILL.md
index e7e2cdfa..5ff63640 100644
--- a/.cursor/skills/env-file-formatting/SKILL.md
+++ b/.cursor/skills/env-file-formatting/SKILL.md
@@ -1,20 +1,39 @@
 ---
 name: env-file-formatting
-description: Env file value formatting and NEXT_PUBLIC ordering. Use when adding or editing .env,
-  .env.example, or any *.env template in the repo.
+description: Env file value formatting — double quotes for Node/Docker .env; unquoted values for
+  K8s source/*.env. Use when adding or editing .env, .env.example, or env templates.
 ---
 
 # Env file formatting
 
 ## When to use
 
-When adding or editing `.env`, `.env.example`, or any `*.env` template (including
-`infra/config/env-templates/*.env.example`, `infra/k8s/**/source/*.env`, and `dev/env-overrides/local/*.env.example`).
+When adding or editing env var files. **Which rules apply depends on the file path** (see below).
 
-## Rules
+## Node / Docker env files
 
-- **Non-empty values**: Double quotes. **Empty/unset**: no value after `=` (see `.cursor/rules/env-file-formatting.mdc`).
-- **K8s `source/*.env` comments**: at most **one** env var name per `#` line.
+Applies to app `.env` / `.env.example`, `infra/config/env-templates/*.env.example`,
+`infra/config/local/*.env`, and `dev/env-overrides/local/*.env.example`.
+
+- **Non-empty values**: Double quotes (e.g. `API_PORT="3000"`, `DATABASE_HOST="localhost"`).
+- **Empty/unset**: no value after `=` (e.g. `OPTIONAL_VAR=`).
+
+See [.cursor/rules/env-file-formatting.mdc](/.cursor/rules/env-file-formatting.mdc) for examples.
+
+## K8s ConfigMap `source/*.env`
+
+Applies to `infra/k8s/**/source/*.env` (and GitOps overlay copies) consumed by `configMapGenerator`.
+
+- **Values are unquoted** (kustomize env-file semantics).
+- **Numbers are unquoted**: `DB_PORT=5432`, not `DB_PORT="5432"`.
+- **Empty/unset**: `KEY=`.
+- **Comments**: at most **one** env var name per `#` line.
+
+Keep keys aligned with `infra/config/env-templates/*.env.example`. See also
+[infra/k8s/INFRA-K8S-BASE.md](/infra/k8s/INFRA-K8S-BASE.md).
+
+For **K8s YAML manifest** value types (string vs numeric OpenAPI fields), see **k8s** skill — not
+this skill.
 
 ## Variable order when mixing server and `NEXT_PUBLIC_*`
 
@@ -29,5 +48,6 @@ Files that are only `NEXT_PUBLIC_*` or only server keys need no extra ordering.
 
 ## References
 
-- [.cursor/rules/env-file-formatting.mdc](../../.cursor/rules/env-file-formatting.mdc)
-- [AGENTS.md](../../AGENTS.md) — env templates and local overrides
+- [.cursor/rules/env-file-formatting.mdc](/.cursor/rules/env-file-formatting.mdc)
+- [.cursor/skills/k8s/SKILL.md](/.cursor/skills/k8s/SKILL.md) — K8s YAML string vs numeric typing
+- [AGENTS.md](/AGENTS.md) — env templates and local overrides
diff --git a/.cursor/skills/generate-data-sync/SKILL.md b/.cursor/skills/generate-data-sync/SKILL.md
index 13644194..519e6b2e 100644
--- a/.cursor/skills/generate-data-sync/SKILL.md
+++ b/.cursor/skills/generate-data-sync/SKILL.md
@@ -43,4 +43,4 @@ true` for seeded rows.
 
 ## See also
 
-- **linear-db-migrations** (`.cursor/skills/linear-db-migrations/SKILL.md`) for migration layout, ops bundle sync, and runners; [docs/development/DB-MIGRATIONS.md](../../docs/development/DB-MIGRATIONS.md) for the full runbook.
+- **linear-db-migrations** (`.cursor/skills/linear-db-migrations/SKILL.md`) for migration layout, ops bundle sync, and runners; [docs/development/DB-MIGRATIONS.md](/docs/development/DB-MIGRATIONS.md) for the full runbook.
diff --git a/.cursor/skills/git-worktree-sibling/SKILL.md b/.cursor/skills/git-worktree-sibling/SKILL.md
new file mode 100644
index 00000000..8f522586
--- /dev/null
+++ b/.cursor/skills/git-worktree-sibling/SKILL.md
@@ -0,0 +1,107 @@
+---
+name: git-worktree-sibling
+description: Create and use Metaboost git worktrees in sibling directories named metaboost_<branch_slug> (underscores). Use when starting feature work, moving WIP off the main checkout, or opening the correct worktree path for a branch.
+---
+
+# Git worktree — sibling directories
+
+## When to use
+
+- Starting or continuing work on a **feature branch** without leaving `metaboost` on `develop`.
+- Moving in-progress changes out of the primary checkout into a dedicated directory.
+- Telling the agent **which folder** to edit for a given branch.
+
+## Layout
+
+| Role                                 | Path                                                     |
+| ------------------------------------ | -------------------------------------------------------- |
+| Primary checkout (stay on `develop`) | `/Users/mitcheldowney/repos/pv/metaboost`                |
+| Parent of all worktrees              | `/Users/mitcheldowney/repos/pv/`                         |
+| Feature worktree                     | `/Users/mitcheldowney/repos/pv/metaboost_<branch_slug>/` |
+
+Worktrees are **siblings** of `metaboost`, not subdirectories inside it.
+
+## Directory naming (canonical)
+
+```text
+metaboost_<branch_slug>
+```
+
+Derive `<branch_slug>` from the git branch name:
+
+1. Replace every `/` with `_`
+2. Replace every `-` with `_`
+
+Examples:
+
+| Branch                       | Worktree directory                     |
+| ---------------------------- | -------------------------------------- |
+| `feature/billing-membership` | `metaboost_feature_billing_membership` |
+| `chore/typeorm-v1`           | `metaboost_chore_typeorm_v1`           |
+| `llm/cursor-hooks`           | `metaboost_llm_cursor_hooks`           |
+
+## Create a worktree
+
+Run from the primary repo. The branch must **not** be checked out in `metaboost`.
+
+```bash
+cd /Users/mitcheldowney/repos/pv/metaboost
+git checkout develop
+git worktree add ../metaboost_feature_my_feature feature/my-feature
+```
+
+Create a new branch at the same time:
+
+```bash
+git worktree add -b feature/my-feature ../metaboost_feature_my_feature develop
+cd ../metaboost_feature_my_feature
+make local_env_setup
+./scripts/nix/with-env npm install
+```
+
+## Move WIP from primary checkout into a worktree
+
+```bash
+cd /Users/mitcheldowney/repos/pv/metaboost
+git stash push -u -m "feature-name wip"
+git checkout develop
+git worktree add ../metaboost_feature_my_feature feature/my-feature
+cd ../metaboost_feature_my_feature
+make local_env_setup
+git stash pop
+```
+
+Use `git stash push -u` so **untracked** files (e.g. `.llm/plans/active/...`) move with the stash.
+
+## Daily workflow
+
+- **Edit feature code** in the sibling worktree (`metaboost_*`), not in `metaboost` unless on `develop`.
+- **Commands** run from that worktree's root: `./scripts/nix/with-env npm run lint`, `make e2e_test_web_report_spec`, etc.
+- **First-time env in a worktree:** `make local_env_setup` (and `make local_env_link` if using home overrides).
+
+List worktrees:
+
+```bash
+cd /Users/mitcheldowney/repos/pv/metaboost
+git worktree list
+```
+
+## Remove a worktree
+
+```bash
+cd /Users/mitcheldowney/repos/pv/metaboost
+git worktree remove ../metaboost_feature_my_feature
+git worktree prune
+```
+
+## Agent rules
+
+1. Before editing files, confirm **which worktree** matches the user's branch (`git worktree list` or ask).
+2. Do **not** implement feature work on `metaboost` while it is on `develop` if a sibling worktree exists for that branch.
+3. When the user names a branch, resolve the directory as `metaboost_<branch_slug>` under `repos/pv/`.
+4. Plans for deferred work live under `.llm/plans/active/` in the **worktree** that owns the feature branch.
+
+## Related
+
+- [DOCS-DEVELOPMENT-LLM.md](/docs/development/llm/DOCS-DEVELOPMENT-LLM.md)
+- **nix-terminal-wrapper** rule — `./scripts/nix/with-env` from worktree root
diff --git a/.cursor/skills/github/SKILL.md b/.cursor/skills/github/SKILL.md
new file mode 100644
index 00000000..54da1e23
--- /dev/null
+++ b/.cursor/skills/github/SKILL.md
@@ -0,0 +1,83 @@
+---
+name: github
+description: gh CLI and GitHub issue/PR workflow for agents. Use when referencing PRs, issues, or Dependabot updates.
+version: 1.0.0
+---
+
+# GitHub Workflows & Issue Management
+
+## Agent policy: `gh` is a git operation
+
+For agents, **`gh` counts as git** — same operator-only policy as `git`. Read-only `gh` is fine
+(`gh pr view`, `gh issue list`, `gh run list`). Do **not** run write `gh` commands
+(`gh pr create`, `gh pr merge`, `gh release create`, mutating `gh api`, etc.) unless the user
+explicitly requests that exact command in that message.
+
+After implementation, give the operator fenced `bash` commands (`git` and `gh`) for commit, push,
+PR, and merge. See **operator-only-git-operations** rule.
+
+## Repository information
+
+- **Repository**: `podverse/metaboost`
+- **Full URL**: https://github.com/podverse/metaboost
+- **Issues**: https://github.com/podverse/metaboost/issues
+- **Pull Requests**: https://github.com/podverse/metaboost/pulls
+
+## Accessing PRs and issues
+
+### Using GitHub CLI (when available)
+
+```bash
+gh pr view 35
+gh pr list
+gh issue view 42
+gh issue list
+```
+
+The `gh` CLI requires network permissions. If certificate errors occur, the command may need full
+permissions in sandboxed environments.
+
+### Direct URLs
+
+- **PR**: `https://github.com/podverse/metaboost/pull/{number}`
+- **Issue**: `https://github.com/podverse/metaboost/issues/{number}`
+
+## Common Dependabot PR patterns
+
+### PR title format
+
+```
+chore(deps): bump {package} from {old-version} to {new-version}
+```
+
+### Labels
+
+See [docs/repo-management/GITHUB-LABELS.md](/docs/repo-management/GITHUB-LABELS.md).
+
+### Finding affected files
+
+```bash
+grep -r "@types/node" --include="package.json"
+```
+
+## Workflow for dependency updates
+
+1. Identify affected workspaces
+2. Update versions consistently
+3. On macOS after lockfile Linux refresh: `./scripts/development/update-lockfile-linux.sh`, then
+   host `npm install` (see **native-deps-platform-mismatch**)
+4. Operator runs `npm run lint` and targeted tests
+
+## Git history for PRs
+
+```bash
+git log --all --oneline --grep="#35"
+git log --all --oneline --grep="chore(deps)"
+git branch -vv
+```
+
+## Related documentation
+
+- [GITHUB-LABELS.md](/docs/repo-management/GITHUB-LABELS.md)
+- [CONTRIBUTING.md](/docs/development/CONTRIBUTING.md) — when present
+- [global](/.cursor/skills/global/SKILL.md) — repo-wide patterns
diff --git a/.cursor/skills/global/SKILL.md b/.cursor/skills/global/SKILL.md
index e1037b3c..905633ce 100644
--- a/.cursor/skills/global/SKILL.md
+++ b/.cursor/skills/global/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: metaboost-global-patterns
-description: Global patterns for the Metaboost repo (API + Next.js app). Use when starting work in the repo or when applying repo-wide code quality, structure, or plan/history conventions.
-version: 1.1.1
+description: Global patterns for the Metaboost repo (API + Next.js app). Use when starting work in the repo or when applying repo-wide code quality, structure, or plan conventions.
+version: 1.1.2
 ---
 
 # Global Patterns
@@ -26,13 +26,9 @@ version: 1.1.1
 
 - Documentation naming rules are canonical in **.cursor/skills/documentation-conventions/SKILL.md**.
 
-## LLM History
-
-- Follow **.cursor/skills/llm-history/SKILL.md** as the canonical history process (timing, format, and split rules).
-- See `.llm/LLM.md` for the full system documentation.
-
 ## Code Quality
 
+- **CSS custom properties:** In `*.scss` / `*.css`, do not use second-argument fallbacks with `var()` — see **.cursor/rules/css-custom-properties-no-var-fallbacks.mdc**. Tokens live under `packages/ui/src/styles/` (e.g. `_themes.scss`).
 - **Import path casing:** Relative import paths must match the exact casing of files and directories on disk so builds pass on Linux/CI. See **.cursor/skills/path-casing-imports/SKILL.md** and **.cursor/rules/path-casing-imports.mdc**.
 - Strict equality (`===` / `!==` only). Semicolons in JS/TS. Prefer `import type` for type-only imports.
 - **Exports:** Do not re-export symbols from app code (e.g. `lib/validation.ts`) when they are already exported by a shared package (e.g. `@metaboost/helpers`). Callers should import from the canonical source; unnecessary re-exports add indirection and maintenance cost.
diff --git a/.cursor/skills/import-specifiers-tiered/SKILL.md b/.cursor/skills/import-specifiers-tiered/SKILL.md
new file mode 100644
index 00000000..ee705808
--- /dev/null
+++ b/.cursor/skills/import-specifiers-tiered/SKILL.md
@@ -0,0 +1,26 @@
+---
+name: import-specifiers-tiered
+description: Tier A NodeNext .js specifiers vs Tier B Next.js src — follow repo boundaries when editing imports.
+---
+
+# Tiered import specifiers
+
+## When to use
+
+- Editing **relative imports** across **packages vs Next app sources**.
+- Considering a **codemod** or bulk fix for import paths.
+
+## Rules of thumb
+
+| Tier  | Locations                                                                                                              | Relative imports                                                                                                                                                  |
+| ----- | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **A** | `packages/**` except `packages/ui`, `apps/api`, `apps/management-api`, `apps/*/sidecar`, `tools/**`, `scripts/**/*.ts` | Use **`.js`** specifiers for TS modules (`./foo.js`, `./dir/index.js` for barrels). ESLint **`nodeNextRelativeImports/require-relative-js-extension`** is **on**. |
+| **C** | `packages/ui/**`                                                                                                       | **Extensionless** relatives (same as Tier B). ESLint rule is **off**. Do not use `.js` suffix — Next bundles sources as `.tsx`.                                   |
+| **B** | `apps/web/src/**`, `apps/management-web/src/**`, those apps’ `e2e/**`                                                  | Prefer **extensionless** relative imports; ESLint rule is **off**. Do not bulk-add `.js` without verifying **`next build`** / Turbopack.                          |
+
+## References
+
+- Canonical doc: [docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md](/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md)
+- ESLint: [eslint.config.mjs](/eslint.config.mjs), rule implementation [eslint-rules/require-relative-js-extension.mjs](/eslint-rules/require-relative-js-extension.mjs)
+- Cursor rule: `.cursor/rules/import-specifiers-tiered.mdc`
+- Upstream: [vercel/next.js#82945](https://github.com/vercel/next.js/issues/82945)
diff --git a/.cursor/skills/k8s/SKILL.md b/.cursor/skills/k8s/SKILL.md
new file mode 100644
index 00000000..e4ad2305
--- /dev/null
+++ b/.cursor/skills/k8s/SKILL.md
@@ -0,0 +1,43 @@
+---
+name: metaboost-k8s-kustomize
+description: Kustomize bases vs overlays under infra/k8s — no sibling ../ bases in component kustomizations; shared bundles (e.g. product-membership) composed in alpha/common with matching remote ?ref=. Use when editing infra/k8s kustomization.yaml, alpha overlays, or GitOps remote resources.
+version: 1.0.1
+---
+
+# Metaboost Kubernetes / Kustomize
+
+## When to use
+
+- Editing `infra/k8s/base/**/kustomization.yaml` or `infra/k8s/alpha/**/kustomization.yaml`
+- Adding shared ConfigMaps or cross-cutting env that multiple workloads consume
+- Aligning in-repo alpha with external GitOps overlay patterns
+
+## Bases stay self-contained (Podverse-style)
+
+- Do **not** add `resources: - ../other-base` inside `infra/k8s/base/<component>/` to pull a sibling directory. That couples bases and breaks clean remote-Git consumption.
+- **`base/product-membership/`** generates `metaboost-product-membership-config`. **api** and **management-api** Deployments reference it, but their **`base/<component>/kustomization.yaml`** lists only that component’s YAML + its own `configMapGenerator` — not `product-membership`.
+
+## Compose shared bundles in overlays
+
+- In-repo: list **`base/product-membership`** under **`infra/k8s/alpha/common/`** (with **`namespace: metaboost-alpha`** and the **same** `?ref=` as other remote bases). **`alpha/api`** and **`alpha/management-api`** list only their **`base/<component>`** URL — Deployments still **`envFrom`** `metaboost-product-membership-config`.
+- External GitOps: same pattern — **`common`** overlay owns **`product-membership`**; workload overlays do not duplicate it (see [METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md](/docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md)).
+
+## Value types in YAML and ConfigMap env
+
+- **`source/*.env`:** unquoted values for `configMapGenerator` (see **env-file-formatting** skill and
+  [INFRA-K8S-BASE.md](/infra/k8s/INFRA-K8S-BASE.md)).
+- **YAML string fields:** double-quoted scalars OK (Prettier under `infra/k8s/`).
+- **YAML integer/float fields:** unquoted numbers (`replicas: 1`, `containerPort: 4000`); never
+  `"1"` where OpenAPI expects a numeric type.
+- **`containers[].env[].value`:** string in the API — `value: "5432"` remains valid for env overrides.
+
+## References
+
+- [infra/k8s/INFRA-K8S.md](/infra/k8s/INFRA-K8S.md) — layout, revision policy, cross-component bases
+- [infra/k8s/INFRA-K8S-BASE.md](/infra/k8s/INFRA-K8S-BASE.md) — per-directory table
+- [docs/development/k8s/REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md) — remote URLs and safety workflow
+- **argocd-gitops-push** skill — push reminder when changing `infra/k8s/`
+
+## Build flags
+
+Use `kubectl kustomize ... --load-restrictor LoadRestrictionsNone` when building overlays that reference paths outside the current folder (see INFRA-K8S-BASE.md).
diff --git a/.cursor/skills/linear-baseline-gz-sync/SKILL.md b/.cursor/skills/linear-baseline-gz-sync/SKILL.md
index bd4cbb48..41c2697f 100644
--- a/.cursor/skills/linear-baseline-gz-sync/SKILL.md
+++ b/.cursor/skills/linear-baseline-gz-sync/SKILL.md
@@ -34,3 +34,4 @@ Keep committed bootstrap baseline archives aligned with the canonical forward-on
 
 - Do not hand-edit `.sql.gz` archives.
 - Generated baseline artifacts are source-controlled and must be updated in the same PR as migration changes.
+- Migration SQL should follow **greenfield-only** authoring (ordered chain, minimal `IF EXISTS` / idempotent seed guards); see [linear-db-migrations](/.cursor/skills/linear-db-migrations/SKILL.md).
diff --git a/.cursor/skills/linear-db-migrations/SKILL.md b/.cursor/skills/linear-db-migrations/SKILL.md
index e3bff344..73e1e0f0 100644
--- a/.cursor/skills/linear-db-migrations/SKILL.md
+++ b/.cursor/skills/linear-db-migrations/SKILL.md
@@ -11,6 +11,15 @@ version: 1.0.0
 - Adding or changing files under `infra/k8s/base/db/source/`, `infra/k8s/base/ops/`, or `scripts/database/`.
 - Wiring DB credentials in Compose, Kubernetes manifests, or env templates/examples.
 
+## Greenfield-only SQL authoring
+
+Treat each chain as **ordered fresh applies**: migration `NNNN` may assume schema and data from all earlier files in that chain only.
+
+- Prefer plain `CREATE`, `ALTER … ADD`, `DROP`, `INSERT` when existence/absence is guaranteed by predecessors.
+- Avoid `CREATE … IF NOT EXISTS`, `DROP … IF EXISTS`, seed `INSERT … ON CONFLICT`, and `INSERT … WHERE NOT EXISTS` unless an earlier migration leaves real ambiguity.
+- Avoid `DO $$` blocks that probe `information_schema` solely to support legacy shapes removed from the canonical chain.
+- The migration runner **creates** `linear_migration_history` before applying files; **do not** add another `CREATE TABLE linear_migration_history` inside `0001_*` (or later) that would duplicate it.
+
 ## Single source of truth
 
 - **Canonical forward-only SQL:** `infra/k8s/base/ops/source/database/linear-migrations/app/` and `infra/k8s/base/ops/source/database/linear-migrations/management/` (ordered `0001_*.sql`, ...).
@@ -30,12 +39,14 @@ version: 1.0.0
   - `bash scripts/database/generate-linear-baseline.sh`
 - Verify generated artifacts are committed and up to date:
   - `bash scripts/database/verify-linear-baseline.sh`
-- The migration runner **creates** the `linear_migration_history` table if missing; do not rely on a dedicated SQL file for that.
+- Runner bootstraps `linear_migration_history` before numbered `.sql` files run (see **Greenfield-only SQL authoring** above).
 
 ## Ops bundle (cache busting)
 
 - `infra/k8s/base/ops/kustomization.yaml` must list every `.sql` file under the app and management `source` directories so the ops jobs ConfigMaps stay in sync.
+- The ops migration-runtime ConfigMap also bundles `verify-bootstrap-contract.sh` and `rebootstrap-full-bootstrap.sh` for suspended CronJobs `metaboost-db-verify-bootstrap-contract` and `metaboost-db-rebootstrap-roles`.
 - Kustomize may load paths outside the ops directory; when building, use e.g. `kubectl kustomize infra/k8s/base/ops --load-restrictor LoadRestrictionsNone`.
+- Local operator check: `make db_verify_bootstrap_contract` (wraps `scripts/database/verify-bootstrap-contract.sh`).
 
 ## Environment keys (admin vs image)
 
@@ -50,10 +61,10 @@ version: 1.0.0
 
 ## Documentation
 
-- [docs/development/DB-MIGRATIONS.md](../../../docs/development/DB-MIGRATIONS.md) – full runbook and contracts.
+- [docs/development/DB-MIGRATIONS.md](/docs/development/DB-MIGRATIONS.md) – full runbook and contracts.
 
 ## Related skills
 
-- [database-schema-naming](../database-schema-naming/SKILL.md) – snake_case schema rules.
-- [argocd-gitops-push](../argocd-gitops-push/SKILL.md) – push reminder when k8s paths change.
-- [generate-data-sync](../generate-data-sync/SKILL.md) – seeders when schema changes.
+- [database-schema-naming](/.cursor/skills/database-schema-naming/SKILL.md) – snake_case schema rules.
+- [argocd-gitops-push](/.cursor/skills/argocd-gitops-push/SKILL.md) – push reminder when k8s paths change.
+- [generate-data-sync](/.cursor/skills/generate-data-sync/SKILL.md) – seeders when schema changes.
diff --git a/.cursor/skills/llm-cursor-source/SKILL.md b/.cursor/skills/llm-cursor-source/SKILL.md
index c41c3b76..e88c99e2 100644
--- a/.cursor/skills/llm-cursor-source/SKILL.md
+++ b/.cursor/skills/llm-cursor-source/SKILL.md
@@ -11,33 +11,30 @@ Only these paths define shared guidance for this repo:
 
 - `.cursor/skills/**`
 - `.cursor/rules/**`
+- `.cursor/prompts/**`
+- `.cursor/hooks/**` and `.cursor/hooks.json` (when present)
 - `.cursorrules` (repo root)
-- `.cursorignore` (repo root) — path-level ignores for Cursor and some tooling
+- `.cursorignore` (repo root) — path-level ignores for Cursor
 
-Do not commit ad-hoc skill/rule trees under `.github/`. **Machine export trees** under [`.llm/exports/`](../../../.llm/exports/) (per-target, allowlisted; see [EXPORT-TARGETS.md](../../../docs/development/llm/EXPORT-TARGETS.md)) are **not** a default write target for humans or for agents: **llm-exports-sync** and **llm-exports-full-sync** in GitHub Actions are the **canonical** producers; they open/update PRs on branches **`llm`** and **`llm-full`**. `npm run llm:exports:sync` is **gated** outside CI (`LLM_EXPORT_ALLOW_LOCAL=1` is required to write locally, for [scripts/llm/](../../../scripts/llm/) work only). Generated content is **`.gitignore`d**; **`.llm/exports/`** is in **`.cursorignore`** for Cursor. Do not commit or hand-edit generated `skills/`, `instructions/`, or `*-instructions.md` in feature PRs. See [`.llm/exports/LLM-EXPORTS.md`](../../../.llm/exports/LLM-EXPORTS.md) and the **`llm-exports-ci`** rule.
+Do not commit ad-hoc skill or rule trees under `.github/` or other paths outside `.cursor/`.
 
-## Other LLM editors
+Never add or recreate `.llm/exports/` — multi-editor mirror trees are prohibited. Cursor-only source under `.cursor/` is the policy.
 
-Start from [`.llm/exports/`](../../../.llm/exports/) after pulling the latest **develop** (or checking the current **`llm` → `develop`** automation PR) when your tool can use repo paths. If you still need a one-off pass, use:
+Operator directory docs (`CURSOR-*.md`, `LLM-*.md`) describe folders for humans; they are not a second source of agent rules.
 
-- [docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md](../../../docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md)
+## When `.cursor` changes
 
-Overview and policy:
-
-- [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](../../../docs/development/llm/DOCS-DEVELOPMENT-LLM.md)
-
-## When .cursor changes
-
-- Edit skills, rules, `.cursorrules`, and (when needed) `.cursorignore`, and commit them like any other source.
-- **Do not** run a local LLM export sync to “refresh” exports, and do not commit or push changes under the generated parts of **`.llm/exports`**. After your work lands on **develop**, automation updates branch **`llm`** and its PR. Pull **develop** once that PR is merged, or follow the open **`llm` → `develop`** PR. Re-run the alignment prompt only if you use tooling that is not fully covered by the opt-in export targets.
+- Edit skills, rules, prompts, hooks, `.cursorrules`, and (when needed) `.cursorignore`, then commit them like any other source.
+- Do not add duplicate guidance elsewhere; keep one source of truth under `.cursor/`.
+- Use an **`llm/<kebab-name>`** branch when the PR changes only LLM-related paths (`.cursor/**`, `.cursorrules`, `.cursorignore`, `docs/development/llm/**`, `.llm/**`, relevant `AGENTS.md` sections). See [DOCS-DEVELOPMENT-LLM.md](/docs/development/llm/DOCS-DEVELOPMENT-LLM.md) § Branch naming.
 
 ## Skill file hygiene
 
 - Skill frontmatter `name` should match the skill folder name.
 - Keep exactly one blank line between closing frontmatter (`---`) and body content.
 
-## Export / sync implementation
+## Contributor policy
 
-When you change the deterministic export (files under `scripts/llm/`), use the **llm-exports-scripts** skill. **Podverse and Metaboost** share the same pipeline shape; keep the mirrored `scripts/llm/**` files aligned when behavior should match.
+Overview, plans, and optional history notes:
 
-Local vendor setup is opt-in via `npm run llm:vendors` (default active vendor: `cursor`).
+- [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](/docs/development/llm/DOCS-DEVELOPMENT-LLM.md)
diff --git a/.cursor/skills/llm-exports-scripts/SKILL.md b/.cursor/skills/llm-exports-scripts/SKILL.md
deleted file mode 100644
index 0bee074b..00000000
--- a/.cursor/skills/llm-exports-scripts/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: llm-exports-scripts
-description: Conventions for scripts/llm (deterministic .cursor exports). Use when editing export-from-cursor, copilot-adapter, github-style-adapter, opencode-adapter, vendor-*, allowed-targets, or guard-exports.
----
-
-# LLM export scripts (`scripts/llm/**`)
-
-## When to use
-
-Use this skill whenever you add or change files under `scripts/llm/` (import/export pipeline, adapters, local vendor config/CLI, export guard, allowlists).
-
-**Policy and source of truth** live in the **llm-cursor-source** skill. **Per-target output** (what each adapter produces) is documented in [docs/development/llm/EXPORT-TARGETS.md](../../../docs/development/llm/EXPORT-TARGETS.md). **Podverse and Metaboost** share the same pipeline shape; keep the mirrored scripts aligned when behavior should match.
-
-Allowlisted **export target** ids: `github-copilot`, `opencode` (see `allowed-targets.mjs`); each opt-in target has a marker under `.llm/exports/<id>/`. The `github-copilot` tree is the single portable mirror (no separate `vscode` target).
-
-**CI:** the **`llm-exports-sync`** and **`llm-exports-full-sync`** GitHub Actions run `node scripts/llm/export-from-cursor.mjs sync` (with `--full` for full) on the runner. **Local** `sync` and `check` that write to disk are **disabled** unless `CI` is set (e.g. GitHub Actions) or you set `LLM_EXPORT_ALLOW_LOCAL=1` for pipeline debugging and tests of `scripts/llm/`. Set that env when you need to run `npm run llm:exports:sync` or `llm:exports:sync:full` outside CI.
-
-## Console and CLI output
-
-- Do **not** use `console.log`, `console.info`, or `console.debug`.
-- Use `console.warn` for non-fatal progress or informational messages, `console.error` for failures.
-- For interactive CLIs, you may use a small helper that writes with `process.stdout.write` (see `vendor-selector.mjs` `out()`).
-
-## After edits
-
-From repo root:
-
-```bash
-npx eslint "scripts/llm/**/*.mjs"
-```
-
-In Metaboost, if import order needs fixing: `npx eslint "scripts/llm/**/*.mjs" --fix`
diff --git a/.cursor/skills/llm-history/SKILL.md b/.cursor/skills/llm-history/SKILL.md
deleted file mode 100644
index 1730ac89..00000000
--- a/.cursor/skills/llm-history/SKILL.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-name: llm-history-tracking
-description: LLM history tracking guidelines. Use when updating history files or starting new feature work.
-version: 1.0.0
----
-
-# LLM History Tracking
-
-This skill provides guidelines for maintaining LLM development history in the Metaboost repo. The Cursor rule `llm-history-tracking.mdc` is the always-applied requirement.
-
-## Critical Rule: 10-Session Maximum Per File
-
-**Each history file must contain at most 10 sessions.** When session 11 needs to be added, the file must be split.
-
-## File Location Pattern
-
-```
-.llm/history/active/[feature-name]/
-  [feature-name]-part-01.md      # Sessions 1-10 (always start with part-01)
-  [feature-name]-part-02.md      # Sessions 11-20
-```
-
-**Always use the `-part-01` suffix from the beginning, even for the first file.**
-
-## When to Split
-
-When a history file has 10 sessions and you need to add session 11: create a new file with `-part-02` suffix and add session 11 there. Session numbers are continuous across parts (never reset).
-
-## Session Entry Format
-
-```markdown
-### Session N - YYYY-MM-DD
-
-#### Prompt (Developer)
-
-[Exact verbatim user prompt - never summarize]
-
-#### Key Decisions
-
-- Decision 1
-
-#### Files Modified
-
-- path/to/file.ts
-```
-
-## Prompt Source Labels
-
-- **`#### Prompt (Developer)`** - Manually typed by user
-- **`#### Prompt (Agent)`** - System-generated (e.g., clicking "Build" on a plan)
-
-## When to Update History
-
-Update when modifying code, config, docs, or plans. Skip for pure Q&A with no file changes.
-
-## Required sequence
-
-1. Record the prompt first in the active history file (verbatim text, correct prompt source label).
-2. Make the file changes.
-3. Finalize the same session entry with key decisions and files modified.
-
-This skill is the canonical source for history timing and entry format.
-
-## Response Ending
-
-End file-modifying responses with:
-
-**LLM History**: Updated .llm/history/active/[feature]/[file].md (Session N)
-
-## See Also
-
-- `.cursor/rules/llm-history-tracking.mdc` - Cursor rule with glob triggers
-- `.llm/LLM.md` - Complete history system documentation
diff --git a/.cursor/skills/logging/SKILL.md b/.cursor/skills/logging/SKILL.md
new file mode 100644
index 00000000..ccf58a0a
--- /dev/null
+++ b/.cursor/skills/logging/SKILL.md
@@ -0,0 +1,36 @@
+---
+name: logging
+description: Log directory (LOG_DIR) behavior across the monorepo. Use when adding or changing log directory behavior, LOG_DIR env, or file logging in any app or package.
+version: 1.0.0
+---
+
+# Log directory (LOG_DIR) — monorepo rules
+
+## When to use
+
+- Adding or changing log directory behavior, LOG_DIR env, or file logging in any app or package.
+
+## Rules
+
+1. **No default value for log directory** in any monorepo app. Config must use
+   `process.env.LOG_DIR ?? ''` (or equivalent) so that when unset, the value is empty.
+
+2. **When LOG_DIR is empty or unset**, logs are console-only (no file transport). This avoids
+   bulky log files inside containers when no external volume is mounted.
+
+3. **When LOG_DIR is set** (e.g. in Docker with a volume), use the path that matches the
+   external volume mount.
+
+4. **Do not default to `./logs` or `/app/logs`** in app code; that causes file logging inside
+   containers without a volume and can become bulky.
+
+## Current state
+
+Apps today use lightweight console loggers (e.g. `apps/api/src/lib/logger.ts`). When introducing
+structured file logging, wire transports only when `LOG_DIR` is non-empty.
+
+## References
+
+- [AGENTS.md](/AGENTS.md) — env and config conventions
+- **config-type-safety** rule — no silent defaults in `config/index.ts`
+- [infra/docker/local/](/infra/docker/local/) — compose volume mounts when file logs are added
diff --git a/.cursor/skills/management-edit-breadcrumbs/SKILL.md b/.cursor/skills/management-edit-breadcrumbs/SKILL.md
index fe692d50..cb763b57 100644
--- a/.cursor/skills/management-edit-breadcrumbs/SKILL.md
+++ b/.cursor/skills/management-edit-breadcrumbs/SKILL.md
@@ -12,7 +12,7 @@ description: New and Edit pages in management-web should use breadcrumbs so user
 Every New and Edit page should show **breadcrumbs** so users can see their position in the hierarchy and navigate back:
 
 - Wrap the page content in `ContentPageLayout` from `@metaboost/ui` with a `breadcrumbs` prop.
-- Build `BreadcrumbItem[]`: list route (link) → optional view/resource link → current page label (no `href` for last item).
+- Build `BreadcrumbItem[]` with **`withDashboardBreadcrumb`** from `apps/management-web/src/lib/management-breadcrumbs.ts` so the first segment is always **Dashboard** (`ROUTES.DASHBOARD`), then list route (link) → optional view/resource link → current page label (no `href` for last item).
 - Use `Breadcrumbs` and `Link` from `@metaboost/ui`; pass a `LinkComponent` that wraps `Link` (e.g. a small `BreadcrumbLink` that forwards `href`, `children`, `className`).
 - Set `contentMaxWidth="form"` on `ContentPageLayout` for form pages.
 
diff --git a/.cursor/skills/management-post-save-navigation/SKILL.md b/.cursor/skills/management-post-save-navigation/SKILL.md
new file mode 100644
index 00000000..c02ab1a1
--- /dev/null
+++ b/.cursor/skills/management-post-save-navigation/SKILL.md
@@ -0,0 +1,39 @@
+---
+name: management-post-save-navigation
+description: Post-save navigation via ROUTES to the canonical management-web list for one-row create/edit pages; exceptions for invite links and password-only updates.
+---
+
+# Management-web post-save navigation
+
+**When to use:** When adding or changing **create** or **edit** pages in **`apps/management-web`**
+that exist to create or update **one primary row** (users, admins, buckets, terms versions, etc.).
+
+## Rule
+
+After a successful **primary** save (POST create or PATCH/PUT profile/settings form), navigate to
+the **canonical exit route**. Usually that is the **resource list** named in breadcrumbs:
+
+- Prefer **`ROUTES`** from **`apps/management-web/src/lib/routes.ts`** (e.g. **`ROUTES.USERS`**,
+  **`ROUTES.ADMINS`**) over hard-coded path strings.
+- Call **`router.refresh()`** after **`router.push`** when the destination list should reload server
+  data.
+
+Existing forms that implement this pattern include **`UserForm`**, **`AdminForm`**,
+**`TermsVersionForm`**, and **`BucketForm`**.
+
+## Exceptions
+
+- **Invite / set-password URL** in the response — **do not** auto-redirect; keep copy UX (and an
+  explicit control to return to the list). Same pattern as **`UserForm`** when **`setPasswordLink`**
+  is present.
+- **Password-only** updates on a **tabbed user edit** — **stay** on the page with success feedback;
+  do not redirect (matches **`UserForm`** **`handleChangePassword`**).
+- **Database / table browser** or flows where the correct landing is **row detail** (not the list).
+- **Bucket / nested** flows where **detail** is the correct landing (**`BucketForm`** uses
+  **`bucketViewRoute`** where appropriate).
+- **Wizard / multi-step** flows follow that flow’s return URL.
+
+## Cross-references
+
+- Breadcrumb hierarchy: **management-edit-breadcrumbs**.
+- List/table patterns: **crud-tables-resources**.
diff --git a/.cursor/skills/modal-layout-contract/SKILL.md b/.cursor/skills/modal-layout-contract/SKILL.md
new file mode 100644
index 00000000..538e68bf
--- /dev/null
+++ b/.cursor/skills/modal-layout-contract/SKILL.md
@@ -0,0 +1,42 @@
+---
+name: modal-layout-contract
+description: Modal overflow, ModalDialogContent actions row, right-aligned wrapping footers (web + management-web).
+version: 1.0.0
+---
+
+# Modal layout contract (`@metaboost/ui`)
+
+**When to use:** Adding or changing dialogs (`Modal`), modal footers, or debugging horizontal scrollbars
+inside modals in **apps/web**, **apps/management-web**, or **`packages/ui`** shells (`ConfirmDeleteModal`,
+`RateLimitModal`, `GoToPageModal`).
+
+## Layout rules
+
+- **`Modal`** — full-window overlay; use **`withBackdrop`** / **`backdropOpaque`** for confirm dialogs.
+  Pass **`onClose`** when the dialog is dismissible (shows close control).
+- **`ModalDialogContent`** — standard body wrapper for confirm/prompt dialogs and small forms inside
+  **`Modal`**: readable max width, padding that clears the close button, optional **`actions`** slot.
+- **`ModalDialogContent` `actions`** — **the** standard footer for cancel/submit (and similar): **`justify-content: flex-end`**, **`flex-wrap: wrap`**, gap from tokens. Use in **both** web and management-web so confirm dialogs match the web baseline (right-aligned group).
+- **Do not** add ad hoc **`display: flex; justify-content: flex-end`** rows for modal footers when
+  **`ModalDialogContent`** can own the **`actions`** prop — use **`ConfirmDeleteModal`** or compose
+  **`ModalDialogContent`** directly.
+- **Do not** add **`overflow-x: hidden`** on the modal to mask overflow — fix the child (`min-width: 0`
+  on flex/grid items, **`actions`** wrap, break long unbreakable strings).
+- **`ModalDialogContent`** root uses **`min-width: 0`**, **`max-width`**, and **`overflow-wrap: anywhere`**
+  so content cannot widen the panel; shared form components should still declare **`min-width: 0`** on
+  their own flex rows/columns where needed.
+- **DOM order:** secondary (**Cancel**) before primary (**Submit** / **Confirm** / **Delete**) inside
+  **`actions`** (same as **`FormActions`** / **use-form-component**).
+- **Non-modal forms:** use **`FormActions`** from **`@metaboost/ui`** for page footers — same
+  right-aligned, wrap, cancel-then-submit order.
+
+## Symptoms
+
+- Horizontal scrollbar on the modal panel or the page when the modal is open → often missing
+  **`flex-wrap`** on **`actions`**, or a child with fixed width / **`min-width: auto`** in a flex context;
+  check nested flex rows without **`min-width: 0`**.
+
+## Related
+
+- **css-custom-properties-no-var-fallbacks** — no `var(..., fallback)` in modal SCSS
+- **reusable-components** — prefer **`Modal`** / **`ModalDialogContent`** over app-local dialog shells
diff --git a/.cursor/skills/native-deps-platform-mismatch/SKILL.md b/.cursor/skills/native-deps-platform-mismatch/SKILL.md
new file mode 100644
index 00000000..03f9a603
--- /dev/null
+++ b/.cursor/skills/native-deps-platform-mismatch/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: native-deps-platform-mismatch
+description: Detect and surface missing-native-binary errors (e.g. @rollup/rollup-darwin-arm64) without mutating node_modules or the lockfile.
+version: 1.0.0
+---
+
+# Native deps platform mismatch
+
+The Metaboost lockfile is Linux-canonical but lists optional deps for every platform (see
+[LOCKFILE-LINUX.md](/docs/development/tooling/LOCKFILE-LINUX.md)). The repo also has a Docker-based
+script ([scripts/development/update-lockfile-linux.sh](/scripts/development/update-lockfile-linux.sh))
+that regenerates the lockfile; after it runs on macOS, the host's `node_modules` no longer has
+darwin native binaries until the host runs `npm install` again.
+
+## When to use
+
+Errors like:
+
+- `Cannot find module @rollup/rollup-darwin-arm64`
+- `Cannot find module @next/swc-darwin-arm64`
+- `Cannot find module @parcel/watcher-darwin-arm64`
+- `Cannot find module sharp` (when prebuilt platform binary is missing)
+
+## Do
+
+- Surface the error to the user with the missing package name and host platform.
+- Recommend the user run `npm install` on the host — this materializes the platform-specific optional
+  deps already listed in the lockfile and does not modify `package-lock.json`.
+- If the user recently ran `update-lockfile-linux.sh`, point them at the "After running on macOS"
+  section of [LOCKFILE-LINUX.md](/docs/development/tooling/LOCKFILE-LINUX.md).
+
+## Do not
+
+- Do not run `npm install`, `npm ci`, `npm rebuild`, `npm install --no-save`, or
+  `npm install --no-save --no-package-lock` autonomously. These mutate `node_modules` and may mutate
+  `package-lock.json` in subtle ways across platforms.
+- Do not modify [package-lock.json](/package-lock.json), [package.json](/package.json), or
+  [scripts/development/update-lockfile-linux.sh](/scripts/development/update-lockfile-linux.sh)
+  unless the user explicitly asks for that work.
+- Do not blame the lockfile. The lockfile entries are correct; the host `node_modules` is the broken
+  artifact.
+
+## Why a rule, not a "ban npm ci"
+
+`npm ci` itself is fine. The CI Dockerfiles under `infra/docker/local/**` use it intentionally. The
+agent failure mode this skill prevents is running mutating commands speculatively while debugging a
+missing-binary error — which can corrupt the lockfile or hide the underlying environment problem from
+the user.
diff --git a/.cursor/skills/observability/SKILL.md b/.cursor/skills/observability/SKILL.md
new file mode 100644
index 00000000..05254e25
--- /dev/null
+++ b/.cursor/skills/observability/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: observability
+description: Distributed tracing and OTLP export patterns. Use when adding trace context, log correlation, or Observability env — after Metaboost adopts a shared observability package.
+version: 1.0.0
+---
+
+# Observability (distributed tracing)
+
+## When to use
+
+- Planning or implementing **OpenTelemetry** tracing, log `trace_id` / `span_id` correlation, or
+  W3C propagation on outbound HTTP
+- Adding **Observability** env keys (`OTEL_SERVICE_NAME`, `OTEL_TRACES_EXPORT`, …) to templates
+
+## Current state (Metaboost)
+
+Metaboost does **not** yet ship a `@metaboost/observability` package or Express bootstrap middleware
+like Podverse. Apps log via console helpers today. Treat this skill as the **target pattern** when
+tracing is added; do not invent `config.extensions.tracing` toggles.
+
+## Target architecture (when adopted)
+
+| Item       | Rule                                                                     |
+| ---------- | ------------------------------------------------------------------------ |
+| Always on  | Trace context in-process even when export is `none`                      |
+| Config     | Dedicated `config.observability.*` (not mixed into unrelated extensions) |
+| Env        | Observability subsection in app `.env.example` and K8s `source/*.env`    |
+| Middleware | HTTP tracing middleware after standard body/auth middleware              |
+
+**Separate from metrics:** If Prometheus scrape or OTLP metrics are added later, keep metrics SDK
+and tracing bootstrap as distinct concerns.
+
+## Env vars (future template shape)
+
+| Variable                      | Notes                          |
+| ----------------------------- | ------------------------------ |
+| `OTEL_SERVICE_NAME`           | Workload name                  |
+| `OTEL_TRACES_EXPORT`          | `none` or `otlp`               |
+| `OTEL_EXPORTER_OTLP_ENDPOINT` | Required when export is `otlp` |
+
+## Don't
+
+- Gate basic W3C trace context behind optional extension toggles
+- Put trace export logic inside unrelated metrics sidecars without an explicit design
+
+## References
+
+- Podverse reference: `podverse/.cursor/skills/observability/SKILL.md` and
+  `docs/operations/observability/TRACING.md` (when porting)
+- **feature-implementation-testing** — add tests when observability changes affect API behavior
+- **k8s** skill — env typing in manifests
diff --git a/.cursor/skills/parallel-plan-execution/SKILL.md b/.cursor/skills/parallel-plan-execution/SKILL.md
new file mode 100644
index 00000000..e5163369
--- /dev/null
+++ b/.cursor/skills/parallel-plan-execution/SKILL.md
@@ -0,0 +1,137 @@
+---
+name: parallel-plan-execution
+description: Create decomposed, parallelizable execution plans with copy-pasta prompts for multi-agent workflows. Use when planning large migrations, refactoring tasks, or any work that can benefit from parallel execution across multiple agents.
+---
+
+# Parallel Plan Execution Strategy
+
+This skill guides you through creating execution plans that can be efficiently parallelized across
+multiple Cursor agents, maximizing throughput while minimizing user effort.
+
+## When to Use This Skill
+
+Use this approach when:
+
+- Working on tasks affecting 10+ files
+- Multiple independent changes can be made simultaneously
+- User wants to leverage parallel agent execution
+- Task can be broken into logical, independent units of work
+
+## Core Principles
+
+> **AGENT BEHAVIOR**: When a copy-pasta prompt is pasted, execute it immediately. The act of pasting
+> IS the instruction to execute. See "Executing Copy-Pasta Prompts" below.
+
+### 1. Dependency Analysis
+
+Before creating plans, identify:
+
+- **Sequential dependencies**: Task B requires Task A completion (phases must run in order)
+- **Parallel opportunities**: Tasks can execute simultaneously (agents within a phase)
+- **Shared resources**: Files modified by multiple tasks (requires coordination)
+
+**Critical distinction**:
+
+- **Phases**: Run sequentially (Phase 1 completes → Phase 2 starts → Phase 3 starts).
+- **Within a phase, order matters.** If the "How to use" says "run A, then B, then C and D in
+  parallel", that means: run A → **wait for A to finish** → run B → **wait for B to finish** →
+  then run C and D in parallel; **wait for all agents in the parallel group** before the next phase.
+- **Agents marked "in parallel"** in the same step run simultaneously; do not start them until any
+  "then" steps before them in that phase are done.
+
+### 2. Plan Hierarchy
+
+Create a clear hierarchy:
+
+```
+feature-00-EXECUTION-ORDER.md    # Master orchestration guide
+feature-00-SUMMARY.md            # Complete scope and file inventory
+feature-01-area-1.md             # Focused execution plan
+feature-02-area-2.md             # Focused execution plan
+...
+feature-COPY-PASTA.md            # Ready-to-paste agent prompts
+```
+
+Plans live under `.llm/plans/active/[plan-set-name]/`. See **plan-files-convention**.
+
+### 3. DRY Principle for Plans
+
+**Detailed plans**: Keep full instructions, file lists, and code examples in numbered plan files.
+**Copy-pasta file**: Should **reference** plan files, not duplicate their content.
+
+Example copy-pasta prompt:
+
+```
+Read and execute .llm/plans/active/feature/08-dashboard-pages.md
+
+Follow all instructions to update 5 dashboard-related files.
+
+Core rule: [One-line reminder of key principle]
+```
+
+## Step-by-Step Workflow
+
+### Step 1: Analyze Scope
+
+1. Count affected files
+2. Group by feature area, directory, or logical domain
+3. Map dependencies
+4. Estimate complexity
+
+### Step 2: Create Master Summary
+
+File: `00-SUMMARY.md` — total file count, breakdown, strategy overview.
+
+### Step 3: Create Execution Order
+
+File: `00-EXECUTION-ORDER.md` — phases (critical path sequential, feature groups parallel).
+
+### Step 4: Create Focused Execution Plans
+
+One file per parallelizable group with scope, per-file instructions, and verification commands.
+
+### Step 5: Create Copy-Pasta File
+
+File: `COPY-PASTA.md`
+
+**CRITICAL**: Make execution rules clear at the top:
+
+- Phases are **SEQUENTIAL** (must wait for each to complete)
+- Agents **WITHIN** phases run in **PARALLEL** when marked
+
+## Naming Conventions
+
+- `00-` prefix: Meta files (summary, execution order)
+- `01-99`: Execution plans (numbered by phase/group)
+- Descriptive names: `08-dashboard-pages.md` not `08.md`
+
+## Anti-Patterns to Avoid
+
+- Do not copy all details into copy-pasta prompts — reference plan files
+- Do not create artificial parallelization (files that could conflict)
+- Do not make phases too granular (1 file per plan); group related files (3–7 per plan)
+- Do not skip verification steps
+
+## Executing Copy-Pasta Prompts
+
+When a copy-pasta prompt from `COPY-PASTA.md` is pasted:
+
+1. **Execute immediately** — do not ask for confirmation
+2. **Prompt is self-contained** — read the referenced plan file and implement
+3. **Recognition**: message references `.llm/plans/active/...` with no extra user instructions
+
+### Final COPY-PASTA step
+
+When the pasted prompt is the **last** step in the plan set:
+
+- Assume the operator ran all prior COPY-PASTA prompts without running tests.
+- After implementation and plan archiving, end the response with **all** cumulative verification
+  commands for the entire set in one fenced `bash` block (see **response-ending-make-verify** and
+  **plan-completion** skills).
+
+## Related Skills
+
+- **plan-files-convention** — directory layout and when to stop at plan creation
+- **plan-completion** — move finished plans to `completed/`
+- **plan-execution-completion-tracking** rule — mark COPY-PASTA progress during execution
+- **response-ending-make-verify** — operator verification commands
diff --git a/.cursor/skills/plan-completion/SKILL.md b/.cursor/skills/plan-completion/SKILL.md
new file mode 100644
index 00000000..8f7d6c4d
--- /dev/null
+++ b/.cursor/skills/plan-completion/SKILL.md
@@ -0,0 +1,79 @@
+---
+name: plan-completion
+description: When you finish a plan file in active/, automatically move it to completed/. If it's the last plan in its set, move the whole set. Use when completing any plan under .llm/plans/active/.
+---
+
+# Plan Completion and Archiving
+
+When you **finish executing** a plan file that lives in `.llm/plans/active/`, archive it (and
+optionally its whole set) without asking the user.
+
+Metaboost also enforces COPY-PASTA progress tracking via the **plan-execution-completion-tracking**
+rule — follow both this skill and that rule during plan-set execution.
+
+## Automatic Move (Single Plan)
+
+1. **After** you have finished executing a plan file (all steps done), move that plan file from
+   `active/` to `completed/`, preserving subdirectory structure.
+2. **Do not ask** "Would you like me to mark this plan as completed?" — move it automatically.
+3. Update `COPY-PASTA.md` to mark the corresponding agent prompt `[x]` (per
+   **plan-execution-completion-tracking**).
+
+Example:
+
+```bash
+mv .llm/plans/active/metaboost-podverse-parity-gaps/03-adopt-podverse-engineering-ops-skills.md \
+   .llm/plans/completed/metaboost-podverse-parity-gaps/
+```
+
+## When It's the Last Plan in a Set — Move the Whole Set
+
+A **set** is any group of plan files that belong together, for example:
+
+- Files listed in `00-EXECUTION-ORDER.md` or `COPY-PASTA.md`
+- All `.md` files under one `active/<feature>/` directory
+
+If the plan you just finished is the **last** numbered plan in that set (no other numbered plans
+remain in `active/<feature>/`), move **all** remaining plan-set files from `active/<feature>/` to
+`completed/<feature>/` in one go. Preserve directory structure.
+
+Keep `COPY-PASTA.md` and `00-*` files in `active/` until all numbered prompts are complete; then move
+the whole directory.
+
+Example (last plan in set):
+
+```bash
+mv .llm/plans/active/metaboost-podverse-parity-gaps .llm/plans/completed/
+```
+
+## Preserve Structure
+
+Always keep the same relative path under `completed/` as under `active/`:
+
+- `active/feature-name/01-part.md` → `completed/feature-name/01-part.md`
+
+## Optional: Update References
+
+If `.llm/LLM.md`, `LLM-PLANS-ACTIVE.md`, or a `00-SUMMARY.md` references the moved plan(s), update
+paths from `active/` to `completed/` where appropriate.
+
+## Final COPY-PASTA step — cumulative verification
+
+When completing the **last** numbered prompt in a set:
+
+| Situation                       | Action                                                                                                                      |
+| ------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
+| Finished one plan in a set      | Move only that plan file to `completed/`; mark `[x]` in COPY-PASTA                                                          |
+| Finished the last plan in a set | Move the whole set directory to `completed/`                                                                                |
+| Last plan in set (COPY-PASTA)   | End response with **all** cumulative operator verification commands for the whole set (see **response-ending-make-verify**) |
+| Don't ask                       | Archive automatically after the plan is done                                                                                |
+
+Dedupe verification commands across the set; order: build/lint → unit → API (if applicable) → E2E
+(if applicable). Default E2E commands **without** `E2E_API_GATE_MODE` unless API code changed.
+
+## Related
+
+- **plan-files-convention** — layout and COPY-PASTA dedupe policy
+- **parallel-plan-execution** — creating parallel-safe plan sets
+- **plan-execution-completion-tracking** rule — authoritative tracking during execution
+- **response-ending-make-verify** — operator command block at end of implementation
diff --git a/.cursor/skills/plan-files-convention/SKILL.md b/.cursor/skills/plan-files-convention/SKILL.md
index dc90c1b7..18313cff 100644
--- a/.cursor/skills/plan-files-convention/SKILL.md
+++ b/.cursor/skills/plan-files-convention/SKILL.md
@@ -60,9 +60,15 @@ Plans stay under ~300 lines each; split into part files (e.g. `22-part-1-dashboa
 
 ## When a Plan Set Is Complete
 
-1. Move the entire directory from `active/` to `completed/`:  
+Follow **plan-completion** skill and **plan-execution-completion-tracking** rule together:
+
+1. After each numbered plan: move that file to `completed/` and mark the COPY-PASTA prompt `[x]`.
+2. When the last numbered plan is done, move the entire directory from `active/` to `completed/`:  
    `mv .llm/plans/active/[plan-set-name] .llm/plans/completed/`
-2. Update any cross-references (e.g. 00-master-plan or README) if needed.
+3. Update any cross-references (e.g. `.llm/LLM.md`, `LLM-PLANS-ACTIVE.md`) if needed.
+4. When the operator completes the **last** COPY-PASTA prompt in the set, end the response with **all**
+   cumulative verification commands for the whole set — deduped, in order build/lint → unit → API → E2E
+   (see **response-ending-make-verify** and **plan-completion** skills).
 
 ## Reference
 
diff --git a/.cursor/skills/rate-limit-message/SKILL.md b/.cursor/skills/rate-limit-message/SKILL.md
new file mode 100644
index 00000000..dc85f55f
--- /dev/null
+++ b/.cursor/skills/rate-limit-message/SKILL.md
@@ -0,0 +1,44 @@
+---
+name: rate-limit-message
+description: Standardizes 429 handling with RateLimitModal and retry-after UX. Use when handling API errors that may return 429 (rate limited) responses.
+---
+
+# Rate Limit Message Handling
+
+## Instructions
+
+- When an API call can return **429**, surface rate limiting with **`RateLimitModal`** from **`@metaboost/ui`** (or the same pattern: modal + **`retryAfterSeconds`** state).
+- Parse **`Retry-After`** (seconds) from the response when present; pass **`retryAfterSeconds`** to **`RateLimitModal`** so the user sees how long to wait.
+- Prefer the modal (or an inline error region) over **`alert()`** for user-facing rate-limit copy.
+- Auth flows already follow this pattern in **`AuthContext`** and auth pages — reuse rather than inventing a one-off helper per page.
+
+## Example (page state + modal)
+
+```tsx
+import { RateLimitModal } from '@metaboost/ui';
+
+const [rateLimitRetrySeconds, setRateLimitRetrySeconds] = useState<number | undefined>(undefined);
+const [rateLimitOpen, setRateLimitOpen] = useState(false);
+
+// On 429 from API:
+if (res.status === 429) {
+  const retryAfter = parseRetryAfterSeconds(res.headers.get('Retry-After'));
+  setRateLimitRetrySeconds(retryAfter);
+  setRateLimitOpen(true);
+}
+
+<RateLimitModal
+  open={rateLimitOpen}
+  onClose={() => setRateLimitOpen(false)}
+  retryAfterSeconds={rateLimitRetrySeconds}
+/>
+```
+
+## Copy
+
+- User-visible strings for **`RateLimitModal`** live in app i18n (`ui.rateLimitModal.*`) — the shared component uses **`next-intl`** keys, not hard-coded English in **`packages/ui`** call sites.
+
+## Related
+
+- **shared-ui-i18n** — localized modal copy in apps
+- **i18n** skill — keep locales aligned when adding keys
diff --git a/.cursor/skills/release-changelog/SKILL.md b/.cursor/skills/release-changelog/SKILL.md
deleted file mode 100644
index 11e2034e..00000000
--- a/.cursor/skills/release-changelog/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: release-changelog
-description: "Use version-first changelog files (docs/development/CHANGELOGS/X.Y.Z.md): bump version at start of work and write release notes continuously for staging and main releases."
----
-
-# Release changelog (Metaboost)
-
-## When to use
-
-When you ship or finish work that is **worth calling out** in preprod/prod release notes: behavior changes, new surfaces, important fixes, or ops-impacting updates—not every internal cleanup.
-
-## What to update
-
-- Use [docs/development/CHANGELOGS/X.Y.Z.md](../../docs/development/CHANGELOGS/) where `X.Y.Z` is the current base version in `package.json`.
-- Bump version **at the start of work** with `scripts/publish/bump-version.sh` so `docs/development/CHANGELOGS/X.Y.Z.md` exists before implementation.
-- Keep updating that same semver file continuously as work lands.
-
-## Conventions
-
-1. **Order** — **Most important first** (safety, security, data, then big features, then smaller fixes; skip low-signal items).
-2. **Wording** — Short, clear lines; link issues/PRs if useful.
-3. **Single source** — Staging prereleases and main production releases both read the same `X.Y.Z.md` file.
-4. **Brevity** — Concise, not a duplicate of git log.
-
-## Naming in CI
-
-- Git branch **`staging`** runs **Publish (staging)**: **`X.Y.Z-staging.N`** and float **`staging`** in GHCR. Cluster “alpha” in GitOps (path/namespace) is separate.
-- Pushes to **`main`** run **Publish (main)**: promote to RTM **`X.Y.Z`** and **`:latest`**.
-
-## Related
-
-- [PUBLISH.md](../../PUBLISH.md) — full publish flow, Git tag, and GitOps pins.
diff --git a/.cursor/skills/response-ending-make-verify/SKILL.md b/.cursor/skills/response-ending-make-verify/SKILL.md
index 615056a7..f679a6c1 100644
--- a/.cursor/skills/response-ending-make-verify/SKILL.md
+++ b/.cursor/skills/response-ending-make-verify/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: response-ending-make-verify
 description: End implementation responses with scoped make-based screenshot report commands for web and management-web verification.
-version: 1.4.0
+version: 1.5.0
 ---
 
 # Response-Ending Make Verification
@@ -14,6 +14,7 @@ Use this skill when answering implementation requests in this repo.
 
 - **Never run test or verification commands** (e.g. `make e2e_test_web`, `npm run test`, `make e2e_test_web_signup_enabled`) as part of your agent or plan implementation work.
 - **Only instruct the user** to run those commands after your work is done. Provide the exact command(s) in a fenced `bash` block so the user can copy and run them.
+- For **UI changes** (`apps/web/src`, `apps/management-web/src`, or `packages/ui/src` consumed by those apps), follow **ui-e2e-screenshot-report** to pick the narrowest `make e2e_test_*_report_spec` command and tell the operator where reports appear (`.artifacts/e2e-reports/latest/.../index.html`).
 - This keeps agent sessions fast, avoids flaky runs in automation, and leaves verification to the user in their environment.
 
 ## Required response behavior
@@ -68,6 +69,17 @@ Multi-spec input:
   - `make e2e_test_web_report_spec SPEC=e2e/buckets.spec.ts,e2e/invite.spec.ts`
   - `make e2e_test_report_scoped WEB_SPEC=e2e/buckets.spec.ts,e2e/bucket-detail.spec.ts MGMT_SPEC=e2e/buckets.spec.ts,e2e/events.spec.ts`
 
+## Copy-pasta final prompt (cumulative verification)
+
+When you complete the **last** step in a plan set (`COPY-PASTA.md` / `00-EXECUTION-ORDER.md`):
+
+1. Assume the operator ran every COPY-PASTA prompt back-to-back **without** running tests until this final step.
+2. Collect **Verification** sections from each numbered plan file in the set.
+3. Merge into one fenced `bash` block for the operator: `npm run build`, `npm run lint`, `npm run test:unit`, `npm run test:e2e:api`, scoped `make e2e_test_*_report_spec`, etc., as applicable to the set.
+4. Deduplicate commands; order: build/lint → unit → API → E2E (scoped before full suite).
+5. Default E2E commands **without** `E2E_API_GATE_MODE` unless API/integration code changed across the set.
+6. For intermediate COPY-PASTA steps (not the last), end with verification commands for **that step only**.
+
 ## Notes
 
 - These report-mode targets capture step screenshots and write timestamped HTML reports in `.artifacts/e2e-reports/`.
diff --git a/.cursor/skills/reusable-components/SKILL.md b/.cursor/skills/reusable-components/SKILL.md
index b0d5a626..adde2940 100644
--- a/.cursor/skills/reusable-components/SKILL.md
+++ b/.cursor/skills/reusable-components/SKILL.md
@@ -1,25 +1,78 @@
 ---
 name: reusable-components
-description: Prefer reusable components and keep globals minimal. Use when adding layout, form, or UI that could be reused, or when adding styles to globals.scss.
+description: Prefer shared UI components from @metaboost/ui over app-local one-off components or page-specific SCSS wrappers when behavior is generic.
 version: 1.0.0
 ---
 
-# Reusable Components
+# reusable-components
 
-**When to use:** Any time you are adding layout, form, or UI that could be reused, or when you are about to add styles to `globals.scss` (or app-level global CSS).
+## When to use
 
-## Principles
+- Building or refactoring UI in `apps/web` or `apps/management-web`.
+- You see repeated `page.module.scss` patterns for headers, forms, table shells, badges, loading/error text, or action rows.
+- You are about to add styles to app-level global CSS — prefer a component + module SCSS instead.
 
-1. **Prefer reusable components** over one-off markup and global class names. If the same structure or pattern appears on more than one page (or might in the future), extract it into a component.
-2. **Keep globals to a minimum.** Use `globals.scss` only for true app-wide basics (e.g. `html`/`body`, root layout wrappers like `.app-view`). Page- or feature-specific layout and styling belong in component module SCSS or layout components.
-3. **Colocate styles with components.** Use CSS modules (e.g. `ComponentName.module.scss`) for component-specific styles so they are scoped and easy to find.
+## Core rule
 
-## Examples
+Use `@metaboost/ui` first for generic UI behavior. Add app-local components only when the behavior is truly product-specific.
 
-- **Auth form layout:** Use a shared `AuthFormLayout` (or similar) component with its own `.module.scss` instead of auth-specific classes in `globals.scss`.
-- **Repeated page structure:** If multiple pages share a wrapper (e.g. centered card, same padding), create a layout component that accepts `children` and owns the structure and styles.
+## Web-first convergence
 
-## Checklist
+When **web** (`apps/web`) and **management-web** both have a similar generic control (icon button, menu, table chrome, etc.):
 
-- Am I adding a class to `globals.scss`? → Consider a reusable component + module SCSS instead.
-- Does this layout/structure appear (or could it appear) on more than one route? → Extract to a component.
+- **Implement one shared primitive** in `@metaboost/ui` instead of maintaining parallel app-local copies.
+- When reconciling visual differences, **default to the web app’s existing style baseline** (tokens, spacing, borders) unless accessibility or product requirements dictate otherwise. Express differences via props (`appearance`, `variant`) on the shared component.
+
+## i18n (shared UI)
+
+- **Do not** bake user-visible strings (including `aria-label`, `title`, empty/loading copy) into `packages/ui`. Apps own localization (`next-intl`) and pass strings in via props or `children`.
+- When you add or extend a shared component that needs copy, add keys in `apps/web` / `apps/management-web` `i18n/originals/en-US.json` (and keep locales aligned per **i18n** skill and **i18n-locale-language** rule).
+- Follow the **shared-ui-i18n** workspace rule for details.
+
+## Prefer this order
+
+1. Reuse existing exports from `@metaboost/ui` (`Button`, `ActionLink`, `CopyToClipboardButton`, `Table`, `Pagination`, form field primitives, `Alert`, `LoadingSpinner`, `StatusBadge`, `IconButton`, `DropdownMenu`, **`Modal`** / **`Modal.Actions`** / **`Modal.Body`** when present, etc.).
+2. If missing but generic, add a reusable component in `packages/ui/src/components/**` (or a shared hook in `packages/ui/src/hooks/**`) and export it from `packages/ui/src/index.ts`.
+3. Use app-local components only for app shell or domain-specific behavior.
+
+## Promotion rubric
+
+| Question                                            | If yes →                           |
+| --------------------------------------------------- | ---------------------------------- |
+| Used in two apps or a foreseeable second consumer?  | `packages/ui`                      |
+| Only strings or router differ?                      | App wrapper around a ui primitive  |
+| Imports `next/*` or app-only config?                | App wrapper                        |
+| Duplicates a ui component with a small style tweak? | Extend ui `variant` / `appearance` |
+
+For cross-app extraction steps, use **ui-component-promotion**.
+
+## App-local configured wrappers (same app, 2+ callsites)
+
+When the **same** `@metaboost/ui` usage appears in **two or more** places **within one app** (same props, same `next-intl` keys for `aria-label` / visible copy), extract a thin **client** component under `apps/<app>/src/components/**` that:
+
+- Owns **`useTranslations`** (or other app-only wiring) and fixed conventions.
+- **Forwards** the remaining props to the shared primitive.
+- Does **not** embed strings in `packages/ui`; the wrapper stays in the app.
+
+Avoid **bare** `export { X } from '@metaboost/ui'` re-exports with no behavior.
+
+## Module SCSS tokens
+
+Use only canonical CSS variables from `packages/ui/src/styles/`; do not add `var(--name, fallback)` — see **css-custom-properties-no-var-fallbacks** rule.
+
+## management-web notes (Metaboost)
+
+- **`FormActions`** from `@metaboost/ui` should keep **Cancel then Submit** in the DOM with a **right-aligned** footer (see **use-form-component**).
+- Prefer **`Select`** from `@metaboost/ui` over raw `<select>` + loose `<label>` for tier/status fields.
+- Forms should use shared form action patterns; prefer `Table` + `Pagination` for list pages.
+
+## Avoid
+
+- New page-specific SCSS utility classes that duplicate existing `@metaboost/ui` behavior.
+- Creating a new component in app code when a `@metaboost/ui` primitive can compose the same UI without repeated identical configuration.
+
+## Cross-references
+
+- **ui-component-promotion** — cross-app extraction workflow
+- **modal-layout-contract** — `Modal` / `ModalDialogContent` footer rules
+- **styles-source-of-truth** — tokens in `packages/ui/src/styles/`
diff --git a/.cursor/skills/routing-url-params/SKILL.md b/.cursor/skills/routing-url-params/SKILL.md
new file mode 100644
index 00000000..f5b12235
--- /dev/null
+++ b/.cursor/skills/routing-url-params/SKILL.md
@@ -0,0 +1,49 @@
+---
+name: routing-url-params
+description: Enforces URL query param handling across pages. Use when adding or updating list/detail filters, pagination, or sorting. Keep URLs clean by not auto-inserting params; only preserve params when the user navigates with them, and remove defaults from the URL.
+---
+
+# Routing URL Params
+
+## Instructions
+
+- Do not auto-insert query params into the URL on initial render.
+- Only keep query params if the user navigated with them (typed or landed on a URL containing them).
+- When params are at default values, remove them from the URL (e.g., `page=1`, default sort key).
+- Keep internal state for defaults; only reflect non-defaults in the URL.
+- Apply this rule consistently across list and detail pages in **web** and **management-web**.
+
+## Defaults and clearing
+
+- If `page` is 1, it should not appear in the URL.
+- If `sort` is the default (e.g., `recent`), it should not appear in the URL.
+- If a user changes filters back to defaults, clear those params from the URL.
+
+## Pagination and sorting behavior
+
+- Pagination and sorting should still work even when the URL is clean.
+- When the user explicitly changes filters/pagination, update internal state first; only update the URL if the value is non-default.
+
+## Examples
+
+**Good (clean URL)**
+
+- `/buckets` (defaults: page 1, default sort)
+
+**Good (user-specified)**
+
+- `/buckets?page=2&sort=oldest`
+
+**Good (clear defaults after change)**
+
+- User selects default sort → remove `sort` param.
+- User returns to page 1 → remove `page` param.
+
+**Bad (auto-inserting defaults)**
+
+- `/buckets?page=1&sort=recent` after initial load
+
+## Related
+
+- **e2e-url-state-contracts** — E2E expectations for URL state
+- **sort-prefs-cookie-by-path** — table sort prefs that may complement URL state
diff --git a/.cursor/skills/startup-validation-env-order/SKILL.md b/.cursor/skills/startup-validation-env-order/SKILL.md
new file mode 100644
index 00000000..ea574cc2
--- /dev/null
+++ b/.cursor/skills/startup-validation-env-order/SKILL.md
@@ -0,0 +1,54 @@
+---
+name: startup-validation-env-order
+description: Keep apps/*/lib/startup/validation.ts push order aligned with apps/*/.env.example section order when practical. Use when adding env vars, startup validation entries, or editing validation.ts.
+version: 1.0.0
+---
+
+# Startup validation order vs env files
+
+## When to use
+
+When adding or reordering entries in:
+
+- `apps/api/src/lib/startup/validation.ts`
+- `apps/management-api/src/lib/startup/validation.ts`
+
+especially after adding vars to the matching `apps/<app>/.env.example`.
+
+## Rule
+
+**Keep validation `results.push(...)` order aligned with the authoritative env template**
+(`apps/<app>/.env.example`) **when practical:**
+
+1. **Section order** — Group validation blocks in the same sequence as env file sections
+   (e.g. General → API Configuration → Auth → Database → …).
+2. **Within a section** — Push validations for vars in the same order they appear under that
+   section header in `.env.example`.
+3. **Last section = last block** — Vars in the final env section belong at the **end** of
+   `validateAllEnvironmentVariables`, not mixed into an earlier category block.
+4. **Comments** — Optional short comment tying a validation block to the env section name
+   helps future edits stay aligned.
+
+## Exceptions (OK to diverge)
+
+- **Early validation** — Vars that must be read before others (e.g. `ACCOUNT_SIGNUP_MODE`
+  before conditional mailer checks) may be validated earlier than their env section.
+- **Grouped helpers** — Custom validators may stay together even if env keys are scattered;
+  keep the _block_ near the related env section when possible.
+- **Display order** — Startup output is grouped by validation `category`, not file order;
+  alignment is for **maintainer ergonomics** when editing both files side by side.
+
+## Files to keep in sync
+
+When adding an env var:
+
+- `apps/<app>/.env.example` — authoritative section + key order
+- `apps/<app>/src/lib/startup/validation.ts` — matching push order (same app)
+- `infra/config/env-templates/*.env.example` when the var is shared across apps
+
+## References
+
+- **startup-validation-env-order** rule (`.cursor/rules/startup-validation-env-order.mdc`)
+- **config-type-safety** rule — no silent defaults in app `config/index.ts`
+- [env-file-formatting](/.cursor/skills/env-file-formatting/SKILL.md) — env value formatting
+- [api](/.cursor/skills/api/SKILL.md) — API startup validation patterns
diff --git a/.cursor/skills/storybook-component-docs/SKILL.md b/.cursor/skills/storybook-component-docs/SKILL.md
index a90f1519..5d4e2474 100644
--- a/.cursor/skills/storybook-component-docs/SKILL.md
+++ b/.cursor/skills/storybook-component-docs/SKILL.md
@@ -27,4 +27,4 @@ Or from `packages/ui`: `npm run storybook`. Dev server runs at http://localhost:
 
 ## Reference
 
-- **Package doc:** [packages/ui/PACKAGES-UI.md](../../../packages/ui/PACKAGES-UI.md) – how to run Storybook, where stories live, how to add a new story.
+- **Package doc:** [packages/ui/PACKAGES-UI.md](/packages/ui/PACKAGES-UI.md) – how to run Storybook, where stories live, how to add a new story.
diff --git a/.cursor/skills/styles-import-last/SKILL.md b/.cursor/skills/styles-import-last/SKILL.md
new file mode 100644
index 00000000..48de610b
--- /dev/null
+++ b/.cursor/skills/styles-import-last/SKILL.md
@@ -0,0 +1,25 @@
+---
+name: styles-import-last
+description: Enforces import ordering so styles (CSS/SCSS module) imports are last. Use when editing React components or pages in .tsx/.jsx files, or when the user mentions import order or style imports.
+---
+
+# Styles Import Last
+
+ESLint enforces import order (including styles last) via `perfectionist/sort-imports`. Run `npm run lint:fix` to fix order.
+
+## Instructions
+
+- In React components and pages (`.tsx`/`.jsx`), place the styles import as the final import at the top of the file.
+- Keep existing import grouping, but move the styles import to the end of the import block.
+- Applies to CSS/SCSS module imports like `styles` or similar.
+- If order is wrong, run `npm run lint:fix` to auto-fix.
+
+## Example
+
+```tsx
+import { useTranslations } from 'next-intl';
+
+import { Button } from '@metaboost/ui';
+
+import styles from './MyComponent.module.scss';
+```
diff --git a/.cursor/skills/styles-source-of-truth/SKILL.md b/.cursor/skills/styles-source-of-truth/SKILL.md
new file mode 100644
index 00000000..bff66ee9
--- /dev/null
+++ b/.cursor/skills/styles-source-of-truth/SKILL.md
@@ -0,0 +1,49 @@
+---
+name: styles-source-of-truth
+description: Design tokens, themes, mixins, and reset live in @metaboost/ui. Apps consume them via @metaboost/ui/styles/* — do not duplicate tokens in app SCSS.
+---
+
+# styles-source-of-truth
+
+## Source of truth
+
+`packages/ui/src/styles/` is the canonical home for:
+
+- Design tokens (SCSS variables + CSS custom properties): `_variables.scss`
+- Themes on **`[data-theme]`** (`light`, `dark`, `dracula`): `_themes.scss`
+- Shared SCSS mixins: `_mixins.scss`
+- CSS reset: `_reset.scss`
+
+## Usage in apps
+
+```scss
+@use '@metaboost/ui/styles/variables' as *;
+@use '@metaboost/ui/styles/mixins' as *;
+@use '@metaboost/ui/styles/themes';
+@use '@metaboost/ui/styles/reset';
+```
+
+Use CSS variables in module SCSS:
+
+```scss
+.card {
+  padding: $space-4;
+  color: var(--color-text);
+  background-color: var(--color-bg);
+}
+```
+
+## Rules
+
+- **No `var()` fallbacks:** Do not use `var(--token, fallback)` in SCSS/CSS (see **css-custom-properties-no-var-fallbacks** rule). Missing tokens belong in `_variables.scss` / `_themes.scss`, not masked with a second `var()` argument.
+- **Buttons and controls:** Never rely on the browser default `<button>` background. Always set `background-color` and `color` using theme tokens so variants stay readable on **every** `[data-theme]` (`light`, `dark`, `dracula`).
+- Do **not** add new tokens to `apps/web/src/styles/...` or `apps/management-web/src/styles/...` except app layout glue that imports package styles. Add tokens in `packages/ui/src/styles/_variables.scss` (and `_themes.scss` if theme-dependent).
+- If page/module styles repeat across multiple pages (forms, table wrappers, badges, header action rows), prefer a reusable React component in `@metaboost/ui` rather than duplicated SCSS blocks.
+- Theme-dependent values (colors, surfaces, button states) **must** be defined in **every** built-in theme block in `_themes.scss` (`light`, `dark`, `dracula`).
+- Non-theme values (spacing, radii, dialog widths, etc.) live in `_variables.scss`.
+- Default theme: **`light`** on `:root` and `[data-theme='light']`; apps set `data-theme` on a root wrapper.
+- If you change a value used by both apps, change it in `packages/ui/src/styles/` and verify web and management-web E2E smoke targets.
+
+## When to break this skill
+
+Never. Token duplication is the bug class this skill exists to prevent.
diff --git a/.cursor/skills/time-format-local/SKILL.md b/.cursor/skills/time-format-local/SKILL.md
new file mode 100644
index 00000000..6bbd2dfc
--- /dev/null
+++ b/.cursor/skills/time-format-local/SKILL.md
@@ -0,0 +1,32 @@
+---
+name: time-format-local
+description: Ensures client-side time displays use formatDateTimeReadable for localized, readable timestamps. Use when rendering dates/times in the UI or when the user mentions time formatting or local timezone display.
+---
+
+# Local Time Formatting
+
+## Instructions
+
+- For client-side UI that displays a time to users, use **`formatDateTimeReadable`** from **`@metaboost/helpers-i18n/client`**.
+- Pass the active locale (typically from **`useLocale()`** / **`next-intl`**) as the **first** argument.
+- This ensures readable timestamps rendered in the user's local timezone with project-supported locales.
+
+## Example
+
+```tsx
+'use client';
+
+import { formatDateTimeReadable } from '@metaboost/helpers-i18n/client';
+import { useLocale } from 'next-intl';
+
+const locale = useLocale();
+const label = formatDateTimeReadable(locale, lastMessageAt);
+```
+
+## Options
+
+`formatDateTimeReadable` accepts optional **`FormatDateTimeOptions`** (`dateStyle`, `timeStyle`, `includeTimezone`) when a shorter or timezone-free display is needed.
+
+## Don't
+
+- Do not use raw `Date.toLocaleString()` without going through the shared helper — locale validation and defaults live in **`packages/helpers-i18n`**.
diff --git a/.cursor/skills/ui-component-promotion/SKILL.md b/.cursor/skills/ui-component-promotion/SKILL.md
new file mode 100644
index 00000000..2318543d
--- /dev/null
+++ b/.cursor/skills/ui-component-promotion/SKILL.md
@@ -0,0 +1,28 @@
+---
+name: ui-component-promotion
+description: Extract or deduplicate UI between apps/web and apps/management-web via packages/ui; thin app wrappers for Next and i18n.
+version: 1.0.0
+---
+
+# ui-component-promotion
+
+## When to use
+
+- Extracting or deduplicating components between **web** and **management-web**.
+- Parallel implementations of the same generic control appear in both apps.
+
+## Steps
+
+1. **Inventory** — find both implementations; list props, styles, and user-visible strings.
+2. **Prop API** — design `@metaboost/ui` surface with **no embedded user-facing copy** (see **shared-ui-i18n**).
+3. **SCSS** — shared styles live under `packages/ui/src/components/**`; converge on the **web visual baseline** unless docs say otherwise (see **prefer-shared-ui-web-management**); prefer **`variant`** / **`appearance`** over forks.
+4. **Export** — add the symbol to `packages/ui/src/index.ts`.
+5. **App migration** — keep wrappers thin where required (`next/link`, `next-intl`, session guards). The same “thin wrapper” approach applies **inside one app** when identical configured usage repeats (see **reusable-components**).
+6. **Tests** — unit tests for meaningful behavior in `packages/ui`; **E2E** when user-visible flows change (**feature-implementation-testing**).
+
+## Related
+
+- **shared-ui-i18n** — apps localize; `@metaboost/ui` stays copy-free.
+- **reusable-components** — default preference order and anti-patterns.
+- **modal-layout-contract** — shared dialog shells (`ModalDialogContent`, `ConfirmDeleteModal`).
+- **feature-implementation-testing** — integration vs E2E expectations by tier.
diff --git a/.cursor/skills/ui-e2e-screenshot-report/SKILL.md b/.cursor/skills/ui-e2e-screenshot-report/SKILL.md
new file mode 100644
index 00000000..e115e739
--- /dev/null
+++ b/.cursor/skills/ui-e2e-screenshot-report/SKILL.md
@@ -0,0 +1,54 @@
+---
+name: ui-e2e-screenshot-report
+description: After Next.js, React, or shared UI changes, instruct the operator to run a targeted make E2E screenshot report and where to review it.
+version: 1.0.0
+---
+
+# UI Change E2E Screenshot Report
+
+Use this skill when you modify **visual or interactive UI** in:
+
+- `apps/web/src/**`
+- `apps/management-web/src/**`
+- `packages/ui/src/**` (when behavior or layout affects web or management-web)
+
+## Operator verification (UI changes)
+
+Agents do **not** run E2E during implementation. Instruct the operator to verify UI work with a targeted screenshot report:
+
+1. Pick the **narrowest** spec that covers the changed surface (add or update the spec when behavior changed; see **e2e-page-tests**).
+2. End the response with the matching make target in a fenced `bash` block (repo root).
+3. Tell the operator where to review screenshots **after they run the command**:
+   - Primary: `.artifacts/e2e-reports/latest/web/index.html` or `.artifacts/e2e-reports/latest/management-web/index.html`
+   - Also mention the concrete timestamped path printed by make (e.g. `.artifacts/e2e-reports/20260528-143022/web/index.html`).
+
+## Commands
+
+- Web: `make e2e_test_web_report_spec SPEC=e2e/<spec>.spec.ts`
+- Management-web: `make e2e_test_management_web_report_spec SPEC=e2e/<spec>.spec.ts`
+- Both apps: `make e2e_test_report_scoped WEB_SPEC=e2e/<web>.spec.ts MGMT_SPEC=e2e/<mgmt>.spec.ts`
+
+Use `SPEC` paths relative to the app `e2e/` folder (e.g. `e2e/login.spec.ts`), not `apps/web/e2e/...`.
+
+Do **not** use `npx playwright test` directly; make handles seed, deps, and report output.
+
+## API gate
+
+Do **not** add `E2E_API_GATE_MODE=on` unless the change also requires API integration tests. Metaboost Makefile defaults to skipping API tests during E2E report runs.
+
+## Response format
+
+End the implementation response with:
+
+1. A fenced `bash` block with the exact command for the operator to run.
+2. The expected report path under `.artifacts/e2e-reports/latest/`.
+
+## When this skill does not apply
+
+- API-only, ORM, or config-only changes with no UI impact: follow **response-ending-make-verify**.
+- Documentation-only edits under `docs/` with no component changes.
+
+## Related
+
+- **response-ending-make-verify** — command tree and API gate policy
+- **end-with-targeted-make-report-verify** rule — mandatory E2E block when UI or E2E specs change
diff --git a/.cursor/skills/unit-test-design-no-overgranularity/SKILL.md b/.cursor/skills/unit-test-design-no-overgranularity/SKILL.md
new file mode 100644
index 00000000..69d4fb55
--- /dev/null
+++ b/.cursor/skills/unit-test-design-no-overgranularity/SKILL.md
@@ -0,0 +1,40 @@
+---
+name: unit-test-design-no-overgranularity
+description: Keep tests behavior-focused and avoid low-value complexity. Use when writing or reviewing unit tests.
+version: 1.0.0
+---
+
+# Unit Test Design - No Overgranularity
+
+Podverse-aligned skill. Metaboost also documents depth limits in **unit-tests-confident-granularity** —
+use both when scoping tests.
+
+## Core Rule
+
+Test behavior contracts and business invariants, not implementation trivia.
+
+## Prefer
+
+- Table-driven cases for deterministic logic
+- Public API behavior over private internals
+- Stable inputs/outputs with explicit assertions
+- Minimal mocks at system boundaries (time, network, DB, environment)
+
+## Avoid
+
+- Snapshot-heavy test suites for logic modules
+- Tests that only mirror implementation line-by-line
+- Huge combinatorial matrices with little incremental signal
+- Framework/library behavior tests that do not validate Metaboost logic
+
+## Practical Depth Limits
+
+- Cover one happy path + key failure path + boundary path first
+- Add cases only when each new case guards a distinct regression risk
+- Stop when additional tests mostly duplicate existing signal
+
+## Determinism
+
+- Freeze time when needed
+- Avoid random data without fixed seeds
+- Keep tests fast so developers run them frequently
diff --git a/.cursor/skills/unit-test-new-code-gate/SKILL.md b/.cursor/skills/unit-test-new-code-gate/SKILL.md
new file mode 100644
index 00000000..bf2cf3e4
--- /dev/null
+++ b/.cursor/skills/unit-test-new-code-gate/SKILL.md
@@ -0,0 +1,42 @@
+---
+name: unit-test-new-code-gate
+description: Require tests for new or changed critical business logic, with explicit exceptions. Use during implementation planning and code edits.
+version: 1.0.0
+---
+
+# Unit Test New Code Gate
+
+## Gate
+
+When changing critical business logic, add or update unit tests in the same change.
+
+## Critical Logic Includes
+
+- Auth, identity, token, session, and membership checks
+- Management-api permission and invitation flows
+- Rate limiting and abuse protection behavior
+- ORM decision logic that affects persisted state (billing, bucket, user)
+- Standard-endpoint signing and registry validation
+- RSS parse policy and currency conversion edge cases
+
+## Acceptable Exceptions
+
+An exception is acceptable only when one of these is true:
+
+1. Change is strictly non-behavioral (comment, rename, formatting)
+2. Logic is fully exercised by existing tests and no branch behavior changed
+3. Testability requires substantial refactor outside request scope
+
+## Required Exception Note
+
+If skipping tests for changed critical logic, document:
+
+- Why tests were skipped
+- What risk remains
+- What follow-up test should be added later
+
+## Verification
+
+- Run workspace tests for changed areas first (`npm run test -w <workspace>` or root `npm run test:unit`).
+- Run `npm run test:e2e:api` when API integration behavior changed.
+- Run targeted E2E make targets when web/management-web behavior changed (see **response-ending-make-verify**).
diff --git a/.cursor/skills/unit-test-priority-confident/SKILL.md b/.cursor/skills/unit-test-priority-confident/SKILL.md
new file mode 100644
index 00000000..a35e02e3
--- /dev/null
+++ b/.cursor/skills/unit-test-priority-confident/SKILL.md
@@ -0,0 +1,40 @@
+---
+name: unit-test-priority-confident
+description: Prioritize unit-test investments for confident (not bulletproof) coverage. Use when planning or implementing tests in Metaboost.
+version: 1.0.0
+---
+
+# Unit Test Priority - Confident Coverage
+
+Podverse-aligned skill. Metaboost also documents risk ordering in **unit-tests-risk-first** — use both;
+this skill adds domain-specific priority targets.
+
+## Goal
+
+Direct test effort to the highest-risk behavior first so coverage gains are meaningful and maintainable.
+
+## Priority Order
+
+1. Auth/security logic (`apps/api/src/lib`, `apps/management-api/src/lib`, JWT/session helpers)
+2. ORM business rules (`packages/orm`, `packages/management-orm` — membership, billing, bucket policy)
+3. Signing and registry helpers (`metaboost-signing`, standard-endpoint registry wiring)
+4. Currency/RSS helpers (`@metaboost/helpers-currency`, `@metaboost/rss-parser`)
+5. High-impact web utilities/hooks (`apps/web/src`, `apps/management-web/src` — non-trivial business hooks)
+
+## Selection Rules
+
+- Prefer pure/near-pure modules first.
+- Prioritize modules with branchy business behavior over simple pass-through code.
+- Cover invariants and boundary behavior before broad expansion.
+- Add tests near changed code when touching critical logic.
+
+## Confidence Target
+
+"Confident" means:
+
+- Happy path covered
+- Key failure path covered
+- Risky edge/boundary cases covered
+
+It does not require full branch-permutation exhaustion. See **unit-tests-confident-granularity** and
+**unit-test-design-no-overgranularity** for depth limits.
diff --git a/.cursor/skills/unit-tests-confident-granularity/SKILL.md b/.cursor/skills/unit-tests-confident-granularity/SKILL.md
index be60bfaf..b02b9647 100644
--- a/.cursor/skills/unit-tests-confident-granularity/SKILL.md
+++ b/.cursor/skills/unit-tests-confident-granularity/SKILL.md
@@ -6,6 +6,9 @@ version: 1.0.0
 
 # Unit Tests - Confident Granularity
 
+Podverse-aligned counterpart: **unit-test-design-no-overgranularity** (anti-patterns and stop rules).
+Use both when scoping test depth.
+
 ## Goal
 
 Deliver strong confidence without turning test suites into unmaintainable exhaustive matrices.
diff --git a/.cursor/skills/unit-tests-risk-first/SKILL.md b/.cursor/skills/unit-tests-risk-first/SKILL.md
index d1bbd8c3..e62634b0 100644
--- a/.cursor/skills/unit-tests-risk-first/SKILL.md
+++ b/.cursor/skills/unit-tests-risk-first/SKILL.md
@@ -6,6 +6,10 @@ version: 1.0.0
 
 # Unit Tests - Risk First
 
+Podverse-aligned counterpart: **unit-test-priority-confident** (domain priority list). Use this skill
+for blast-radius / security-impact ordering; use **unit-test-priority-confident** for module-area
+targets.
+
 ## Use This Skill When
 
 - Creating a new unit-test backlog.
diff --git a/.cursor/skills/use-form-component/SKILL.md b/.cursor/skills/use-form-component/SKILL.md
index 66b27993..c668bfc8 100644
--- a/.cursor/skills/use-form-component/SKILL.md
+++ b/.cursor/skills/use-form-component/SKILL.md
@@ -21,6 +21,11 @@ Do **not** use raw `<form>` in app code. Use one of:
 - Use **Form** when the whole block is “card + form” (e.g. auth screens); use **FormContainer** when the form lives inside an existing card or page section.
 - For spacing around the form, use a layout component (e.g. `Stack` with gap or `Container`) rather than a bare `div`; see **avoid-wrapper-elements**.
 
+## FormActions (footer row)
+
+- **`FormActions`** (`@metaboost/ui`) uses **`justify-content: flex-end`** so Cancel and Submit sit on the **right**.
+- **DOM order:** secondary (**Cancel**) first, primary (**Submit**) second — visually Cancel left of Submit at the trailing edge.
+
 ## Checklist
 
 - Adding a new form? → Use `Form` or `FormContainer` from `@metaboost/ui`, not `<form>`.
diff --git a/.cursorignore b/.cursorignore
index ad5f6162..f1ae5382 100644
--- a/.cursorignore
+++ b/.cursorignore
@@ -1,2 +1,3 @@
-# Machine-generated Copilot export mirror: CI on develop; source of truth is .cursor (llm-cursor-source)
-.llm/exports/
+# Optional human LLM history workflow (archived policy text; not agent instructions)
+docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md
+
diff --git a/.cursorrules b/.cursorrules
index 08de1bf7..5b42ccba 100644
--- a/.cursorrules
+++ b/.cursorrules
@@ -4,65 +4,69 @@
 
 - Node.js 24+, TypeScript strict, npm workspaces
 
+## Architecture
+
+Lower tiers cannot depend on higher (see `.cursor/rules/architecture-tier-dependencies.mdc`; full table in `.llm/context/architecture.md`).
+
 ## Code Quality
 
 - No `any` types
-- **Strict equality**: Use `===` and `!==` only (no `==` or `!=`).
-- **Avoid type assertions (`as`)**: Prefer proper types, optional chaining, type guards, or narrowing.
+- **Shared UI:** Prefer `@metaboost/ui` for reusable primitives in web and management-web. When both apps overlap, implement once in `packages/ui` and **prefer the web app's existing visual baseline** when merging styles unless a11y/product docs say otherwise (see `.cursor/rules/prefer-shared-ui-web-management.mdc`, **`reusable-components`**, and **`ui-component-promotion`** when adopted).
+- Follow `tsconfig.base.json`
+- Use ESM formatting: **Tier A** uses `.js` specifiers on relative TS imports (NodeNext); **Tier B** (`apps/web/src`, `apps/management-web/src`) stays extensionless until Turbopack parity — [docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md](docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md). Prefer `"type": "module"` where applicable.
+- Prefer `import type` for type-only imports instead of value imports
+- **Strict equality**: Use `===` and `!==` only (no `==` or `!=`). For "not null or undefined" use `x !== null && x !== undefined` (or optional chaining / truthiness where appropriate).
+- **Avoid type assertions (`as`)**: Prefer proper types, optional chaining, type guards, or narrowing so the type system enforces correctness. Use `as` only when there is no better way (e.g. necessary escape hatch); keep such use minimal and documented.
 - **Named exports**: Prefer named `export` in TypeScript modules; avoid `export default` when a named export works. Framework-required defaults (e.g. Next.js `page.tsx`) are the exception. See `.cursor/skills/prefer-named-exports/SKILL.md`.
+- **CSS `var()`:** Do not use fallback arguments in SCSS/CSS (`var(--token, …)`); see `.cursor/rules/css-custom-properties-no-var-fallbacks.mdc`.
 
-## Formatting
-
-- **JavaScript/TypeScript/JSON/CSS**: Single quotes, semicolons, 2-space indent.
-- Run `npm run lint:fix` or `npm run prettier:write` to auto-fix.
+## Commands / Terminal
 
----
+- **Commands from repo root**: When giving terminal or npm commands, always give them **relative to the monorepo root**. Use `npm run <script> -w @metaboost/<workspace> -- [args]` instead of instructing users to `cd apps/api` (or similar) first. See `.cursor/rules/commands-from-metaboost-root.mdc`.
+- **Copy button**: Always put runnable commands in a **fenced code block** (e.g. `bash ... `) so the IDE shows a copy button. Do not give only inline commands when the user may want to run them.
 
-## LLM WORKFLOW
+## Formatting Rules
 
-### Context Gathering
+### Quote Styles
 
-For substantial requests, ask: "What's the goal?" / "GitHub issue?"
-
-### Scope Management
-
-Warn if drifting: "This seems outside scope. Continue?"
-
-### Agent/plan work: do not run tests
-
-- **Do not run** test or verification commands (e.g. `make e2e_test_web`, `npm run test`) during agent or plan implementation.
-- **Only instruct the user** to run those commands after your work is done; provide the exact command(s) in a fenced `bash` block. See **response-ending-make-verify** skill for which commands to suggest.
-- **E2E verification commands:** Always give commands that **skip API tests** by default (do not add `E2E_API_GATE_MODE=on`). Only add `E2E_API_GATE_MODE=on` when the change affected API or integration tests. The Makefile default is `E2E_API_GATE_MODE=off`.
+- **JavaScript/TypeScript/JSON/CSS**: Single quotes (`singleQuote: true`)
+- **YAML files**: Double quotes (override in `.prettierrc.json`)
+- Run `npm run lint:fix` or `npm run prettier:write` to auto-fix
 
 ---
 
-## HISTORY TRACKING (Essential)
+## LLM WORKFLOW
+
+### Context Gathering
 
-**Applies to every file-modifying response in this repo** — no exception for path or task size. When in doubt, update history.
+For substantial requests, ask first:
 
-Before work: Check/create `.llm/history/active/[feature]/[feature]-part-01.md`
+- "What's the goal?"
+- "GitHub issue?"
 
-After changes, update with:
+### Issue Linking
 
-- Session date, user prompt (EXACT text), decisions, files
+Ask once at start: "Related GitHub issue?"
 
-### Prompt Recording (CRITICAL)
+### Scope Management
 
-**Always use the user's EXACT, FULL prompt text.** Never summarize or paraphrase.
+Warn if drifting: "This seems outside scope. Continue?"
 
-- **`#### Prompt (Developer)`** — Manually typed by the user
-- **`#### Prompt (Agent)`** — System-generated (e.g., clicking "Build" on a plan)
+### Agent/plan work: operator-only git and publish
 
-### Real-Time Capture
+- **Git operations = `git` + `gh`.** Do not run write/publish commands (`git push`, `gh pr create`, `gh pr merge`, releases, etc.) unless the user explicitly asks for a specific command in that message.
+- Implement locally; give the operator copy-pasteable `git` and `gh` commands in a fenced `bash` block. See **operator-only-git-operations** rule.
 
-**If a response will modify files, log the prompt FIRST.**
+### Agent/plan work: do not run tests
 
-- **Start of response**: Log prompt to `.llm/history/active/[feature]/[file].md`
-- **End of response**: Update with files changed and key decisions
+- **Do not run** test or verification commands (e.g. `make e2e_test_web`, `npm run test`, `npm run lint`) during agent or plan implementation.
+- **Only instruct the user** to run those commands after your work is done; provide the exact command(s) in a fenced `bash` block. See **response-ending-make-verify** skill.
+- **E2E verification commands:** Always give commands that **skip API tests** by default (do not add `E2E_API_GATE_MODE=on`). Only add `E2E_API_GATE_MODE=on` when the change affected API or integration tests. The Makefile default is `E2E_API_GATE_MODE=off`.
+- **Final COPY-PASTA prompt:** When you complete the last step in a plan set, assume the operator ran all COPY-PASTA prompts back-to-back without running tests. End the response with **all** cumulative verification commands for the whole set (deduped; see **response-ending-make-verify** and **plan-files-convention** skills).
 
-Skip logging for pure Q&A or explanations that don't change files.
+### User vocabulary
 
-End file-modifying responses with: **LLM History**: Updated `.llm/history/active/[feature]/[file].md`
+User vocabulary **abcmemory** / **abcremember**: see `.cursor/rules/abcmemory-vocabulary.mdc` and `.cursor/skills/abcmemory/SKILL.md`.
 
 ---
 
@@ -70,4 +74,4 @@ End file-modifying responses with: **LLM History**: Updated `.llm/history/active
 
 **Plans must be under 300 lines.** Plans live in `.llm/plans/active/` (not `.cursor/plans/`).
 
-If over 300: STOP, split into sub-plans, save in `.llm/plans/active/`, then work sequentially.
+If over 300: STOP, split into sub-plans, save in `.llm/plans/active/`, then work sequentially. For file layout, use **plan-files-convention** skill.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9353d937..a7069582 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,8 +1,12 @@
-# Dependabot configuration – aligned with Podverse monorepo
-# Targets develop branch.
+# Dependabot configuration for automated dependency updates
+# Targets develop branch — PRs are created against develop.
 #
-# Node.js: we only care about LTS (even-numbered: 18, 20, 22, 24, 26...).
-# This repo uses Node >= 24; odd-numbered majors are non-LTS and are ignored.
+# Node.js: Dependabot has no "LTS only" filter. We adopt new Node LTS on a defined
+# schedule (.nvmrc, CI, Dockerfiles) and do not use Dependabot PRs for the official
+# `node` Docker image (ignore all `node` image updates below). @types/node is filtered
+# to reduce noise from non-LTS odd majors and not-yet-adopted current lines (e.g. 26.x).
+#
+# Note: This is an alternative to Renovate — use ONE or the other, not both.
 
 version: 2
 
@@ -24,11 +28,25 @@ updates:
       - "dependencies"
     commit-message:
       prefix: "chore(deps)"
-    # Only LTS (even) Node >= 24: ignore pre-24 and odd (non-LTS) versions
     ignore:
       - dependency-name: "@types/node"
-        versions: ["18.x", "19.x", "20.x", "21.x", "22.x", "23.x", "25.x", "27.x", "29.x", "31.x"]
+        versions:
+          - "18.x"
+          - "19.x"
+          - "20.x"
+          - "21.x"
+          - "22.x"
+          - "23.x"
+          - "25.x"
+          - "26.x"
+          - "27.x"
+          - "28.x"
+          - "29.x"
+          - "30.x"
+          - "31.x"
+          - "32.x"
     groups:
+      # Group minor/patch prod deps together
       production-minor-patch:
         applies-to: version-updates
         patterns:
@@ -40,14 +58,14 @@ updates:
         update-types:
           - "minor"
           - "patch"
+      # TypeScript ecosystem — often needs manual attention
       typescript-ecosystem:
         patterns:
           - "typescript"
           - "@types/*"
           - "eslint*"
 
-  # Docker images – infra/docker/local/*
-  # Docker `versions` use Bundler/Rubygems ranges (GitHub docs), not npm semver like "25.x".
+  # Docker images — ignore all updates for the official `node` base image (bump with LTS adoption).
   - package-ecosystem: "docker"
     directory: "/infra/docker/local/api"
     target-branch: "develop"
@@ -56,10 +74,8 @@ updates:
     labels:
       - "dependencies"
       - "docker"
-    # Only LTS (even) Node >= 24: ignore pre-24 and odd (non-LTS) versions
     ignore:
       - dependency-name: "node"
-        versions: ["18", "19", "20", "21", "22", "23", "25", "27", "29", "31"]
 
   - package-ecosystem: "docker"
     directory: "/infra/docker/local/web"
@@ -69,10 +85,8 @@ updates:
     labels:
       - "dependencies"
       - "docker"
-    # Only LTS (even) Node >= 24: ignore pre-24 and odd (non-LTS) versions
     ignore:
       - dependency-name: "node"
-        versions: ["18", "19", "20", "21", "22", "23", "25", "27", "29", "31"]
 
   - package-ecosystem: "docker"
     directory: "/infra/docker/local/web-sidecar"
@@ -82,10 +96,8 @@ updates:
     labels:
       - "dependencies"
       - "docker"
-    # Only LTS (even) Node >= 24: ignore pre-24 and odd (non-LTS) versions
     ignore:
       - dependency-name: "node"
-        versions: ["18", "19", "20", "21", "22", "23", "25", "27", "29", "31"]
 
   - package-ecosystem: "docker"
     directory: "/infra/docker/local/management-api"
@@ -95,10 +107,8 @@ updates:
     labels:
       - "dependencies"
       - "docker"
-    # Only LTS (even) Node >= 24: ignore pre-24 and odd (non-LTS) versions
     ignore:
       - dependency-name: "node"
-        versions: ["18", "19", "20", "21", "22", "23", "25", "27", "29", "31"]
 
   - package-ecosystem: "docker"
     directory: "/infra/docker/local/management-web"
@@ -108,10 +118,8 @@ updates:
     labels:
       - "dependencies"
       - "docker"
-    # Only LTS (even) Node >= 24: ignore pre-24 and odd (non-LTS) versions
     ignore:
       - dependency-name: "node"
-        versions: ["18", "19", "20", "21", "22", "23", "25", "27", "29", "31"]
 
   - package-ecosystem: "docker"
     directory: "/infra/docker/local/management-web-sidecar"
@@ -121,10 +129,8 @@ updates:
     labels:
       - "dependencies"
       - "docker"
-    # Only LTS (even) Node >= 24: ignore pre-24 and odd (non-LTS) versions
     ignore:
       - dependency-name: "node"
-        versions: ["18", "19", "20", "21", "22", "23", "25", "27", "29", "31"]
 
   # GitHub Actions
   - package-ecosystem: "github-actions"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 70b22fd2..918ef53b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -97,11 +97,11 @@ jobs:
           ref: ${{ steps.pr-comment.outputs.head_sha }}
 
       - name: Validate linear migration files
-        id: db-validate
+        id: db-verify
         run: bash scripts/database/validate-linear-migrations.sh
 
-      - name: Verify generated linear baseline artifacts
-        id: db-baseline
+      - name: Verify linear baseline 0003
+        id: db-baseline-0003
         run: bash scripts/database/verify-linear-baseline.sh
 
       - name: Validate db init sync
@@ -122,9 +122,23 @@ jobs:
           node-version: "24"
           cache: "npm"
 
+      - name: Pin npm version
+        run: npm install -g npm@11.13.0
+
       - name: Install dependencies
         id: install
-        run: npm ci --include=optional
+        run: |
+          set -euo pipefail
+          for attempt in 1 2 3 4 5; do
+            if npm ci; then
+              break
+            fi
+            echo "npm ci failed (attempt $attempt/5); retrying in 15s..." >&2
+            sleep 15
+            if [[ "$attempt" -eq 5 ]]; then
+              exit 1
+            fi
+          done
 
       - name: Build packages
         id: build-packages
@@ -244,7 +258,7 @@ jobs:
               '| Check | Status |',
               '|-------|--------|',
               '| Linear migration files valid | ✅ |',
-              '| Linear baseline 0003 (.sql.gz) verified | ✅ |',
+              '| Linear baseline 0003 (vs generator) | ✅ |',
               '| DB init sync valid | ✅ |',
               '| Bootstrap init contract verified | ✅ |',
               '| Runtime CREATE EXTENSION guard | ✅ |',
@@ -294,8 +308,8 @@ jobs:
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{
             github.run_id }}
           PR_NUMBER: ${{ steps.pr-comment.outputs.pr_number }}
-          DB_VALIDATE: ${{ steps.db-validate.outcome }}
-          DB_BASELINE: ${{ steps.db-baseline.outcome }}
+          DB_VERIFY: ${{ steps.db-verify.outcome }}
+          DB_BASELINE_0003: ${{ steps.db-baseline-0003.outcome }}
           DB_INIT_SYNC: ${{ steps.db-init-sync.outcome }}
           DB_BOOTSTRAP_CONTRACT: ${{ steps.db-bootstrap-contract.outcome }}
           DB_RUNTIME_EXTENSION_GUARD: ${{ steps.db-runtime-extension-guard.outcome }}
@@ -314,7 +328,7 @@ jobs:
             };
 
             const baselineFix =
-              process.env.DB_BASELINE === 'failure'
+              process.env.DB_BASELINE_0003 === 'failure'
                 ? [
                     '',
                     '**Linear baseline 0003a/0003b:** Regenerate from the repo root, then commit:',
@@ -334,8 +348,8 @@ jobs:
               '',
               '| Check | Status |',
               '|-------|--------|',
-              `| Linear migration files valid | ${status(process.env.DB_VALIDATE)} |`,
-              `| Linear baseline 0003 (.sql.gz) verified | ${status(process.env.DB_BASELINE)} |`,
+              `| Linear migration files valid | ${status(process.env.DB_VERIFY)} |`,
+              `| Linear baseline 0003 (vs generator) | ${status(process.env.DB_BASELINE_0003)} |`,
               `| DB init sync valid | ${status(process.env.DB_INIT_SYNC)} |`,
               `| Bootstrap init contract verified | ${status(process.env.DB_BOOTSTRAP_CONTRACT)} |`,
               `| Runtime CREATE EXTENSION guard | ${status(process.env.DB_RUNTIME_EXTENSION_GUARD)} |`,
diff --git a/.github/workflows/complete-feature.yml b/.github/workflows/complete-feature.yml
new file mode 100644
index 00000000..0d9707cd
--- /dev/null
+++ b/.github/workflows/complete-feature.yml
@@ -0,0 +1,100 @@
+name: Complete Feature
+
+# Automatically moves LLM history from active/ to completed/ when a PR is merged into develop.
+on:
+  pull_request:
+    types: [closed]
+    branches: [develop]
+
+# Prevent concurrent pushes to target branch - queue instead of cancel
+concurrency:
+  group: push-${{ github.event.pull_request.base.ref }}
+  cancel-in-progress: false
+
+jobs:
+  complete-history:
+    # Only run if PR was merged (not just closed)
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: false
+
+      - name: Extract feature name from branch
+        id: feature
+        run: |
+          BRANCH="${{ github.event.pull_request.head.ref }}"
+          # Extract feature name (remove prefix like feature/, fix/, etc.)
+          FEATURE_NAME=$(echo "$BRANCH" | sed 's|^[^/]*/||')
+          echo "name=$FEATURE_NAME" >> $GITHUB_OUTPUT
+          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Check for LLM history
+        id: check
+        run: |
+          FEATURE_NAME="${{ steps.feature.outputs.name }}"
+          HISTORY_DIR=".llm/history/active/$FEATURE_NAME"
+
+          if [[ -d "$HISTORY_DIR" ]]; then
+            echo "found=true" >> $GITHUB_OUTPUT
+            echo "Found history directory: $HISTORY_DIR"
+          else
+            echo "found=false" >> $GITHUB_OUTPUT
+            echo "No LLM history found for feature: $FEATURE_NAME"
+            echo "This is normal if LLM assistance wasn't used."
+          fi
+
+      - name: Complete feature history
+        if: steps.check.outputs.found == 'true'
+        run: |
+          FEATURE_NAME="${{ steps.feature.outputs.name }}"
+          HISTORY_DIR=".llm/history/active/$FEATURE_NAME"
+          DATE=$(date +%Y-%m)
+
+          mkdir -p ".llm/history/completed/$DATE"
+
+          # Update completion date in all markdown files
+          for file in "$HISTORY_DIR"/*.md; do
+            if [[ -f "$file" ]]; then
+              sed -i "s/Completed: In Progress/Completed: $(date +%Y-%m-%d)/" "$file"
+            fi
+          done
+
+          # Move directory to completed
+          mv "$HISTORY_DIR" ".llm/history/completed/$DATE/"
+          echo "✓ Moved to .llm/history/completed/$DATE/$FEATURE_NAME/"
+
+      - name: Commit and push
+        if: steps.check.outputs.found == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Configure remote URL with GitHub App token for authenticated push
+          git remote set-url origin https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git
+
+          git add .llm/history/
+
+          if git diff --staged --quiet; then
+            echo "No changes to commit"
+          else
+            git commit --no-verify -m "chore: complete LLM history for ${{ steps.feature.outputs.name }} [bot]"
+
+            # Pull latest changes (in case i18n workflow pushed)
+            git pull --rebase origin ${{ github.event.pull_request.base.ref }} || true
+
+            git push --no-verify origin ${{ github.event.pull_request.base.ref }}
+          fi
diff --git a/.github/workflows/i18n.yml b/.github/workflows/i18n.yml
index 173fe505..5d933d77 100644
--- a/.github/workflows/i18n.yml
+++ b/.github/workflows/i18n.yml
@@ -28,6 +28,9 @@ jobs:
           node-version: "24"
           cache: "npm"
 
+      - name: Pin npm version
+        run: npm install -g npm@11.13.0
+
       - name: Install dependencies
         run: npm ci
 
diff --git a/.github/workflows/llm-exports-full-sync.yml b/.github/workflows/llm-exports-full-sync.yml
deleted file mode 100644
index 369477ee..00000000
--- a/.github/workflows/llm-exports-full-sync.yml
+++ /dev/null
@@ -1,82 +0,0 @@
-# Full regen: wipe per-target generated subtrees, then re-export (removes orphans from renames/deletes in .cursor).
-# Rolling incremental updates use "LLM exports sync" and branch `llm`. This workflow is on-demand; branch `llm-full`.
-# Plain Node (no root npm install); see package.json llm:exports:sync:full.
-#
-# Do not add push, pull_request, schedule, workflow_run, or other automatic triggers. Manual run only
-# (Actions → LLM exports full → Run workflow).
-
-name: LLM exports full
-
-on:
-  workflow_dispatch: {}
-
-concurrency:
-  group: llm-exports-full-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  publish_llm_full_pr:
-    if: github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Checkout develop
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          ref: develop
-          fetch-depth: 0
-
-      - name: Use Node
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-
-      - name: Generate exports (full)
-        run: node scripts/llm/export-from-cursor.mjs sync --full
-
-      - name: Stage export tree
-        # peter-evans/create-pull-request respects .gitignore; machine output is ignored locally
-        # — force-add gitignored export paths
-        run: |
-          set -e
-          git add -A -f -- .llm/exports
-
-      - name: Create or update llm-full PR
-        id: cpr
-        uses: peter-evans/create-pull-request@v7
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: llm-full
-          base: develop
-          add-paths: .llm/exports
-          commit-message: "chore(llm): full regen .llm/exports from .cursor"
-          title: "chore(llm): full regen .llm/exports from .cursor"
-          body: |
-            On-demand full LLM export regen from `.cursor` + `.cursorrules`.
-
-            - Source of truth remains `.cursor/**` and `.cursorrules`
-            - Orphans under per-target `skills/`, `instructions/`, and root `*-instructions.md` are removed for full regen, then the export is regenerated
-            - For day-to-day updates use workflow **LLM exports sync** (branch `llm`); use **LLM exports full** for catch-up / after large renames
-          labels: |
-            llm
-          delete-branch: false
-
-      - name: Keep only the latest open llm-full PR
-        if: always()
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          prs_json=$(gh api "repos/${{ github.repository }}/pulls?state=open&head=${{ github.repository_owner }}:llm-full&base=develop&per_page=100")
-          mapfile -t prs < <(node -e "const prs=JSON.parse(process.argv[1]||'[]'); prs.sort((a,b)=>new Date(b.updated_at)-new Date(a.updated_at)); for (const pr of prs) console.log(pr.number);" "$prs_json")
-          if [ "${#prs[@]}" -le 1 ]; then
-            echo "No duplicate llm-full PRs to close."
-            exit 0
-          fi
-          echo "Keeping PR #${prs[0]} and closing ${#prs[@]}-1 duplicate(s)."
-          for n in "${prs[@]:1}"; do
-            gh pr close "$n" --repo "${{ github.repository }}" --comment "Closing duplicate llm-full automation PR; branch llm-full reuses a single rolling PR into develop."
-          done
diff --git a/.github/workflows/llm-exports-optional-cloud-llm.yml b/.github/workflows/llm-exports-optional-cloud-llm.yml
deleted file mode 100644
index 3b68f9a8..00000000
--- a/.github/workflows/llm-exports-optional-cloud-llm.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-# Placeholder for a future opt-in job that could call a cloud LLM (requires org secrets, budgets, and review).
-# Disabled: does not run until you set `if: true` and implement the job with strict timeouts and no logging of PII.
-
-name: LLM exports optional (cloud) — disabled
-
-on:
-  workflow_dispatch: {}
-
-jobs:
-  not_implemented:
-    if: false
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "Intentionally disabled. See scripts/llm/ and docs/development/llm/GH-EXPORTS-SETUP.md."
diff --git a/.github/workflows/llm-exports-sync.yml b/.github/workflows/llm-exports-sync.yml
deleted file mode 100644
index 4b5b8769..00000000
--- a/.github/workflows/llm-exports-sync.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-# Deterministic sync from .cursor to .llm/exports (see scripts/llm/ and docs/development/llm/).
-# Does not use cloud LLM APIs. Export is plain Node (no root npm install); see package.json llm:exports:sync.
-# PRs to develop are not gated on .llm/exports matching; after merge, this workflow (push to develop) updates branch `llm` and its rolling PR. Use `npm run llm:exports:check` locally if you want to assert a branch is in sync.
-
-name: LLM exports sync
-
-on:
-  push:
-    branches: [develop]
-    paths:
-      - ".cursor/**"
-      - ".cursorrules"
-      - ".cursorignore"
-      - "scripts/llm/**"
-  workflow_dispatch: {}
-
-concurrency:
-  group: llm-exports-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  publish_llm_pr:
-    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/develop' && !contains(github.event.head_commit.message, '[bot]'))
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Checkout develop
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          ref: develop
-          fetch-depth: 0
-
-      - name: Use Node
-        uses: actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-
-      - name: Generate exports
-        run: node scripts/llm/export-from-cursor.mjs sync
-
-      - name: Stage export tree
-        # peter-evans/create-pull-request respects .gitignore; machine output is ignored locally
-        # — force-add gitignored export paths (same staging as local `llm:exports:check` would use)
-        run: |
-          set -e
-          git add -A -f -- .llm/exports
-
-      - name: Create or update llm PR
-        id: cpr
-        uses: peter-evans/create-pull-request@v7
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          branch: llm
-          base: develop
-          add-paths: .llm/exports
-          commit-message: "chore(llm): sync .llm/exports from .cursor"
-          title: "chore(llm): sync .llm/exports from .cursor"
-          body: |
-            Automated LLM export sync from `.cursor` + `.cursorrules`.
-
-            - Source of truth remains `.cursor/**` and `.cursorrules`
-            - Generated: `.llm/exports/**` (including ignored paths, staged on the workflow runner for the PR)
-          labels: |
-            llm
-          delete-branch: false
-
-      - name: Keep only the latest open llm PR
-        if: always()
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          prs_json=$(gh api "repos/${{ github.repository }}/pulls?state=open&head=${{ github.repository_owner }}:llm&base=develop&per_page=100")
-          mapfile -t prs < <(node -e "const prs=JSON.parse(process.argv[1]||'[]'); prs.sort((a,b)=>new Date(b.updated_at)-new Date(a.updated_at)); for (const pr of prs) console.log(pr.number);" "$prs_json")
-          if [ "${#prs[@]}" -le 1 ]; then
-            echo "No duplicate llm PRs to close."
-            exit 0
-          fi
-          echo "Keeping PR #${prs[0]} and closing ${#prs[@]}-1 duplicate(s)."
-          for n in "${prs[@]:1}"; do
-            gh pr close "$n" --repo "${{ github.repository }}" --comment "Closing duplicate llm automation PR; branch llm reuses a single rolling PR into develop."
-          done
diff --git a/.github/workflows/metaboost-infra-alpha-contracts.yml b/.github/workflows/metaboost-infra-alpha-contracts.yml
index 17dfcd60..38441e99 100644
--- a/.github/workflows/metaboost-infra-alpha-contracts.yml
+++ b/.github/workflows/metaboost-infra-alpha-contracts.yml
@@ -24,11 +24,6 @@ jobs:
           kustomize version
 
       - name: Render infra/k8s/alpha overlays
-        run: |
-          set -euo pipefail
-          for overlay in infra/k8s/alpha/*; do
-            if [ -d "$overlay" ] && [ -f "$overlay/kustomization.yaml" ]; then
-              echo "=== kustomize build $overlay ==="
-              kustomize build --load-restrictor LoadRestrictionsNone "$overlay" >/dev/null
-            fi
-          done
+        env:
+          KUSTOMIZE_REF: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: bash scripts/k8s/kustomize-build-metaboost-alpha-overlays.sh
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index 72a86702..eb3b25f8 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -1,4 +1,4 @@
-# Apply labels to PRs based on changed file paths (apps, packages, docs, infra, ci, scripts, tools, i18n, llm).
+# Apply labels to PRs based on changed file paths (apps, packages, docs, infra, ci, scripts, tools, i18n).
 # Requires labels to exist; run scripts/github/setup-all-labels.sh first.
 
 name: PR Labeler
@@ -28,7 +28,6 @@ jobs:
             const paths = files.map(f => f.filename);
             const labels = new Set();
             for (const file of paths) {
-              if (file === '.cursorrules' || file.startsWith('.cursor/')) labels.add('llm');
               if (file.startsWith('apps/')) labels.add('apps');
               if (file.startsWith('packages/')) labels.add('packages');
               if (file.startsWith('docs/')) labels.add('docs');
diff --git a/.github/workflows/publish-main.yml b/.github/workflows/publish-main.yml
index fe9171e9..a643f76a 100644
--- a/.github/workflows/publish-main.yml
+++ b/.github/workflows/publish-main.yml
@@ -107,14 +107,10 @@ jobs:
             const sha = context.sha;
             const owner = context.repo.owner;
             const repo = context.repo.repo;
-            const fs = require("fs");
-            const path = "docs/development/CHANGELOGS/" + base + ".md";
-            let body;
-            if (fs.existsSync(path)) {
-              body = fs.readFileSync(path, "utf8");
-            } else {
-              body = "Production build; no " + path + " at this commit. Bump version on develop at the start of work and write notes continuously in that file.";
-            }
+            const body =
+              "Production release " +
+              base +
+              ". Add or edit release notes on GitHub if needed.";
             try {
               await github.rest.git.createRef({
                 owner, repo, ref: "refs/tags/" + base, sha
diff --git a/.github/workflows/publish-metaboost-signing.yml b/.github/workflows/publish-metaboost-signing.yml
index 29512610..2cae9534 100644
--- a/.github/workflows/publish-metaboost-signing.yml
+++ b/.github/workflows/publish-metaboost-signing.yml
@@ -1,5 +1,5 @@
 # Publish packages/metaboost-signing to the public npm registry.
-# Versioning: bump package.json + CHANGELOG, then tag metaboost-signing-vX.Y.Z and push.
+# Versioning: bump package.json version, then tag metaboost-signing-vX.Y.Z and push.
 
 name: Publish metaboost-signing
 
@@ -31,8 +31,22 @@ jobs:
           cache: "npm"
           registry-url: "https://registry.npmjs.org"
 
+      - name: Pin npm version
+        run: npm install -g npm@11.13.0
+
       - name: Install dependencies
-        run: npm ci --include=optional
+        run: |
+          set -euo pipefail
+          for attempt in 1 2 3 4 5; do
+            if npm ci; then
+              break
+            fi
+            echo "npm ci failed (attempt $attempt/5); retrying in 15s..." >&2
+            sleep 15
+            if [[ "$attempt" -eq 5 ]]; then
+              exit 1
+            fi
+          done
 
       - name: Verify tag matches package version
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
diff --git a/.github/workflows/publish-staging.yml b/.github/workflows/publish-staging.yml
index 4e3ed019..fe0e4cbd 100644
--- a/.github/workflows/publish-staging.yml
+++ b/.github/workflows/publish-staging.yml
@@ -34,8 +34,22 @@ jobs:
           node-version: "24"
           cache: "npm"
 
+      - name: Pin npm version
+        run: npm install -g npm@11.13.0
+
       - name: Install dependencies
-        run: npm ci --include=optional
+        run: |
+          set -euo pipefail
+          for attempt in 1 2 3 4 5; do
+            if npm ci; then
+              break
+            fi
+            echo "npm ci failed (attempt $attempt/5); retrying in 15s..." >&2
+            sleep 15
+            if [[ "$attempt" -eq 5 ]]; then
+              exit 1
+            fi
+          done
 
       - name: Security audit
         run: npm audit --omit=dev --audit-level=moderate
@@ -108,11 +122,10 @@ jobs:
           if [ -n "$OVERRIDE" ]; then
             VERSION="$OVERRIDE"
             create_tag "$VERSION" "$SHA"
-            if [ "$LAST_CREATE_CODE" != "201" ] && [ "$LAST_CREATE_CODE" != "422" ]; then
-              exit 1
-            fi
-            if [ "$LAST_CREATE_CODE" = "422" ]; then
-              echo "::error::Override tag $VERSION already exists" >&2
+            if [ "$LAST_CREATE_CODE" = "201" ]; then
+              echo "Reserved explicit override tag ${VERSION}."
+            elif [ "$LAST_CREATE_CODE" = "422" ]; then
+              echo "Override tag already exists; refusing unless same commit (not implemented for simple path); exit 1" >&2
               exit 1
             fi
           else
@@ -125,15 +138,26 @@ jobs:
                   if (index(ref, prefix) == 1) {
                     n=substr(ref, length(prefix) + 1)
                     if (n ~ /^[0-9]+$/) {
-                      if (max == "" || (n + 0) > (max + 0)) { max=n + 0 }
+                      if (max == "" || (n + 0) > (max + 0)) {
+                        max=n + 0
+                      }
                     }
                   }
                 }
-                END { if (max != "") { print max } }')
+                END {
+                  if (max != "") {
+                    print max
+                  }
+                }
+              ')
               if [ -n "$MAX" ]; then
                 START=$((MAX + 1))
               fi
+              echo "Smart-start candidate N=${START}."
+            else
+              echo "git ls-remote failed for ${BASE}-${SUFFIX}; starting at N=0."
             fi
+
             N=$START
             while :; do
               VERSION="${BASE}-${SUFFIX}.${N}"
@@ -142,16 +166,18 @@ jobs:
                 break
               fi
               if [ "$LAST_CREATE_CODE" = "422" ]; then
+                echo "Tag ${VERSION} exists; incrementing N."
                 N=$((N + 1))
                 continue
               fi
               exit 1
             done
           fi
+
+          echo "Reserved version: $VERSION"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "float_tag=$FLOAT" >> "$GITHUB_OUTPUT"
           echo "is_prod=$IS_PROD" >> "$GITHUB_OUTPUT"
-          echo "Reserved version: $VERSION"
 
   publish-docker:
     needs: [validate, reserve-version]
@@ -285,15 +311,10 @@ jobs:
         with:
           script: |
             const version = "${{ needs.reserve-version.outputs.version }}";
-            const baseVersion = version.replace(/-(staging|alpha|beta)\.\d+$/, "");
-            const path = "docs/development/CHANGELOGS/" + baseVersion + ".md";
-            const fs = require("fs");
-            let body;
-            if (fs.existsSync(path)) {
-              body = fs.readFileSync(path, "utf8");
-            } else {
-              body = "Prerelease build; no " + path + " at this commit. Bump version on develop at the start of work and write notes continuously in that file.";
-            }
+            const body =
+              "Prerelease " +
+              version +
+              ". Add or edit release notes on GitHub if needed.";
             const tag = version;
             const owner = context.repo.owner;
             const repo = context.repo.repo;
diff --git a/.github/workflows/vulnerability-scanner.yml b/.github/workflows/vulnerability-scanner.yml
new file mode 100644
index 00000000..95cd00cb
--- /dev/null
+++ b/.github/workflows/vulnerability-scanner.yml
@@ -0,0 +1,347 @@
+name: Vulnerability Scanner
+
+# Scheduled npm audit scan. Release scripts use scripts/lib/check-audit-gate.sh (strict allowlist).
+# See docs/development/NPM-AUDIT-ALLOWLIST.md for allowlist policy and investigation steps.
+
+on:
+  schedule:
+    # Run twice daily at 9 AM and 9 PM UTC
+    - cron: "0 9,21 * * *"
+  workflow_dispatch:
+    # Allow manual triggering anytime
+
+jobs:
+  scan-vulnerabilities:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: "npm"
+
+      - name: Pin npm version
+        run: npm install -g npm@11.13.0
+
+      - name: Install dependencies
+        run: |
+          set -euo pipefail
+          for attempt in 1 2 3 4 5; do
+            if npm ci; then
+              break
+            fi
+            echo "npm ci failed (attempt $attempt/5); retrying in 15s..." >&2
+            sleep 15
+            if [[ "$attempt" -eq 5 ]]; then
+              exit 1
+            fi
+          done
+
+      - name: Run npm audit --omit=dev
+        id: audit
+        continue-on-error: true
+        run: |
+          echo "🔍 Scanning for vulnerabilities..."
+
+          # Run npm audit and save output
+          npm audit --omit=dev --json > audit-output.json || true
+
+          # Check if any vulnerabilities found
+          VULN_COUNT=$(jq '.metadata.vulnerabilities.total // 0' audit-output.json)
+
+          # Always count by severity (for fail threshold: above low)
+          CRITICAL=$(jq '.metadata.vulnerabilities.critical // 0' audit-output.json)
+          HIGH=$(jq '.metadata.vulnerabilities.high // 0' audit-output.json)
+          MODERATE=$(jq '.metadata.vulnerabilities.moderate // 0' audit-output.json)
+          LOW=$(jq '.metadata.vulnerabilities.low // 0' audit-output.json)
+          ABOVE_LOW=$((CRITICAL + HIGH + MODERATE))
+
+          echo "found_vulnerabilities=$VULN_COUNT" >> $GITHUB_OUTPUT
+          echo "above_low_count=$ABOVE_LOW" >> $GITHUB_OUTPUT
+          echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
+          echo "high=$HIGH" >> $GITHUB_OUTPUT
+          echo "moderate=$MODERATE" >> $GITHUB_OUTPUT
+          echo "low=$LOW" >> $GITHUB_OUTPUT
+
+          if [ "$VULN_COUNT" -gt 0 ]; then
+            echo "⚠️  Found $VULN_COUNT total vulnerabilities (fail only if above low: $ABOVE_LOW)"
+            echo "  🔴 Critical: $CRITICAL"
+            echo "  🟠 High: $HIGH"
+            echo "  🟡 Moderate: $MODERATE"
+            echo "  🟢 Low: $LOW"
+          else
+            echo "✅ No vulnerabilities found"
+          fi
+
+      - name: Fail if vulnerabilities above low
+        if: steps.audit.outputs.above_low_count != '0'
+        run: |
+          echo "❌ Failing: ${{ steps.audit.outputs.above_low_count }} vulnerability/vulnerabilities with severity above low (critical/high/moderate)"
+          echo "See docs/development/NPM-AUDIT-ALLOWLIST.md and scripts/lib/check-audit-gate.sh (release gate)."
+          exit 1
+
+      - name: Parse vulnerabilities
+        id: parse
+        if: steps.audit.outputs.found_vulnerabilities != '0'
+        run: |
+          echo "📊 Parsing vulnerability data..."
+
+          # Extract unique advisories (grouped by GHSA/CVE)
+          jq -r '.vulnerabilities | to_entries | .[] |
+            .value.via[] |
+            select(type == "object") |
+            {
+              title: .title,
+              url: .url,
+              severity: .severity,
+              cve: (.cve // []),
+              ghsa: (.source // 0),
+              package_name: .name,
+              range: .range,
+              recommendation: (.fixAvailable // "No fix available")
+            }' audit-output.json | jq -s 'unique_by(.url)' > unique-advisories.json
+
+          # Count unique advisories
+          ADVISORY_COUNT=$(jq '. | length' unique-advisories.json)
+          echo "unique_advisories=$ADVISORY_COUNT" >> $GITHUB_OUTPUT
+          echo "✅ Found $ADVISORY_COUNT unique advisories"
+
+      - name: Check for existing issues and PRs
+        id: check-existing
+        if: steps.audit.outputs.found_vulnerabilities != '0'
+        run: |
+          echo "🔍 Checking for existing issues and Dependabot PRs..."
+
+          # Get all open security issues
+          gh issue list --label "security" --state open --json number,title,body --limit 100 > existing-issues.json
+
+          # Get all open Dependabot PRs
+          gh pr list --author "app/dependabot" --state open --json number,title,url,body --limit 100 > dependabot-prs.json
+
+          echo "✅ Retrieved existing issues and PRs"
+
+      - name: Create issues for new vulnerabilities
+        id: create-issues
+        if: steps.audit.outputs.found_vulnerabilities != '0'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          echo "📝 Processing vulnerabilities..."
+
+          CREATED_COUNT=0
+          SKIPPED_COUNT=0
+          ISSUES_CREATED=""
+
+          # Read each unique advisory
+          jq -c '.[]' unique-advisories.json | while read -r advisory; do
+            TITLE=$(echo "$advisory" | jq -r '.title')
+            URL=$(echo "$advisory" | jq -r '.url')
+            SEVERITY=$(echo "$advisory" | jq -r '.severity')
+            CVE=$(echo "$advisory" | jq -r '.cve[]? // empty' | head -1)
+            GHSA=$(echo "$advisory" | jq -r '.ghsa')
+            PACKAGE=$(echo "$advisory" | jq -r '.package_name')
+            RANGE=$(echo "$advisory" | jq -r '.range')
+
+            # Extract GHSA ID from URL if not in data
+            if [ -z "$GHSA" ] || [ "$GHSA" = "0" ]; then
+              GHSA=$(echo "$URL" | grep -oE 'GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}' || echo "")
+            fi
+
+            # Check if issue already exists (search for GHSA or CVE in existing issues)
+            SEARCH_TERM="$GHSA"
+            if [ -z "$GHSA" ] && [ -n "$CVE" ]; then
+              SEARCH_TERM="$CVE"
+            fi
+
+            if [ -n "$SEARCH_TERM" ]; then
+              EXISTS=$(jq --arg term "$SEARCH_TERM" '[.[] | select(.title | contains($term) or (.body | contains($term)))] | length' existing-issues.json)
+
+              if [ "$EXISTS" -gt 0 ]; then
+                echo "⏭️  Skipping: Issue already exists for $SEARCH_TERM"
+                SKIPPED_COUNT=$((SKIPPED_COUNT + 1))
+                continue
+              fi
+            fi
+
+            # Check if Dependabot already created a PR for this vulnerability
+            DEPENDABOT_PR=""
+            if [ -n "$PACKAGE" ]; then
+              DEPENDABOT_PR=$(jq -r --arg pkg "$PACKAGE" '[.[] | select(.title | contains($pkg))] | .[0].url // empty' dependabot-prs.json)
+            fi
+
+            # Format severity with emoji
+            case "$SEVERITY" in
+              critical)
+                SEVERITY_EMOJI="🔴"
+                PRIORITY_LABEL="priority:critical"
+                ;;
+              high)
+                SEVERITY_EMOJI="🟠"
+                PRIORITY_LABEL="priority:high"
+                ;;
+              moderate)
+                SEVERITY_EMOJI="🟡"
+                PRIORITY_LABEL="priority:medium"
+                ;;
+              low)
+                SEVERITY_EMOJI="🟢"
+                PRIORITY_LABEL="priority:low"
+                ;;
+              *)
+                SEVERITY_EMOJI="⚪"
+                PRIORITY_LABEL=""
+                ;;
+            esac
+
+            # Build issue body - use printf to avoid YAML parsing issues with markdown
+            printf -v BODY '%s' \
+              "## Security Vulnerability" $'\n\n' \
+              "**Severity**: ${SEVERITY_EMOJI} ${SEVERITY}" $'\n' \
+              "**Package**: \`${PACKAGE}\`" $'\n' \
+              "**Affected Versions**: ${RANGE}" $'\n'
+
+            if [ -n "$CVE" ]; then
+              printf -v BODY '%s' "$BODY" "**CVE**: ${CVE}" $'\n'
+            fi
+
+            if [ -n "$GHSA" ]; then
+              printf -v BODY '%s' "$BODY" "**GHSA**: ${GHSA}" $'\n'
+            fi
+
+            printf -v BODY '%s' "$BODY" $'\n' \
+              "### Description" $'\n' \
+              "${TITLE}" $'\n\n' \
+              "### References" $'\n' \
+              "- [GitHub Advisory](${URL})" $'\n'
+
+            if [ -n "$CVE" ]; then
+              printf -v BODY '%s' "$BODY" "- [CVE Details](https://nvd.nist.gov/vuln/detail/${CVE})" $'\n'
+            fi
+
+            if [ -n "$DEPENDABOT_PR" ]; then
+              printf -v BODY '%s' "$BODY" $'\n' \
+                "### Dependabot PR" $'\n' \
+                "Dependabot has already created a PR to fix this vulnerability:" $'\n' \
+                "- ${DEPENDABOT_PR}" $'\n\n' \
+                "Review and merge the PR to resolve this issue." $'\n'
+            fi
+
+            printf -v BODY '%s' "$BODY" $'\n' \
+              "### Action Required" $'\n' \
+              "- [ ] Review vulnerability details" $'\n' \
+              "- [ ] "
+
+            if [ -n "$DEPENDABOT_PR" ]; then
+              printf -v BODY '%s' "$BODY" "Review and merge Dependabot PR"
+            else
+              printf -v BODY '%s' "$BODY" "Update \`${PACKAGE}\` to a patched version"
+            fi
+
+            printf -v BODY '%s' "$BODY" $'\n' \
+              "- [ ] Test changes" $'\n' \
+              "- [ ] Deploy fix" $'\n\n' \
+              "---" $'\n' \
+              "*Automatically created by vulnerability scanner*"
+
+            # Build issue title
+            if [ -n "$CVE" ]; then
+              ISSUE_TITLE="Security: ${CVE} - ${SEVERITY} severity in ${PACKAGE}"
+            elif [ -n "$GHSA" ]; then
+              ISSUE_TITLE="Security: ${GHSA} - ${SEVERITY} severity in ${PACKAGE}"
+            else
+              ISSUE_TITLE="Security: ${SEVERITY} severity in ${PACKAGE}"
+            fi
+
+            # Build labels
+            LABELS="security,dependencies"
+            if [ -n "$PRIORITY_LABEL" ]; then
+              LABELS="${LABELS},${PRIORITY_LABEL}"
+            fi
+
+            echo "📝 Creating issue: $ISSUE_TITLE"
+
+            # Create issue
+            ISSUE_URL=$(gh issue create \
+              --title "$ISSUE_TITLE" \
+              --body "$BODY" \
+              --label "$LABELS" \
+              --json url --jq '.url')
+
+            CREATED_COUNT=$((CREATED_COUNT + 1))
+            ISSUES_CREATED="${ISSUES_CREATED}${ISSUE_URL}"$'\n'
+
+            echo "✅ Created: $ISSUE_URL"
+
+            # Rate limit protection - wait 2 seconds between issue creations
+            sleep 2
+          done
+
+          echo "created_count=$CREATED_COUNT" >> $GITHUB_OUTPUT
+          echo "skipped_count=$SKIPPED_COUNT" >> $GITHUB_OUTPUT
+          echo "issues_created<<EOF" >> $GITHUB_OUTPUT
+          echo "$ISSUES_CREATED" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "# 🛡️ Vulnerability Scanner Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ "${{ steps.audit.outputs.found_vulnerabilities }}" == "0" ]; then
+            echo "✅ **No vulnerabilities found!**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "All dependencies are secure." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "## Vulnerabilities Found" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY
+            echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
+            echo "| 🔴 Critical | ${{ steps.audit.outputs.critical }} |" >> $GITHUB_STEP_SUMMARY
+            echo "| 🟠 High | ${{ steps.audit.outputs.high }} |" >> $GITHUB_STEP_SUMMARY
+            echo "| 🟡 Moderate | ${{ steps.audit.outputs.moderate }} |" >> $GITHUB_STEP_SUMMARY
+            echo "| 🟢 Low | ${{ steps.audit.outputs.low }} |" >> $GITHUB_STEP_SUMMARY
+            echo "| **Total** | **${{ steps.audit.outputs.found_vulnerabilities }}** |" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+
+            if [ -n "${{ steps.parse.outputs.unique_advisories }}" ]; then
+              echo "**Unique advisories**: ${{ steps.parse.outputs.unique_advisories }}" >> $GITHUB_STEP_SUMMARY
+              echo "" >> $GITHUB_STEP_SUMMARY
+            fi
+
+            if [ -n "${{ steps.create-issues.outputs.created_count }}" ]; then
+              echo "## Issues Created" >> $GITHUB_STEP_SUMMARY
+              echo "" >> $GITHUB_STEP_SUMMARY
+              echo "✅ **Created**: ${{ steps.create-issues.outputs.created_count }} new security issues" >> $GITHUB_STEP_SUMMARY
+
+              if [ "${{ steps.create-issues.outputs.skipped_count }}" != "0" ]; then
+                echo "⏭️  **Skipped**: ${{ steps.create-issues.outputs.skipped_count }} (already tracked)" >> $GITHUB_STEP_SUMMARY
+              fi
+
+              if [ -n "${{ steps.create-issues.outputs.issues_created }}" ]; then
+                echo "" >> $GITHUB_STEP_SUMMARY
+                echo "### New Issues" >> $GITHUB_STEP_SUMMARY
+                echo "" >> $GITHUB_STEP_SUMMARY
+                echo "${{ steps.create-issues.outputs.issues_created }}" | while read -r url; do
+                  if [ -n "$url" ]; then
+                    echo "- $url" >> $GITHUB_STEP_SUMMARY
+                  fi
+                done
+              fi
+            fi
+
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "## Next Steps" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "1. Review the created issues in the [Issues tab](https://github.com/${{ github.repository }}/issues?q=is%3Aissue+is%3Aopen+label%3Asecurity)" >> $GITHUB_STEP_SUMMARY
+            echo "2. Check for Dependabot PRs that may already fix some vulnerabilities" >> $GITHUB_STEP_SUMMARY
+            echo "3. Prioritize critical and high severity vulnerabilities" >> $GITHUB_STEP_SUMMARY
+            echo "4. Update affected packages and test changes" >> $GITHUB_STEP_SUMMARY
+            echo "5. Release allowlist policy: [NPM-AUDIT-ALLOWLIST.md](docs/development/NPM-AUDIT-ALLOWLIST.md) (strict mode in bump-version / promote scripts)" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "---" >> $GITHUB_STEP_SUMMARY
+          echo "*Scan completed at $(date -u '+%Y-%m-%d %H:%M:%S UTC')*" >> $GITHUB_STEP_SUMMARY
diff --git a/.gitignore b/.gitignore
index 6db503ee..ac9818ef 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,20 +24,3 @@ temp/
 apps/web/i18n/compiled/
 apps/management-web/i18n/compiled/
 
-# LLM / editor: see docs/development/llm/DOCS-DEVELOPMENT-LLM.md. Canonical: .llm/exports/<id>/.gitkeep, allowed-targets.mjs
-/.llm/local/vendors.json
-# Machine-generated under each target (CI on develop writes with git add -f; do not hand-commit):
-# allowlisted ids — scripts/llm/allowed-targets.mjs (ALLOWED_TARGET_IDS)
-/.llm/exports/github-copilot/skills/
-/.llm/exports/github-copilot/instructions/
-/.llm/exports/github-copilot/copilot-instructions.md
-/.llm/exports/opencode/skills/
-/.llm/exports/opencode/instructions/
-/.llm/exports/opencode/opencode-instructions.md
-# .copilot/
-# .github/copilot-instructions.md.local
-# --- other local editors (not necessarily in the allowlist) ---
-# .windsurf/
-# .aider*
-# .cline/
-
diff --git a/.llm/LLM.md b/.llm/LLM.md
index f6a389a1..4d49dbfd 100644
--- a/.llm/LLM.md
+++ b/.llm/LLM.md
@@ -1,59 +1,82 @@
-# LLM Development History
+# `.llm/` directory
 
-## Overview
+**Planning workspace** for this repo — feature plans, optional history, human templates, and reference context.
 
-This directory tracks LLM-assisted development on the Metaboost project. It provides:
+**Not abcmemory.** Standing agent guidance (what Cursor loads every session) lives **only** under [`.cursor/`](/.cursor/skills/abcmemory/SKILL.md) plus `.cursorrules` and `.cursorignore`. When you say **abcremember**, agents write to `.cursor/`, not here, unless you explicitly ask otherwise.
 
-- A record of what was built and why
-- Context for future LLM sessions
-- Documentation of decisions
+## Directory index — `.llm/` (planning workspace)
 
-## Directory Structure
+| Path | Operator doc |
+| --- | --- |
+| `.llm/context/` | [LLM-CONTEXT.md](context/LLM-CONTEXT.md) |
+| `.llm/history/active/` | [LLM-HISTORY-ACTIVE.md](history/active/LLM-HISTORY-ACTIVE.md) |
+| `.llm/history/completed/` | [LLM-HISTORY-COMPLETED.md](history/completed/LLM-HISTORY-COMPLETED.md) |
+| `.llm/plans/active/` | [LLM-PLANS-ACTIVE.md](plans/active/LLM-PLANS-ACTIVE.md) |
+| `.llm/plans/completed/` | [LLM-PLANS-COMPLETED.md](plans/completed/LLM-PLANS-COMPLETED.md) |
+| `.llm/templates/` | [LLM-TEMPLATES.md](templates/LLM-TEMPLATES.md) |
+
+## Directory index — abcmemory (`.cursor/`)
+
+| Path | Operator doc |
+| --- | --- |
+| `.cursor/skills/` | [CURSOR-SKILLS.md](/.cursor/skills/CURSOR-SKILLS.md) |
+| `.cursor/rules/` | [CURSOR-RULES.md](/.cursor/rules/CURSOR-RULES.md) |
+| `.cursor/prompts/` | [CURSOR-PROMPTS.md](/.cursor/prompts/CURSOR-PROMPTS.md) |
+| `.cursor/hooks/` | [CURSOR-HOOKS.md](/.cursor/hooks/CURSOR-HOOKS.md) |
+
+Vocabulary: **abcmemory** / **abcremember** — [abcmemory skill](/.cursor/skills/abcmemory/SKILL.md).
+
+## Layout
 
 ```
 .llm/
-├── LLM.md
+├── LLM.md                 # This file
+├── context/               # Codebase summaries for contributors (e.g. architecture)
 ├── history/
-│   ├── active/            # Features in progress
-│   │   └── [feature]/
-│   │       └── [feature]-part-01.md
-│   └── completed/         # Archived by month (optional)
-│       └── YYYY-MM/
+│   ├── active/            # Optional per-feature folders if your team records notes here
+│   └── completed/         # Archived by automation or manually (see below)
 ├── plans/
 │   ├── active/
 │   └── completed/
-├── context/               # Optional codebase summaries
-└── templates/
-    └── prompt-template.md
+└── templates/             # Human templates for plans/history (not abcmemory)
 ```
 
-## When to Update History
+Empty layout directories may contain a `.gitkeep` so git tracks the folder after clone.
 
-Update history when modifying code, config, docs, or plans. Skip for pure Q&A with no file changes.
+## abcmemory vs `.llm/` (do not merge)
 
-## History Entry Format
+| Question | Answer |
+| --- | --- |
+| Where is abcmemory? | **Only** `.cursor/` + `.cursorrules` + `.cursorignore` |
+| What is `.llm/`? | Planning workspace — not loaded as standing agent rules |
+| **abcremember** default target? | `.cursor/` only |
+| Agent prompt snippets? | `.cursor/prompts/` (abcmemory), not `.llm/templates/` |
+| Human copy-paste blanks? | `.llm/templates/` |
+| Active feature plans? | `.llm/plans/active/<name>/` |
+| `.llm/exports/`? | **Do not create.** Multi-editor mirrors are prohibited; use `.cursor/` only |
 
-```markdown
-### Session N - YYYY-MM-DD
+## Plans
 
-#### Prompt (Developer|Agent)
+Active work lives under `.llm/plans/active/`; completed sets move to `.llm/plans/completed/`. See
+`.cursor/skills/plan-files-convention/SKILL.md`, **plan-execution-completion-tracking** rule, and
+**plan-creation** rule for the 300-line plan limit and COPY-PASTA completion tracking. (Podverse
+also documents a **plan-completion** skill; Metaboost encodes the same lifecycle in the rule above.)
 
-[Exact verbatim prompt]
+**Import specifiers (Tier A vs Next `src`):** see [docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md](/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md).
 
-#### Key Decisions
-
-- Decision 1
-
-#### Files Modified
-
-- path/to/file.ts
-```
+## Optional history notes
 
-- **Prompt (Developer)** – Manually typed by user
-- **Prompt (Agent)** – System-generated (e.g. Build on a plan)
+Some teams keep markdown notes under `.llm/history/active/<feature>/`. That is **optional** and not required for contributing.
 
-## 10-Session Limit
+A retired description of an older session-logging workflow (for humans only) lives in
+`docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md`. That path is listed in `.cursorignore`
+so Cursor does not treat it as agent instructions.
 
-Each history file has at most **10 sessions**. When adding session 11, create a new part file (e.g. `[feature]-part-02.md`) and continue numbering sessions there. Always start with `-part-01` for the first file.
+### Completing features (GitHub Actions)
 
-See **.cursor/skills/llm-history/SKILL.md** for full guidelines.
+When a PR merges to `develop`, `.github/workflows/complete-feature.yml` may detect a matching
+folder under `.llm/history/active/<feature-name>/` (derived from the branch name), set completion
+metadata, move it under `.llm/history/completed/YYYY-MM/`, and push. Requires GitHub App secrets
+(`APP_ID`, `APP_PRIVATE_KEY`) — see [GITHUB-SETUP.md](/docs/repo-management/GITHUB-SETUP.md). If no
+folder exists, the job no-ops. Plan-set moves under `.llm/plans/` remain manual per
+**plan-execution-completion-tracking** rule.
diff --git a/.llm/exports/opencode/.gitkeep b/.llm/context/.gitkeep
similarity index 100%
rename from .llm/exports/opencode/.gitkeep
rename to .llm/context/.gitkeep
diff --git a/.llm/context/LLM-CONTEXT.md b/.llm/context/LLM-CONTEXT.md
new file mode 100644
index 00000000..dab2c2c2
--- /dev/null
+++ b/.llm/context/LLM-CONTEXT.md
@@ -0,0 +1,10 @@
+# `.llm/context/`
+
+Shared codebase summaries for contributors (for example architecture and conventions). Reference material — not standing agent rules.
+
+- [`architecture.md`](architecture.md) holds the full tier table; the always-applied rule `.cursor/rules/architecture-tier-dependencies.mdc` states the dependency constraint for agents.
+- [`conventions.md`](conventions.md) summarizes TypeScript, import, and plan conventions; see [AGENTS.md](/AGENTS.md) for full detail.
+- When a summary encodes a standing constraint agents must follow, add or extend an always-applied `.cursor/rules/*.mdc` and link here for the full table or narrative.
+- Put durable, repo-wide context here when it helps people orient quickly.
+- Do not duplicate content that belongs in skills, rules, or `docs/`.
+- See [LLM.md](/.llm/LLM.md).
diff --git a/.llm/context/architecture.md b/.llm/context/architecture.md
new file mode 100644
index 00000000..ca16e12b
--- /dev/null
+++ b/.llm/context/architecture.md
@@ -0,0 +1,83 @@
+# Metaboost Architecture
+
+## Module Dependency Order
+
+| Tier | Packages | Depends On |
+| ---- | -------- | ---------- |
+| 1 | helpers, helpers-currency, rss-parser, metaboost-signing | (none / external only) |
+| 2 | helpers-backend-api, helpers-valkey, helpers-i18n, helpers-requests | helpers |
+| 3 | orm, management-orm | helpers (+ helpers-requests for orm) |
+| 4 | ui | helpers |
+| 5 | api, management-api, web, management-web, web-sidecar, management-web-sidecar | various packages above |
+
+## Directory Structure
+
+- `packages/` — Publishable npm packages (`@metaboost/*`, `metaboost-signing`)
+- `apps/` — Deployable applications (api, management-api, web, management-web, sidecars under `apps/*/sidecar/`)
+- `tools/` — Development tools (e.g. `generate-data`)
+- `infra/` — Docker, env templates, K8s manifests, database linear migrations
+
+## Technologies
+
+- Node.js 24+, TypeScript (strict), npm workspaces
+- Next.js, Express, PostgreSQL, TypeORM
+
+## App Descriptions
+
+### apps/api
+
+Express HTTP API for the main app. Routes in `apps/api/src/routes/`. Joi schemas in `apps/api/src/schemas/`.
+
+### apps/management-api
+
+Admin API for management identities, permissions, and events. Separate from main API for security isolation.
+
+### apps/web
+
+Next.js app. Fetches runtime config from `apps/web/sidecar/` when `RUNTIME_CONFIG_URL` is set. Internationalized via `next-intl`.
+
+### apps/management-web
+
+Admin dashboard (Next.js). Uses `@metaboost/ui` and runtime config from its sidecar.
+
+## Common Code Patterns
+
+### Service Pattern
+
+Business logic in `*Service` classes with static methods under `packages/orm/src/services/` and `packages/management-orm/src/services/`.
+
+### Validation Pattern
+
+Joi schemas live in `apps/api/src/schemas/` and `apps/management-api/src/schemas/` only — not in controllers or routes.
+
+### HTTP from apps
+
+Use `@metaboost/helpers-requests` (`req...` pattern); do not use raw `fetch()` in app code.
+
+## Where to Find X
+
+| Looking for... | Location |
+| -------------- | -------- |
+| API routes | `apps/api/src/routes/` |
+| Management API routes | `apps/management-api/src/routes/` |
+| Database entities (app) | `packages/orm/src/entities/` |
+| Database entities (management) | `packages/management-orm/src/entities/` |
+| Database services | `packages/orm/src/services/`, `packages/management-orm/src/services/` |
+| Shared helpers | `packages/helpers/src/` |
+| Web pages | `apps/web/src/app/` |
+| Management pages | `apps/management-web/src/app/` |
+| Shared UI | `packages/ui/src/components/` |
+| Environment templates | `infra/config/env-templates/`, `apps/*/.env.example` |
+| Linear SQL migrations | `infra/k8s/base/ops/source/database/linear-migrations/` |
+| K8s manifests | `infra/k8s/` |
+
+## Build Order
+
+From repo root:
+
+```bash
+npm run build:packages
+npm run build:apps
+```
+
+See root `package.json` `build:packages` for the canonical package build sequence.
diff --git a/.llm/context/conventions.md b/.llm/context/conventions.md
new file mode 100644
index 00000000..7a5d1bd8
--- /dev/null
+++ b/.llm/context/conventions.md
@@ -0,0 +1,121 @@
+# Metaboost Conventions
+
+Reference summary for contributors. Full detail: [AGENTS.md](/AGENTS.md).
+
+## TypeScript
+
+- Strict mode, no `any` types
+- DTOs and shared types from `@metaboost/helpers` where applicable
+- Prefer named exports; avoid `export default` except framework-required defaults (e.g. Next.js `page.tsx`)
+
+## Naming
+
+- Files: kebab-case
+- Classes: PascalCase
+- Functions: camelCase
+- Constants: SCREAMING_SNAKE_CASE
+
+## Style
+
+- Semicolons required, single quotes, 2-space indent
+- Strict equality (`===` / `!==` only)
+- Type-only imports on a separate line: `import type { X } from '...'`
+
+## Import order
+
+Organize imports in this order, separated by blank lines:
+
+1. Node built-ins (`fs`, `path`, etc.)
+2. External packages (`express`, `typeorm`, etc.)
+3. Workspace packages (`@metaboost/helpers`, `@metaboost/orm`, etc.)
+4. Relative imports (local files)
+5. Style imports (SCSS/CSS) last in components/pages
+
+```typescript
+import path from 'path';
+
+import express from 'express';
+import { DataSource } from 'typeorm';
+
+import { logger } from '@metaboost/helpers';
+import { User } from '@metaboost/orm';
+
+import { config } from './config';
+```
+
+Enforced by ESLint; fix with `npm run lint:fix`.
+
+## Import specifiers
+
+- **Tier A** (packages except `ui`, APIs, sidecars, tools): NodeNext **`.js`** relative specifiers
+- **Tier B** (`apps/web/src`, `apps/management-web/src`): **extensionless** relative imports for bundler/Turbopack
+
+See [docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md](/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md).
+
+## Database
+
+- Table and column names: snake_case
+- TypeORM `orderBy`: entity property names (camelCase), not column names
+
+## Git
+
+- Present tense commits
+- Include issue refs when applicable
+- Branches: `feature/`, `fix/`, `chore/`, `docs/`, `hotfix/`, `release/`, `llm/` (see [DOCS-DEVELOPMENT-LLM.md](/docs/development/llm/DOCS-DEVELOPMENT-LLM.md) for `llm/` scope)
+
+## GitHub Issues
+
+**Templates**: Use appropriate templates for different work types when available.
+
+**Labels**: See [docs/repo-management/GITHUB-LABELS.md](/docs/repo-management/GITHUB-LABELS.md) for the complete reference.
+
+## Error handling
+
+### API errors
+
+- Use typed errors or shared helpers for known error types
+- Return appropriate HTTP status codes
+- Log unexpected errors with context; do not log expected auth failures as errors
+
+```typescript
+try {
+  const result = await someOperation();
+  return result;
+} catch (error) {
+  logger.error('someOperation failed', { error, context });
+  throw error;
+}
+```
+
+### Service errors
+
+- Let errors propagate to callers
+- Add context when rethrowing
+
+## Logging
+
+Use the centralized logger from `@metaboost/helpers`:
+
+```typescript
+import { logger } from '@metaboost/helpers';
+
+logger.info('Processing request', { userId });
+logger.warn('Retrying request', { attempt, maxAttempts });
+logger.error('Operation failed', { error, context });
+```
+
+- Include relevant context objects
+- Do not log sensitive data (passwords, tokens)
+- Empty `LOG_DIR` means console-only logging
+
+## Environment variables
+
+- Use SCREAMING_SNAKE_CASE; prefix by domain when helpful (`DB_`, `KEYVALDB_`, `API_`)
+- Canonical templates: `apps/*/.env.example`, `infra/config/env-templates/`
+- Config modules must not hide missing env with defaults — validation fails fast at startup (see [AGENTS.md](/AGENTS.md))
+
+## Plans
+
+- Active plans: `.llm/plans/active/<name>/`
+- Keep each plan file under 300 lines
+- See **plan-files-convention** skill and **plan-execution-completion-tracking** rule
diff --git a/.llm/exports/LLM-EXPORTS.md b/.llm/exports/LLM-EXPORTS.md
deleted file mode 100644
index 51226b90..00000000
--- a/.llm/exports/LLM-EXPORTS.md
+++ /dev/null
@@ -1,36 +0,0 @@
-# Machine-generated LLM editor exports
-
-**Do not hand-edit** files under `.llm/exports/<target-id>/`. They are produced from the repository’s **source of truth**:
-
-- `.cursor/skills/**`
-- `.cursor/rules/**`
-- `.cursorrules`
-
-## How exports are updated
-
-- **Authoritative for humans and PRs:** commit only [`.cursor/*`](../../.cursor) and [`.cursorrules`](../../.cursorrules) when changing guidance. Do **not** hand-commit generated paths (`skills/`, `instructions/`, `copilot-instructions.md` under each target). Those paths are **listed in [`.gitignore`](../../.gitignore)**; Cursor also lists **`.llm/exports/github-copilot/`** in [`.cursorignore`](../../.cursorignore) so local tools do not treat the mirror as editable.
-- **CI (only writer of generated files):** The [`.github` workflow `llm-exports-sync`](../../.github/workflows/llm-exports-sync.yml), triggered by `.cursor`, `.cursorrules`, or `scripts/llm/` changes on **`develop`** (or `workflow_dispatch`), runs `npm run llm:exports:sync`, updates branch **`llm`**, and creates or updates a single PR from **`llm`** to **`develop`**. You can run the same `sync` locally to inspect; do not `git add` the generated content unless you set `ALLOW_DERIVED_EXPORT_EDIT=1` (rare) and you know the policy.
-- **PR behavior:** Humans should not commit generated export trees directly. The automation owns generated file updates through the rolling **`llm` -> `develop`** PR.
-
-## Naming convention
-
-- **Default (new targets):** Use a **stable, kebab-case** `<target-id>` in [`scripts/llm/allowed-targets.mjs`](../../scripts/llm/allowed-targets.mjs) that names the editor or integration. When you add an adapter, shape **`.llm/exports/<target-id>/`** so its **inner** tree matches the **on-disk layout that tool’s docs describe** (so people can `cp -R` or symlink with minimal custom steps). The target folder name and contents should look like the editor’s project-local convention when there is a single obvious root to copy.
-- **Exception — `github-copilot`:** Git / VS Code / Copilot project instructions and related files live under the repository **`.github/`** directory (GitHub’s conventional path) — not under a top-level directory literally named `github-copilot` at the project root. In this repo we place the **generated** Copilot-shaped output under **`.llm/exports/github-copilot/`** with a flat shape: `skills/`, `instructions/`, and `copilot-instructions.md` at the top of that tree. **To use it with a workflow that reads `.github/`**, merge these **contents** into your project’s **`.github/`** (e.g. copy `skills` and `instructions` into place and add `copilot-instructions.md` beside them). This repository does not commit that duplicate under `.github/`; keep CI, workflows, and other `.github` files separate and avoid blindly overwriting the whole directory.
-
-## Registering a new export target (max 10)
-
-1. Add **`.llm/exports/<target-id>/.gitkeep`** (or `.export-target`) so Git tracks the directory.
-2. Add `<target-id>` to the allowlist in [`scripts/llm/allowed-targets.mjs`](../../scripts/llm/allowed-targets.mjs).
-3. Implement the adapter in [`scripts/llm/export-from-cursor.mjs`](../../scripts/llm/export-from-cursor.mjs) (and supporting modules under `scripts/llm/lib/` if needed).
-
-Unknown directory names without an allowlist entry **fail CI**.
-
-## Using GitHub Copilot–shaped output
-
-**Map** the generated files from `.llm/exports/github-copilot/` into the project’s **`.github/`** as needed for your local Copilot setup; see the naming section above. More context: [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](../../docs/development/llm/DOCS-DEVELOPMENT-LLM.md).
-
-## `.state`
-
-[`.state/`](.state/) is reserved for future incremental-export metadata. Do not treat it as an export target.
-
-Local vendor setup is opt-in via `npm run llm:vendors` (default active vendor: `cursor`).
diff --git a/.llm/exports/github-copilot/copilot-instructions.md b/.llm/exports/github-copilot/copilot-instructions.md
deleted file mode 100644
index 6eb95f17..00000000
--- a/.llm/exports/github-copilot/copilot-instructions.md
+++ /dev/null
@@ -1,76 +0,0 @@
-<!-- Generated from .cursorrules — do not edit this file. Source: .cursorrules -->
-<!-- Re-run: npm run llm:exports:sync (see docs/development/llm/) -->
-
-# Metaboost Repo Rules
-
-## Stack
-
-- Node.js 24+, TypeScript strict, npm workspaces
-
-## Code Quality
-
-- No `any` types
-- **Strict equality**: Use `===` and `!==` only (no `==` or `!=`).
-- **Avoid type assertions (`as`)**: Prefer proper types, optional chaining, type guards, or narrowing.
-- **Named exports**: Prefer named `export` in TypeScript modules; avoid `export default` when a named export works. Framework-required defaults (e.g. Next.js `page.tsx`) are the exception. See `.llm/exports/github-copilot/skills/prefer-named-exports/SKILL.md`.
-
-## Formatting
-
-- **JavaScript/TypeScript/JSON/CSS**: Single quotes, semicolons, 2-space indent.
-- Run `npm run lint:fix` or `npm run prettier:write` to auto-fix.
-
----
-
-## LLM WORKFLOW
-
-### Context Gathering
-
-For substantial requests, ask: "What's the goal?" / "GitHub issue?"
-
-### Scope Management
-
-Warn if drifting: "This seems outside scope. Continue?"
-
-### Agent/plan work: do not run tests
-
-- **Do not run** test or verification commands (e.g. `make e2e_test_web`, `npm run test`) during agent or plan implementation.
-- **Only instruct the user** to run those commands after your work is done; provide the exact command(s) in a fenced `bash` block. See **response-ending-make-verify** skill for which commands to suggest.
-- **E2E verification commands:** Always give commands that **skip API tests** by default (do not add `E2E_API_GATE_MODE=on`). Only add `E2E_API_GATE_MODE=on` when the change affected API or integration tests. The Makefile default is `E2E_API_GATE_MODE=off`.
-
----
-
-## HISTORY TRACKING (Essential)
-
-**Applies to every file-modifying response in this repo** — no exception for path or task size. When in doubt, update history.
-
-Before work: Check/create `.llm/history/active/[feature]/[feature]-part-01.md`
-
-After changes, update with:
-
-- Session date, user prompt (EXACT text), decisions, files
-
-### Prompt Recording (CRITICAL)
-
-**Always use the user's EXACT, FULL prompt text.** Never summarize or paraphrase.
-
-- **`#### Prompt (Developer)`** — Manually typed by the user
-- **`#### Prompt (Agent)`** — System-generated (e.g., clicking "Build" on a plan)
-
-### Real-Time Capture
-
-**If a response will modify files, log the prompt FIRST.**
-
-- **Start of response**: Log prompt to `.llm/history/active/[feature]/[file].md`
-- **End of response**: Update with files changed and key decisions
-
-Skip logging for pure Q&A or explanations that don't change files.
-
-End file-modifying responses with: **LLM History**: Updated `.llm/history/active/[feature]/[file].md`
-
----
-
-## PLAN MANAGEMENT
-
-**Plans must be under 300 lines.** Plans live in `.llm/plans/active/` (not `.cursor/plans/`).
-
-If over 300: STOP, split into sub-plans, save in `.llm/plans/active/`, then work sequentially.
diff --git a/.llm/exports/github-copilot/instructions/api-no-pii-credentials-in-responses.instructions.md b/.llm/exports/github-copilot/instructions/api-no-pii-credentials-in-responses.instructions.md
deleted file mode 100644
index 585a1b83..00000000
--- a/.llm/exports/github-copilot/instructions/api-no-pii-credentials-in-responses.instructions.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-description: "API responses must never expose credentials or serialize req.user/req.managementUser directly. Use safe toJson helpers only."
-applyTo: "**"
----
-
-# No PII/Credentials in API Responses
-
-When adding or changing code that sends user or admin data in API responses:
-
-## Do
-
-- **Main API (apps/api):** Use `userToJson(user)` for the **authenticated user only** (login, me, signup, refresh, confirm-email-change, update-profile). Use `userToPublicSummary(user)` for any **other** user (e.g. bucket admins list/detail) so email is never returned for other users while username/displayName are available for identity in UI lists/details. See [apps/api/src/lib/userToJson.ts](apps/api/src/lib/userToJson.ts).
-- **Management API (apps/management-api):** Use `managementUserToJson(admin)` for every response that includes a management user. Use `userToJson(user)` in usersController for main-app user data. See [apps/management-api/src/lib/managementUserToJson.ts](apps/management-api/src/lib/managementUserToJson.ts).
-- Never include `passwordHash`, `credentials`, or any credential field in response bodies.
-
-## Don't
-
-- Never pass `req.user` or `req.managementUser` (or any entity that has `.credentials`) to `res.json()` or into response payloads. Always serialize through the safe helpers above.
-- Never return email for *another* user from the main API; use `userToPublicSummary` for other users.
-
-## Reference
-
-- AGENTS.md § Auth and PII
-- apps/management-api/src/CREDENTIALS-PROTECTION.md
diff --git a/.llm/exports/github-copilot/instructions/avoid-type-assertions.instructions.md b/.llm/exports/github-copilot/instructions/avoid-type-assertions.instructions.md
deleted file mode 100644
index 909d5084..00000000
--- a/.llm/exports/github-copilot/instructions/avoid-type-assertions.instructions.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-description: "Avoid type assertions (as) when a better approach exists; prefer types, narrowing, type guards."
-applyTo:
-  - "**/*.ts"
-  - "**/*.tsx"
----
-
-# Avoid Type Assertions
-
-Avoid `as` (type assertions) when there is a better way. Prefer: better types, optional chaining, type guards, or narrowing. Allowed: import aliases, `as const`, and rare documented escape hatches.
diff --git a/.llm/exports/github-copilot/instructions/commands-from-metaboost-root.instructions.md b/.llm/exports/github-copilot/instructions/commands-from-metaboost-root.instructions.md
deleted file mode 100644
index 5e45c2e6..00000000
--- a/.llm/exports/github-copilot/instructions/commands-from-metaboost-root.instructions.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-description: "Always provide runnable commands from Metaboost repo root."
-applyTo: "**"
----
-
-# Commands From Metaboost Root
-
-Always provide runnable terminal commands relative to the Metaboost repository root.
-
-## Do
-
-- Use root-invoked workspace commands (for example `npm run <script> -w @metaboost/<workspace> -- [args]`).
-- For E2E commands, use `make` targets from repo root so dependencies and seed steps are handled.
-- Use `SPEC`/`WEB_SPEC`/`MGMT_SPEC` for one spec or comma-delimited spec lists.
-- Put runnable commands in fenced `bash` blocks so the editor shows copy buttons.
-
-## Don't
-
-- Do not instruct users to `cd apps/api`, `cd apps/web`, or `cd apps/management-web` before running commands.
-- Do not provide commands that only work from subdirectories unless explicitly requested.
-- Do not suggest direct Playwright invocation (`npx playwright test`, `npm run test:e2e ...`) for Metaboost E2E runs.
-
-## Example
-
-```bash
-make e2e_test_management_web_report_spec SPEC=e2e/dashboard-super-admin-full-crud.spec.ts
-make e2e_test_management_web_report_spec SPEC=e2e/dashboard-super-admin-full-crud.spec.ts,e2e/login-super-admin-full-crud.spec.ts
-```
diff --git a/.llm/exports/github-copilot/instructions/e2e-run-with-make-only.instructions.md b/.llm/exports/github-copilot/instructions/e2e-run-with-make-only.instructions.md
deleted file mode 100644
index 05e96c08..00000000
--- a/.llm/exports/github-copilot/instructions/e2e-run-with-make-only.instructions.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-description: "Run Metaboost E2E via make targets only."
-applyTo: "**"
----
-
-# E2E Commands Must Use Make
-
-For Metaboost E2E verification commands, always use `make` targets from repo root.
-
-## Required
-
-- Use `make e2e_test_web_report_spec SPEC=...` for web specs.
-- Use `make e2e_test_management_web_report_spec SPEC=...` for management-web specs.
-- Use `make e2e_test_report_scoped WEB_SPEC=... MGMT_SPEC=...` for cross-app scoped runs.
-- `SPEC`, `WEB_SPEC`, and `MGMT_SPEC` may be a single path or comma-delimited list.
-
-## Prohibited
-
-- Do not suggest direct Playwright commands (`npx playwright test ...`) for normal verification.
-- Do not suggest `npm run test:e2e -w ...` for normal verification.
-
-## Why
-
-Make targets handle required test setup consistently (dependencies, seed, report output), reducing flaky failures caused by missing setup.
diff --git a/.llm/exports/github-copilot/instructions/e2e-suite-title.instructions.md b/.llm/exports/github-copilot/instructions/e2e-suite-title.instructions.md
deleted file mode 100644
index dd90510f..00000000
--- a/.llm/exports/github-copilot/instructions/e2e-suite-title.instructions.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-description: "E2E top-level suite title is a concise phrase; nested describe, test titles, and step labels stay verbose."
-applyTo:
-  - "apps/web/e2e/**/*.spec.ts"
-  - "apps/management-web/e2e/**/*.spec.ts"
----
-
-# E2E Suite Title Convention
-
-When adding or editing E2E specs:
-
-- **Top-level** `test.describe(...)` (the suite): use a **concise, title-like phrase** (e.g. "Home page for the unauthenticated user"). Do not use "This suite verifies …" or other long sentence forms.
-- **Non-default auth mode:** End the title with `(admin_only_email)` or `(user_signup_email)` when the spec runs in that mode; do not use the word "mode". Default `admin_only_username` has no suffix.
-- **Nested** describe, **test titles**, and **step labels**: keep **verbose sentence-style**.
-
-Applies to both `apps/web/e2e` and `apps/management-web/e2e`. Full guidance: `.llm/exports/github-copilot/skills/e2e-readability/SKILL.md`.
diff --git a/.llm/exports/github-copilot/instructions/end-with-targeted-make-report-verify.instructions.md b/.llm/exports/github-copilot/instructions/end-with-targeted-make-report-verify.instructions.md
deleted file mode 100644
index 0896cc14..00000000
--- a/.llm/exports/github-copilot/instructions/end-with-targeted-make-report-verify.instructions.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-description: "End implementation responses with targeted make screenshot-report verification commands."
-applyTo: "**"
----
-
-# End With Targeted Make Report Verify
-
-For implementation responses in this repo:
-
-1. **Give the user** one or more runnable `make` commands they can copy and run to verify the change; place them in a fenced `bash` code block at the end of your response.
-2. **MANDATORY when the change affects E2E:** If you modified UI (apps/web or apps/management-web), E2E spec files, or any code that E2E tests cover, you **MUST** end the response with a fenced `bash` block containing the **EXACT** command(s) needed to run the affected E2E test(s). No exception. Example: `make e2e_test_web_report_spec SPEC=e2e/settings-bucket-owner.spec.ts`.
-3. Prefer screenshot-report targets scoped to the changed feature area.
-3. Avoid suggesting unrelated full-suite runs by default.
-4. Use full-suite report mode only when the change scope is broad or cross-cutting.
-5. Place final verification commands in a fenced `bash` code block so copy-to-clipboard is available.
-6. Inside the code block, list plain commands (one per line), without bullets or inline backticks.
-7. **When the change includes files under `infra/k8s/`:** Add a sentence in the response that the user should push to the Argo CD–tracked branch (e.g. `develop`) for the cluster to sync. See **argocd-gitops-push** skill for details.
-
-API gate (default: no API tests):
-
-- **Always** give E2E verification commands **without** `E2E_API_GATE_MODE` so the default applies: API integration tests are **skipped**. Do not add `E2E_API_GATE_MODE=on` unless the change affected API or integration tests.
-- To include API tests the user must pass the env var: `make E2E_API_GATE_MODE=on e2e_test_web_report_spec SPEC=...`
-
-Preferred command order:
-
-- Web feature verification:
-  - `make e2e_test_web_report_spec SPEC=e2e/<web-spec>.spec.ts`
-- Management-web feature verification:
-  - `make e2e_test_management_web_report_spec SPEC=e2e/<management-spec>.spec.ts`
-- Cross-app web + management-web verification:
-  - `make e2e_test_report_scoped WEB_SPEC=e2e/<web-spec>.spec.ts MGMT_SPEC=e2e/<management-spec>.spec.ts`
-- Broad smoke:
-  - `make e2e_test_home_report`
-- Full regression (four reports: web default, web signup-enabled, web admin-only-email, management-web):
-  - `make e2e_test_report`
-
-Spec variables (`SPEC`, `WEB_SPEC`, `MGMT_SPEC`) may contain comma-separated spec paths when multiple related specs should run.
-
-Extended reference: **response-ending-make-verify** skill (command tree, API gate, multi-spec examples).
diff --git a/.llm/exports/github-copilot/instructions/env-file-formatting.instructions.md b/.llm/exports/github-copilot/instructions/env-file-formatting.instructions.md
deleted file mode 100644
index ee293f34..00000000
--- a/.llm/exports/github-copilot/instructions/env-file-formatting.instructions.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-description: "Environment file formatting - non-empty values in double quotes, empty unset"
-applyTo:
-  - "**/.env"
-  - "**/.env.*"
-  - "**/.env.example"
-  - "infra/config/local/*.env"
-  - "dev/env-overrides/local/*.env"
-  - "dev/env-overrides/alpha/*.env"
----
-
-# Environment File Formatting
-
-- **Non-empty values**: Use double quotes (e.g. `API_PORT="3000"`).
-- **Empty/unset values**: No value after `=` (e.g. `OPTIONAL_VAR=`).
-- **Alignment**: When creating or editing generated env files, follow variable order and grouping from canonical templates/examples in [`infra/config/env-templates/`](../../infra/config/env-templates/) and app `.env.example` files. Only values may differ.
-
-Correct: `DATABASE_HOST="localhost"`, `EMPTY_VALUE=`. Incorrect: `DATABASE_HOST=localhost`, `EMPTY_VALUE=""`.
diff --git a/.llm/exports/github-copilot/instructions/eqeqeq-strict-equality.instructions.md b/.llm/exports/github-copilot/instructions/eqeqeq-strict-equality.instructions.md
deleted file mode 100644
index e041af02..00000000
--- a/.llm/exports/github-copilot/instructions/eqeqeq-strict-equality.instructions.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-description: "Use strict equality (=== and !==) to satisfy eslint eqeqeq"
-applyTo:
-  - "**/*.ts"
-  - "**/*.tsx"
-  - "**/*.js"
-  - "**/*.jsx"
----
-
-# Strict Equality (eqeqeq)
-
-Use **strict equality** only. ESLint rule `eqeqeq` expects `===` and `!==`, not `==` or `!=`.
-
-- Do: `x === null`, `x !== undefined`, `x !== null && x !== undefined`
-- Don't: `x == null`, `x != null`, or `a == b` / `a != b` in general.
diff --git a/.llm/exports/github-copilot/instructions/i18n-locale-language.instructions.md b/.llm/exports/github-copilot/instructions/i18n-locale-language.instructions.md
deleted file mode 100644
index 0ca7cb8f..00000000
--- a/.llm/exports/github-copilot/instructions/i18n-locale-language.instructions.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-description: "Non–en-US i18n originals must be in the target language; do not put English in es or other locale files"
-applyTo:
-  - "**/i18n/originals/*.json"
-  - "**/i18n/overrides/*.json"
----
-
-# i18n locale language
-
-- **Non–en-US originals** (e.g. `es.json`, `fr.json`) must contain text **in that locale’s language**. Spanish files must be in Spanish; do not put English strings into `es.json` or other non–en-US originals.
-- The sync script adds missing keys with **empty string** so they can be filled with the correct translation. When you add or edit translations for a locale, use the target language (e.g. Spanish for `es`).
-- Overrides may be used for corrections; same rule: use the locale language, not English, for non–en-US.
diff --git a/.llm/exports/github-copilot/instructions/llm-cursor-source.instructions.md b/.llm/exports/github-copilot/instructions/llm-cursor-source.instructions.md
deleted file mode 100644
index 103699d2..00000000
--- a/.llm/exports/github-copilot/instructions/llm-cursor-source.instructions.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-description: "AI guidance source of truth is .cursor and .cursorrules; .llm/exports is machine-only"
-applyTo:
-  - ".llm/exports/github-copilot/skills/**"
-  - ".llm/exports/github-copilot/instructions/**"
-  - ".cursorrules"
----
-
-# LLM / Cursor source of truth
-
-Committed **authoring** guidance for this repo lives only in:
-
-- `.llm/exports/github-copilot/skills/**`
-- `.llm/exports/github-copilot/instructions/**`
-- `.cursorrules`
-
-**Do not** hand-edit the machine-generated tree at [`.llm/exports/`](.llm/exports/) (portable per-target exports). The **llm-exports-sync** and **llm-exports-full-sync** GitHub Actions produce and publish those files via the **`llm`** / **`llm-full`** branches and their PRs into **develop** — that is the normal path. **Do not** run `npm run llm:exports:sync` (or `export-from-cursor.mjs sync`) for routine `.cursor` work; the script is gated outside CI. Pull **develop** after the automation PR merges when you need updated exports locally.
-
-**Exception — pipeline development only:** if you are changing [scripts/llm/](scripts/llm/) export code, you may set `LLM_EXPORT_ALLOW_LOCAL=1` to run a local sync; see [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md).
-
-If you use another LLM or editor, follow [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md) and, if needed, [docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md](docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md).
-
-When you change `.cursor` or `.cursorrules`, commit and push only those **source** files. Let automation refresh `.llm/exports` on the `llm` branch; do not mirror that with a local run unless you are editing the export pipeline.
diff --git a/.llm/exports/github-copilot/instructions/llm-exports-ci.instructions.md b/.llm/exports/github-copilot/instructions/llm-exports-ci.instructions.md
deleted file mode 100644
index 123d8953..00000000
--- a/.llm/exports/github-copilot/instructions/llm-exports-ci.instructions.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-description: "Machine exports are CI + develop only; source is .cursor"
-applyTo:
-  - ".llm/exports/**"
-  - "scripts/llm/**"
----
-
-# LLM machine exports (`.llm/exports/*`)
-
-- Source of truth: `.cursor/`, `.cursorrules`. The **`llm-exports-sync`** Action (push to **`develop`**, or `workflow_dispatch`) runs incremental `sync` on the GitHub runner, then updates branch **`llm`**, and **`peter-evans/create-pull-request`** opens or updates a PR from **`llm`** into **`develop`**. Feature PRs are **not** blocked on export diffs; CI does not run `check` on the PR. The **`llm-exports-full`** Action (`workflow_dispatch` only) runs `sync --full` and updates branch **`llm-full`**. The workflow uses `git add -f` of ignored export paths on the runner. **Local** runs of the export script do **not** write unless `LLM_EXPORT_ALLOW_LOCAL=1` (for `scripts/llm/**` work only). Do not hand-mirror with ad-hoc commits; generated machine paths stay under ignore rules.
-- **Do not** hand-commit generated paths (`skills/`, `instructions/`, per-target `*-instructions.md` such as `copilot-instructions.md`) except allowlisted files (e.g. target `.gitkeep`); they are under ignore rules. See the **`llm-cursor-source`** and **`llm-exports-scripts`** skills, [docs/development/llm/EXPORT-TARGETS.md](../../docs/development/llm/EXPORT-TARGETS.md), and [`.llm/exports/LLM-EXPORTS.md`](../../.llm/exports/LLM-EXPORTS.md).
-- When editing files under `scripts/llm/**`, follow the **`llm-exports-scripts`** skill.
diff --git a/.llm/exports/github-copilot/instructions/llm-history-tracking.instructions.md b/.llm/exports/github-copilot/instructions/llm-history-tracking.instructions.md
deleted file mode 100644
index 9777b4c8..00000000
--- a/.llm/exports/github-copilot/instructions/llm-history-tracking.instructions.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-description: "LLM history tracking — essential for any file-modifying response in this repo"
-applyTo: "**/*"
----
-
-# History Tracking (Essential)
-
-When modifying **any** files in this workspace, update `.llm/history/active/[feature]/[feature]-part-01.md` (or the latest part file):
-
-```markdown
-### Session N - YYYY-MM-DD
-#### Prompt (Developer|Agent)
-[Exact verbatim prompt]
-#### Key Decisions
-- Decision 1
-#### Files Created/Modified
-- path/to/file.ts
-```
-
-## 10-Session Limit
-
-Each history file is limited to **10 sessions**. When adding session 11, create a new part file (e.g. `[feature]-part-02.md`).
-
-## File Naming
-
-- `.llm/history/active/[feature]/[feature]-part-01.md` (sessions 1-10)
-- `[feature]-part-02.md` (sessions 11-20), etc.
-
-End every file-modifying response with: **LLM History**: Updated `.llm/history/active/[feature]/[file].md` (Session N).
diff --git a/.llm/exports/github-copilot/instructions/markdown-formatting.instructions.md b/.llm/exports/github-copilot/instructions/markdown-formatting.instructions.md
deleted file mode 100644
index 49490302..00000000
--- a/.llm/exports/github-copilot/instructions/markdown-formatting.instructions.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-description: "Markdown formatting rules matching Prettier config"
-applyTo: "**/*.md"
----
-
-# Markdown Formatting
-
-- Max line width 100 characters (except code/URLs/tables).
-- Tables: aligned columns with padding.
-- Blank lines around lists, headings, code blocks.
-- Use `-` for unordered lists. ATX headings (`#`). Code blocks with language identifier.
-- **Bold** with `**text**`, *italic* with `*text*`, inline `code` with backticks.
diff --git a/.llm/exports/github-copilot/instructions/nix-terminal-wrapper.instructions.md b/.llm/exports/github-copilot/instructions/nix-terminal-wrapper.instructions.md
deleted file mode 100644
index d7c2d7dd..00000000
--- a/.llm/exports/github-copilot/instructions/nix-terminal-wrapper.instructions.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-description: "Run node/npm and other flake tools via the Nix wrapper so the agent sandbox has the correct environment"
-applyTo: "**"
----
-
-# Nix Terminal Wrapper (Agent Sandbox)
-
-This repo uses a Nix flake for Node/npm and other tools. There is no global Node on the system path in environments where the agent runs.
-
-For any terminal command that needs `node`, `npm`, `npx`, or other tools provided by the flake, run it via the project wrapper from repo root:
-
-```bash
-./scripts/nix/with-env <command> [args...]
-```
-
-Examples:
-
-- `./scripts/nix/with-env npm run build`
-- `./scripts/nix/with-env npm run lint`
-- `./scripts/nix/with-env npm run dev:api`
-- `./scripts/nix/with-env npm run dev:web`
-- `./scripts/nix/with-env npx some-package`
-
-Run from the repository root. The wrapper resolves the flake path so it also works when the shell's cwd is a subdirectory.
-
-In automated or agent runs (e.g. Cursor's agent), the sandbox may block Nix's cache under `~/.cache/nix`. When invoking this wrapper from the agent, request full permissions (e.g. `all`) so Nix can write to its cache and the command can succeed.
diff --git a/.llm/exports/github-copilot/instructions/path-casing-imports.instructions.md b/.llm/exports/github-copilot/instructions/path-casing-imports.instructions.md
deleted file mode 100644
index 3aaeef5d..00000000
--- a/.llm/exports/github-copilot/instructions/path-casing-imports.instructions.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-description: "Keep import path casing identical to actual file/directory names for Linux and CI"
-applyTo:
-  - "**/*.ts"
-  - "**/*.tsx"
-  - "**/*.js"
-  - "**/*.jsx"
----
-
-# Path Casing in Imports
-
-**Import paths must match the exact casing of the files and directories on disk.**
-
-- Linux and CI (e.g. GitHub Actions) use **case-sensitive** filesystems. A path like `'./components/form/Button'` will fail if the directory is actually named `Form` (uppercase).
-- macOS can hide the bug because the default filesystem is often case-insensitive, so `form` and `Form` resolve to the same directory locally but not in CI.
-- When adding or changing relative imports, verify that every segment of the path (each folder and file name) uses the **exact same casing** as in the repository (e.g. `git ls-tree` or your IDE file tree). Do not rely on "it works on my machine."
-- **Component directories** under `packages/ui/src/components/` use **lowercase** names (e.g. `form`, `bucket`, `layout`, `modal`, `navigation`, `table`). Use that casing in imports.
-
-Example: if the repo has `packages/ui/src/components/form/Button/Button.tsx`, use `from './components/form/Button/Button'` or `from '../../form/Button/Button'`, not `./components/Form/...`.
diff --git a/.llm/exports/github-copilot/instructions/plan-creation.instructions.md b/.llm/exports/github-copilot/instructions/plan-creation.instructions.md
deleted file mode 100644
index 4f4e1ac9..00000000
--- a/.llm/exports/github-copilot/instructions/plan-creation.instructions.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-description: "Plan creation - breaking large plans into separate files"
-applyTo: ".llm/plans/**/*.md"
----
-
-# Plan Creation
-
-When creating a plan, if it is too large, **do not implement it immediately**. Instead:
-
-1. Break it into separate files
-2. Save those files in `.llm/plans/active/`
-3. Wait for the user to prompt you to complete them one-by-one
-
-Plans must be under 300 lines. For file layout (00-EXECUTION-ORDER, COPY-PASTA, etc.), use the **plan-files-convention** skill (`.llm/exports/github-copilot/skills/plan-files-convention/SKILL.md`).
diff --git a/.llm/exports/github-copilot/instructions/plan-execution-completion-tracking.instructions.md b/.llm/exports/github-copilot/instructions/plan-execution-completion-tracking.instructions.md
deleted file mode 100644
index 2dcc17c1..00000000
--- a/.llm/exports/github-copilot/instructions/plan-execution-completion-tracking.instructions.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-description: "Plan execution - mark COPY-PASTA progress and move completed plan files"
-applyTo: ".llm/plans/active/**/*.md"
----
-
-# Plan Execution Completion Tracking
-
-When executing a plan set from `.llm/plans/active/**`:
-
-1. Execute numbered plan files in the order defined by `00-EXECUTION-ORDER.md` and `COPY-PASTA.md`.
-2. After each completed numbered prompt, update `COPY-PASTA.md` to mark that prompt as completed.
-3. Move each completed numbered plan file from `active/` to the mirrored `completed/` directory path.
-4. Keep `COPY-PASTA.md` and `00-*` files in `active/` until all numbered prompts are complete.
-5. When all numbered prompts are complete, move the remaining plan-set files and directory to `completed/`.
-
-This tracking is required for plan implementation responses so progress is durable and visible.
diff --git a/.llm/exports/github-copilot/instructions/semicolons-required.instructions.md b/.llm/exports/github-copilot/instructions/semicolons-required.instructions.md
deleted file mode 100644
index 26c45e94..00000000
--- a/.llm/exports/github-copilot/instructions/semicolons-required.instructions.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-description: "Require semicolons in JS/TS files"
-applyTo: "**/*.{js,jsx,ts,tsx}"
----
-
-# Semicolons Required
-
-Use semicolons at the end of statements in JavaScript and TypeScript (`.js`, `.jsx`, `.ts`, `.tsx`). Markdown and `.mdc` files are exempt. Keep semicolons consistent in existing code.
diff --git a/.llm/exports/github-copilot/instructions/single-readme.instructions.md b/.llm/exports/github-copilot/instructions/single-readme.instructions.md
deleted file mode 100644
index 70073f54..00000000
--- a/.llm/exports/github-copilot/instructions/single-readme.instructions.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-description: "Only one README.md in the Metaboost monorepo (at repo root)"
-applyTo:
-  - "**/README.md"
-  - ".llm/**/*.md"
-  - "**/INDEX.md"
----
-
-# Single README
-
-The Metaboost monorepo has **exactly one README.md**, at the **repository root**. Do not create `README.md` in subdirectories.
-
-For directory docs use **full-path names** (e.g. `INFRA-K8S.md`, `PACKAGES-UI.md`) per the documentation-conventions skill. The only `INDEX.md` is `.llm/exports/github-copilot/skills/INDEX.md`; plan-set indexes use `00-overview.md` or `00-master-plan.md`.
diff --git a/.llm/exports/github-copilot/instructions/type-imports-separate-line.instructions.md b/.llm/exports/github-copilot/instructions/type-imports-separate-line.instructions.md
deleted file mode 100644
index 0e16a23c..00000000
--- a/.llm/exports/github-copilot/instructions/type-imports-separate-line.instructions.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-description: "Type imports must use a separate import line; do not mix type and value in one statement."
-applyTo:
-  - "**/*.ts"
-  - "**/*.tsx"
----
-
-# Type Imports on Separate Line
-
-Type-only imports must use a **separate** `import type { ... }` statement. Do not declare types inline with value imports.
-
-## Do
-
-- Use a dedicated line for type imports from the same module as value imports:
-
-```typescript
-import { DataSource } from 'typeorm';
-import type { DataSourceOptions } from 'typeorm';
-```
-
-- Use `import type { X } from '...'` when the symbol is only used in type positions.
-
-## Don't
-
-- Do not mix type and value in one import: `import { DataSource, type DataSourceOptions } from 'typeorm'`.
-- Do not use inline `type` in a value import statement.
-
-## Enforcement
-
-ESLint `@typescript-eslint/consistent-type-imports` with `fixStyle: 'separate-type-imports'` enforces this. Run `npm run lint:fix` to auto-fix.
diff --git a/.llm/exports/github-copilot/skills/api-testing/SKILL.md b/.llm/exports/github-copilot/skills/api-testing/SKILL.md
deleted file mode 100644
index 0d7241cc..00000000
--- a/.llm/exports/github-copilot/skills/api-testing/SKILL.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-name: api-testing
-description: When changing API routes, auth, or env-dependent behavior, add or update the corresponding integration tests and keep the test file layout consistent.
----
-
-
-# API Integration Testing (Metaboost)
-
-Testing requirement policy lives in **feature-implementation-testing**. This skill focuses on **how** to add or update API integration tests. If an API change affects behavior in `apps/web` or `apps/management-web`, also update the corresponding E2E specs (see e2e-page-tests).
-
-Use this skill when adding or changing auth endpoints, versioned routes, or any API behavior that depends on environment variables. Keep tests in sync and use the correct test file and base URL.
-
-## Test file layout
-
-| File                                       | Scope                                                                                                                                     | When to update                                                                                                           |
-| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| `apps/api/src/test/auth.test.ts`           | **Shared** – endpoints unaffected by mailer mode: versioned root (GET /health, GET /), login, logout, me, change-password                 | Add tests for new shared auth or versioned routes; add validation/error cases for these endpoints.                       |
-| `apps/api/src/test/auth-no-mailer.test.ts` | **No-mailer (admin-only)** – signup → 403, all verification routes → 403                                                                  | Change when no-mailer behavior or verification route list changes.                                                       |
-| `apps/api/src/test/auth-mailer.test.ts`    | **Mailer-enabled (mocked)** – signup, verify-email, forgot/reset-password, request/confirm-email-change; uses `vi.mock` to capture tokens | Change when verification flows or mailer-dependent behavior changes; add validation tests (400/401) for these endpoints. |
-
-- **Base URL**: Use `config.apiVersionPath` (from `../config/index.js`), never hardcode `/v1`. Example: `const API = config.apiVersionPath;` then `request(app).get(\`${API}/health\`)`.
-- **Naming**: Mode-specific tests live in files with consistent names: `auth-no-mailer.test.ts`, `auth-mailer.test.ts`. If you add another mode (e.g. invite-only), add `auth-<mode>.test.ts` and document it in file headers and AGENTS.md.
-
-## Clean slate and requirements
-
-- **Clean slate**: Each test run truncates app tables once via Vitest `globalSetup` (`apps/api/src/test/global-setup.mjs`). No manual DB wipe needed between runs.
-- **Test data unique per file**: Use a file-unique prefix (e.g. `const FILE_PREFIX = 'auth-shared';`) for all emails, usernames, and other identifiers that create DB rows, so tests can run in parallel (e.g. `maxWorkers: 2`) without collisions. The same rules (file-unique prefix, schema length limits, afterAll guards) apply to management-api integration tests in `apps/management-api/src/test/`.
-- **Respect schema length limits**: DB columns have max lengths (e.g. `user_credentials.username` is VARCHAR(50) per `infra/k8s/base/db/source/app/0001_app_schema.sql`; see also `USERNAME_MAX_LENGTH` / `SHORT_TEXT_MAX_LENGTH` in `@metaboost/helpers`). When building file-unique identifiers (prefix + suffix + `Date.now()`), ensure the full string does not exceed the column limit — e.g. username ≤ 50 chars, so keep FILE_PREFIX short or use short suffixes for usernames. For management-api tests, `management_user_credentials.username` and `management_user_bio.display_name` are VARCHAR(50) (varchar_short in `infra/k8s/base/db/source/management/0001_management_schema.sql`). When building file-unique admin usernames (e.g. email-style `prefix-suffix-${Date.now()}@example.com`), ensure the full string is ≤ 50 characters — use a short FILE_PREFIX (e.g. `mgmt-ap`, `mgmt-up`) or short suffixes.
-- **afterAll cleanup**: In describe blocks that create resources in beforeAll and delete them in afterAll, guard the delete so it only runs when the created id is defined (e.g. `if (adminId !== undefined) await agent.delete(...)`). Otherwise a failed beforeAll leaves the id undefined and delete requests with id `"undefined"` cause unhandled rejections and hook timeouts.
-- **Rate limiting in tests**: Rate limiting is **disabled in test** (very high limit in `packages/helpers-backend-api` rateLimit.ts) so integration tests never hit 429. **Do not add tests that assert rate-limit behavior** (e.g. 429 after N requests); they are a chronic source of flakiness and load-order issues.
-- **Signup strict-limit test mode**: For `POST /auth/signup` strict-limit assertions, force signup-enabled mode in the test setup (`MAILER_ENABLED=true` and `ACCOUNT_SIGNUP_MODE` not `admin_only`) so assertions are not masked by admin-only/no-mailer `403` responses. Keep this setup before the dynamic app import.
-- **Requirements**: Before tests, Postgres and Valkey must be up and the test DB created. Root `npm run test` runs `scripts/check-test-requirements.mjs` first; if ports are unreachable, it exits with instructions. From repo root: `make test_deps` (note underscore) starts test containers (Postgres **5632**, Valkey **6579** — Metaboost dev Docker uses 5532/6479), creates `metaboost_app_test`, applies schema, and grants read/read_write (including TRUNCATE for globalSetup). Make targets use **underscores**: `test_deps`, `help_test`, `test_clean`. After `apps/api` and `apps/management-api`, the same root command runs Vitest in **metaboost-signing** and **@metaboost/rss-parser**.
-
-## What to update when the API changes
-
-1. **New versioned or shared auth route**  
-   Add tests in `auth.test.ts` (happy path and validation/error cases as appropriate).
-
-2. **New or changed verification or mailer-dependent route**  
-   Add or update tests in `auth-mailer.test.ts` (with mailer mocked). Add corresponding 403 tests in `auth-no-mailer.test.ts` for the same path.
-
-3. **New env mode (e.g. ACCOUNT_SIGNUP_MODE or new feature flag)**  
-   Add a new test file `auth-<mode>.test.ts` with a clear top-level describe (e.g. `auth-invite-only (mocked)`), set the env in that file, and document in its header and in AGENTS.md.
-
-4. **Schema/ORM change**  
-   Ensure entity column names match the DB (e.g. `@PrimaryColumn('uuid', { name: 'user_id' })` for `UserCredentials` and `UserBio`). Otherwise integration tests will fail with “column does not exist” (TypeORM uses property name by default).
-
-5. **New app table that should be cleared between runs**  
-   Update `global-setup.mjs`: either extend the single `TRUNCATE "user" ... CASCADE` if the new table references `user`, or add an explicit `TRUNCATE` for the new table.
-
-## Quick reference
-
-- **Default execution strategy (agent/sandbox):** start with the leanest targeted integration test command that verifies the change (for example a single test file), then expand scope only if needed.
-- Run tests: `npm run test:e2e:api` from repo root for API integration tests only (or `./scripts/nix/with-env npm run test:e2e:api` in Nix/agent). First step is the requirements check, then Vitest runs for `apps/api` and `apps/management-api`. For unit-only (no DB needed): `npm run test:unit`. Full suite: `npm test`.
-- Run one API integration test file (preferred during iteration): `./scripts/nix/with-env npm run test -w apps/api -- src/test/<file>.test.ts`
-- Test env: `apps/api/src/test/setup.ts` sets defaults (DB_PORT 5632, KEYVALDB_PORT 6579, DB_APP_NAME metaboost_app_test, etc.). globalSetup uses the same defaults so it can run without setupFiles.
-- Mailer in tests: No real SMTP. `auth-mailer.test.ts` sets `MAILER_ENABLED=true` and mocks `../lib/mailer/send.js` to capture tokens for verify-email, reset-password, and confirm-email-change.
diff --git a/.llm/exports/github-copilot/skills/api/SKILL.md b/.llm/exports/github-copilot/skills/api/SKILL.md
deleted file mode 100644
index 5ab03fa6..00000000
--- a/.llm/exports/github-copilot/skills/api/SKILL.md
+++ /dev/null
@@ -1,59 +0,0 @@
----
-name: api
-description: Common patterns for the Metaboost HTTP API (Express)
-version: 1.0.0
----
-
-
-# Metaboost API Patterns
-
-- **Location**: `apps/api/`
-- **Stack**: Express, TypeScript, ESM
-
-## API change triad (use every time)
-
-When you add or change an API route, update these together:
-
-1. Route/controller/schema implementation in API or management-api.
-2. API integration tests (see **api-testing**).
-3. OpenAPI spec updates (see **swagger-openapi**).
-
-## Patterns
-
-### Route and handler
-
-```typescript
-import { Router, type Request, type Response } from 'express';
-
-const router = Router();
-
-router.get('/health', (_req: Request, res: Response): void => {
-  res.json({ status: 'ok', message: 'The server is running.' });
-});
-
-export default router;
-```
-
-### Config and startup validation
-
-- **Startup validation**: `lib/startup/validation.ts` runs after loadEnv() and before importing config. It validates required env vars (e.g. API_PORT), logs results by category, and throws if any required are missing or invalid. **`WEB_BRAND_NAME`** is required only when **`ACCOUNT_SIGNUP_MODE`** uses email flows (with mailer vars), for transactional email copy. Pattern aligned with Podverse’s API startup validation.
-- Read env in `config/index.ts` only after validation has passed.
-- Use `.env.example` for documented variables; non-empty values in `.env` use double quotes; empty/unset use no value after `=`.
-- **Env alignment**: All `.env` files (including `infra/config/local/*.env`) must match the organization, section comments, and variable order of their authoritative `.env.example`; only values may differ. Generated files are filled by `make local_env_setup` (auto-generated secrets plus overrides from local override files when present). **`WEB_BRAND_NAME`** is set from dev/env-overrides/local/info.env (template contract workload **`info`**). See [docs/development/env/LOCAL-ENV-OVERRIDES.md](../../docs/development/env/LOCAL-ENV-OVERRIDES.md).
-
-### Async handlers
-
-Wrap async route handlers to avoid unhandled rejections (e.g. try/catch and pass errors to Express error middleware, or use a small `asyncHandler` wrapper).
-
-### Request body validation and controller typing
-
-- **Validate at the route**: Use `validateBody(schema)` middleware (Joi) on any route that accepts a JSON body. Validation runs before the controller; invalid requests get 400 with details and never reach the controller.
-- **Type the validated body**: In the schema file, export an interface that matches the shape Joi validates (e.g. `CreateAdminBody` for `createAdminSchema`). Use `.default()` in Joi so optional fields have a known shape after validation.
-- **Controllers assume valid body**: In the controller, use the validated schema shape (for example the exported body interface from the schema module) and avoid redundant field-type checks. Do **not** repeat “field is required” or “field must be a string” checks for fields already validated by middleware; controllers should only do business checks (e.g. “email already in use”, “display name already in use”, auth checks).
-- **Same pattern in management-api**: Apply the same pattern in `apps/management-api`: schemas in `schemas/*.ts` with exported body types, routes using `validateBody(schema)`, controllers using the types and no redundant presence/type checks for validated fields.
-
-## Scripts
-
-- `npm run dev` – Build and run (from `apps/api`)
-- `npm run dev:api` – From repo root
-- **Tests:** When adding or changing routes or auth behavior, add or update integration tests. Use the **api-testing** skill for file layout (auth.test.ts vs auth-no-mailer vs auth-mailer), base URL (`config.apiVersionPath`), and clean-slate/requirements.
diff --git a/.llm/exports/github-copilot/skills/argocd-gitops-push/SKILL.md b/.llm/exports/github-copilot/skills/argocd-gitops-push/SKILL.md
deleted file mode 100644
index 7b64bc03..00000000
--- a/.llm/exports/github-copilot/skills/argocd-gitops-push/SKILL.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-name: argocd-gitops-push
-description: When adding or changing files under infra/k8s/ or sync targets for k8s, know what Argo CD syncs and remind the user to push to Git so the cluster can sync.
----
-
-
-# Argo CD / GitOps push awareness
-
-## When to use
-
-When adding or changing files under:
-
-- `infra/k8s/` (local, base, or app-of-apps manifests and referenced resources),
-- Or any path that is part of an Argo CD Application source (e.g. `infra/k8s/local/apps`, `infra/k8s/local/stack`, `infra/k8s/base/stack`, source under base, and files referenced by those via Kustomize),
-- Or **canonical linear migration SQL** under `infra/k8s/base/ops/source/database/linear-migrations/{app,management}/` (versioned chain applied by the linear migration runner),
-- Or **ops** manifests under `infra/k8s/base/ops/` (Kustomize bundles: migration CronJob SQL, scripts mounted into jobs, and related `kustomization.yaml` entries that must stay in sync with on-disk files).
-
-## What Argo CD syncs
-
-- The local app points at repo path `infra/k8s/local/apps` (see `infra/k8s/local-application.yaml`), which references `infra/k8s/local/stack` and the base stack.
-- The alpha app-of-apps root points at repo path `infra/k8s/alpha/apps` (see `infra/k8s/alpha-application.yaml`), which references `infra/k8s/alpha/<component>/` overlays.
-- Only the **remote** Git repo at the configured revision (e.g. `develop`) is used; the agent does not push. The user must push for Argo CD to see changes.
-
-## When a push is required
-
-Any change to files under those paths (or to canonical sources that get copied into them) means the cluster will not reflect the change until the user pushes to the branch Argo CD tracks.
-
-## Response requirement
-
-When your file-modifying work touches any of these paths, add a short **Push to Git** note in the response (e.g. before or after the verification block):
-
-**Push to Git:** This change affects Argo CD–synced manifests. Push to the branch Argo CD tracks (e.g. `develop`) for the cluster to sync.
-
-## Version updates (GitOps)
-
-- **Manifest changes** (image tags, env, resources, new deployments): Updating the manifest is the change; push is required for Argo CD (covered by the response reminder above).
-- **npm/package versions:** Follow the existing AGENTS.md Dependencies section; no separate version rule for GitOps.
-
-## See also
-
-- [infra/k8s/INFRA-K8S.md](infra/k8s/INFRA-K8S.md) – k8s layout and local app-of-apps.
-- [docs/development/k8s/K3D-ARGOCD-LOCAL.md](docs/development/k8s/K3D-ARGOCD-LOCAL.md) – Local k3d + Argo CD setup.
diff --git a/.llm/exports/github-copilot/skills/avoid-line-height/SKILL.md b/.llm/exports/github-copilot/skills/avoid-line-height/SKILL.md
deleted file mode 100644
index 57cbcf8f..00000000
--- a/.llm/exports/github-copilot/skills/avoid-line-height/SKILL.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-name: avoid-line-height
-description: Do not change line-height; use normal line height for text. Control spacing with gap, margin, padding, and layout components. Use when adding or editing styles, typography, or vertical rhythm in SCSS/CSS or UI components.
----
-
-
-# Avoid Changing Line Height
-
-**When to use:** When adding or editing styles (SCSS/CSS), typography, layout components, or when the user mentions line-height, vertical spacing, or text spacing.
-
-## Rule
-
-Do **not** set or change `line-height` on text elements. The project uses **normal line height** for text (from the reset on `html`/`body`). Line height should match the text itself; we do not use line-height to control vertical spacing.
-
-## How to control spacing instead
-
-- **Between lines of text:** Rely on `line-height: normal` (inherited). Do not add `line-height` to get more or less space.
-- **Between blocks or elements:** Use **gap** (e.g. `Stack` with `gap`, flex/grid `gap`), **margin**, or **padding** on layout components.
-- **Form controls / inputs:** The reset and component styles may keep inherited line-height; do not add line-height for spacing—use padding or min-height if needed for tap targets.
-- **Vertical rhythm:** Use spacing tokens (`$space-*`, `$gap-standard`), `Stack`, and layout structure rather than line-height.
-
-## Do not
-
-- Add `line-height: 1.5`, `line-height: 1.2`, or any explicit line-height for “readability” or spacing.
-- Override the root `line-height: normal` in globals or reset.
-- Use line-height to fix alignment or spacing that should be solved with gap, margin, or padding.
-
-## Exception
-
-Only set `line-height` when a component has a **specific need** that cannot be met by gap/margin/padding (e.g. a single-line control that must have `line-height: 1` for precise height). Prefer leaving line-height unset so it inherits normal.
diff --git a/.llm/exports/github-copilot/skills/avoid-unknown-types/SKILL.md b/.llm/exports/github-copilot/skills/avoid-unknown-types/SKILL.md
deleted file mode 100644
index 444a6545..00000000
--- a/.llm/exports/github-copilot/skills/avoid-unknown-types/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: avoid-unknown-types
-description: Do not use `unknown` for API response fields or known data shapes. Use precise types so the type system enforces correctness. Use when typing API responses, context state, or DTOs.
-version: 1.0.0
----
-
-
-# Avoid `unknown` for Known Shapes
-
-Using `unknown` for a field that has a known structure (e.g. `permissions`, API response bodies) is a code smell: it opts out of type checking and forces call sites to assert or narrow without a single source of truth.
-
-## Do
-
-- **Define a precise type** that matches the API contract or domain shape (e.g. `ManagementUserPermissions`, `ManagementUser`). Put it in a shared types file (e.g. `src/types/management-api.ts`) or a package (e.g. `@podverse/helpers` DTOs).
-- **Use that type** in context state, component props, and API response handling. Re-export or alias if needed (e.g. `export type AuthUser = ManagementUser`).
-- **Keep types in sync** with the API (OpenAPI schema, backend entities, or API docs). When the API gains a new field, add it to the type.
-
-## Don't
-
-- **Don't type known shapes as `unknown`** (e.g. `permissions?: unknown`, `metadata?: unknown`) when you know the structure. If the backend returns `{ adminsCrud, usersCrud, ... }`, type it as an object with those properties.
-- **Don't leave placeholder `unknown`** “for later.” Define the minimal shape now and extend it when the API evolves.
-
-## When `unknown` is acceptable
-
-- **Truly opaque data** (e.g. a pass-through payload you never inspect).
-- **Type guards**: the guard narrows `unknown` to a concrete type in one place; call sites then use the narrowed type.
-- **Generic or external input** that must be validated at runtime before use.
-
-## Example
-
-- **Bad:** `type Admin = { id: string; email: string; permissions?: unknown };`
-- **Good:** Define `ManagementUserPermissions` with `adminsCrud`, `usersCrud`, `canChangePasswords`, `canAssignPermissions`, `eventVisibility`, then `type ManagementUser = { id: string; email: string; permissions?: ManagementUserPermissions | null };` and use `ManagementUser` (or `AuthUser = ManagementUser`) everywhere.
diff --git a/.llm/exports/github-copilot/skills/avoid-unused-props-vars/SKILL.md b/.llm/exports/github-copilot/skills/avoid-unused-props-vars/SKILL.md
deleted file mode 100644
index f08ccf13..00000000
--- a/.llm/exports/github-copilot/skills/avoid-unused-props-vars/SKILL.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-name: avoid-unused-props-vars
-description: Do not keep unused props or variables. Remove them from types and call sites (or delete the variable) instead of using _unused or "intentionally unused" patterns. Use when adding or refactoring component props, function parameters, or local variables.
----
-
-
-# Avoid Unused Props and Variables
-
-Do not add or keep props or variables that are never used. Prefer removing them over using underscore or "intentionally unused" patterns.
-
-## Do
-
-- Remove the prop from the component's props type and from every caller.
-- Remove unused local variables or parameters when you control the interface.
-- Rely on derived values (e.g. `canEditPermissions`) at the caller instead of passing raw data the component does not use.
-
-## Don't
-
-- Add or keep props "for callers" that the component never uses.
-- Destructure as `prop: _prop` or `prop: _unused` just to satisfy the linter when the prop can be removed.
-- Keep variables that are never read.
-
-## Exception
-
-When a symbol is required by an external interface or API and cannot be removed (e.g. a callback signature that must accept a parameter), the underscore pattern is acceptable. Add a brief comment explaining why it is required.
diff --git a/.llm/exports/github-copilot/skills/avoid-wrapper-elements/SKILL.md b/.llm/exports/github-copilot/skills/avoid-wrapper-elements/SKILL.md
deleted file mode 100644
index 20a72d49..00000000
--- a/.llm/exports/github-copilot/skills/avoid-wrapper-elements/SKILL.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-name: avoid-wrapper-elements
-description: Avoid div and other element wrappers within pages that exist only to apply styles. Use when adding or reviewing page layout, spacing, or wrapper markup in apps (e.g. Next.js pages, React components).
----
-
-
-# Avoid Wrapper Elements for Styling Only
-
-**When to use:** When adding or editing page layout, spacing, or when you see a `<div>`, `<span>`, or similar wrapper that exists only to hold a `className` (e.g. for margin, padding, or flex).
-
-## Rule
-
-Do **not** add free-floating wrappers (div, span, etc.) whose sole purpose is to apply styles. If you need layout or spacing:
-
-1. **Use an existing component** that already provides the structure (e.g. `Stack`, `Container`, `SectionWithHeading`, `Card`, `ContentPageLayout`).
-2. **Add a reusable component** if the pattern is repeated or will be—put the structure and styles in that component and use it from the page.
-
-In **shared UI / layout components** (e.g. `BucketDetailContent`), do **not** use raw `<div>`, `<h1>`, `<h2>`, or other heading tags when a layout component exists: use **PageHeader** for page/section titles, **SectionWithHeading** for section blocks, **Stack** / **Container** for layout. This keeps markup consistent and lets the design system own structure and semantics.
-
-## How to fix
-
-- **Spacing between blocks:** Prefer layout components (e.g. `Stack` with gap) or margin/padding on the real semantic parent (section, article, the component that owns the content).
-- **“Wrapper for one style”:** Move the style onto an existing wrapper or the nearest semantic element; or introduce a small layout component (e.g. in `@metaboost/ui`) that encodes the pattern.
-- **Repeated pattern:** Extract to a shared component with its own module SCSS instead of a one-off div + class.
-
-## Examples
-
-- **Bad:** `<div style={{ marginBottom: '1rem' }}><ButtonLink>...</ButtonLink></div>`  
-  **Good:** Use `Stack` with gap, or a layout component that already provides that spacing.
-
-- **Bad:** A `<div className={styles.section}>` that only adds padding and is used once on one page.  
-  **Good:** Use `Container`, `Card`, or a layout component; or add a named component (e.g. `Section`) if the pattern is reused.
-
-- **Bad:** Nested divs that each apply one CSS property.  
-  **Good:** Single semantic container or existing layout component; consolidate styles there or in a new reusable component.
-
-- **Bad:** `<h2>{name}</h2>` or a raw `<div className={styles.wrap}>` for content width in a shared component.  
-  **Good:** `<PageHeader title={name} />` for the title; `<Container contentMaxWidth="readable">` or `<Stack maxWidth="readable">` for layout.
-
-## Relation to other skills
-
-- Prefer **reusable components** (see reusable-components skill) when the pattern is or could be repeated.
-- Use **existing UI/layout components** from the design system (Stack, Container, Card, etc.) before introducing new wrapper elements.
diff --git a/.llm/exports/github-copilot/skills/button-loading-async/SKILL.md b/.llm/exports/github-copilot/skills/button-loading-async/SKILL.md
deleted file mode 100644
index 0720a3cd..00000000
--- a/.llm/exports/github-copilot/skills/button-loading-async/SKILL.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-name: button-loading-async
-description: Always show a loading spinner in a button when it triggers an async action (submit, save, delete, etc.).
-version: 1.1.0
----
-
-
-# Button loading state for async actions
-
-**When to use:** Whenever you add or change a button that triggers an async request (form submit, save, delete, invite, copy, etc.).
-
-## Rule
-
-Any button that starts an async operation (API call, mutation, clipboard write, etc.) must:
-
-1. **Track in-flight state** – e.g. `const [loading, setLoading] = useState(false);` and set `true` at the start of the request, `false` in `finally` (or on success/error).
-2. **Pass it to the Button** – use the `loading` prop on `Button` from `@metaboost/ui`: `<Button ... loading={loading}>`. The Button shows an inline spinner and is disabled while `loading` is true.
-3. **Disable the button while loading** – either pass `disabled={loading}` explicitly or rely on Button’s built-in behavior (Button already sets `disabled` when `loading` is true). For secondary actions (e.g. Cancel), pass `disabled={loading}` so they are disabled during the primary action.
-
-## Why
-
-- Users get immediate feedback that the action is in progress (visible spinner).
-- Prevents double-submit and accidental repeated clicks.
-- Matches expected UX for forms and destructive actions.
-
-## Checklist
-
-- Does this button trigger a fetch, mutation, or other async work? → Add (or reuse) a loading state and pass `loading={...}` to the Button.
-- For form submit buttons, the same state used for `disabled={loading}` should be passed as `loading={loading}` so the spinner appears.
-- For confirm/delete modals, pass `loading={confirmLoading}` (or equivalent) to the confirm Button so the delete button shows a spinner.
-- For copy buttons (e.g. clipboard), use a short-lived loading state so the button shows a spinner while the async copy runs.
diff --git a/.llm/exports/github-copilot/skills/catch-unused-error/SKILL.md b/.llm/exports/github-copilot/skills/catch-unused-error/SKILL.md
deleted file mode 100644
index 37469192..00000000
--- a/.llm/exports/github-copilot/skills/catch-unused-error/SKILL.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-name: catch-unused-error
-description: Use parameterless catch when the error value is not used. Use when writing or editing try/catch in TypeScript/JavaScript.
----
-
-
-# Catch without unused variable
-
-When a `catch` block does **not** use the error value, do not bind it. Use a parameterless `catch` so ESLint `@typescript-eslint/no-unused-vars` is satisfied and the intent is clear.
-
-## Do
-
-```ts
-try {
-  await sendVerificationEmail(...);
-} catch {
-  // Continue; best-effort
-}
-```
-
-## Don't
-
-```ts
-try {
-  await sendVerificationEmail(...);
-} catch (e) {
-  // e is never used → no-unused-vars
-}
-```
-
-## Empty catch and `no-empty`
-
-This repo enables ESLint **`no-empty`** via `eslint.configs.recommended`. A `catch { }` block with **no statements and no comment** is rejected as an empty block. If you swallow the error intentionally, include at least **one comment** (see “Do” above) or a statement. See [no-empty](https://eslint.org/docs/latest/rules/no-empty).
-
-When you **do** need the error (e.g. to log, rethrow, or inspect it), keep the binding: `catch (err) { ... }`. Only omit the parameter when the catch body does not reference the error at all.
diff --git a/.llm/exports/github-copilot/skills/crud-tables-resources/SKILL.md b/.llm/exports/github-copilot/skills/crud-tables-resources/SKILL.md
deleted file mode 100644
index 229f28c5..00000000
--- a/.llm/exports/github-copilot/skills/crud-tables-resources/SKILL.md
+++ /dev/null
@@ -1,67 +0,0 @@
----
-name: crud-tables-resources
-description: How CRUD (Create, Read, Update, Delete) is handled for resource tables and detail pages in the Metaboost management-web app.
----
-
-
-# CRUD Tables and Resources (Metaboost)
-
-Use this skill when adding or changing list/detail/edit flows for admins, users, or other CRUD resources in management-web. Keeps table actions, routes, and permissions consistent.
-
-## CRUD flow and routes
-
-For each resource (e.g. Admins, Users):
-
-| Action     | Route pattern          | Page / behavior                                                      |
-| ---------- | ---------------------- | -------------------------------------------------------------------- |
-| **List**   | `/resources`           | List page with table, search/filter, “Add” when create allowed.      |
-| **View**   | `/resources/[id]`      | Read-only detail page; link to Edit when update allowed.             |
-| **Create** | `/resources/new`       | Form page; create permission required.                               |
-| **Edit**   | `/resources/[id]/edit` | Form page; update permission required (or self for super admin).     |
-| **Delete** | (no page)              | Triggered from table row; delete permission required; confirm modal. |
-
-- **Routes**: Define in `apps/management-web/src/lib/routes.ts` — e.g. `adminViewRoute(id)`, `adminEditRoute(id)`, `userViewRoute(id)`, `userEditRoute(id)`.
-- **List access**: User must have **read** permission (or be super admin) to see the list; redirect otherwise.
-
-## Table actions order
-
-In `ResourceTableWithFilter`, row actions are shown in this order:
-
-1. **View** — link to `/resources/[id]` (read-only). Shown when `canView` is true (typically when user has read permission).
-2. **Edit** — link to `/resources/[id]/edit`. Shown when `canUpdate` (or per-row `getRowActions().canUpdate`) is true.
-3. **Delete** — button opening confirm modal. Shown when `canDelete` (or per-row `getRowActions().canDelete`) is true.
-
-View is always before Edit and Delete. Pass `viewRoute`, `viewLabelKey`, and `canView` into `ResourceTableWithFilter`; use `editRoute`, `editLabelKey`, `canUpdate`, `deleteLabelKey`, `canDelete` for Edit/Delete.
-
-## Permissions (CRUD bits)
-
-- **Source**: `getCrudFlags(isSuperAdmin, permissions, 'adminsCrud' | 'usersCrud')` from `lib/main-nav.ts`. Returns `{ create, read, update, delete }`.
-- **List page**: Require `crud.read` (or super admin); pass `canViewX={crud.read}`, `canUpdateX={crud.update}`, `canDeleteX={crud.delete}` to the table.
-- **View page**: Require read; show Edit button only when `crud.update` (or self-edit for super admin).
-- **Edit page**: Require update (or self for super admin); form submit calls update API.
-- **Create page**: Require `crud.create`; form submit calls create API.
-- **Delete**: API called from table with `onDelete`; require delete permission (and no delete for super admin row).
-
-## ResourceTableWithFilter props (summary)
-
-- **View**: `viewRoute?: (id) => string`, `viewLabelKey?: string`, `canView?: boolean`. When `canView` and viewRoute/viewLabelKey are set, a View link is rendered before Edit.
-- **Edit**: `editRoute`, `editLabelKey`, `canUpdate` (or per-row via `getRowActions().canUpdate`).
-- **Delete**: `onDelete`, `deleteLabelKey`, `canDelete` (or per-row via `getRowActions().canDelete`), `confirmDeleteTranslationKeyPrefix`, `getDisplayName`, `currentUserId`, `onSelfDelete`.
-- **Per-row overrides**: `getRowActions(row)` can return `{ canView?, canUpdate, canDelete }` (e.g. hide Delete for super admin, allow Edit only for self).
-
-## Adding a new CRUD resource
-
-1. **Routes**: Add `ROUTES.RESOURCE`, `ROUTES.RESOURCE_NEW`, plus `resourceViewRoute(id)` and `resourceEditRoute(id)` in `lib/routes.ts`.
-2. **List page**: `app/(main)/resources/page.tsx` — fetch list, compute crud flags, render `*TableWithFilter` with `canView*, canUpdate*, canDelete*`, `viewRoute`, `viewLabelKey`, `editRoute`, `onDelete`, etc.
-3. **View page**: `app/(main)/resources/[id]/page.tsx` — fetch one by id, require read, show read-only fields and Edit link when update allowed.
-4. **Edit page**: `app/(main)/resources/[id]/edit/page.tsx` — fetch one, require update (or self), render form.
-5. **Create page**: `app/(main)/resources/new/page.tsx` — require create, render form.
-6. **Table component**: e.g. `ResourcesTableWithFilter` — pass `viewRoute`, `viewLabelKey`, `canView`, `editRoute`, `canUpdate`, `canDelete`, `getRowActions` if needed.
-7. **i18n**: Add `resourcesTable.view`, `resourcesTable.edit`, `resourcesTable.delete`, `viewResourceTitle`, etc., in `i18n/originals/en-US.json` (and es).
-
-## References
-
-- `apps/management-web/src/components/ResourceTableWithFilter.tsx` — shared table with View / Edit / Delete.
-- `apps/management-web/src/components/AdminsTableWithFilter.tsx`, `UsersTableWithFilter.tsx` — examples.
-- `apps/management-web/src/lib/main-nav.ts` — `getCrudFlags`, `hasReadPermission`.
-- `apps/management-web/src/lib/routes.ts` — route helpers.
diff --git a/.llm/exports/github-copilot/skills/database-schema-naming/SKILL.md b/.llm/exports/github-copilot/skills/database-schema-naming/SKILL.md
deleted file mode 100644
index 1c47b958..00000000
--- a/.llm/exports/github-copilot/skills/database-schema-naming/SKILL.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: database-schema-naming
-description: Table and column names in this repo use snake_case. Use when adding or changing ORM entities, migrations, or init SQL.
----
-
-
-# Database schema: snake_case
-
-## Rule
-
-**Table names** use **singular** nouns (e.g. `user`, `user_credentials`, `user_bio`, `verification_token`). **Column names** use **snake_case** (e.g. `display_name`, `created_at`, `profile_visibility`).
-
-- **SQL / init scripts** (`infra/k8s/base/db/source/`, `packages/orm`): Define tables in singular and columns in snake_case.
-- **TypeORM entities**: Use camelCase for TypeScript properties. Map to the database with an explicit `name` when they differ:
-  - `@Entity('user')` — table name singular, snake_case.
-  - `@Column({ name: 'display_name', ... })` for property `displayName`.
-  - `@Column({ name: 'profile_visibility', ... })` for property `profileVisibility`.
-  - `@CreateDateColumn({ name: 'created_at' })` for `createdAt`, and similarly for `updated_at`.
-
-If you add a new entity or column without `name`, TypeORM will use the property name as the column name (camelCase), which will not match the schema and will cause runtime errors (e.g. `column "displayName" does not exist`). Always use singular table names and snake_case columns in the DB, and map explicitly in the entity when the property is camelCase.
-
-**Public `id_text` columns** (e.g. `user.id_text`, `bucket.id_text`): SQL type is **`nano_id_v2`** (Postgres domain `VARCHAR(15)` with 9–15 length); ORM properties use **`idText`**; JWT claim **`id_text`**; helpers use `NANO_ID_V2_*` and `isValidNanoIdV2IdText` (aligned with Podverse).
-
-## See also
-
-- **linear-db-migrations** (`.llm/exports/github-copilot/skills/linear-db-migrations/SKILL.md`) when changing migration files, ops bundles, or bootstrap under `infra/k8s/base/db/`.
diff --git a/.llm/exports/github-copilot/skills/documentation-conventions/SKILL.md b/.llm/exports/github-copilot/skills/documentation-conventions/SKILL.md
deleted file mode 100644
index a8565962..00000000
--- a/.llm/exports/github-copilot/skills/documentation-conventions/SKILL.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-name: documentation-conventions
-description: Documentation file naming for the Metaboost repo. Use when creating or modifying docs, README, or markdown.
-version: 1.1.0
----
-
-
-# Documentation Conventions
-
-## Single README
-
-- **One** `README.md` at repository root.
-- **Only one file in the entire repository may be named README** (the root `README.md`). Subdirectories must use descriptive names (e.g. `scripts/github/SCRIPTS-GITHUB.md`, not `README.md`).
-
-## Directory-Specific Docs
-
-Name after the full path from root (uppercase, slashes → hyphens):
-
-- `apps/api/` → `APPS-API.md`
-- `apps/web/` → `APPS-WEB.md`
-- `infra/k8s/` → `INFRA-K8S.md`
-- `packages/ui/` → `PACKAGES-UI.md`
-- `scripts/github/` → `SCRIPTS-GITHUB.md`
-- `.llm/` → `LLM.md`
-
-Pattern: `[FULL-PATH-WITH-HYPHENS].md`. Do not add multiple `README.md` files per directory.
-
-## INDEX.md and plan indexes
-
-- The **only** `INDEX.md` in the repo is `.llm/exports/github-copilot/skills/INDEX.md` (skills quick reference). All other directory overviews use the full-path name (e.g. `INFRA-K8S.md`, `PACKAGES-UI.md`).
-- Plan-set indexes under `.llm/plans/` use `00-overview.md` or `00-master-plan.md`, not INDEX.md or README.md.
diff --git a/.llm/exports/github-copilot/skills/e2e-authz-matrix/SKILL.md b/.llm/exports/github-copilot/skills/e2e-authz-matrix/SKILL.md
deleted file mode 100644
index 30f82790..00000000
--- a/.llm/exports/github-copilot/skills/e2e-authz-matrix/SKILL.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-name: e2e-authz-matrix
-description: Adds authorization matrix coverage to Playwright specs. Use when testing pages with role or ownership rules so tests assert visible, hidden, disabled, and forbidden action states.
-version: 1.0.0
----
-
-
-# E2E AuthZ Matrix
-
-Use this skill for permission-sensitive routes and controls. Current E2E bar: **Confident** (see e2e-crud-state-matrix).
-
-For **permission-gated edit/detail/settings specs**, apply the full **permission actor matrix** process so all actor × outcome permutations are tested (unauthenticated, owner, non-owner with/without permission, non-admin, plus list→edit and Cancel→list). See the **e2e-permission-actor-matrix** skill for the step-by-step process and the reference implementation: web bucket-admin-edit is implemented across the `bucket-admin-edit-*.spec.ts` specs in `apps/web/e2e/` (unauthenticated, bucket-owner, bucket-admin, admin-without-permission, non-admin).
-
-## Required role/ownership matrix
-
-For each protected surface, include at least:
-
-- Unauthenticated user
-- Fully privileged user
-- Restricted user or restricted row/entity condition (owner/self/superadmin cases)
-
-## Required assertions
-
-- Redirect or forbidden behavior for unauthenticated requests.
-- Action visibility differences (`visible` vs `not rendered`) by role.
-- Action interactivity differences (`enabled` vs `disabled`) by role/row state.
-- Forbidden mutation attempts return stable UI feedback (error banner/toast/message) when applicable.
-
-## Management-web specifics
-
-- Prefer row-level assertions in resource tables for `view/edit/delete` action gating.
-- Include superadmin/self-protection behavior when relevant.
-
-## User context in the E2E report
-
-For authZ tests, set the user context so the E2E HTML report shows which role/CRUD permissions are in effect. Call `setE2EUserContext(testInfo, '…')` at the start of each test (see e2e-readability skill). The report will display "User context: <description>" in the test section and summary.
-
-## Completion checklist
-
-- [ ] At least one non-happy-path authZ assertion exists for each permission-sensitive flow touched.
-- [ ] Visibility and disabled-state checks are both present where UI supports both.
-- [ ] No authZ scenario is marked complete with only route-load assertions.
diff --git a/.llm/exports/github-copilot/skills/e2e-crud-state-matrix/SKILL.md b/.llm/exports/github-copilot/skills/e2e-crud-state-matrix/SKILL.md
deleted file mode 100644
index 8398f91f..00000000
--- a/.llm/exports/github-copilot/skills/e2e-crud-state-matrix/SKILL.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-name: e2e-crud-state-matrix
-description: Enforces a strict CRUD and UI-state matrix for Playwright tests in apps/web and apps/management-web. Use when adding or reviewing E2E specs for create/read/update/delete, validation, show/hide, enable/disable, and empty/loading/error branches.
-version: 1.0.0
----
-
-
-# E2E CRUD State Matrix
-
-Use this skill before marking E2E work complete.
-
-## Current E2E bar: Confident
-
-The project targets **Confident** coverage: happy paths and auth boundaries covered; permission matrix on important surfaces (e.g. bucket admin edit, role edit, message edit); URL-state where it matters; deny tests use real seeded resources so breaking permission checks fails the test. Cells in the CRUD/state/auth matrices marked Gap are backlog—fix when touching that feature, not as a single "close all gaps" pass. Matrix checklists: [docs/testing/E2E-CRUD-STATE-AUTH-MATRICES.md](docs/testing/E2E-CRUD-STATE-AUTH-MATRICES.md) (index), [E2E-CRUD-STATE-AUTH-MATRIX-WEB.md](docs/testing/E2E-CRUD-STATE-AUTH-MATRIX-WEB.md), [E2E-CRUD-STATE-AUTH-MATRIX-MANAGEMENT-WEB.md](docs/testing/E2E-CRUD-STATE-AUTH-MATRIX-MANAGEMENT-WEB.md).
-
-## Required matrix per surface
-
-For each tested page/component surface, explicitly track:
-
-- Create
-- Read
-- Update
-- Delete
-- Show/hide controls by state
-- Enable/disable transitions (including submit loading state)
-- Validation (required fields, invalid input, server error text)
-- Empty/loading/error states
-
-## Quality bar
-
-- Prefer deterministic assertions over broad fallback assertions.
-- Do not accept “route loads” as sufficient for edit/delete flows.
-- For update/delete, assert both action result and post-action persistence.
-- For forms, assert button/input state transitions before and after submit.
-
-## Minimum assertion patterns
-
-- **Create**: submit valid form -> redirect/result -> row/detail visible.
-- **Update**: edit field -> save -> revisit list/detail -> updated value visible.
-- **Delete**: confirm dialog path -> row removed; cancel path -> row unchanged.
-- **Validation**: empty/invalid submit -> remains on form -> validation visible.
-- **State branches**: explicit assertions for each reachable empty/loading/error branch.
-
-## Permission-gated surfaces
-
-For edit/detail/settings pages that are gated by ownership or role (bucket admin, bucket role, message edit, management resource edit), also apply the **e2e-permission-actor-matrix** skill so all actor × outcome permutations (unauthenticated, owner, non-owner with/without permission, non-admin) and flow tests (list→edit, Cancel→list) are covered.
-
-## Completion checklist
-
-- [ ] Every modified surface has CRUD row status (`covered` or `deferred`).
-- [ ] Deferred rows include rationale in the active plan/history.
-- [ ] For permission-gated surfaces, actor matrix coverage is applied (see e2e-permission-actor-matrix).
-- [ ] Changed specs pass targeted runs.
-- [ ] Full relevant app E2E run passes.
diff --git a/.llm/exports/github-copilot/skills/e2e-page-tests/SKILL.md b/.llm/exports/github-copilot/skills/e2e-page-tests/SKILL.md
deleted file mode 100644
index 39043352..00000000
--- a/.llm/exports/github-copilot/skills/e2e-page-tests/SKILL.md
+++ /dev/null
@@ -1,117 +0,0 @@
----
-name: e2e-page-tests
-description: When layout, functionality, or conditions change in apps/web or apps/management-web, add or update the corresponding E2E (Playwright) test so page behavior stays covered.
-version: 1.3.4
----
-
-
-# E2E Page Tests (Web and Management-Web)
-
-Testing requirement policy lives in **feature-implementation-testing**. This skill focuses on **how** to add or update E2E coverage for web and management-web changes.
-
-Current E2E bar: **Confident**. Use this skill when you change **layout**, **functionality**, or **conditions** (e.g. redirects, auth checks, visibility, error states) in `apps/web` or `apps/management-web`. Always add or update an E2E test so the change is covered and regressions are caught. **Updating E2E tests is required for functional changes to web or management-web; it must not be treated or listed as optional in plans or implementation reports.**
-
-## When to add or update a test
-
-- **Layout changes** – New or moved sections, nav, headings, or structure on a page.
-- **Functionality changes** – New or changed forms, buttons, links, or user flows (e.g. create bucket, edit message, login).
-- **Condition changes** – New or changed redirects, auth guards, visibility rules, or error/empty states.
-
-For CRUD and permission-gated flows, also apply **e2e-crud-state-matrix** and, for permission-gated pages, **e2e-permission-actor-matrix**.
-For query-param state behavior, also apply **e2e-url-state-contracts**.
-For test-title/step readability and report behavior, also apply **e2e-readability**.
-
-If the change is in **web**, add or update a spec in `apps/web/e2e/`. If it is in **management-web**, add or update a spec in `apps/management-web/e2e/`. When **adding** a new spec file, update the corresponding E2E spec order file so the full report stays in conceptual order (see **e2e-report-order** skill).
-
-**End your response with exact E2E verification commands.** Whenever you add, change, or remove E2E specs or change UI that E2E tests cover, you **MUST** end the response with a fenced `bash` block containing the **EXACT** `make` command(s) the user needs to run to verify the change (e.g. `make e2e_test_web_report_spec SPEC=e2e/settings-bucket-owner.spec.ts`). See **response-ending-make-verify** skill. No exception.
-
-## Deterministic outcome policy (required)
-
-- Each E2E test must have **one deterministic expected outcome** for the mode/config it runs under.
-- **No dual-condition or mode-agnostic tests.** Do not write a single test that accepts "either outcome A or outcome B" (e.g. "either success message or error message") depending on config or env. Such tests hide regressions and violate single-outcome policy.
-- **Do not permit dual outcomes** such as "either error message A or redirect B." Use one assertion path per test.
-- Do not use `Promise.race(...)` or broad regex patterns to accept multiple incompatible outcomes.
-- **Separate spec files per mode (avoid `test.skip()`).** When behavior is mode-dependent (e.g. `ACCOUNT_SIGNUP_MODE=admin_only_username` vs `ACCOUNT_SIGNUP_MODE=admin_only_email` or `user_signup_email`), use **separate spec files per mode** (e.g. `settings-bucket-owner.spec.ts` for default, `settings-bucket-owner-admin-only-email.spec.ts` for admin-only-email) and run each spec only under the config where that outcome is guaranteed. Do **not** use `test.skip()` to gate mode-dependent tests so that "skipped" is not necessary; each file has a single outcome per test and runs in one config.
-- A test should fail when the non-target mode behavior appears.
-
-## Timeout increases are almost never the fix (required)
-
-- Do **not** resolve failing or flaky E2E tests by increasing timeout values (`test.setTimeout(...)`, `test.slow()`, Playwright `timeout`, `expect.timeout`, or per-call `{ timeout: ... }`) as the first response.
-- In nearly all cases, timeout failures indicate a readiness, determinism, or assertion issue, not that tests should simply wait longer.
-- Fix root cause first:
-  - add explicit destination-load verification after navigation (URL and destination-specific visible element),
-  - assert the specific success/error state tied to the user action,
-  - use deterministic setup data (especially for one-time tokens and links),
-  - remove arbitrary sleeps in favor of condition-based waits.
-- If a timeout increase is truly unavoidable, treat it as a rare exception: document why inline in the spec and keep the increase minimal.
-
-## Where tests live
-
-| App                 | Specs directory            | Config                                         |
-| ------------------- | -------------------------- | ---------------------------------------------- |
-| apps/web            | `apps/web/e2e/`            | `apps/web/playwright.config.ts` (default)      |
-| apps/web (signup)   | `apps/web/e2e/`            | `apps/web/playwright.signup-enabled.config.ts` |
-| apps/management-web | `apps/management-web/e2e/` | `apps/management-web/playwright.config.ts`     |
-
-- **Default web E2E** uses `ACCOUNT_SIGNUP_MODE=admin_only` (signup disabled). For signup-enabled auth flows (signup, forgot-password, reset-password), use `make e2e_test_web_signup_enabled`; it starts Mailpit via `infra/docker/e2e/docker-compose.yml` and uses the signup-enabled config. `make test_clean` removes Mailpit with other test containers. See [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md) (“E2E and ACCOUNT_SIGNUP_MODE”).
-- Use the **deterministic E2E seed** for data (e.g. `e2e-bucket-owner@example.com` / `Test!1Aa` for web bucket-owner; management-web login is by username `e2e-superadmin` and password `Test!1Aa`). See [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md).
-- **API gate**: E2E Make targets run API integration tests first; if they fail, Playwright does not run.
-- **Current startup model**: Playwright `webServer` now auto-starts the required API + web apps on dedicated E2E ports in production-like mode (`build` + `start`), so manual app startup is not part of normal E2E runs.
-
-## Rate limiting and auth in E2E
-
-- **Rate limiting disabled in test**: In test, rate limits are effectively disabled (very high limit) so E2E and API integration tests never hit 429. Do not add tests (E2E or API) that assert rate-limit behavior (e.g. 429 after N requests); see api-testing skill.
-
-## Placeholder plans
-
-Page-level coverage is tracked in `.llm/plans/active/e2e-page-tests/` (e.g. `web-03-dashboard.md`, `mgmt-06-bucket-detail.md`). When you add or expand a test for a page, consider updating the corresponding placeholder with the new scenarios or marking it as implemented.
-
-## Quick reference
-
-- **Default execution strategy (agent/sandbox):** use the leanest E2E command that validates the change first (single spec/report-spec target), then broaden only when required.
-- **Most targeted web E2E run:** `make e2e_test_web_report_spec SPEC=e2e/<spec>.spec.ts`
-- **Most targeted management-web E2E run:** `make e2e_test_management_web_report_spec SPEC=e2e/<spec>.spec.ts`
-- **Run E2E (web only):** `make e2e_test_web`
-- **Run E2E (management-web only):** `make e2e_test_management_web`.
-- **Run E2E (both):** `make e2e_test`.
-- **Run report-focused home smoke (auto-opens HTML reports, captures step screenshots):** `make e2e_test_home_report`.
-- **Signup-enabled web E2E** (signup + forgot/reset auth pages; starts Mailpit, report to `web-signup-enabled/`): `make e2e_test_web_signup_enabled`.
-- **Admin-only-email web E2E (scoped report):** `make e2e_test_web_admin_only_email_report_spec SPEC=e2e/<spec>.spec.ts` (e.g. `SPEC=e2e/settings-bucket-owner-admin-only-email.spec.ts`). Full suite: `make e2e_test_web_admin_only_email`.
-- **Docs:** [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md).
-
-Report mode uses a custom reporter (`scripts/e2e-html-steps-reporter.ts`) so each
-step screenshot is shown with its full "Step description" in an expandable block
-directly below the image; when the capture helper attaches a "Step URL", the report
-shows that URL in the same block. The report UI includes a fixed top-right indicator
-showing which test you are viewing (e.g. 3 / 12) and fixed bottom-right nav (prev/next
-test, shot, error).
-
-### Report title and meta title (required)
-
-Every E2E HTML report must use a **descriptive title** in the page heading and `<title>` (browser tab), not a generic label like "E2E step report". The required pattern is:
-
-- **Web (default or scoped):** `E2E Web Report - e2e/<spec>.spec.ts` (or comma-separated spec paths when multiple).
-- **Web admin-only-email:** same pattern; output dir must be `web-admin-only-email` so the reporter uses the Web Report title and appends `E2E_REPORT_SPEC`.
-- **Web signup-enabled:** `E2E Web Report – ACCOUNT_SIGNUP_MODE=user_signup_email, MAILER_ENABLED=true` with optional ` - e2e/<spec>...` when scoped.
-- **Management-web:** `E2E Management Web Report - e2e/<spec>.spec.ts`.
-
-The reporter derives the title from `PLAYWRIGHT_HTML_OUTPUT_DIR` (must end with one of: `web`, `web-admin-only-email`, `web-signup-enabled`, `management-web`) and `E2E_REPORT_SPEC` (spec path or comma-separated list). When adding or changing Make report targets, always set `E2E_REPORT_SPEC` and use one of these output dirs so the generated report has the correct heading and meta title.
-
-## Screenshot naming policy (QA-readable)
-
-When adding or updating screenshot steps in E2E specs:
-
-- Use `actionAndCapture` / `capturePageLoad` from `e2e/helpers/stepScreenshots`.
-- Keep screenshot capture report-focused (`E2E_STEP_SCREENSHOTS=true` runs such as `e2e_test_home_report`).
-- **Use very descriptive step labels** that explain expected visible UI outcome, not short action codes.
-- Prefer long, explicit labels over short ambiguous labels so QA can infer expected state from filename alone.
-
-Good label examples:
-
-- `User navigates to the home route and is redirected to the login page for an unauthenticated session.`
-- `The dashboard screen is visible with the primary heading after successful login.`
-
-Avoid labels like:
-
-- `goto-home`
-- `click-login`
diff --git a/.llm/exports/github-copilot/skills/e2e-permission-actor-matrix/SKILL.md b/.llm/exports/github-copilot/skills/e2e-permission-actor-matrix/SKILL.md
deleted file mode 100644
index 1d4fa8a5..00000000
--- a/.llm/exports/github-copilot/skills/e2e-permission-actor-matrix/SKILL.md
+++ /dev/null
@@ -1,76 +0,0 @@
----
-name: e2e-permission-actor-matrix
-description: Apply the thorough CRUD permission permutation test process to E2E specs. Use when adding or aligning tests for permission-gated pages (edit/detail/settings) so all actor × outcome permutations and key flows are covered.
-version: 1.0.0
----
-
-
-# E2E Permission Actor Matrix
-
-Current E2E bar: **Confident**. Use this skill when implementing or reviewing E2E tests for any permission-gated surface (bucket admin edit, role edit, message edit, settings, management resource edit/detail, etc.). The goal is to bring every such spec into alignment with the same thorough, CRUD-permutation approach used in the web bucket-admin-edit specs.
-
-## Reference implementation
-
-- **Specs (web, split by actor):** The actor × outcome matrix for bucket-admin-edit is implemented across [bucket-admin-edit-unauthenticated.spec.ts](apps/web/e2e/bucket-admin-edit-unauthenticated.spec.ts), [bucket-admin-edit-bucket-owner.spec.ts](apps/web/e2e/bucket-admin-edit-bucket-owner.spec.ts), [bucket-admin-edit-bucket-admin.spec.ts](apps/web/e2e/bucket-admin-edit-bucket-admin.spec.ts), [bucket-admin-edit-admin-without-permission.spec.ts](apps/web/e2e/bucket-admin-edit-admin-without-permission.spec.ts), and [bucket-admin-edit-non-admin.spec.ts](apps/web/e2e/bucket-admin-edit-non-admin.spec.ts). Together they cover unauthenticated, owner, admin with permission, admin without permission, and non-admin.
-- **Pattern:** API/source-of-truth → actor matrix table → seed + login helpers → tests per actor × outcome + flow tests (one spec per actor or combined as needed).
-
-## Process (apply to each permission-gated spec)
-
-### 1. Establish API/source of truth
-
-- Identify the permission policy (e.g. `canManageBucketAdmins`, bucket/role/message CRUD bits).
-- Document which actors can perform which actions (e.g. owner vs non-owner-admin with/without permission vs non-admin).
-- Note how the app treats API responses (e.g. 403 → not found).
-
-### 2. Define the actor matrix
-
-Build a table of **actors** × **expected outcome** when opening or acting on the page:
-
-- **Unauthenticated** → redirect to login.
-- **Fully privileged** (e.g. owner, superadmin) → can open; read-only vs editable by row/target as per policy.
-- **Privileged non-owner** (e.g. admin with permission) → same as owner where policy allows; otherwise not found/forbidden.
-- **Restricted** (e.g. admin without permission, or non-admin) → not found or forbidden (match API behavior).
-
-Add rows for **target** × **actor** where relevant (e.g. edit owner row → read-only; edit other admin → form with Save; invalid id → not found).
-
-### 3. Seed and login helpers
-
-- Ensure E2E seed (or test data) includes all required actors: owner, non-owner with permission, non-owner without permission, non-admin (or management equivalents).
-- Provide login helpers per role (e.g. `loginAsWebE2EUserAndExpectDashboard`, `loginAsWebE2EAdminWithPermission`, `loginAsWebE2EAdminWithoutPermission`, `loginAsWebE2ENonAdmin`).
-- Use `setE2EUserContext(testInfo, '…')` at the start of each test so the report shows which role is in effect.
-
-### 4. Implement tests
-
-- **Unauthenticated:** redirect to login (e.g. `expectUnauthedRouteRedirectsToLogin`).
-- **Owner / fully privileged:** happy path (open edit, read-only for owner row, form for other row), invalid id → not found.
-- **Non-owner with permission:** open edit on owner row → read-only (or not found if API does not return owner); open edit on self/other → form; invalid id → not found.
-- **Non-owner without permission:** open edit (any target) → not found (e.g. `expectInvalidRouteShowsNotFound`).
-- **Non-admin:** open edit (any target) → not found.
-- **Flow tests:** list → edit navigation; Cancel → list; Save → list and persistence where applicable.
-
-Use existing helpers: `expectInvalidRouteShowsNotFound`, `actionAndCapture`, `capturePageLoad`, `setE2EUserContext`.
-
-### 5. Quality bar
-
-- Every actor in the matrix has at least one test that asserts the expected outcome.
-- Invalid or forbidden targets (invalid id, wrong permission) assert not found or equivalent stable UI.
-- Navigation flows (list→edit, Cancel→list) are covered for at least one privileged actor.
-- No permission-sensitive scenario is marked done with only "route loads" or a single-actor test.
-
-## Cross-reference
-
-- **e2e-crud-state-matrix:** CRUD and UI-state coverage (create/read/update/delete, validation, empty/loading/error).
-- **e2e-authz-matrix:** Role/ownership visibility and disabled states; use together with this skill for full coverage.
-- **e2e-readability:** Verbose step names and `setE2EUserContext` for report clarity.
-
-## Completion checklist (per spec)
-
-- [ ] API/source-of-truth behavior documented or referenced.
-- [ ] Actor matrix table defined (actors × outcomes).
-- [ ] Seed data and login helpers exist for all actors.
-- [ ] Unauthenticated test present.
-- [ ] Each privileged actor has tests for allowed and disallowed targets.
-- [ ] Restricted actors (no permission / non-admin) get not found or forbidden.
-- [ ] List→edit and Cancel→list (and Save→list where relevant) covered.
-- [ ] Invalid id (or equivalent) → not found for at least one privileged actor.
-- [ ] Targeted spec run passes; no regression in full app E2E.
diff --git a/.llm/exports/github-copilot/skills/e2e-readability/SKILL.md b/.llm/exports/github-copilot/skills/e2e-readability/SKILL.md
deleted file mode 100644
index 46fd1dee..00000000
--- a/.llm/exports/github-copilot/skills/e2e-readability/SKILL.md
+++ /dev/null
@@ -1,125 +0,0 @@
----
-name: e2e-readability
-description: E2E specs use verbose complete sentences and explicit post-navigation verification; report keeps redirect-to-login summary-only and hides only non-validating navigation screenshots.
-version: 1.2.0
----
-
-
-# E2E Readability and Report Behavior
-
-Use this skill when adding or editing E2E specs in `apps/web/e2e/` or `apps/management-web/e2e/`. Test titles and step labels use complete sentences; the only exception is the **suite-level describe**, which uses a concise title-like phrase (see Describe blocks).
-
-## Describe blocks
-
-**Suite-level describe** (the top-level block that states what the suite verifies): use a **concise, title-like** descriptor, not a full sentence. This is the one place where a short phrase is preferred. **Nested describe blocks, test titles, and step labels** keep **verbose sentence-style** (see Test titles and Step labels below). This convention applies to both `apps/web/e2e` and `apps/management-web/e2e`.
-
-- Good: "Home page for the unauthenticated user"
-- Good: "Dashboard for non-admin users"
-- Avoid (for suite-level): "This suite verifies the home page for the unauthenticated user."
-- **Non-default auth mode:** If the suite runs in a non-default auth mode, end the title with the mode in parentheses. Do not use the word "mode". Default is `admin_only_username` (no suffix). Use `(admin_only_email)` or `(user_signup_email)` only when the spec is run with that config. Examples: "Reset-password page (admin_only_email)", "Signup page (user_signup_email)".
-
-**Nested describe blocks** (feature or group): use a clear full-sentence or phrase for the feature.
-
-- Good: "Creating a new child bucket under an existing bucket"
-- Avoid: "Bucket child new"
-
-## Test titles
-
-Use **complete, verbose sentences**. Prefer "When … , they/he/she …" for readability.
-
-- Good: "When an unauthenticated user tries to open the page to create a new child bucket, they are redirected to the login page."
-- Good: "When an authenticated user opens the page to create a new child bucket, they see the create form with a name field and a submit button."
-- Avoid: "unauthenticated user is redirected to login", "authenticated user sees child bucket create form"
-
-## Step labels
-
-Use **full sentences** for the third argument to `capturePageLoad`, `actionAndCapture`, and `expectUnauthedRouteRedirectsToLogin`, and keep compound terms consistent with titles.
-
-- Good: "User navigates to the admin-edit-route for the bucket-owner's user id and sees not found."
-- Good: "The bucket-admin-edit-form is visible for the bucket-admin."
-- Avoid: mixing hyphenated compound terms in one section and space-separated terms in another for the same concept.
-
-The reporter preserves step labels as authored, including hyphenated compound terms.
-
-## Post-navigation verification (required)
-
-Every navigation action in E2E tests must be followed by explicit verification that the destination loaded correctly. **Checking only that the URL changed is not enough:** you must verify that at least one expected element on the destination page has loaded (e.g. heading, form field, table, CTA). Otherwise the test (or a step screenshot) may pass while the new page is still loading or not yet rendered.
-
-- Applies to `page.goto(...)`, route-changing link/button clicks, and helper-driven navigation.
-- After navigation, assert **both**:
-  - URL assertion (`toHaveURL(...)`), and
-  - at least one destination-specific element visibility (`toBeVisible()` on heading, form field, table, CTA, etc.).
-- Do not rely only on "absence" assertions right after navigation (for example, only checking a value is missing). Add a positive destination-load assertion first.
-- **When using `actionAndCapture` for a navigation step** (e.g. click a link, then capture): perform the URL assertion and the element visibility assertion **inside** the callback, so the screenshot is taken only after the destination page has loaded. If you assert only after the callback, the screenshot may show the previous page or a loading state.
-- For shared helpers that navigate (for example login helpers), include the destination-load verification inside the helper.
-
-## Redirect-to-login tests
-
-Tests that assert an unauthenticated user is redirected to the login page appear **only in the Test summary** at the top of the E2E HTML report; they are not shown in the "Screenshots and step descriptions" section (to avoid repetitive content). When adding such tests, use a title that clearly indicates redirect to login (e.g. contains "redirected to the login page") so the reporter keeps them summary-only.
-
-## Navigation screenshot filtering in report
-
-The reporter hides **image only** (not step text) for navigation-only, non-validating steps when the same test has a later validation/evidence step.
-
-- Keep the step row and authored step description visible in the report.
-- Hide only the screenshot image for navigation-only setup steps.
-- Keep screenshots for validation/evidence steps.
-- This uses step-label patterns plus same-test local context to avoid over-filtering.
-- Redirect-to-login summary-only behavior remains unchanged.
-
-## Error-state screenshot ordering (required)
-
-When a test step expects an error-like result (validation error, invalid credentials, not found, invalid token, or unauth redirect), capture screenshots only after that outcome is verified.
-
-- For `actionAndCapture(...)`, place error-like assertions inside the callback so capture happens after verification.
-- For helper wrappers (for example invalid-route and unauth-redirect helpers), verify the expected error-like state inside the wrapped callback before the screenshot is taken.
-- Acceptable post-action verification includes:
-  - explicit error/validation/not-found text visibility,
-  - redirect target verification plus destination UI evidence (for example login form fields).
-- Avoid taking screenshots immediately after navigation or submit when the expected error-like state has not yet been asserted.
-
-## User context in reports
-
-Every test that has a defined user (unauthenticated or a specific role) should set the **user-role** annotation so the E2E HTML report shows **User context** for that test. Call `setE2EUserContext(testInfo, description)` at the start of each test (from `./helpers/userContext`).
-
-**Pattern:** Use **role** or **role (permissions)**. Be consistent so the reporter can apply a dedicated color.
-
-**Web app:** Only **unauthenticated**, **basic-user**, **bucket-owner**, and **bucket-admin** (web has no "admin" role). For limited-permission bucket admins use the **same resource/level notation** as management-web inside parentheses: full CRUD = resource name only; read-only = `resource:R`; no access = `resource:-`. Web resources (bucket-scoped): settings, roles, messages, admins, bucket, bucket_create. Examples: `bucket-admin (settings:- roles:- messages:- admins:-)`, `bucket-admin (bucket:R bucket_create:-)`.
-
-**Management-web:** Use **super-admin** for the super-admin identity. For all other management users use **admin (…)** with abbreviated permission notation: full CRUD = resource name only (e.g. `admins`, `users`); read-only = `resource:R` (e.g. `buckets:R`). Examples: `admin (admins users events:own)`, `admin (buckets:R bucket_admins events:all_admins)`. Do not use "limited-admin", "admin with X", or "admin without X" as the role name.
-
-- Good: `super-admin`, `admin (admins users events:own)`, `bucket-owner`, `unauthenticated`
-- Avoid: `super-admin`, `limited-admin (users read)`, `admin with bucketAdminsCrud`
-
-The report then shows "User context: <description>" in each test section and in the summary.
-
-## Seeded user role naming
-
-When a test refers to a **specific seeded user role**, use consistent names so "user" vs "owner user" is unambiguous:
-
-- **bucket-owner** — the seeded user who owns the bucket (web: e2e-bucket-owner@example.com). In code/comments: `bucketOwner`.
-- **bucket-admin** — the seeded user who is a bucket admin but not the owner (web: e2e-bucket-admin@example.com). In code/comments: `bucketAdmin`.
-- **super-admin** — management-web: e2e-superadmin. In code/comments: `superAdmin`.
-
-Avoid "seeded owner user" (prefer bucket-owner) and "seeded non-owner-admin" (prefer bucket-admin) so the role is clear.
-
-## Hyphens for compound concepts in titles and step labels
-
-In **test titles and step labels**, use **hyphens between words** for compound terms that represent one thing. Joining words that refer to a single concept (routes, pages, forms, seeded identities) makes it clearer what is being asserted when reading the report.
-
-- Apply this consistently across **all** specs in both `apps/web/e2e` and `apps/management-web/e2e`.
-- **Routes:** admin-edit-route, bucket-admin-edit-route (not "admin edit route" with spaces).
-- **Pages:** bucket-admin-edit-page, admin-edit-page (not "bucket admin edit page").
-- **Forms:** bucket-admin-edit-form (not "bucket admin edit form").
-- **Seeded identities:** bucket-owner, bucket-admin, super-admin (not "seeded bucket owner").
-- **Other single concepts:** bucket-admin-permissions when referring to one thing.
-
-Example: "When the user opens the admin-edit-route with the bucket-owner's user id, they see not found." In variable names and constant comments in code, use camelCase (e.g. `bucketOwner`).
-
-## Screenshot shows verified element
-
-When a step documents verification of a **specific element** (e.g. a row, form, or control state), pass that element to the capture helper so the screenshot is taken with it vertically centered. See the **e2e-screenshot-verified-element** skill.
-
-## Reference
-
-See [apps/web/e2e/bucket-nested-new.spec.ts](apps/web/e2e/bucket-nested-new.spec.ts) for the canonical pattern. Reporter logic: [scripts/e2e-html-steps-reporter.ts](scripts/e2e-html-steps-reporter.ts) (`isRedirectToLoginTest`).
diff --git a/.llm/exports/github-copilot/skills/e2e-report-order/SKILL.md b/.llm/exports/github-copilot/skills/e2e-report-order/SKILL.md
deleted file mode 100644
index cd54466f..00000000
--- a/.llm/exports/github-copilot/skills/e2e-report-order/SKILL.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-name: e2e-report-order
-description: Maintain E2E spec order for full reports and respect parameter order for specified runs.
-version: 1.0.0
----
-
-
-# E2E Report Order
-
-Use this skill when working with E2E report ordering: full-suite reports (`make e2e_test_report`) or scoped runs with `SPEC` / `WEB_SPEC` / `MGMT_SPEC`.
-
-## 1. Full report: one per web auth mode + management-web
-
-The full E2E report (`make e2e_test_report`) produces **four** HTML reports (four browser tabs when opened):
-
-1. **Web (default)** — `ACCOUNT_SIGNUP_MODE=admin_only_username`; report dir `web/`.
-2. **Web signup-enabled** — `ACCOUNT_SIGNUP_MODE=user_signup_email`, Mailpit; report dir `web-signup-enabled/`.
-3. **Web admin-only-email** — `ACCOUNT_SIGNUP_MODE=admin_only_email`; report dir `web-admin-only-email/`.
-4. **Management-web** — report dir `management-web/`.
-
-**When adding a new web auth mode**: Add a Playwright config (e.g. `playwright.<mode>.config.ts`), a spec-order file if needed (e.g. `e2e-spec-order-web-<mode>.txt`), and include the new run in both `e2e_test_report` and `e2e_test` in `makefiles/local/Makefile.local.e2e.mk` (new report dir, npm run with the new config, echo/open, and exit check). Update `scripts/e2e-html-steps-reporter.ts` so the new output dir gets a distinct report title.
-
-## 2. Master order for full report
-
-The full E2E report displays tests in **conceptual order** so the HTML report is easier to review (e.g. home first, then buckets list/detail/settings, then events/users/admins). Playwright may run spec files in its own order (e.g. alphabetical); when `E2E_SPEC_ORDER` is set (as the Makefile does from the order files), the custom HTML reporter reorders `this.runs` for display so the report reflects the intended order.
-
-- **Order files** (single source of truth):
-  - `makefiles/local/e2e-spec-order-web.txt` — one spec path per line (e.g. `e2e/home-unauthenticated.spec.ts`) for apps/web (default).
-  - `makefiles/local/e2e-spec-order-web-admin-only-email.txt` — same for apps/web admin-only-email mode.
-  - `makefiles/local/e2e-spec-order-management-web.txt` — same for apps/management-web.
-- **When adding a new E2E spec**: Add it to the appropriate order file in the **right conceptual place** (e.g. home specs first, then buckets list, bucket detail, bucket settings, bucket messages, bucket admin edit, etc.). Do not append at the end unless that is the right place; insert in the logical group.
-- **When removing a spec**: Remove its line from the corresponding order file so the full report does not reference a missing file.
-- **Comments**: Lines starting with `#` and blank lines in the order files are ignored when building the spec list.
-
-## 3. Specified runs (parameter order)
-
-When running one or more specs via `e2e_test_web_report_spec`, `e2e_test_management_web_report_spec`, or `e2e_test_report_scoped` with multiple comma-separated paths:
-
-- The Makefile sets `E2E_SPEC_ORDER` from the parameter (comma → semicolon); the reporter reorders runs for display so the report shows tests in **the same order as the parameter** (SPEC, WEB_SPEC, or MGMT_SPEC), even if Playwright runs specs in a different order.
-- **Do not sort or reorder** the spec list when suggesting or generating make commands. Pass specs in the order the user or scenario expects for review.
-
-## Reference
-
-- Order semantics are documented in [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md) under "Report order".
-- The custom reporter (`scripts/e2e-html-steps-reporter.ts`) reads `E2E_SPEC_ORDER` (semicolon-separated spec paths) in `onEnd` and sorts `this.runs` by that order before generating the HTML, so report display matches the intended order regardless of Playwright execution order.
diff --git a/.llm/exports/github-copilot/skills/e2e-screenshot-verified-element/SKILL.md b/.llm/exports/github-copilot/skills/e2e-screenshot-verified-element/SKILL.md
deleted file mode 100644
index 3cf5b4ae..00000000
--- a/.llm/exports/github-copilot/skills/e2e-screenshot-verified-element/SKILL.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-name: e2e-screenshot-verified-element
-description: When an E2E test verifies a specific element, pass it to the capture helper so the step screenshot is taken with that element vertically centered.
-version: 1.0.0
----
-
-
-# E2E Screenshot: Center Verified Element
-
-Use this skill when adding or editing E2E specs in `apps/web/e2e/` or `apps/management-web/e2e/` when the test verifies a specific element (visibility, content, state, or absence of a control) and then takes a step screenshot.
-
-## Rule
-
-When the goal of the step is to document verification of a **specific element**, pass that element as the optional `scrollToElement` argument to `capturePageLoad` or `actionAndCapture` so the screenshot is taken with that element **vertically centered** in the viewport. This makes the report show what was actually asserted.
-
-## Examples
-
-- Test asserts "owner row has no delete button" then captures → pass the owner row locator as the 4th argument to `capturePageLoad(page, testInfo, label, ownerRow)`.
-- Test performs an action then asserts on a specific table or form and captures → pass that table/form locator to `actionAndCapture(page, testInfo, label, action, scrollToElement)`.
-
-## When not to pass
-
-Generic "page loaded" or "navigation completed" captures with no single asserted element do not need `scrollToElement`; leave the parameter omitted.
diff --git a/.llm/exports/github-copilot/skills/e2e-url-state-contracts/SKILL.md b/.llm/exports/github-copilot/skills/e2e-url-state-contracts/SKILL.md
deleted file mode 100644
index 216aa2f3..00000000
--- a/.llm/exports/github-copilot/skills/e2e-url-state-contracts/SKILL.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-name: e2e-url-state-contracts
-description: Enforces URL-state contract tests for sortable/filterable pages in Playwright. Use when pages support search, sort, filters, pagination, or tab query params.
-version: 1.0.0
----
-
-
-# E2E URL State Contracts
-
-Current E2E bar: **Confident**. Use this skill for pages with query-param state.
-
-Apply this alongside **e2e-page-tests** for page-behavior coverage, and alongside **e2e-crud-state-matrix** when URL-state behavior affects CRUD list/detail flows.
-
-## Contract checklist
-
-- [ ] Supports expected params (`search`, `sortBy`, `sortOrder`, `page`, `tab`, etc.).
-- [ ] Preserves explicit params on load.
-- [ ] Applies canonicalization rules consistently (no unstable URL drift).
-- [ ] Back/forward navigation keeps user-visible state aligned with URL.
-- [ ] Defaults are not redundantly forced into URL unless product behavior requires it.
-
-## Assertion guidance
-
-- Parse `new URL(page.url())` and assert pathname + relevant params exactly.
-- Assert visible table/list state that corresponds to URL state (not URL alone).
-- For canonicalized routes, assert accepted canonical patterns explicitly.
-
-## Avoid
-
-- Overly permissive URL regexes that allow unintended params.
-- Assertions that only check the page heading after navigation.
-
-## Completion checklist
-
-- [ ] At least one query-param contract test per modified sortable/filterable surface.
-- [ ] Contract tests included in targeted and full E2E verification runs.
-- [ ] Companion page-behavior assertions are covered in the relevant e2e-page-tests spec.
diff --git a/.llm/exports/github-copilot/skills/feature-implementation-testing/SKILL.md b/.llm/exports/github-copilot/skills/feature-implementation-testing/SKILL.md
deleted file mode 100644
index baa9d0c6..00000000
--- a/.llm/exports/github-copilot/skills/feature-implementation-testing/SKILL.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-name: feature-implementation-testing
-description: When creating or implementing plans for features that touch api, management-api, web, or management-web, include the corresponding tests—integration tests for api/management-api and E2E tests for web/management-web.
-version: 1.0.0
----
-
-
-# Feature Implementation Testing Requirement
-
-When **creating or implementing plans** for features that touch `apps/api`, `apps/management-api`, `apps/web`, or `apps/management-web`, adding or updating the corresponding tests is a **requirement**, not optional.
-
-**Terminology:** **Integration tests** = api/management-api (Vitest, no browser). **E2E tests** = web/management-web (Playwright, browser).
-
-## Requirement by app
-
-- **api / management-api**: Add or update **integration tests** (see **api-testing**). If the change affects UI in web or management-web, also add or update the relevant **E2E tests** (see **e2e-page-tests**).
-- **web / management-web**: Add or update **E2E tests** (see **e2e-page-tests**, **e2e-crud-state-matrix**, **e2e-permission-actor-matrix** as applicable).
-
-## When this applies
-
-- Implementing a plan file that touches any of the four apps.
-- Implementing a feature (with or without a plan) that makes meaningful changes to api, management-api, web, or management-web.
-
-## Planning vs implementation
-
-- **Plan creation phase:** Do not implement product code or tests. Include explicit testing work in the plan steps (integration tests for api/management-api changes, E2E tests for web/management-web changes).
-- **Implementation phase:** Add or update the actual test files as required by this policy.
-
-Apply the relevant skill for _how_ to write the tests (api-testing for integration tests, e2e-page-tests and related E2E skills for Playwright specs). For URL-state behavior and E2E readability conventions, also see **e2e-url-state-contracts** and **e2e-readability**.
diff --git a/.llm/exports/github-copilot/skills/focus-outline-visible/SKILL.md b/.llm/exports/github-copilot/skills/focus-outline-visible/SKILL.md
deleted file mode 100644
index 73ab8220..00000000
--- a/.llm/exports/github-copilot/skills/focus-outline-visible/SKILL.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-name: focus-outline-visible
-description: Ensure the entire focus indicator is visible for buttons and button-like focusable elements; use padding + reverse margin when layout must stay unchanged.
-version: 1.0.0
----
-
-
-# Focus outline visibility
-
-**When to use:** When adding or changing buttons, links, tabs, or any focusable (clickable) component in `@metaboost/ui` or app code that receives keyboard focus and shows a focus ring.
-
-## Rule
-
-Every button and button-like component or element that can receive focus must have enough space around it so that when it has focus, the **entire** focus indicator is visible (not clipped).
-
-- Focus rings typically use `outline` + `outline-offset` (or box-shadow). The ring extends **outside** the element by `$focus-outline-width + $focus-outline-offset` (see `packages/ui/src/styles/_variables.scss`), usually 4px.
-- Any parent with `overflow: hidden`, `overflow: auto`, or `overflow: scroll` can clip that ring.
-- **Fix:** Give the container that has overflow enough **padding** (or give the focusable enough **margin**) so the ring has room—at least `$focus-outline-width + $focus-outline-offset` in each direction that could clip.
-
-### Keeping page spacing unchanged (reverse margin)
-
-When you need the **resulting spacing on the page to stay the same** but still need room inside the scroll/overflow container for the focus ring:
-
-1. Add **padding** to the scroll/overflow container: `padding: ($focus-outline-width + $focus-outline-offset) 0;` (vertical) or the same for horizontal as needed.
-2. Add an **equal negative margin** to the same element: `margin: -($focus-outline-width + $focus-outline-offset) 0;`.
-
-Effect: the focusable content has internal room so the outline is not clipped; the negative margin pulls the block back so the row/section does not take up extra space and the page layout looks the same. Use this for horizontal tab rows in a scroll wrapper, or any overflow container where visual spacing must be preserved.
-
-## Checklist
-
-- Does this component or its wrapper use overflow (hidden/auto/scroll)? If yes, is the focus ring fully visible when focused?
-- If the ring is clipped, add padding (and optionally reverse margin) so the ring is not clipped.
-- For new focusable components, ensure containers that use overflow leave room for the focus ring (padding or margin at least `$focus-outline-width + $focus-outline-offset`).
diff --git a/.llm/exports/github-copilot/skills/generate-data-sync/SKILL.md b/.llm/exports/github-copilot/skills/generate-data-sync/SKILL.md
deleted file mode 100644
index 120baa88..00000000
--- a/.llm/exports/github-copilot/skills/generate-data-sync/SKILL.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-name: generate-data-sync
-description: Keeps tools/generate-data seeders and docs in sync when main or management DB schema or ORM entities change. Use when adding or changing tables/entities in packages/orm, packages/management-orm, or infra database migrations.
----
-
-
-# Generate-data sync
-
-When the main or management database schema or ORM entities change, update the generate-data tool so
-seeded test data stays aligned.
-
-## When to use
-
-- Adding or changing tables in canonical SQL under `infra/k8s/base/db/source/`.
-- Adding or changing entities in `packages/orm` or `packages/management-orm`.
-
-## Steps
-
-1. **Decide what to seed**  
-   New or changed core domain tables (e.g. user-related, admin-related) should usually get seed
-   logic. Skip internal/auth-only tables (e.g. refresh_token, verification_token) unless tests need
-   them.
-
-2. **Update seeders**
-   - Main: `tools/generate-data/src/main/seed.ts` – add or update entities in dependency order;
-     respect FKs; use `@faker-js/faker` for appropriate fields; use bcrypt for password hashes where
-     applicable.
-   - Management: `tools/generate-data/src/management/seed.ts` – same; never set `is_super_admin:
-true` for seeded rows.
-
-3. **Update docs**  
-   Edit `tools/generate-data/TOOLS-GENERATE-DATA.md` so the “What gets seeded” section lists the
-   new or changed tables/entities.
-
-4. **Schema naming**  
-   Follow **database-schema-naming**: snake_case columns, singular table names; entity `name`
-   mapping where property is camelCase.
-
-## References
-
-- Main schema: `infra/k8s/base/db/source/app/0001_app_schema.sql`
-- Management schema: `infra/k8s/base/db/source/management/0001_management_schema.sql`
-- Seeders: `tools/generate-data/src/main/seed.ts`, `tools/generate-data/src/management/seed.ts`
-
-## See also
-
-- **linear-db-migrations** (`.llm/exports/github-copilot/skills/linear-db-migrations/SKILL.md`) for migration layout, ops bundle sync, and runners; [docs/development/DB-MIGRATIONS.md](../../docs/development/DB-MIGRATIONS.md) for the full runbook.
diff --git a/.llm/exports/github-copilot/skills/global/SKILL.md b/.llm/exports/github-copilot/skills/global/SKILL.md
deleted file mode 100644
index 99edbd46..00000000
--- a/.llm/exports/github-copilot/skills/global/SKILL.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-name: global
-description: Global patterns for the Metaboost repo (API + Next.js app). Use when starting work in the repo or when applying repo-wide code quality, structure, or plan/history conventions.
-version: 1.1.1
----
-
-
-# Global Patterns
-
-## Structure
-
-- **API**: `apps/api/` – Standalone Express HTTP API
-- **Web**: `apps/web/` – Next.js app
-- **Sidecar**: `apps/web/sidecar/` – Runtime-config server for the Next.js app
-
-## TypeScript
-
-- Extend `tsconfig.base.json` in apps. Use ESM (NodeNext). Avoid type assertions (`as`) when a better approach exists.
-- Prefer **named exports**; avoid `export default` in ordinary modules when a named export works. See **.llm/exports/github-copilot/skills/prefer-named-exports/SKILL.md** (Next.js `page` defaults excepted).
-
-## Plan Management
-
-- Plans go in `.llm/plans/active/` (not `.cursor/plans/`).
-- **300 line limit** per plan. Split into sub-plans in the same directory if larger.
-
-## Documentation
-
-- Documentation naming rules are canonical in **.llm/exports/github-copilot/skills/documentation-conventions/SKILL.md**.
-
-## LLM History
-
-- Follow **.llm/exports/github-copilot/skills/llm-history/SKILL.md** as the canonical history process (timing, format, and split rules).
-- See `.llm/LLM.md` for the full system documentation.
-
-## Code Quality
-
-- **Import path casing:** Relative import paths must match the exact casing of files and directories on disk so builds pass on Linux/CI. See **.llm/exports/github-copilot/skills/path-casing-imports/SKILL.md** and **.llm/exports/github-copilot/instructions/path-casing-imports.instructions.md**.
-- Strict equality (`===` / `!==` only). Semicolons in JS/TS. Prefer `import type` for type-only imports.
-- **Exports:** Do not re-export symbols from app code (e.g. `lib/validation.ts`) when they are already exported by a shared package (e.g. `@metaboost/helpers`). Callers should import from the canonical source; unnecessary re-exports add indirection and maintenance cost.
-- **Catch blocks:** If the error value is not used, use `catch { ... }` (no variable). Put at least one comment inside the block when swallowing errors so ESLint **`no-empty`** passes. See **.llm/exports/github-copilot/skills/catch-unused-error/SKILL.md**.
-- **Unused props/vars:** Remove them; do not keep and destructure as `_unused`. See **.llm/exports/github-copilot/skills/avoid-unused-props-vars/SKILL.md**.
-- **Component props:** Do not pass `undefined` explicitly to components. Allow `null` as a value for optional props so callers can pass `prop={value}` directly; components treat `null` (and `undefined`) as "not set" / default behavior. When checking optional string props (e.g. error messages) for "has value", use a simple falsy check (`Boolean(value)` or `if (value)`) instead of explicit `!== undefined && !== null && !== ''`.
-- **No inline styles:** Do not use `style={{ ... }}` for layout or appearance. Use CSS classes instead: component or page SCSS modules (e.g. `ComponentName.module.scss`), or shared utility classes where appropriate. Keeps styling maintainable and consistent.
-
-## Agent/plan work: do not run tests
-
-- **Do not run tests or verification commands** (e.g. `make e2e_test_web`, `npm run test`, `make e2e_test_web_signup_enabled`) during agent or plan implementation work.
-- **Only instruct the user** to run those commands after your work is done. Provide the exact command(s) in a fenced `bash` block so the user can copy and run them.
-- See **response-ending-make-verify** for which commands to suggest.
-
-## Testing: no rate-limit tests
-
-- **Do not add tests that assert rate-limit behavior** (e.g. 429 after N requests) in api or management-api. Rate limiting is disabled in test (high limit); dedicated rate-limit tests have been removed as a chronic source of flakiness. See **api-testing** skill.
-
-## Test Command Efficiency (Agent default)
-
-- When **suggesting** verification commands to the user, start with the **smallest targeted command** that can verify the behavior.
-- Prefer single-file or single-spec commands before suite-level commands (for example, one Vitest file or one Playwright spec).
-- Escalate to broader commands only when required by scope or when a targeted run passes and broader confidence is needed.
-- Avoid defaulting to full test suites when a focused command can confirm the same fix faster.
diff --git a/.llm/exports/github-copilot/skills/helpers-requests-req-pattern/SKILL.md b/.llm/exports/github-copilot/skills/helpers-requests-req-pattern/SKILL.md
deleted file mode 100644
index dedf325f..00000000
--- a/.llm/exports/github-copilot/skills/helpers-requests-req-pattern/SKILL.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-name: helpers-requests-req-pattern
-description: Use @metaboost/helpers-requests and the "req..." function pattern for all API calls from apps. Use when adding or changing HTTP requests to the API, or when you see raw fetch() or axios in app code.
----
-
-
-# Helpers-requests and the req... pattern
-
-All outbound API requests from apps (web, management-web) must go through **@metaboost/helpers-requests**, using the **req...** function pattern. Do not use raw `fetch()` or direct HTTP clients in app code for API calls.
-
-## Rules
-
-1. **No raw fetch for API calls**  
-   App code must not call `fetch(url, ...)` for app/management API endpoints. Use a `req...` helper from `@metaboost/helpers-requests` instead.
-
-2. **Req... naming**
-   - **GET**: `reqFetch...` (e.g. `reqFetchBucket`, `reqFetchPublicBucket`, `reqFetchPublicBucketMessages`).
-   - **POST**: `reqPost...` (e.g. `reqPostPublicBucketMessage`).
-   - Other verbs: `reqPatch...`, `reqPut...`, `reqDelete...` as needed.
-
-3. **Where helpers live**
-   - **Web app API**: `packages/helpers-requests/src/web/` (e.g. `web/buckets.ts`, `web/auth.ts`). Exported as `webBuckets`, `webAuth`, etc.
-   - **Management-web API**: `packages/helpers-requests/src/management-web/`. Exported as `managementWebAuth`, `managementWebAdmins`, etc.
-   - Each helper calls the shared `request()` from `packages/helpers-requests/src/request.js` (consistent URL building, JSON, error shape, optional auth/locale).
-
-4. **Adding a new endpoint**
-   - Add a `req...` function in the appropriate module under `web/` or `management-web/`.
-   - Use `request<T>(baseUrl, path, options)` with `method`, `body`, `headers`, `credentials` as needed.
-   - Export the function via the existing namespace (e.g. `webBuckets`) in `packages/helpers-requests/src/index.ts`.
-   - In the app, call e.g. `webBuckets.reqPostPublicBucketMessage(baseUrl, bucketId, body)` and handle `res.ok` / `res.error.message`.
-
-5. **Base URL**
-   - Server-side: use `getServerApiBaseUrl()` (from app lib); base URL already includes API version path.
-   - Client-side: use `getApiBaseUrl()` from app’s api-client (or equivalent); it includes version path.
-
-## Example (client component)
-
-```ts
-import { webBuckets } from '@metaboost/helpers-requests';
-import { getApiBaseUrl } from '../../../../../lib/api-client';
-
-const baseUrl = getApiBaseUrl();
-const res = await webBuckets.reqPostPublicBucketMessage(baseUrl, bucketId, {
-  senderName,
-  body,
-  isPublic,
-});
-if (!res.ok) {
-  setSubmitError(res.error.message ?? 'Failed to submit');
-  return;
-}
-// res.data available when res.ok
-```
-
-## Example (server component)
-
-```ts
-import { webBuckets } from '@metaboost/helpers-requests';
-import { getServerApiBaseUrl } from '../../../../../lib/server-request';
-
-const baseUrl = getServerApiBaseUrl();
-const res = await webBuckets.reqFetchPublicBucket(baseUrl, id);
-if (!res.ok || res.data?.bucket === undefined) return null;
-return res.data.bucket;
-```
-
-## When to use this skill
-
-- Adding or changing any HTTP request from apps/web or apps/management-web to the main API or management API.
-- Reviewing or refactoring code that uses `fetch(...)` or direct HTTP calls to app backends.
-- Adding a new API endpoint and wiring it in the frontend: add the `req...` helper first, then use it in the app.
diff --git a/.llm/exports/github-copilot/skills/i18n/SKILL.md b/.llm/exports/github-copilot/skills/i18n/SKILL.md
deleted file mode 100644
index dd4626c0..00000000
--- a/.llm/exports/github-copilot/skills/i18n/SKILL.md
+++ /dev/null
@@ -1,99 +0,0 @@
----
-name: i18n
-description: How i18n translations work in the Metaboost repo. Use when adding or editing translation keys, adding locales, or generating translations so you can do it reliably.
-version: 1.1.0
----
-
-
-# i18n in Metaboost
-
-Use this skill whenever you add or change user-facing strings, add a locale, or generate translations. It ensures key parity, correct file layout, and the right commands.
-
-## Three-tier layout (per app or package)
-
-Each app with i18n (`apps/web`, `apps/management-web`) and the backend package (`packages/helpers-i18n`) have:
-
-- **`i18n/originals/`** — Source of truth. `en-US.json` is maintained by hand. Other locale files (e.g. `es.json`) must have the **exact same key structure** as `en-US.json` (values can be translated or placeholder).
-- **`i18n/overrides/`** — Human corrections for non–en-US locales. Same keys as originals; non-empty override values win over originals at compile time. Committed.
-- **`i18n/compiled/`** — Merged output (originals + overrides). Generated only; **do not commit** (in `.gitignore`). Used at runtime.
-
-## Commands (run from repo root)
-
-- **`npm run i18n:sync`** — Sync originals from en-US for web, management-web, and helpers-i18n: add any keys present in en-US but missing in other locales’ originals with **empty string** (do not put English into es or other locale files; those must be in the target language, e.g. Spanish for es). Run after adding keys to en-US so key parity is achieved; then translate empty keys to the locale language. The **compile** step does not sync from en-US; sync is done by this script or by the i18n workflow.
-- **`npm run i18n:compile`** — For web, management-web, and **helpers-i18n**: sync override file structure **from each locale’s originals** (new keys get empty string in overrides), then merge originals + overrides into compiled. Run after changing originals or overrides.
-- **`npm run i18n:validate`** — Check that all locale files (originals + overrides) have the same keys **and key order** as `en-US`; **en-US** originals must have no empty values; non–en-US originals may have empty (pending translation). Overrides match structure. Validates web, management-web, and helpers-i18n. Run in CI and locally before committing i18n changes.
-
-## Adding or changing keys
-
-1. Edit **`i18n/originals/en-US.json`** in the app (or in each app/package that has the key). Use nested keys and namespaces (e.g. `auth.login.title`, `common.loading`, `ui.auth.login.email`). Do **not** leave empty values in en-US.
-2. **Other locales:** Run **`npm run i18n:sync`** then **`npm run i18n:compile`** so originals and overrides for other locales get the new keys (sync adds missing keys with empty string; do not put English in es or other locale files—translate to the target language, e.g. Spanish for es). Alternatively, merge to the mainline branch and let the **i18n workflow** run sync + compile + validate; then add translations for any new empty keys.
-3. Run **`npm run i18n:validate`** to confirm (same keys and key order as en-US; only en-US must have no empty).
-4. In code: `useTranslations('auth')` then `t('login.title')`, or `useTranslations('ui')` then `t('auth.login.email')` for UI package keys.
-
-## Key conventions
-
-- **Namespaces:** `auth`, `common`, `dashboard`, `settings`, `errors`, **`ui`** (see below).
-- **UI package:** Components in `@metaboost/ui` that render their own text use the **`ui`** namespace. Each app must include a full **`ui`** object in its `i18n/originals/en-US.json` (and other locales). Required keys are listed in **`packages/ui/I18N-KEYS.md`**. When adding or changing UI strings, update that file and add the key to each app’s originals (and other locales).
-
-## Generating translations (other locales)
-
-There is **no built-in auto-translate**. Translations for non–en-US locales can be generated with an **LLM of your choosing** (e.g. Cursor chat): provide `en-US.json` (or the relevant namespace) and ask for a translation that preserves the exact JSON key structure and only changes string values. Then:
-
-1. Write the result to the correct `i18n/originals/<locale>.json` (or use overrides for corrections).
-2. Run **`npm run i18n:compile`** and **`npm run i18n:validate`** to ensure key parity and compile.
-
-## Non–en-US originals must be in the target language
-
-**Do not put English text into non–en-US originals** (e.g. `es.json`). Spanish originals must be in Spanish; other locales in their language. The sync script adds missing keys with empty string so they can be filled with the correct translation. When adding or editing translations, use the target language for that locale.
-
-## Validation rules (what i18n:validate enforces)
-
-- `en-US.json` exists in originals and has no empty or undefined values.
-- Non–en-US files in `originals/` may have empty values (pending translation); only en-US is required to have no empty.
-- Every file in `originals/` and `overrides/` has exactly the same keys as `en-US` (no missing, no extra) and in the **same key order** (depth-first) as en-US.
-
-## Locale list and environment variables
-
-Locale list and default are defined once in **`packages/helpers/src/locale/constants.ts`** (`ALL_AVAILABLE_LOCALES`, `DEFAULT_LOCALE`, `Locale`). Web and management-web import from `@metaboost/helpers`; backend (helpers-i18n) re-exports from helpers. Runtime behavior is filtered by env vars `DEFAULT_LOCALE` and `SUPPORTED_LOCALES`.
-
-### Sync points (all locations to update when adding a locale or changing default/supported)
-
-| Purpose                                   | File                                                                                                                                                              |
-| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Locale constants (single source of truth) | `packages/helpers/src/locale/constants.ts` — `ALL_AVAILABLE_LOCALES`, `DEFAULT_LOCALE`. Web, management-web, and helpers-i18n use these via `@metaboost/helpers`. |
-| Web: env var documentation                | `apps/web/sidecar/.env.example` — `DEFAULT_LOCALE`, `SUPPORTED_LOCALES`                                                                                           |
-| Management-web: env var documentation     | `apps/management-web/sidecar/.env.example` — `DEFAULT_LOCALE`, `SUPPORTED_LOCALES`                                                                                |
-
-- **`DEFAULT_LOCALE`** (env) — Overrides the default locale (e.g. `en-US`). Must be one of the values in that app’s `ALL_AVAILABLE_LOCALES`.
-- **`SUPPORTED_LOCALES`** (env) — Unset or `all-available`: use the full hardcoded list. Comma-delimited (e.g. `en-US,es`): only those locales are active; values must be in `ALL_AVAILABLE_LOCALES`.
-
-**When you add a new locale** (e.g. `fr`): add the locale to **`packages/helpers/src/locale/constants.ts`** (`ALL_AVAILABLE_LOCALES`). Then add `originals/fr.json` and (after compile) `overrides/fr.json` for each app and for `packages/helpers-i18n`, and run compile and validate. Web and management-web read the list from `@metaboost/helpers`; no need to edit their request.ts. Ensure the sidecar `.env.example` files (`apps/web/sidecar/.env.example`, `apps/management-web/sidecar/.env.example`)
-document `DEFAULT_LOCALE` and `SUPPORTED_LOCALES` if you rely on them; app `.env.example` files
-contain only `RUNTIME_CONFIG_URL`.
-
-## Where things live
-
-| Item                                  | Location                                                                                                                                                                                                |
-| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| App originals                         | `apps/<app>/i18n/originals/` (e.g. `en-US.json`, `es.json`)                                                                                                                                             |
-| App overrides                         | `apps/<app>/i18n/overrides/` (e.g. `es.json`)                                                                                                                                                           |
-| App compiled                          | `apps/<app>/i18n/compiled/` (generated; do not edit)                                                                                                                                                    |
-| App locale list / request config      | Apps import `ALL_AVAILABLE_LOCALES` from `@metaboost/helpers`; `request.ts` (or app i18n config) uses that for locale list.                                                                             |
-| Backend i18n (API / management-api)   | `packages/helpers-i18n/` — same originals/overrides/compiled; `resolveLocale()`, `getPasswordValidationMessages()`, email content helpers. User-facing messages only (password validation, email body). |
-| Locale constants (all apps + backend) | `packages/helpers/src/locale/constants.ts`; import from `@metaboost/helpers` everywhere.                                                                                                                |
-| UI keys reference                     | `packages/ui/I18N-KEYS.md`                                                                                                                                                                              |
-| Full doc                              | `docs/localization/I18N.md`                                                                                                                                                                             |
-
-## i18n workflow (Podverse-style)
-
-When en-US changes are pushed to **develop**, `.github/workflows/i18n.yml` runs: **sync** originals from en-US (add missing keys with en-US value), **compile** (sync overrides from each locale’s originals, merge to compiled), **validate**, then commit and push originals + overrides if changed (message: `chore: sync i18n keys from en-US [bot]`). No LLM; key parity is achieved by the sync script. Locally you can run `npm run i18n:sync` then `npm run i18n:compile` to get the same result before pushing.
-
-## Quick checklist when you add or change strings
-
-- [ ] Add or edit key in `apps/<app>/i18n/originals/en-US.json` (no empty values).
-- [ ] If the string is from `@metaboost/ui`, add/update key in `packages/ui/I18N-KEYS.md` and ensure each app’s `ui` object has it.
-- [ ] Run `npm run i18n:sync` then `npm run i18n:compile` (or merge to develop and let the workflow do it).
-- [ ] Run `npm run i18n:validate`.
-- [ ] Use `useTranslations('namespace')` and `t('key')` in code (or pass translated strings as props from app to UI components).
-
-When **adding a new locale** (e.g. `fr`): add the locale to **`packages/helpers/src/locale/constants.ts`** (`ALL_AVAILABLE_LOCALES`). Web and management-web import from `@metaboost/helpers`; helpers-i18n re-exports from helpers. Then add originals/overrides for the new locale in each app and in helpers-i18n (see **Sync points** above).
diff --git a/.llm/exports/github-copilot/skills/interactive-prompts/SKILL.md b/.llm/exports/github-copilot/skills/interactive-prompts/SKILL.md
deleted file mode 100644
index b725c41b..00000000
--- a/.llm/exports/github-copilot/skills/interactive-prompts/SKILL.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-name: interactive-prompts
-description: Do not complete steps that require interactive prompts (inquirer, CLI input). Tell the user their input is needed and provide exact instructions.
-version: 1.0.0
----
-
-
-# Interactive Prompts
-
-When a workflow **requires the user to enter input at a prompt** (e.g. inquirer, readline, "Enter…", "Select…"), do **not** try to complete that step automatically.
-
-## Rule
-
-1. **Do not** run or "complete" steps that depend on interactive prompts.
-2. **Do** stop and tell the user that **their input is needed**.
-3. **Do** give **clear, copy-pasteable instructions**: exact commands and what to enter or select.
-
-## Summary
-
-- **Don't:** Pipe input, fake prompts, or mark interactive steps as "done" without user action.
-- **Do:** State that the user must complete the prompt steps and give exact instructions.
diff --git a/.llm/exports/github-copilot/skills/linear-db-migrations/SKILL.md b/.llm/exports/github-copilot/skills/linear-db-migrations/SKILL.md
deleted file mode 100644
index 275ccc90..00000000
--- a/.llm/exports/github-copilot/skills/linear-db-migrations/SKILL.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-name: linear-db-migrations
-description: Canonical linear DB migrations under infra/k8s/base/ops/source/database/linear-migrations, ops bundles, env keys, and runners. Use when adding or changing SQL migrations, K8s DB bootstrap, or scripts/database in this repo.
-version: 1.0.0
----
-
-
-# Linear database migrations (Metaboost)
-
-## When to use
-
-- Adding or changing files under `infra/k8s/base/db/source/`, `infra/k8s/base/ops/`, or `scripts/database/`.
-- Wiring DB credentials in Compose, k3d, or K8s manifests, or in env templates/examples.
-
-## Single source of truth
-
-- **Canonical forward-only SQL:** `infra/k8s/base/ops/source/database/linear-migrations/app/` and `infra/k8s/base/ops/source/database/linear-migrations/management/` (ordered `0001_*.sql`, ...).
-- **Bootstrap init (`docker-entrypoint-initdb.d`):** `infra/k8s/base/db/source/bootstrap/` — shell steps **`0001`** / **`0002`**, generated **`0003_linear_baseline.sql.gz`** and **`0004_seed_linear_migration_history.sql`**, then **`0006_management_grants.sh`**.
-- **Generated bootstrap artifacts:**
-  - `infra/k8s/base/db/source/bootstrap/0003_linear_baseline.sql.gz`
-  - `infra/k8s/base/db/source/bootstrap/0004_seed_linear_migration_history.sql`
-  - Generated by scripts under `scripts/database/`; do not hand-edit.
-
-## Runner and validation
-
-- Apply migrations: `bash scripts/database/run-linear-migrations.sh --database app|management` (always pass `--database`; there is no default).
-- K8s wrapper: `bash scripts/database/run-linear-migrations-k8s.sh` (same requirement).
-- Validate: `bash scripts/database/validate-linear-migrations.sh` (and `--check-db` to compare on-disk checksums to `linear_migration_history` when a DB is available).
-- Regenerate baseline artifacts:
-  - `bash scripts/database/generate-linear-baseline.sh`
-  - `bash scripts/database/generate-linear-migration-history-seed.sh`
-- Verify generated artifacts are committed and up to date:
-  - `bash scripts/database/verify-linear-baseline.sh`
-- The migration runner **creates** the `linear_migration_history` table if missing; do not rely on a dedicated SQL file for that.
-
-## Ops bundle (cache busting)
-
-- `infra/k8s/base/ops/kustomization.yaml` must list every `.sql` file under the app and management `source` directories so the ops jobs ConfigMaps stay in sync.
-- Kustomize may load paths outside the ops directory; when building, use e.g. `kubectl kustomize infra/k8s/base/ops --load-restrictor LoadRestrictionsNone`.
-
-## Environment keys (admin vs image)
-
-- **Authoritative in secrets and generated env:** `DB_APP_ADMIN_USER` / `DB_APP_ADMIN_PASSWORD`, `DB_MANAGEMENT_ADMIN_USER` / `DB_MANAGEMENT_ADMIN_PASSWORD`, plus read-only and read-write keys and `DB_APP_NAME` / `DB_MANAGEMENT_NAME` (see `infra/config/env-templates/db.env.example` and local `infra/config/local/db.env` after `scripts/local-env/setup.sh`).
-- The **postgres** container image still reads `POSTGRES_USER` / `POSTGRES_PASSWORD` / `POSTGRES_DB` at runtime—**map** those from the `DB_*_ADMIN_*` and `DB_APP_NAME` keys in Compose or Deployment `env`, not the reverse.
-
-## Cross-repo invariants
-
-- Canonical forward-only trees under `infra/k8s/base/ops/source/database/linear-migrations/`.
-- Generated bootstrap baseline artifacts `0003` and `0004` are machine-derived and committed.
-- Same npm script naming model in root `package.json` (`db:migrate:linear:*`, `db:validate:linear`, etc.). Product-specific naming differences are expected.
-
-## Documentation
-
-- [docs/development/DB-MIGRATIONS.md](../../../docs/development/DB-MIGRATIONS.md) – full runbook and contracts.
-
-## Related skills
-
-- [database-schema-naming](../database-schema-naming/SKILL.md) – snake_case schema rules.
-- [argocd-gitops-push](../argocd-gitops-push/SKILL.md) – push reminder when k8s paths change.
-- [generate-data-sync](../generate-data-sync/SKILL.md) – seeders when schema changes.
diff --git a/.llm/exports/github-copilot/skills/llm-cursor-source/SKILL.md b/.llm/exports/github-copilot/skills/llm-cursor-source/SKILL.md
deleted file mode 100644
index 70a6fdd2..00000000
--- a/.llm/exports/github-copilot/skills/llm-cursor-source/SKILL.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-name: llm-cursor-source
-description: Repository source of truth for AI editor guidance is under .cursor, .cursorrules, and .cursorignore. Use when adding, editing, or deleting skills, rules, .cursorrules, or .cursorignore.
----
-
-
-# LLM / Cursor source of truth
-
-## What to commit
-
-Only these paths define shared guidance for this repo:
-
-- `.llm/exports/github-copilot/skills/**`
-- `.llm/exports/github-copilot/instructions/**`
-- `.cursorrules` (repo root)
-- `.cursorignore` (repo root) — path-level ignores for Cursor and some tooling
-
-Do not commit ad-hoc skill/rule trees under `.github/`. **Machine export trees** under [`.llm/exports/`](../../../.llm/exports/) (per-target, allowlisted; see [EXPORT-TARGETS.md](../../../docs/development/llm/EXPORT-TARGETS.md)) are **not** a default write target for humans or for agents: **llm-exports-sync** and **llm-exports-full-sync** in GitHub Actions are the **canonical** producers; they open/update PRs on branches **`llm`** and **`llm-full`**. `npm run llm:exports:sync` is **gated** outside CI (`LLM_EXPORT_ALLOW_LOCAL=1` is required to write locally, for [scripts/llm/](../../../scripts/llm/) work only). Generated content is **`.gitignore`d**; **`.llm/exports/`** is in **`.cursorignore`** for Cursor. Do not commit or hand-edit generated `skills/`, `instructions/`, or `*-instructions.md` in feature PRs. See [`.llm/exports/LLM-EXPORTS.md`](../../../.llm/exports/LLM-EXPORTS.md) and the **`llm-exports-ci`** rule.
-
-## Other LLM editors
-
-Start from [`.llm/exports/`](../../../.llm/exports/) after pulling the latest **develop** (or checking the current **`llm` → `develop`** automation PR) when your tool can use repo paths. If you still need a one-off pass, use:
-
-- [docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md](../../../docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md)
-
-Overview and policy:
-
-- [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](../../../docs/development/llm/DOCS-DEVELOPMENT-LLM.md)
-
-## When .cursor changes
-
-- Edit skills, rules, `.cursorrules`, and (when needed) `.cursorignore`, and commit them like any other source.
-- **Do not** run a local LLM export sync to “refresh” exports, and do not commit or push changes under the generated parts of **`.llm/exports`**. After your work lands on **develop**, automation updates branch **`llm`** and its PR. Pull **develop** once that PR is merged, or follow the open **`llm` → `develop`** PR. Re-run the alignment prompt only if you use tooling that is not fully covered by the opt-in export targets.
-
-## Skill file hygiene
-
-- Skill frontmatter `name` should match the skill folder name.
-- Keep exactly one blank line between closing frontmatter (`---`) and body content.
-
-## Export / sync implementation
-
-When you change the deterministic export (files under `scripts/llm/`), use the **llm-exports-scripts** skill. **Podverse and Metaboost** share the same pipeline shape; keep the mirrored `scripts/llm/**` files aligned when behavior should match.
-
-Local vendor setup is opt-in via `npm run llm:vendors` (default active vendor: `cursor`).
diff --git a/.llm/exports/github-copilot/skills/llm-exports-scripts/SKILL.md b/.llm/exports/github-copilot/skills/llm-exports-scripts/SKILL.md
deleted file mode 100644
index 9b9710f3..00000000
--- a/.llm/exports/github-copilot/skills/llm-exports-scripts/SKILL.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-name: llm-exports-scripts
-description: Conventions for scripts/llm (deterministic .cursor exports). Use when editing export-from-cursor, copilot-adapter, github-style-adapter, opencode-adapter, vendor-*, allowed-targets, or guard-exports.
----
-
-
-# LLM export scripts (`scripts/llm/**`)
-
-## When to use
-
-Use this skill whenever you add or change files under `scripts/llm/` (import/export pipeline, adapters, local vendor config/CLI, export guard, allowlists).
-
-**Policy and source of truth** live in the **llm-cursor-source** skill. **Per-target output** (what each adapter produces) is documented in [docs/development/llm/EXPORT-TARGETS.md](../../../docs/development/llm/EXPORT-TARGETS.md). **Podverse and Metaboost** share the same pipeline shape; keep the mirrored scripts aligned when behavior should match.
-
-Allowlisted **export target** ids: `github-copilot`, `opencode` (see `allowed-targets.mjs`); each opt-in target has a marker under `.llm/exports/<id>/`. The `github-copilot` tree is the single portable mirror (no separate `vscode` target).
-
-**CI:** the **`llm-exports-sync`** and **`llm-exports-full-sync`** GitHub Actions run `node scripts/llm/export-from-cursor.mjs sync` (with `--full` for full) on the runner. **Local** `sync` and `check` that write to disk are **disabled** unless `CI` is set (e.g. GitHub Actions) or you set `LLM_EXPORT_ALLOW_LOCAL=1` for pipeline debugging and tests of `scripts/llm/`. Set that env when you need to run `npm run llm:exports:sync` or `llm:exports:sync:full` outside CI.
-
-## Console and CLI output
-
-- Do **not** use `console.log`, `console.info`, or `console.debug`.
-- Use `console.warn` for non-fatal progress or informational messages, `console.error` for failures.
-- For interactive CLIs, you may use a small helper that writes with `process.stdout.write` (see `vendor-selector.mjs` `out()`).
-
-## After edits
-
-From repo root:
-
-```bash
-npx eslint "scripts/llm/**/*.mjs"
-```
-
-In Metaboost, if import order needs fixing: `npx eslint "scripts/llm/**/*.mjs" --fix`
diff --git a/.llm/exports/github-copilot/skills/llm-history/SKILL.md b/.llm/exports/github-copilot/skills/llm-history/SKILL.md
deleted file mode 100644
index fb04f39c..00000000
--- a/.llm/exports/github-copilot/skills/llm-history/SKILL.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-name: llm-history
-description: LLM history tracking guidelines. Use when updating history files or starting new feature work.
-version: 1.0.0
----
-
-
-# LLM History Tracking
-
-This skill provides guidelines for maintaining LLM development history in the Metaboost repo. The Cursor rule `llm-history-tracking.mdc` is the always-applied requirement.
-
-## Critical Rule: 10-Session Maximum Per File
-
-**Each history file must contain at most 10 sessions.** When session 11 needs to be added, the file must be split.
-
-## File Location Pattern
-
-```
-.llm/history/active/[feature-name]/
-  [feature-name]-part-01.md      # Sessions 1-10 (always start with part-01)
-  [feature-name]-part-02.md      # Sessions 11-20
-```
-
-**Always use the `-part-01` suffix from the beginning, even for the first file.**
-
-## When to Split
-
-When a history file has 10 sessions and you need to add session 11: create a new file with `-part-02` suffix and add session 11 there. Session numbers are continuous across parts (never reset).
-
-## Session Entry Format
-
-```markdown
-### Session N - YYYY-MM-DD
-
-#### Prompt (Developer)
-
-[Exact verbatim user prompt - never summarize]
-
-#### Key Decisions
-
-- Decision 1
-
-#### Files Modified
-
-- path/to/file.ts
-```
-
-## Prompt Source Labels
-
-- **`#### Prompt (Developer)`** - Manually typed by user
-- **`#### Prompt (Agent)`** - System-generated (e.g., clicking "Build" on a plan)
-
-## When to Update History
-
-Update when modifying code, config, docs, or plans. Skip for pure Q&A with no file changes.
-
-## Required sequence
-
-1. Record the prompt first in the active history file (verbatim text, correct prompt source label).
-2. Make the file changes.
-3. Finalize the same session entry with key decisions and files modified.
-
-This skill is the canonical source for history timing and entry format.
-
-## Response Ending
-
-End file-modifying responses with:
-
-**LLM History**: Updated .llm/history/active/[feature]/[file].md (Session N)
-
-## See Also
-
-- `.llm/exports/github-copilot/instructions/llm-history-tracking.instructions.md` - Cursor rule with glob triggers
-- `.llm/LLM.md` - Complete history system documentation
diff --git a/.llm/exports/github-copilot/skills/local-docker-k3d-alignment/SKILL.md b/.llm/exports/github-copilot/skills/local-docker-k3d-alignment/SKILL.md
deleted file mode 100644
index 2bae1341..00000000
--- a/.llm/exports/github-copilot/skills/local-docker-k3d-alignment/SKILL.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-name: local-docker-k3d-alignment
-description: When adding or changing preconditions, cleanup steps, or env usage for local Docker Compose or local k3d, keep both in sync where they share resources (e.g. infra/config/local/*.env).
----
-
-
-# Local Docker vs k3d alignment
-
-## When to use
-
-When modifying Makefile targets or scripts that:
-
-- Start or stop local Docker Compose services or the local k3d cluster
-- Read or write `infra/config/local/*.env` (generated by `scripts/local-env/setup.sh` from canonical templates and overrides)
-- Check for “running” state before running env clean, setup, or reset
-
-## Rule
-
-Keep Docker and k3d local behavior aligned where they share resources (e.g. env files). If a target aborts when Docker containers are running, consider aborting when the k3d cluster is running when the same env files are in use. Full teardown / clean targets should also tear down the k3d cluster, not only Docker.
-
-**Commands that should consider k3d:** (1) **Guards**: any target that refuses to run while Docker is up and touches shared env (e.g. `local_env_clean`) should also refuse while k3d is up. (2) **Teardown**: any "clean" or "full teardown" target (e.g. `local_clean`) should run `local_k3d_down` so both Docker and k3d are stopped. (3) **Docs**: where local env or k3d is described, note shared env and that `local_clean` tears down both.
-
-## Do
-
-- **`infra/config/local/*-sidecar.env`** vs **`apps/*/sidecar/.env`**: **`local_env_setup`** generates **both** with **`merge-env`**: infra files use **`--profile local_docker`** (Compose **`env_file`**); app **`sidecar/.env`** files use **`--profile dev`** (host npm). They are independent outputs, not copies; do not assume byte parity.
-- Guard `local_env_clean` on both Docker Compose containers and the k3d cluster; document that both use `infra/config/local/*.env` (Postgres: single `db.env`; Valkey: `valkey-source-only.env`, `valkey.env`).
-- Include k3d in "full teardown" targets: `local_clean` should run `local_k3d_down` so Docker, k3d, and test/E2E are all torn down.
-- When adding a precondition or cleanup step that touches `infra/config/local/*.env` or “running” state, apply the same logic to both Docker and k3d (or document why they differ).
-
-## Don't
-
-- Don’t add Docker-only or k3d-only guards for shared env without considering the other (e.g. cleaning env while k3d is up leaves the cluster with stale secrets).
-
-## Examples
-
-- **local_env_clean**: Aborts if Metaboost local containers are running (`make local_down`) and also if the k3d cluster is running (`make local_k3d_down`).
-- **local_clean**: Full teardown runs `local_down`, `local_down_volumes`, `local_k3d_down` (idempotent if cluster is gone), and `test_clean` so both Docker and k3d are stopped.
-- **Docs**: `local_env_setup` and `local_k3d_up` both consume `infra/config/local/*.env`; mention this where describing local env or k3d setup. Document that `make local_clean` tears down k3d as well as Docker.
diff --git a/.llm/exports/github-copilot/skills/management-edit-breadcrumbs/SKILL.md b/.llm/exports/github-copilot/skills/management-edit-breadcrumbs/SKILL.md
deleted file mode 100644
index 67a3dd8e..00000000
--- a/.llm/exports/github-copilot/skills/management-edit-breadcrumbs/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: management-edit-breadcrumbs
-description: New and Edit pages in management-web should use breadcrumbs so users can see where they are and navigate back.
----
-
-
-# Management-web New/Edit page breadcrumbs
-
-**When to use:** When adding or changing New or Edit pages in management-web (e.g. new resource pages, edit resource pages).
-
-## Rule
-
-Every New and Edit page should show **breadcrumbs** so users can see their position in the hierarchy and navigate back:
-
-- Wrap the page content in `ContentPageLayout` from `@metaboost/ui` with a `breadcrumbs` prop.
-- Build `BreadcrumbItem[]`: list route (link) → optional view/resource link → current page label (no `href` for last item).
-- Use `Breadcrumbs` and `Link` from `@metaboost/ui`; pass a `LinkComponent` that wraps `Link` (e.g. a small `BreadcrumbLink` that forwards `href`, `children`, `className`).
-- Set `contentMaxWidth="form"` on `ContentPageLayout` for form pages.
-
-## Hierarchy examples
-
-- **Admins:** Admins (link) → Add admin | Edit: [name] (current).
-- **Users:** Users (link) → Add user | [Name] (link) → Edit (current).
-- **Buckets:** Buckets (link) → Add bucket (current).
-- **Bucket message edit:** [Ancestor buckets] → Bucket name (link) → Edit (current). Fetch bucket and ancestry to build items.
-
-## References
-
-- User edit: `apps/management-web/src/app/(main)/user/[id]/edit/page.tsx`
-- Admins new, admin edit, users new, buckets new: same pattern in respective `page.tsx` files.
-- Bucket message edit: `apps/management-web/src/app/(main)/bucket/[id]/messages/[messageId]/edit/page.tsx` (fetches bucket + ancestry for breadcrumbs).
-- Bucket settings (admins/roles edit) already have breadcrumbs via `BucketSettingsLayoutClient`.
diff --git a/.llm/exports/github-copilot/skills/management-edit-page-tabs/SKILL.md b/.llm/exports/github-copilot/skills/management-edit-page-tabs/SKILL.md
deleted file mode 100644
index 34fac68d..00000000
--- a/.llm/exports/github-copilot/skills/management-edit-page-tabs/SKILL.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-name: management-edit-page-tabs
-description: Use a consistent tabbed layout on management-web edit pages when there are multiple distinct forms (e.g. profile vs password).
----
-
-
-# Management-web edit page tabs
-
-**When to use:** When adding or changing edit pages in management-web that have multiple distinct forms (e.g. profile vs change password, or multiple logical sections that could be separate forms).
-
-## Rule
-
-Use a tabbed layout with **one tab per form** (or logical group):
-
-- Use `Tabs` from `@metaboost/ui` with `LinkComponent={Link}` and `exactMatch`.
-- Follow **tab-active-state-url-match** for canonical tab href / `activeHref` behavior.
-- Use `?tab=...` in the URL and a route helper (e.g. `userEditRoute(id, tab)`) so the active tab matches with and without query params.
-- Default tab = first tab (no param or explicit first tab value).
-
-## References
-
-- Edit User page: Profile / Change password tabs (`apps/management-web/src/app/(main)/user/[id]/edit/`, `EditUserPageContent.tsx`, `userEditRoute(id, tab)`).
-- Settings: General / Profile / Password tabs (`apps/management-web/src/app/(main)/settings/SettingsContent.tsx`, `accountSettingsRoute(tab)`).
-
-## Single-form edit pages
-
-Edit pages with a single form (e.g. admin edit, bucket admin edit, role edit, message edit) do not need tabs. If a future edit page gains a second form, apply this pattern.
diff --git a/.llm/exports/github-copilot/skills/nested-resource-prefix-naming/SKILL.md b/.llm/exports/github-copilot/skills/nested-resource-prefix-naming/SKILL.md
deleted file mode 100644
index 3fcc57b4..00000000
--- a/.llm/exports/github-copilot/skills/nested-resource-prefix-naming/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: nested-resource-prefix-naming
-description: Use parent-prefix naming for nested resources so the schema and API make hierarchy explicit (e.g. bucket_messages_crud). Use when adding or naming DB columns, tables, permission fields, API/ORM types, or request/response fields for resources that are children of another resource.
----
-
-
-# Nested resource prefix naming
-
-## Rule
-
-When a resource is **nested under** another (e.g. messages under buckets), **prefix names with the parent** so it's clear in the schema and API that the child belongs to the parent. Do not use a bare child name that could be mistaken for a top-level resource.
-
-## Where this applies
-
-- **DB columns / tables**: e.g. `bucket_messages_crud`; table/column names that represent a child resource should include the parent (e.g. `bucket_message`, `bucket_messages_crud`).
-- **Permission / CRUD bitmasks**: e.g. `bucketMessagesCrud` (camelCase in TS/API), `bucket_messages_crud` (snake_case in DB).
-- **API request/response fields and types**: same prefix in DTOs, schemas, and OpenAPI.
-- **ORM entities and services**: property and type names should reflect the hierarchy (e.g. `bucketMessagesCrud` on `AdminPermissions`).
-
-## Examples
-
-| Context        | Prefer                 | Avoid                                               |
-| -------------- | ---------------------- | --------------------------------------------------- |
-| Permission col | `bucket_messages_crud` | unprefixed child CRUD field                         |
-| TS/API field   | `bucketMessagesCrud`   | unprefixed child CRUD field                         |
-| Label in UI    | "Bucket Messages CRUD" | "Messages CRUD" (when listing permissions globally) |
-
-On **pages that are already under the parent** (e.g. bucket messages list/edit), the breadcrumb provides context so a short label like "Messages" is fine; the **schema and permission names** should still use the prefix everywhere.
-
-## Why
-
-Bare unprefixed names suggest a top-level "messages" resource. Prefixing with `bucket_` makes it obvious that these are bucket-scoped messages and keeps the schema self-documenting and consistent as more nested resources are added.
diff --git a/.llm/exports/github-copilot/skills/npm-audit/SKILL.md b/.llm/exports/github-copilot/skills/npm-audit/SKILL.md
deleted file mode 100644
index d99a4ebb..00000000
--- a/.llm/exports/github-copilot/skills/npm-audit/SKILL.md
+++ /dev/null
@@ -1,223 +0,0 @@
----
-name: npm-audit
-description: Investigate and decide on npm audit vulnerabilities—fix vs. allowlist pattern with shared gate utility
-version: 1.0.0
----
-
-
-# Handling NPM Audit Vulnerabilities
-
-## When to Use This Skill
-
-Use this skill when:
-
-- `npm audit --omit=dev --audit-level=moderate` is failing in the release gate or CI
-- You need to investigate why an npm override is not resolving a transitive dependency
-- You need to decide between fixing a vulnerability vs. allowlisting it
-- A PR proposes changes to `package.json` overrides or audit allowlists
-
-## ⚠️ CRITICAL: Allowlist Consistency Across All Release Scripts
-
-**When you add an advisory ID to the allowlist, you must update it in ONLY ONE place:**
-
-**`scripts/lib/check-audit-gate.sh`** — the shared audit gate utility used by all release scripts.
-
-This shared utility is called by:
-
-- `scripts/publish/bump-version.sh`
-- `scripts/publish/sync-develop-to-staging.sh` (passes allowlist as argument)
-- `scripts/publish/sync-staging-to-main.sh` (passes allowlist as argument; RTM: fast-forward `main` from `staging` only)
-
-When you update the allowlist:
-
-1. **Do NOT** manually update each script individually
-2. **Do** edit the `ALLOWED_AUDIT_IDS` variable in the script that calls the utility (e.g., bump-version.sh passes it as an argument to the shared utility)
-3. All sync scripts receive the same allowlist from their hardcoded argument to the shared utility
-
-**If you see allowlist values in multiple sync scripts:** That's the correct pattern. Each script passes its repo's allowlist to the shared utility. They will update atomically if the shared utility changes.
-
-## Investigation Process
-
-### Step 1: Understand the Vulnerability
-
-```bash
-npm audit --omit=dev --json > temp/audit-report.json
-node --input-type=module -e "
-  import fs from 'fs';
-  const audit = JSON.parse(fs.readFileSync('temp/audit-report.json', 'utf8'));
-  for (const [pkg, data] of Object.entries(audit.vulnerabilities || {})) {
-    if (Array.isArray(data.via)) {
-      for (const adv of data.via) {
-        if (typeof adv === 'object') {
-          console.log(\`\${pkg}: \${adv.severity} - \${adv.title} (Advisory \${adv.source})\`);
-          console.log(\`  URL: \${adv.url}\`);
-          console.log(\`  Via: \${data.via}\`);
-        }
-      }
-    }
-  }
-"
-```
-
-This shows:
-
-- Affected package name
-- Severity level
-- Advisory ID (source)
-- Direct URL to vulnerability details
-- **Via:** The chain of how this vulnerability reaches your code
-
-### Step 2: Trace the Dependency Chain
-
-For each vulnerability, understand the full path:
-
-```bash
-npm ls <vulnerable-package> --all
-```
-
-Example:
-
-```
-metaboost@1.0.0
-└── (transitive)
-    └── firebase-admin@13.8.0
-        └── @google-cloud/storage@7.19.0
-            └── teeny-request@9.0.0
-                └── uuid@9.0.1 (vulnerable)
-```
-
-### Step 3: Determine Root Cause
-
-**Root cause types:**
-
-1. **Direct dependency outdated**
-   - Package in your `package.json` is not at latest
-   - **Fix:** `npm upgrade <package>`
-
-2. **Transitive dependency in resolvable chain**
-   - Intermediate package has a recent version that upgrades the vulnerable dep
-   - **Fix:** Upgrade the intermediate package, then re-audit
-   - **Example:** firebase-admin@14.x might pull @google-cloud/storage@8.x which uses teeny-request@11.x
-
-3. **Transitive dependency in constrained chain** (most common)
-   - Latest version of intermediate packages still pin the vulnerable dep
-   - **Fix:** Evaluate if npm overrides can force a newer version
-   - **Check:**
-     ```bash
-     # In package.json, try an override like:
-     "overrides": {
-       "uuid": "14.0.0",
-       "teeny-request": {
-         "uuid": "14.0.0"
-       }
-     }
-     ```
-   - **Then:** `npm install` and re-audit
-
-4. **Nested optional dependency bug** (hardest case)
-   - npm's resolver installs optional dependencies into their own node_modules folder
-   - Overrides don't cascade into these nested folders in certain cases
-   - **Symptom:** `package-lock.json` shows `node_modules/teeny-request/node_modules/uuid@9.0.1` even though you have `"uuid": "14.0.0"` in overrides
-   - **Fix:** Either upgrade the parent package OR allowlist the advisory
-
-### Step 4: Decide Fix vs. Allowlist
-
-**Fix if:**
-
-- Direct dependency upgrade resolves it
-- A recent major version of an intermediate package resolves it
-- npm overrides can successfully force the resolution (verify in `package-lock.json`)
-- The vulnerability is directly exploitable in Metaboost's usage
-
-**Allowlist if:**
-
-- Latest mainstream versions of all upstream packages still carry the vulnerability
-- Fixing requires downgrading other critical packages (causes regressions)
-- The vulnerability is transitive-only and low-risk in Metaboost's deployment model
-- A clear path exists to remove the allowlist when upstream packages release fixes
-
-### Step 5: Document the Rationale
-
-If allowlisting, document **why** in a `docs/NPM-AUDIT-ALLOWLIST.md` or equivalent:
-
-```markdown
-### Advisory XXXXX: <vulnerability name>
-
-**Affected chain:** pkg1 → pkg2 → pkg3 → vulnerable-pkg
-
-**Why it's allowlisted:**
-- Latest pkg3@X.Y still pins vulnerable-pkg@<14
-- Downgrading pkg1 causes regressions (list them)
-- Replacing pkg1 would require major refactor (explain scope)
-
-**Risk level:** Transitive-only; not directly exploitable because [reason].
-
-### When to revisit:
-- When pkg1 releases X+1.0.0 with upgraded dependencies
-- When pkg3 releases Y+1.0.0 that drops the vulnerable dep
-```
-
-Then update the release gate:
-
-```bash
-# See docs/NPM-AUDIT-ALLOWLIST.md for rationale
-ALLOWED_AUDIT_IDS="1113977,1116970"
-```
-
-### Step 6: Add to Memory for Revisit
-
-Update `/memories/user/npm-audit-overrides.md` with:
-
-```markdown
-## Tracked Overrides for Removal
-
-- Advisory 1113977 (uuid): Remove when firebase-admin@14.x+ or @google-cloud/storage@8.x+ upgrades teeny-request
-- Advisory 1116970 (@tootallnate/once): Same dependency chain; will resolve when 1113977 resolves
-```
-
-## Common Patterns
-
-### Pattern: npm Overrides Not Cascading
-
-**Symptom:** Root `package.json` has `"uuid": "14.0.0"` override, but `npm audit` still reports uuid@9.0.1 in the output.
-
-**Why:** Optional dependencies get their own node_modules folder, and npm doesn't always apply overrides there.
-
-**Verification:**
-
-```bash
-# Check the lockfile for nested node_modules
-grep -A2 'node_modules/teeny-request/node_modules/uuid' package-lock.json
-```
-
-If you see a nested uuid entry with version < 14, the override didn't work.
-
-**Options:**
-
-1. Try pinning the parent package instead: `"teeny-request": "11.x"`
-2. Force a major version of the upstream: `"@google-cloud/storage": "8.0.0"`
-3. Accept the allowlist if neither works
-
-### Pattern: npm audit fix --force Causes Regressions
-
-**Symptom:** Running `npm audit fix --force` downgrades critical packages like firebase-admin@10.1.0.
-
-**Why:** `--force` prioritizes clearing vulnerabilities over semver compatibility.
-
-**Solution:** **Never use `--force` in monorepos.** Instead, carefully upgrade intermediate packages one at a time and check side effects.
-
-## Checklist Before Committing
-
-- [ ] Investigation documented: vulnerability chain traced and root cause identified
-- [ ] Attempted a fix: either package upgrade or npm override tested in package-lock.json
-- [ ] Verified no regression: `npm run build` succeeds
-- [ ] If allowlisting: documented rationale in appropriate docs file
-- [ ] If allowlisting: updated release gate with link to rationale docs
-- [ ] If allowlisting: added advisory ID to `/memories/user/npm-audit-overrides.md` for future revisit
-- [ ] LLM history updated with investigation results
-
-## See Also
-
-- `docs/` — Check for NPM-AUDIT-ALLOWLIST.md or equivalent
-- Release/publish gate — Audit gate implementation
-- LLM history — Investigation notes
diff --git a/.llm/exports/github-copilot/skills/password-strength-on-set-update/SKILL.md b/.llm/exports/github-copilot/skills/password-strength-on-set-update/SKILL.md
deleted file mode 100644
index 3af60425..00000000
--- a/.llm/exports/github-copilot/skills/password-strength-on-set-update/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: password-strength-on-set-update
-description: On every page where a password can be set or updated, include the PasswordStrengthMeter component.
----
-
-
-# Password strength on set/update
-
-**When to use:** When adding or changing any form or page where a user can set a new password or update their password (signup, create user, create admin, change password, reset password, etc.).
-
-## Rule
-
-Include the **PasswordStrengthMeter** component (from `@metaboost/ui`) on every page where a password can be set or updated:
-
-- Place it directly after the **new password** input field (the field that is being set or changed). For "change password" flows with current + new + confirm, the meter goes after the new-password field and before the confirm field.
-- Pass the current value of the new-password field: `<PasswordStrengthMeter password={newPassword} />`.
-- **Always render the meter** (do not condition on `password !== ''`). When empty, the component still shows requirements and an empty bar so the user sees it is present; when they type, the strength updates. Hiding the meter when the field is empty makes the page look like it has no strength indicator.
-
-## Where it applies
-
-- **Signup / create account:** After the password (or main password) field.
-- **Create user (management):** UserForm create mode — after password input.
-- **Edit user – change password:** UserForm edit mode — after new password input.
-- **Create admin (management):** AdminForm — after password input.
-- **Edit admin – change password:** AdminForm edit mode — after password input (when shown).
-- **Settings – change password:** Management-web SettingsContent and web SettingsPageContent — after new password input.
-- **Reset password:** ResetPasswordForm — after new password input (already present in UI package).
-
-## References
-
-- Component: `packages/ui/src/components/form/PasswordStrengthMeter/`
-- Examples: `UserForm.tsx`, `AdminForm.tsx`, `SignupForm.tsx`, `ResetPasswordForm.tsx`, `SettingsContent.tsx`, `SettingsPageContent.tsx`.
diff --git a/.llm/exports/github-copilot/skills/path-casing-imports/SKILL.md b/.llm/exports/github-copilot/skills/path-casing-imports/SKILL.md
deleted file mode 100644
index fd0f2bde..00000000
--- a/.llm/exports/github-copilot/skills/path-casing-imports/SKILL.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-name: path-casing-imports
-description: Keep import path casing identical to file/directory names so builds pass on Linux and in CI. Use when adding or changing relative imports, or when CI fails with "Cannot find module" for paths that work locally.
-version: 1.0.0
----
-
-
-# Path Casing in Imports
-
-## Why it matters
-
-- **Linux and CI** (e.g. GitHub Actions) use **case-sensitive** filesystems. Imports like `'./components/form/Button'` fail if the directory is actually `Form` (uppercase).
-- **macOS** often uses a case-insensitive default FS, so `form` and `Form` can both resolve locally while CI fails with "Cannot find module ... or its corresponding type declarations."
-- Fix: use the **exact casing** of every path segment (folders and files) as stored in the repo.
-
-## What to do
-
-1. **When adding or changing relative imports:** Check the real path casing (e.g. `git ls-tree -r --name-only HEAD -- <path>` or the IDE file tree) and use that exact casing in the import string.
-2. **When CI fails with module-not-found for a path that works locally:** Treat it as a casing mismatch. Find the actual path (e.g. `git ls-tree` under the package), then update the import to match (e.g. `form/` → `Form/` or vice versa to match the tree). Do **not** rename files/dirs unless the team agrees; prefer updating the imports to match existing names.
-3. **When creating new directories/files:** Prefer a single convention and use that same casing in all imports. In this repo, **component directories** under `packages/ui/src/components/` use **lowercase** (e.g. `form`, `bucket`, `layout`, `modal`, `navigation`, `table`).
-
-## Reference
-
-- Cursor rule: **.llm/exports/github-copilot/instructions/path-casing-imports.instructions.md**
-- This skill: **.llm/exports/github-copilot/skills/path-casing-imports/SKILL.md**
diff --git a/.llm/exports/github-copilot/skills/plan-files-convention/SKILL.md b/.llm/exports/github-copilot/skills/plan-files-convention/SKILL.md
deleted file mode 100644
index 2a46546f..00000000
--- a/.llm/exports/github-copilot/skills/plan-files-convention/SKILL.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-name: plan-files-convention
-description: Where and how to save LLM plan files locally. Use when creating, saving, or completing plan sets (e.g. multi-phase plans). Aligns with Podverse monorepo convention.
-version: 1.1.0
----
-
-
-# Plan Files Convention
-
-This skill describes how to save plan files locally in the Metaboost repo, following the same convention as the Podverse monorepo.
-
-## When Asked to Create a Plan That Is Too Big for One Pass
-
-If the user asks you to create a plan and the plan is **too large to implement in a single pass**:
-
-1. **First goal**: Treat the deliverable as **creating detailed plan files and saving them locally**. Do not attempt to implement the full plan in one go.
-2. **Produce and save**:
-   - A plan-set directory under `.llm/plans/active/[plan-set-name]/`
-   - `00-EXECUTION-ORDER.md`, `00-SUMMARY.md`, numbered plan files (e.g. `01-topic.md` …), and `COPY-PASTA.md` as described below.
-3. **After the plan files exist**: The user will use the **COPY-PASTA.md** (copy-pasta doc) to ask you to implement the plans—typically **one after another**, or **in parallel** when the execution order doc says it is safe (e.g. within a phase marked as parallel). Do not start implementation until the user requests it via those prompts.
-4. When the user pastes a prompt from COPY-PASTA.md, execute that plan immediately (see parallel-plan-execution skill for copy-pasta behavior).
-
-## Where to Save Plans
-
-- **Active plans**: `.llm/plans/active/[plan-set-name]/`
-- **Completed plans**: `.llm/plans/completed/[plan-set-name]/` (move here when the plan set is done)
-
-Use a short, kebab-case name for the set (e.g. `metaboost`, `web-runtime-config-endpoint`).
-
-## Standard File Layout (Active Set)
-
-Inside the plan-set directory, use:
-
-- **00-EXECUTION-ORDER.md** – Phase order, parallel groups, and pointers to each numbered plan.
-- **00-SUMMARY.md** – Scope summary, list of plan files, dependency map, and recorded decisions.
-- **01-topic.md** … **NN-topic.md** – One markdown file per topic (e.g. `01-infra-directory.md`, `09-gitflow-test.md`). Each has: Scope, Steps, Key files, Verification.
-- **COPY-PASTA.md** – Copy-paste prompts for parallel agents, referencing the numbered plans.
-
-During **plan creation**, do not modify product code or test files. For plans that touch **api** or **management-api**, include explicit integration-test steps (see api-testing). For plans that touch **web** or **management-web**, include explicit E2E-test steps (see e2e-page-tests).
-
-Plans stay under ~300 lines each; split into part files (e.g. `22-part-1-dashboard.md`) if a topic grows.
-
-## How to use COPY-PASTA (execution order)
-
-- **Phases are sequential.** Do not start Phase N+1 until Phase N is fully complete.
-- **Within a phase,** steps can be sequential or parallel. When the doc says "run A, then B,
-  then C and D in parallel" it means: run A → **wait for A to finish** → run B → **wait for
-  B to finish** → then run C and D in parallel (e.g. two agents); **wait for both C and D**
-  before starting the next phase. Only start "in parallel" work after all prior steps in
-  that phase have completed.
-- For each step or parallel group, wait for completion before starting the next step or
-  phase.
-
-## When Creating a New Plan Set
-
-1. Create the directory: `.llm/plans/active/[plan-set-name]/`.
-2. Add 00-EXECUTION-ORDER.md and 00-SUMMARY.md first.
-3. Add one file per topic (01, 02, …) with scope, steps, key files, verification.
-4. Add COPY-PASTA.md with copy-paste prompts that **reference** the numbered plan files (so the user can request implementation one-by-one or in parallel as allowed by the execution order).
-5. **Stop when the plan files are saved.** Do not implement product code or test files in this pass. Implementation happens when the user uses COPY-PASTA.md to ask you to execute each plan (sequentially or in parallel per the execution order).
-
-## When a Plan Set Is Complete
-
-1. Move the entire directory from `active/` to `completed/`:  
-   `mv .llm/plans/active/[plan-set-name] .llm/plans/completed/`
-2. Update any cross-references (e.g. 00-master-plan or README) if needed.
-
-## Reference
-
-- Podverse: `.llm/plans/active/` and `.llm/plans/completed/`; see e.g. `podverse/.llm/plans/completed/web-runtime-config-endpoint/` for layout.
-- Metaboost: active plan sets live in topic-specific directories under `.llm/plans/active/`
-  (e.g. `web-dashboard/`, `documentation-diagrams/`, `git-hooks/`, `jenkins-local/`,
-  `deployment-installer-roadmap/`). Index: `.llm/plans/active/metaboost/00-overview.md`.
-  Completed: `.llm/plans/completed/metaboost/`, `.llm/plans/completed/metaboost-k3s/`.
diff --git a/.llm/exports/github-copilot/skills/prefer-named-exports/SKILL.md b/.llm/exports/github-copilot/skills/prefer-named-exports/SKILL.md
deleted file mode 100644
index 8ca9de68..00000000
--- a/.llm/exports/github-copilot/skills/prefer-named-exports/SKILL.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-name: prefer-named-exports
-description: >-
-  Prefer named exports in TypeScript/ESM modules; avoid default exports when a named export
-  is sufficient. Use in Metaboost and Podverse when adding or editing modules, API routes, worker
-  commands, packages, and app code. Framework-required defaults are the exception.
-version: 1.0.0
----
-
-
-# Prefer named exports
-
-## When to use
-
-- Creating or changing `.ts` / `.tsx` modules, `packages/*`, and app code in this monorepo.
-- Refactoring imports; choosing export style for a new function, component, or command.
-
-## Rules
-
-- **Prefer** `export function name`, `export const name`, and `export type` / `export { x }` so names stay stable at import sites and refactors are easier to trace.
-- **Avoid** `export default` for ordinary modules when there is a single main export: use a **named** export with a clear, stable name.
-
-## Exceptions (defaults are fine)
-
-- **Next.js (App Router)**: `page.tsx`, `layout.tsx`, and similar files that the framework **requires** as the default export.
-- **Stricter framework contracts**: e.g. Storybook or tooling that only accepts `export default` (prefer named exports in the same file for everything else, or a thin default wrapper that re-exports a named symbol).
-- **Generated or third-party patterns**: match the existing file’s style when the file is not yours to own.
-
-## Imports
-
-- Use `import { foo } from './bar.js'`, not `import foo from './bar.js'`, for named exports.
-- Re-exporting: `export { foo } from './bar.js'` in barrels instead of re-exporting a default with an alias, when possible.
-
-## Related
-
-- ESM: `.js` extension in import paths (see repo `tsconfig` / `.cursorrules` stack notes). The Podverse monorepo has the same skill for cross-repo consistency.
diff --git a/.llm/exports/github-copilot/skills/release-changelog/SKILL.md b/.llm/exports/github-copilot/skills/release-changelog/SKILL.md
deleted file mode 100644
index 73b385b1..00000000
--- a/.llm/exports/github-copilot/skills/release-changelog/SKILL.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-name: release-changelog
-description: "Use version-first changelog files (docs/development/CHANGELOGS/X.Y.Z.md): bump version at start of work and write release notes continuously for staging and main releases."
----
-
-
-# Release changelog (Metaboost)
-
-## When to use
-
-When you ship or finish work that is **worth calling out** in preprod/prod release notes: behavior changes, new surfaces, important fixes, or ops-impacting updates—not every internal cleanup.
-
-## What to update
-
-- Use [docs/development/CHANGELOGS/X.Y.Z.md](../../docs/development/CHANGELOGS/) where `X.Y.Z` is the current base version in `package.json`.
-- Bump version **at the start of work** with `scripts/publish/bump-version.sh` so `docs/development/CHANGELOGS/X.Y.Z.md` exists before implementation.
-- Keep updating that same semver file continuously as work lands.
-
-## Conventions
-
-1. **Order** — **Most important first** (safety, security, data, then big features, then smaller fixes; skip low-signal items).
-2. **Wording** — Short, clear lines; link issues/PRs if useful.
-3. **Single source** — Staging prereleases and main production releases both read the same `X.Y.Z.md` file.
-4. **Brevity** — Concise, not a duplicate of git log.
-
-## Naming in CI
-
-- Git branch **`staging`** runs **Publish (staging)**: **`X.Y.Z-staging.N`** and float **`staging`** in GHCR. Cluster “alpha” in GitOps (path/namespace) is separate.
-- Pushes to **`main`** run **Publish (main)**: promote to RTM **`X.Y.Z`** and **`:latest`**.
-
-## Related
-
-- [PUBLISH.md](../../PUBLISH.md) — full publish flow, Git tag, and GitOps pins.
diff --git a/.llm/exports/github-copilot/skills/response-ending-make-verify/SKILL.md b/.llm/exports/github-copilot/skills/response-ending-make-verify/SKILL.md
deleted file mode 100644
index 2d962066..00000000
--- a/.llm/exports/github-copilot/skills/response-ending-make-verify/SKILL.md
+++ /dev/null
@@ -1,77 +0,0 @@
----
-name: response-ending-make-verify
-description: End implementation responses with scoped make-based screenshot report commands for web and management-web verification.
-version: 1.4.0
----
-
-
-# Response-Ending Make Verification
-
-The Cursor rule `end-with-targeted-make-report-verify` enforces this behavior; this skill is the extended reference (command tree, API gate, multi-spec).
-
-Use this skill when answering implementation requests in this repo.
-
-## Do not run tests during agent or plan work
-
-- **Never run test or verification commands** (e.g. `make e2e_test_web`, `npm run test`, `make e2e_test_web_signup_enabled`) as part of your agent or plan implementation work.
-- **Only instruct the user** to run those commands after your work is done. Provide the exact command(s) in a fenced `bash` block so the user can copy and run them.
-- This keeps agent sessions fast, avoids flaky runs in automation, and leaves verification to the user in their environment.
-
-## Required response behavior
-
-1. Give the user a runnable make command they can copy and run to verify the change; include it in a fenced `bash` code block at the end of the response.
-2. End every implementation response with one or more runnable `make` commands.
-3. Do not suggest direct Playwright execution (`npx playwright test ...` or `npm run test:e2e -w ...`) for standard E2E verification; use the `make` wrappers so seed/setup is included.
-4. **E2E-affected changes (mandatory):** If the change affects E2E tests in any way (e.g. you modified UI in apps/web or apps/management-web, or you added/edited files under `apps/web/e2e/` or `apps/management-web/e2e/`), you **MUST** end the response with a fenced `bash` block containing the **EXACT** command(s) the user needs to run to E2E-verify that change. No exception. Use the specific spec path(s) that cover the changed behavior (e.g. `make e2e_test_web_report_spec SPEC=e2e/settings-bucket-owner.spec.ts`). This is non-negotiable.
-5. Prefer feature-scoped screenshot report commands over full-suite commands.
-6. Choose the smallest command set that verifies the changed behavior.
-7. Only recommend full-suite report mode when scope is broad or cross-cutting.
-8. Render final verification commands inside a fenced `bash` code block so the UI shows a copy button.
-9. Inside the fenced block, keep one command per line and avoid bullets/backticks.
-
-## Command selection decision tree
-
-- Web-only feature (single page/flow):
-  - `make e2e_test_web_report_spec SPEC=e2e/<web-spec>.spec.ts`
-- Signup-enabled web flows (duplicate email, successful signup redirect):
-  - `make e2e_test_web_signup_enabled`
-- Management-web-only feature (single page/flow):
-  - `make e2e_test_management_web_report_spec SPEC=e2e/<management-spec>.spec.ts`
-- Cross-app feature touching both web and management-web:
-  - `make e2e_test_report_scoped WEB_SPEC=e2e/<web-spec>.spec.ts MGMT_SPEC=e2e/<management-spec>.spec.ts`
-- Lightweight broad smoke check:
-  - `make e2e_test_home_report`
-- Broad regression or pre-deploy confidence (four reports: one per web auth mode + management-web):
-  - `make e2e_test_report`
-
-## API gate: default is no API tests (required)
-
-- **Default (no env var):** E2E commands **do not run** API integration tests. The Makefile default is `E2E_API_GATE_MODE=off`. When you give the user E2E verification commands, **always** give them without `E2E_API_GATE_MODE` so they get the default (skip API tests). This is required for all E2E-only verification.
-- **Only when the change affected API tests:** If you modified API code, integration tests, auth, seed, or backend packages that could affect E2E outcomes, then give the user a command that **includes** API tests by prefixing with `E2E_API_GATE_MODE=on` (e.g. `make E2E_API_GATE_MODE=on e2e_test_web_report_spec SPEC=e2e/...`). Otherwise do **not** add the env var.
-- **Optional:** User can pass `E2E_API_GATE_MODE=on` to run API tests before E2E; `E2E_API_GATE_MODE=auto` to run API tests only when changed files match API-impacting paths.
-
-Examples (E2E-only, no API tests — use these by default):
-
-- `make e2e_test_web_report_spec SPEC=e2e/<web-spec>.spec.ts`
-- `make e2e_test_management_web_report_spec SPEC=e2e/<management-spec>.spec.ts`
-- `make e2e_test_web_admin_only_email_report_spec SPEC=e2e/<spec>.spec.ts`
-
-When API tests are needed (only if change affected API/integration tests):
-
-- `make E2E_API_GATE_MODE=on e2e_test_web_report_spec SPEC=e2e/<web-spec>.spec.ts`
-- `make E2E_API_GATE_MODE=on e2e_test_management_web_report_spec SPEC=e2e/<management-spec>.spec.ts`
-- `make E2E_API_GATE_MODE=on e2e_test_report_scoped WEB_SPEC=... MGMT_SPEC=...`
-
-Multi-spec input:
-
-- `SPEC`, `WEB_SPEC`, and `MGMT_SPEC` support comma-separated values.
-- Example:
-  - `make e2e_test_web_report_spec SPEC=e2e/buckets.spec.ts,e2e/invite.spec.ts`
-  - `make e2e_test_report_scoped WEB_SPEC=e2e/buckets.spec.ts,e2e/bucket-detail.spec.ts MGMT_SPEC=e2e/buckets.spec.ts,e2e/events.spec.ts`
-
-## Notes
-
-- These report-mode targets capture step screenshots and write timestamped HTML reports in `.artifacts/e2e-reports/`.
-- API gate: default is `off` (no API tests). Pass `E2E_API_GATE_MODE=on` to include API integration tests; `E2E_API_GATE_MODE=auto` for conditional run based on changed files.
-- If a response includes non-UI/API-internal work, still end with the nearest relevant verification command and briefly explain why it is the best available check.
-- If a verification command requires interactive input, stop and hand off using the **interactive-prompts** skill.
diff --git a/.llm/exports/github-copilot/skills/reusable-components/SKILL.md b/.llm/exports/github-copilot/skills/reusable-components/SKILL.md
deleted file mode 100644
index 8d804e33..00000000
--- a/.llm/exports/github-copilot/skills/reusable-components/SKILL.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: reusable-components
-description: Prefer reusable components and keep globals minimal. Use when adding layout, form, or UI that could be reused, or when adding styles to globals.scss.
-version: 1.0.0
----
-
-
-# Reusable Components
-
-**When to use:** Any time you are adding layout, form, or UI that could be reused, or when you are about to add styles to `globals.scss` (or app-level global CSS).
-
-## Principles
-
-1. **Prefer reusable components** over one-off markup and global class names. If the same structure or pattern appears on more than one page (or might in the future), extract it into a component.
-2. **Keep globals to a minimum.** Use `globals.scss` only for true app-wide basics (e.g. `html`/`body`, root layout wrappers like `.app-view`). Page- or feature-specific layout and styling belong in component module SCSS or layout components.
-3. **Colocate styles with components.** Use CSS modules (e.g. `ComponentName.module.scss`) for component-specific styles so they are scoped and easy to find.
-
-## Examples
-
-- **Auth form layout:** Use a shared `AuthFormLayout` (or similar) component with its own `.module.scss` instead of auth-specific classes in `globals.scss`.
-- **Repeated page structure:** If multiple pages share a wrapper (e.g. centered card, same padding), create a layout component that accepts `children` and owns the structure and styles.
-
-## Checklist
-
-- Am I adding a class to `globals.scss`? → Consider a reusable component + module SCSS instead.
-- Does this layout/structure appear (or could it appear) on more than one route? → Extract to a component.
diff --git a/.llm/exports/github-copilot/skills/roles-schema-sync/SKILL.md b/.llm/exports/github-copilot/skills/roles-schema-sync/SKILL.md
deleted file mode 100644
index e70f2c0e..00000000
--- a/.llm/exports/github-copilot/skills/roles-schema-sync/SKILL.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-name: roles-schema-sync
-description: When changing DB schema or permission dimensions, consider predefined roles and bucket_role / role-related code.
----
-
-
-# Roles and schema / permission changes
-
-## When to use
-
-When changing **DB schema** (especially permission-related columns or new resource types), or when **adding/removing CRUD dimensions** for bucket admins.
-
-## What to consider
-
-1. **Predefined roles** are defined in code (`packages/helpers/src/bucketRoles/constants.ts`) and may need:
-   - New entries (e.g. a new predefined role id and nameKey).
-   - Updated bitmasks (`bucketCrud`, `bucketMessagesCrud`, `bucketAdminsCrud`) if CRUD semantics change.
-   - i18n keys in apps (e.g. `roles.full`, `roles.noUpdate`) and in management-web/originals.
-
-   Use parent-prefixed names for nested resources (e.g. `bucketMessagesCrud`); see **nested-resource-prefix-naming**.
-
-2. **Custom roles** live in schema tables (`bucket_role`, `management_admin_role`). Adding columns or changing CRUD semantics may require:
-   - Migrations and init SQL updates together (keep both in sync):
-     - Main DB: `infra/k8s/base/db/source/app/0001_app_schema.sql` (canonical)
-     - Management DB: `infra/k8s/base/db/source/management/0001_management_schema.sql` (canonical)
-   - ORM entity and `BucketRoleService` updates.
-   - Management-api schemas (Joi), controller, and OpenAPI updates.
-   - Helpers-requests types and API helpers.
-
-3. **UI** that lists or applies roles (dropdowns, Roles tab, role create/edit forms) may need to:
-   - Reflect new permission dimensions or labels.
-   - Update CrudCheckboxes or role option shapes if CRUD bits change.
-
-## Key files
-
-- Predefined: `packages/helpers/src/bucketRoles/constants.ts`
-- DB (main): `infra/k8s/base/db/source/app/0001_app_schema.sql`
-- DB (management): `infra/k8s/base/db/source/management/0001_management_schema.sql`
-- ORM: `packages/orm` (BucketRole entity, BucketRoleService)
-- API: `apps/management-api` (bucket roles routes, controller, schemas)
-- Client: `packages/helpers-requests` (bucket roles), `packages/ui` (BucketAdminsView, EditBucketAdminForm, BucketSettingsTabs)
diff --git a/.llm/exports/github-copilot/skills/single-focus-indicator/SKILL.md b/.llm/exports/github-copilot/skills/single-focus-indicator/SKILL.md
deleted file mode 100644
index d4393eba..00000000
--- a/.llm/exports/github-copilot/skills/single-focus-indicator/SKILL.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-name: single-focus-indicator
-description: Use exactly one visible focus indicator per focusable element; when using the focus-ring mixin, do not also change border or add a second outline.
-version: 1.0.0
----
-
-
-# Single focus indicator (no double focus)
-
-**When to use:** When adding or changing focus styles on buttons, links, selects, inputs, or any focusable component in `@metaboost/ui` or app code.
-
-## Rule
-
-Use **exactly one** visible focus indicator per focusable element. Do not combine multiple indicators (e.g. outline **and** border-color change, or outline **and** box-shadow) on the same element when focused.
-
-- When using the `focus-ring` mixin (`@include focus-ring` from `packages/ui/src/styles/_mixins.scss`), do **not** also change `border-color` or add a second outline/ring on `:focus` or `:focus-visible`. The mixin already provides an outline; adding a border-color change causes a "double focus" (inner border + outer outline).
-- If you need a custom focus style, use a single mechanism: either the mixin’s outline, or only border, or only box-shadow—not more than one.
-- Keep `outline: none` on `:focus` only to suppress the browser default; then use `:focus-visible` (e.g. via the mixin) for the one visible indicator so keyboard users get a clear ring.
-
-## Checklist
-
-- Does this component set both an outline/ring and a border (or box-shadow) change on focus? If yes, remove one.
-- When using `@include focus-ring`, is there a separate `&:focus { border-color: ... }` (or similar)? If yes, remove the border-color (or other second indicator) so only the focus-ring outline shows.
-- Prefer `:focus-visible` and the shared `focus-ring` mixin for keyboard-visible focus.
diff --git a/.llm/exports/github-copilot/skills/single-readme/SKILL.md b/.llm/exports/github-copilot/skills/single-readme/SKILL.md
deleted file mode 100644
index d041d4d9..00000000
--- a/.llm/exports/github-copilot/skills/single-readme/SKILL.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-name: single-readme
-description: The Metaboost monorepo has exactly one README.md (at repo root). Use when adding index/overview docs or creating new directories so you do not add a second README.
-version: 1.0.0
----
-
-
-# Single README (Metaboost)
-
-The **Metaboost monorepo must have exactly one README.md**, at the **repository root** (`README.md`).
-
-## Do
-
-- Keep the single project README at the repo root.
-- For directory docs use **full-path names** (e.g. `INFRA-K8S.md`, `PACKAGES-UI.md`) per the documentation-conventions skill.
-- The only `INDEX.md` in the repo is `.llm/exports/github-copilot/skills/INDEX.md`. Plan-set indexes under `.llm/plans/` use `00-overview.md` or `00-master-plan.md`.
-
-## Don't
-
-- Do **not** create `README.md` in any subdirectory (apps, packages, infra, .llm/plans, .cursor/skills, etc.).
-- Do not add a second README or a second INDEX when introducing a new area; use the full-path doc name instead.
-
-## When to use this skill
-
-- Adding new documentation or index files.
-- Creating new directories that need an overview or index.
-- Planning or editing docs under `.llm/`, `infra/`, `packages/`, `apps/`, or `.cursor/`.
diff --git a/.llm/exports/github-copilot/skills/sort-prefs-cookie-by-path/SKILL.md b/.llm/exports/github-copilot/skills/sort-prefs-cookie-by-path/SKILL.md
deleted file mode 100644
index aafab310..00000000
--- a/.llm/exports/github-copilot/skills/sort-prefs-cookie-by-path/SKILL.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-name: sort-prefs-cookie-by-path
-description: Persist list and sort preferences in cookies keyed by path/list id; server reads cookies when URL has no query params; in-app list actions strip the query string and refetch list data via the API with the global async loading overlay (never router.refresh for sort/filter metadata).
----
-
-
-# Sort and list state cookies (Metaboost)
-
-Use this skill when adding or changing sort UI (messages recent/oldest, table sortBy/sortOrder), search, filters, pagination, bucket detail tabs, or other list metadata.
-
-**Policy:** User actions inside the app must **not** leave sort/filter/pagination/tab metadata in the URL after the user changes a control. Persist state in cookies (plus existing sort-prefs keys where applicable). **Direct or bookmarked URLs** may still include `?…`; the server honors those **`searchParams` on that request** when present. On the **first in-app** change to list metadata, **`router.replace(pathname)`** strips all query params for that page; cookies remain the source of truth afterward.
-
-**Loading UX:** List metadata updates (**sort, filter, search, pagination**) must **not** use **`router.refresh()`**. Use **`useCookieModeListRefresh`** with a parent callback that **calls the HTTP API** with cookie-derived query params and **replaces** displayed rows/state with the response, wrapped by **`runAsyncLoad`** via **`useAsyncPageLoading`** so **`NavigationLoadingOverlay`** shows during the request. Omitting the callback makes **`useCookieModeListRefresh`** fall back to **`router.refresh()`** — avoid that whenever a full RSC reload is unnecessary (including **bucket-detail tab switching**: prefer **client `activeTab`** inside **`BucketDetailTabShell`** and optional **`router.push` with `?tab=`** when context is unavailable; tab is **not** persisted in **`bucket_detail_nav`**). It is **not** acceptable for sort/filter list updates on data tables.
-
-## Path-based keys (sort prefs cookie)
-
-- `TABLE_SORT_PREFS_COOKIE_NAME` / `management_table_sort_prefs`: map keys such as `bucket-detail-messages` (`{ sort }`) and `bucket-detail-buckets` (`SortPref`).
-- Same pattern for dashboard/management lists: keys like `dashboard-buckets`, `admins`, `events`, etc.
-
-## Table list state cookie
-
-- **`TABLE_LIST_STATE_COOKIE_NAME`** / **`management_table_list_state`**: JSON map keyed by the same **list key** as sort prefs. Stores optional `search`, `filterColumns`, `page`, and (events) `timelineSort`.
-- Server pages merge **URL params first**, then fall back to this cookie when a param is absent.
-- Client tables pass **`tableListStateCookieName`** + **`sortPrefsListKey`** into `TableWithFilter` / `ResourceTableWithFilter` and **`onListMetadataChange`** so controls write cookies and **client-fetch** list data instead of pushing query strings or doing a full RSC reload.
-
-## Bucket detail navigation cookie
-
-- **`BUCKET_DETAIL_NAV_COOKIE_NAME`** (per app): map keyed by **bucket pathname** (e.g. `/bucket/idText`). Stores optional **`messagesPage`**, **`includeBlockedSenderMessages`** — **not** active tab (tab uses **`searchParams.tab`** when present; default tab is Messages when absent).
-- Tab links share the same pathname. **Bucket detail (web + management-web):** **`BucketDetailTabShell`** uses **`BucketDetailTabNavContext`** for **`selectTab`** (**URL strip** + client **`activeTab`** without tab cookie); fallback tab clicks **`router.push` with `?tab=`**. Post-create redirects attach **`?tab=add-to-rss`** / **`?tab=endpoint`** as needed. When the user opens **Messages** after landing on another tab, the messages panel **client-fetches** if SSR did not load the list.
-
-## Messages sort
-
-- **`MessagesSortSelect`**: `setMessagesSortInCookie` then shared **`onAfterCookieWrite` / list refetch** — the messages list must **refetch messages from the API** (see web messages tab); do not use **`router.refresh()`** for applying the new sort to message rows.
-
-## See also
-
-- **table-sort-defaults** — default sort order by column type.
-- **tables-support-sorting** — ensuring tables support sorting.
diff --git a/.llm/exports/github-copilot/skills/storybook-component-docs/SKILL.md b/.llm/exports/github-copilot/skills/storybook-component-docs/SKILL.md
deleted file mode 100644
index ef5145bf..00000000
--- a/.llm/exports/github-copilot/skills/storybook-component-docs/SKILL.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-name: storybook-component-docs
-description: Add or update Storybook stories when adding or changing UI components in packages/ui. Use when creating or modifying components in @metaboost/ui.
-version: 1.0.0
----
-
-
-# Storybook component docs
-
-**When to use:** When you add a new component to `packages/ui`, or when you change a component’s props, variants, or visible behavior in a way that should be documented or visually verified.
-
-## Principles
-
-1. **Co-locate stories with components.** Add a `ComponentName.stories.tsx` file next to (or in the same directory as) the component.
-2. **Use CSF (Component Story Format).** Default export is `meta` (`Meta<typeof Component>`); named exports are stories (`StoryObj<typeof Component>`).
-3. **Cover main variants and states.** Include at least one default story; add stories for variants (e.g. primary/secondary), loading, disabled, and error states where relevant.
-4. **Expose props as controls.** Use `argTypes` in meta so docs and controls reflect the component’s API.
-
-## How to run Storybook
-
-From repo root (use Nix wrapper in agent/automated environments):
-
-```bash
-./scripts/nix/with-env npm run storybook -w @metaboost/ui
-```
-
-Or from `packages/ui`: `npm run storybook`. Dev server runs at http://localhost:6006.
-
-## Reference
-
-- **Package doc:** [packages/ui/PACKAGES-UI.md](../../../packages/ui/PACKAGES-UI.md) – how to run Storybook, where stories live, how to add a new story.
diff --git a/.llm/exports/github-copilot/skills/swagger-openapi/SKILL.md b/.llm/exports/github-copilot/skills/swagger-openapi/SKILL.md
deleted file mode 100644
index 9b8ec498..00000000
--- a/.llm/exports/github-copilot/skills/swagger-openapi/SKILL.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-name: swagger-openapi
-description: Keep the OpenAPI spec in sync with API endpoints. Use when adding, changing, or removing API routes, request/response bodies, or auth requirements.
----
-
-
-# Swagger / OpenAPI sync
-
-## Rule
-
-**Whenever you change API endpoints**, update the OpenAPI spec so `/api-docs` (Swagger UI) stays accurate and testable.
-
-- **Add a route** → Add the path, method, requestBody, responses, and (if protected) `security: [{ bearerAuth: [] }]` in the spec.
-- **Change request/response shape** → Update the relevant `components.schemas` and path definitions.
-- **Remove or rename a route** → Remove or update the path in the spec.
-- **Change which routes require auth** → Update the path’s `security` array in the spec.
-
-## Where the spec lives
-
-- **Single source**: `apps/api/src/openapi.ts` exports `openApiDocument` (OpenAPI 3.0).
-- **Served at**: `GET /api-docs` via `swagger-ui-express` in `apps/api/src/index.ts`.
-
-## What to keep in sync
-
-- **Paths**: Every public route (e.g. `GET /`, `GET /health`, `GET /auth/me`, `POST /auth/login`, etc.) should have a matching path in `openApiDocument.paths`.
-- **Schemas**: Request bodies and response bodies that have a defined shape should use or define a schema under `components.schemas` and reference with `$ref`.
-- **Security**: Endpoints that use `requireAuth` must have `security: [{ bearerAuth: [] }]` and document 401 responses.
-- **Status codes**: Document the real status codes and (when applicable) response bodies (e.g. 400, 401, 403, 409, 500).
-
-## Checklist when touching the API
-
-After editing any of:
-
-- `apps/api/src/index.ts` (new top-level routes)
-- `apps/api/src/routes/*.ts`
-- `apps/api/src/controllers/*.ts` (if response/request shape changes)
-
-ask: **Did I update `apps/api/src/openapi.ts`?** If not, update it in the same change set.
diff --git a/.llm/exports/github-copilot/skills/tab-active-state-url-match/SKILL.md b/.llm/exports/github-copilot/skills/tab-active-state-url-match/SKILL.md
deleted file mode 100644
index c4d83a6a..00000000
--- a/.llm/exports/github-copilot/skills/tab-active-state-url-match/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: tab-active-state-url-match
-description: Ensure Tabs active state works with and without URL params by passing the canonical tab href as activeHref, not a URL with extra query params.
-version: 1.0.0
----
-
-
-# Tab active state and URL matching
-
-**When to use:** When adding or changing tab navigation that uses `Tabs` from `@metaboost/ui` with `exactMatch`, or when the tab URL can have query params (e.g. `?tab=messages`, `?sort=oldest`).
-
-This file is the authority for canonical tab href and `activeHref` matching behavior.
-
-## Rule
-
-For the active tab to be highlighted reliably:
-
-1. **Canonical tab href:** Each tab item's `href` should be the canonical URL for that tab (the base URL users land on when they click the tab, e.g. path only or path + minimal params like `?tab=buckets`).
-2. **activeHref must match that href:** When passing `activeHref` to `Tabs`, it must equal the **same** href as the tab item for the current tab. Do **not** pass the full current URL if it includes extra query params (e.g. `sort`, `page`) that are not part of the tab item's href.
-
-Otherwise, with `exactMatch`, `currentHref === item.href` will be false (e.g. `activeHref` is `/bucket/1?tab=messages&sort=oldest` but the Messages tab's href is `/bucket/1`), and no tab will appear active.
-
-## Implementation
-
-- Derive the current tab from the URL (e.g. `searchParams.tab === 'buckets' ? 'buckets' : 'messages'`).
-- Set `activeHref` to the **canonical** href for that tab—the same value as the corresponding item in `items` (e.g. when on messages tab use `bucketViewRoute(id)` or `bucketDetailRoute(id)`, not a URL that includes `&sort=oldest` or `&page=2`).
-
-## Checklist
-
-- Are tab items using canonical hrefs (base URL per tab)?
-- Is `activeHref` set to the canonical href for the current tab (same as the tab item's href), not the full URL with sort/page/other params?
-- When the URL has no tab param, does your default tab match one of the item hrefs (e.g. pathname-only for default tab)?
diff --git a/.llm/exports/github-copilot/skills/table-sort-defaults/SKILL.md b/.llm/exports/github-copilot/skills/table-sort-defaults/SKILL.md
deleted file mode 100644
index c50c1c14..00000000
--- a/.llm/exports/github-copilot/skills/table-sort-defaults/SKILL.md
+++ /dev/null
@@ -1,76 +0,0 @@
----
-name: table-sort-defaults
-description: Default sort order by column type for sortable tables; use when adding or changing sortable tables or backend list endpoints.
----
-
-
-# Table Sort Defaults (Metaboost)
-
-Use this skill when adding or changing sortable tables (ResourceTableWithFilter, TableWithFilter, **TableWithSort**) or backend list endpoints that accept sortBy/sortOrder. Keeps sort indicators and data order consistent with user expectations. For ensuring any table that displays list data supports sorting, see **tables-support-sorting** (`.llm/exports/github-copilot/skills/tables-support-sorting/SKILL.md`). For persisting sort in a cookie by path (e.g. bucket-detail messages/buckets), see **sort-prefs-cookie-by-path** (`.llm/exports/github-copilot/skills/sort-prefs-cookie-by-path/SKILL.md`).
-
-This file is the authority for default sort-order rules by column type.
-
-## Default sort order by column type
-
-| Column type | Default order          | Rationale                                                      |
-| ----------- | ---------------------- | -------------------------------------------------------------- |
-| **String**  | `asc` (A→Z)            | Alphabetical is the natural reading order.                     |
-| **Number**  | `asc` (smallest first) | Ascending is conventional unless "latest" is the goal.         |
-| **Date**    | `desc` (newest first)  | Lists (events, admins by created) typically show newest first. |
-
-The header icon reflects the **current** sort: up = ascending, down = descending. So string columns should default to asc and show an up arrow on first load.
-
-## Frontend: column defaultSortOrder
-
-- **TableFilterBarColumn** (in `packages/ui`) supports optional `defaultSortOrder?: 'asc' | 'desc'`.
-- **ResourceTableWithFilter** and **TableWithFilter** use it when:
-  - Setting initial `sortBy`/`sortOrder` in the URL (first sortable column’s default).
-  - Deriving `effectiveSortOrder` when the URL has no `sortOrder` (active column’s default).
-- If you omit `defaultSortOrder`, legacy behavior is used (default `'desc'`).
-
-When adding or changing a sortable table, set `defaultSortOrder` on each column:
-
-- String columns: `defaultSortOrder: 'asc'`.
-- Date columns (e.g. timestamp, createdAt): `defaultSortOrder: 'desc'`.
-- Number columns: `defaultSortOrder: 'asc'`.
-
-Example (buckets list, string columns):
-
-```ts
-const columns = [
-  { id: 'name', label: t('name'), defaultSortOrder: 'asc' as const },
-  { id: 'isPublic', label: t('isPublic'), defaultSortOrder: 'asc' as const },
-];
-```
-
-Example (events, timestamp first):
-
-```ts
-const eventColumns = [
-  { id: 'timestamp', label: tCommon('eventsTable.timestamp'), defaultSortOrder: 'desc' as const },
-  { id: 'actor', label: tCommon('eventsTable.actor'), defaultSortOrder: 'asc' as const },
-  // ...
-];
-```
-
-## Backend: default when sortOrder is missing
-
-When the API receives `sortBy` but no `sortOrder`, default according to the sort field:
-
-- **Date-like fields** (e.g. `createdAt`, `timestamp`): default **DESC**.
-- **Other fields** (string, number): default **ASC**.
-
-Examples:
-
-- `packages/orm` **BucketService**: `orderDir = orderBy === 'createdAt' ? 'DESC' : 'ASC'` when sortOrder is undefined.
-- `packages/management-orm` **ManagementUserService**: same for admins list.
-- **management-api** list controllers (e.g. usersController): when `sortOrder` is missing, use ASC for string fields and DESC for date fields (e.g. `sortBy === 'createdAt' ? 'DESC' : 'ASC'`).
-
-This keeps direct API calls and any URL without `sortOrder` aligned with the same UX.
-
-## Where this is implemented
-
-- **UI types**: `packages/ui/src/components/table/TableFilterBar/TableFilterBar.tsx` — `TableFilterBarColumn.defaultSortOrder`.
-- **Table components**: `packages/ui/src/components/table/ResourceTableWithFilter/ResourceTableWithFilter.tsx`, `packages/ui/src/components/table/TableWithFilter/TableWithFilter.tsx` — initial effect and `effectiveSortOrder` fallback.
-- **Pages**: Column arrays in list pages (e.g. `apps/web/.../buckets/page.tsx`, `apps/management-web/.../admins/page.tsx`, `users/page.tsx`, `buckets/page.tsx`, `events/page.tsx`).
-- **Backend**: `packages/orm/src/services/BucketService.ts`, `packages/management-orm/src/services/ManagementUserService.ts`, `apps/management-api/src/controllers/usersController.ts` (and any other list endpoint that accepts sortBy/sortOrder).
diff --git a/.llm/exports/github-copilot/skills/tables-support-sorting/SKILL.md b/.llm/exports/github-copilot/skills/tables-support-sorting/SKILL.md
deleted file mode 100644
index 285cd634..00000000
--- a/.llm/exports/github-copilot/skills/tables-support-sorting/SKILL.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-name: tables-support-sorting
-description: Ensure tables that display list data support sortable columns; use TableWithSort or Table.SortableHeaderCell and follow table-sort-defaults.
----
-
-
-# Tables Support Sorting (Metaboost)
-
-Use this skill when adding or changing tables that display list data (e.g. buckets, admins, messages). Every such table should support sortable columns where it makes sense, so users can order by name, date, or other relevant fields.
-
-This is the **orchestration** skill for sortable tables:
-
-- Use this file to decide whether a table should support sorting and which table primitive to use.
-- Use **table-sort-defaults** as the authority for default order rules.
-- Use **sort-prefs-cookie-by-path** as the authority for persistence/restore behavior.
-
-## How to add sorting
-
-1. **TableWithSort** (`packages/ui`): Use for tables that only need sortable headers (no filter bar, no pagination). It renders `Table` with a configurable header row: sortable columns use `Table.SortableHeaderCell`, others use `Table.HeaderCell`. You pass `columns` (with `sortable`, `sortKey`, `defaultSortOrder`), `sortBy`, `sortOrder`, and `onSortChange(sortKey)`. The parent owns sort state (e.g. URL params) and navigates or updates state in `onSortChange`.
-
-2. **Table.SortableHeaderCell**: For one-off sortable headers or custom table layouts, use the base `Table.SortableHeaderCell` directly with `sortKey`, `label`, `activeSortBy`, `sortOrder`, `onSort`.
-
-3. **TableWithFilter / ResourceTableWithFilter**: For list pages that already have a filter bar and pagination, these components already support sortable columns via `sortableColumnIds` and URL/cookie. No change needed unless adding new columns.
-
-## Default sort order
-
-Follow **table-sort-defaults** (`.llm/exports/github-copilot/skills/table-sort-defaults/SKILL.md`) for all default-order decisions.
-
-## Sort state
-
-- **URL-driven**: For server-rendered pages, read `sortBy` and `sortOrder` from `searchParams`; sort data on the server; pass `sortBy`, `sortOrder`, and a base path (or callback) so the client can navigate to new sort params. Omit default sort from the URL for a clean default (e.g. `?tab=buckets` without `sortBy`/`sortOrder` when sort is name/asc). For persistence/restore rules, use **sort-prefs-cookie-by-path**.
-- **Parent-controlled**: Pass `onSortChange(sortKey)` and let the parent update URL or local state and re-render.
-
-## Example
-
-Bucket detail topics table uses **TableWithSort**: columns Name (asc), Last Message (desc), Created (desc), plus non-sortable Public and Actions. The page reads `sortBy`/`sortOrder` from the URL, sorts child buckets, and passes `topicsSortBy`, `topicsSortOrder`, `topicsSortBasePath` into `BucketDetailContent`, which renders `TableWithSort` and navigates on header click.
diff --git a/.llm/exports/github-copilot/skills/typeorm-orderby-property-names/SKILL.md b/.llm/exports/github-copilot/skills/typeorm-orderby-property-names/SKILL.md
deleted file mode 100644
index ec7c42a3..00000000
--- a/.llm/exports/github-copilot/skills/typeorm-orderby-property-names/SKILL.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: typeorm-orderby-property-names
-description: In TypeORM query builder use entity property names (camelCase) for orderBy, not database column names (snake_case). Use when writing or editing createQueryBuilder().orderBy() in packages/orm or apps that use TypeORM.
----
-
-
-# TypeORM orderBy: use property names
-
-## Rule
-
-When calling `.orderBy()` on a TypeORM `SelectQueryBuilder`, pass the **entity property name** (camelCase), not the database column name (snake_case). TypeORM resolves the string to column metadata by property name; if you pass the DB column name, resolution fails and you get `TypeError: Cannot read properties of undefined (reading 'databaseName')`.
-
-## Do
-
-- `.orderBy('bucket.createdAt', 'DESC')` — property name; TypeORM maps to `created_at` in SQL.
-- `.orderBy('user.displayName', 'ASC')` — property name.
-
-## Don't
-
-- `.orderBy('bucket.created_at', 'DESC')` — column name; no matching property, column is undefined.
-- `.orderBy('user.display_name', 'ASC')` — same issue.
-
-## When it applies
-
-- Any `createQueryBuilder('alias').orderBy('alias.someField', ...)` in `packages/orm` (or other TypeORM usage in the repo).
-- Expressions like `.orderBy('LOWER(alias.name)', 'ASC')` are fine; the problem is only when the second token is meant to be a single column reference that TypeORM looks up on the entity.
diff --git a/.llm/exports/github-copilot/skills/unit-tests-confident-granularity/SKILL.md b/.llm/exports/github-copilot/skills/unit-tests-confident-granularity/SKILL.md
deleted file mode 100644
index 9d3434bc..00000000
--- a/.llm/exports/github-copilot/skills/unit-tests-confident-granularity/SKILL.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-name: unit-tests-confident-granularity
-description: Enforces Metaboost unit-test scope at a confident-not-bulletproof level. Use when writing unit tests to avoid both under-testing and excessive combinatorial test complexity.
-version: 1.0.0
----
-
-
-# Unit Tests - Confident Granularity
-
-## Goal
-
-Deliver strong confidence without turning test suites into unmaintainable exhaustive matrices.
-
-## Confident Coverage Rule
-
-For each critical module under test, include:
-
-1. Happy path behavior.
-2. Guard/rejection behavior for invalid input or state.
-3. Boundary behavior (limits, edge values, time windows).
-4. Safe-failure behavior (no privileged fallback).
-
-## Stop Conditions (Avoid Over-Testing)
-
-Do not keep adding unit tests once all are true:
-
-- Every meaningful branch has at least one direct assertion.
-- At least one representative negative case exists for each guard.
-- Additional cases only duplicate already-proven behavior.
-
-## What To Avoid
-
-- Exhaustive Cartesian permutations that do not add new behavior confidence.
-- Snapshot-heavy tests for business logic.
-- Tests that lock internal implementation details instead of module contract.
-
-## Permutation Sampling Guidance
-
-When a matrix is large, use representative rows:
-
-- One allow example per permission source (owner, admin, etc.).
-- One deny example per missing permission path.
-- One edge case for malformed/missing data.
-
-Add more rows only when they validate a different branch.
diff --git a/.llm/exports/github-copilot/skills/unit-tests-risk-first/SKILL.md b/.llm/exports/github-copilot/skills/unit-tests-risk-first/SKILL.md
deleted file mode 100644
index cb965b77..00000000
--- a/.llm/exports/github-copilot/skills/unit-tests-risk-first/SKILL.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-name: unit-tests-risk-first
-description: Prioritizes unit tests by risk and regression impact in Metaboost. Use when adding or expanding unit tests so coverage is focused on auth, authorization, security boundaries, and high-reuse helpers before lower-risk code.
-version: 1.0.0
----
-
-
-# Unit Tests - Risk First
-
-## Use This Skill When
-
-- Creating a new unit-test backlog.
-- Expanding coverage in a large area and deciding what to test first.
-- Choosing between multiple candidate modules for limited time.
-
-## Priority Order
-
-1. **Auth and identity boundaries**
-   - JWT claim handling, assertion verification, session/cookie safety.
-2. **Authorization decisions**
-   - Permission and role checks, allow/deny branching.
-3. **Security-sensitive transforms**
-   - Token hashing/expiry logic, request binding checks, serialization guards.
-4. **High-reuse helper logic**
-   - Shared helper functions used by multiple apps/packages.
-5. **UI utility logic**
-   - Frontend policy helpers that gate user actions.
-
-## Selection Rule
-
-When choosing the next test target, prefer modules with:
-
-- Higher blast radius (many callers or privileged code path).
-- Higher probability of silent failure (wrong allow/deny outcome).
-- Higher user/security impact if behavior drifts.
-
-Skip low-risk wrappers until higher-risk targets have coverage.
-
-## Required Output Shape
-
-When proposing or implementing tests, include:
-
-- Why this target is high-priority.
-- Which behavior branches are being covered.
-- Which lower-priority targets are intentionally deferred.
diff --git a/.llm/exports/github-copilot/skills/unit-tests-security-authz-template/SKILL.md b/.llm/exports/github-copilot/skills/unit-tests-security-authz-template/SKILL.md
deleted file mode 100644
index 44e3d4cc..00000000
--- a/.llm/exports/github-copilot/skills/unit-tests-security-authz-template/SKILL.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-name: unit-tests-security-authz-template
-description: Provides a repeatable case template for auth, permission, and security-sensitive unit tests in Metaboost. Use when testing JWT, assertion validation, cookie/session helpers, bucket policy, or similar allow/deny logic.
-version: 1.0.0
----
-
-
-# Unit Tests - Security/Authz Template
-
-## Use This Skill When
-
-- Testing auth token helpers and claim validation.
-- Testing permission policy (bucket/admin/role/message CRUD decisions).
-- Testing security-sensitive request binding and replay controls.
-
-## Standard Case Template
-
-For each function/module, cover these case buckets:
-
-1. **Accept valid input**
-   - Confirm expected allow/success behavior.
-2. **Reject invalid input**
-   - Missing/empty/malformed token, claim, id, or mask.
-3. **Enforce boundary rule**
-   - Time window, max TTL, min/max limits, bitmask edge.
-4. **Enforce deny precedence**
-   - Non-owner/non-admin or missing permission bit remains denied.
-5. **Preserve safe failure**
-   - Errors return non-privileged result (`null`, `false`, or explicit reject response).
-
-## Assertions Checklist
-
-- Assert on outcome and error code/message contract where relevant.
-- Verify no accidental allow behavior in negative paths.
-- Keep fixtures minimal and explicit.
-- Mock only unstable boundaries (network, time, cache, external services).
-
-## Matrix Update Rule
-
-When introducing a new auth/authz/security module:
-
-1. Add the module to the active test target matrix plan.
-2. Add at least one test from each relevant case bucket above.
-3. Record any intentionally deferred cases and why they are lower priority.
diff --git a/.llm/exports/github-copilot/skills/use-form-component/SKILL.md b/.llm/exports/github-copilot/skills/use-form-component/SKILL.md
deleted file mode 100644
index f454adae..00000000
--- a/.llm/exports/github-copilot/skills/use-form-component/SKILL.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-name: use-form-component
-description: Never use raw `<form>` in app code. Use Form or FormContainer from @metaboost/ui.
-version: 1.0.0
----
-
-
-# Use Form / FormContainer Instead of Raw &lt;form&gt;
-
-**When to use:** When adding or editing forms in app code (e.g. `apps/web`, `apps/management-web`).
-
-## Rule
-
-Do **not** use raw `<form>` in app code. Use one of:
-
-- **`Form`** (from `@metaboost/ui`) – when you need a titled card plus the form. Renders a Card + `<form>` + Stack; props include `title`, `onSubmit`, `submitError`, `children`.
-- **`FormContainer`** (from `@metaboost/ui`) – when the form is already inside a card or other layout. Renders a `<form>` with optional max-width; props: `onSubmit`, `children`, optional `constrainWidth`, optional `className`.
-
-## Pattern
-
-- Wrap **FormContainer** children in **`Stack`** for consistent vertical spacing (flex column + gap).
-- Use **Form** when the whole block is “card + form” (e.g. auth screens); use **FormContainer** when the form lives inside an existing card or page section.
-- For spacing around the form, use a layout component (e.g. `Stack` with gap or `Container`) rather than a bare `div`; see **avoid-wrapper-elements**.
-
-## Checklist
-
-- Adding a new form? → Use `Form` or `FormContainer` from `@metaboost/ui`, not `<form>`.
-- Using FormContainer? → Put form fields and actions inside a single `<Stack>` as the direct child of FormContainer.
diff --git a/.llm/exports/github-copilot/skills/web/SKILL.md b/.llm/exports/github-copilot/skills/web/SKILL.md
deleted file mode 100644
index b1d58338..00000000
--- a/.llm/exports/github-copilot/skills/web/SKILL.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-name: web
-description: Common patterns for the Metaboost Next.js app
-version: 1.0.0
----
-
-
-# Metaboost Web Patterns
-
-- **Location**: `apps/web/`
-- **Stack**: Next.js, React, TypeScript
-
-## Runtime config (sidecar)
-
-- The Next.js app can load runtime config from a sidecar server when `RUNTIME_CONFIG_URL` is set.
-- Sidecar runs on a separate port (e.g. 3001) and serves GET `/runtime-config` with env-derived JSON.
-- `instrumentation.ts` runs once at server start and fetches config; it is stored in a global/store and used in layout and components.
-
-## Structure
-
-- `src/app/` – App Router pages and layout
-- `src/config/` – Runtime config types, store, server fetch
-- `apps/web/sidecar/` – Standalone Node server that validates env and serves config
-
-## Scripts
-
-- `npm run dev` – Next.js dev server
-- `npm run dev:sidecar` – Run sidecar (after building it)
-- From root: `npm run dev:web-sidecar` – Build sidecar then run web with sidecar
diff --git a/.llm/exports/opencode/instructions/api-no-pii-credentials-in-responses.instructions.md b/.llm/exports/opencode/instructions/api-no-pii-credentials-in-responses.instructions.md
deleted file mode 100644
index 585a1b83..00000000
--- a/.llm/exports/opencode/instructions/api-no-pii-credentials-in-responses.instructions.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-description: "API responses must never expose credentials or serialize req.user/req.managementUser directly. Use safe toJson helpers only."
-applyTo: "**"
----
-
-# No PII/Credentials in API Responses
-
-When adding or changing code that sends user or admin data in API responses:
-
-## Do
-
-- **Main API (apps/api):** Use `userToJson(user)` for the **authenticated user only** (login, me, signup, refresh, confirm-email-change, update-profile). Use `userToPublicSummary(user)` for any **other** user (e.g. bucket admins list/detail) so email is never returned for other users while username/displayName are available for identity in UI lists/details. See [apps/api/src/lib/userToJson.ts](apps/api/src/lib/userToJson.ts).
-- **Management API (apps/management-api):** Use `managementUserToJson(admin)` for every response that includes a management user. Use `userToJson(user)` in usersController for main-app user data. See [apps/management-api/src/lib/managementUserToJson.ts](apps/management-api/src/lib/managementUserToJson.ts).
-- Never include `passwordHash`, `credentials`, or any credential field in response bodies.
-
-## Don't
-
-- Never pass `req.user` or `req.managementUser` (or any entity that has `.credentials`) to `res.json()` or into response payloads. Always serialize through the safe helpers above.
-- Never return email for *another* user from the main API; use `userToPublicSummary` for other users.
-
-## Reference
-
-- AGENTS.md § Auth and PII
-- apps/management-api/src/CREDENTIALS-PROTECTION.md
diff --git a/.llm/exports/opencode/instructions/avoid-type-assertions.instructions.md b/.llm/exports/opencode/instructions/avoid-type-assertions.instructions.md
deleted file mode 100644
index 909d5084..00000000
--- a/.llm/exports/opencode/instructions/avoid-type-assertions.instructions.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-description: "Avoid type assertions (as) when a better approach exists; prefer types, narrowing, type guards."
-applyTo:
-  - "**/*.ts"
-  - "**/*.tsx"
----
-
-# Avoid Type Assertions
-
-Avoid `as` (type assertions) when there is a better way. Prefer: better types, optional chaining, type guards, or narrowing. Allowed: import aliases, `as const`, and rare documented escape hatches.
diff --git a/.llm/exports/opencode/instructions/commands-from-metaboost-root.instructions.md b/.llm/exports/opencode/instructions/commands-from-metaboost-root.instructions.md
deleted file mode 100644
index 5e45c2e6..00000000
--- a/.llm/exports/opencode/instructions/commands-from-metaboost-root.instructions.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-description: "Always provide runnable commands from Metaboost repo root."
-applyTo: "**"
----
-
-# Commands From Metaboost Root
-
-Always provide runnable terminal commands relative to the Metaboost repository root.
-
-## Do
-
-- Use root-invoked workspace commands (for example `npm run <script> -w @metaboost/<workspace> -- [args]`).
-- For E2E commands, use `make` targets from repo root so dependencies and seed steps are handled.
-- Use `SPEC`/`WEB_SPEC`/`MGMT_SPEC` for one spec or comma-delimited spec lists.
-- Put runnable commands in fenced `bash` blocks so the editor shows copy buttons.
-
-## Don't
-
-- Do not instruct users to `cd apps/api`, `cd apps/web`, or `cd apps/management-web` before running commands.
-- Do not provide commands that only work from subdirectories unless explicitly requested.
-- Do not suggest direct Playwright invocation (`npx playwright test`, `npm run test:e2e ...`) for Metaboost E2E runs.
-
-## Example
-
-```bash
-make e2e_test_management_web_report_spec SPEC=e2e/dashboard-super-admin-full-crud.spec.ts
-make e2e_test_management_web_report_spec SPEC=e2e/dashboard-super-admin-full-crud.spec.ts,e2e/login-super-admin-full-crud.spec.ts
-```
diff --git a/.llm/exports/opencode/instructions/e2e-run-with-make-only.instructions.md b/.llm/exports/opencode/instructions/e2e-run-with-make-only.instructions.md
deleted file mode 100644
index 05e96c08..00000000
--- a/.llm/exports/opencode/instructions/e2e-run-with-make-only.instructions.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-description: "Run Metaboost E2E via make targets only."
-applyTo: "**"
----
-
-# E2E Commands Must Use Make
-
-For Metaboost E2E verification commands, always use `make` targets from repo root.
-
-## Required
-
-- Use `make e2e_test_web_report_spec SPEC=...` for web specs.
-- Use `make e2e_test_management_web_report_spec SPEC=...` for management-web specs.
-- Use `make e2e_test_report_scoped WEB_SPEC=... MGMT_SPEC=...` for cross-app scoped runs.
-- `SPEC`, `WEB_SPEC`, and `MGMT_SPEC` may be a single path or comma-delimited list.
-
-## Prohibited
-
-- Do not suggest direct Playwright commands (`npx playwright test ...`) for normal verification.
-- Do not suggest `npm run test:e2e -w ...` for normal verification.
-
-## Why
-
-Make targets handle required test setup consistently (dependencies, seed, report output), reducing flaky failures caused by missing setup.
diff --git a/.llm/exports/opencode/instructions/e2e-suite-title.instructions.md b/.llm/exports/opencode/instructions/e2e-suite-title.instructions.md
deleted file mode 100644
index 0ef5b68d..00000000
--- a/.llm/exports/opencode/instructions/e2e-suite-title.instructions.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-description: "E2E top-level suite title is a concise phrase; nested describe, test titles, and step labels stay verbose."
-applyTo:
-  - "apps/web/e2e/**/*.spec.ts"
-  - "apps/management-web/e2e/**/*.spec.ts"
----
-
-# E2E Suite Title Convention
-
-When adding or editing E2E specs:
-
-- **Top-level** `test.describe(...)` (the suite): use a **concise, title-like phrase** (e.g. "Home page for the unauthenticated user"). Do not use "This suite verifies …" or other long sentence forms.
-- **Non-default auth mode:** End the title with `(admin_only_email)` or `(user_signup_email)` when the spec runs in that mode; do not use the word "mode". Default `admin_only_username` has no suffix.
-- **Nested** describe, **test titles**, and **step labels**: keep **verbose sentence-style**.
-
-Applies to both `apps/web/e2e` and `apps/management-web/e2e`. Full guidance: `.llm/exports/opencode/skills/e2e-readability/SKILL.md`.
diff --git a/.llm/exports/opencode/instructions/end-with-targeted-make-report-verify.instructions.md b/.llm/exports/opencode/instructions/end-with-targeted-make-report-verify.instructions.md
deleted file mode 100644
index 0896cc14..00000000
--- a/.llm/exports/opencode/instructions/end-with-targeted-make-report-verify.instructions.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-description: "End implementation responses with targeted make screenshot-report verification commands."
-applyTo: "**"
----
-
-# End With Targeted Make Report Verify
-
-For implementation responses in this repo:
-
-1. **Give the user** one or more runnable `make` commands they can copy and run to verify the change; place them in a fenced `bash` code block at the end of your response.
-2. **MANDATORY when the change affects E2E:** If you modified UI (apps/web or apps/management-web), E2E spec files, or any code that E2E tests cover, you **MUST** end the response with a fenced `bash` block containing the **EXACT** command(s) needed to run the affected E2E test(s). No exception. Example: `make e2e_test_web_report_spec SPEC=e2e/settings-bucket-owner.spec.ts`.
-3. Prefer screenshot-report targets scoped to the changed feature area.
-3. Avoid suggesting unrelated full-suite runs by default.
-4. Use full-suite report mode only when the change scope is broad or cross-cutting.
-5. Place final verification commands in a fenced `bash` code block so copy-to-clipboard is available.
-6. Inside the code block, list plain commands (one per line), without bullets or inline backticks.
-7. **When the change includes files under `infra/k8s/`:** Add a sentence in the response that the user should push to the Argo CD–tracked branch (e.g. `develop`) for the cluster to sync. See **argocd-gitops-push** skill for details.
-
-API gate (default: no API tests):
-
-- **Always** give E2E verification commands **without** `E2E_API_GATE_MODE` so the default applies: API integration tests are **skipped**. Do not add `E2E_API_GATE_MODE=on` unless the change affected API or integration tests.
-- To include API tests the user must pass the env var: `make E2E_API_GATE_MODE=on e2e_test_web_report_spec SPEC=...`
-
-Preferred command order:
-
-- Web feature verification:
-  - `make e2e_test_web_report_spec SPEC=e2e/<web-spec>.spec.ts`
-- Management-web feature verification:
-  - `make e2e_test_management_web_report_spec SPEC=e2e/<management-spec>.spec.ts`
-- Cross-app web + management-web verification:
-  - `make e2e_test_report_scoped WEB_SPEC=e2e/<web-spec>.spec.ts MGMT_SPEC=e2e/<management-spec>.spec.ts`
-- Broad smoke:
-  - `make e2e_test_home_report`
-- Full regression (four reports: web default, web signup-enabled, web admin-only-email, management-web):
-  - `make e2e_test_report`
-
-Spec variables (`SPEC`, `WEB_SPEC`, `MGMT_SPEC`) may contain comma-separated spec paths when multiple related specs should run.
-
-Extended reference: **response-ending-make-verify** skill (command tree, API gate, multi-spec examples).
diff --git a/.llm/exports/opencode/instructions/env-file-formatting.instructions.md b/.llm/exports/opencode/instructions/env-file-formatting.instructions.md
deleted file mode 100644
index ee293f34..00000000
--- a/.llm/exports/opencode/instructions/env-file-formatting.instructions.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-description: "Environment file formatting - non-empty values in double quotes, empty unset"
-applyTo:
-  - "**/.env"
-  - "**/.env.*"
-  - "**/.env.example"
-  - "infra/config/local/*.env"
-  - "dev/env-overrides/local/*.env"
-  - "dev/env-overrides/alpha/*.env"
----
-
-# Environment File Formatting
-
-- **Non-empty values**: Use double quotes (e.g. `API_PORT="3000"`).
-- **Empty/unset values**: No value after `=` (e.g. `OPTIONAL_VAR=`).
-- **Alignment**: When creating or editing generated env files, follow variable order and grouping from canonical templates/examples in [`infra/config/env-templates/`](../../infra/config/env-templates/) and app `.env.example` files. Only values may differ.
-
-Correct: `DATABASE_HOST="localhost"`, `EMPTY_VALUE=`. Incorrect: `DATABASE_HOST=localhost`, `EMPTY_VALUE=""`.
diff --git a/.llm/exports/opencode/instructions/eqeqeq-strict-equality.instructions.md b/.llm/exports/opencode/instructions/eqeqeq-strict-equality.instructions.md
deleted file mode 100644
index e041af02..00000000
--- a/.llm/exports/opencode/instructions/eqeqeq-strict-equality.instructions.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-description: "Use strict equality (=== and !==) to satisfy eslint eqeqeq"
-applyTo:
-  - "**/*.ts"
-  - "**/*.tsx"
-  - "**/*.js"
-  - "**/*.jsx"
----
-
-# Strict Equality (eqeqeq)
-
-Use **strict equality** only. ESLint rule `eqeqeq` expects `===` and `!==`, not `==` or `!=`.
-
-- Do: `x === null`, `x !== undefined`, `x !== null && x !== undefined`
-- Don't: `x == null`, `x != null`, or `a == b` / `a != b` in general.
diff --git a/.llm/exports/opencode/instructions/i18n-locale-language.instructions.md b/.llm/exports/opencode/instructions/i18n-locale-language.instructions.md
deleted file mode 100644
index 0ca7cb8f..00000000
--- a/.llm/exports/opencode/instructions/i18n-locale-language.instructions.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-description: "Non–en-US i18n originals must be in the target language; do not put English in es or other locale files"
-applyTo:
-  - "**/i18n/originals/*.json"
-  - "**/i18n/overrides/*.json"
----
-
-# i18n locale language
-
-- **Non–en-US originals** (e.g. `es.json`, `fr.json`) must contain text **in that locale’s language**. Spanish files must be in Spanish; do not put English strings into `es.json` or other non–en-US originals.
-- The sync script adds missing keys with **empty string** so they can be filled with the correct translation. When you add or edit translations for a locale, use the target language (e.g. Spanish for `es`).
-- Overrides may be used for corrections; same rule: use the locale language, not English, for non–en-US.
diff --git a/.llm/exports/opencode/instructions/llm-cursor-source.instructions.md b/.llm/exports/opencode/instructions/llm-cursor-source.instructions.md
deleted file mode 100644
index 23f24de0..00000000
--- a/.llm/exports/opencode/instructions/llm-cursor-source.instructions.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-description: "AI guidance source of truth is .cursor and .cursorrules; .llm/exports is machine-only"
-applyTo:
-  - ".llm/exports/opencode/skills/**"
-  - ".llm/exports/opencode/instructions/**"
-  - ".cursorrules"
----
-
-# LLM / Cursor source of truth
-
-Committed **authoring** guidance for this repo lives only in:
-
-- `.llm/exports/opencode/skills/**`
-- `.llm/exports/opencode/instructions/**`
-- `.cursorrules`
-
-**Do not** hand-edit the machine-generated tree at [`.llm/exports/`](.llm/exports/) (portable per-target exports). The **llm-exports-sync** and **llm-exports-full-sync** GitHub Actions produce and publish those files via the **`llm`** / **`llm-full`** branches and their PRs into **develop** — that is the normal path. **Do not** run `npm run llm:exports:sync` (or `export-from-cursor.mjs sync`) for routine `.cursor` work; the script is gated outside CI. Pull **develop** after the automation PR merges when you need updated exports locally.
-
-**Exception — pipeline development only:** if you are changing [scripts/llm/](scripts/llm/) export code, you may set `LLM_EXPORT_ALLOW_LOCAL=1` to run a local sync; see [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md).
-
-If you use another LLM or editor, follow [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md) and, if needed, [docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md](docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md).
-
-When you change `.cursor` or `.cursorrules`, commit and push only those **source** files. Let automation refresh `.llm/exports` on the `llm` branch; do not mirror that with a local run unless you are editing the export pipeline.
diff --git a/.llm/exports/opencode/instructions/llm-exports-ci.instructions.md b/.llm/exports/opencode/instructions/llm-exports-ci.instructions.md
deleted file mode 100644
index 123d8953..00000000
--- a/.llm/exports/opencode/instructions/llm-exports-ci.instructions.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-description: "Machine exports are CI + develop only; source is .cursor"
-applyTo:
-  - ".llm/exports/**"
-  - "scripts/llm/**"
----
-
-# LLM machine exports (`.llm/exports/*`)
-
-- Source of truth: `.cursor/`, `.cursorrules`. The **`llm-exports-sync`** Action (push to **`develop`**, or `workflow_dispatch`) runs incremental `sync` on the GitHub runner, then updates branch **`llm`**, and **`peter-evans/create-pull-request`** opens or updates a PR from **`llm`** into **`develop`**. Feature PRs are **not** blocked on export diffs; CI does not run `check` on the PR. The **`llm-exports-full`** Action (`workflow_dispatch` only) runs `sync --full` and updates branch **`llm-full`**. The workflow uses `git add -f` of ignored export paths on the runner. **Local** runs of the export script do **not** write unless `LLM_EXPORT_ALLOW_LOCAL=1` (for `scripts/llm/**` work only). Do not hand-mirror with ad-hoc commits; generated machine paths stay under ignore rules.
-- **Do not** hand-commit generated paths (`skills/`, `instructions/`, per-target `*-instructions.md` such as `copilot-instructions.md`) except allowlisted files (e.g. target `.gitkeep`); they are under ignore rules. See the **`llm-cursor-source`** and **`llm-exports-scripts`** skills, [docs/development/llm/EXPORT-TARGETS.md](../../docs/development/llm/EXPORT-TARGETS.md), and [`.llm/exports/LLM-EXPORTS.md`](../../.llm/exports/LLM-EXPORTS.md).
-- When editing files under `scripts/llm/**`, follow the **`llm-exports-scripts`** skill.
diff --git a/.llm/exports/opencode/instructions/llm-history-tracking.instructions.md b/.llm/exports/opencode/instructions/llm-history-tracking.instructions.md
deleted file mode 100644
index 9777b4c8..00000000
--- a/.llm/exports/opencode/instructions/llm-history-tracking.instructions.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-description: "LLM history tracking — essential for any file-modifying response in this repo"
-applyTo: "**/*"
----
-
-# History Tracking (Essential)
-
-When modifying **any** files in this workspace, update `.llm/history/active/[feature]/[feature]-part-01.md` (or the latest part file):
-
-```markdown
-### Session N - YYYY-MM-DD
-#### Prompt (Developer|Agent)
-[Exact verbatim prompt]
-#### Key Decisions
-- Decision 1
-#### Files Created/Modified
-- path/to/file.ts
-```
-
-## 10-Session Limit
-
-Each history file is limited to **10 sessions**. When adding session 11, create a new part file (e.g. `[feature]-part-02.md`).
-
-## File Naming
-
-- `.llm/history/active/[feature]/[feature]-part-01.md` (sessions 1-10)
-- `[feature]-part-02.md` (sessions 11-20), etc.
-
-End every file-modifying response with: **LLM History**: Updated `.llm/history/active/[feature]/[file].md` (Session N).
diff --git a/.llm/exports/opencode/instructions/markdown-formatting.instructions.md b/.llm/exports/opencode/instructions/markdown-formatting.instructions.md
deleted file mode 100644
index 49490302..00000000
--- a/.llm/exports/opencode/instructions/markdown-formatting.instructions.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-description: "Markdown formatting rules matching Prettier config"
-applyTo: "**/*.md"
----
-
-# Markdown Formatting
-
-- Max line width 100 characters (except code/URLs/tables).
-- Tables: aligned columns with padding.
-- Blank lines around lists, headings, code blocks.
-- Use `-` for unordered lists. ATX headings (`#`). Code blocks with language identifier.
-- **Bold** with `**text**`, *italic* with `*text*`, inline `code` with backticks.
diff --git a/.llm/exports/opencode/instructions/nix-terminal-wrapper.instructions.md b/.llm/exports/opencode/instructions/nix-terminal-wrapper.instructions.md
deleted file mode 100644
index d7c2d7dd..00000000
--- a/.llm/exports/opencode/instructions/nix-terminal-wrapper.instructions.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-description: "Run node/npm and other flake tools via the Nix wrapper so the agent sandbox has the correct environment"
-applyTo: "**"
----
-
-# Nix Terminal Wrapper (Agent Sandbox)
-
-This repo uses a Nix flake for Node/npm and other tools. There is no global Node on the system path in environments where the agent runs.
-
-For any terminal command that needs `node`, `npm`, `npx`, or other tools provided by the flake, run it via the project wrapper from repo root:
-
-```bash
-./scripts/nix/with-env <command> [args...]
-```
-
-Examples:
-
-- `./scripts/nix/with-env npm run build`
-- `./scripts/nix/with-env npm run lint`
-- `./scripts/nix/with-env npm run dev:api`
-- `./scripts/nix/with-env npm run dev:web`
-- `./scripts/nix/with-env npx some-package`
-
-Run from the repository root. The wrapper resolves the flake path so it also works when the shell's cwd is a subdirectory.
-
-In automated or agent runs (e.g. Cursor's agent), the sandbox may block Nix's cache under `~/.cache/nix`. When invoking this wrapper from the agent, request full permissions (e.g. `all`) so Nix can write to its cache and the command can succeed.
diff --git a/.llm/exports/opencode/instructions/path-casing-imports.instructions.md b/.llm/exports/opencode/instructions/path-casing-imports.instructions.md
deleted file mode 100644
index 3aaeef5d..00000000
--- a/.llm/exports/opencode/instructions/path-casing-imports.instructions.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-description: "Keep import path casing identical to actual file/directory names for Linux and CI"
-applyTo:
-  - "**/*.ts"
-  - "**/*.tsx"
-  - "**/*.js"
-  - "**/*.jsx"
----
-
-# Path Casing in Imports
-
-**Import paths must match the exact casing of the files and directories on disk.**
-
-- Linux and CI (e.g. GitHub Actions) use **case-sensitive** filesystems. A path like `'./components/form/Button'` will fail if the directory is actually named `Form` (uppercase).
-- macOS can hide the bug because the default filesystem is often case-insensitive, so `form` and `Form` resolve to the same directory locally but not in CI.
-- When adding or changing relative imports, verify that every segment of the path (each folder and file name) uses the **exact same casing** as in the repository (e.g. `git ls-tree` or your IDE file tree). Do not rely on "it works on my machine."
-- **Component directories** under `packages/ui/src/components/` use **lowercase** names (e.g. `form`, `bucket`, `layout`, `modal`, `navigation`, `table`). Use that casing in imports.
-
-Example: if the repo has `packages/ui/src/components/form/Button/Button.tsx`, use `from './components/form/Button/Button'` or `from '../../form/Button/Button'`, not `./components/Form/...`.
diff --git a/.llm/exports/opencode/instructions/plan-creation.instructions.md b/.llm/exports/opencode/instructions/plan-creation.instructions.md
deleted file mode 100644
index 0778bd63..00000000
--- a/.llm/exports/opencode/instructions/plan-creation.instructions.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-description: "Plan creation - breaking large plans into separate files"
-applyTo: ".llm/plans/**/*.md"
----
-
-# Plan Creation
-
-When creating a plan, if it is too large, **do not implement it immediately**. Instead:
-
-1. Break it into separate files
-2. Save those files in `.llm/plans/active/`
-3. Wait for the user to prompt you to complete them one-by-one
-
-Plans must be under 300 lines. For file layout (00-EXECUTION-ORDER, COPY-PASTA, etc.), use the **plan-files-convention** skill (`.llm/exports/opencode/skills/plan-files-convention/SKILL.md`).
diff --git a/.llm/exports/opencode/instructions/plan-execution-completion-tracking.instructions.md b/.llm/exports/opencode/instructions/plan-execution-completion-tracking.instructions.md
deleted file mode 100644
index 2dcc17c1..00000000
--- a/.llm/exports/opencode/instructions/plan-execution-completion-tracking.instructions.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-description: "Plan execution - mark COPY-PASTA progress and move completed plan files"
-applyTo: ".llm/plans/active/**/*.md"
----
-
-# Plan Execution Completion Tracking
-
-When executing a plan set from `.llm/plans/active/**`:
-
-1. Execute numbered plan files in the order defined by `00-EXECUTION-ORDER.md` and `COPY-PASTA.md`.
-2. After each completed numbered prompt, update `COPY-PASTA.md` to mark that prompt as completed.
-3. Move each completed numbered plan file from `active/` to the mirrored `completed/` directory path.
-4. Keep `COPY-PASTA.md` and `00-*` files in `active/` until all numbered prompts are complete.
-5. When all numbered prompts are complete, move the remaining plan-set files and directory to `completed/`.
-
-This tracking is required for plan implementation responses so progress is durable and visible.
diff --git a/.llm/exports/opencode/instructions/semicolons-required.instructions.md b/.llm/exports/opencode/instructions/semicolons-required.instructions.md
deleted file mode 100644
index 26c45e94..00000000
--- a/.llm/exports/opencode/instructions/semicolons-required.instructions.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-description: "Require semicolons in JS/TS files"
-applyTo: "**/*.{js,jsx,ts,tsx}"
----
-
-# Semicolons Required
-
-Use semicolons at the end of statements in JavaScript and TypeScript (`.js`, `.jsx`, `.ts`, `.tsx`). Markdown and `.mdc` files are exempt. Keep semicolons consistent in existing code.
diff --git a/.llm/exports/opencode/instructions/single-readme.instructions.md b/.llm/exports/opencode/instructions/single-readme.instructions.md
deleted file mode 100644
index 8a5afebe..00000000
--- a/.llm/exports/opencode/instructions/single-readme.instructions.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-description: "Only one README.md in the Metaboost monorepo (at repo root)"
-applyTo:
-  - "**/README.md"
-  - ".llm/**/*.md"
-  - "**/INDEX.md"
----
-
-# Single README
-
-The Metaboost monorepo has **exactly one README.md**, at the **repository root**. Do not create `README.md` in subdirectories.
-
-For directory docs use **full-path names** (e.g. `INFRA-K8S.md`, `PACKAGES-UI.md`) per the documentation-conventions skill. The only `INDEX.md` is `.llm/exports/opencode/skills/INDEX.md`; plan-set indexes use `00-overview.md` or `00-master-plan.md`.
diff --git a/.llm/exports/opencode/instructions/type-imports-separate-line.instructions.md b/.llm/exports/opencode/instructions/type-imports-separate-line.instructions.md
deleted file mode 100644
index 0e16a23c..00000000
--- a/.llm/exports/opencode/instructions/type-imports-separate-line.instructions.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-description: "Type imports must use a separate import line; do not mix type and value in one statement."
-applyTo:
-  - "**/*.ts"
-  - "**/*.tsx"
----
-
-# Type Imports on Separate Line
-
-Type-only imports must use a **separate** `import type { ... }` statement. Do not declare types inline with value imports.
-
-## Do
-
-- Use a dedicated line for type imports from the same module as value imports:
-
-```typescript
-import { DataSource } from 'typeorm';
-import type { DataSourceOptions } from 'typeorm';
-```
-
-- Use `import type { X } from '...'` when the symbol is only used in type positions.
-
-## Don't
-
-- Do not mix type and value in one import: `import { DataSource, type DataSourceOptions } from 'typeorm'`.
-- Do not use inline `type` in a value import statement.
-
-## Enforcement
-
-ESLint `@typescript-eslint/consistent-type-imports` with `fixStyle: 'separate-type-imports'` enforces this. Run `npm run lint:fix` to auto-fix.
diff --git a/.llm/exports/opencode/opencode-instructions.md b/.llm/exports/opencode/opencode-instructions.md
deleted file mode 100644
index 706e2c6f..00000000
--- a/.llm/exports/opencode/opencode-instructions.md
+++ /dev/null
@@ -1,76 +0,0 @@
-<!-- Generated from .cursorrules — do not edit this file. Source: .cursorrules -->
-<!-- Re-run: npm run llm:exports:sync (see docs/development/llm/) -->
-
-# Metaboost Repo Rules
-
-## Stack
-
-- Node.js 24+, TypeScript strict, npm workspaces
-
-## Code Quality
-
-- No `any` types
-- **Strict equality**: Use `===` and `!==` only (no `==` or `!=`).
-- **Avoid type assertions (`as`)**: Prefer proper types, optional chaining, type guards, or narrowing.
-- **Named exports**: Prefer named `export` in TypeScript modules; avoid `export default` when a named export works. Framework-required defaults (e.g. Next.js `page.tsx`) are the exception. See `.llm/exports/opencode/skills/prefer-named-exports/SKILL.md`.
-
-## Formatting
-
-- **JavaScript/TypeScript/JSON/CSS**: Single quotes, semicolons, 2-space indent.
-- Run `npm run lint:fix` or `npm run prettier:write` to auto-fix.
-
----
-
-## LLM WORKFLOW
-
-### Context Gathering
-
-For substantial requests, ask: "What's the goal?" / "GitHub issue?"
-
-### Scope Management
-
-Warn if drifting: "This seems outside scope. Continue?"
-
-### Agent/plan work: do not run tests
-
-- **Do not run** test or verification commands (e.g. `make e2e_test_web`, `npm run test`) during agent or plan implementation.
-- **Only instruct the user** to run those commands after your work is done; provide the exact command(s) in a fenced `bash` block. See **response-ending-make-verify** skill for which commands to suggest.
-- **E2E verification commands:** Always give commands that **skip API tests** by default (do not add `E2E_API_GATE_MODE=on`). Only add `E2E_API_GATE_MODE=on` when the change affected API or integration tests. The Makefile default is `E2E_API_GATE_MODE=off`.
-
----
-
-## HISTORY TRACKING (Essential)
-
-**Applies to every file-modifying response in this repo** — no exception for path or task size. When in doubt, update history.
-
-Before work: Check/create `.llm/history/active/[feature]/[feature]-part-01.md`
-
-After changes, update with:
-
-- Session date, user prompt (EXACT text), decisions, files
-
-### Prompt Recording (CRITICAL)
-
-**Always use the user's EXACT, FULL prompt text.** Never summarize or paraphrase.
-
-- **`#### Prompt (Developer)`** — Manually typed by the user
-- **`#### Prompt (Agent)`** — System-generated (e.g., clicking "Build" on a plan)
-
-### Real-Time Capture
-
-**If a response will modify files, log the prompt FIRST.**
-
-- **Start of response**: Log prompt to `.llm/history/active/[feature]/[file].md`
-- **End of response**: Update with files changed and key decisions
-
-Skip logging for pure Q&A or explanations that don't change files.
-
-End file-modifying responses with: **LLM History**: Updated `.llm/history/active/[feature]/[file].md`
-
----
-
-## PLAN MANAGEMENT
-
-**Plans must be under 300 lines.** Plans live in `.llm/plans/active/` (not `.cursor/plans/`).
-
-If over 300: STOP, split into sub-plans, save in `.llm/plans/active/`, then work sequentially.
diff --git a/.llm/exports/opencode/skills/api-testing/SKILL.md b/.llm/exports/opencode/skills/api-testing/SKILL.md
deleted file mode 100644
index 0d7241cc..00000000
--- a/.llm/exports/opencode/skills/api-testing/SKILL.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-name: api-testing
-description: When changing API routes, auth, or env-dependent behavior, add or update the corresponding integration tests and keep the test file layout consistent.
----
-
-
-# API Integration Testing (Metaboost)
-
-Testing requirement policy lives in **feature-implementation-testing**. This skill focuses on **how** to add or update API integration tests. If an API change affects behavior in `apps/web` or `apps/management-web`, also update the corresponding E2E specs (see e2e-page-tests).
-
-Use this skill when adding or changing auth endpoints, versioned routes, or any API behavior that depends on environment variables. Keep tests in sync and use the correct test file and base URL.
-
-## Test file layout
-
-| File                                       | Scope                                                                                                                                     | When to update                                                                                                           |
-| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| `apps/api/src/test/auth.test.ts`           | **Shared** – endpoints unaffected by mailer mode: versioned root (GET /health, GET /), login, logout, me, change-password                 | Add tests for new shared auth or versioned routes; add validation/error cases for these endpoints.                       |
-| `apps/api/src/test/auth-no-mailer.test.ts` | **No-mailer (admin-only)** – signup → 403, all verification routes → 403                                                                  | Change when no-mailer behavior or verification route list changes.                                                       |
-| `apps/api/src/test/auth-mailer.test.ts`    | **Mailer-enabled (mocked)** – signup, verify-email, forgot/reset-password, request/confirm-email-change; uses `vi.mock` to capture tokens | Change when verification flows or mailer-dependent behavior changes; add validation tests (400/401) for these endpoints. |
-
-- **Base URL**: Use `config.apiVersionPath` (from `../config/index.js`), never hardcode `/v1`. Example: `const API = config.apiVersionPath;` then `request(app).get(\`${API}/health\`)`.
-- **Naming**: Mode-specific tests live in files with consistent names: `auth-no-mailer.test.ts`, `auth-mailer.test.ts`. If you add another mode (e.g. invite-only), add `auth-<mode>.test.ts` and document it in file headers and AGENTS.md.
-
-## Clean slate and requirements
-
-- **Clean slate**: Each test run truncates app tables once via Vitest `globalSetup` (`apps/api/src/test/global-setup.mjs`). No manual DB wipe needed between runs.
-- **Test data unique per file**: Use a file-unique prefix (e.g. `const FILE_PREFIX = 'auth-shared';`) for all emails, usernames, and other identifiers that create DB rows, so tests can run in parallel (e.g. `maxWorkers: 2`) without collisions. The same rules (file-unique prefix, schema length limits, afterAll guards) apply to management-api integration tests in `apps/management-api/src/test/`.
-- **Respect schema length limits**: DB columns have max lengths (e.g. `user_credentials.username` is VARCHAR(50) per `infra/k8s/base/db/source/app/0001_app_schema.sql`; see also `USERNAME_MAX_LENGTH` / `SHORT_TEXT_MAX_LENGTH` in `@metaboost/helpers`). When building file-unique identifiers (prefix + suffix + `Date.now()`), ensure the full string does not exceed the column limit — e.g. username ≤ 50 chars, so keep FILE_PREFIX short or use short suffixes for usernames. For management-api tests, `management_user_credentials.username` and `management_user_bio.display_name` are VARCHAR(50) (varchar_short in `infra/k8s/base/db/source/management/0001_management_schema.sql`). When building file-unique admin usernames (e.g. email-style `prefix-suffix-${Date.now()}@example.com`), ensure the full string is ≤ 50 characters — use a short FILE_PREFIX (e.g. `mgmt-ap`, `mgmt-up`) or short suffixes.
-- **afterAll cleanup**: In describe blocks that create resources in beforeAll and delete them in afterAll, guard the delete so it only runs when the created id is defined (e.g. `if (adminId !== undefined) await agent.delete(...)`). Otherwise a failed beforeAll leaves the id undefined and delete requests with id `"undefined"` cause unhandled rejections and hook timeouts.
-- **Rate limiting in tests**: Rate limiting is **disabled in test** (very high limit in `packages/helpers-backend-api` rateLimit.ts) so integration tests never hit 429. **Do not add tests that assert rate-limit behavior** (e.g. 429 after N requests); they are a chronic source of flakiness and load-order issues.
-- **Signup strict-limit test mode**: For `POST /auth/signup` strict-limit assertions, force signup-enabled mode in the test setup (`MAILER_ENABLED=true` and `ACCOUNT_SIGNUP_MODE` not `admin_only`) so assertions are not masked by admin-only/no-mailer `403` responses. Keep this setup before the dynamic app import.
-- **Requirements**: Before tests, Postgres and Valkey must be up and the test DB created. Root `npm run test` runs `scripts/check-test-requirements.mjs` first; if ports are unreachable, it exits with instructions. From repo root: `make test_deps` (note underscore) starts test containers (Postgres **5632**, Valkey **6579** — Metaboost dev Docker uses 5532/6479), creates `metaboost_app_test`, applies schema, and grants read/read_write (including TRUNCATE for globalSetup). Make targets use **underscores**: `test_deps`, `help_test`, `test_clean`. After `apps/api` and `apps/management-api`, the same root command runs Vitest in **metaboost-signing** and **@metaboost/rss-parser**.
-
-## What to update when the API changes
-
-1. **New versioned or shared auth route**  
-   Add tests in `auth.test.ts` (happy path and validation/error cases as appropriate).
-
-2. **New or changed verification or mailer-dependent route**  
-   Add or update tests in `auth-mailer.test.ts` (with mailer mocked). Add corresponding 403 tests in `auth-no-mailer.test.ts` for the same path.
-
-3. **New env mode (e.g. ACCOUNT_SIGNUP_MODE or new feature flag)**  
-   Add a new test file `auth-<mode>.test.ts` with a clear top-level describe (e.g. `auth-invite-only (mocked)`), set the env in that file, and document in its header and in AGENTS.md.
-
-4. **Schema/ORM change**  
-   Ensure entity column names match the DB (e.g. `@PrimaryColumn('uuid', { name: 'user_id' })` for `UserCredentials` and `UserBio`). Otherwise integration tests will fail with “column does not exist” (TypeORM uses property name by default).
-
-5. **New app table that should be cleared between runs**  
-   Update `global-setup.mjs`: either extend the single `TRUNCATE "user" ... CASCADE` if the new table references `user`, or add an explicit `TRUNCATE` for the new table.
-
-## Quick reference
-
-- **Default execution strategy (agent/sandbox):** start with the leanest targeted integration test command that verifies the change (for example a single test file), then expand scope only if needed.
-- Run tests: `npm run test:e2e:api` from repo root for API integration tests only (or `./scripts/nix/with-env npm run test:e2e:api` in Nix/agent). First step is the requirements check, then Vitest runs for `apps/api` and `apps/management-api`. For unit-only (no DB needed): `npm run test:unit`. Full suite: `npm test`.
-- Run one API integration test file (preferred during iteration): `./scripts/nix/with-env npm run test -w apps/api -- src/test/<file>.test.ts`
-- Test env: `apps/api/src/test/setup.ts` sets defaults (DB_PORT 5632, KEYVALDB_PORT 6579, DB_APP_NAME metaboost_app_test, etc.). globalSetup uses the same defaults so it can run without setupFiles.
-- Mailer in tests: No real SMTP. `auth-mailer.test.ts` sets `MAILER_ENABLED=true` and mocks `../lib/mailer/send.js` to capture tokens for verify-email, reset-password, and confirm-email-change.
diff --git a/.llm/exports/opencode/skills/api/SKILL.md b/.llm/exports/opencode/skills/api/SKILL.md
deleted file mode 100644
index 5ab03fa6..00000000
--- a/.llm/exports/opencode/skills/api/SKILL.md
+++ /dev/null
@@ -1,59 +0,0 @@
----
-name: api
-description: Common patterns for the Metaboost HTTP API (Express)
-version: 1.0.0
----
-
-
-# Metaboost API Patterns
-
-- **Location**: `apps/api/`
-- **Stack**: Express, TypeScript, ESM
-
-## API change triad (use every time)
-
-When you add or change an API route, update these together:
-
-1. Route/controller/schema implementation in API or management-api.
-2. API integration tests (see **api-testing**).
-3. OpenAPI spec updates (see **swagger-openapi**).
-
-## Patterns
-
-### Route and handler
-
-```typescript
-import { Router, type Request, type Response } from 'express';
-
-const router = Router();
-
-router.get('/health', (_req: Request, res: Response): void => {
-  res.json({ status: 'ok', message: 'The server is running.' });
-});
-
-export default router;
-```
-
-### Config and startup validation
-
-- **Startup validation**: `lib/startup/validation.ts` runs after loadEnv() and before importing config. It validates required env vars (e.g. API_PORT), logs results by category, and throws if any required are missing or invalid. **`WEB_BRAND_NAME`** is required only when **`ACCOUNT_SIGNUP_MODE`** uses email flows (with mailer vars), for transactional email copy. Pattern aligned with Podverse’s API startup validation.
-- Read env in `config/index.ts` only after validation has passed.
-- Use `.env.example` for documented variables; non-empty values in `.env` use double quotes; empty/unset use no value after `=`.
-- **Env alignment**: All `.env` files (including `infra/config/local/*.env`) must match the organization, section comments, and variable order of their authoritative `.env.example`; only values may differ. Generated files are filled by `make local_env_setup` (auto-generated secrets plus overrides from local override files when present). **`WEB_BRAND_NAME`** is set from dev/env-overrides/local/info.env (template contract workload **`info`**). See [docs/development/env/LOCAL-ENV-OVERRIDES.md](../../docs/development/env/LOCAL-ENV-OVERRIDES.md).
-
-### Async handlers
-
-Wrap async route handlers to avoid unhandled rejections (e.g. try/catch and pass errors to Express error middleware, or use a small `asyncHandler` wrapper).
-
-### Request body validation and controller typing
-
-- **Validate at the route**: Use `validateBody(schema)` middleware (Joi) on any route that accepts a JSON body. Validation runs before the controller; invalid requests get 400 with details and never reach the controller.
-- **Type the validated body**: In the schema file, export an interface that matches the shape Joi validates (e.g. `CreateAdminBody` for `createAdminSchema`). Use `.default()` in Joi so optional fields have a known shape after validation.
-- **Controllers assume valid body**: In the controller, use the validated schema shape (for example the exported body interface from the schema module) and avoid redundant field-type checks. Do **not** repeat “field is required” or “field must be a string” checks for fields already validated by middleware; controllers should only do business checks (e.g. “email already in use”, “display name already in use”, auth checks).
-- **Same pattern in management-api**: Apply the same pattern in `apps/management-api`: schemas in `schemas/*.ts` with exported body types, routes using `validateBody(schema)`, controllers using the types and no redundant presence/type checks for validated fields.
-
-## Scripts
-
-- `npm run dev` – Build and run (from `apps/api`)
-- `npm run dev:api` – From repo root
-- **Tests:** When adding or changing routes or auth behavior, add or update integration tests. Use the **api-testing** skill for file layout (auth.test.ts vs auth-no-mailer vs auth-mailer), base URL (`config.apiVersionPath`), and clean-slate/requirements.
diff --git a/.llm/exports/opencode/skills/argocd-gitops-push/SKILL.md b/.llm/exports/opencode/skills/argocd-gitops-push/SKILL.md
deleted file mode 100644
index 7b64bc03..00000000
--- a/.llm/exports/opencode/skills/argocd-gitops-push/SKILL.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-name: argocd-gitops-push
-description: When adding or changing files under infra/k8s/ or sync targets for k8s, know what Argo CD syncs and remind the user to push to Git so the cluster can sync.
----
-
-
-# Argo CD / GitOps push awareness
-
-## When to use
-
-When adding or changing files under:
-
-- `infra/k8s/` (local, base, or app-of-apps manifests and referenced resources),
-- Or any path that is part of an Argo CD Application source (e.g. `infra/k8s/local/apps`, `infra/k8s/local/stack`, `infra/k8s/base/stack`, source under base, and files referenced by those via Kustomize),
-- Or **canonical linear migration SQL** under `infra/k8s/base/ops/source/database/linear-migrations/{app,management}/` (versioned chain applied by the linear migration runner),
-- Or **ops** manifests under `infra/k8s/base/ops/` (Kustomize bundles: migration CronJob SQL, scripts mounted into jobs, and related `kustomization.yaml` entries that must stay in sync with on-disk files).
-
-## What Argo CD syncs
-
-- The local app points at repo path `infra/k8s/local/apps` (see `infra/k8s/local-application.yaml`), which references `infra/k8s/local/stack` and the base stack.
-- The alpha app-of-apps root points at repo path `infra/k8s/alpha/apps` (see `infra/k8s/alpha-application.yaml`), which references `infra/k8s/alpha/<component>/` overlays.
-- Only the **remote** Git repo at the configured revision (e.g. `develop`) is used; the agent does not push. The user must push for Argo CD to see changes.
-
-## When a push is required
-
-Any change to files under those paths (or to canonical sources that get copied into them) means the cluster will not reflect the change until the user pushes to the branch Argo CD tracks.
-
-## Response requirement
-
-When your file-modifying work touches any of these paths, add a short **Push to Git** note in the response (e.g. before or after the verification block):
-
-**Push to Git:** This change affects Argo CD–synced manifests. Push to the branch Argo CD tracks (e.g. `develop`) for the cluster to sync.
-
-## Version updates (GitOps)
-
-- **Manifest changes** (image tags, env, resources, new deployments): Updating the manifest is the change; push is required for Argo CD (covered by the response reminder above).
-- **npm/package versions:** Follow the existing AGENTS.md Dependencies section; no separate version rule for GitOps.
-
-## See also
-
-- [infra/k8s/INFRA-K8S.md](infra/k8s/INFRA-K8S.md) – k8s layout and local app-of-apps.
-- [docs/development/k8s/K3D-ARGOCD-LOCAL.md](docs/development/k8s/K3D-ARGOCD-LOCAL.md) – Local k3d + Argo CD setup.
diff --git a/.llm/exports/opencode/skills/avoid-line-height/SKILL.md b/.llm/exports/opencode/skills/avoid-line-height/SKILL.md
deleted file mode 100644
index 57cbcf8f..00000000
--- a/.llm/exports/opencode/skills/avoid-line-height/SKILL.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-name: avoid-line-height
-description: Do not change line-height; use normal line height for text. Control spacing with gap, margin, padding, and layout components. Use when adding or editing styles, typography, or vertical rhythm in SCSS/CSS or UI components.
----
-
-
-# Avoid Changing Line Height
-
-**When to use:** When adding or editing styles (SCSS/CSS), typography, layout components, or when the user mentions line-height, vertical spacing, or text spacing.
-
-## Rule
-
-Do **not** set or change `line-height` on text elements. The project uses **normal line height** for text (from the reset on `html`/`body`). Line height should match the text itself; we do not use line-height to control vertical spacing.
-
-## How to control spacing instead
-
-- **Between lines of text:** Rely on `line-height: normal` (inherited). Do not add `line-height` to get more or less space.
-- **Between blocks or elements:** Use **gap** (e.g. `Stack` with `gap`, flex/grid `gap`), **margin**, or **padding** on layout components.
-- **Form controls / inputs:** The reset and component styles may keep inherited line-height; do not add line-height for spacing—use padding or min-height if needed for tap targets.
-- **Vertical rhythm:** Use spacing tokens (`$space-*`, `$gap-standard`), `Stack`, and layout structure rather than line-height.
-
-## Do not
-
-- Add `line-height: 1.5`, `line-height: 1.2`, or any explicit line-height for “readability” or spacing.
-- Override the root `line-height: normal` in globals or reset.
-- Use line-height to fix alignment or spacing that should be solved with gap, margin, or padding.
-
-## Exception
-
-Only set `line-height` when a component has a **specific need** that cannot be met by gap/margin/padding (e.g. a single-line control that must have `line-height: 1` for precise height). Prefer leaving line-height unset so it inherits normal.
diff --git a/.llm/exports/opencode/skills/avoid-unknown-types/SKILL.md b/.llm/exports/opencode/skills/avoid-unknown-types/SKILL.md
deleted file mode 100644
index 444a6545..00000000
--- a/.llm/exports/opencode/skills/avoid-unknown-types/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: avoid-unknown-types
-description: Do not use `unknown` for API response fields or known data shapes. Use precise types so the type system enforces correctness. Use when typing API responses, context state, or DTOs.
-version: 1.0.0
----
-
-
-# Avoid `unknown` for Known Shapes
-
-Using `unknown` for a field that has a known structure (e.g. `permissions`, API response bodies) is a code smell: it opts out of type checking and forces call sites to assert or narrow without a single source of truth.
-
-## Do
-
-- **Define a precise type** that matches the API contract or domain shape (e.g. `ManagementUserPermissions`, `ManagementUser`). Put it in a shared types file (e.g. `src/types/management-api.ts`) or a package (e.g. `@podverse/helpers` DTOs).
-- **Use that type** in context state, component props, and API response handling. Re-export or alias if needed (e.g. `export type AuthUser = ManagementUser`).
-- **Keep types in sync** with the API (OpenAPI schema, backend entities, or API docs). When the API gains a new field, add it to the type.
-
-## Don't
-
-- **Don't type known shapes as `unknown`** (e.g. `permissions?: unknown`, `metadata?: unknown`) when you know the structure. If the backend returns `{ adminsCrud, usersCrud, ... }`, type it as an object with those properties.
-- **Don't leave placeholder `unknown`** “for later.” Define the minimal shape now and extend it when the API evolves.
-
-## When `unknown` is acceptable
-
-- **Truly opaque data** (e.g. a pass-through payload you never inspect).
-- **Type guards**: the guard narrows `unknown` to a concrete type in one place; call sites then use the narrowed type.
-- **Generic or external input** that must be validated at runtime before use.
-
-## Example
-
-- **Bad:** `type Admin = { id: string; email: string; permissions?: unknown };`
-- **Good:** Define `ManagementUserPermissions` with `adminsCrud`, `usersCrud`, `canChangePasswords`, `canAssignPermissions`, `eventVisibility`, then `type ManagementUser = { id: string; email: string; permissions?: ManagementUserPermissions | null };` and use `ManagementUser` (or `AuthUser = ManagementUser`) everywhere.
diff --git a/.llm/exports/opencode/skills/avoid-unused-props-vars/SKILL.md b/.llm/exports/opencode/skills/avoid-unused-props-vars/SKILL.md
deleted file mode 100644
index f08ccf13..00000000
--- a/.llm/exports/opencode/skills/avoid-unused-props-vars/SKILL.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-name: avoid-unused-props-vars
-description: Do not keep unused props or variables. Remove them from types and call sites (or delete the variable) instead of using _unused or "intentionally unused" patterns. Use when adding or refactoring component props, function parameters, or local variables.
----
-
-
-# Avoid Unused Props and Variables
-
-Do not add or keep props or variables that are never used. Prefer removing them over using underscore or "intentionally unused" patterns.
-
-## Do
-
-- Remove the prop from the component's props type and from every caller.
-- Remove unused local variables or parameters when you control the interface.
-- Rely on derived values (e.g. `canEditPermissions`) at the caller instead of passing raw data the component does not use.
-
-## Don't
-
-- Add or keep props "for callers" that the component never uses.
-- Destructure as `prop: _prop` or `prop: _unused` just to satisfy the linter when the prop can be removed.
-- Keep variables that are never read.
-
-## Exception
-
-When a symbol is required by an external interface or API and cannot be removed (e.g. a callback signature that must accept a parameter), the underscore pattern is acceptable. Add a brief comment explaining why it is required.
diff --git a/.llm/exports/opencode/skills/avoid-wrapper-elements/SKILL.md b/.llm/exports/opencode/skills/avoid-wrapper-elements/SKILL.md
deleted file mode 100644
index 20a72d49..00000000
--- a/.llm/exports/opencode/skills/avoid-wrapper-elements/SKILL.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-name: avoid-wrapper-elements
-description: Avoid div and other element wrappers within pages that exist only to apply styles. Use when adding or reviewing page layout, spacing, or wrapper markup in apps (e.g. Next.js pages, React components).
----
-
-
-# Avoid Wrapper Elements for Styling Only
-
-**When to use:** When adding or editing page layout, spacing, or when you see a `<div>`, `<span>`, or similar wrapper that exists only to hold a `className` (e.g. for margin, padding, or flex).
-
-## Rule
-
-Do **not** add free-floating wrappers (div, span, etc.) whose sole purpose is to apply styles. If you need layout or spacing:
-
-1. **Use an existing component** that already provides the structure (e.g. `Stack`, `Container`, `SectionWithHeading`, `Card`, `ContentPageLayout`).
-2. **Add a reusable component** if the pattern is repeated or will be—put the structure and styles in that component and use it from the page.
-
-In **shared UI / layout components** (e.g. `BucketDetailContent`), do **not** use raw `<div>`, `<h1>`, `<h2>`, or other heading tags when a layout component exists: use **PageHeader** for page/section titles, **SectionWithHeading** for section blocks, **Stack** / **Container** for layout. This keeps markup consistent and lets the design system own structure and semantics.
-
-## How to fix
-
-- **Spacing between blocks:** Prefer layout components (e.g. `Stack` with gap) or margin/padding on the real semantic parent (section, article, the component that owns the content).
-- **“Wrapper for one style”:** Move the style onto an existing wrapper or the nearest semantic element; or introduce a small layout component (e.g. in `@metaboost/ui`) that encodes the pattern.
-- **Repeated pattern:** Extract to a shared component with its own module SCSS instead of a one-off div + class.
-
-## Examples
-
-- **Bad:** `<div style={{ marginBottom: '1rem' }}><ButtonLink>...</ButtonLink></div>`  
-  **Good:** Use `Stack` with gap, or a layout component that already provides that spacing.
-
-- **Bad:** A `<div className={styles.section}>` that only adds padding and is used once on one page.  
-  **Good:** Use `Container`, `Card`, or a layout component; or add a named component (e.g. `Section`) if the pattern is reused.
-
-- **Bad:** Nested divs that each apply one CSS property.  
-  **Good:** Single semantic container or existing layout component; consolidate styles there or in a new reusable component.
-
-- **Bad:** `<h2>{name}</h2>` or a raw `<div className={styles.wrap}>` for content width in a shared component.  
-  **Good:** `<PageHeader title={name} />` for the title; `<Container contentMaxWidth="readable">` or `<Stack maxWidth="readable">` for layout.
-
-## Relation to other skills
-
-- Prefer **reusable components** (see reusable-components skill) when the pattern is or could be repeated.
-- Use **existing UI/layout components** from the design system (Stack, Container, Card, etc.) before introducing new wrapper elements.
diff --git a/.llm/exports/opencode/skills/button-loading-async/SKILL.md b/.llm/exports/opencode/skills/button-loading-async/SKILL.md
deleted file mode 100644
index 0720a3cd..00000000
--- a/.llm/exports/opencode/skills/button-loading-async/SKILL.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-name: button-loading-async
-description: Always show a loading spinner in a button when it triggers an async action (submit, save, delete, etc.).
-version: 1.1.0
----
-
-
-# Button loading state for async actions
-
-**When to use:** Whenever you add or change a button that triggers an async request (form submit, save, delete, invite, copy, etc.).
-
-## Rule
-
-Any button that starts an async operation (API call, mutation, clipboard write, etc.) must:
-
-1. **Track in-flight state** – e.g. `const [loading, setLoading] = useState(false);` and set `true` at the start of the request, `false` in `finally` (or on success/error).
-2. **Pass it to the Button** – use the `loading` prop on `Button` from `@metaboost/ui`: `<Button ... loading={loading}>`. The Button shows an inline spinner and is disabled while `loading` is true.
-3. **Disable the button while loading** – either pass `disabled={loading}` explicitly or rely on Button’s built-in behavior (Button already sets `disabled` when `loading` is true). For secondary actions (e.g. Cancel), pass `disabled={loading}` so they are disabled during the primary action.
-
-## Why
-
-- Users get immediate feedback that the action is in progress (visible spinner).
-- Prevents double-submit and accidental repeated clicks.
-- Matches expected UX for forms and destructive actions.
-
-## Checklist
-
-- Does this button trigger a fetch, mutation, or other async work? → Add (or reuse) a loading state and pass `loading={...}` to the Button.
-- For form submit buttons, the same state used for `disabled={loading}` should be passed as `loading={loading}` so the spinner appears.
-- For confirm/delete modals, pass `loading={confirmLoading}` (or equivalent) to the confirm Button so the delete button shows a spinner.
-- For copy buttons (e.g. clipboard), use a short-lived loading state so the button shows a spinner while the async copy runs.
diff --git a/.llm/exports/opencode/skills/catch-unused-error/SKILL.md b/.llm/exports/opencode/skills/catch-unused-error/SKILL.md
deleted file mode 100644
index 37469192..00000000
--- a/.llm/exports/opencode/skills/catch-unused-error/SKILL.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-name: catch-unused-error
-description: Use parameterless catch when the error value is not used. Use when writing or editing try/catch in TypeScript/JavaScript.
----
-
-
-# Catch without unused variable
-
-When a `catch` block does **not** use the error value, do not bind it. Use a parameterless `catch` so ESLint `@typescript-eslint/no-unused-vars` is satisfied and the intent is clear.
-
-## Do
-
-```ts
-try {
-  await sendVerificationEmail(...);
-} catch {
-  // Continue; best-effort
-}
-```
-
-## Don't
-
-```ts
-try {
-  await sendVerificationEmail(...);
-} catch (e) {
-  // e is never used → no-unused-vars
-}
-```
-
-## Empty catch and `no-empty`
-
-This repo enables ESLint **`no-empty`** via `eslint.configs.recommended`. A `catch { }` block with **no statements and no comment** is rejected as an empty block. If you swallow the error intentionally, include at least **one comment** (see “Do” above) or a statement. See [no-empty](https://eslint.org/docs/latest/rules/no-empty).
-
-When you **do** need the error (e.g. to log, rethrow, or inspect it), keep the binding: `catch (err) { ... }`. Only omit the parameter when the catch body does not reference the error at all.
diff --git a/.llm/exports/opencode/skills/crud-tables-resources/SKILL.md b/.llm/exports/opencode/skills/crud-tables-resources/SKILL.md
deleted file mode 100644
index 229f28c5..00000000
--- a/.llm/exports/opencode/skills/crud-tables-resources/SKILL.md
+++ /dev/null
@@ -1,67 +0,0 @@
----
-name: crud-tables-resources
-description: How CRUD (Create, Read, Update, Delete) is handled for resource tables and detail pages in the Metaboost management-web app.
----
-
-
-# CRUD Tables and Resources (Metaboost)
-
-Use this skill when adding or changing list/detail/edit flows for admins, users, or other CRUD resources in management-web. Keeps table actions, routes, and permissions consistent.
-
-## CRUD flow and routes
-
-For each resource (e.g. Admins, Users):
-
-| Action     | Route pattern          | Page / behavior                                                      |
-| ---------- | ---------------------- | -------------------------------------------------------------------- |
-| **List**   | `/resources`           | List page with table, search/filter, “Add” when create allowed.      |
-| **View**   | `/resources/[id]`      | Read-only detail page; link to Edit when update allowed.             |
-| **Create** | `/resources/new`       | Form page; create permission required.                               |
-| **Edit**   | `/resources/[id]/edit` | Form page; update permission required (or self for super admin).     |
-| **Delete** | (no page)              | Triggered from table row; delete permission required; confirm modal. |
-
-- **Routes**: Define in `apps/management-web/src/lib/routes.ts` — e.g. `adminViewRoute(id)`, `adminEditRoute(id)`, `userViewRoute(id)`, `userEditRoute(id)`.
-- **List access**: User must have **read** permission (or be super admin) to see the list; redirect otherwise.
-
-## Table actions order
-
-In `ResourceTableWithFilter`, row actions are shown in this order:
-
-1. **View** — link to `/resources/[id]` (read-only). Shown when `canView` is true (typically when user has read permission).
-2. **Edit** — link to `/resources/[id]/edit`. Shown when `canUpdate` (or per-row `getRowActions().canUpdate`) is true.
-3. **Delete** — button opening confirm modal. Shown when `canDelete` (or per-row `getRowActions().canDelete`) is true.
-
-View is always before Edit and Delete. Pass `viewRoute`, `viewLabelKey`, and `canView` into `ResourceTableWithFilter`; use `editRoute`, `editLabelKey`, `canUpdate`, `deleteLabelKey`, `canDelete` for Edit/Delete.
-
-## Permissions (CRUD bits)
-
-- **Source**: `getCrudFlags(isSuperAdmin, permissions, 'adminsCrud' | 'usersCrud')` from `lib/main-nav.ts`. Returns `{ create, read, update, delete }`.
-- **List page**: Require `crud.read` (or super admin); pass `canViewX={crud.read}`, `canUpdateX={crud.update}`, `canDeleteX={crud.delete}` to the table.
-- **View page**: Require read; show Edit button only when `crud.update` (or self-edit for super admin).
-- **Edit page**: Require update (or self for super admin); form submit calls update API.
-- **Create page**: Require `crud.create`; form submit calls create API.
-- **Delete**: API called from table with `onDelete`; require delete permission (and no delete for super admin row).
-
-## ResourceTableWithFilter props (summary)
-
-- **View**: `viewRoute?: (id) => string`, `viewLabelKey?: string`, `canView?: boolean`. When `canView` and viewRoute/viewLabelKey are set, a View link is rendered before Edit.
-- **Edit**: `editRoute`, `editLabelKey`, `canUpdate` (or per-row via `getRowActions().canUpdate`).
-- **Delete**: `onDelete`, `deleteLabelKey`, `canDelete` (or per-row via `getRowActions().canDelete`), `confirmDeleteTranslationKeyPrefix`, `getDisplayName`, `currentUserId`, `onSelfDelete`.
-- **Per-row overrides**: `getRowActions(row)` can return `{ canView?, canUpdate, canDelete }` (e.g. hide Delete for super admin, allow Edit only for self).
-
-## Adding a new CRUD resource
-
-1. **Routes**: Add `ROUTES.RESOURCE`, `ROUTES.RESOURCE_NEW`, plus `resourceViewRoute(id)` and `resourceEditRoute(id)` in `lib/routes.ts`.
-2. **List page**: `app/(main)/resources/page.tsx` — fetch list, compute crud flags, render `*TableWithFilter` with `canView*, canUpdate*, canDelete*`, `viewRoute`, `viewLabelKey`, `editRoute`, `onDelete`, etc.
-3. **View page**: `app/(main)/resources/[id]/page.tsx` — fetch one by id, require read, show read-only fields and Edit link when update allowed.
-4. **Edit page**: `app/(main)/resources/[id]/edit/page.tsx` — fetch one, require update (or self), render form.
-5. **Create page**: `app/(main)/resources/new/page.tsx` — require create, render form.
-6. **Table component**: e.g. `ResourcesTableWithFilter` — pass `viewRoute`, `viewLabelKey`, `canView`, `editRoute`, `canUpdate`, `canDelete`, `getRowActions` if needed.
-7. **i18n**: Add `resourcesTable.view`, `resourcesTable.edit`, `resourcesTable.delete`, `viewResourceTitle`, etc., in `i18n/originals/en-US.json` (and es).
-
-## References
-
-- `apps/management-web/src/components/ResourceTableWithFilter.tsx` — shared table with View / Edit / Delete.
-- `apps/management-web/src/components/AdminsTableWithFilter.tsx`, `UsersTableWithFilter.tsx` — examples.
-- `apps/management-web/src/lib/main-nav.ts` — `getCrudFlags`, `hasReadPermission`.
-- `apps/management-web/src/lib/routes.ts` — route helpers.
diff --git a/.llm/exports/opencode/skills/database-schema-naming/SKILL.md b/.llm/exports/opencode/skills/database-schema-naming/SKILL.md
deleted file mode 100644
index 9230ee3e..00000000
--- a/.llm/exports/opencode/skills/database-schema-naming/SKILL.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: database-schema-naming
-description: Table and column names in this repo use snake_case. Use when adding or changing ORM entities, migrations, or init SQL.
----
-
-
-# Database schema: snake_case
-
-## Rule
-
-**Table names** use **singular** nouns (e.g. `user`, `user_credentials`, `user_bio`, `verification_token`). **Column names** use **snake_case** (e.g. `display_name`, `created_at`, `profile_visibility`).
-
-- **SQL / init scripts** (`infra/k8s/base/db/source/`, `packages/orm`): Define tables in singular and columns in snake_case.
-- **TypeORM entities**: Use camelCase for TypeScript properties. Map to the database with an explicit `name` when they differ:
-  - `@Entity('user')` — table name singular, snake_case.
-  - `@Column({ name: 'display_name', ... })` for property `displayName`.
-  - `@Column({ name: 'profile_visibility', ... })` for property `profileVisibility`.
-  - `@CreateDateColumn({ name: 'created_at' })` for `createdAt`, and similarly for `updated_at`.
-
-If you add a new entity or column without `name`, TypeORM will use the property name as the column name (camelCase), which will not match the schema and will cause runtime errors (e.g. `column "displayName" does not exist`). Always use singular table names and snake_case columns in the DB, and map explicitly in the entity when the property is camelCase.
-
-**Public `id_text` columns** (e.g. `user.id_text`, `bucket.id_text`): SQL type is **`nano_id_v2`** (Postgres domain `VARCHAR(15)` with 9–15 length); ORM properties use **`idText`**; JWT claim **`id_text`**; helpers use `NANO_ID_V2_*` and `isValidNanoIdV2IdText` (aligned with Podverse).
-
-## See also
-
-- **linear-db-migrations** (`.llm/exports/opencode/skills/linear-db-migrations/SKILL.md`) when changing migration files, ops bundles, or bootstrap under `infra/k8s/base/db/`.
diff --git a/.llm/exports/opencode/skills/documentation-conventions/SKILL.md b/.llm/exports/opencode/skills/documentation-conventions/SKILL.md
deleted file mode 100644
index 30ff59cb..00000000
--- a/.llm/exports/opencode/skills/documentation-conventions/SKILL.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-name: documentation-conventions
-description: Documentation file naming for the Metaboost repo. Use when creating or modifying docs, README, or markdown.
-version: 1.1.0
----
-
-
-# Documentation Conventions
-
-## Single README
-
-- **One** `README.md` at repository root.
-- **Only one file in the entire repository may be named README** (the root `README.md`). Subdirectories must use descriptive names (e.g. `scripts/github/SCRIPTS-GITHUB.md`, not `README.md`).
-
-## Directory-Specific Docs
-
-Name after the full path from root (uppercase, slashes → hyphens):
-
-- `apps/api/` → `APPS-API.md`
-- `apps/web/` → `APPS-WEB.md`
-- `infra/k8s/` → `INFRA-K8S.md`
-- `packages/ui/` → `PACKAGES-UI.md`
-- `scripts/github/` → `SCRIPTS-GITHUB.md`
-- `.llm/` → `LLM.md`
-
-Pattern: `[FULL-PATH-WITH-HYPHENS].md`. Do not add multiple `README.md` files per directory.
-
-## INDEX.md and plan indexes
-
-- The **only** `INDEX.md` in the repo is `.llm/exports/opencode/skills/INDEX.md` (skills quick reference). All other directory overviews use the full-path name (e.g. `INFRA-K8S.md`, `PACKAGES-UI.md`).
-- Plan-set indexes under `.llm/plans/` use `00-overview.md` or `00-master-plan.md`, not INDEX.md or README.md.
diff --git a/.llm/exports/opencode/skills/e2e-authz-matrix/SKILL.md b/.llm/exports/opencode/skills/e2e-authz-matrix/SKILL.md
deleted file mode 100644
index 30f82790..00000000
--- a/.llm/exports/opencode/skills/e2e-authz-matrix/SKILL.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-name: e2e-authz-matrix
-description: Adds authorization matrix coverage to Playwright specs. Use when testing pages with role or ownership rules so tests assert visible, hidden, disabled, and forbidden action states.
-version: 1.0.0
----
-
-
-# E2E AuthZ Matrix
-
-Use this skill for permission-sensitive routes and controls. Current E2E bar: **Confident** (see e2e-crud-state-matrix).
-
-For **permission-gated edit/detail/settings specs**, apply the full **permission actor matrix** process so all actor × outcome permutations are tested (unauthenticated, owner, non-owner with/without permission, non-admin, plus list→edit and Cancel→list). See the **e2e-permission-actor-matrix** skill for the step-by-step process and the reference implementation: web bucket-admin-edit is implemented across the `bucket-admin-edit-*.spec.ts` specs in `apps/web/e2e/` (unauthenticated, bucket-owner, bucket-admin, admin-without-permission, non-admin).
-
-## Required role/ownership matrix
-
-For each protected surface, include at least:
-
-- Unauthenticated user
-- Fully privileged user
-- Restricted user or restricted row/entity condition (owner/self/superadmin cases)
-
-## Required assertions
-
-- Redirect or forbidden behavior for unauthenticated requests.
-- Action visibility differences (`visible` vs `not rendered`) by role.
-- Action interactivity differences (`enabled` vs `disabled`) by role/row state.
-- Forbidden mutation attempts return stable UI feedback (error banner/toast/message) when applicable.
-
-## Management-web specifics
-
-- Prefer row-level assertions in resource tables for `view/edit/delete` action gating.
-- Include superadmin/self-protection behavior when relevant.
-
-## User context in the E2E report
-
-For authZ tests, set the user context so the E2E HTML report shows which role/CRUD permissions are in effect. Call `setE2EUserContext(testInfo, '…')` at the start of each test (see e2e-readability skill). The report will display "User context: <description>" in the test section and summary.
-
-## Completion checklist
-
-- [ ] At least one non-happy-path authZ assertion exists for each permission-sensitive flow touched.
-- [ ] Visibility and disabled-state checks are both present where UI supports both.
-- [ ] No authZ scenario is marked complete with only route-load assertions.
diff --git a/.llm/exports/opencode/skills/e2e-crud-state-matrix/SKILL.md b/.llm/exports/opencode/skills/e2e-crud-state-matrix/SKILL.md
deleted file mode 100644
index 8398f91f..00000000
--- a/.llm/exports/opencode/skills/e2e-crud-state-matrix/SKILL.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-name: e2e-crud-state-matrix
-description: Enforces a strict CRUD and UI-state matrix for Playwright tests in apps/web and apps/management-web. Use when adding or reviewing E2E specs for create/read/update/delete, validation, show/hide, enable/disable, and empty/loading/error branches.
-version: 1.0.0
----
-
-
-# E2E CRUD State Matrix
-
-Use this skill before marking E2E work complete.
-
-## Current E2E bar: Confident
-
-The project targets **Confident** coverage: happy paths and auth boundaries covered; permission matrix on important surfaces (e.g. bucket admin edit, role edit, message edit); URL-state where it matters; deny tests use real seeded resources so breaking permission checks fails the test. Cells in the CRUD/state/auth matrices marked Gap are backlog—fix when touching that feature, not as a single "close all gaps" pass. Matrix checklists: [docs/testing/E2E-CRUD-STATE-AUTH-MATRICES.md](docs/testing/E2E-CRUD-STATE-AUTH-MATRICES.md) (index), [E2E-CRUD-STATE-AUTH-MATRIX-WEB.md](docs/testing/E2E-CRUD-STATE-AUTH-MATRIX-WEB.md), [E2E-CRUD-STATE-AUTH-MATRIX-MANAGEMENT-WEB.md](docs/testing/E2E-CRUD-STATE-AUTH-MATRIX-MANAGEMENT-WEB.md).
-
-## Required matrix per surface
-
-For each tested page/component surface, explicitly track:
-
-- Create
-- Read
-- Update
-- Delete
-- Show/hide controls by state
-- Enable/disable transitions (including submit loading state)
-- Validation (required fields, invalid input, server error text)
-- Empty/loading/error states
-
-## Quality bar
-
-- Prefer deterministic assertions over broad fallback assertions.
-- Do not accept “route loads” as sufficient for edit/delete flows.
-- For update/delete, assert both action result and post-action persistence.
-- For forms, assert button/input state transitions before and after submit.
-
-## Minimum assertion patterns
-
-- **Create**: submit valid form -> redirect/result -> row/detail visible.
-- **Update**: edit field -> save -> revisit list/detail -> updated value visible.
-- **Delete**: confirm dialog path -> row removed; cancel path -> row unchanged.
-- **Validation**: empty/invalid submit -> remains on form -> validation visible.
-- **State branches**: explicit assertions for each reachable empty/loading/error branch.
-
-## Permission-gated surfaces
-
-For edit/detail/settings pages that are gated by ownership or role (bucket admin, bucket role, message edit, management resource edit), also apply the **e2e-permission-actor-matrix** skill so all actor × outcome permutations (unauthenticated, owner, non-owner with/without permission, non-admin) and flow tests (list→edit, Cancel→list) are covered.
-
-## Completion checklist
-
-- [ ] Every modified surface has CRUD row status (`covered` or `deferred`).
-- [ ] Deferred rows include rationale in the active plan/history.
-- [ ] For permission-gated surfaces, actor matrix coverage is applied (see e2e-permission-actor-matrix).
-- [ ] Changed specs pass targeted runs.
-- [ ] Full relevant app E2E run passes.
diff --git a/.llm/exports/opencode/skills/e2e-page-tests/SKILL.md b/.llm/exports/opencode/skills/e2e-page-tests/SKILL.md
deleted file mode 100644
index 39043352..00000000
--- a/.llm/exports/opencode/skills/e2e-page-tests/SKILL.md
+++ /dev/null
@@ -1,117 +0,0 @@
----
-name: e2e-page-tests
-description: When layout, functionality, or conditions change in apps/web or apps/management-web, add or update the corresponding E2E (Playwright) test so page behavior stays covered.
-version: 1.3.4
----
-
-
-# E2E Page Tests (Web and Management-Web)
-
-Testing requirement policy lives in **feature-implementation-testing**. This skill focuses on **how** to add or update E2E coverage for web and management-web changes.
-
-Current E2E bar: **Confident**. Use this skill when you change **layout**, **functionality**, or **conditions** (e.g. redirects, auth checks, visibility, error states) in `apps/web` or `apps/management-web`. Always add or update an E2E test so the change is covered and regressions are caught. **Updating E2E tests is required for functional changes to web or management-web; it must not be treated or listed as optional in plans or implementation reports.**
-
-## When to add or update a test
-
-- **Layout changes** – New or moved sections, nav, headings, or structure on a page.
-- **Functionality changes** – New or changed forms, buttons, links, or user flows (e.g. create bucket, edit message, login).
-- **Condition changes** – New or changed redirects, auth guards, visibility rules, or error/empty states.
-
-For CRUD and permission-gated flows, also apply **e2e-crud-state-matrix** and, for permission-gated pages, **e2e-permission-actor-matrix**.
-For query-param state behavior, also apply **e2e-url-state-contracts**.
-For test-title/step readability and report behavior, also apply **e2e-readability**.
-
-If the change is in **web**, add or update a spec in `apps/web/e2e/`. If it is in **management-web**, add or update a spec in `apps/management-web/e2e/`. When **adding** a new spec file, update the corresponding E2E spec order file so the full report stays in conceptual order (see **e2e-report-order** skill).
-
-**End your response with exact E2E verification commands.** Whenever you add, change, or remove E2E specs or change UI that E2E tests cover, you **MUST** end the response with a fenced `bash` block containing the **EXACT** `make` command(s) the user needs to run to verify the change (e.g. `make e2e_test_web_report_spec SPEC=e2e/settings-bucket-owner.spec.ts`). See **response-ending-make-verify** skill. No exception.
-
-## Deterministic outcome policy (required)
-
-- Each E2E test must have **one deterministic expected outcome** for the mode/config it runs under.
-- **No dual-condition or mode-agnostic tests.** Do not write a single test that accepts "either outcome A or outcome B" (e.g. "either success message or error message") depending on config or env. Such tests hide regressions and violate single-outcome policy.
-- **Do not permit dual outcomes** such as "either error message A or redirect B." Use one assertion path per test.
-- Do not use `Promise.race(...)` or broad regex patterns to accept multiple incompatible outcomes.
-- **Separate spec files per mode (avoid `test.skip()`).** When behavior is mode-dependent (e.g. `ACCOUNT_SIGNUP_MODE=admin_only_username` vs `ACCOUNT_SIGNUP_MODE=admin_only_email` or `user_signup_email`), use **separate spec files per mode** (e.g. `settings-bucket-owner.spec.ts` for default, `settings-bucket-owner-admin-only-email.spec.ts` for admin-only-email) and run each spec only under the config where that outcome is guaranteed. Do **not** use `test.skip()` to gate mode-dependent tests so that "skipped" is not necessary; each file has a single outcome per test and runs in one config.
-- A test should fail when the non-target mode behavior appears.
-
-## Timeout increases are almost never the fix (required)
-
-- Do **not** resolve failing or flaky E2E tests by increasing timeout values (`test.setTimeout(...)`, `test.slow()`, Playwright `timeout`, `expect.timeout`, or per-call `{ timeout: ... }`) as the first response.
-- In nearly all cases, timeout failures indicate a readiness, determinism, or assertion issue, not that tests should simply wait longer.
-- Fix root cause first:
-  - add explicit destination-load verification after navigation (URL and destination-specific visible element),
-  - assert the specific success/error state tied to the user action,
-  - use deterministic setup data (especially for one-time tokens and links),
-  - remove arbitrary sleeps in favor of condition-based waits.
-- If a timeout increase is truly unavoidable, treat it as a rare exception: document why inline in the spec and keep the increase minimal.
-
-## Where tests live
-
-| App                 | Specs directory            | Config                                         |
-| ------------------- | -------------------------- | ---------------------------------------------- |
-| apps/web            | `apps/web/e2e/`            | `apps/web/playwright.config.ts` (default)      |
-| apps/web (signup)   | `apps/web/e2e/`            | `apps/web/playwright.signup-enabled.config.ts` |
-| apps/management-web | `apps/management-web/e2e/` | `apps/management-web/playwright.config.ts`     |
-
-- **Default web E2E** uses `ACCOUNT_SIGNUP_MODE=admin_only` (signup disabled). For signup-enabled auth flows (signup, forgot-password, reset-password), use `make e2e_test_web_signup_enabled`; it starts Mailpit via `infra/docker/e2e/docker-compose.yml` and uses the signup-enabled config. `make test_clean` removes Mailpit with other test containers. See [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md) (“E2E and ACCOUNT_SIGNUP_MODE”).
-- Use the **deterministic E2E seed** for data (e.g. `e2e-bucket-owner@example.com` / `Test!1Aa` for web bucket-owner; management-web login is by username `e2e-superadmin` and password `Test!1Aa`). See [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md).
-- **API gate**: E2E Make targets run API integration tests first; if they fail, Playwright does not run.
-- **Current startup model**: Playwright `webServer` now auto-starts the required API + web apps on dedicated E2E ports in production-like mode (`build` + `start`), so manual app startup is not part of normal E2E runs.
-
-## Rate limiting and auth in E2E
-
-- **Rate limiting disabled in test**: In test, rate limits are effectively disabled (very high limit) so E2E and API integration tests never hit 429. Do not add tests (E2E or API) that assert rate-limit behavior (e.g. 429 after N requests); see api-testing skill.
-
-## Placeholder plans
-
-Page-level coverage is tracked in `.llm/plans/active/e2e-page-tests/` (e.g. `web-03-dashboard.md`, `mgmt-06-bucket-detail.md`). When you add or expand a test for a page, consider updating the corresponding placeholder with the new scenarios or marking it as implemented.
-
-## Quick reference
-
-- **Default execution strategy (agent/sandbox):** use the leanest E2E command that validates the change first (single spec/report-spec target), then broaden only when required.
-- **Most targeted web E2E run:** `make e2e_test_web_report_spec SPEC=e2e/<spec>.spec.ts`
-- **Most targeted management-web E2E run:** `make e2e_test_management_web_report_spec SPEC=e2e/<spec>.spec.ts`
-- **Run E2E (web only):** `make e2e_test_web`
-- **Run E2E (management-web only):** `make e2e_test_management_web`.
-- **Run E2E (both):** `make e2e_test`.
-- **Run report-focused home smoke (auto-opens HTML reports, captures step screenshots):** `make e2e_test_home_report`.
-- **Signup-enabled web E2E** (signup + forgot/reset auth pages; starts Mailpit, report to `web-signup-enabled/`): `make e2e_test_web_signup_enabled`.
-- **Admin-only-email web E2E (scoped report):** `make e2e_test_web_admin_only_email_report_spec SPEC=e2e/<spec>.spec.ts` (e.g. `SPEC=e2e/settings-bucket-owner-admin-only-email.spec.ts`). Full suite: `make e2e_test_web_admin_only_email`.
-- **Docs:** [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md).
-
-Report mode uses a custom reporter (`scripts/e2e-html-steps-reporter.ts`) so each
-step screenshot is shown with its full "Step description" in an expandable block
-directly below the image; when the capture helper attaches a "Step URL", the report
-shows that URL in the same block. The report UI includes a fixed top-right indicator
-showing which test you are viewing (e.g. 3 / 12) and fixed bottom-right nav (prev/next
-test, shot, error).
-
-### Report title and meta title (required)
-
-Every E2E HTML report must use a **descriptive title** in the page heading and `<title>` (browser tab), not a generic label like "E2E step report". The required pattern is:
-
-- **Web (default or scoped):** `E2E Web Report - e2e/<spec>.spec.ts` (or comma-separated spec paths when multiple).
-- **Web admin-only-email:** same pattern; output dir must be `web-admin-only-email` so the reporter uses the Web Report title and appends `E2E_REPORT_SPEC`.
-- **Web signup-enabled:** `E2E Web Report – ACCOUNT_SIGNUP_MODE=user_signup_email, MAILER_ENABLED=true` with optional ` - e2e/<spec>...` when scoped.
-- **Management-web:** `E2E Management Web Report - e2e/<spec>.spec.ts`.
-
-The reporter derives the title from `PLAYWRIGHT_HTML_OUTPUT_DIR` (must end with one of: `web`, `web-admin-only-email`, `web-signup-enabled`, `management-web`) and `E2E_REPORT_SPEC` (spec path or comma-separated list). When adding or changing Make report targets, always set `E2E_REPORT_SPEC` and use one of these output dirs so the generated report has the correct heading and meta title.
-
-## Screenshot naming policy (QA-readable)
-
-When adding or updating screenshot steps in E2E specs:
-
-- Use `actionAndCapture` / `capturePageLoad` from `e2e/helpers/stepScreenshots`.
-- Keep screenshot capture report-focused (`E2E_STEP_SCREENSHOTS=true` runs such as `e2e_test_home_report`).
-- **Use very descriptive step labels** that explain expected visible UI outcome, not short action codes.
-- Prefer long, explicit labels over short ambiguous labels so QA can infer expected state from filename alone.
-
-Good label examples:
-
-- `User navigates to the home route and is redirected to the login page for an unauthenticated session.`
-- `The dashboard screen is visible with the primary heading after successful login.`
-
-Avoid labels like:
-
-- `goto-home`
-- `click-login`
diff --git a/.llm/exports/opencode/skills/e2e-permission-actor-matrix/SKILL.md b/.llm/exports/opencode/skills/e2e-permission-actor-matrix/SKILL.md
deleted file mode 100644
index 1d4fa8a5..00000000
--- a/.llm/exports/opencode/skills/e2e-permission-actor-matrix/SKILL.md
+++ /dev/null
@@ -1,76 +0,0 @@
----
-name: e2e-permission-actor-matrix
-description: Apply the thorough CRUD permission permutation test process to E2E specs. Use when adding or aligning tests for permission-gated pages (edit/detail/settings) so all actor × outcome permutations and key flows are covered.
-version: 1.0.0
----
-
-
-# E2E Permission Actor Matrix
-
-Current E2E bar: **Confident**. Use this skill when implementing or reviewing E2E tests for any permission-gated surface (bucket admin edit, role edit, message edit, settings, management resource edit/detail, etc.). The goal is to bring every such spec into alignment with the same thorough, CRUD-permutation approach used in the web bucket-admin-edit specs.
-
-## Reference implementation
-
-- **Specs (web, split by actor):** The actor × outcome matrix for bucket-admin-edit is implemented across [bucket-admin-edit-unauthenticated.spec.ts](apps/web/e2e/bucket-admin-edit-unauthenticated.spec.ts), [bucket-admin-edit-bucket-owner.spec.ts](apps/web/e2e/bucket-admin-edit-bucket-owner.spec.ts), [bucket-admin-edit-bucket-admin.spec.ts](apps/web/e2e/bucket-admin-edit-bucket-admin.spec.ts), [bucket-admin-edit-admin-without-permission.spec.ts](apps/web/e2e/bucket-admin-edit-admin-without-permission.spec.ts), and [bucket-admin-edit-non-admin.spec.ts](apps/web/e2e/bucket-admin-edit-non-admin.spec.ts). Together they cover unauthenticated, owner, admin with permission, admin without permission, and non-admin.
-- **Pattern:** API/source-of-truth → actor matrix table → seed + login helpers → tests per actor × outcome + flow tests (one spec per actor or combined as needed).
-
-## Process (apply to each permission-gated spec)
-
-### 1. Establish API/source of truth
-
-- Identify the permission policy (e.g. `canManageBucketAdmins`, bucket/role/message CRUD bits).
-- Document which actors can perform which actions (e.g. owner vs non-owner-admin with/without permission vs non-admin).
-- Note how the app treats API responses (e.g. 403 → not found).
-
-### 2. Define the actor matrix
-
-Build a table of **actors** × **expected outcome** when opening or acting on the page:
-
-- **Unauthenticated** → redirect to login.
-- **Fully privileged** (e.g. owner, superadmin) → can open; read-only vs editable by row/target as per policy.
-- **Privileged non-owner** (e.g. admin with permission) → same as owner where policy allows; otherwise not found/forbidden.
-- **Restricted** (e.g. admin without permission, or non-admin) → not found or forbidden (match API behavior).
-
-Add rows for **target** × **actor** where relevant (e.g. edit owner row → read-only; edit other admin → form with Save; invalid id → not found).
-
-### 3. Seed and login helpers
-
-- Ensure E2E seed (or test data) includes all required actors: owner, non-owner with permission, non-owner without permission, non-admin (or management equivalents).
-- Provide login helpers per role (e.g. `loginAsWebE2EUserAndExpectDashboard`, `loginAsWebE2EAdminWithPermission`, `loginAsWebE2EAdminWithoutPermission`, `loginAsWebE2ENonAdmin`).
-- Use `setE2EUserContext(testInfo, '…')` at the start of each test so the report shows which role is in effect.
-
-### 4. Implement tests
-
-- **Unauthenticated:** redirect to login (e.g. `expectUnauthedRouteRedirectsToLogin`).
-- **Owner / fully privileged:** happy path (open edit, read-only for owner row, form for other row), invalid id → not found.
-- **Non-owner with permission:** open edit on owner row → read-only (or not found if API does not return owner); open edit on self/other → form; invalid id → not found.
-- **Non-owner without permission:** open edit (any target) → not found (e.g. `expectInvalidRouteShowsNotFound`).
-- **Non-admin:** open edit (any target) → not found.
-- **Flow tests:** list → edit navigation; Cancel → list; Save → list and persistence where applicable.
-
-Use existing helpers: `expectInvalidRouteShowsNotFound`, `actionAndCapture`, `capturePageLoad`, `setE2EUserContext`.
-
-### 5. Quality bar
-
-- Every actor in the matrix has at least one test that asserts the expected outcome.
-- Invalid or forbidden targets (invalid id, wrong permission) assert not found or equivalent stable UI.
-- Navigation flows (list→edit, Cancel→list) are covered for at least one privileged actor.
-- No permission-sensitive scenario is marked done with only "route loads" or a single-actor test.
-
-## Cross-reference
-
-- **e2e-crud-state-matrix:** CRUD and UI-state coverage (create/read/update/delete, validation, empty/loading/error).
-- **e2e-authz-matrix:** Role/ownership visibility and disabled states; use together with this skill for full coverage.
-- **e2e-readability:** Verbose step names and `setE2EUserContext` for report clarity.
-
-## Completion checklist (per spec)
-
-- [ ] API/source-of-truth behavior documented or referenced.
-- [ ] Actor matrix table defined (actors × outcomes).
-- [ ] Seed data and login helpers exist for all actors.
-- [ ] Unauthenticated test present.
-- [ ] Each privileged actor has tests for allowed and disallowed targets.
-- [ ] Restricted actors (no permission / non-admin) get not found or forbidden.
-- [ ] List→edit and Cancel→list (and Save→list where relevant) covered.
-- [ ] Invalid id (or equivalent) → not found for at least one privileged actor.
-- [ ] Targeted spec run passes; no regression in full app E2E.
diff --git a/.llm/exports/opencode/skills/e2e-readability/SKILL.md b/.llm/exports/opencode/skills/e2e-readability/SKILL.md
deleted file mode 100644
index 46fd1dee..00000000
--- a/.llm/exports/opencode/skills/e2e-readability/SKILL.md
+++ /dev/null
@@ -1,125 +0,0 @@
----
-name: e2e-readability
-description: E2E specs use verbose complete sentences and explicit post-navigation verification; report keeps redirect-to-login summary-only and hides only non-validating navigation screenshots.
-version: 1.2.0
----
-
-
-# E2E Readability and Report Behavior
-
-Use this skill when adding or editing E2E specs in `apps/web/e2e/` or `apps/management-web/e2e/`. Test titles and step labels use complete sentences; the only exception is the **suite-level describe**, which uses a concise title-like phrase (see Describe blocks).
-
-## Describe blocks
-
-**Suite-level describe** (the top-level block that states what the suite verifies): use a **concise, title-like** descriptor, not a full sentence. This is the one place where a short phrase is preferred. **Nested describe blocks, test titles, and step labels** keep **verbose sentence-style** (see Test titles and Step labels below). This convention applies to both `apps/web/e2e` and `apps/management-web/e2e`.
-
-- Good: "Home page for the unauthenticated user"
-- Good: "Dashboard for non-admin users"
-- Avoid (for suite-level): "This suite verifies the home page for the unauthenticated user."
-- **Non-default auth mode:** If the suite runs in a non-default auth mode, end the title with the mode in parentheses. Do not use the word "mode". Default is `admin_only_username` (no suffix). Use `(admin_only_email)` or `(user_signup_email)` only when the spec is run with that config. Examples: "Reset-password page (admin_only_email)", "Signup page (user_signup_email)".
-
-**Nested describe blocks** (feature or group): use a clear full-sentence or phrase for the feature.
-
-- Good: "Creating a new child bucket under an existing bucket"
-- Avoid: "Bucket child new"
-
-## Test titles
-
-Use **complete, verbose sentences**. Prefer "When … , they/he/she …" for readability.
-
-- Good: "When an unauthenticated user tries to open the page to create a new child bucket, they are redirected to the login page."
-- Good: "When an authenticated user opens the page to create a new child bucket, they see the create form with a name field and a submit button."
-- Avoid: "unauthenticated user is redirected to login", "authenticated user sees child bucket create form"
-
-## Step labels
-
-Use **full sentences** for the third argument to `capturePageLoad`, `actionAndCapture`, and `expectUnauthedRouteRedirectsToLogin`, and keep compound terms consistent with titles.
-
-- Good: "User navigates to the admin-edit-route for the bucket-owner's user id and sees not found."
-- Good: "The bucket-admin-edit-form is visible for the bucket-admin."
-- Avoid: mixing hyphenated compound terms in one section and space-separated terms in another for the same concept.
-
-The reporter preserves step labels as authored, including hyphenated compound terms.
-
-## Post-navigation verification (required)
-
-Every navigation action in E2E tests must be followed by explicit verification that the destination loaded correctly. **Checking only that the URL changed is not enough:** you must verify that at least one expected element on the destination page has loaded (e.g. heading, form field, table, CTA). Otherwise the test (or a step screenshot) may pass while the new page is still loading or not yet rendered.
-
-- Applies to `page.goto(...)`, route-changing link/button clicks, and helper-driven navigation.
-- After navigation, assert **both**:
-  - URL assertion (`toHaveURL(...)`), and
-  - at least one destination-specific element visibility (`toBeVisible()` on heading, form field, table, CTA, etc.).
-- Do not rely only on "absence" assertions right after navigation (for example, only checking a value is missing). Add a positive destination-load assertion first.
-- **When using `actionAndCapture` for a navigation step** (e.g. click a link, then capture): perform the URL assertion and the element visibility assertion **inside** the callback, so the screenshot is taken only after the destination page has loaded. If you assert only after the callback, the screenshot may show the previous page or a loading state.
-- For shared helpers that navigate (for example login helpers), include the destination-load verification inside the helper.
-
-## Redirect-to-login tests
-
-Tests that assert an unauthenticated user is redirected to the login page appear **only in the Test summary** at the top of the E2E HTML report; they are not shown in the "Screenshots and step descriptions" section (to avoid repetitive content). When adding such tests, use a title that clearly indicates redirect to login (e.g. contains "redirected to the login page") so the reporter keeps them summary-only.
-
-## Navigation screenshot filtering in report
-
-The reporter hides **image only** (not step text) for navigation-only, non-validating steps when the same test has a later validation/evidence step.
-
-- Keep the step row and authored step description visible in the report.
-- Hide only the screenshot image for navigation-only setup steps.
-- Keep screenshots for validation/evidence steps.
-- This uses step-label patterns plus same-test local context to avoid over-filtering.
-- Redirect-to-login summary-only behavior remains unchanged.
-
-## Error-state screenshot ordering (required)
-
-When a test step expects an error-like result (validation error, invalid credentials, not found, invalid token, or unauth redirect), capture screenshots only after that outcome is verified.
-
-- For `actionAndCapture(...)`, place error-like assertions inside the callback so capture happens after verification.
-- For helper wrappers (for example invalid-route and unauth-redirect helpers), verify the expected error-like state inside the wrapped callback before the screenshot is taken.
-- Acceptable post-action verification includes:
-  - explicit error/validation/not-found text visibility,
-  - redirect target verification plus destination UI evidence (for example login form fields).
-- Avoid taking screenshots immediately after navigation or submit when the expected error-like state has not yet been asserted.
-
-## User context in reports
-
-Every test that has a defined user (unauthenticated or a specific role) should set the **user-role** annotation so the E2E HTML report shows **User context** for that test. Call `setE2EUserContext(testInfo, description)` at the start of each test (from `./helpers/userContext`).
-
-**Pattern:** Use **role** or **role (permissions)**. Be consistent so the reporter can apply a dedicated color.
-
-**Web app:** Only **unauthenticated**, **basic-user**, **bucket-owner**, and **bucket-admin** (web has no "admin" role). For limited-permission bucket admins use the **same resource/level notation** as management-web inside parentheses: full CRUD = resource name only; read-only = `resource:R`; no access = `resource:-`. Web resources (bucket-scoped): settings, roles, messages, admins, bucket, bucket_create. Examples: `bucket-admin (settings:- roles:- messages:- admins:-)`, `bucket-admin (bucket:R bucket_create:-)`.
-
-**Management-web:** Use **super-admin** for the super-admin identity. For all other management users use **admin (…)** with abbreviated permission notation: full CRUD = resource name only (e.g. `admins`, `users`); read-only = `resource:R` (e.g. `buckets:R`). Examples: `admin (admins users events:own)`, `admin (buckets:R bucket_admins events:all_admins)`. Do not use "limited-admin", "admin with X", or "admin without X" as the role name.
-
-- Good: `super-admin`, `admin (admins users events:own)`, `bucket-owner`, `unauthenticated`
-- Avoid: `super-admin`, `limited-admin (users read)`, `admin with bucketAdminsCrud`
-
-The report then shows "User context: <description>" in each test section and in the summary.
-
-## Seeded user role naming
-
-When a test refers to a **specific seeded user role**, use consistent names so "user" vs "owner user" is unambiguous:
-
-- **bucket-owner** — the seeded user who owns the bucket (web: e2e-bucket-owner@example.com). In code/comments: `bucketOwner`.
-- **bucket-admin** — the seeded user who is a bucket admin but not the owner (web: e2e-bucket-admin@example.com). In code/comments: `bucketAdmin`.
-- **super-admin** — management-web: e2e-superadmin. In code/comments: `superAdmin`.
-
-Avoid "seeded owner user" (prefer bucket-owner) and "seeded non-owner-admin" (prefer bucket-admin) so the role is clear.
-
-## Hyphens for compound concepts in titles and step labels
-
-In **test titles and step labels**, use **hyphens between words** for compound terms that represent one thing. Joining words that refer to a single concept (routes, pages, forms, seeded identities) makes it clearer what is being asserted when reading the report.
-
-- Apply this consistently across **all** specs in both `apps/web/e2e` and `apps/management-web/e2e`.
-- **Routes:** admin-edit-route, bucket-admin-edit-route (not "admin edit route" with spaces).
-- **Pages:** bucket-admin-edit-page, admin-edit-page (not "bucket admin edit page").
-- **Forms:** bucket-admin-edit-form (not "bucket admin edit form").
-- **Seeded identities:** bucket-owner, bucket-admin, super-admin (not "seeded bucket owner").
-- **Other single concepts:** bucket-admin-permissions when referring to one thing.
-
-Example: "When the user opens the admin-edit-route with the bucket-owner's user id, they see not found." In variable names and constant comments in code, use camelCase (e.g. `bucketOwner`).
-
-## Screenshot shows verified element
-
-When a step documents verification of a **specific element** (e.g. a row, form, or control state), pass that element to the capture helper so the screenshot is taken with it vertically centered. See the **e2e-screenshot-verified-element** skill.
-
-## Reference
-
-See [apps/web/e2e/bucket-nested-new.spec.ts](apps/web/e2e/bucket-nested-new.spec.ts) for the canonical pattern. Reporter logic: [scripts/e2e-html-steps-reporter.ts](scripts/e2e-html-steps-reporter.ts) (`isRedirectToLoginTest`).
diff --git a/.llm/exports/opencode/skills/e2e-report-order/SKILL.md b/.llm/exports/opencode/skills/e2e-report-order/SKILL.md
deleted file mode 100644
index cd54466f..00000000
--- a/.llm/exports/opencode/skills/e2e-report-order/SKILL.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-name: e2e-report-order
-description: Maintain E2E spec order for full reports and respect parameter order for specified runs.
-version: 1.0.0
----
-
-
-# E2E Report Order
-
-Use this skill when working with E2E report ordering: full-suite reports (`make e2e_test_report`) or scoped runs with `SPEC` / `WEB_SPEC` / `MGMT_SPEC`.
-
-## 1. Full report: one per web auth mode + management-web
-
-The full E2E report (`make e2e_test_report`) produces **four** HTML reports (four browser tabs when opened):
-
-1. **Web (default)** — `ACCOUNT_SIGNUP_MODE=admin_only_username`; report dir `web/`.
-2. **Web signup-enabled** — `ACCOUNT_SIGNUP_MODE=user_signup_email`, Mailpit; report dir `web-signup-enabled/`.
-3. **Web admin-only-email** — `ACCOUNT_SIGNUP_MODE=admin_only_email`; report dir `web-admin-only-email/`.
-4. **Management-web** — report dir `management-web/`.
-
-**When adding a new web auth mode**: Add a Playwright config (e.g. `playwright.<mode>.config.ts`), a spec-order file if needed (e.g. `e2e-spec-order-web-<mode>.txt`), and include the new run in both `e2e_test_report` and `e2e_test` in `makefiles/local/Makefile.local.e2e.mk` (new report dir, npm run with the new config, echo/open, and exit check). Update `scripts/e2e-html-steps-reporter.ts` so the new output dir gets a distinct report title.
-
-## 2. Master order for full report
-
-The full E2E report displays tests in **conceptual order** so the HTML report is easier to review (e.g. home first, then buckets list/detail/settings, then events/users/admins). Playwright may run spec files in its own order (e.g. alphabetical); when `E2E_SPEC_ORDER` is set (as the Makefile does from the order files), the custom HTML reporter reorders `this.runs` for display so the report reflects the intended order.
-
-- **Order files** (single source of truth):
-  - `makefiles/local/e2e-spec-order-web.txt` — one spec path per line (e.g. `e2e/home-unauthenticated.spec.ts`) for apps/web (default).
-  - `makefiles/local/e2e-spec-order-web-admin-only-email.txt` — same for apps/web admin-only-email mode.
-  - `makefiles/local/e2e-spec-order-management-web.txt` — same for apps/management-web.
-- **When adding a new E2E spec**: Add it to the appropriate order file in the **right conceptual place** (e.g. home specs first, then buckets list, bucket detail, bucket settings, bucket messages, bucket admin edit, etc.). Do not append at the end unless that is the right place; insert in the logical group.
-- **When removing a spec**: Remove its line from the corresponding order file so the full report does not reference a missing file.
-- **Comments**: Lines starting with `#` and blank lines in the order files are ignored when building the spec list.
-
-## 3. Specified runs (parameter order)
-
-When running one or more specs via `e2e_test_web_report_spec`, `e2e_test_management_web_report_spec`, or `e2e_test_report_scoped` with multiple comma-separated paths:
-
-- The Makefile sets `E2E_SPEC_ORDER` from the parameter (comma → semicolon); the reporter reorders runs for display so the report shows tests in **the same order as the parameter** (SPEC, WEB_SPEC, or MGMT_SPEC), even if Playwright runs specs in a different order.
-- **Do not sort or reorder** the spec list when suggesting or generating make commands. Pass specs in the order the user or scenario expects for review.
-
-## Reference
-
-- Order semantics are documented in [docs/testing/E2E-PAGE-TESTING.md](../../../docs/testing/E2E-PAGE-TESTING.md) under "Report order".
-- The custom reporter (`scripts/e2e-html-steps-reporter.ts`) reads `E2E_SPEC_ORDER` (semicolon-separated spec paths) in `onEnd` and sorts `this.runs` by that order before generating the HTML, so report display matches the intended order regardless of Playwright execution order.
diff --git a/.llm/exports/opencode/skills/e2e-screenshot-verified-element/SKILL.md b/.llm/exports/opencode/skills/e2e-screenshot-verified-element/SKILL.md
deleted file mode 100644
index 3cf5b4ae..00000000
--- a/.llm/exports/opencode/skills/e2e-screenshot-verified-element/SKILL.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-name: e2e-screenshot-verified-element
-description: When an E2E test verifies a specific element, pass it to the capture helper so the step screenshot is taken with that element vertically centered.
-version: 1.0.0
----
-
-
-# E2E Screenshot: Center Verified Element
-
-Use this skill when adding or editing E2E specs in `apps/web/e2e/` or `apps/management-web/e2e/` when the test verifies a specific element (visibility, content, state, or absence of a control) and then takes a step screenshot.
-
-## Rule
-
-When the goal of the step is to document verification of a **specific element**, pass that element as the optional `scrollToElement` argument to `capturePageLoad` or `actionAndCapture` so the screenshot is taken with that element **vertically centered** in the viewport. This makes the report show what was actually asserted.
-
-## Examples
-
-- Test asserts "owner row has no delete button" then captures → pass the owner row locator as the 4th argument to `capturePageLoad(page, testInfo, label, ownerRow)`.
-- Test performs an action then asserts on a specific table or form and captures → pass that table/form locator to `actionAndCapture(page, testInfo, label, action, scrollToElement)`.
-
-## When not to pass
-
-Generic "page loaded" or "navigation completed" captures with no single asserted element do not need `scrollToElement`; leave the parameter omitted.
diff --git a/.llm/exports/opencode/skills/e2e-url-state-contracts/SKILL.md b/.llm/exports/opencode/skills/e2e-url-state-contracts/SKILL.md
deleted file mode 100644
index 216aa2f3..00000000
--- a/.llm/exports/opencode/skills/e2e-url-state-contracts/SKILL.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-name: e2e-url-state-contracts
-description: Enforces URL-state contract tests for sortable/filterable pages in Playwright. Use when pages support search, sort, filters, pagination, or tab query params.
-version: 1.0.0
----
-
-
-# E2E URL State Contracts
-
-Current E2E bar: **Confident**. Use this skill for pages with query-param state.
-
-Apply this alongside **e2e-page-tests** for page-behavior coverage, and alongside **e2e-crud-state-matrix** when URL-state behavior affects CRUD list/detail flows.
-
-## Contract checklist
-
-- [ ] Supports expected params (`search`, `sortBy`, `sortOrder`, `page`, `tab`, etc.).
-- [ ] Preserves explicit params on load.
-- [ ] Applies canonicalization rules consistently (no unstable URL drift).
-- [ ] Back/forward navigation keeps user-visible state aligned with URL.
-- [ ] Defaults are not redundantly forced into URL unless product behavior requires it.
-
-## Assertion guidance
-
-- Parse `new URL(page.url())` and assert pathname + relevant params exactly.
-- Assert visible table/list state that corresponds to URL state (not URL alone).
-- For canonicalized routes, assert accepted canonical patterns explicitly.
-
-## Avoid
-
-- Overly permissive URL regexes that allow unintended params.
-- Assertions that only check the page heading after navigation.
-
-## Completion checklist
-
-- [ ] At least one query-param contract test per modified sortable/filterable surface.
-- [ ] Contract tests included in targeted and full E2E verification runs.
-- [ ] Companion page-behavior assertions are covered in the relevant e2e-page-tests spec.
diff --git a/.llm/exports/opencode/skills/feature-implementation-testing/SKILL.md b/.llm/exports/opencode/skills/feature-implementation-testing/SKILL.md
deleted file mode 100644
index baa9d0c6..00000000
--- a/.llm/exports/opencode/skills/feature-implementation-testing/SKILL.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-name: feature-implementation-testing
-description: When creating or implementing plans for features that touch api, management-api, web, or management-web, include the corresponding tests—integration tests for api/management-api and E2E tests for web/management-web.
-version: 1.0.0
----
-
-
-# Feature Implementation Testing Requirement
-
-When **creating or implementing plans** for features that touch `apps/api`, `apps/management-api`, `apps/web`, or `apps/management-web`, adding or updating the corresponding tests is a **requirement**, not optional.
-
-**Terminology:** **Integration tests** = api/management-api (Vitest, no browser). **E2E tests** = web/management-web (Playwright, browser).
-
-## Requirement by app
-
-- **api / management-api**: Add or update **integration tests** (see **api-testing**). If the change affects UI in web or management-web, also add or update the relevant **E2E tests** (see **e2e-page-tests**).
-- **web / management-web**: Add or update **E2E tests** (see **e2e-page-tests**, **e2e-crud-state-matrix**, **e2e-permission-actor-matrix** as applicable).
-
-## When this applies
-
-- Implementing a plan file that touches any of the four apps.
-- Implementing a feature (with or without a plan) that makes meaningful changes to api, management-api, web, or management-web.
-
-## Planning vs implementation
-
-- **Plan creation phase:** Do not implement product code or tests. Include explicit testing work in the plan steps (integration tests for api/management-api changes, E2E tests for web/management-web changes).
-- **Implementation phase:** Add or update the actual test files as required by this policy.
-
-Apply the relevant skill for _how_ to write the tests (api-testing for integration tests, e2e-page-tests and related E2E skills for Playwright specs). For URL-state behavior and E2E readability conventions, also see **e2e-url-state-contracts** and **e2e-readability**.
diff --git a/.llm/exports/opencode/skills/focus-outline-visible/SKILL.md b/.llm/exports/opencode/skills/focus-outline-visible/SKILL.md
deleted file mode 100644
index 73ab8220..00000000
--- a/.llm/exports/opencode/skills/focus-outline-visible/SKILL.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-name: focus-outline-visible
-description: Ensure the entire focus indicator is visible for buttons and button-like focusable elements; use padding + reverse margin when layout must stay unchanged.
-version: 1.0.0
----
-
-
-# Focus outline visibility
-
-**When to use:** When adding or changing buttons, links, tabs, or any focusable (clickable) component in `@metaboost/ui` or app code that receives keyboard focus and shows a focus ring.
-
-## Rule
-
-Every button and button-like component or element that can receive focus must have enough space around it so that when it has focus, the **entire** focus indicator is visible (not clipped).
-
-- Focus rings typically use `outline` + `outline-offset` (or box-shadow). The ring extends **outside** the element by `$focus-outline-width + $focus-outline-offset` (see `packages/ui/src/styles/_variables.scss`), usually 4px.
-- Any parent with `overflow: hidden`, `overflow: auto`, or `overflow: scroll` can clip that ring.
-- **Fix:** Give the container that has overflow enough **padding** (or give the focusable enough **margin**) so the ring has room—at least `$focus-outline-width + $focus-outline-offset` in each direction that could clip.
-
-### Keeping page spacing unchanged (reverse margin)
-
-When you need the **resulting spacing on the page to stay the same** but still need room inside the scroll/overflow container for the focus ring:
-
-1. Add **padding** to the scroll/overflow container: `padding: ($focus-outline-width + $focus-outline-offset) 0;` (vertical) or the same for horizontal as needed.
-2. Add an **equal negative margin** to the same element: `margin: -($focus-outline-width + $focus-outline-offset) 0;`.
-
-Effect: the focusable content has internal room so the outline is not clipped; the negative margin pulls the block back so the row/section does not take up extra space and the page layout looks the same. Use this for horizontal tab rows in a scroll wrapper, or any overflow container where visual spacing must be preserved.
-
-## Checklist
-
-- Does this component or its wrapper use overflow (hidden/auto/scroll)? If yes, is the focus ring fully visible when focused?
-- If the ring is clipped, add padding (and optionally reverse margin) so the ring is not clipped.
-- For new focusable components, ensure containers that use overflow leave room for the focus ring (padding or margin at least `$focus-outline-width + $focus-outline-offset`).
diff --git a/.llm/exports/opencode/skills/generate-data-sync/SKILL.md b/.llm/exports/opencode/skills/generate-data-sync/SKILL.md
deleted file mode 100644
index 0e6ad932..00000000
--- a/.llm/exports/opencode/skills/generate-data-sync/SKILL.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-name: generate-data-sync
-description: Keeps tools/generate-data seeders and docs in sync when main or management DB schema or ORM entities change. Use when adding or changing tables/entities in packages/orm, packages/management-orm, or infra database migrations.
----
-
-
-# Generate-data sync
-
-When the main or management database schema or ORM entities change, update the generate-data tool so
-seeded test data stays aligned.
-
-## When to use
-
-- Adding or changing tables in canonical SQL under `infra/k8s/base/db/source/`.
-- Adding or changing entities in `packages/orm` or `packages/management-orm`.
-
-## Steps
-
-1. **Decide what to seed**  
-   New or changed core domain tables (e.g. user-related, admin-related) should usually get seed
-   logic. Skip internal/auth-only tables (e.g. refresh_token, verification_token) unless tests need
-   them.
-
-2. **Update seeders**
-   - Main: `tools/generate-data/src/main/seed.ts` – add or update entities in dependency order;
-     respect FKs; use `@faker-js/faker` for appropriate fields; use bcrypt for password hashes where
-     applicable.
-   - Management: `tools/generate-data/src/management/seed.ts` – same; never set `is_super_admin:
-true` for seeded rows.
-
-3. **Update docs**  
-   Edit `tools/generate-data/TOOLS-GENERATE-DATA.md` so the “What gets seeded” section lists the
-   new or changed tables/entities.
-
-4. **Schema naming**  
-   Follow **database-schema-naming**: snake_case columns, singular table names; entity `name`
-   mapping where property is camelCase.
-
-## References
-
-- Main schema: `infra/k8s/base/db/source/app/0001_app_schema.sql`
-- Management schema: `infra/k8s/base/db/source/management/0001_management_schema.sql`
-- Seeders: `tools/generate-data/src/main/seed.ts`, `tools/generate-data/src/management/seed.ts`
-
-## See also
-
-- **linear-db-migrations** (`.llm/exports/opencode/skills/linear-db-migrations/SKILL.md`) for migration layout, ops bundle sync, and runners; [docs/development/DB-MIGRATIONS.md](../../docs/development/DB-MIGRATIONS.md) for the full runbook.
diff --git a/.llm/exports/opencode/skills/global/SKILL.md b/.llm/exports/opencode/skills/global/SKILL.md
deleted file mode 100644
index eac83f85..00000000
--- a/.llm/exports/opencode/skills/global/SKILL.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-name: global
-description: Global patterns for the Metaboost repo (API + Next.js app). Use when starting work in the repo or when applying repo-wide code quality, structure, or plan/history conventions.
-version: 1.1.1
----
-
-
-# Global Patterns
-
-## Structure
-
-- **API**: `apps/api/` – Standalone Express HTTP API
-- **Web**: `apps/web/` – Next.js app
-- **Sidecar**: `apps/web/sidecar/` – Runtime-config server for the Next.js app
-
-## TypeScript
-
-- Extend `tsconfig.base.json` in apps. Use ESM (NodeNext). Avoid type assertions (`as`) when a better approach exists.
-- Prefer **named exports**; avoid `export default` in ordinary modules when a named export works. See **.llm/exports/opencode/skills/prefer-named-exports/SKILL.md** (Next.js `page` defaults excepted).
-
-## Plan Management
-
-- Plans go in `.llm/plans/active/` (not `.cursor/plans/`).
-- **300 line limit** per plan. Split into sub-plans in the same directory if larger.
-
-## Documentation
-
-- Documentation naming rules are canonical in **.llm/exports/opencode/skills/documentation-conventions/SKILL.md**.
-
-## LLM History
-
-- Follow **.llm/exports/opencode/skills/llm-history/SKILL.md** as the canonical history process (timing, format, and split rules).
-- See `.llm/LLM.md` for the full system documentation.
-
-## Code Quality
-
-- **Import path casing:** Relative import paths must match the exact casing of files and directories on disk so builds pass on Linux/CI. See **.llm/exports/opencode/skills/path-casing-imports/SKILL.md** and **.llm/exports/opencode/instructions/path-casing-imports.instructions.md**.
-- Strict equality (`===` / `!==` only). Semicolons in JS/TS. Prefer `import type` for type-only imports.
-- **Exports:** Do not re-export symbols from app code (e.g. `lib/validation.ts`) when they are already exported by a shared package (e.g. `@metaboost/helpers`). Callers should import from the canonical source; unnecessary re-exports add indirection and maintenance cost.
-- **Catch blocks:** If the error value is not used, use `catch { ... }` (no variable). Put at least one comment inside the block when swallowing errors so ESLint **`no-empty`** passes. See **.llm/exports/opencode/skills/catch-unused-error/SKILL.md**.
-- **Unused props/vars:** Remove them; do not keep and destructure as `_unused`. See **.llm/exports/opencode/skills/avoid-unused-props-vars/SKILL.md**.
-- **Component props:** Do not pass `undefined` explicitly to components. Allow `null` as a value for optional props so callers can pass `prop={value}` directly; components treat `null` (and `undefined`) as "not set" / default behavior. When checking optional string props (e.g. error messages) for "has value", use a simple falsy check (`Boolean(value)` or `if (value)`) instead of explicit `!== undefined && !== null && !== ''`.
-- **No inline styles:** Do not use `style={{ ... }}` for layout or appearance. Use CSS classes instead: component or page SCSS modules (e.g. `ComponentName.module.scss`), or shared utility classes where appropriate. Keeps styling maintainable and consistent.
-
-## Agent/plan work: do not run tests
-
-- **Do not run tests or verification commands** (e.g. `make e2e_test_web`, `npm run test`, `make e2e_test_web_signup_enabled`) during agent or plan implementation work.
-- **Only instruct the user** to run those commands after your work is done. Provide the exact command(s) in a fenced `bash` block so the user can copy and run them.
-- See **response-ending-make-verify** for which commands to suggest.
-
-## Testing: no rate-limit tests
-
-- **Do not add tests that assert rate-limit behavior** (e.g. 429 after N requests) in api or management-api. Rate limiting is disabled in test (high limit); dedicated rate-limit tests have been removed as a chronic source of flakiness. See **api-testing** skill.
-
-## Test Command Efficiency (Agent default)
-
-- When **suggesting** verification commands to the user, start with the **smallest targeted command** that can verify the behavior.
-- Prefer single-file or single-spec commands before suite-level commands (for example, one Vitest file or one Playwright spec).
-- Escalate to broader commands only when required by scope or when a targeted run passes and broader confidence is needed.
-- Avoid defaulting to full test suites when a focused command can confirm the same fix faster.
diff --git a/.llm/exports/opencode/skills/helpers-requests-req-pattern/SKILL.md b/.llm/exports/opencode/skills/helpers-requests-req-pattern/SKILL.md
deleted file mode 100644
index dedf325f..00000000
--- a/.llm/exports/opencode/skills/helpers-requests-req-pattern/SKILL.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-name: helpers-requests-req-pattern
-description: Use @metaboost/helpers-requests and the "req..." function pattern for all API calls from apps. Use when adding or changing HTTP requests to the API, or when you see raw fetch() or axios in app code.
----
-
-
-# Helpers-requests and the req... pattern
-
-All outbound API requests from apps (web, management-web) must go through **@metaboost/helpers-requests**, using the **req...** function pattern. Do not use raw `fetch()` or direct HTTP clients in app code for API calls.
-
-## Rules
-
-1. **No raw fetch for API calls**  
-   App code must not call `fetch(url, ...)` for app/management API endpoints. Use a `req...` helper from `@metaboost/helpers-requests` instead.
-
-2. **Req... naming**
-   - **GET**: `reqFetch...` (e.g. `reqFetchBucket`, `reqFetchPublicBucket`, `reqFetchPublicBucketMessages`).
-   - **POST**: `reqPost...` (e.g. `reqPostPublicBucketMessage`).
-   - Other verbs: `reqPatch...`, `reqPut...`, `reqDelete...` as needed.
-
-3. **Where helpers live**
-   - **Web app API**: `packages/helpers-requests/src/web/` (e.g. `web/buckets.ts`, `web/auth.ts`). Exported as `webBuckets`, `webAuth`, etc.
-   - **Management-web API**: `packages/helpers-requests/src/management-web/`. Exported as `managementWebAuth`, `managementWebAdmins`, etc.
-   - Each helper calls the shared `request()` from `packages/helpers-requests/src/request.js` (consistent URL building, JSON, error shape, optional auth/locale).
-
-4. **Adding a new endpoint**
-   - Add a `req...` function in the appropriate module under `web/` or `management-web/`.
-   - Use `request<T>(baseUrl, path, options)` with `method`, `body`, `headers`, `credentials` as needed.
-   - Export the function via the existing namespace (e.g. `webBuckets`) in `packages/helpers-requests/src/index.ts`.
-   - In the app, call e.g. `webBuckets.reqPostPublicBucketMessage(baseUrl, bucketId, body)` and handle `res.ok` / `res.error.message`.
-
-5. **Base URL**
-   - Server-side: use `getServerApiBaseUrl()` (from app lib); base URL already includes API version path.
-   - Client-side: use `getApiBaseUrl()` from app’s api-client (or equivalent); it includes version path.
-
-## Example (client component)
-
-```ts
-import { webBuckets } from '@metaboost/helpers-requests';
-import { getApiBaseUrl } from '../../../../../lib/api-client';
-
-const baseUrl = getApiBaseUrl();
-const res = await webBuckets.reqPostPublicBucketMessage(baseUrl, bucketId, {
-  senderName,
-  body,
-  isPublic,
-});
-if (!res.ok) {
-  setSubmitError(res.error.message ?? 'Failed to submit');
-  return;
-}
-// res.data available when res.ok
-```
-
-## Example (server component)
-
-```ts
-import { webBuckets } from '@metaboost/helpers-requests';
-import { getServerApiBaseUrl } from '../../../../../lib/server-request';
-
-const baseUrl = getServerApiBaseUrl();
-const res = await webBuckets.reqFetchPublicBucket(baseUrl, id);
-if (!res.ok || res.data?.bucket === undefined) return null;
-return res.data.bucket;
-```
-
-## When to use this skill
-
-- Adding or changing any HTTP request from apps/web or apps/management-web to the main API or management API.
-- Reviewing or refactoring code that uses `fetch(...)` or direct HTTP calls to app backends.
-- Adding a new API endpoint and wiring it in the frontend: add the `req...` helper first, then use it in the app.
diff --git a/.llm/exports/opencode/skills/i18n/SKILL.md b/.llm/exports/opencode/skills/i18n/SKILL.md
deleted file mode 100644
index dd4626c0..00000000
--- a/.llm/exports/opencode/skills/i18n/SKILL.md
+++ /dev/null
@@ -1,99 +0,0 @@
----
-name: i18n
-description: How i18n translations work in the Metaboost repo. Use when adding or editing translation keys, adding locales, or generating translations so you can do it reliably.
-version: 1.1.0
----
-
-
-# i18n in Metaboost
-
-Use this skill whenever you add or change user-facing strings, add a locale, or generate translations. It ensures key parity, correct file layout, and the right commands.
-
-## Three-tier layout (per app or package)
-
-Each app with i18n (`apps/web`, `apps/management-web`) and the backend package (`packages/helpers-i18n`) have:
-
-- **`i18n/originals/`** — Source of truth. `en-US.json` is maintained by hand. Other locale files (e.g. `es.json`) must have the **exact same key structure** as `en-US.json` (values can be translated or placeholder).
-- **`i18n/overrides/`** — Human corrections for non–en-US locales. Same keys as originals; non-empty override values win over originals at compile time. Committed.
-- **`i18n/compiled/`** — Merged output (originals + overrides). Generated only; **do not commit** (in `.gitignore`). Used at runtime.
-
-## Commands (run from repo root)
-
-- **`npm run i18n:sync`** — Sync originals from en-US for web, management-web, and helpers-i18n: add any keys present in en-US but missing in other locales’ originals with **empty string** (do not put English into es or other locale files; those must be in the target language, e.g. Spanish for es). Run after adding keys to en-US so key parity is achieved; then translate empty keys to the locale language. The **compile** step does not sync from en-US; sync is done by this script or by the i18n workflow.
-- **`npm run i18n:compile`** — For web, management-web, and **helpers-i18n**: sync override file structure **from each locale’s originals** (new keys get empty string in overrides), then merge originals + overrides into compiled. Run after changing originals or overrides.
-- **`npm run i18n:validate`** — Check that all locale files (originals + overrides) have the same keys **and key order** as `en-US`; **en-US** originals must have no empty values; non–en-US originals may have empty (pending translation). Overrides match structure. Validates web, management-web, and helpers-i18n. Run in CI and locally before committing i18n changes.
-
-## Adding or changing keys
-
-1. Edit **`i18n/originals/en-US.json`** in the app (or in each app/package that has the key). Use nested keys and namespaces (e.g. `auth.login.title`, `common.loading`, `ui.auth.login.email`). Do **not** leave empty values in en-US.
-2. **Other locales:** Run **`npm run i18n:sync`** then **`npm run i18n:compile`** so originals and overrides for other locales get the new keys (sync adds missing keys with empty string; do not put English in es or other locale files—translate to the target language, e.g. Spanish for es). Alternatively, merge to the mainline branch and let the **i18n workflow** run sync + compile + validate; then add translations for any new empty keys.
-3. Run **`npm run i18n:validate`** to confirm (same keys and key order as en-US; only en-US must have no empty).
-4. In code: `useTranslations('auth')` then `t('login.title')`, or `useTranslations('ui')` then `t('auth.login.email')` for UI package keys.
-
-## Key conventions
-
-- **Namespaces:** `auth`, `common`, `dashboard`, `settings`, `errors`, **`ui`** (see below).
-- **UI package:** Components in `@metaboost/ui` that render their own text use the **`ui`** namespace. Each app must include a full **`ui`** object in its `i18n/originals/en-US.json` (and other locales). Required keys are listed in **`packages/ui/I18N-KEYS.md`**. When adding or changing UI strings, update that file and add the key to each app’s originals (and other locales).
-
-## Generating translations (other locales)
-
-There is **no built-in auto-translate**. Translations for non–en-US locales can be generated with an **LLM of your choosing** (e.g. Cursor chat): provide `en-US.json` (or the relevant namespace) and ask for a translation that preserves the exact JSON key structure and only changes string values. Then:
-
-1. Write the result to the correct `i18n/originals/<locale>.json` (or use overrides for corrections).
-2. Run **`npm run i18n:compile`** and **`npm run i18n:validate`** to ensure key parity and compile.
-
-## Non–en-US originals must be in the target language
-
-**Do not put English text into non–en-US originals** (e.g. `es.json`). Spanish originals must be in Spanish; other locales in their language. The sync script adds missing keys with empty string so they can be filled with the correct translation. When adding or editing translations, use the target language for that locale.
-
-## Validation rules (what i18n:validate enforces)
-
-- `en-US.json` exists in originals and has no empty or undefined values.
-- Non–en-US files in `originals/` may have empty values (pending translation); only en-US is required to have no empty.
-- Every file in `originals/` and `overrides/` has exactly the same keys as `en-US` (no missing, no extra) and in the **same key order** (depth-first) as en-US.
-
-## Locale list and environment variables
-
-Locale list and default are defined once in **`packages/helpers/src/locale/constants.ts`** (`ALL_AVAILABLE_LOCALES`, `DEFAULT_LOCALE`, `Locale`). Web and management-web import from `@metaboost/helpers`; backend (helpers-i18n) re-exports from helpers. Runtime behavior is filtered by env vars `DEFAULT_LOCALE` and `SUPPORTED_LOCALES`.
-
-### Sync points (all locations to update when adding a locale or changing default/supported)
-
-| Purpose                                   | File                                                                                                                                                              |
-| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Locale constants (single source of truth) | `packages/helpers/src/locale/constants.ts` — `ALL_AVAILABLE_LOCALES`, `DEFAULT_LOCALE`. Web, management-web, and helpers-i18n use these via `@metaboost/helpers`. |
-| Web: env var documentation                | `apps/web/sidecar/.env.example` — `DEFAULT_LOCALE`, `SUPPORTED_LOCALES`                                                                                           |
-| Management-web: env var documentation     | `apps/management-web/sidecar/.env.example` — `DEFAULT_LOCALE`, `SUPPORTED_LOCALES`                                                                                |
-
-- **`DEFAULT_LOCALE`** (env) — Overrides the default locale (e.g. `en-US`). Must be one of the values in that app’s `ALL_AVAILABLE_LOCALES`.
-- **`SUPPORTED_LOCALES`** (env) — Unset or `all-available`: use the full hardcoded list. Comma-delimited (e.g. `en-US,es`): only those locales are active; values must be in `ALL_AVAILABLE_LOCALES`.
-
-**When you add a new locale** (e.g. `fr`): add the locale to **`packages/helpers/src/locale/constants.ts`** (`ALL_AVAILABLE_LOCALES`). Then add `originals/fr.json` and (after compile) `overrides/fr.json` for each app and for `packages/helpers-i18n`, and run compile and validate. Web and management-web read the list from `@metaboost/helpers`; no need to edit their request.ts. Ensure the sidecar `.env.example` files (`apps/web/sidecar/.env.example`, `apps/management-web/sidecar/.env.example`)
-document `DEFAULT_LOCALE` and `SUPPORTED_LOCALES` if you rely on them; app `.env.example` files
-contain only `RUNTIME_CONFIG_URL`.
-
-## Where things live
-
-| Item                                  | Location                                                                                                                                                                                                |
-| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| App originals                         | `apps/<app>/i18n/originals/` (e.g. `en-US.json`, `es.json`)                                                                                                                                             |
-| App overrides                         | `apps/<app>/i18n/overrides/` (e.g. `es.json`)                                                                                                                                                           |
-| App compiled                          | `apps/<app>/i18n/compiled/` (generated; do not edit)                                                                                                                                                    |
-| App locale list / request config      | Apps import `ALL_AVAILABLE_LOCALES` from `@metaboost/helpers`; `request.ts` (or app i18n config) uses that for locale list.                                                                             |
-| Backend i18n (API / management-api)   | `packages/helpers-i18n/` — same originals/overrides/compiled; `resolveLocale()`, `getPasswordValidationMessages()`, email content helpers. User-facing messages only (password validation, email body). |
-| Locale constants (all apps + backend) | `packages/helpers/src/locale/constants.ts`; import from `@metaboost/helpers` everywhere.                                                                                                                |
-| UI keys reference                     | `packages/ui/I18N-KEYS.md`                                                                                                                                                                              |
-| Full doc                              | `docs/localization/I18N.md`                                                                                                                                                                             |
-
-## i18n workflow (Podverse-style)
-
-When en-US changes are pushed to **develop**, `.github/workflows/i18n.yml` runs: **sync** originals from en-US (add missing keys with en-US value), **compile** (sync overrides from each locale’s originals, merge to compiled), **validate**, then commit and push originals + overrides if changed (message: `chore: sync i18n keys from en-US [bot]`). No LLM; key parity is achieved by the sync script. Locally you can run `npm run i18n:sync` then `npm run i18n:compile` to get the same result before pushing.
-
-## Quick checklist when you add or change strings
-
-- [ ] Add or edit key in `apps/<app>/i18n/originals/en-US.json` (no empty values).
-- [ ] If the string is from `@metaboost/ui`, add/update key in `packages/ui/I18N-KEYS.md` and ensure each app’s `ui` object has it.
-- [ ] Run `npm run i18n:sync` then `npm run i18n:compile` (or merge to develop and let the workflow do it).
-- [ ] Run `npm run i18n:validate`.
-- [ ] Use `useTranslations('namespace')` and `t('key')` in code (or pass translated strings as props from app to UI components).
-
-When **adding a new locale** (e.g. `fr`): add the locale to **`packages/helpers/src/locale/constants.ts`** (`ALL_AVAILABLE_LOCALES`). Web and management-web import from `@metaboost/helpers`; helpers-i18n re-exports from helpers. Then add originals/overrides for the new locale in each app and in helpers-i18n (see **Sync points** above).
diff --git a/.llm/exports/opencode/skills/interactive-prompts/SKILL.md b/.llm/exports/opencode/skills/interactive-prompts/SKILL.md
deleted file mode 100644
index b725c41b..00000000
--- a/.llm/exports/opencode/skills/interactive-prompts/SKILL.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-name: interactive-prompts
-description: Do not complete steps that require interactive prompts (inquirer, CLI input). Tell the user their input is needed and provide exact instructions.
-version: 1.0.0
----
-
-
-# Interactive Prompts
-
-When a workflow **requires the user to enter input at a prompt** (e.g. inquirer, readline, "Enter…", "Select…"), do **not** try to complete that step automatically.
-
-## Rule
-
-1. **Do not** run or "complete" steps that depend on interactive prompts.
-2. **Do** stop and tell the user that **their input is needed**.
-3. **Do** give **clear, copy-pasteable instructions**: exact commands and what to enter or select.
-
-## Summary
-
-- **Don't:** Pipe input, fake prompts, or mark interactive steps as "done" without user action.
-- **Do:** State that the user must complete the prompt steps and give exact instructions.
diff --git a/.llm/exports/opencode/skills/linear-db-migrations/SKILL.md b/.llm/exports/opencode/skills/linear-db-migrations/SKILL.md
deleted file mode 100644
index 275ccc90..00000000
--- a/.llm/exports/opencode/skills/linear-db-migrations/SKILL.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-name: linear-db-migrations
-description: Canonical linear DB migrations under infra/k8s/base/ops/source/database/linear-migrations, ops bundles, env keys, and runners. Use when adding or changing SQL migrations, K8s DB bootstrap, or scripts/database in this repo.
-version: 1.0.0
----
-
-
-# Linear database migrations (Metaboost)
-
-## When to use
-
-- Adding or changing files under `infra/k8s/base/db/source/`, `infra/k8s/base/ops/`, or `scripts/database/`.
-- Wiring DB credentials in Compose, k3d, or K8s manifests, or in env templates/examples.
-
-## Single source of truth
-
-- **Canonical forward-only SQL:** `infra/k8s/base/ops/source/database/linear-migrations/app/` and `infra/k8s/base/ops/source/database/linear-migrations/management/` (ordered `0001_*.sql`, ...).
-- **Bootstrap init (`docker-entrypoint-initdb.d`):** `infra/k8s/base/db/source/bootstrap/` — shell steps **`0001`** / **`0002`**, generated **`0003_linear_baseline.sql.gz`** and **`0004_seed_linear_migration_history.sql`**, then **`0006_management_grants.sh`**.
-- **Generated bootstrap artifacts:**
-  - `infra/k8s/base/db/source/bootstrap/0003_linear_baseline.sql.gz`
-  - `infra/k8s/base/db/source/bootstrap/0004_seed_linear_migration_history.sql`
-  - Generated by scripts under `scripts/database/`; do not hand-edit.
-
-## Runner and validation
-
-- Apply migrations: `bash scripts/database/run-linear-migrations.sh --database app|management` (always pass `--database`; there is no default).
-- K8s wrapper: `bash scripts/database/run-linear-migrations-k8s.sh` (same requirement).
-- Validate: `bash scripts/database/validate-linear-migrations.sh` (and `--check-db` to compare on-disk checksums to `linear_migration_history` when a DB is available).
-- Regenerate baseline artifacts:
-  - `bash scripts/database/generate-linear-baseline.sh`
-  - `bash scripts/database/generate-linear-migration-history-seed.sh`
-- Verify generated artifacts are committed and up to date:
-  - `bash scripts/database/verify-linear-baseline.sh`
-- The migration runner **creates** the `linear_migration_history` table if missing; do not rely on a dedicated SQL file for that.
-
-## Ops bundle (cache busting)
-
-- `infra/k8s/base/ops/kustomization.yaml` must list every `.sql` file under the app and management `source` directories so the ops jobs ConfigMaps stay in sync.
-- Kustomize may load paths outside the ops directory; when building, use e.g. `kubectl kustomize infra/k8s/base/ops --load-restrictor LoadRestrictionsNone`.
-
-## Environment keys (admin vs image)
-
-- **Authoritative in secrets and generated env:** `DB_APP_ADMIN_USER` / `DB_APP_ADMIN_PASSWORD`, `DB_MANAGEMENT_ADMIN_USER` / `DB_MANAGEMENT_ADMIN_PASSWORD`, plus read-only and read-write keys and `DB_APP_NAME` / `DB_MANAGEMENT_NAME` (see `infra/config/env-templates/db.env.example` and local `infra/config/local/db.env` after `scripts/local-env/setup.sh`).
-- The **postgres** container image still reads `POSTGRES_USER` / `POSTGRES_PASSWORD` / `POSTGRES_DB` at runtime—**map** those from the `DB_*_ADMIN_*` and `DB_APP_NAME` keys in Compose or Deployment `env`, not the reverse.
-
-## Cross-repo invariants
-
-- Canonical forward-only trees under `infra/k8s/base/ops/source/database/linear-migrations/`.
-- Generated bootstrap baseline artifacts `0003` and `0004` are machine-derived and committed.
-- Same npm script naming model in root `package.json` (`db:migrate:linear:*`, `db:validate:linear`, etc.). Product-specific naming differences are expected.
-
-## Documentation
-
-- [docs/development/DB-MIGRATIONS.md](../../../docs/development/DB-MIGRATIONS.md) – full runbook and contracts.
-
-## Related skills
-
-- [database-schema-naming](../database-schema-naming/SKILL.md) – snake_case schema rules.
-- [argocd-gitops-push](../argocd-gitops-push/SKILL.md) – push reminder when k8s paths change.
-- [generate-data-sync](../generate-data-sync/SKILL.md) – seeders when schema changes.
diff --git a/.llm/exports/opencode/skills/llm-cursor-source/SKILL.md b/.llm/exports/opencode/skills/llm-cursor-source/SKILL.md
deleted file mode 100644
index 9920231c..00000000
--- a/.llm/exports/opencode/skills/llm-cursor-source/SKILL.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-name: llm-cursor-source
-description: Repository source of truth for AI editor guidance is under .cursor, .cursorrules, and .cursorignore. Use when adding, editing, or deleting skills, rules, .cursorrules, or .cursorignore.
----
-
-
-# LLM / Cursor source of truth
-
-## What to commit
-
-Only these paths define shared guidance for this repo:
-
-- `.llm/exports/opencode/skills/**`
-- `.llm/exports/opencode/instructions/**`
-- `.cursorrules` (repo root)
-- `.cursorignore` (repo root) — path-level ignores for Cursor and some tooling
-
-Do not commit ad-hoc skill/rule trees under `.github/`. **Machine export trees** under [`.llm/exports/`](../../../.llm/exports/) (per-target, allowlisted; see [EXPORT-TARGETS.md](../../../docs/development/llm/EXPORT-TARGETS.md)) are **not** a default write target for humans or for agents: **llm-exports-sync** and **llm-exports-full-sync** in GitHub Actions are the **canonical** producers; they open/update PRs on branches **`llm`** and **`llm-full`**. `npm run llm:exports:sync` is **gated** outside CI (`LLM_EXPORT_ALLOW_LOCAL=1` is required to write locally, for [scripts/llm/](../../../scripts/llm/) work only). Generated content is **`.gitignore`d**; **`.llm/exports/`** is in **`.cursorignore`** for Cursor. Do not commit or hand-edit generated `skills/`, `instructions/`, or `*-instructions.md` in feature PRs. See [`.llm/exports/LLM-EXPORTS.md`](../../../.llm/exports/LLM-EXPORTS.md) and the **`llm-exports-ci`** rule.
-
-## Other LLM editors
-
-Start from [`.llm/exports/`](../../../.llm/exports/) after pulling the latest **develop** (or checking the current **`llm` → `develop`** automation PR) when your tool can use repo paths. If you still need a one-off pass, use:
-
-- [docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md](../../../docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md)
-
-Overview and policy:
-
-- [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](../../../docs/development/llm/DOCS-DEVELOPMENT-LLM.md)
-
-## When .cursor changes
-
-- Edit skills, rules, `.cursorrules`, and (when needed) `.cursorignore`, and commit them like any other source.
-- **Do not** run a local LLM export sync to “refresh” exports, and do not commit or push changes under the generated parts of **`.llm/exports`**. After your work lands on **develop**, automation updates branch **`llm`** and its PR. Pull **develop** once that PR is merged, or follow the open **`llm` → `develop`** PR. Re-run the alignment prompt only if you use tooling that is not fully covered by the opt-in export targets.
-
-## Skill file hygiene
-
-- Skill frontmatter `name` should match the skill folder name.
-- Keep exactly one blank line between closing frontmatter (`---`) and body content.
-
-## Export / sync implementation
-
-When you change the deterministic export (files under `scripts/llm/`), use the **llm-exports-scripts** skill. **Podverse and Metaboost** share the same pipeline shape; keep the mirrored `scripts/llm/**` files aligned when behavior should match.
-
-Local vendor setup is opt-in via `npm run llm:vendors` (default active vendor: `cursor`).
diff --git a/.llm/exports/opencode/skills/llm-exports-scripts/SKILL.md b/.llm/exports/opencode/skills/llm-exports-scripts/SKILL.md
deleted file mode 100644
index 9b9710f3..00000000
--- a/.llm/exports/opencode/skills/llm-exports-scripts/SKILL.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-name: llm-exports-scripts
-description: Conventions for scripts/llm (deterministic .cursor exports). Use when editing export-from-cursor, copilot-adapter, github-style-adapter, opencode-adapter, vendor-*, allowed-targets, or guard-exports.
----
-
-
-# LLM export scripts (`scripts/llm/**`)
-
-## When to use
-
-Use this skill whenever you add or change files under `scripts/llm/` (import/export pipeline, adapters, local vendor config/CLI, export guard, allowlists).
-
-**Policy and source of truth** live in the **llm-cursor-source** skill. **Per-target output** (what each adapter produces) is documented in [docs/development/llm/EXPORT-TARGETS.md](../../../docs/development/llm/EXPORT-TARGETS.md). **Podverse and Metaboost** share the same pipeline shape; keep the mirrored scripts aligned when behavior should match.
-
-Allowlisted **export target** ids: `github-copilot`, `opencode` (see `allowed-targets.mjs`); each opt-in target has a marker under `.llm/exports/<id>/`. The `github-copilot` tree is the single portable mirror (no separate `vscode` target).
-
-**CI:** the **`llm-exports-sync`** and **`llm-exports-full-sync`** GitHub Actions run `node scripts/llm/export-from-cursor.mjs sync` (with `--full` for full) on the runner. **Local** `sync` and `check` that write to disk are **disabled** unless `CI` is set (e.g. GitHub Actions) or you set `LLM_EXPORT_ALLOW_LOCAL=1` for pipeline debugging and tests of `scripts/llm/`. Set that env when you need to run `npm run llm:exports:sync` or `llm:exports:sync:full` outside CI.
-
-## Console and CLI output
-
-- Do **not** use `console.log`, `console.info`, or `console.debug`.
-- Use `console.warn` for non-fatal progress or informational messages, `console.error` for failures.
-- For interactive CLIs, you may use a small helper that writes with `process.stdout.write` (see `vendor-selector.mjs` `out()`).
-
-## After edits
-
-From repo root:
-
-```bash
-npx eslint "scripts/llm/**/*.mjs"
-```
-
-In Metaboost, if import order needs fixing: `npx eslint "scripts/llm/**/*.mjs" --fix`
diff --git a/.llm/exports/opencode/skills/llm-history/SKILL.md b/.llm/exports/opencode/skills/llm-history/SKILL.md
deleted file mode 100644
index a16a89e1..00000000
--- a/.llm/exports/opencode/skills/llm-history/SKILL.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-name: llm-history
-description: LLM history tracking guidelines. Use when updating history files or starting new feature work.
-version: 1.0.0
----
-
-
-# LLM History Tracking
-
-This skill provides guidelines for maintaining LLM development history in the Metaboost repo. The Cursor rule `llm-history-tracking.mdc` is the always-applied requirement.
-
-## Critical Rule: 10-Session Maximum Per File
-
-**Each history file must contain at most 10 sessions.** When session 11 needs to be added, the file must be split.
-
-## File Location Pattern
-
-```
-.llm/history/active/[feature-name]/
-  [feature-name]-part-01.md      # Sessions 1-10 (always start with part-01)
-  [feature-name]-part-02.md      # Sessions 11-20
-```
-
-**Always use the `-part-01` suffix from the beginning, even for the first file.**
-
-## When to Split
-
-When a history file has 10 sessions and you need to add session 11: create a new file with `-part-02` suffix and add session 11 there. Session numbers are continuous across parts (never reset).
-
-## Session Entry Format
-
-```markdown
-### Session N - YYYY-MM-DD
-
-#### Prompt (Developer)
-
-[Exact verbatim user prompt - never summarize]
-
-#### Key Decisions
-
-- Decision 1
-
-#### Files Modified
-
-- path/to/file.ts
-```
-
-## Prompt Source Labels
-
-- **`#### Prompt (Developer)`** - Manually typed by user
-- **`#### Prompt (Agent)`** - System-generated (e.g., clicking "Build" on a plan)
-
-## When to Update History
-
-Update when modifying code, config, docs, or plans. Skip for pure Q&A with no file changes.
-
-## Required sequence
-
-1. Record the prompt first in the active history file (verbatim text, correct prompt source label).
-2. Make the file changes.
-3. Finalize the same session entry with key decisions and files modified.
-
-This skill is the canonical source for history timing and entry format.
-
-## Response Ending
-
-End file-modifying responses with:
-
-**LLM History**: Updated .llm/history/active/[feature]/[file].md (Session N)
-
-## See Also
-
-- `.llm/exports/opencode/instructions/llm-history-tracking.instructions.md` - Cursor rule with glob triggers
-- `.llm/LLM.md` - Complete history system documentation
diff --git a/.llm/exports/opencode/skills/local-docker-k3d-alignment/SKILL.md b/.llm/exports/opencode/skills/local-docker-k3d-alignment/SKILL.md
deleted file mode 100644
index 2bae1341..00000000
--- a/.llm/exports/opencode/skills/local-docker-k3d-alignment/SKILL.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-name: local-docker-k3d-alignment
-description: When adding or changing preconditions, cleanup steps, or env usage for local Docker Compose or local k3d, keep both in sync where they share resources (e.g. infra/config/local/*.env).
----
-
-
-# Local Docker vs k3d alignment
-
-## When to use
-
-When modifying Makefile targets or scripts that:
-
-- Start or stop local Docker Compose services or the local k3d cluster
-- Read or write `infra/config/local/*.env` (generated by `scripts/local-env/setup.sh` from canonical templates and overrides)
-- Check for “running” state before running env clean, setup, or reset
-
-## Rule
-
-Keep Docker and k3d local behavior aligned where they share resources (e.g. env files). If a target aborts when Docker containers are running, consider aborting when the k3d cluster is running when the same env files are in use. Full teardown / clean targets should also tear down the k3d cluster, not only Docker.
-
-**Commands that should consider k3d:** (1) **Guards**: any target that refuses to run while Docker is up and touches shared env (e.g. `local_env_clean`) should also refuse while k3d is up. (2) **Teardown**: any "clean" or "full teardown" target (e.g. `local_clean`) should run `local_k3d_down` so both Docker and k3d are stopped. (3) **Docs**: where local env or k3d is described, note shared env and that `local_clean` tears down both.
-
-## Do
-
-- **`infra/config/local/*-sidecar.env`** vs **`apps/*/sidecar/.env`**: **`local_env_setup`** generates **both** with **`merge-env`**: infra files use **`--profile local_docker`** (Compose **`env_file`**); app **`sidecar/.env`** files use **`--profile dev`** (host npm). They are independent outputs, not copies; do not assume byte parity.
-- Guard `local_env_clean` on both Docker Compose containers and the k3d cluster; document that both use `infra/config/local/*.env` (Postgres: single `db.env`; Valkey: `valkey-source-only.env`, `valkey.env`).
-- Include k3d in "full teardown" targets: `local_clean` should run `local_k3d_down` so Docker, k3d, and test/E2E are all torn down.
-- When adding a precondition or cleanup step that touches `infra/config/local/*.env` or “running” state, apply the same logic to both Docker and k3d (or document why they differ).
-
-## Don't
-
-- Don’t add Docker-only or k3d-only guards for shared env without considering the other (e.g. cleaning env while k3d is up leaves the cluster with stale secrets).
-
-## Examples
-
-- **local_env_clean**: Aborts if Metaboost local containers are running (`make local_down`) and also if the k3d cluster is running (`make local_k3d_down`).
-- **local_clean**: Full teardown runs `local_down`, `local_down_volumes`, `local_k3d_down` (idempotent if cluster is gone), and `test_clean` so both Docker and k3d are stopped.
-- **Docs**: `local_env_setup` and `local_k3d_up` both consume `infra/config/local/*.env`; mention this where describing local env or k3d setup. Document that `make local_clean` tears down k3d as well as Docker.
diff --git a/.llm/exports/opencode/skills/management-edit-breadcrumbs/SKILL.md b/.llm/exports/opencode/skills/management-edit-breadcrumbs/SKILL.md
deleted file mode 100644
index 67a3dd8e..00000000
--- a/.llm/exports/opencode/skills/management-edit-breadcrumbs/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: management-edit-breadcrumbs
-description: New and Edit pages in management-web should use breadcrumbs so users can see where they are and navigate back.
----
-
-
-# Management-web New/Edit page breadcrumbs
-
-**When to use:** When adding or changing New or Edit pages in management-web (e.g. new resource pages, edit resource pages).
-
-## Rule
-
-Every New and Edit page should show **breadcrumbs** so users can see their position in the hierarchy and navigate back:
-
-- Wrap the page content in `ContentPageLayout` from `@metaboost/ui` with a `breadcrumbs` prop.
-- Build `BreadcrumbItem[]`: list route (link) → optional view/resource link → current page label (no `href` for last item).
-- Use `Breadcrumbs` and `Link` from `@metaboost/ui`; pass a `LinkComponent` that wraps `Link` (e.g. a small `BreadcrumbLink` that forwards `href`, `children`, `className`).
-- Set `contentMaxWidth="form"` on `ContentPageLayout` for form pages.
-
-## Hierarchy examples
-
-- **Admins:** Admins (link) → Add admin | Edit: [name] (current).
-- **Users:** Users (link) → Add user | [Name] (link) → Edit (current).
-- **Buckets:** Buckets (link) → Add bucket (current).
-- **Bucket message edit:** [Ancestor buckets] → Bucket name (link) → Edit (current). Fetch bucket and ancestry to build items.
-
-## References
-
-- User edit: `apps/management-web/src/app/(main)/user/[id]/edit/page.tsx`
-- Admins new, admin edit, users new, buckets new: same pattern in respective `page.tsx` files.
-- Bucket message edit: `apps/management-web/src/app/(main)/bucket/[id]/messages/[messageId]/edit/page.tsx` (fetches bucket + ancestry for breadcrumbs).
-- Bucket settings (admins/roles edit) already have breadcrumbs via `BucketSettingsLayoutClient`.
diff --git a/.llm/exports/opencode/skills/management-edit-page-tabs/SKILL.md b/.llm/exports/opencode/skills/management-edit-page-tabs/SKILL.md
deleted file mode 100644
index 34fac68d..00000000
--- a/.llm/exports/opencode/skills/management-edit-page-tabs/SKILL.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-name: management-edit-page-tabs
-description: Use a consistent tabbed layout on management-web edit pages when there are multiple distinct forms (e.g. profile vs password).
----
-
-
-# Management-web edit page tabs
-
-**When to use:** When adding or changing edit pages in management-web that have multiple distinct forms (e.g. profile vs change password, or multiple logical sections that could be separate forms).
-
-## Rule
-
-Use a tabbed layout with **one tab per form** (or logical group):
-
-- Use `Tabs` from `@metaboost/ui` with `LinkComponent={Link}` and `exactMatch`.
-- Follow **tab-active-state-url-match** for canonical tab href / `activeHref` behavior.
-- Use `?tab=...` in the URL and a route helper (e.g. `userEditRoute(id, tab)`) so the active tab matches with and without query params.
-- Default tab = first tab (no param or explicit first tab value).
-
-## References
-
-- Edit User page: Profile / Change password tabs (`apps/management-web/src/app/(main)/user/[id]/edit/`, `EditUserPageContent.tsx`, `userEditRoute(id, tab)`).
-- Settings: General / Profile / Password tabs (`apps/management-web/src/app/(main)/settings/SettingsContent.tsx`, `accountSettingsRoute(tab)`).
-
-## Single-form edit pages
-
-Edit pages with a single form (e.g. admin edit, bucket admin edit, role edit, message edit) do not need tabs. If a future edit page gains a second form, apply this pattern.
diff --git a/.llm/exports/opencode/skills/nested-resource-prefix-naming/SKILL.md b/.llm/exports/opencode/skills/nested-resource-prefix-naming/SKILL.md
deleted file mode 100644
index 3fcc57b4..00000000
--- a/.llm/exports/opencode/skills/nested-resource-prefix-naming/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: nested-resource-prefix-naming
-description: Use parent-prefix naming for nested resources so the schema and API make hierarchy explicit (e.g. bucket_messages_crud). Use when adding or naming DB columns, tables, permission fields, API/ORM types, or request/response fields for resources that are children of another resource.
----
-
-
-# Nested resource prefix naming
-
-## Rule
-
-When a resource is **nested under** another (e.g. messages under buckets), **prefix names with the parent** so it's clear in the schema and API that the child belongs to the parent. Do not use a bare child name that could be mistaken for a top-level resource.
-
-## Where this applies
-
-- **DB columns / tables**: e.g. `bucket_messages_crud`; table/column names that represent a child resource should include the parent (e.g. `bucket_message`, `bucket_messages_crud`).
-- **Permission / CRUD bitmasks**: e.g. `bucketMessagesCrud` (camelCase in TS/API), `bucket_messages_crud` (snake_case in DB).
-- **API request/response fields and types**: same prefix in DTOs, schemas, and OpenAPI.
-- **ORM entities and services**: property and type names should reflect the hierarchy (e.g. `bucketMessagesCrud` on `AdminPermissions`).
-
-## Examples
-
-| Context        | Prefer                 | Avoid                                               |
-| -------------- | ---------------------- | --------------------------------------------------- |
-| Permission col | `bucket_messages_crud` | unprefixed child CRUD field                         |
-| TS/API field   | `bucketMessagesCrud`   | unprefixed child CRUD field                         |
-| Label in UI    | "Bucket Messages CRUD" | "Messages CRUD" (when listing permissions globally) |
-
-On **pages that are already under the parent** (e.g. bucket messages list/edit), the breadcrumb provides context so a short label like "Messages" is fine; the **schema and permission names** should still use the prefix everywhere.
-
-## Why
-
-Bare unprefixed names suggest a top-level "messages" resource. Prefixing with `bucket_` makes it obvious that these are bucket-scoped messages and keeps the schema self-documenting and consistent as more nested resources are added.
diff --git a/.llm/exports/opencode/skills/npm-audit/SKILL.md b/.llm/exports/opencode/skills/npm-audit/SKILL.md
deleted file mode 100644
index d99a4ebb..00000000
--- a/.llm/exports/opencode/skills/npm-audit/SKILL.md
+++ /dev/null
@@ -1,223 +0,0 @@
----
-name: npm-audit
-description: Investigate and decide on npm audit vulnerabilities—fix vs. allowlist pattern with shared gate utility
-version: 1.0.0
----
-
-
-# Handling NPM Audit Vulnerabilities
-
-## When to Use This Skill
-
-Use this skill when:
-
-- `npm audit --omit=dev --audit-level=moderate` is failing in the release gate or CI
-- You need to investigate why an npm override is not resolving a transitive dependency
-- You need to decide between fixing a vulnerability vs. allowlisting it
-- A PR proposes changes to `package.json` overrides or audit allowlists
-
-## ⚠️ CRITICAL: Allowlist Consistency Across All Release Scripts
-
-**When you add an advisory ID to the allowlist, you must update it in ONLY ONE place:**
-
-**`scripts/lib/check-audit-gate.sh`** — the shared audit gate utility used by all release scripts.
-
-This shared utility is called by:
-
-- `scripts/publish/bump-version.sh`
-- `scripts/publish/sync-develop-to-staging.sh` (passes allowlist as argument)
-- `scripts/publish/sync-staging-to-main.sh` (passes allowlist as argument; RTM: fast-forward `main` from `staging` only)
-
-When you update the allowlist:
-
-1. **Do NOT** manually update each script individually
-2. **Do** edit the `ALLOWED_AUDIT_IDS` variable in the script that calls the utility (e.g., bump-version.sh passes it as an argument to the shared utility)
-3. All sync scripts receive the same allowlist from their hardcoded argument to the shared utility
-
-**If you see allowlist values in multiple sync scripts:** That's the correct pattern. Each script passes its repo's allowlist to the shared utility. They will update atomically if the shared utility changes.
-
-## Investigation Process
-
-### Step 1: Understand the Vulnerability
-
-```bash
-npm audit --omit=dev --json > temp/audit-report.json
-node --input-type=module -e "
-  import fs from 'fs';
-  const audit = JSON.parse(fs.readFileSync('temp/audit-report.json', 'utf8'));
-  for (const [pkg, data] of Object.entries(audit.vulnerabilities || {})) {
-    if (Array.isArray(data.via)) {
-      for (const adv of data.via) {
-        if (typeof adv === 'object') {
-          console.log(\`\${pkg}: \${adv.severity} - \${adv.title} (Advisory \${adv.source})\`);
-          console.log(\`  URL: \${adv.url}\`);
-          console.log(\`  Via: \${data.via}\`);
-        }
-      }
-    }
-  }
-"
-```
-
-This shows:
-
-- Affected package name
-- Severity level
-- Advisory ID (source)
-- Direct URL to vulnerability details
-- **Via:** The chain of how this vulnerability reaches your code
-
-### Step 2: Trace the Dependency Chain
-
-For each vulnerability, understand the full path:
-
-```bash
-npm ls <vulnerable-package> --all
-```
-
-Example:
-
-```
-metaboost@1.0.0
-└── (transitive)
-    └── firebase-admin@13.8.0
-        └── @google-cloud/storage@7.19.0
-            └── teeny-request@9.0.0
-                └── uuid@9.0.1 (vulnerable)
-```
-
-### Step 3: Determine Root Cause
-
-**Root cause types:**
-
-1. **Direct dependency outdated**
-   - Package in your `package.json` is not at latest
-   - **Fix:** `npm upgrade <package>`
-
-2. **Transitive dependency in resolvable chain**
-   - Intermediate package has a recent version that upgrades the vulnerable dep
-   - **Fix:** Upgrade the intermediate package, then re-audit
-   - **Example:** firebase-admin@14.x might pull @google-cloud/storage@8.x which uses teeny-request@11.x
-
-3. **Transitive dependency in constrained chain** (most common)
-   - Latest version of intermediate packages still pin the vulnerable dep
-   - **Fix:** Evaluate if npm overrides can force a newer version
-   - **Check:**
-     ```bash
-     # In package.json, try an override like:
-     "overrides": {
-       "uuid": "14.0.0",
-       "teeny-request": {
-         "uuid": "14.0.0"
-       }
-     }
-     ```
-   - **Then:** `npm install` and re-audit
-
-4. **Nested optional dependency bug** (hardest case)
-   - npm's resolver installs optional dependencies into their own node_modules folder
-   - Overrides don't cascade into these nested folders in certain cases
-   - **Symptom:** `package-lock.json` shows `node_modules/teeny-request/node_modules/uuid@9.0.1` even though you have `"uuid": "14.0.0"` in overrides
-   - **Fix:** Either upgrade the parent package OR allowlist the advisory
-
-### Step 4: Decide Fix vs. Allowlist
-
-**Fix if:**
-
-- Direct dependency upgrade resolves it
-- A recent major version of an intermediate package resolves it
-- npm overrides can successfully force the resolution (verify in `package-lock.json`)
-- The vulnerability is directly exploitable in Metaboost's usage
-
-**Allowlist if:**
-
-- Latest mainstream versions of all upstream packages still carry the vulnerability
-- Fixing requires downgrading other critical packages (causes regressions)
-- The vulnerability is transitive-only and low-risk in Metaboost's deployment model
-- A clear path exists to remove the allowlist when upstream packages release fixes
-
-### Step 5: Document the Rationale
-
-If allowlisting, document **why** in a `docs/NPM-AUDIT-ALLOWLIST.md` or equivalent:
-
-```markdown
-### Advisory XXXXX: <vulnerability name>
-
-**Affected chain:** pkg1 → pkg2 → pkg3 → vulnerable-pkg
-
-**Why it's allowlisted:**
-- Latest pkg3@X.Y still pins vulnerable-pkg@<14
-- Downgrading pkg1 causes regressions (list them)
-- Replacing pkg1 would require major refactor (explain scope)
-
-**Risk level:** Transitive-only; not directly exploitable because [reason].
-
-### When to revisit:
-- When pkg1 releases X+1.0.0 with upgraded dependencies
-- When pkg3 releases Y+1.0.0 that drops the vulnerable dep
-```
-
-Then update the release gate:
-
-```bash
-# See docs/NPM-AUDIT-ALLOWLIST.md for rationale
-ALLOWED_AUDIT_IDS="1113977,1116970"
-```
-
-### Step 6: Add to Memory for Revisit
-
-Update `/memories/user/npm-audit-overrides.md` with:
-
-```markdown
-## Tracked Overrides for Removal
-
-- Advisory 1113977 (uuid): Remove when firebase-admin@14.x+ or @google-cloud/storage@8.x+ upgrades teeny-request
-- Advisory 1116970 (@tootallnate/once): Same dependency chain; will resolve when 1113977 resolves
-```
-
-## Common Patterns
-
-### Pattern: npm Overrides Not Cascading
-
-**Symptom:** Root `package.json` has `"uuid": "14.0.0"` override, but `npm audit` still reports uuid@9.0.1 in the output.
-
-**Why:** Optional dependencies get their own node_modules folder, and npm doesn't always apply overrides there.
-
-**Verification:**
-
-```bash
-# Check the lockfile for nested node_modules
-grep -A2 'node_modules/teeny-request/node_modules/uuid' package-lock.json
-```
-
-If you see a nested uuid entry with version < 14, the override didn't work.
-
-**Options:**
-
-1. Try pinning the parent package instead: `"teeny-request": "11.x"`
-2. Force a major version of the upstream: `"@google-cloud/storage": "8.0.0"`
-3. Accept the allowlist if neither works
-
-### Pattern: npm audit fix --force Causes Regressions
-
-**Symptom:** Running `npm audit fix --force` downgrades critical packages like firebase-admin@10.1.0.
-
-**Why:** `--force` prioritizes clearing vulnerabilities over semver compatibility.
-
-**Solution:** **Never use `--force` in monorepos.** Instead, carefully upgrade intermediate packages one at a time and check side effects.
-
-## Checklist Before Committing
-
-- [ ] Investigation documented: vulnerability chain traced and root cause identified
-- [ ] Attempted a fix: either package upgrade or npm override tested in package-lock.json
-- [ ] Verified no regression: `npm run build` succeeds
-- [ ] If allowlisting: documented rationale in appropriate docs file
-- [ ] If allowlisting: updated release gate with link to rationale docs
-- [ ] If allowlisting: added advisory ID to `/memories/user/npm-audit-overrides.md` for future revisit
-- [ ] LLM history updated with investigation results
-
-## See Also
-
-- `docs/` — Check for NPM-AUDIT-ALLOWLIST.md or equivalent
-- Release/publish gate — Audit gate implementation
-- LLM history — Investigation notes
diff --git a/.llm/exports/opencode/skills/password-strength-on-set-update/SKILL.md b/.llm/exports/opencode/skills/password-strength-on-set-update/SKILL.md
deleted file mode 100644
index 3af60425..00000000
--- a/.llm/exports/opencode/skills/password-strength-on-set-update/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: password-strength-on-set-update
-description: On every page where a password can be set or updated, include the PasswordStrengthMeter component.
----
-
-
-# Password strength on set/update
-
-**When to use:** When adding or changing any form or page where a user can set a new password or update their password (signup, create user, create admin, change password, reset password, etc.).
-
-## Rule
-
-Include the **PasswordStrengthMeter** component (from `@metaboost/ui`) on every page where a password can be set or updated:
-
-- Place it directly after the **new password** input field (the field that is being set or changed). For "change password" flows with current + new + confirm, the meter goes after the new-password field and before the confirm field.
-- Pass the current value of the new-password field: `<PasswordStrengthMeter password={newPassword} />`.
-- **Always render the meter** (do not condition on `password !== ''`). When empty, the component still shows requirements and an empty bar so the user sees it is present; when they type, the strength updates. Hiding the meter when the field is empty makes the page look like it has no strength indicator.
-
-## Where it applies
-
-- **Signup / create account:** After the password (or main password) field.
-- **Create user (management):** UserForm create mode — after password input.
-- **Edit user – change password:** UserForm edit mode — after new password input.
-- **Create admin (management):** AdminForm — after password input.
-- **Edit admin – change password:** AdminForm edit mode — after password input (when shown).
-- **Settings – change password:** Management-web SettingsContent and web SettingsPageContent — after new password input.
-- **Reset password:** ResetPasswordForm — after new password input (already present in UI package).
-
-## References
-
-- Component: `packages/ui/src/components/form/PasswordStrengthMeter/`
-- Examples: `UserForm.tsx`, `AdminForm.tsx`, `SignupForm.tsx`, `ResetPasswordForm.tsx`, `SettingsContent.tsx`, `SettingsPageContent.tsx`.
diff --git a/.llm/exports/opencode/skills/path-casing-imports/SKILL.md b/.llm/exports/opencode/skills/path-casing-imports/SKILL.md
deleted file mode 100644
index 197f9fa4..00000000
--- a/.llm/exports/opencode/skills/path-casing-imports/SKILL.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-name: path-casing-imports
-description: Keep import path casing identical to file/directory names so builds pass on Linux and in CI. Use when adding or changing relative imports, or when CI fails with "Cannot find module" for paths that work locally.
-version: 1.0.0
----
-
-
-# Path Casing in Imports
-
-## Why it matters
-
-- **Linux and CI** (e.g. GitHub Actions) use **case-sensitive** filesystems. Imports like `'./components/form/Button'` fail if the directory is actually `Form` (uppercase).
-- **macOS** often uses a case-insensitive default FS, so `form` and `Form` can both resolve locally while CI fails with "Cannot find module ... or its corresponding type declarations."
-- Fix: use the **exact casing** of every path segment (folders and files) as stored in the repo.
-
-## What to do
-
-1. **When adding or changing relative imports:** Check the real path casing (e.g. `git ls-tree -r --name-only HEAD -- <path>` or the IDE file tree) and use that exact casing in the import string.
-2. **When CI fails with module-not-found for a path that works locally:** Treat it as a casing mismatch. Find the actual path (e.g. `git ls-tree` under the package), then update the import to match (e.g. `form/` → `Form/` or vice versa to match the tree). Do **not** rename files/dirs unless the team agrees; prefer updating the imports to match existing names.
-3. **When creating new directories/files:** Prefer a single convention and use that same casing in all imports. In this repo, **component directories** under `packages/ui/src/components/` use **lowercase** (e.g. `form`, `bucket`, `layout`, `modal`, `navigation`, `table`).
-
-## Reference
-
-- Cursor rule: **.llm/exports/opencode/instructions/path-casing-imports.instructions.md**
-- This skill: **.llm/exports/opencode/skills/path-casing-imports/SKILL.md**
diff --git a/.llm/exports/opencode/skills/plan-files-convention/SKILL.md b/.llm/exports/opencode/skills/plan-files-convention/SKILL.md
deleted file mode 100644
index 2a46546f..00000000
--- a/.llm/exports/opencode/skills/plan-files-convention/SKILL.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-name: plan-files-convention
-description: Where and how to save LLM plan files locally. Use when creating, saving, or completing plan sets (e.g. multi-phase plans). Aligns with Podverse monorepo convention.
-version: 1.1.0
----
-
-
-# Plan Files Convention
-
-This skill describes how to save plan files locally in the Metaboost repo, following the same convention as the Podverse monorepo.
-
-## When Asked to Create a Plan That Is Too Big for One Pass
-
-If the user asks you to create a plan and the plan is **too large to implement in a single pass**:
-
-1. **First goal**: Treat the deliverable as **creating detailed plan files and saving them locally**. Do not attempt to implement the full plan in one go.
-2. **Produce and save**:
-   - A plan-set directory under `.llm/plans/active/[plan-set-name]/`
-   - `00-EXECUTION-ORDER.md`, `00-SUMMARY.md`, numbered plan files (e.g. `01-topic.md` …), and `COPY-PASTA.md` as described below.
-3. **After the plan files exist**: The user will use the **COPY-PASTA.md** (copy-pasta doc) to ask you to implement the plans—typically **one after another**, or **in parallel** when the execution order doc says it is safe (e.g. within a phase marked as parallel). Do not start implementation until the user requests it via those prompts.
-4. When the user pastes a prompt from COPY-PASTA.md, execute that plan immediately (see parallel-plan-execution skill for copy-pasta behavior).
-
-## Where to Save Plans
-
-- **Active plans**: `.llm/plans/active/[plan-set-name]/`
-- **Completed plans**: `.llm/plans/completed/[plan-set-name]/` (move here when the plan set is done)
-
-Use a short, kebab-case name for the set (e.g. `metaboost`, `web-runtime-config-endpoint`).
-
-## Standard File Layout (Active Set)
-
-Inside the plan-set directory, use:
-
-- **00-EXECUTION-ORDER.md** – Phase order, parallel groups, and pointers to each numbered plan.
-- **00-SUMMARY.md** – Scope summary, list of plan files, dependency map, and recorded decisions.
-- **01-topic.md** … **NN-topic.md** – One markdown file per topic (e.g. `01-infra-directory.md`, `09-gitflow-test.md`). Each has: Scope, Steps, Key files, Verification.
-- **COPY-PASTA.md** – Copy-paste prompts for parallel agents, referencing the numbered plans.
-
-During **plan creation**, do not modify product code or test files. For plans that touch **api** or **management-api**, include explicit integration-test steps (see api-testing). For plans that touch **web** or **management-web**, include explicit E2E-test steps (see e2e-page-tests).
-
-Plans stay under ~300 lines each; split into part files (e.g. `22-part-1-dashboard.md`) if a topic grows.
-
-## How to use COPY-PASTA (execution order)
-
-- **Phases are sequential.** Do not start Phase N+1 until Phase N is fully complete.
-- **Within a phase,** steps can be sequential or parallel. When the doc says "run A, then B,
-  then C and D in parallel" it means: run A → **wait for A to finish** → run B → **wait for
-  B to finish** → then run C and D in parallel (e.g. two agents); **wait for both C and D**
-  before starting the next phase. Only start "in parallel" work after all prior steps in
-  that phase have completed.
-- For each step or parallel group, wait for completion before starting the next step or
-  phase.
-
-## When Creating a New Plan Set
-
-1. Create the directory: `.llm/plans/active/[plan-set-name]/`.
-2. Add 00-EXECUTION-ORDER.md and 00-SUMMARY.md first.
-3. Add one file per topic (01, 02, …) with scope, steps, key files, verification.
-4. Add COPY-PASTA.md with copy-paste prompts that **reference** the numbered plan files (so the user can request implementation one-by-one or in parallel as allowed by the execution order).
-5. **Stop when the plan files are saved.** Do not implement product code or test files in this pass. Implementation happens when the user uses COPY-PASTA.md to ask you to execute each plan (sequentially or in parallel per the execution order).
-
-## When a Plan Set Is Complete
-
-1. Move the entire directory from `active/` to `completed/`:  
-   `mv .llm/plans/active/[plan-set-name] .llm/plans/completed/`
-2. Update any cross-references (e.g. 00-master-plan or README) if needed.
-
-## Reference
-
-- Podverse: `.llm/plans/active/` and `.llm/plans/completed/`; see e.g. `podverse/.llm/plans/completed/web-runtime-config-endpoint/` for layout.
-- Metaboost: active plan sets live in topic-specific directories under `.llm/plans/active/`
-  (e.g. `web-dashboard/`, `documentation-diagrams/`, `git-hooks/`, `jenkins-local/`,
-  `deployment-installer-roadmap/`). Index: `.llm/plans/active/metaboost/00-overview.md`.
-  Completed: `.llm/plans/completed/metaboost/`, `.llm/plans/completed/metaboost-k3s/`.
diff --git a/.llm/exports/opencode/skills/prefer-named-exports/SKILL.md b/.llm/exports/opencode/skills/prefer-named-exports/SKILL.md
deleted file mode 100644
index 8ca9de68..00000000
--- a/.llm/exports/opencode/skills/prefer-named-exports/SKILL.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-name: prefer-named-exports
-description: >-
-  Prefer named exports in TypeScript/ESM modules; avoid default exports when a named export
-  is sufficient. Use in Metaboost and Podverse when adding or editing modules, API routes, worker
-  commands, packages, and app code. Framework-required defaults are the exception.
-version: 1.0.0
----
-
-
-# Prefer named exports
-
-## When to use
-
-- Creating or changing `.ts` / `.tsx` modules, `packages/*`, and app code in this monorepo.
-- Refactoring imports; choosing export style for a new function, component, or command.
-
-## Rules
-
-- **Prefer** `export function name`, `export const name`, and `export type` / `export { x }` so names stay stable at import sites and refactors are easier to trace.
-- **Avoid** `export default` for ordinary modules when there is a single main export: use a **named** export with a clear, stable name.
-
-## Exceptions (defaults are fine)
-
-- **Next.js (App Router)**: `page.tsx`, `layout.tsx`, and similar files that the framework **requires** as the default export.
-- **Stricter framework contracts**: e.g. Storybook or tooling that only accepts `export default` (prefer named exports in the same file for everything else, or a thin default wrapper that re-exports a named symbol).
-- **Generated or third-party patterns**: match the existing file’s style when the file is not yours to own.
-
-## Imports
-
-- Use `import { foo } from './bar.js'`, not `import foo from './bar.js'`, for named exports.
-- Re-exporting: `export { foo } from './bar.js'` in barrels instead of re-exporting a default with an alias, when possible.
-
-## Related
-
-- ESM: `.js` extension in import paths (see repo `tsconfig` / `.cursorrules` stack notes). The Podverse monorepo has the same skill for cross-repo consistency.
diff --git a/.llm/exports/opencode/skills/release-changelog/SKILL.md b/.llm/exports/opencode/skills/release-changelog/SKILL.md
deleted file mode 100644
index 73b385b1..00000000
--- a/.llm/exports/opencode/skills/release-changelog/SKILL.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-name: release-changelog
-description: "Use version-first changelog files (docs/development/CHANGELOGS/X.Y.Z.md): bump version at start of work and write release notes continuously for staging and main releases."
----
-
-
-# Release changelog (Metaboost)
-
-## When to use
-
-When you ship or finish work that is **worth calling out** in preprod/prod release notes: behavior changes, new surfaces, important fixes, or ops-impacting updates—not every internal cleanup.
-
-## What to update
-
-- Use [docs/development/CHANGELOGS/X.Y.Z.md](../../docs/development/CHANGELOGS/) where `X.Y.Z` is the current base version in `package.json`.
-- Bump version **at the start of work** with `scripts/publish/bump-version.sh` so `docs/development/CHANGELOGS/X.Y.Z.md` exists before implementation.
-- Keep updating that same semver file continuously as work lands.
-
-## Conventions
-
-1. **Order** — **Most important first** (safety, security, data, then big features, then smaller fixes; skip low-signal items).
-2. **Wording** — Short, clear lines; link issues/PRs if useful.
-3. **Single source** — Staging prereleases and main production releases both read the same `X.Y.Z.md` file.
-4. **Brevity** — Concise, not a duplicate of git log.
-
-## Naming in CI
-
-- Git branch **`staging`** runs **Publish (staging)**: **`X.Y.Z-staging.N`** and float **`staging`** in GHCR. Cluster “alpha” in GitOps (path/namespace) is separate.
-- Pushes to **`main`** run **Publish (main)**: promote to RTM **`X.Y.Z`** and **`:latest`**.
-
-## Related
-
-- [PUBLISH.md](../../PUBLISH.md) — full publish flow, Git tag, and GitOps pins.
diff --git a/.llm/exports/opencode/skills/response-ending-make-verify/SKILL.md b/.llm/exports/opencode/skills/response-ending-make-verify/SKILL.md
deleted file mode 100644
index 2d962066..00000000
--- a/.llm/exports/opencode/skills/response-ending-make-verify/SKILL.md
+++ /dev/null
@@ -1,77 +0,0 @@
----
-name: response-ending-make-verify
-description: End implementation responses with scoped make-based screenshot report commands for web and management-web verification.
-version: 1.4.0
----
-
-
-# Response-Ending Make Verification
-
-The Cursor rule `end-with-targeted-make-report-verify` enforces this behavior; this skill is the extended reference (command tree, API gate, multi-spec).
-
-Use this skill when answering implementation requests in this repo.
-
-## Do not run tests during agent or plan work
-
-- **Never run test or verification commands** (e.g. `make e2e_test_web`, `npm run test`, `make e2e_test_web_signup_enabled`) as part of your agent or plan implementation work.
-- **Only instruct the user** to run those commands after your work is done. Provide the exact command(s) in a fenced `bash` block so the user can copy and run them.
-- This keeps agent sessions fast, avoids flaky runs in automation, and leaves verification to the user in their environment.
-
-## Required response behavior
-
-1. Give the user a runnable make command they can copy and run to verify the change; include it in a fenced `bash` code block at the end of the response.
-2. End every implementation response with one or more runnable `make` commands.
-3. Do not suggest direct Playwright execution (`npx playwright test ...` or `npm run test:e2e -w ...`) for standard E2E verification; use the `make` wrappers so seed/setup is included.
-4. **E2E-affected changes (mandatory):** If the change affects E2E tests in any way (e.g. you modified UI in apps/web or apps/management-web, or you added/edited files under `apps/web/e2e/` or `apps/management-web/e2e/`), you **MUST** end the response with a fenced `bash` block containing the **EXACT** command(s) the user needs to run to E2E-verify that change. No exception. Use the specific spec path(s) that cover the changed behavior (e.g. `make e2e_test_web_report_spec SPEC=e2e/settings-bucket-owner.spec.ts`). This is non-negotiable.
-5. Prefer feature-scoped screenshot report commands over full-suite commands.
-6. Choose the smallest command set that verifies the changed behavior.
-7. Only recommend full-suite report mode when scope is broad or cross-cutting.
-8. Render final verification commands inside a fenced `bash` code block so the UI shows a copy button.
-9. Inside the fenced block, keep one command per line and avoid bullets/backticks.
-
-## Command selection decision tree
-
-- Web-only feature (single page/flow):
-  - `make e2e_test_web_report_spec SPEC=e2e/<web-spec>.spec.ts`
-- Signup-enabled web flows (duplicate email, successful signup redirect):
-  - `make e2e_test_web_signup_enabled`
-- Management-web-only feature (single page/flow):
-  - `make e2e_test_management_web_report_spec SPEC=e2e/<management-spec>.spec.ts`
-- Cross-app feature touching both web and management-web:
-  - `make e2e_test_report_scoped WEB_SPEC=e2e/<web-spec>.spec.ts MGMT_SPEC=e2e/<management-spec>.spec.ts`
-- Lightweight broad smoke check:
-  - `make e2e_test_home_report`
-- Broad regression or pre-deploy confidence (four reports: one per web auth mode + management-web):
-  - `make e2e_test_report`
-
-## API gate: default is no API tests (required)
-
-- **Default (no env var):** E2E commands **do not run** API integration tests. The Makefile default is `E2E_API_GATE_MODE=off`. When you give the user E2E verification commands, **always** give them without `E2E_API_GATE_MODE` so they get the default (skip API tests). This is required for all E2E-only verification.
-- **Only when the change affected API tests:** If you modified API code, integration tests, auth, seed, or backend packages that could affect E2E outcomes, then give the user a command that **includes** API tests by prefixing with `E2E_API_GATE_MODE=on` (e.g. `make E2E_API_GATE_MODE=on e2e_test_web_report_spec SPEC=e2e/...`). Otherwise do **not** add the env var.
-- **Optional:** User can pass `E2E_API_GATE_MODE=on` to run API tests before E2E; `E2E_API_GATE_MODE=auto` to run API tests only when changed files match API-impacting paths.
-
-Examples (E2E-only, no API tests — use these by default):
-
-- `make e2e_test_web_report_spec SPEC=e2e/<web-spec>.spec.ts`
-- `make e2e_test_management_web_report_spec SPEC=e2e/<management-spec>.spec.ts`
-- `make e2e_test_web_admin_only_email_report_spec SPEC=e2e/<spec>.spec.ts`
-
-When API tests are needed (only if change affected API/integration tests):
-
-- `make E2E_API_GATE_MODE=on e2e_test_web_report_spec SPEC=e2e/<web-spec>.spec.ts`
-- `make E2E_API_GATE_MODE=on e2e_test_management_web_report_spec SPEC=e2e/<management-spec>.spec.ts`
-- `make E2E_API_GATE_MODE=on e2e_test_report_scoped WEB_SPEC=... MGMT_SPEC=...`
-
-Multi-spec input:
-
-- `SPEC`, `WEB_SPEC`, and `MGMT_SPEC` support comma-separated values.
-- Example:
-  - `make e2e_test_web_report_spec SPEC=e2e/buckets.spec.ts,e2e/invite.spec.ts`
-  - `make e2e_test_report_scoped WEB_SPEC=e2e/buckets.spec.ts,e2e/bucket-detail.spec.ts MGMT_SPEC=e2e/buckets.spec.ts,e2e/events.spec.ts`
-
-## Notes
-
-- These report-mode targets capture step screenshots and write timestamped HTML reports in `.artifacts/e2e-reports/`.
-- API gate: default is `off` (no API tests). Pass `E2E_API_GATE_MODE=on` to include API integration tests; `E2E_API_GATE_MODE=auto` for conditional run based on changed files.
-- If a response includes non-UI/API-internal work, still end with the nearest relevant verification command and briefly explain why it is the best available check.
-- If a verification command requires interactive input, stop and hand off using the **interactive-prompts** skill.
diff --git a/.llm/exports/opencode/skills/reusable-components/SKILL.md b/.llm/exports/opencode/skills/reusable-components/SKILL.md
deleted file mode 100644
index 8d804e33..00000000
--- a/.llm/exports/opencode/skills/reusable-components/SKILL.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: reusable-components
-description: Prefer reusable components and keep globals minimal. Use when adding layout, form, or UI that could be reused, or when adding styles to globals.scss.
-version: 1.0.0
----
-
-
-# Reusable Components
-
-**When to use:** Any time you are adding layout, form, or UI that could be reused, or when you are about to add styles to `globals.scss` (or app-level global CSS).
-
-## Principles
-
-1. **Prefer reusable components** over one-off markup and global class names. If the same structure or pattern appears on more than one page (or might in the future), extract it into a component.
-2. **Keep globals to a minimum.** Use `globals.scss` only for true app-wide basics (e.g. `html`/`body`, root layout wrappers like `.app-view`). Page- or feature-specific layout and styling belong in component module SCSS or layout components.
-3. **Colocate styles with components.** Use CSS modules (e.g. `ComponentName.module.scss`) for component-specific styles so they are scoped and easy to find.
-
-## Examples
-
-- **Auth form layout:** Use a shared `AuthFormLayout` (or similar) component with its own `.module.scss` instead of auth-specific classes in `globals.scss`.
-- **Repeated page structure:** If multiple pages share a wrapper (e.g. centered card, same padding), create a layout component that accepts `children` and owns the structure and styles.
-
-## Checklist
-
-- Am I adding a class to `globals.scss`? → Consider a reusable component + module SCSS instead.
-- Does this layout/structure appear (or could it appear) on more than one route? → Extract to a component.
diff --git a/.llm/exports/opencode/skills/roles-schema-sync/SKILL.md b/.llm/exports/opencode/skills/roles-schema-sync/SKILL.md
deleted file mode 100644
index e70f2c0e..00000000
--- a/.llm/exports/opencode/skills/roles-schema-sync/SKILL.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-name: roles-schema-sync
-description: When changing DB schema or permission dimensions, consider predefined roles and bucket_role / role-related code.
----
-
-
-# Roles and schema / permission changes
-
-## When to use
-
-When changing **DB schema** (especially permission-related columns or new resource types), or when **adding/removing CRUD dimensions** for bucket admins.
-
-## What to consider
-
-1. **Predefined roles** are defined in code (`packages/helpers/src/bucketRoles/constants.ts`) and may need:
-   - New entries (e.g. a new predefined role id and nameKey).
-   - Updated bitmasks (`bucketCrud`, `bucketMessagesCrud`, `bucketAdminsCrud`) if CRUD semantics change.
-   - i18n keys in apps (e.g. `roles.full`, `roles.noUpdate`) and in management-web/originals.
-
-   Use parent-prefixed names for nested resources (e.g. `bucketMessagesCrud`); see **nested-resource-prefix-naming**.
-
-2. **Custom roles** live in schema tables (`bucket_role`, `management_admin_role`). Adding columns or changing CRUD semantics may require:
-   - Migrations and init SQL updates together (keep both in sync):
-     - Main DB: `infra/k8s/base/db/source/app/0001_app_schema.sql` (canonical)
-     - Management DB: `infra/k8s/base/db/source/management/0001_management_schema.sql` (canonical)
-   - ORM entity and `BucketRoleService` updates.
-   - Management-api schemas (Joi), controller, and OpenAPI updates.
-   - Helpers-requests types and API helpers.
-
-3. **UI** that lists or applies roles (dropdowns, Roles tab, role create/edit forms) may need to:
-   - Reflect new permission dimensions or labels.
-   - Update CrudCheckboxes or role option shapes if CRUD bits change.
-
-## Key files
-
-- Predefined: `packages/helpers/src/bucketRoles/constants.ts`
-- DB (main): `infra/k8s/base/db/source/app/0001_app_schema.sql`
-- DB (management): `infra/k8s/base/db/source/management/0001_management_schema.sql`
-- ORM: `packages/orm` (BucketRole entity, BucketRoleService)
-- API: `apps/management-api` (bucket roles routes, controller, schemas)
-- Client: `packages/helpers-requests` (bucket roles), `packages/ui` (BucketAdminsView, EditBucketAdminForm, BucketSettingsTabs)
diff --git a/.llm/exports/opencode/skills/single-focus-indicator/SKILL.md b/.llm/exports/opencode/skills/single-focus-indicator/SKILL.md
deleted file mode 100644
index d4393eba..00000000
--- a/.llm/exports/opencode/skills/single-focus-indicator/SKILL.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-name: single-focus-indicator
-description: Use exactly one visible focus indicator per focusable element; when using the focus-ring mixin, do not also change border or add a second outline.
-version: 1.0.0
----
-
-
-# Single focus indicator (no double focus)
-
-**When to use:** When adding or changing focus styles on buttons, links, selects, inputs, or any focusable component in `@metaboost/ui` or app code.
-
-## Rule
-
-Use **exactly one** visible focus indicator per focusable element. Do not combine multiple indicators (e.g. outline **and** border-color change, or outline **and** box-shadow) on the same element when focused.
-
-- When using the `focus-ring` mixin (`@include focus-ring` from `packages/ui/src/styles/_mixins.scss`), do **not** also change `border-color` or add a second outline/ring on `:focus` or `:focus-visible`. The mixin already provides an outline; adding a border-color change causes a "double focus" (inner border + outer outline).
-- If you need a custom focus style, use a single mechanism: either the mixin’s outline, or only border, or only box-shadow—not more than one.
-- Keep `outline: none` on `:focus` only to suppress the browser default; then use `:focus-visible` (e.g. via the mixin) for the one visible indicator so keyboard users get a clear ring.
-
-## Checklist
-
-- Does this component set both an outline/ring and a border (or box-shadow) change on focus? If yes, remove one.
-- When using `@include focus-ring`, is there a separate `&:focus { border-color: ... }` (or similar)? If yes, remove the border-color (or other second indicator) so only the focus-ring outline shows.
-- Prefer `:focus-visible` and the shared `focus-ring` mixin for keyboard-visible focus.
diff --git a/.llm/exports/opencode/skills/single-readme/SKILL.md b/.llm/exports/opencode/skills/single-readme/SKILL.md
deleted file mode 100644
index 1d523f07..00000000
--- a/.llm/exports/opencode/skills/single-readme/SKILL.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-name: single-readme
-description: The Metaboost monorepo has exactly one README.md (at repo root). Use when adding index/overview docs or creating new directories so you do not add a second README.
-version: 1.0.0
----
-
-
-# Single README (Metaboost)
-
-The **Metaboost monorepo must have exactly one README.md**, at the **repository root** (`README.md`).
-
-## Do
-
-- Keep the single project README at the repo root.
-- For directory docs use **full-path names** (e.g. `INFRA-K8S.md`, `PACKAGES-UI.md`) per the documentation-conventions skill.
-- The only `INDEX.md` in the repo is `.llm/exports/opencode/skills/INDEX.md`. Plan-set indexes under `.llm/plans/` use `00-overview.md` or `00-master-plan.md`.
-
-## Don't
-
-- Do **not** create `README.md` in any subdirectory (apps, packages, infra, .llm/plans, .cursor/skills, etc.).
-- Do not add a second README or a second INDEX when introducing a new area; use the full-path doc name instead.
-
-## When to use this skill
-
-- Adding new documentation or index files.
-- Creating new directories that need an overview or index.
-- Planning or editing docs under `.llm/`, `infra/`, `packages/`, `apps/`, or `.cursor/`.
diff --git a/.llm/exports/opencode/skills/sort-prefs-cookie-by-path/SKILL.md b/.llm/exports/opencode/skills/sort-prefs-cookie-by-path/SKILL.md
deleted file mode 100644
index aafab310..00000000
--- a/.llm/exports/opencode/skills/sort-prefs-cookie-by-path/SKILL.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-name: sort-prefs-cookie-by-path
-description: Persist list and sort preferences in cookies keyed by path/list id; server reads cookies when URL has no query params; in-app list actions strip the query string and refetch list data via the API with the global async loading overlay (never router.refresh for sort/filter metadata).
----
-
-
-# Sort and list state cookies (Metaboost)
-
-Use this skill when adding or changing sort UI (messages recent/oldest, table sortBy/sortOrder), search, filters, pagination, bucket detail tabs, or other list metadata.
-
-**Policy:** User actions inside the app must **not** leave sort/filter/pagination/tab metadata in the URL after the user changes a control. Persist state in cookies (plus existing sort-prefs keys where applicable). **Direct or bookmarked URLs** may still include `?…`; the server honors those **`searchParams` on that request** when present. On the **first in-app** change to list metadata, **`router.replace(pathname)`** strips all query params for that page; cookies remain the source of truth afterward.
-
-**Loading UX:** List metadata updates (**sort, filter, search, pagination**) must **not** use **`router.refresh()`**. Use **`useCookieModeListRefresh`** with a parent callback that **calls the HTTP API** with cookie-derived query params and **replaces** displayed rows/state with the response, wrapped by **`runAsyncLoad`** via **`useAsyncPageLoading`** so **`NavigationLoadingOverlay`** shows during the request. Omitting the callback makes **`useCookieModeListRefresh`** fall back to **`router.refresh()`** — avoid that whenever a full RSC reload is unnecessary (including **bucket-detail tab switching**: prefer **client `activeTab`** inside **`BucketDetailTabShell`** and optional **`router.push` with `?tab=`** when context is unavailable; tab is **not** persisted in **`bucket_detail_nav`**). It is **not** acceptable for sort/filter list updates on data tables.
-
-## Path-based keys (sort prefs cookie)
-
-- `TABLE_SORT_PREFS_COOKIE_NAME` / `management_table_sort_prefs`: map keys such as `bucket-detail-messages` (`{ sort }`) and `bucket-detail-buckets` (`SortPref`).
-- Same pattern for dashboard/management lists: keys like `dashboard-buckets`, `admins`, `events`, etc.
-
-## Table list state cookie
-
-- **`TABLE_LIST_STATE_COOKIE_NAME`** / **`management_table_list_state`**: JSON map keyed by the same **list key** as sort prefs. Stores optional `search`, `filterColumns`, `page`, and (events) `timelineSort`.
-- Server pages merge **URL params first**, then fall back to this cookie when a param is absent.
-- Client tables pass **`tableListStateCookieName`** + **`sortPrefsListKey`** into `TableWithFilter` / `ResourceTableWithFilter` and **`onListMetadataChange`** so controls write cookies and **client-fetch** list data instead of pushing query strings or doing a full RSC reload.
-
-## Bucket detail navigation cookie
-
-- **`BUCKET_DETAIL_NAV_COOKIE_NAME`** (per app): map keyed by **bucket pathname** (e.g. `/bucket/idText`). Stores optional **`messagesPage`**, **`includeBlockedSenderMessages`** — **not** active tab (tab uses **`searchParams.tab`** when present; default tab is Messages when absent).
-- Tab links share the same pathname. **Bucket detail (web + management-web):** **`BucketDetailTabShell`** uses **`BucketDetailTabNavContext`** for **`selectTab`** (**URL strip** + client **`activeTab`** without tab cookie); fallback tab clicks **`router.push` with `?tab=`**. Post-create redirects attach **`?tab=add-to-rss`** / **`?tab=endpoint`** as needed. When the user opens **Messages** after landing on another tab, the messages panel **client-fetches** if SSR did not load the list.
-
-## Messages sort
-
-- **`MessagesSortSelect`**: `setMessagesSortInCookie` then shared **`onAfterCookieWrite` / list refetch** — the messages list must **refetch messages from the API** (see web messages tab); do not use **`router.refresh()`** for applying the new sort to message rows.
-
-## See also
-
-- **table-sort-defaults** — default sort order by column type.
-- **tables-support-sorting** — ensuring tables support sorting.
diff --git a/.llm/exports/opencode/skills/storybook-component-docs/SKILL.md b/.llm/exports/opencode/skills/storybook-component-docs/SKILL.md
deleted file mode 100644
index ef5145bf..00000000
--- a/.llm/exports/opencode/skills/storybook-component-docs/SKILL.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-name: storybook-component-docs
-description: Add or update Storybook stories when adding or changing UI components in packages/ui. Use when creating or modifying components in @metaboost/ui.
-version: 1.0.0
----
-
-
-# Storybook component docs
-
-**When to use:** When you add a new component to `packages/ui`, or when you change a component’s props, variants, or visible behavior in a way that should be documented or visually verified.
-
-## Principles
-
-1. **Co-locate stories with components.** Add a `ComponentName.stories.tsx` file next to (or in the same directory as) the component.
-2. **Use CSF (Component Story Format).** Default export is `meta` (`Meta<typeof Component>`); named exports are stories (`StoryObj<typeof Component>`).
-3. **Cover main variants and states.** Include at least one default story; add stories for variants (e.g. primary/secondary), loading, disabled, and error states where relevant.
-4. **Expose props as controls.** Use `argTypes` in meta so docs and controls reflect the component’s API.
-
-## How to run Storybook
-
-From repo root (use Nix wrapper in agent/automated environments):
-
-```bash
-./scripts/nix/with-env npm run storybook -w @metaboost/ui
-```
-
-Or from `packages/ui`: `npm run storybook`. Dev server runs at http://localhost:6006.
-
-## Reference
-
-- **Package doc:** [packages/ui/PACKAGES-UI.md](../../../packages/ui/PACKAGES-UI.md) – how to run Storybook, where stories live, how to add a new story.
diff --git a/.llm/exports/opencode/skills/swagger-openapi/SKILL.md b/.llm/exports/opencode/skills/swagger-openapi/SKILL.md
deleted file mode 100644
index 9b8ec498..00000000
--- a/.llm/exports/opencode/skills/swagger-openapi/SKILL.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-name: swagger-openapi
-description: Keep the OpenAPI spec in sync with API endpoints. Use when adding, changing, or removing API routes, request/response bodies, or auth requirements.
----
-
-
-# Swagger / OpenAPI sync
-
-## Rule
-
-**Whenever you change API endpoints**, update the OpenAPI spec so `/api-docs` (Swagger UI) stays accurate and testable.
-
-- **Add a route** → Add the path, method, requestBody, responses, and (if protected) `security: [{ bearerAuth: [] }]` in the spec.
-- **Change request/response shape** → Update the relevant `components.schemas` and path definitions.
-- **Remove or rename a route** → Remove or update the path in the spec.
-- **Change which routes require auth** → Update the path’s `security` array in the spec.
-
-## Where the spec lives
-
-- **Single source**: `apps/api/src/openapi.ts` exports `openApiDocument` (OpenAPI 3.0).
-- **Served at**: `GET /api-docs` via `swagger-ui-express` in `apps/api/src/index.ts`.
-
-## What to keep in sync
-
-- **Paths**: Every public route (e.g. `GET /`, `GET /health`, `GET /auth/me`, `POST /auth/login`, etc.) should have a matching path in `openApiDocument.paths`.
-- **Schemas**: Request bodies and response bodies that have a defined shape should use or define a schema under `components.schemas` and reference with `$ref`.
-- **Security**: Endpoints that use `requireAuth` must have `security: [{ bearerAuth: [] }]` and document 401 responses.
-- **Status codes**: Document the real status codes and (when applicable) response bodies (e.g. 400, 401, 403, 409, 500).
-
-## Checklist when touching the API
-
-After editing any of:
-
-- `apps/api/src/index.ts` (new top-level routes)
-- `apps/api/src/routes/*.ts`
-- `apps/api/src/controllers/*.ts` (if response/request shape changes)
-
-ask: **Did I update `apps/api/src/openapi.ts`?** If not, update it in the same change set.
diff --git a/.llm/exports/opencode/skills/tab-active-state-url-match/SKILL.md b/.llm/exports/opencode/skills/tab-active-state-url-match/SKILL.md
deleted file mode 100644
index c4d83a6a..00000000
--- a/.llm/exports/opencode/skills/tab-active-state-url-match/SKILL.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-name: tab-active-state-url-match
-description: Ensure Tabs active state works with and without URL params by passing the canonical tab href as activeHref, not a URL with extra query params.
-version: 1.0.0
----
-
-
-# Tab active state and URL matching
-
-**When to use:** When adding or changing tab navigation that uses `Tabs` from `@metaboost/ui` with `exactMatch`, or when the tab URL can have query params (e.g. `?tab=messages`, `?sort=oldest`).
-
-This file is the authority for canonical tab href and `activeHref` matching behavior.
-
-## Rule
-
-For the active tab to be highlighted reliably:
-
-1. **Canonical tab href:** Each tab item's `href` should be the canonical URL for that tab (the base URL users land on when they click the tab, e.g. path only or path + minimal params like `?tab=buckets`).
-2. **activeHref must match that href:** When passing `activeHref` to `Tabs`, it must equal the **same** href as the tab item for the current tab. Do **not** pass the full current URL if it includes extra query params (e.g. `sort`, `page`) that are not part of the tab item's href.
-
-Otherwise, with `exactMatch`, `currentHref === item.href` will be false (e.g. `activeHref` is `/bucket/1?tab=messages&sort=oldest` but the Messages tab's href is `/bucket/1`), and no tab will appear active.
-
-## Implementation
-
-- Derive the current tab from the URL (e.g. `searchParams.tab === 'buckets' ? 'buckets' : 'messages'`).
-- Set `activeHref` to the **canonical** href for that tab—the same value as the corresponding item in `items` (e.g. when on messages tab use `bucketViewRoute(id)` or `bucketDetailRoute(id)`, not a URL that includes `&sort=oldest` or `&page=2`).
-
-## Checklist
-
-- Are tab items using canonical hrefs (base URL per tab)?
-- Is `activeHref` set to the canonical href for the current tab (same as the tab item's href), not the full URL with sort/page/other params?
-- When the URL has no tab param, does your default tab match one of the item hrefs (e.g. pathname-only for default tab)?
diff --git a/.llm/exports/opencode/skills/table-sort-defaults/SKILL.md b/.llm/exports/opencode/skills/table-sort-defaults/SKILL.md
deleted file mode 100644
index b46317c8..00000000
--- a/.llm/exports/opencode/skills/table-sort-defaults/SKILL.md
+++ /dev/null
@@ -1,76 +0,0 @@
----
-name: table-sort-defaults
-description: Default sort order by column type for sortable tables; use when adding or changing sortable tables or backend list endpoints.
----
-
-
-# Table Sort Defaults (Metaboost)
-
-Use this skill when adding or changing sortable tables (ResourceTableWithFilter, TableWithFilter, **TableWithSort**) or backend list endpoints that accept sortBy/sortOrder. Keeps sort indicators and data order consistent with user expectations. For ensuring any table that displays list data supports sorting, see **tables-support-sorting** (`.llm/exports/opencode/skills/tables-support-sorting/SKILL.md`). For persisting sort in a cookie by path (e.g. bucket-detail messages/buckets), see **sort-prefs-cookie-by-path** (`.llm/exports/opencode/skills/sort-prefs-cookie-by-path/SKILL.md`).
-
-This file is the authority for default sort-order rules by column type.
-
-## Default sort order by column type
-
-| Column type | Default order          | Rationale                                                      |
-| ----------- | ---------------------- | -------------------------------------------------------------- |
-| **String**  | `asc` (A→Z)            | Alphabetical is the natural reading order.                     |
-| **Number**  | `asc` (smallest first) | Ascending is conventional unless "latest" is the goal.         |
-| **Date**    | `desc` (newest first)  | Lists (events, admins by created) typically show newest first. |
-
-The header icon reflects the **current** sort: up = ascending, down = descending. So string columns should default to asc and show an up arrow on first load.
-
-## Frontend: column defaultSortOrder
-
-- **TableFilterBarColumn** (in `packages/ui`) supports optional `defaultSortOrder?: 'asc' | 'desc'`.
-- **ResourceTableWithFilter** and **TableWithFilter** use it when:
-  - Setting initial `sortBy`/`sortOrder` in the URL (first sortable column’s default).
-  - Deriving `effectiveSortOrder` when the URL has no `sortOrder` (active column’s default).
-- If you omit `defaultSortOrder`, legacy behavior is used (default `'desc'`).
-
-When adding or changing a sortable table, set `defaultSortOrder` on each column:
-
-- String columns: `defaultSortOrder: 'asc'`.
-- Date columns (e.g. timestamp, createdAt): `defaultSortOrder: 'desc'`.
-- Number columns: `defaultSortOrder: 'asc'`.
-
-Example (buckets list, string columns):
-
-```ts
-const columns = [
-  { id: 'name', label: t('name'), defaultSortOrder: 'asc' as const },
-  { id: 'isPublic', label: t('isPublic'), defaultSortOrder: 'asc' as const },
-];
-```
-
-Example (events, timestamp first):
-
-```ts
-const eventColumns = [
-  { id: 'timestamp', label: tCommon('eventsTable.timestamp'), defaultSortOrder: 'desc' as const },
-  { id: 'actor', label: tCommon('eventsTable.actor'), defaultSortOrder: 'asc' as const },
-  // ...
-];
-```
-
-## Backend: default when sortOrder is missing
-
-When the API receives `sortBy` but no `sortOrder`, default according to the sort field:
-
-- **Date-like fields** (e.g. `createdAt`, `timestamp`): default **DESC**.
-- **Other fields** (string, number): default **ASC**.
-
-Examples:
-
-- `packages/orm` **BucketService**: `orderDir = orderBy === 'createdAt' ? 'DESC' : 'ASC'` when sortOrder is undefined.
-- `packages/management-orm` **ManagementUserService**: same for admins list.
-- **management-api** list controllers (e.g. usersController): when `sortOrder` is missing, use ASC for string fields and DESC for date fields (e.g. `sortBy === 'createdAt' ? 'DESC' : 'ASC'`).
-
-This keeps direct API calls and any URL without `sortOrder` aligned with the same UX.
-
-## Where this is implemented
-
-- **UI types**: `packages/ui/src/components/table/TableFilterBar/TableFilterBar.tsx` — `TableFilterBarColumn.defaultSortOrder`.
-- **Table components**: `packages/ui/src/components/table/ResourceTableWithFilter/ResourceTableWithFilter.tsx`, `packages/ui/src/components/table/TableWithFilter/TableWithFilter.tsx` — initial effect and `effectiveSortOrder` fallback.
-- **Pages**: Column arrays in list pages (e.g. `apps/web/.../buckets/page.tsx`, `apps/management-web/.../admins/page.tsx`, `users/page.tsx`, `buckets/page.tsx`, `events/page.tsx`).
-- **Backend**: `packages/orm/src/services/BucketService.ts`, `packages/management-orm/src/services/ManagementUserService.ts`, `apps/management-api/src/controllers/usersController.ts` (and any other list endpoint that accepts sortBy/sortOrder).
diff --git a/.llm/exports/opencode/skills/tables-support-sorting/SKILL.md b/.llm/exports/opencode/skills/tables-support-sorting/SKILL.md
deleted file mode 100644
index 9b41f0bd..00000000
--- a/.llm/exports/opencode/skills/tables-support-sorting/SKILL.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-name: tables-support-sorting
-description: Ensure tables that display list data support sortable columns; use TableWithSort or Table.SortableHeaderCell and follow table-sort-defaults.
----
-
-
-# Tables Support Sorting (Metaboost)
-
-Use this skill when adding or changing tables that display list data (e.g. buckets, admins, messages). Every such table should support sortable columns where it makes sense, so users can order by name, date, or other relevant fields.
-
-This is the **orchestration** skill for sortable tables:
-
-- Use this file to decide whether a table should support sorting and which table primitive to use.
-- Use **table-sort-defaults** as the authority for default order rules.
-- Use **sort-prefs-cookie-by-path** as the authority for persistence/restore behavior.
-
-## How to add sorting
-
-1. **TableWithSort** (`packages/ui`): Use for tables that only need sortable headers (no filter bar, no pagination). It renders `Table` with a configurable header row: sortable columns use `Table.SortableHeaderCell`, others use `Table.HeaderCell`. You pass `columns` (with `sortable`, `sortKey`, `defaultSortOrder`), `sortBy`, `sortOrder`, and `onSortChange(sortKey)`. The parent owns sort state (e.g. URL params) and navigates or updates state in `onSortChange`.
-
-2. **Table.SortableHeaderCell**: For one-off sortable headers or custom table layouts, use the base `Table.SortableHeaderCell` directly with `sortKey`, `label`, `activeSortBy`, `sortOrder`, `onSort`.
-
-3. **TableWithFilter / ResourceTableWithFilter**: For list pages that already have a filter bar and pagination, these components already support sortable columns via `sortableColumnIds` and URL/cookie. No change needed unless adding new columns.
-
-## Default sort order
-
-Follow **table-sort-defaults** (`.llm/exports/opencode/skills/table-sort-defaults/SKILL.md`) for all default-order decisions.
-
-## Sort state
-
-- **URL-driven**: For server-rendered pages, read `sortBy` and `sortOrder` from `searchParams`; sort data on the server; pass `sortBy`, `sortOrder`, and a base path (or callback) so the client can navigate to new sort params. Omit default sort from the URL for a clean default (e.g. `?tab=buckets` without `sortBy`/`sortOrder` when sort is name/asc). For persistence/restore rules, use **sort-prefs-cookie-by-path**.
-- **Parent-controlled**: Pass `onSortChange(sortKey)` and let the parent update URL or local state and re-render.
-
-## Example
-
-Bucket detail topics table uses **TableWithSort**: columns Name (asc), Last Message (desc), Created (desc), plus non-sortable Public and Actions. The page reads `sortBy`/`sortOrder` from the URL, sorts child buckets, and passes `topicsSortBy`, `topicsSortOrder`, `topicsSortBasePath` into `BucketDetailContent`, which renders `TableWithSort` and navigates on header click.
diff --git a/.llm/exports/opencode/skills/typeorm-orderby-property-names/SKILL.md b/.llm/exports/opencode/skills/typeorm-orderby-property-names/SKILL.md
deleted file mode 100644
index ec7c42a3..00000000
--- a/.llm/exports/opencode/skills/typeorm-orderby-property-names/SKILL.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: typeorm-orderby-property-names
-description: In TypeORM query builder use entity property names (camelCase) for orderBy, not database column names (snake_case). Use when writing or editing createQueryBuilder().orderBy() in packages/orm or apps that use TypeORM.
----
-
-
-# TypeORM orderBy: use property names
-
-## Rule
-
-When calling `.orderBy()` on a TypeORM `SelectQueryBuilder`, pass the **entity property name** (camelCase), not the database column name (snake_case). TypeORM resolves the string to column metadata by property name; if you pass the DB column name, resolution fails and you get `TypeError: Cannot read properties of undefined (reading 'databaseName')`.
-
-## Do
-
-- `.orderBy('bucket.createdAt', 'DESC')` — property name; TypeORM maps to `created_at` in SQL.
-- `.orderBy('user.displayName', 'ASC')` — property name.
-
-## Don't
-
-- `.orderBy('bucket.created_at', 'DESC')` — column name; no matching property, column is undefined.
-- `.orderBy('user.display_name', 'ASC')` — same issue.
-
-## When it applies
-
-- Any `createQueryBuilder('alias').orderBy('alias.someField', ...)` in `packages/orm` (or other TypeORM usage in the repo).
-- Expressions like `.orderBy('LOWER(alias.name)', 'ASC')` are fine; the problem is only when the second token is meant to be a single column reference that TypeORM looks up on the entity.
diff --git a/.llm/exports/opencode/skills/unit-tests-confident-granularity/SKILL.md b/.llm/exports/opencode/skills/unit-tests-confident-granularity/SKILL.md
deleted file mode 100644
index 9d3434bc..00000000
--- a/.llm/exports/opencode/skills/unit-tests-confident-granularity/SKILL.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-name: unit-tests-confident-granularity
-description: Enforces Metaboost unit-test scope at a confident-not-bulletproof level. Use when writing unit tests to avoid both under-testing and excessive combinatorial test complexity.
-version: 1.0.0
----
-
-
-# Unit Tests - Confident Granularity
-
-## Goal
-
-Deliver strong confidence without turning test suites into unmaintainable exhaustive matrices.
-
-## Confident Coverage Rule
-
-For each critical module under test, include:
-
-1. Happy path behavior.
-2. Guard/rejection behavior for invalid input or state.
-3. Boundary behavior (limits, edge values, time windows).
-4. Safe-failure behavior (no privileged fallback).
-
-## Stop Conditions (Avoid Over-Testing)
-
-Do not keep adding unit tests once all are true:
-
-- Every meaningful branch has at least one direct assertion.
-- At least one representative negative case exists for each guard.
-- Additional cases only duplicate already-proven behavior.
-
-## What To Avoid
-
-- Exhaustive Cartesian permutations that do not add new behavior confidence.
-- Snapshot-heavy tests for business logic.
-- Tests that lock internal implementation details instead of module contract.
-
-## Permutation Sampling Guidance
-
-When a matrix is large, use representative rows:
-
-- One allow example per permission source (owner, admin, etc.).
-- One deny example per missing permission path.
-- One edge case for malformed/missing data.
-
-Add more rows only when they validate a different branch.
diff --git a/.llm/exports/opencode/skills/unit-tests-risk-first/SKILL.md b/.llm/exports/opencode/skills/unit-tests-risk-first/SKILL.md
deleted file mode 100644
index cb965b77..00000000
--- a/.llm/exports/opencode/skills/unit-tests-risk-first/SKILL.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-name: unit-tests-risk-first
-description: Prioritizes unit tests by risk and regression impact in Metaboost. Use when adding or expanding unit tests so coverage is focused on auth, authorization, security boundaries, and high-reuse helpers before lower-risk code.
-version: 1.0.0
----
-
-
-# Unit Tests - Risk First
-
-## Use This Skill When
-
-- Creating a new unit-test backlog.
-- Expanding coverage in a large area and deciding what to test first.
-- Choosing between multiple candidate modules for limited time.
-
-## Priority Order
-
-1. **Auth and identity boundaries**
-   - JWT claim handling, assertion verification, session/cookie safety.
-2. **Authorization decisions**
-   - Permission and role checks, allow/deny branching.
-3. **Security-sensitive transforms**
-   - Token hashing/expiry logic, request binding checks, serialization guards.
-4. **High-reuse helper logic**
-   - Shared helper functions used by multiple apps/packages.
-5. **UI utility logic**
-   - Frontend policy helpers that gate user actions.
-
-## Selection Rule
-
-When choosing the next test target, prefer modules with:
-
-- Higher blast radius (many callers or privileged code path).
-- Higher probability of silent failure (wrong allow/deny outcome).
-- Higher user/security impact if behavior drifts.
-
-Skip low-risk wrappers until higher-risk targets have coverage.
-
-## Required Output Shape
-
-When proposing or implementing tests, include:
-
-- Why this target is high-priority.
-- Which behavior branches are being covered.
-- Which lower-priority targets are intentionally deferred.
diff --git a/.llm/exports/opencode/skills/unit-tests-security-authz-template/SKILL.md b/.llm/exports/opencode/skills/unit-tests-security-authz-template/SKILL.md
deleted file mode 100644
index 44e3d4cc..00000000
--- a/.llm/exports/opencode/skills/unit-tests-security-authz-template/SKILL.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-name: unit-tests-security-authz-template
-description: Provides a repeatable case template for auth, permission, and security-sensitive unit tests in Metaboost. Use when testing JWT, assertion validation, cookie/session helpers, bucket policy, or similar allow/deny logic.
-version: 1.0.0
----
-
-
-# Unit Tests - Security/Authz Template
-
-## Use This Skill When
-
-- Testing auth token helpers and claim validation.
-- Testing permission policy (bucket/admin/role/message CRUD decisions).
-- Testing security-sensitive request binding and replay controls.
-
-## Standard Case Template
-
-For each function/module, cover these case buckets:
-
-1. **Accept valid input**
-   - Confirm expected allow/success behavior.
-2. **Reject invalid input**
-   - Missing/empty/malformed token, claim, id, or mask.
-3. **Enforce boundary rule**
-   - Time window, max TTL, min/max limits, bitmask edge.
-4. **Enforce deny precedence**
-   - Non-owner/non-admin or missing permission bit remains denied.
-5. **Preserve safe failure**
-   - Errors return non-privileged result (`null`, `false`, or explicit reject response).
-
-## Assertions Checklist
-
-- Assert on outcome and error code/message contract where relevant.
-- Verify no accidental allow behavior in negative paths.
-- Keep fixtures minimal and explicit.
-- Mock only unstable boundaries (network, time, cache, external services).
-
-## Matrix Update Rule
-
-When introducing a new auth/authz/security module:
-
-1. Add the module to the active test target matrix plan.
-2. Add at least one test from each relevant case bucket above.
-3. Record any intentionally deferred cases and why they are lower priority.
diff --git a/.llm/exports/opencode/skills/use-form-component/SKILL.md b/.llm/exports/opencode/skills/use-form-component/SKILL.md
deleted file mode 100644
index f454adae..00000000
--- a/.llm/exports/opencode/skills/use-form-component/SKILL.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-name: use-form-component
-description: Never use raw `<form>` in app code. Use Form or FormContainer from @metaboost/ui.
-version: 1.0.0
----
-
-
-# Use Form / FormContainer Instead of Raw &lt;form&gt;
-
-**When to use:** When adding or editing forms in app code (e.g. `apps/web`, `apps/management-web`).
-
-## Rule
-
-Do **not** use raw `<form>` in app code. Use one of:
-
-- **`Form`** (from `@metaboost/ui`) – when you need a titled card plus the form. Renders a Card + `<form>` + Stack; props include `title`, `onSubmit`, `submitError`, `children`.
-- **`FormContainer`** (from `@metaboost/ui`) – when the form is already inside a card or other layout. Renders a `<form>` with optional max-width; props: `onSubmit`, `children`, optional `constrainWidth`, optional `className`.
-
-## Pattern
-
-- Wrap **FormContainer** children in **`Stack`** for consistent vertical spacing (flex column + gap).
-- Use **Form** when the whole block is “card + form” (e.g. auth screens); use **FormContainer** when the form lives inside an existing card or page section.
-- For spacing around the form, use a layout component (e.g. `Stack` with gap or `Container`) rather than a bare `div`; see **avoid-wrapper-elements**.
-
-## Checklist
-
-- Adding a new form? → Use `Form` or `FormContainer` from `@metaboost/ui`, not `<form>`.
-- Using FormContainer? → Put form fields and actions inside a single `<Stack>` as the direct child of FormContainer.
diff --git a/.llm/exports/opencode/skills/web/SKILL.md b/.llm/exports/opencode/skills/web/SKILL.md
deleted file mode 100644
index b1d58338..00000000
--- a/.llm/exports/opencode/skills/web/SKILL.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-name: web
-description: Common patterns for the Metaboost Next.js app
-version: 1.0.0
----
-
-
-# Metaboost Web Patterns
-
-- **Location**: `apps/web/`
-- **Stack**: Next.js, React, TypeScript
-
-## Runtime config (sidecar)
-
-- The Next.js app can load runtime config from a sidecar server when `RUNTIME_CONFIG_URL` is set.
-- Sidecar runs on a separate port (e.g. 3001) and serves GET `/runtime-config` with env-derived JSON.
-- `instrumentation.ts` runs once at server start and fetches config; it is stored in a global/store and used in layout and components.
-
-## Structure
-
-- `src/app/` – App Router pages and layout
-- `src/config/` – Runtime config types, store, server fetch
-- `apps/web/sidecar/` – Standalone Node server that validates env and serves config
-
-## Scripts
-
-- `npm run dev` – Next.js dev server
-- `npm run dev:sidecar` – Run sidecar (after building it)
-- From root: `npm run dev:web-sidecar` – Build sidecar then run web with sidecar
diff --git a/.llm/history/active/LLM-HISTORY-ACTIVE.md b/.llm/history/active/LLM-HISTORY-ACTIVE.md
new file mode 100644
index 00000000..5202d7ca
--- /dev/null
+++ b/.llm/history/active/LLM-HISTORY-ACTIVE.md
@@ -0,0 +1,9 @@
+# `.llm/history/active/`
+
+Optional per-feature session notes while work is in progress. Not required for contributing.
+
+- Create one folder per feature (kebab-case), for example `history/active/my-feature/`.
+- Record prompts, decisions, and file lists if your team uses this workflow.
+- On merge to `develop`, `.github/workflows/complete-feature.yml` may archive a matching folder to
+  `history/completed/YYYY-MM/`.
+- See [LLM.md](../../LLM.md).
diff --git a/.llm/history/active/cross-app-error-boundaries/cross-app-error-boundaries-part-01.md b/.llm/history/active/cross-app-error-boundaries/cross-app-error-boundaries-part-01.md
new file mode 100644
index 00000000..4e48fa74
--- /dev/null
+++ b/.llm/history/active/cross-app-error-boundaries/cross-app-error-boundaries-part-01.md
@@ -0,0 +1,30 @@
+# cross-app-error-boundaries
+
+**Started:** 2026-05-06  
+**Author:** Agent  
+**Context:** Align Next.js error routes with Podverse-style handling for Metaboost web and management-web.
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+Align error boundary handling (Podverse + Metaboost)
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the todo's.
+
+#### Key Decisions
+
+- Added `apps/web` and `apps/management-web` `error.tsx` and `global-error.tsx` with `@metaboost/ui`, dynamic locale loading for `global-error`, and `ThemeWrapper` + `globals.scss` on global shell (web: `web-settings`, management: `management-settings` cookie).
+- Extended `errors` in `i18n/originals/en-US.json` and `es.json` for both apps with boundary/global/action strings.
+- Skipped optional subtree `ErrorBoundary` until an isolation use case exists.
+
+#### Files Created/Modified
+
+- apps/web/src/app/error.tsx
+- apps/web/src/app/global-error.tsx
+- apps/web/i18n/originals/en-US.json, es.json
+- apps/management-web/src/app/error.tsx
+- apps/management-web/src/app/global-error.tsx
+- apps/management-web/i18n/originals/en-US.json, es.json
diff --git a/.llm/history/active/css-var-no-fallbacks/css-var-no-fallbacks-part-01.md b/.llm/history/active/css-var-no-fallbacks/css-var-no-fallbacks-part-01.md
new file mode 100644
index 00000000..a64aab18
--- /dev/null
+++ b/.llm/history/active/css-var-no-fallbacks/css-var-no-fallbacks-part-01.md
@@ -0,0 +1,34 @@
+### Session 2 - 2026-05-07
+
+#### Prompt (Developer)
+
+@podverse/.llm/plans/active/css-var-no-fallbacks/COPY-PASTA.md:23-24
+
+#### Key Decisions
+
+- Added `.cursor/rules/css-custom-properties-no-var-fallbacks.mdc`; cross-links in **global** and **reusable-components** skills; one-line in `.cursorrules`.
+
+#### Files Modified
+
+- `.cursor/rules/css-custom-properties-no-var-fallbacks.mdc`
+- `.cursor/skills/global/SKILL.md`
+- `.cursor/skills/reusable-components/SKILL.md`
+- `.cursorrules`
+
+### Session 1 - 2026-05-07
+
+#### Prompt (Developer)
+
+@podverse/.llm/plans/active/css-var-no-fallbacks/COPY-PASTA.md:16-17
+
+#### Key Decisions
+
+- Replaced `var(--color-border, #eee)` with `var(--color-border)` in bucket roles/messages module SCSS.
+- Storybook decorator border uses `var(--color-border)` only (optional follow-up from plan).
+
+#### Files Modified
+
+- `apps/web/src/app/(main)/bucket/[id]/BucketRolesClient.module.scss`
+- `apps/management-web/src/app/(main)/bucket/[id]/settings/BucketRolesClient.module.scss`
+- `apps/management-web/src/components/buckets/BucketMessagesClient.module.scss`
+- `packages/ui/src/components/navigation/Dropdown/CaretMenuDropdown.stories.tsx`
diff --git a/.llm/history/active/dashboard-breadcrumbs-management-web/dashboard-breadcrumbs-management-web-part-01.md b/.llm/history/active/dashboard-breadcrumbs-management-web/dashboard-breadcrumbs-management-web-part-01.md
new file mode 100644
index 00000000..acee1efc
--- /dev/null
+++ b/.llm/history/active/dashboard-breadcrumbs-management-web/dashboard-breadcrumbs-management-web-part-01.md
@@ -0,0 +1,26 @@
+# dashboard-breadcrumbs-management-web
+
+**Started:** 2026-05-06
+**Author:** LLM session
+**Context:** Dashboard-first breadcrumbs across management-web.
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+in metaboost management, every page accessible via the dashboard should have a breadcrumb that brings you back to the Dashboard
+
+#### Key Decisions
+
+- Added `withDashboardBreadcrumb` + `ManagementBreadcrumbLink`; extended `FilterTablePageLayout` and bucket breadcrumb components with optional leading segments.
+- List pages (admins, users, buckets, terms versions), events, global blocked apps, and existing form/detail pages now show Dashboard as the first crumb; bucket detail/settings include Dashboard via helper or `leadingItems`.
+
+#### Files Created/Modified
+
+- [apps/management-web/src/lib/management-breadcrumbs.ts](apps/management-web/src/lib/management-breadcrumbs.ts)
+- [apps/management-web/src/components/ManagementBreadcrumbLink.tsx](apps/management-web/src/components/ManagementBreadcrumbLink.tsx)
+- [packages/ui/src/components/layout/FilterTablePageLayout/FilterTablePageLayout.tsx](packages/ui/src/components/layout/FilterTablePageLayout/FilterTablePageLayout.tsx)
+- [packages/ui/src/components/bucket/BucketSettingsBreadcrumbs/BucketSettingsBreadcrumbs.tsx](packages/ui/src/components/bucket/BucketSettingsBreadcrumbs/BucketSettingsBreadcrumbs.tsx)
+- [packages/ui/src/components/bucket/BucketMessagesBreadcrumbs/BucketMessagesBreadcrumbs.tsx](packages/ui/src/components/bucket/BucketMessagesBreadcrumbs/BucketMessagesBreadcrumbs.tsx)
+- [packages/ui/src/components/bucket/BucketMessagesPageContent/BucketMessagesPageContent.tsx](packages/ui/src/components/bucket/BucketMessagesPageContent/BucketMessagesPageContent.tsx)
+- Multiple `apps/management-web/src/app/(main)/**` pages and [bucket settings layout/client](apps/management-web/src/app/(main)/bucket/[id]/settings/)
diff --git a/.llm/history/active/drop-defaults-resolved-membership/drop-defaults-resolved-membership-part-01.md b/.llm/history/active/drop-defaults-resolved-membership/drop-defaults-resolved-membership-part-01.md
new file mode 100644
index 00000000..65834436
--- /dev/null
+++ b/.llm/history/active/drop-defaults-resolved-membership/drop-defaults-resolved-membership-part-01.md
@@ -0,0 +1,48 @@
+# drop-defaults-resolved-membership
+
+**Started:** 2026-05-06  
+**Author:** Cursor Agent  
+**Context:** Align resolved membership naming with Podverse; drop "defaults" outside env-bootstrap layer.
+
+---
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+Drop "Defaults" From Resolved Membership (Podverse Parity)
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+
+- Kept `ProductMembershipDefaultsFromEnv` / `resolveProductMembershipDefaultsFromEnv` / `productMembershipDefaultsFromEnv.ts` unchanged (env-bootstrap only; Podverse parity).
+- Renamed management-api OpenAPI and helpers-requests client to `ResolvedProductMembership` / `getResolvedProductMembership` / `managementWebProductMembership`; flattened public `GET /product/membership` JSON: no nested `membershipDefaults` (flat `ResolvedProductMembership` fields + `listPriceCurrencyCode` + `selfServePublicSignupOpen`).
+- Renamed K8s source file to `product-membership-settings.env`; i18n key `billingGovernance.resolvedMembership`.
+- Ran `npm run lint` (pass). Prettier also fixed `.cursor/skills/INDEX.md` and `packages/helpers/src/time/toDateTimeLocalValue.ts` (were failing `prettier --check` on the branch).
+
+#### Files Created/Modified
+
+- `packages/helpers-requests/src/management-web/productMembership.ts` (replaces `productMembershipDefaults.ts`)
+- `packages/helpers-requests/src/index.ts`
+- `packages/helpers/src/membership/billingReadModelTypes.ts`
+- `packages/helpers-requests/src/web/product.ts` (comment)
+- `packages/helpers/src/membership/resolvedProductMembership.ts`
+- `apps/api/src/lib/billingReadModelSerialization.ts`
+- `apps/api/src/controllers/productController.ts`
+- `apps/api/src/openapi.ts`
+- `apps/api/src/routes/product.ts`
+- `apps/api/src/test/product-membership.test.ts`
+- `apps/management-api/src/openapi.ts`
+- `apps/management-web/src/components/users/UserForm.tsx`
+- `apps/management-web/src/lib/createUserFormDefaults.ts`
+- `apps/management-web/src/app/(main)/products/membership/ProductsMembershipClient.tsx`
+- `apps/management-web/e2e/products-membership-billing.spec.ts`
+- `apps/management-web/i18n/originals/en-US.json`, `es.json`, `overrides/es.json`
+- `infra/k8s/base/product-membership/source/product-membership-settings.env` (replaces `product-membership-defaults.env`)
+- `infra/k8s/base/product-membership/kustomization.yaml`
+- `infra/k8s/INFRA-K8S-BASE.md`
+- `infra/k8s/base/management-web/source/management-web-sidecar.env` (comment)
+- `.cursor/skills/INDEX.md`, `packages/helpers/src/time/toDateTimeLocalValue.ts` (prettier only)
diff --git a/.llm/history/active/env-expiration-naming/env-expiration-naming-part-01.md b/.llm/history/active/env-expiration-naming/env-expiration-naming-part-01.md
new file mode 100644
index 00000000..a76436c0
--- /dev/null
+++ b/.llm/history/active/env-expiration-naming/env-expiration-naming-part-01.md
@@ -0,0 +1,28 @@
+# env-expiration-naming
+
+**Started:** 2026-05-04  
+**Author:** Cursor Agent  
+
+---
+
+### Session 1 - 2026-05-04
+
+#### Prompt (Developer)
+
+DEFAULT_FREE_TRIAL_EXPIRATION_SECONDS
+
+this is the wrong convention we want _EXPIRATION to end env and js variable names, not have a denomination afterward. _EXPIRATION env vars should always be seconds so we can infer that. if you don't have skills that already inform you for this standard then add them
+
+#### Key Decisions
+
+- Renamed **`DEFAULT_FREE_TRIAL_EXPIRATION_SECONDS`** → **`DEFAULT_FREE_TRIAL_EXPIRATION`** across helpers, orm `freeTrialExpirationSeconds.ts`, management-web create-user defaults; renamed helper `parsePositiveIntegerTrialSeconds` → **`parsePositiveIntegerTrialExpiration`** with `fallbackExpiration` param.
+- Added **`.cursor/skills/env-expiration-naming/SKILL.md`** and **`.cursor/rules/env-expiration-naming.mdc`**.
+
+#### Files Created/Modified
+
+- `packages/helpers/src/membership/membershipProductDefaultsFromEnv.ts`
+- `packages/helpers/src/index.ts`
+- `packages/orm/src/lib/freeTrialExpirationSeconds.ts`
+- `apps/management-web/src/lib/createUserFormDefaults.ts`
+- `.cursor/skills/env-expiration-naming/SKILL.md`
+- `.cursor/rules/env-expiration-naming.mdc`
diff --git a/.llm/history/active/fix-ebadplatform-npm-ci/fix-ebadplatform-npm-ci-part-01.md b/.llm/history/active/fix-ebadplatform-npm-ci/fix-ebadplatform-npm-ci-part-01.md
new file mode 100644
index 00000000..b2cbf084
--- /dev/null
+++ b/.llm/history/active/fix-ebadplatform-npm-ci/fix-ebadplatform-npm-ci-part-01.md
@@ -0,0 +1,44 @@
+# fix-ebadplatform-npm-ci
+
+**Started:** 2026-05-06  
+**Author:** Cursor Agent  
+**Context:** Remove `--include=optional` from CI/publish install steps to avoid `EBADPLATFORM` on platform-scoped optional dependencies while keeping Linux lockfile generation unchanged.
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+fix it for both podverse and metaboost
+
+#### Key Decisions
+
+- Keep Linux lockfile-generation scripts (`update-lockfile-linux.sh`) on `npm install --include=optional`.
+- Change CI/publish install steps from `npm ci --include=optional` to plain `npm ci`.
+- Limit scope to workflow install steps; do not change lockfile docs/scripts in this pass.
+
+#### Files Created/Modified
+
+- `.github/workflows/ci.yml`
+- `.github/workflows/publish-staging.yml`
+- `.github/workflows/publish-metaboost-signing.yml`
+- `.llm/history/active/fix-ebadplatform-npm-ci/fix-ebadplatform-npm-ci-part-01.md`
+
+### Session 2 - 2026-05-06
+
+#### Prompt (Developer)
+
+implement
+
+#### Key Decisions
+
+- Pin npm in GitHub Actions workflows to `11.13.0` after `actions/setup-node@v6`.
+- Apply npm pin to every Metaboost workflow that runs `npm ci`.
+- Keep lockfile-generation scripts unchanged.
+
+#### Files Created/Modified
+
+- `.github/workflows/ci.yml`
+- `.github/workflows/publish-staging.yml`
+- `.github/workflows/publish-metaboost-signing.yml`
+- `.github/workflows/i18n.yml`
+- `.llm/history/active/fix-ebadplatform-npm-ci/fix-ebadplatform-npm-ci-part-01.md`
diff --git a/.llm/history/active/greenfield-only-migration-rewrite/greenfield-only-migration-rewrite-part-01.md b/.llm/history/active/greenfield-only-migration-rewrite/greenfield-only-migration-rewrite-part-01.md
new file mode 100644
index 00000000..17a10fe7
--- /dev/null
+++ b/.llm/history/active/greenfield-only-migration-rewrite/greenfield-only-migration-rewrite-part-01.md
@@ -0,0 +1,43 @@
+### Metadata
+- Started: 2026-05-05
+- Author: Agent
+- Context: Greenfield-only linear SQL migration rewrite (Podverse + Metaboost)
+
+### Session 1 - 2026-05-05
+#### Prompt (Developer)
+Greenfield-Only Migration Rewrite (Podverse + Metaboost)
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+- Dropped `linear_migration_history` CREATE from app/management `0001_*` migrations to avoid duplicate with `runner/run-linear-migrations.sh` bootstrap.
+- Replaced upgrade-only 0002 `DO $$` rename with no-op `SELECT 1` (column already canonical in 0001).
+- Terms, billing seeds, product_membership_settings: unconditional `INSERT` / `VALUES`.
+- 0004 backfill: `INSERT … SELECT` from `"user"` only (empty `user_trust_settings` on greenfield).
+- 0005: `DROP CONSTRAINT` / `DROP COLUMN` without `IF EXISTS`.
+- Management 0001: plain `CREATE TABLE` / `CREATE INDEX` (no `IF NOT EXISTS`).
+- Regenerated `infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz` and `0003b_management_linear_baseline.sql.gz`; verify + validate scripts passed.
+
+#### Files Created/Modified
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0002_bucket_settings_public_boost_display_minimum.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0003_terms_default_seed.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0004_user_trust_and_entitlement_overrides.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0005_remove_user_trust_tier.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0006_billing_catalog_and_trust_renewal.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/management/0001_management_schema.sql`
+- `infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz`
+- `infra/k8s/base/db/source/bootstrap/0003b_management_linear_baseline.sql.gz`
+
+### Session 2 - 2026-05-05
+#### Prompt (Developer)
+make sure that this choice is in skill files so you remember to follow this standard going forward
+
+#### Key Decisions
+- Documented greenfield-only linear SQL authoring in `linear-db-migrations` and `linear-baseline-gz-sync` skills; Podverse gained dedicated `linear-sql-greenfield-only` skill plus docs/rule cross-links (repo-local).
+
+#### Files Created/Modified
+- `.cursor/skills/linear-db-migrations/SKILL.md`
+- `.cursor/skills/linear-baseline-gz-sync/SKILL.md`
diff --git a/.llm/history/active/helpers-subpath-export-trim/helpers-subpath-export-trim-part-01.md b/.llm/history/active/helpers-subpath-export-trim/helpers-subpath-export-trim-part-01.md
new file mode 100644
index 00000000..0ec5d20a
--- /dev/null
+++ b/.llm/history/active/helpers-subpath-export-trim/helpers-subpath-export-trim-part-01.md
@@ -0,0 +1,28 @@
+# helpers-subpath-export-trim
+
+**Started:** 2026-05-06  
+**Author:** Cursor Agent  
+**Context:** Drop redundant `@metaboost/helpers` package subpath export; use root barrel only.
+
+---
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+Remove redundant `@metaboost/helpers` subpath export
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+
+- ORM now imports `DEFAULT_FREE_TRIAL_EXPIRATION` from `@metaboost/helpers` (root export already provided by `index.ts`).
+- Removed `./membership/productMembershipDefaultsFromEnv.js` from `packages/helpers/package.json` `exports`; subpath map retains only `"."`.
+
+#### Files Created/Modified
+
+- `packages/orm/src/lib/freeTrialExpirationSeconds.ts`
+- `packages/helpers/package.json`
+- `.llm/history/active/helpers-subpath-export-trim/helpers-subpath-export-trim-part-01.md`
diff --git a/.llm/history/active/i18n-locale-sweep/i18n-locale-sweep-part-01.md b/.llm/history/active/i18n-locale-sweep/i18n-locale-sweep-part-01.md
new file mode 100644
index 00000000..bfe50dc9
--- /dev/null
+++ b/.llm/history/active/i18n-locale-sweep/i18n-locale-sweep-part-01.md
@@ -0,0 +1,18 @@
+# i18n locale sweep (Podverse + Metaboost)
+
+**Started:** 2026-05-04
+
+## Session 1 - 2026-05-04
+
+#### Prompt (Developer)
+
+sweep through the i18n files for podverse and metaboost. make sure they are up to date and fully translated
+
+#### Key Decisions
+
+- **Metaboost `apps/management-web`:** Synced `es` originals/overrides with `en-US` key order for `common.userForm` (`passwordInviteHint`, `premiumBillingCadence*` strings). Spanish strings present in originals; overrides hold empty placeholders for those keys.
+
+#### Files Created/Modified
+
+- `apps/management-web/i18n/originals/es.json` (verified complete after root `i18n:sync`)
+- `apps/management-web/i18n/overrides/es.json`
diff --git a/.llm/history/active/linear-migrations-greenfield-trim/linear-migrations-greenfield-trim-part-01.md b/.llm/history/active/linear-migrations-greenfield-trim/linear-migrations-greenfield-trim-part-01.md
new file mode 100644
index 00000000..a2ccba4f
--- /dev/null
+++ b/.llm/history/active/linear-migrations-greenfield-trim/linear-migrations-greenfield-trim-part-01.md
@@ -0,0 +1,34 @@
+## Started
+
+**Author:** Cursor agent  
+**Context:** Trim redundant greenfield linear SQL migrations after assessment.
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+assess the sql files in metaboost. are any unnecessary? you can remove them and change the numbers if it looks like any are not truly needd. assume a green field environment
+
+#### Key Decisions
+
+- **App:** Removed no-op `0002_bucket_settings_public_boost_display_minimum.sql` (`SELECT 1` only; column already in 0001).
+- **App:** Dropped `0005_remove_user_trust_tier.sql` by creating `user_trust_settings` without `trust_tier_id` in `0003_user_trust_and_entitlement_overrides.sql` (greenfield never introduces the column).
+- **App:** Renumbered chain to five files: `0002_terms_default_seed.sql`, `0003_user_trust_and_entitlement_overrides.sql`, `0004_billing_catalog_and_trust_renewal.sql`, `0005_billing_domain_events.sql`.
+- **Management:** Folded `0006_billing_prices_permissions.sql` into `0001_management_schema.sql` (`billing_prices_crud` on `admin_permissions` and `management_admin_role`); deleted standalone `0006`.
+- **Ops:** Updated `infra/k8s/base/ops/kustomization.yaml`, `API_EXPECTED_MIGRATION_FILENAME` → `0005_billing_domain_events.sql`, `MANAGEMENT_API_EXPECTED_MIGRATION_FILENAME` → `0001_management_schema.sql`.
+- Regenerated `0003a_app_linear_baseline.sql.gz` and `0003b_management_linear_baseline.sql.gz`; ran `validate-linear-migrations.sh` and `verify-linear-baseline.sh`.
+
+#### Files Created/Modified
+
+- `infra/k8s/base/ops/source/database/linear-migrations/management/0001_management_schema.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0002_terms_default_seed.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0003_user_trust_and_entitlement_overrides.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0004_billing_catalog_and_trust_renewal.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0005_billing_domain_events.sql`
+- Removed obsolete app/management migration files listed in decisions above
+- `infra/k8s/base/ops/kustomization.yaml`
+- `infra/k8s/base/api/source/api.env`
+- `infra/k8s/base/management-api/source/management-api.env`
+- `infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz`
+- `infra/k8s/base/db/source/bootstrap/0003b_management_linear_baseline.sql.gz`
+- `.llm/history/active/linear-migrations-greenfield-trim/linear-migrations-greenfield-trim-part-01.md`
diff --git a/.llm/history/active/local-docker-image-tag-pin/local-docker-image-tag-pin-part-01.md b/.llm/history/active/local-docker-image-tag-pin/local-docker-image-tag-pin-part-01.md
index 8c251fef..a612b1fb 100644
--- a/.llm/history/active/local-docker-image-tag-pin/local-docker-image-tag-pin-part-01.md
+++ b/.llm/history/active/local-docker-image-tag-pin/local-docker-image-tag-pin-part-01.md
@@ -8,7 +8,7 @@ Context: **K8s only:** explicit pins for `metaboost-local-*` in `workloads.yaml`
 
 #### Prompt (Developer)
 
-check metaboost and metaboost.cc for any examples where a "latest" tag is used. we want everything hard coded to X.X.X-staging.N for now
+check metaboost and metaboost.cc for any examples where a "latest" tag is used. we want everything hard coded to X.Y.Z-staging.N for now
 
 #### Key Decisions
 
@@ -36,8 +36,8 @@ i gave you the wrong instructions. we can keep latest for images that are used l
 #### Key Decisions
 
 - Reverted **Docker Compose** and **`local_prune_metaboost_images`** to `metaboost-*:latest`.
-- Kept **`infra/k8s/base/stack/workloads.yaml`** on explicit `metaboost-local-*:X.X.X-staging.N` (no `:latest` in that K8s manifest).
-- **`build-images.sh`:** dual-tag each `metaboost-local-*` image as `:latest` and `:${METABOOST_LOCAL_K8S_IMAGE_TAG:-X.X.X-staging.N}` so Compose-oriented `latest` and K8s pins refer to the same build.
+- Kept **`infra/k8s/base/stack/workloads.yaml`** on explicit `metaboost-local-*:X.Y.Z-staging.N` (no `:latest` in that K8s manifest).
+- **`build-images.sh`:** dual-tag each `metaboost-local-*` image as `:latest` and `:${METABOOST_LOCAL_K8S_IMAGE_TAG:-X.Y.Z-staging.N}` so Compose-oriented `latest` and K8s pins refer to the same build.
 - **`local-up.sh`:** `LOCAL_IMAGES` uses `METABOOST_LOCAL_K8S_IMAGE_TAG` (same default) so k3d import matches workload image refs.
 
 #### Files Created/Modified
diff --git a/.llm/history/active/local-postgres-wait-db-env/local-postgres-wait-db-env-part-01.md b/.llm/history/active/local-postgres-wait-db-env/local-postgres-wait-db-env-part-01.md
new file mode 100644
index 00000000..8080e71a
--- /dev/null
+++ b/.llm/history/active/local-postgres-wait-db-env/local-postgres-wait-db-env-part-01.md
@@ -0,0 +1,26 @@
+# local-postgres-wait-db-env
+
+**Started:** 2026-05-06  
+**Author:** Cursor Agent  
+**Context:** Align `local_postgres_wait` with Podverse — source `infra/config/local/db.env`, use `DB_APP_OWNER_USER` and read-role names from env (no drifting Make defaults).
+
+---
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+implement the plan
+
+#### Key Decisions
+
+- `local_postgres_wait` and `local_db_init_management` source `infra/config/local/db.env` (Podverse pattern); `psql` uses `DB_APP_OWNER_USER`; role-count query uses `DB_APP_READ_USER` / `DB_APP_READ_WRITE_USER`.
+- `local_infra_up` depends on `infra/config/local/db.env` so Compose and wait share the same file.
+- Removed `LOCAL_PG_USER`, `LOCAL_POSTGRES_READ_*`, `LOCAL_POSTGRES_MANAGEMENT_*`, and `LOCAL_MANAGEMENT_DB_NAME` Make defaults to avoid parallel definitions of DB identity.
+
+#### Files Created/Modified
+
+- `makefiles/local/Makefile.local.docker.mk`
+- `makefiles/local/Makefile.local.env.mk`
+- `infra/docker/local/INFRA-DOCKER-LOCAL.md`
+- `.llm/history/active/local-postgres-wait-db-env/local-postgres-wait-db-env-part-01.md`
diff --git a/.llm/history/active/membership-bootstrap-env-alignment/membership-bootstrap-env-alignment-part-01.md b/.llm/history/active/membership-bootstrap-env-alignment/membership-bootstrap-env-alignment-part-01.md
new file mode 100644
index 00000000..9cc53425
--- /dev/null
+++ b/.llm/history/active/membership-bootstrap-env-alignment/membership-bootstrap-env-alignment-part-01.md
@@ -0,0 +1,39 @@
+# membership-bootstrap-env-alignment
+
+**Started:** 2026-05-06  
+**Author:** Cursor Agent  
+**Context:** Rename membership product bootstrap env keys to the shared `MEMBERSHIP_*` convention.
+
+---
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+Align Metaboost membership bootstrap env keys with Podverse naming
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+
+- Renamed `FREE_TRIAL_EXPIRATION` → `MEMBERSHIP_FREE_TRIAL_EXPIRATION`, `PREMIUM_MEMBERSHIP_COST_MONTHLY` → `MEMBERSHIP_PREMIUM_COST_MONTHLY`, `PREMIUM_MEMBERSHIP_COST_ANNUALLY` → `MEMBERSHIP_PREMIUM_COST_ANNUALLY` in helpers, ORM, both apps’ startup validation, env examples, infra templates, and K8s `product-membership` ConfigMap source; updated K8s cross-comments in `api.env` and `management-api.env`.
+- Refreshed `env-expiration-naming` skill examples to use the new membership env keys; no backward-compat dual-read of legacy names.
+
+#### Files Created/Modified
+
+- `packages/helpers/src/membership/productMembershipDefaultsFromEnv.ts`
+- `packages/orm/src/lib/freeTrialExpirationSeconds.ts`
+- `packages/orm/src/lib/defaultMembershipExpiresAt.ts`
+- `apps/api/src/lib/startup/validation.ts`
+- `apps/management-api/src/lib/startup/validation.ts`
+- `apps/api/.env.example`
+- `apps/management-api/.env.example`
+- `infra/config/env-templates/api.env.example`
+- `infra/config/env-templates/management-api.env.example`
+- `infra/k8s/base/product-membership/source/product-membership-defaults.env`
+- `infra/k8s/base/api/source/api.env`
+- `infra/k8s/base/management-api/source/management-api.env`
+- `.cursor/skills/env-expiration-naming/SKILL.md`
+- `.llm/history/active/membership-bootstrap-env-alignment/membership-bootstrap-env-alignment-part-01.md`
diff --git a/.llm/history/active/membership-product-metaboost/membership-product-metaboost-part-01.md b/.llm/history/active/membership-product-metaboost/membership-product-metaboost-part-01.md
new file mode 100644
index 00000000..ed2fb92c
--- /dev/null
+++ b/.llm/history/active/membership-product-metaboost/membership-product-metaboost-part-01.md
@@ -0,0 +1,163 @@
+# membership-product-metaboost
+
+**Started:** 2026-05-04  
+**Author:** Cursor Agent  
+**Context:** Parity with Podverse membership product defaults — API-driven management-web, shared K8s ConfigMap, `@metaboost/helpers` resolver.
+
+---
+
+### Session 1 - 2026-05-04
+
+#### Prompt (Developer)
+
+continue
+
+#### Key Decisions
+
+- **`@metaboost/helpers`**: New `membership/membershipProductDefaultsFromEnv.ts` with `DEFAULT_FREE_TRIAL_EXPIRATION_SECONDS`, `MembershipProductDefaultsFromEnv`, and lenient `resolveMembershipProductDefaultsFromEnv()` (trial + premium monthly/annual). Package `exports` includes subpath `./membership/membershipProductDefaultsFromEnv.js` for Vitest/runtime parity with Podverse.
+- **`@metaboost/orm`**: `freeTrialExpirationSeconds.ts` imports shared default constant from helpers subpath (single source for 31-day default).
+- **management-api**: `GET {version}/membership-product-defaults` — super-admin only, returns `{ data: resolveMembershipProductDefaultsFromEnv() }`; OpenAPI 0.1.3 + schemas.
+- **helpers-requests**: `managementWebMembershipProductDefaults.getMembershipProductDefaults`.
+- **management-web**: Create-user flow fetches defaults; loading gate; `computeDefaultMembershipExpiresAtInput` takes `trialExpirationSeconds`; removed `NEXT_PUBLIC_FREE_TRIAL_EXPIRATION` from runtime-config, runtime-config-store, sidecar, K8s sidecar env, `.env.example`.
+- **K8s**: `infra/k8s/base/membership-product/` → ConfigMap `metaboost-membership-product-config`; included in api + management-api kustomizations; `envFrom` last on api and management-api deployments; deduped overlapping keys from `api.env` and `management-api.env`.
+
+#### Files Created/Modified
+
+- `packages/helpers/src/membership/membershipProductDefaultsFromEnv.ts`
+- `packages/helpers/package.json`
+- `packages/helpers/src/index.ts`
+- `packages/orm/src/lib/freeTrialExpirationSeconds.ts`
+- `packages/helpers-requests/src/management-web/membershipProductDefaults.ts`
+- `packages/helpers-requests/src/index.ts`
+- `apps/management-api/src/app.ts`
+- `apps/management-api/src/openapi.ts`
+- `apps/management-api/src/test/management-api.test.ts`
+- `apps/management-web/src/lib/createUserFormDefaults.ts`
+- `apps/management-web/src/components/users/UserForm.tsx`
+- `apps/management-web/src/config/runtime-config.ts`
+- `apps/management-web/src/config/runtime-config-store.ts`
+- `apps/management-web/sidecar/src/server.ts`
+- `apps/management-web/sidecar/.env.example`
+- `infra/k8s/base/membership-product/kustomization.yaml`
+- `infra/k8s/base/membership-product/source/membership-product-defaults.env`
+- `infra/k8s/base/api/kustomization.yaml`
+- `infra/k8s/base/api/deployment.yaml`
+- `infra/k8s/base/api/source/api.env`
+- `infra/k8s/base/management-api/kustomization.yaml`
+- `infra/k8s/base/management-api/deployment.yaml`
+- `infra/k8s/base/management-api/source/management-api.env`
+- `infra/k8s/base/management-web/source/management-web-sidecar.env`
+
+### Session 2 - 2026-05-05
+
+#### Prompt (Developer)
+
+# Trial/pricing/RSS limits: management-web loads `/api/v2/membership-product-defaults` from management-api (podverse-membership-product-config on api + management-api).
+
+i am thinking we should follow a convention like
+
+/api/v2/product/membership/defaults
+
+where product represents anything a user of this app can purchase from the site.
+
+as we may potentially offer more products than memberships in the future. both podverse and metaboost should follow this convention (i am not sure if metaboost has memberships yet but there may be active plans you can update to make sure they are aligned with these goals)
+
+#### Key Decisions
+
+- Adopted canonical product endpoint path for membership defaults:
+  - `/v1/product/membership/defaults` (new canonical path)
+  - `/v1/membership-product-defaults` (kept as backward-compatible alias)
+- Updated management-web client request helper to the canonical path.
+- Updated OpenAPI to document canonical path and mark legacy path as deprecated alias.
+- Updated management-web sidecar env comments to reference the canonical path.
+- No active plan files in `.llm/plans/active` referenced this endpoint path, so no plan updates were required.
+
+#### Files Created/Modified
+
+- `.llm/history/active/membership-product-metaboost/membership-product-metaboost-part-01.md`
+- `apps/management-api/src/app.ts`
+- `apps/management-api/src/openapi.ts`
+- `apps/management-api/src/test/management-api.test.ts`
+- `packages/helpers-requests/src/management-web/membershipProductDefaults.ts`
+- `infra/k8s/base/management-web/source/management-web-sidecar.env`
+- `apps/management-web/sidecar/.env.example`
+
+### Session 3 - 2026-05-05
+
+#### Prompt (Developer)
+
+@podverse/apps/management-api/src/routes/membershipProductDefaults.ts:1-36 we do not want any references to "legacy path" check all of the non-committed changes and make sure it uses hard breaks and does not hang onto "legacy" handling
+
+#### Key Decisions
+
+- Enforced hard-break endpoint behavior by removing backward-compatible alias handling:
+  - kept only `/v1/product/membership/defaults`
+  - removed `/v1/membership-product-defaults` route and compatibility docs/tests
+- Verified Metaboost management-api compiles after the hard-break cutover.
+
+#### Files Created/Modified
+
+- `.llm/history/active/membership-product-metaboost/membership-product-metaboost-part-01.md`
+- `apps/management-api/src/app.ts`
+- `apps/management-api/src/openapi.ts`
+- `apps/management-api/src/test/management-api.test.ts`
+
+### Session 4 - 2026-05-05
+
+#### Prompt (Developer)
+
+Product Membership Global Rename Plan
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+
+- Hard-break renamed membership product surfaces to product membership naming in code and files.
+- Changed management-api defaults endpoint from `/v1/product/membership/defaults` to `/v1/product/membership`.
+- Renamed helpers and helpers-requests module names/types/functions from `membershipProduct*` to `productMembership*`.
+- Renamed K8s component and ConfigMap from `membership-product` to `product-membership` with atomic reference updates.
+- Updated `.cursor` expiration-naming rule glob and skill reference to the renamed helper module file.
+
+#### Files Created/Modified
+
+- `.llm/history/active/membership-product-metaboost/membership-product-metaboost-part-01.md`
+- `.cursor/rules/env-expiration-naming.mdc`
+- `.cursor/skills/env-expiration-naming/SKILL.md`
+- `apps/management-api/src/app.ts`
+- `apps/management-api/src/openapi.ts`
+- `apps/management-api/src/test/management-api.test.ts`
+- `apps/management-web/sidecar/.env.example`
+- `apps/management-web/src/components/users/UserForm.tsx`
+- `apps/management-web/src/lib/createUserFormDefaults.ts`
+- `infra/k8s/base/api/deployment.yaml`
+- `infra/k8s/base/api/kustomization.yaml`
+- `infra/k8s/base/api/source/api.env`
+- `infra/k8s/base/management-api/deployment.yaml`
+- `infra/k8s/base/management-api/kustomization.yaml`
+- `infra/k8s/base/management-api/source/management-api.env`
+- `infra/k8s/base/management-web/source/management-web-sidecar.env`
+- `infra/k8s/base/product-membership/kustomization.yaml`
+- `infra/k8s/base/product-membership/source/product-membership-defaults.env`
+- `packages/helpers/package.json`
+- `packages/helpers/src/index.ts`
+- `packages/helpers/src/membership/productMembershipDefaultsFromEnv.ts`
+- `packages/helpers-requests/src/index.ts`
+- `packages/helpers-requests/src/management-web/productMembershipDefaults.ts`
+- `packages/orm/src/lib/freeTrialExpirationSeconds.ts`
+
+### Session 5 - 2026-05-05
+
+#### Prompt (Developer)
+
+complete anythig needed but you don't need to commit or run tests
+
+#### Key Decisions
+
+- Confirmed no remaining `membership-product` / old defaults path references in Metaboost app code, packages, `infra/k8s`, or `infra/config` (only historical lines in other `.llm/history` files).
+- Skipped commit and test runs per request.
+
+#### Files Created/Modified
+
+- `.llm/history/active/membership-product-metaboost/membership-product-metaboost-part-01.md`
diff --git a/.llm/history/active/metaboost-bucket-webpush-foundation/metaboost-bucket-webpush-foundation-part-01.md b/.llm/history/active/metaboost-bucket-webpush-foundation/metaboost-bucket-webpush-foundation-part-01.md
new file mode 100644
index 00000000..e29e93c9
--- /dev/null
+++ b/.llm/history/active/metaboost-bucket-webpush-foundation/metaboost-bucket-webpush-foundation-part-01.md
@@ -0,0 +1,197 @@
+# metaboost-bucket-webpush-foundation
+
+**Started:** 2026-05-06
+**Author:** LLM session
+**Context:** Plan-set execution prompts.
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+make sure a copy pasta for the @metaboost/.llm/plans/active/metaboost-bucket-webpush-foundation/ plans is created
+
+#### Key Decisions
+
+- Added [`COPY-PASTA.md`](.llm/plans/active/metaboost-bucket-webpush-foundation/COPY-PASTA.md) with five sequential copy-paste prompts mapped to `01`–`05` plan files and assumptions between steps.
+- Linked execution order doc to COPY-PASTA for discovery.
+
+#### Files Created/Modified
+
+- [.llm/plans/active/metaboost-bucket-webpush-foundation/COPY-PASTA.md](.llm/plans/active/metaboost-bucket-webpush-foundation/COPY-PASTA.md)
+- [.llm/plans/active/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md](.llm/plans/active/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md)
+
+### Session 2 - 2026-05-06
+
+#### Prompt (Developer)
+
+Implement plan file `.llm/plans/active/metaboost-bucket-webpush-foundation/01-backend-domain-and-schema.md` exactly as written.
+Follow Metaboost linear migrations and ORM conventions (forward-only SQL under infra/k8s, ops kustomization bundle sync if adding migration files).
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+
+#### Key Decisions
+
+- Added `bucket_notification_preference` and `user_web_push_subscription` to canonical `0001_app_schema.sql` (ops + `infra/k8s/base/db/source/app` copy), with triggers and indexes.
+- Implemented `BucketNotificationPreferenceService` and `UserWebPushSubscriptionService` with upsert/list/delete; Web Push upsert keys on unique `endpoint`.
+- Child bucket creation copies parent `bucket_notification_preference` rows in `BucketService.create` after settings insert.
+- Regenerated `0003a`/`0003b` linear baseline archives after migration change.
+- Moved completed plan `01-backend-domain-and-schema.md` to `.llm/plans/completed/metaboost-bucket-webpush-foundation/`.
+
+#### Files Created/Modified
+
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql`
+- `infra/k8s/base/db/source/app/0001_app_schema.sql`
+- `infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz`
+- `infra/k8s/base/db/source/bootstrap/0003b_management_linear_baseline.sql.gz`
+- `packages/orm/src/entities/BucketNotificationPreference.ts`
+- `packages/orm/src/entities/UserWebPushSubscription.ts`
+- `packages/orm/src/services/BucketNotificationPreferenceService.ts`
+- `packages/orm/src/services/UserWebPushSubscriptionService.ts`
+- `packages/orm/src/data-source.ts`
+- `packages/orm/src/index.ts`
+- `packages/orm/src/services/BucketService.ts`
+- `.llm/plans/active/metaboost-bucket-webpush-foundation/COPY-PASTA.md`
+- `.llm/plans/active/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/completed/metaboost-bucket-webpush-foundation/01-backend-domain-and-schema.md` (moved from active)
+
+### Session 3 - 2026-05-06
+
+#### Prompt (Developer)
+
+Implement plan file `.llm/plans/active/metaboost-bucket-webpush-foundation/02-api-and-webpush-channel.md` exactly as written.
+Assume step 1 (01-backend-domain-and-schema) is complete.
+Include Joi schemas, helpers-requests types, non-blocking dispatch on message persistence, and threshold-aware gating per the plan.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+
+#### Key Decisions
+
+- Added authenticated bucket notification preference GET/PATCH with `applyToDescendants`; auth-scoped Web Push subscription CRUD under `/auth/web-push-subscriptions`.
+- Implemented `notifyNewBucketMessage` + `webPushChannel` (VAPID optional via `API_WEB_PUSH_VAPID_*`); non-blocking `void` dispatch after boost persistence in `persistStandardBoostMessage`.
+- Threshold gate reuses `resolveEffectiveThresholdFilter` via new `boostMessageMeetsRootPublicMinimumThreshold` (boost rows only).
+- OpenAPI, Joi (`schemas/buckets`, `schemas/webPushSubscriptions`), and `helpers-requests` updated for new contracts.
+- Added `web-push` dependency to `@metaboost/api`; ORM `findByUserAndBucket`, `updateForUser` for API handlers.
+
+#### Files Created/Modified
+
+- `apps/api/package.json` (web-push)
+- `apps/api/src/config/index.ts`
+- `apps/api/src/lib/message-threshold-filter.ts`
+- `apps/api/src/lib/notifications/notifyNewBucketMessage.ts`
+- `apps/api/src/lib/notifications/webPushChannel.ts`
+- `apps/api/src/lib/standardIngest/persistBoostMessage.ts`
+- `apps/api/src/controllers/bucketsController.ts`
+- `apps/api/src/controllers/webPushSubscriptionsController.ts`
+- `apps/api/src/routes/auth.ts`
+- `apps/api/src/routes/buckets.ts`
+- `apps/api/src/schemas/buckets.ts`
+- `apps/api/src/schemas/webPushSubscriptions.ts`
+- `apps/api/src/openapi.ts`
+- `packages/orm/src/services/BucketNotificationPreferenceService.ts`
+- `packages/orm/src/services/UserWebPushSubscriptionService.ts`
+- `packages/helpers-requests/src/web/auth.ts`
+- `packages/helpers-requests/src/web/buckets.ts`
+- `.llm/plans/active/metaboost-bucket-webpush-foundation/COPY-PASTA.md`
+- `.llm/plans/active/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/completed/metaboost-bucket-webpush-foundation/02-api-and-webpush-channel.md` (moved from active)
+
+### Session 4 - 2026-05-06
+
+#### Prompt (Developer)
+
+Implement plan file `.llm/plans/active/metaboost-bucket-webpush-foundation/03-web-ui-and-service-worker.md` exactly as written.
+Assume steps 1–2 are complete so APIs and contracts exist.
+Reuse existing bucket scope-modal patterns where the plan says to align UX.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+
+#### Key Decisions
+
+- Added `BucketNotificationsBell` with enable/disable flows (permission, SW subscribe, upsert subscription API, PATCH preference) and disable (unsubscribe, delete server sub, PATCH preference).
+- Scope modal reuses `applySettingsScope*` strings when `hasChildBuckets`; tabs + bell in `Row wrap` via optional `notificationBell` on `BucketDetailTabShell`.
+- Fixed bell relative imports to `../../../../config` and `../../../../lib/webPushBrowser`.
+- Documented optional `NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY` in web sidecar `.env.example`; i18n keys under `buckets.*`.
+- Moved completed plan `03-web-ui-and-service-worker.md` to `.llm/plans/completed/metaboost-bucket-webpush-foundation/`.
+
+#### Files Created/Modified
+
+- `apps/web/src/app/(main)/bucket/[id]/BucketNotificationsBell.tsx`
+- `apps/web/src/app/(main)/bucket/[id]/BucketDetailTabShell.tsx`
+- `apps/web/src/app/(main)/bucket/[id]/page.tsx`
+- `apps/web/i18n/originals/en-US.json`
+- `apps/web/i18n/originals/es.json`
+- `apps/web/i18n/overrides/es.json`
+- `apps/web/sidecar/.env.example`
+- `apps/web/src/lib/webPushBrowser.ts` (import path: remove `.js` for Turbopack)
+- `.llm/plans/active/metaboost-bucket-webpush-foundation/COPY-PASTA.md`
+- `.llm/plans/active/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/completed/metaboost-bucket-webpush-foundation/03-web-ui-and-service-worker.md` (moved from active)
+
+### Session 5 - 2026-05-06
+
+#### Prompt (Developer)
+
+Implement plan file `.llm/plans/active/metaboost-bucket-webpush-foundation/04-env-vapid-and-local-setup.md` exactly as written.
+Assume steps 1–3 are complete so required env keys and runtime surfaces are known from implemented code.
+Keep canonical `.env.example`, sidecar, and local env override flows aligned per Metaboost env conventions.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+
+#### Key Decisions
+
+- Canonical API env: **`WEBPUSH_ENABLED`**, **`WEBPUSH_VAPID_*`**, subject via **`WEBPUSH_VAPID_SUBJECT`**; legacy **`API_WEB_PUSH_VAPID_*`** still supported in `config.webPushVapid`.
+- Web runtime: **`NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY`**, **`NEXT_PUBLIC_WEBPUSH_ENABLED`** (+ legacy **`NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY`**); sidecar forwards optional keys; **`getWebPushClientEnabled`** gates bucket bell.
+- **`notifications.env`** home override + **`setup.sh`** apply/sync to API and web/sidecar (public key mirror).
+- **`npm run webpush:generate-vapid-keys -w @metaboost/api`** and **`scripts/development/generate-webpush-vapid-keys.sh`**; docs **`docs/development/env/WEB-PUSH-LOCAL.md`**.
+- Moved completed plan `04-env-vapid-and-local-setup.md` to `.llm/plans/completed/metaboost-bucket-webpush-foundation/`.
+
+#### Files Created/Modified
+
+- `apps/api/src/config/index.ts`
+- `apps/api/.env.example`
+- `apps/api/package.json`
+- `apps/web/src/config/runtime-config.ts`
+- `apps/web/src/config/env.ts`
+- `apps/web/src/app/(main)/bucket/[id]/page.tsx`
+- `apps/web/sidecar/src/server.ts`
+- `apps/web/sidecar/.env.example`
+- `infra/config/env-templates/api.env.example`
+- `infra/config/env-templates/web-sidecar.env.example`
+- `scripts/local-env/setup.sh`
+- `scripts/env-overrides/home-override-env-files.inc.sh`
+- `scripts/env-overrides/write-home-override-stubs.rb`
+- `scripts/development/generate-webpush-vapid-keys.sh`
+- `docs/development/env/LOCAL-ENV-OVERRIDES.md`
+- `docs/development/env/WEB-PUSH-LOCAL.md`
+- `AGENTS.md`
+- `.llm/plans/active/metaboost-bucket-webpush-foundation/COPY-PASTA.md`
+- `.llm/plans/active/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/completed/metaboost-bucket-webpush-foundation/04-env-vapid-and-local-setup.md` (moved from active)
+
+### Session 6 - 2026-05-06
+
+#### Prompt (Developer)
+
+Implement plan file `.llm/plans/active/metaboost-bucket-webpush-foundation/05-tests-and-verification.md` exactly as written.
+Assume steps 1–4 are complete.
+Add or update API integration tests and web E2E tests per the plan; do not skip threshold/dispatch or inheritance cases listed there.
+Do not modify unrelated files.
+When done, summarize changed files, verification commands run (or to run locally), and any follow-up risks.
+
+#### Key Decisions
+
+- Added `apps/api/src/test/notification-webpush.test.ts`: mocked `web-push`, preference GET/PATCH (solo + apply descendants), inheritance via `BucketService` mb-mid + RSS item, subscription CRUD, `notifyNewBucketMessage` dispatch vs threshold floor.
+- Wired stable E2E VAPID keys for API + web/sidecar in `apps/web/playwright.e2e-server-env.ts`; seeded child bucket `e2ebkt000003` under Bucket One for scope-modal flows (`tools/web/seed-e2e.mjs`).
+- New Playwright spec `apps/web/e2e/bucket-notifications-webpush-bucket-owner.spec.ts` (bell visibility, API reload parity, no-modal toggle, modal buttons, descendant pref after apply-all).
+- Moved `05-tests-and-verification.md` to `.llm/plans/completed/metaboost-bucket-webpush-foundation/`; marked Step 5 complete in COPY-PASTA and execution-order link; moved `COPY-PASTA.md` and `00-EXECUTION-ORDER.md` from `active/` to the same completed plan-set directory; fixed same-directory links in `00-EXECUTION-ORDER.md`.
+
+#### Files Created/Modified
+
+- `apps/api/src/test/notification-webpush.test.ts`
+- `apps/web/playwright.e2e-server-env.ts`
+- `apps/web/e2e/bucket-notifications-webpush-bucket-owner.spec.ts`
+- `tools/web/seed-e2e.mjs`
+- `makefiles/local/e2e-spec-order-web.txt`
+- `.llm/plans/completed/metaboost-bucket-webpush-foundation/COPY-PASTA.md` (moved from active)
+- `.llm/plans/completed/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md` (moved from active)
+- `.llm/plans/completed/metaboost-bucket-webpush-foundation/05-tests-and-verification.md` (moved from active)
diff --git a/.llm/history/active/metaboost-kustomize-podverse-composition/metaboost-kustomize-podverse-composition-part-01.md b/.llm/history/active/metaboost-kustomize-podverse-composition/metaboost-kustomize-podverse-composition-part-01.md
new file mode 100644
index 00000000..b7be2041
--- /dev/null
+++ b/.llm/history/active/metaboost-kustomize-podverse-composition/metaboost-kustomize-podverse-composition-part-01.md
@@ -0,0 +1,40 @@
+# metaboost-kustomize-podverse-composition
+
+**Started:** 2026-05-06  
+**Author:** Cursor Agent  
+**Context:** Align Metaboost Kustomize with Podverse — no `../` sibling bases in component bases;
+compose `base/product-membership` in overlays; remote `alpha/ops`.
+
+---
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+Metaboost Kustomize: Podverse-style composition (no `../` in bases)
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+
+- Removed `../product-membership` from `base/api` and `base/management-api`; composed `base/product-membership` in `alpha/api` and `alpha/management-api` via remote Git URLs (same `?ref=` as component base), matching Podverse.
+- Replaced `alpha/ops` filesystem `../../base/ops` with remote `base/ops` URL; updated INFRA-K8S revision policy accordingly.
+- Extended `kustomize-build-metaboost-bases.sh` and INFRA-K8S-BASE manual loop to include `product-membership`.
+- Documented api/management-api dual-remote requirement in METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.
+- Added `.cursor/skills/k8s/SKILL.md` and INDEX entry.
+
+#### Files Created/Modified
+
+- `infra/k8s/base/api/kustomization.yaml`
+- `infra/k8s/base/management-api/kustomization.yaml`
+- `infra/k8s/alpha/api/kustomization.yaml`
+- `infra/k8s/alpha/management-api/kustomization.yaml`
+- `infra/k8s/alpha/ops/kustomization.yaml`
+- `infra/k8s/INFRA-K8S.md`
+- `infra/k8s/INFRA-K8S-BASE.md`
+- `scripts/k8s/kustomize-build-metaboost-bases.sh`
+- `docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md`
+- `.cursor/skills/k8s/SKILL.md`
+- `.cursor/skills/INDEX.md`
diff --git a/.llm/history/active/metaboost-staged-changes-cleanup/metaboost-staged-changes-cleanup-part-01.md b/.llm/history/active/metaboost-staged-changes-cleanup/metaboost-staged-changes-cleanup-part-01.md
new file mode 100644
index 00000000..16cef265
--- /dev/null
+++ b/.llm/history/active/metaboost-staged-changes-cleanup/metaboost-staged-changes-cleanup-part-01.md
@@ -0,0 +1,224 @@
+# metaboost-staged-changes-cleanup
+
+**Started:** 2026-05-07
+**Author:** Agent
+**Context:** Plan files for cleaning up DRY violations and inefficiencies introduced by
+the bucket-webpush-foundation changeset and adjacent additions in the staged Metaboost
+diff. Six dependency-ordered phases saved under
+`.llm/plans/active/metaboost-staged-changes-cleanup/`.
+
+### Session 1 - 2026-05-07
+
+#### Prompt (Developer)
+
+thoroughly investigate all of the staged changes for metaboost, and determine if there
+are any inefficiencies or lack of DRY practices you think should be cleaned up.
+
+#### Prompt (Developer)
+
+create and save plan files for the work locally
+
+#### Key Decisions
+
+- Treated the deliverable as plan-file authoring per `plan-files-convention`; no product
+  code or tests changed in this session.
+- Six phases ordered so cross-app error-boundary extraction (largest DRY win) and
+  notification-dispatch performance fixes ship first; type/schema dedup and bell refactor
+  follow once shared types are in place; style/import hygiene runs last.
+- Error boundaries to be moved to `@metaboost/ui` (per `reusable-components` /
+  `ui-component-promotion`), not an internal shared module.
+- Auth narrowing handled via a `requireUser(req, res)` helper rather than a typed
+  `AuthenticatedRequest` to keep the change local.
+- Push send fan-out uses `Promise.allSettled` so one bad endpoint does not abort the
+  batch; descendant preference write is collapsed to a single `INSERT ... SELECT ...
+  ON CONFLICT` mirroring `BucketService.applyGeneralSettingsToDescendants`.
+- Postgres unique-violation detection centralized in `@metaboost/orm` via
+  `isPgUniqueViolation`, removing two `as { code: string }` assertions flagged by
+  `avoid-type-assertions`.
+- Pre-existing duplication outside the bucket-webpush changeset (e.g. the broader
+  cookie-header pattern across all of `helpers-requests/web/buckets.ts`) is out of scope
+  beyond replacing the call sites already touched.
+
+#### Files Created/Modified
+
+- .llm/plans/active/metaboost-staged-changes-cleanup/00-SUMMARY.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/01-error-boundaries-shared-ui.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/02-notification-dispatch-perf.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/03-shared-api-contract-types.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/04-schema-and-error-helpers.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/05-helpers-and-bell-refactor.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/06-style-and-import-hygiene.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md
+- .llm/history/active/metaboost-staged-changes-cleanup/metaboost-staged-changes-cleanup-part-01.md
+
+### Session 2 - 2026-05-07
+
+#### Prompt (Developer)
+
+@metaboost/.llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md:21-25
+
+#### Key Decisions
+
+- Completed plan `01-error-boundaries-shared-ui`: thin `error.tsx` / `global-error.tsx` in web and management-web using `AppErrorBoundary`, `GlobalErrorBoundary`, and `extractErrorsStringsFromMessagesDefault` from `@metaboost/ui`.
+- Vitest + Testing Library + jsdom + `@vitejs/plugin-react` added to `packages/ui`; root `test:unit` runs `@metaboost/ui` tests.
+- Plan file moved to `.llm/plans/completed/metaboost-staged-changes-cleanup/`.
+
+#### Files Created/Modified
+
+- packages/ui/package.json, vitest.config.ts
+- packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.test.tsx
+- apps/web/src/app/error.tsx, apps/web/src/app/global-error.tsx
+- apps/management-web/src/app/error.tsx, apps/management-web/src/app/global-error.tsx
+- packages/ui/PACKAGES-UI.md
+- package.json (test:unit)
+- .llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md
+- .llm/plans/completed/metaboost-staged-changes-cleanup/01-error-boundaries-shared-ui.md (moved from active)
+- .llm/plans/active/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md
+- packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.tsx (import order)
+
+### Session 3 - 2026-05-07
+
+#### Prompt (Developer)
+
+@metaboost/.llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md:37-41
+
+#### Key Decisions
+
+- Implemented `02-notification-dispatch-perf`: `UserWebPushSubscriptionService.listByUserIds`, batched `Promise.allSettled` web-push dispatch with inline status extraction + Phase 4 TODO, `BucketNotificationPreferenceService.upsertManyForUser` (INSERT…SELECT…ON CONFLICT), controller uses bulk upsert for descendants; extended `notification-webpush.test.ts` with five-descendant bulk spy and multi-subscriber `listByUserIds` spy cases.
+
+#### Files Created/Modified
+
+- packages/orm/src/services/UserWebPushSubscriptionService.ts
+- packages/orm/src/services/BucketNotificationPreferenceService.ts
+- apps/api/src/lib/notifications/webPushChannel.ts
+- apps/api/src/controllers/bucketsController.ts
+- apps/api/src/test/notification-webpush.test.ts
+- .llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md
+- .llm/plans/completed/metaboost-staged-changes-cleanup/02-notification-dispatch-perf.md (moved from active)
+
+### Session 4 - 2026-05-07
+
+#### Prompt (Developer)
+
+@metaboost/.llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md:53-57
+
+#### Key Decisions
+
+- Completed plan `03-shared-api-contract-types`: canonical types in `@metaboost/helpers-requests` (`WebPushSubscriptionKeys`, PATCH response `BucketNotificationPreferencePatchResponse`), package barrel exports, API schemas re-export only, `subscriptionToJson` returns `WebPushSubscriptionDto`, bucket notification handlers use typed payloads.
+
+#### Files Created/Modified
+
+- packages/helpers-requests/src/web/auth.ts
+- packages/helpers-requests/src/web/buckets.ts
+- packages/helpers-requests/src/index.ts
+- apps/api/src/schemas/webPushSubscriptions.ts
+- apps/api/src/schemas/buckets.ts
+- apps/api/src/controllers/webPushSubscriptionsController.ts
+- apps/api/src/controllers/bucketsController.ts
+- .llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md
+- .llm/plans/completed/metaboost-staged-changes-cleanup/03-shared-api-contract-types.md (moved from active)
+
+### Session 5 - 2026-05-07
+
+#### Prompt (Developer)
+
+@metaboost/.llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md:69-77
+
+#### Key Decisions
+
+- Completed plan `04-schema-and-error-helpers`: OpenAPI `WebPushSubscriptionKeys` + `$ref`; Joi `webPushKeysObject`; `packages/orm/src/lib/pgError.ts` with `getPgErrorCode` / `isPgUniqueViolation`; Vitest unit tests and `**/*.test.ts` excluded from orm tsc; `getWebPushErrorStatusCode` in `webPushChannel.ts`; `bucketsController` and `BucketService.create` use `isPgUniqueViolation`.
+
+#### Files Created/Modified
+
+- packages/orm/src/lib/pgError.ts, pgError.test.ts, vitest.config.ts
+- packages/orm/package.json, tsconfig.json
+- packages/orm/src/index.ts
+- packages/orm/src/services/BucketService.ts
+- apps/api/src/openapi.ts
+- apps/api/src/schemas/webPushSubscriptions.ts
+- apps/api/src/lib/notifications/webPushChannel.ts
+- apps/api/src/controllers/bucketsController.ts
+- .llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md
+- .llm/plans/completed/metaboost-staged-changes-cleanup/04-schema-and-error-helpers.md (moved from active)
+
+### Session 6 - 2026-05-07
+
+#### Prompt (Developer)
+
+@metaboost/.llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md:88-92
+
+#### Key Decisions
+
+- Implemented plan `05-helpers-and-bell-refactor`: `requireUser` in `apps/api/src/middleware/auth.ts`; `cookieHeaderToHeaders` in `helpers-requests` + 11 call sites in `web/buckets.ts`; `withServerCookie` in `apps/web/src/lib/server-request.ts` and refactored server `fetch*` helpers that used the cookie/baseUrl preamble with `webBuckets.*`; raw SQL `INSERT … ON CONFLICT … RETURNING` for `UserWebPushSubscriptionService.upsert` and `BucketNotificationPreferenceService.upsert` with row mappers (explicit bypass comment); split bell into `useBucketWebPushSubscription.ts`, `useApplyToDescendantsModal.tsx`, and thin `BucketNotificationsBell.tsx`.
+- Express 5 `req.params` typing requires `typeof subscriptionIdParam !== 'string'` guards before ORM calls (replaces prior empty-string checks only).
+- Vitest added to `@metaboost/helpers-requests` with `request.cookieHeaderToHeaders.test.ts`; root `test:unit` runs that workspace; API `require-user.test.ts` added.
+- `notification-webpush` integration test narrows subscription id without type assertions and asserts DB row `id`/`endpoint` after upsert.
+
+#### Files Created/Modified
+
+- apps/api/src/middleware/auth.ts
+- apps/api/src/controllers/webPushSubscriptionsController.ts
+- apps/api/src/controllers/bucketsController.ts
+- apps/api/src/test/require-user.test.ts
+- apps/api/src/test/notification-webpush.test.ts
+- packages/helpers-requests/src/request.ts
+- packages/helpers-requests/src/web/buckets.ts
+- packages/helpers-requests/src/index.ts
+- packages/helpers-requests/src/request.cookieHeaderToHeaders.test.ts
+- packages/helpers-requests/vitest.config.ts
+- packages/helpers-requests/package.json
+- packages/orm/src/services/UserWebPushSubscriptionService.ts
+- packages/orm/src/services/BucketNotificationPreferenceService.ts
+- apps/web/src/lib/server-request.ts
+- apps/web/src/lib/buckets.ts
+- apps/web/src/components/useApplyToDescendantsModal.tsx
+- apps/web/src/app/(main)/bucket/[id]/useBucketWebPushSubscription.ts
+- apps/web/src/app/(main)/bucket/[id]/BucketNotificationsBell.tsx
+- package.json (root test:unit)
+- package-lock.json
+- .llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md
+- .llm/plans/active/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md
+- .llm/plans/completed/metaboost-staged-changes-cleanup/05-helpers-and-bell-refactor.md (moved from active)
+
+### Session 7 - 2026-05-07
+
+#### Prompt (Developer)
+
+@metaboost/.llm/plans/active/metaboost-staged-changes-cleanup/COPY-PASTA.md:104-107
+
+#### Key Decisions
+
+- Completed plan `06-style-and-import-hygiene`: bucket detail title uses co-located `BucketName.module.scss` with `@metaboost/ui` spacing tokens (no shared `BucketNameWithVisibility` — pattern only on detail page); verified `@metaboost/ui` feedback error boundaries have no inline styles; `webPushChannel` uses named `web-push` imports and `logger.error` via new `apps/api/src/lib/logger.ts`; integration test mock uses named exports and `vi.mocked(sendNotification)`.
+- Entire plan set finalized per tracking rules: moved `06-style-and-import-hygiene.md`, `COPY-PASTA.md`, `00-EXECUTION-ORDER.md`, and `00-SUMMARY.md` into `.llm/plans/completed/metaboost-staged-changes-cleanup/` with execution-order links rewritten as same-directory `./NN-*.md`.
+
+#### Files Created/Modified
+
+- apps/web/src/app/(main)/bucket/[id]/BucketName.module.scss
+- apps/web/src/app/(main)/bucket/[id]/page.tsx
+- apps/api/src/lib/logger.ts
+- apps/api/src/lib/notifications/webPushChannel.ts
+- apps/api/src/test/notification-webpush.test.ts
+- .llm/plans/completed/metaboost-staged-changes-cleanup/06-style-and-import-hygiene.md (from active)
+- .llm/plans/completed/metaboost-staged-changes-cleanup/COPY-PASTA.md (from active)
+- .llm/plans/completed/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md (from active)
+- .llm/plans/completed/metaboost-staged-changes-cleanup/00-SUMMARY.md (from active)
+
+### Session 8 - 2026-05-07
+
+#### Prompt (Developer)
+
+Briefly inform the user about the task result and perform any follow-up actions (if needed).
+
+#### Key Decisions
+
+- Summarized background shell tasks (Podverse + Metaboost): successes vs failures from terminal logs.
+- Metaboost `@metaboost/ui` ESLint failure was `perfectionist/sort-imports` on `GlobalErrorBoundary.tsx`; ran `eslint --fix` on that file — canonical order is `ThemeWrapper` (`../../../contexts`) then `../../form` / `../../layout` imports; full `npm run lint -w @metaboost/ui` now passes.
+
+#### Files Created/Modified
+
+- packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.tsx
+- .llm/history/active/metaboost-staged-changes-cleanup/metaboost-staged-changes-cleanup-part-01.md
diff --git a/.llm/history/active/mgmt-create-user-ux/mgmt-create-user-ux-part-01.md b/.llm/history/active/mgmt-create-user-ux/mgmt-create-user-ux-part-01.md
new file mode 100644
index 00000000..3f572b13
--- /dev/null
+++ b/.llm/history/active/mgmt-create-user-ux/mgmt-create-user-ux-part-01.md
@@ -0,0 +1,97 @@
+# mgmt-create-user-ux (Metaboost)
+
+**Started:** 2026-05-04
+**Context:** Metaboost management-web create-user UX (plan handoff + completion).
+
+## Session 1 - 2026-05-04
+
+#### Prompt (Developer)
+
+Management web create-user UX (Podverse + Metaboost)
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+
+- Added `NEXT_PUBLIC_FREE_TRIAL_EXPIRATION` to management-web runtime config and sidecar optional keys; validated with `validatePositiveNumber` (min 0, optional).
+- Introduced `createUserFormDefaults.ts` using `addMonths` from `@metaboost/helpers` for premium defaults aligned with ORM.
+- `UserForm`: styled `Select` for tier; cadence `Select` when Premium (create); persisted expiry + cadence in `localStorage`; `premiumBillingCadence` on create API body; invitation-focused copy.
+- `FormActions.module.scss`: `justify-content: flex-end`.
+- Extended **use-form-component** skill with FormActions footer alignment notes.
+
+#### Files Created/Modified
+
+- `apps/management-web/src/config/runtime-config.ts`
+- `apps/management-web/src/config/runtime-config-store.ts`
+- `apps/management-web/src/lib/createUserFormDefaults.ts`
+- `apps/management-web/src/components/users/UserForm.tsx`
+- `apps/management-web/sidecar/src/server.ts`
+- `apps/management-web/sidecar/.env.example`
+- `apps/management-web/i18n/originals/en-US.json`
+- `infra/k8s/base/management-web/source/management-web-sidecar.env`
+- `packages/ui/src/components/form/FormActions/FormActions.module.scss`
+- `apps/management-web/e2e/users-new-super-admin-full-crud.spec.ts`
+- `.cursor/skills/use-form-component/SKILL.md`
+
+## Session 2 - 2026-05-04
+
+#### Prompt (Developer)
+
+review the plan. is everything important finished? or did you missing anything? continue
+
+#### Key Decisions
+
+- Plan audit: prior Session 1 work matched the plan; Session 2 adds **reusable-components** notes for
+  management-web **FormActions** (right-aligned footer) and **Select** vs raw selects.
+
+#### Files Created/Modified
+
+- `.cursor/skills/reusable-components/SKILL.md`
+
+## Session 3 - 2026-05-05
+
+#### Prompt (Developer)
+
+complete that work
+
+#### Key Decisions
+
+- Canonical `PremiumBillingCadence` lives in `@metaboost/helpers`; ORM re-exports from helpers for `resolveDefaultMembershipExpiresAt`; `@metaboost/helpers-requests` CreateUserBody and management-web create-user defaults / UserForm use the shared type (removed duplicate UI-only alias).
+
+#### Files Created/Modified
+
+- `.llm/history/active/mgmt-create-user-ux/mgmt-create-user-ux-part-01.md`
+- `packages/helpers/src/membership/premiumBillingCadence.ts`
+- `packages/helpers/src/index.ts`
+- `packages/orm/src/lib/defaultMembershipExpiresAt.ts`
+- `packages/orm/src/index.ts`
+- `packages/orm/src/services/UserService.ts`
+- `packages/helpers-requests/src/types/management-user-types.ts`
+- `apps/management-web/src/lib/createUserFormDefaults.ts`
+- `apps/management-web/src/components/users/UserForm.tsx`
+
+## Session 4 - 2026-05-06
+
+#### Prompt (Developer)
+
+Consolidate create-user form helpers (Metaboost + Podverse parity)
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+
+- `toDateTimeLocalValue` in `@metaboost/helpers` now formats with **local** calendar fields (Podverse `toDatetimeLocalInputValue` parity), accepts `Date | number | string | null | undefined`, and returns `''` for invalid/nullish inputs; added `toDateTimeLocalValue.test.ts`.
+- Introduced `PRODUCT_MEMBERSHIP_DEFAULTS_FROM_ENV_FALLBACK` as single source for env-parse defaults and client `fallbackProductMembershipFromEnv`.
+- `createUserFormDefaults.ts`: removed duplicate `pad`/local formatter; uses shared `toDateTimeLocalValue`; kept app storage keys and `fallbackProductMembershipFromEnv` aligned with `ResolvedProductMembership`.
+
+#### Files Created/Modified
+
+- `packages/helpers/src/time/toDateTimeLocalValue.ts`
+- `packages/helpers/src/time/toDateTimeLocalValue.test.ts`
+- `packages/helpers/src/membership/productMembershipDefaultsFromEnv.ts`
+- `packages/helpers/src/index.ts`
+- `apps/management-web/src/lib/createUserFormDefaults.ts`
diff --git a/.llm/history/active/migrations-process/migrations-process-part-02.md b/.llm/history/active/migrations-process/migrations-process-part-02.md
index 876f780c..488a0100 100644
--- a/.llm/history/active/migrations-process/migrations-process-part-02.md
+++ b/.llm/history/active/migrations-process/migrations-process-part-02.md
@@ -737,12 +737,12 @@ as a matter of fact it seems like there may be many doc files that may be unneed
 ### Session 41 - 2026-04-28
 
 #### Prompt (Developer)
-for metaboost the default targetRevision for base k8s files should be staging. the "alpha" k8s files should be X.X.X-staging.N
+for metaboost the default targetRevision for base k8s files should be staging. the "alpha" k8s files should be X.Y.Z-staging.N
 
 #### Key Decisions
 - Set local/base Argo Application defaults to `targetRevision: staging`.
-- Set all alpha app-of-apps and child Application `targetRevision` values to `X.X.X-staging.N`.
-- Align alpha remote Kustomize base `?ref=` pins to `X.X.X-staging.N` for revision consistency.
+- Set all alpha app-of-apps and child Application `targetRevision` values to `X.Y.Z-staging.N`.
+- Align alpha remote Kustomize base `?ref=` pins to `X.Y.Z-staging.N` for revision consistency.
 
 #### Files Changed
 - .llm/history/active/migrations-process/migrations-process-part-02.md
@@ -766,7 +766,7 @@ for metaboost the default targetRevision for base k8s files should be staging. t
 - infra/k8s/alpha/web/kustomization.yaml
 
 #### Verification
-- `rg -n "targetRevision:|\?ref=" infra/k8s/alpha infra/k8s/local-application.yaml infra/k8s/argocd/metaboost-local-stack-application.yaml infra/k8s/INFRA-K8S.md` shows local/base `targetRevision: staging` and alpha `targetRevision`/`?ref=` values set to `X.X.X-staging.N`.
+- `rg -n "targetRevision:|\?ref=" infra/k8s/alpha infra/k8s/local-application.yaml infra/k8s/argocd/metaboost-local-stack-application.yaml infra/k8s/INFRA-K8S.md` shows local/base `targetRevision: staging` and alpha `targetRevision`/`?ref=` values set to `X.Y.Z-staging.N`.
 - `rg -n "6355dbb9fc9260f30afee6bc18c170f581a49065|targetRevision:\s*develop" infra/k8s` returns no matches.
 
 ### Session 42 - 2026-04-28
diff --git a/.llm/history/active/npm-overrides-cleanup/npm-overrides-cleanup-part-01.md b/.llm/history/active/npm-overrides-cleanup/npm-overrides-cleanup-part-01.md
new file mode 100644
index 00000000..1df057cb
--- /dev/null
+++ b/.llm/history/active/npm-overrides-cleanup/npm-overrides-cleanup-part-01.md
@@ -0,0 +1,29 @@
+# npm-overrides-cleanup
+
+**Started:** 2026-05-06  
+**Author:** Agent  
+**Context:** Implement Metaboost package.json overrides assessment plan.
+
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+Metaboost `package.json` overrides assessment
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+
+- Removed redundant **`punycode`** override; `uri-js` range `^2.1.0` still resolves to **2.3.1** (confirmed via `npm ls punycode` and lockfile).
+- Removed **`glob`** override; lockfile keeps single **glob@11.1.0** (patched for GHSA-5j98-mcp5-4vw2); `npm audit` shows no glob-related findings (only pre-existing **ip-address** / **express-rate-limit** moderates).
+- Kept **`postcss`** `^8.5.10` and **`uuid`** `^14.0.0` overrides per plan (Next PostCSS pin + GHSA-w5hq-g745-h8pq).
+- **`test:e2e:api`** failed after **`billing_domain_event`** migration because **`TRUNCATE ... RESTART IDENTITY`** requires sequence ownership; migrator-owned sequences blocked **`metaboost_app_read_write`**. Added **`REASSIGN OWNED BY`** migrator → read_write after app linear migrations in **[makefiles/local/Makefile.local.test.mk](/Users/mitcheldowney/repos/pv/metaboost/makefiles/local/Makefile.local.test.mk)** (test DB init only).
+
+#### Files Created/Modified
+
+- [package.json](/Users/mitcheldowney/repos/pv/metaboost/package.json)
+- [package-lock.json](/Users/mitcheldowney/repos/pv/metaboost/package-lock.json)
+- [makefiles/local/Makefile.local.test.mk](/Users/mitcheldowney/repos/pv/metaboost/makefiles/local/Makefile.local.test.mk)
+- [.llm/history/active/npm-overrides-cleanup/npm-overrides-cleanup-part-01.md](/Users/mitcheldowney/repos/pv/metaboost/.llm/history/active/npm-overrides-cleanup/npm-overrides-cleanup-part-01.md)
diff --git a/.llm/history/active/product-membership-metaboost-common/product-membership-metaboost-common-part-01.md b/.llm/history/active/product-membership-metaboost-common/product-membership-metaboost-common-part-01.md
new file mode 100644
index 00000000..3d46d466
--- /dev/null
+++ b/.llm/history/active/product-membership-metaboost-common/product-membership-metaboost-common-part-01.md
@@ -0,0 +1,28 @@
+### Session 1 - 2026-05-06
+
+#### Prompt (Developer)
+
+Metaboost: move `product-membership` to `alpha/common`
+
+Implement the plan as specified, it is attached for your reference. Do NOT edit the plan file itself.
+
+To-do's from the plan have already been created. Do not create them again. Mark them as in_progress as you work, starting with the first one. Don't stop until you have completed all the to-dos.
+
+#### Key Decisions
+
+- Compose `base/product-membership` only in `infra/k8s/alpha/common` with `namespace: metaboost-alpha`; remove
+  from `alpha/api` and `alpha/management-api`.
+- Update INFRA-K8S, INFRA-K8S-BASE, METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST, k8s SKILL, and env cross-comments.
+
+#### Files Modified
+
+- infra/k8s/alpha/common/kustomization.yaml
+- infra/k8s/alpha/api/kustomization.yaml
+- infra/k8s/alpha/management-api/kustomization.yaml
+- infra/k8s/INFRA-K8S.md
+- infra/k8s/INFRA-K8S-BASE.md
+- docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md
+- .cursor/skills/k8s/SKILL.md
+- infra/k8s/base/product-membership/source/product-membership-settings.env
+- infra/k8s/base/management-web/source/management-web-sidecar.env
+- .llm/history/active/product-membership-metaboost-common/product-membership-metaboost-common-part-01.md
diff --git a/.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md b/.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md
new file mode 100644
index 00000000..cc01a388
--- /dev/null
+++ b/.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md
@@ -0,0 +1,417 @@
+# vendor-agnostic-billing-foundation
+
+**Started:** 2026-05-04  
+**Author:** Cursor Agent  
+**Context:** Cross-repo plan set for vendor-agnostic billing, renewal cadence policy, and
+DB-backed product pricing governance.
+
+---
+
+### Session 1 - 2026-05-04
+
+#### Prompt (Developer)
+
+create and save the plan files locally
+
+#### Key Decisions
+
+- Create and save local deferred plan sets under `.llm/plans/active/` for Podverse and Metaboost.
+- Keep plan content future-focused and provider-agnostic with DB-first pricing governance.
+- Include phased execution files: `00-SUMMARY.md`, `00-EXECUTION-ORDER.md`, numbered plan files,
+  and `COPY-PASTA.md`.
+
+#### Files Created/Modified
+
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-SUMMARY.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/01-domain-and-period-policy.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/02-pricing-catalog-and-schema.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/03-services-api-and-orchestration.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+
+### Session 2 - 2026-05-05
+
+#### Prompt (Developer)
+
+update the high level plan, and also break the plans into subplans if you think it should have
+multiple plans instead of doing all the changes in one pass, and look for gaps and try to
+addrees them if you think you can
+
+#### Key Decisions
+
+- Reworked the high-level plan into a strict multi-phase model with explicit in-scope/out-of-scope
+  guardrails so billing alignment cannot drift into unrelated domains.
+- Split the billing foundation into four execution bundles (policy, schema/bootstrap, runtime API,
+  and governance/verification) and added missing numbered subplans.
+- Added a gap-closure pass in planning to explicitly cover membership settings source-of-truth,
+  idempotency contracts, retry/backoff acceptance coverage, pricing permission rollout criteria,
+  and read-model field stability.
+
+#### Files Created/Modified
+
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-SUMMARY.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/04-membership-settings-bootstrap.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/05-management-pricing-governance.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/06-public-api-billing-read-models.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/07-tests-and-rollout-verification.md`
+
+### Session 3 - 2026-05-05
+
+#### Prompt (Developer)
+
+@metaboost/.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md:7-8
+
+#### Key Decisions
+
+- Executed plan **01 — Domain and Period Policy**: centralized membership period math in
+  `@metaboost/helpers` (`membershipPeriodPolicy`, `billingDomain` types), wired ORM default expiry
+  and management-web create-user defaults through `resolveInitialMembershipExpiresAt`.
+- Fixed `addMonths` to use end-of-month calendar clamping (Jan 31 + 1 month → Feb end) so renewal
+  math matches month-safe billing policy.
+- Moved completed plan file to `.llm/plans/completed/vendor-agnostic-billing-foundation/` and
+  refreshed `COPY-PASTA`, `00-EXECUTION-ORDER`, and `00-SUMMARY` links.
+
+#### Files Created/Modified
+
+- `packages/helpers/src/membership/billingDomain.ts`
+- `packages/helpers/src/membership/membershipPeriodPolicy.ts`
+- `packages/helpers/src/membership/membershipPeriodPolicy.test.ts`
+- `packages/helpers/src/time/addMonths.ts`
+- `packages/helpers/src/time/addMonths.test.ts`
+- `packages/helpers/src/index.ts`
+- `packages/orm/src/lib/defaultMembershipExpiresAt.ts`
+- `apps/management-web/src/lib/createUserFormDefaults.ts`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/01-domain-and-period-policy.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-SUMMARY.md`
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
+
+### Session 4 - 2026-05-05
+
+#### Prompt (Developer)
+
+Execute `.llm/plans/active/vendor-agnostic-billing-foundation/02-pricing-catalog-and-schema.md`
+exactly as written. Use DB as pricing source-of-truth with env bootstrap fallback only.
+
+#### Key Decisions
+
+- Finished wiring **`billingPricesCrud`** through **`@metaboost/helpers-requests`** admin role types,
+  management-api OpenAPI, management-web permission types and **`main-nav`** CRUD keys, **`AdminForm`**
+  / **`AdminRoleForm`** (display + create payloads), i18n, E2E **`advancedFixtures`**, **`generate-data`**
+  **`CrudMatrix`**, and **`management-admin-roles`** integration expectations.
+- Fixed **`UserService`** trust upsert typing for **`autoRenewMode`** (`'off' | 'on'`) so **`@metaboost/orm`** builds.
+- Made linear migration seeds **deterministic** for baseline verification: fixed **`effective_from`** /
+  membership-settings timestamps in **`0006_billing_catalog_and_trust_renewal.sql`**, explicit bootstrap
+  **`terms_version.id`** in **`0003_terms_default_seed.sql`**. Regenerated **`0003a`** / **`0003b`** gz and
+  confirmed **`make db_verify_linear_baseline`** passes.
+- Moved **`02-pricing-catalog-and-schema.md`** to **`completed/`** and refreshed **`COPY-PASTA`**,
+  **`00-EXECUTION-ORDER`**, **`00-SUMMARY`** (next COPY-PASTA prompt is membership settings bootstrap).
+
+#### Files Created/Modified
+
+- `packages/helpers-requests/src/management-web/adminRoles.ts`
+- `apps/management-api/src/openapi.ts`
+- `apps/management-web/src/types/management-api.ts`
+- `apps/management-web/src/lib/main-nav.ts`
+- `packages/orm/src/index.ts`
+- `packages/orm/src/services/UserService.ts`
+- `apps/management-web/src/components/admins/AdminForm.tsx`
+- `apps/management-web/src/components/admins/AdminRoleForm.tsx`
+- `apps/management-web/i18n/originals/en-US.json`
+- `apps/management-web/i18n/originals/es.json`
+- `apps/management-web/i18n/overrides/es.json`
+- `apps/management-web/e2e/helpers/advancedFixtures.ts`
+- `apps/management-api/src/test/management-admin-roles.test.ts`
+- `tools/generate-data/src/types.ts`
+- `tools/generate-data/src/management/seed.ts`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0006_billing_catalog_and_trust_renewal.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0003_terms_default_seed.sql`
+- `infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz`
+- `infra/k8s/base/db/source/bootstrap/0003b_management_linear_baseline.sql.gz`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/02-pricing-catalog-and-schema.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-SUMMARY.md`
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
+- (plus ESLint auto-fixes from `npm run lint:fix` on touched billing/admin-related modules)
+
+### Session 5 - 2026-05-05
+
+#### Prompt (Developer)
+
+Execute `.llm/plans/active/vendor-agnostic-billing-foundation/04-membership-settings-bootstrap.md`
+exactly as written. Keep product settings canonical, DB-first, and idempotently seeded.
+
+#### Key Decisions
+
+- Introduced **`ProductMembershipSettingsService`** (singleton row `id = 1`, env bootstrap via `ON CONFLICT DO NOTHING`) and refactored **`BillingPriceCatalogService`** to use it for trial resolution.
+- **`GET /product/membership`** now returns **`BillingPriceCatalogService.resolveProductMembership()`** so responses are DB-first, not raw env.
+- **Startup bootstrap**: **`resolveProductMembership`** runs after DB init in **api** and **management-api** `index.ts`, and in **api** / **management-api** test app helpers so seeding is idempotent before requests.
+- **OpenAPI**, **`productMembershipDefaultsFromEnv`** docs, **env templates**, **`.env.example`**, and **startup validation** category strings updated to describe bootstrap vs runtime reads.
+- Archived **`04-membership-settings-bootstrap.md`** to **`completed/`** and refreshed **COPY-PASTA**, **00-EXECUTION-ORDER**, **00-SUMMARY**.
+
+#### Files Created/Modified
+
+- `packages/orm/src/services/productMembershipSettings.ts`
+- `packages/orm/src/services/billingPriceCatalog.ts`
+- `packages/orm/src/index.ts`
+- `apps/management-api/src/routes/product.ts`
+- `apps/management-api/src/index.ts`
+- `apps/api/src/index.ts`
+- `apps/management-api/src/test/helpers/setup.ts`
+- `apps/api/src/test/helpers/setup.ts`
+- `apps/management-api/src/openapi.ts`
+- `packages/helpers/src/membership/productMembershipDefaultsFromEnv.ts`
+- `apps/api/src/lib/startup/validation.ts`
+- `apps/management-api/src/lib/startup/validation.ts`
+- `infra/config/env-templates/api.env.example`
+- `infra/config/env-templates/management-api.env.example`
+- `apps/api/.env.example`
+- `apps/management-api/.env.example`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/04-membership-settings-bootstrap.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-SUMMARY.md`
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
+
+### Session 6 - 2026-05-05
+
+#### Prompt (Developer)
+
+Execute `.llm/plans/active/vendor-agnostic-billing-foundation/03-services-api-and-orchestration.md`
+exactly as written. Keep the adapter boundary vendor-agnostic and include required tests.
+
+#### Key Decisions
+
+- Added linear migration **`0007_billing_domain_events.sql`**, **`billing_domain_event`** entity, and
+  **`BillingDomainEventLogService`** for normalized domain events.
+- Implemented **`MembershipPeriodExtensionService`** (idempotent, delegates expiry math to
+  **`extendMembershipPeriodByCadence`**), **`BillingRenewalOrchestratorService`** with
+  **`BillingRenewalProviderAdapter`** + **`createStubBillingRenewalProviderAdapter`** in **`@metaboost/helpers`**,
+  and **`BillingPriceGovernanceService`** for audited price schedule/deprecate.
+- **Management API**: **`GET/POST /billing-prices`**, **`POST /billing-prices/:id/deprecate`** with
+  **`requireCrud('billingPrices', …)`**, Joi schemas, OpenAPI updates.
+- **Main API**: **`GET /auth/billing/membership-summary`** for client-safe trust + catalog read model.
+- **Ops**: root script **`npm run billing:process-due-renewals`**, updated **`API_EXPECTED_MIGRATION_FILENAME`**,
+  Kustomize migration wiring, regenerated **`0003a`/`0003b`** linear baseline **`.sql.gz`**.
+- Integration tests: **`billing-prices.test.ts`**, **`billing-membership-summary.test.ts`**,
+  **`billing-renewal-orchestrator.test.ts`**.
+- Archived plan **`03-services-api-and-orchestration.md`** to **`completed/`**; updated **COPY-PASTA** and
+  **`00-EXECUTION-ORDER.md`**.
+
+#### Files Created/Modified
+
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0007_billing_domain_events.sql`
+- `infra/k8s/base/ops/kustomization.yaml`
+- `infra/k8s/base/api/source/api.env`
+- `infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz`
+- `infra/k8s/base/db/source/bootstrap/0003b_management_linear_baseline.sql.gz`
+- `packages/helpers/src/membership/billingDomainEvents.ts`
+- `packages/helpers/src/membership/billingRenewalAdapter.ts`
+- `packages/helpers/src/index.ts`
+- `packages/orm/src/entities/BillingDomainEvent.ts`
+- `packages/orm/src/data-source.ts`
+- `packages/orm/src/services/billingDomainEventLog.ts`
+- `packages/orm/src/services/membershipPeriodExtension.ts`
+- `packages/orm/src/services/billingRenewalOrchestrator.ts`
+- `packages/orm/src/services/billingPriceGovernance.ts`
+- `packages/orm/src/index.ts`
+- `apps/management-api/src/schemas/billingPrices.ts`
+- `apps/management-api/src/controllers/billingPricesController.ts`
+- `apps/management-api/src/routes/billingPrices.ts`
+- `apps/management-api/src/app.ts`
+- `apps/management-api/src/openapi.ts`
+- `apps/management-api/src/test/billing-prices.test.ts`
+- `apps/api/src/controllers/billingController.ts`
+- `apps/api/src/routes/auth.ts`
+- `apps/api/src/test/billing-membership-summary.test.ts`
+- `apps/api/src/test/billing-renewal-orchestrator.test.ts`
+- `scripts/api/process-due-renewals.mjs`
+- `package.json`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/03-services-api-and-orchestration.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
+
+### Session 7 - 2026-05-05
+
+#### Prompt (Developer)
+
+Execute `.llm/plans/active/vendor-agnostic-billing-foundation/06-public-api-billing-read-models.md`
+exactly as written. Keep payloads stable, client-safe, and product-neutral.
+
+#### Key Decisions
+
+- Added **`@metaboost/helpers`** contracts: **`PublicProductMembershipReadModelData`**,
+  **`AuthenticatedBillingMembershipReadModelData`**, **`BILLING_LIST_PRICE_CURRENCY_CODE`**, with explicit
+  **`*Iso`** timestamp field names in the authenticated model.
+- **Public** **`GET /product/membership`**: DB-first defaults + **`selfServePublicSignupOpen`** (signup-gated
+  behavior for anonymous clients) via **`buildPublicProductMembershipReadModel`**.
+- **Authenticated** **`GET /auth/billing/membership-summary`**: nested **`membership`**, **`renewal`**, **`catalog`**
+  (replaces flat shape); serialization in **`apps/api/src/lib/billingReadModelSerialization.ts`**.
+- **`@metaboost/helpers-requests`**: **`webProduct.getPublicProductMembership`**, **`getBillingMembershipSummary`**
+  and type re-exports.
+- **OpenAPI**: **`ResolvedProductMembership`**, public + authenticated response schemas, new paths.
+- **Tests**: **`product-membership.test.ts`**, updated **`billing-membership-summary.test.ts`**.
+- Archived **`06-public-api-billing-read-models.md`** to **`completed/`**; updated **COPY-PASTA** and
+  **`00-EXECUTION-ORDER.md`**.
+
+#### Files Created/Modified
+
+- `packages/helpers/src/membership/billingReadModelTypes.ts`
+- `packages/helpers/src/index.ts`
+- `packages/helpers-requests/src/types/billing-read-model-types.ts`
+- `packages/helpers-requests/src/types/index.ts`
+- `packages/helpers-requests/src/web/product.ts`
+- `packages/helpers-requests/src/index.ts`
+- `apps/api/src/lib/billingReadModelSerialization.ts`
+- `apps/api/src/controllers/productController.ts`
+- `apps/api/src/controllers/billingController.ts`
+- `apps/api/src/routes/product.ts`
+- `apps/api/src/app.ts`
+- `apps/api/src/openapi.ts`
+- `apps/api/src/test/product-membership.test.ts`
+- `apps/api/src/test/billing-membership-summary.test.ts`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/06-public-api-billing-read-models.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
+
+### Session 7 - 2026-05-05
+
+#### Prompt (Developer)
+
+Execute `.llm/plans/active/vendor-agnostic-billing-foundation/06-public-api-billing-read-models.md`
+exactly as written. Keep payloads stable, client-safe, and product-neutral.
+
+#### Key Decisions
+
+- Added **`@metaboost/helpers`** contracts: **`PublicProductMembershipReadModelData`**,
+  **`AuthenticatedBillingMembershipReadModelData`**, **`BILLING_LIST_PRICE_CURRENCY_CODE`**, with explicit
+  **`*Iso`** timestamp field names in the authenticated model.
+- **Public** **`GET /product/membership`**: DB-first defaults + **`selfServePublicSignupOpen`** (signup-gated
+  behavior for anonymous clients) via **`buildPublicProductMembershipReadModel`**.
+- **Authenticated** **`GET /auth/billing/membership-summary`**: nested **`membership`**, **`renewal`**, **`catalog`**
+  (replaces flat shape); serialization in **`apps/api/src/lib/billingReadModelSerialization.ts`**.
+- **`@metaboost/helpers-requests`**: **`webProduct.getPublicProductMembership`**, **`getBillingMembershipSummary`**
+  and type re-exports.
+- **OpenAPI**: **`ResolvedProductMembership`**, public + authenticated response schemas, new paths.
+- **Tests**: **`product-membership.test.ts`**, updated **`billing-membership-summary.test.ts`**.
+- Archived **`06-public-api-billing-read-models.md`** to **`completed/`**; updated **COPY-PASTA** and
+  **`00-EXECUTION-ORDER.md`**.
+
+#### Files Created/Modified
+
+- `packages/helpers/src/membership/billingReadModelTypes.ts`
+- `packages/helpers/src/index.ts`
+- `packages/helpers-requests/src/types/billing-read-model-types.ts`
+- `packages/helpers-requests/src/types/index.ts`
+- `packages/helpers-requests/src/web/product.ts`
+- `packages/helpers-requests/src/index.ts`
+- `apps/api/src/lib/billingReadModelSerialization.ts`
+- `apps/api/src/controllers/productController.ts`
+- `apps/api/src/controllers/billingController.ts`
+- `apps/api/src/routes/product.ts`
+- `apps/api/src/app.ts`
+- `apps/api/src/openapi.ts`
+- `apps/api/src/test/product-membership.test.ts`
+- `apps/api/src/test/billing-membership-summary.test.ts`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/06-public-api-billing-read-models.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
+
+### Session 8 - 2026-05-05
+
+#### Prompt (Developer)
+
+Execute `.llm/plans/active/vendor-agnostic-billing-foundation/05-management-pricing-governance.md`
+exactly as written. Keep management-web scope billing-adjacent only.
+
+#### Key Decisions
+
+- ORM: `BillingPriceGovernanceService.listPriceWindows` and `listPriceChangeAudit` for governance UI and API.
+- Management API: `GET /billing-prices/windows`, `GET /billing-prices/audit`; `GET /product/membership` guarded by `billingPrices` read (not super-admin-only).
+- Management-web: `/products/membership` with defaults, windows table, audit table, schedule + deprecate flows (CRUD-gated).
+- Archived plan `05-management-pricing-governance.md` to `completed/`; updated COPY-PASTA and execution order.
+
+#### Files Created/Modified
+
+- `packages/orm/src/services/billingPriceGovernance.ts`
+- `packages/orm/src/index.ts`
+- `packages/helpers-requests/src/management-web/billingPrices.ts`
+- `packages/helpers-requests/src/management-web/productMembershipDefaults.ts`
+- `packages/helpers-requests/src/index.ts`
+- `apps/management-api/src/app.ts`
+- `apps/management-api/src/controllers/billingPricesController.ts`
+- `apps/management-api/src/routes/billingPrices.ts`
+- `apps/management-api/src/routes/product.ts`
+- `apps/management-api/src/openapi.ts`
+- `apps/management-api/src/test/billing-prices.test.ts`
+- `apps/management-web/src/lib/routes.ts`
+- `apps/management-web/src/lib/main-nav.ts`
+- `apps/management-web/src/app/(main)/dashboard/page.tsx`
+- `apps/management-web/src/app/(main)/products/membership/page.tsx`
+- `apps/management-web/src/app/(main)/products/membership/ProductsMembershipClient.tsx`
+- `apps/management-web/i18n/originals/en-US.json`
+- `apps/management-web/i18n/originals/es.json`
+- `apps/management-web/e2e/products-membership-billing.spec.ts`
+- `apps/management-web/e2e/dashboard-super-admin-full-crud.spec.ts`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/05-management-pricing-governance.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- ESLint/Prettier fixes on other touched repo files to keep `npm run lint` green.
+
+### Session 9 - 2026-05-05
+
+#### Prompt (Developer)
+
+Execute `.llm/plans/active/vendor-agnostic-billing-foundation/07-tests-and-rollout-verification.md`
+exactly as written. Do not mark complete unless all acceptance gates pass.
+
+#### Key Decisions
+
+- API integration: `MembershipPeriodExtensionService` idempotency (`membership-period-extension.test.ts`); renewal lookahead exclusion + failing-adapter retry/event logging (`billing-renewal-orchestrator.test.ts`).
+- Management API: 403 boundaries for admins without billing read; billing reader denied POST schedule/deprecate (`billing-prices.test.ts`).
+- Added `ROLLOUT-CHECKLIST.md` under completed plan set; consolidated `00-EXECUTION-ORDER.md` to completed; archived `07-tests-and-rollout-verification.md`; simplified active `COPY-PASTA.md`.
+- Acceptance: `npm run lint` passes repo-wide. `npm run test:e2e:api` did not complete in agent environment (Postgres truncate / sequence ownership); run locally after `make test_deps` with correct DB owner grants or in CI.
+
+#### Files Created/Modified
+
+- `apps/api/src/test/membership-period-extension.test.ts`
+- `apps/api/src/test/billing-renewal-orchestrator.test.ts`
+- `apps/management-api/src/test/billing-prices.test.ts`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/ROLLOUT-CHECKLIST.md`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/07-tests-and-rollout-verification.md`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
+
+### Session 10 - 2026-05-06
+
+#### Prompt (Developer)
+
+if these two are done they should be moved to completed
+
+#### Key Decisions
+
+- Confirmed vendor-agnostic billing plan set is complete (numbered artifacts already under
+  `completed/`); moved `00-SUMMARY.md` and `COPY-PASTA.md` from active to
+  `completed/vendor-agnostic-billing-foundation/`.
+- Updated `00-SUMMARY.md` plan links to sibling `./…` paths and marked all seven prompts completed.
+- Added `00-SUMMARY.md` to the “Also” section of `00-EXECUTION-ORDER.md` for navigation.
+- Removed empty `.llm/plans/active/vendor-agnostic-billing-foundation/` directory.
+
+#### Files Created/Modified
+
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/00-SUMMARY.md`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md`
+- Deleted `.llm/plans/active/vendor-agnostic-billing-foundation/00-SUMMARY.md`
+- Deleted `.llm/plans/active/vendor-agnostic-billing-foundation/COPY-PASTA.md`
+- `.llm/history/active/vendor-agnostic-billing-foundation/vendor-agnostic-billing-foundation-part-01.md`
diff --git a/.llm/history/active/web-api-rollout-gating/web-api-rollout-gating-part-01.md b/.llm/history/active/web-api-rollout-gating/web-api-rollout-gating-part-01.md
index 6b57dc7e..7dc420f7 100644
--- a/.llm/history/active/web-api-rollout-gating/web-api-rollout-gating-part-01.md
+++ b/.llm/history/active/web-api-rollout-gating/web-api-rollout-gating-part-01.md
@@ -64,11 +64,11 @@ you stalled. continue
 
 across all example files and base env files use this as an example version
 
-X.X.X-staging.N
+X.Y.Z-staging.N
 
 #### Key Decisions
 
-- Standardized placeholder release strings in app `.env.example`, `infra/config/env-templates/*.env.example`, and `infra/k8s/base/**/source/*.env` to literal `X.X.X-staging.N`.
+- Standardized placeholder release strings in app `.env.example`, `infra/config/env-templates/*.env.example`, and `infra/k8s/base/**/source/*.env` to literal `X.Y.Z-staging.N`.
 - Left GitOps live alpha env pins unchanged so they continue to match real `?ref=` / image tags for CI.
 
 #### Files Modified
diff --git a/.llm/history/completed/LLM-HISTORY-COMPLETED.md b/.llm/history/completed/LLM-HISTORY-COMPLETED.md
new file mode 100644
index 00000000..edf66d1b
--- /dev/null
+++ b/.llm/history/completed/LLM-HISTORY-COMPLETED.md
@@ -0,0 +1,7 @@
+# `.llm/history/completed/`
+
+Archived feature history moved from `history/active/` (manually or by GitHub Actions).
+
+- Folders may be grouped under `completed/YYYY-MM/` after automation runs.
+- Read-only archive for operators; do not treat as agent instruction source.
+- See [LLM.md](../../LLM.md).
diff --git a/.llm/plans/active/LLM-PLANS-ACTIVE.md b/.llm/plans/active/LLM-PLANS-ACTIVE.md
new file mode 100644
index 00000000..4c0959e3
--- /dev/null
+++ b/.llm/plans/active/LLM-PLANS-ACTIVE.md
@@ -0,0 +1,10 @@
+# `.llm/plans/active/`
+
+In-progress multi-step plan sets (one directory per feature or initiative). **Not** `.llm/templates/` — templates are blanks; this directory holds real plan instances.
+
+- Keep each plan file under 300 lines; split into numbered files when larger.
+- Use `00-EXECUTION-ORDER.md`, `COPY-PASTA.md`, and numbered plans per **plan-files-convention** skill.
+- When executing a set, follow **plan-execution-completion-tracking** rule: mark COPY-PASTA prompts done,
+  move each finished `NN-*.md` to `completed/<set>/`, then move the whole set to `plans/completed/`
+  when all prompts are complete.
+- See [LLM.md](/.llm/LLM.md).
diff --git a/.llm/plans/active/custom-css-remote-file-operator-themes/00-EXECUTION-ORDER.md b/.llm/plans/active/custom-css-remote-file-operator-themes/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..32beeb43
--- /dev/null
+++ b/.llm/plans/active/custom-css-remote-file-operator-themes/00-EXECUTION-ORDER.md
@@ -0,0 +1,18 @@
+# Execution order — Metaboost mirror (deferred)
+
+## Order
+
+1. [01-contract-parity.md](./01-contract-parity.md)
+2. [02-metaboost-runtime-and-theme-system.md](./02-metaboost-runtime-and-theme-system.md)
+3. [03-metaboost-e2e-matrix.md](./03-metaboost-e2e-matrix.md)
+4. [04-abcmemory-and-doc-sync.md](./04-abcmemory-and-doc-sync.md)
+
+## Note
+
+This mirror is intentionally deferred; execute only when Metaboost implementation is scheduled.
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule: mark each prompt `[x]` in `COPY-PASTA.md`, move
+each finished `NN-*.md` to `.llm/plans/completed/custom-css-remote-file-operator-themes/`, then move
+the whole set when all four plans are done.
diff --git a/.llm/plans/active/custom-css-remote-file-operator-themes/00-SUMMARY.md b/.llm/plans/active/custom-css-remote-file-operator-themes/00-SUMMARY.md
new file mode 100644
index 00000000..f4e015a6
--- /dev/null
+++ b/.llm/plans/active/custom-css-remote-file-operator-themes/00-SUMMARY.md
@@ -0,0 +1,22 @@
+# Metaboost mirror plan — operator remote custom themes
+
+## Status
+
+Deferred mirror plan set for cross-repo alignment with Podverse custom remote theme work.
+
+## Source plan set
+
+Primary coordinating plan set lives in:
+
+- `/Users/mitcheldowney/repos/pv/podverse-custom-css-remote-file/.llm/plans/active/custom-css-remote-file-operator-themes`
+
+## Locked behavior
+
+- Allow remote URL from `https://*` plus local HTTP only (`http://localhost`, `http://127.0.0.1`).
+- If custom file resolves, first custom theme is default and `NEXT_PUBLIC_DEFAULT_THEME` is ignored.
+- If custom URL is set but fetch/validation fails, fall back to built-in theme behavior and normal `NEXT_PUBLIC_DEFAULT_THEME` handling.
+- Include test-assets fixture(s) for local HTTP serving and E2E.
+
+## Deferred execution note
+
+Do not execute implementation from this mirror plan set until explicitly scheduled. Keep this set synchronized with the Podverse coordinating plan.
diff --git a/.llm/plans/active/custom-css-remote-file-operator-themes/01-contract-parity.md b/.llm/plans/active/custom-css-remote-file-operator-themes/01-contract-parity.md
new file mode 100644
index 00000000..d3e38f73
--- /dev/null
+++ b/.llm/plans/active/custom-css-remote-file-operator-themes/01-contract-parity.md
@@ -0,0 +1,12 @@
+# 01 — Contract parity
+
+## Objective
+
+Mirror the shared remote custom-theme contract and behavior rules from the coordinating Podverse plan set.
+
+## Must match exactly
+
+- URL policy: allow `https://*` plus local dev HTTP (`http://localhost`, `http://127.0.0.1`).
+- Precedence: when custom file resolves, first custom theme is default and `NEXT_PUBLIC_DEFAULT_THEME` is ignored.
+- Failure behavior: if custom URL is set but fetch/validation fails, fall back to built-in themes and normal `NEXT_PUBLIC_DEFAULT_THEME`.
+- Include test-assets fixture(s) for local HTTP serving and E2E.
diff --git a/.llm/plans/active/custom-css-remote-file-operator-themes/02-metaboost-runtime-and-theme-system.md b/.llm/plans/active/custom-css-remote-file-operator-themes/02-metaboost-runtime-and-theme-system.md
new file mode 100644
index 00000000..f07d1893
--- /dev/null
+++ b/.llm/plans/active/custom-css-remote-file-operator-themes/02-metaboost-runtime-and-theme-system.md
@@ -0,0 +1,13 @@
+# 02 — Metaboost runtime and theme system
+
+## Objective
+
+Plan Metaboost implementation details for custom remote themes.
+
+## Scope
+
+- Sidecar env/runtime-config wiring and validation.
+- Dynamic theme registry integration in UI/theme context/cookie parsing.
+- SSR first-render CSS-variable application (no FOUC).
+- Explicit `next.config` decision for remote loading strategy (document whether changes are required).
+- Test-assets fixture path and local HTTP serving plan.
diff --git a/.llm/plans/active/custom-css-remote-file-operator-themes/03-metaboost-e2e-matrix.md b/.llm/plans/active/custom-css-remote-file-operator-themes/03-metaboost-e2e-matrix.md
new file mode 100644
index 00000000..11b7ba72
--- /dev/null
+++ b/.llm/plans/active/custom-css-remote-file-operator-themes/03-metaboost-e2e-matrix.md
@@ -0,0 +1,16 @@
+# 03 — Metaboost E2E matrix
+
+## Required matrix
+
+1. No custom theme file configured.
+2. Only custom theme file configured (no `NEXT_PUBLIC_SUPPORTED_THEMES` and no `NEXT_PUBLIC_DEFAULT_THEME`).
+3. Custom theme file with `NEXT_PUBLIC_SUPPORTED_THEMES` and `NEXT_PUBLIC_DEFAULT_THEME`.
+4. Custom URL configured but remote fetch fails or payload is invalid.
+
+## Assertions
+
+- Custom themes appear in selectors when custom file resolves.
+- First custom theme is default when custom file resolves.
+- `NEXT_PUBLIC_DEFAULT_THEME` is ignored only in resolved-custom mode.
+- Failure path restores built-in/default behavior.
+- First render shows expected theme values (no flash regression).
diff --git a/.llm/plans/active/custom-css-remote-file-operator-themes/04-abcmemory-and-doc-sync.md b/.llm/plans/active/custom-css-remote-file-operator-themes/04-abcmemory-and-doc-sync.md
new file mode 100644
index 00000000..6c7d4683
--- /dev/null
+++ b/.llm/plans/active/custom-css-remote-file-operator-themes/04-abcmemory-and-doc-sync.md
@@ -0,0 +1,11 @@
+# 04 — Abcmemory and doc sync
+
+## Objective
+
+Prevent drift between theme CSS variables, custom theme fixture files, and operator docs.
+
+## Tasks
+
+- Update best-fit `.cursor/` rule or skill to require fixture/doc updates whenever theme CSS variables change.
+- Point guidance at the exact maintained test-assets fixture file(s).
+- Ensure docs reference local HTTP fixture testing and operator deployment usage.
diff --git a/.llm/plans/active/custom-css-remote-file-operator-themes/COPY-PASTA.md b/.llm/plans/active/custom-css-remote-file-operator-themes/COPY-PASTA.md
new file mode 100644
index 00000000..9e180252
--- /dev/null
+++ b/.llm/plans/active/custom-css-remote-file-operator-themes/COPY-PASTA.md
@@ -0,0 +1,29 @@
+# COPY-PASTA prompts (deferred mirror)
+
+## Prompt 1 — Contract parity
+
+Execute `01-contract-parity.md` to ensure Metaboost contract and fallback semantics exactly match the coordinating Podverse plan.
+
+## Prompt 2 — Runtime and theme system
+
+Execute `02-metaboost-runtime-and-theme-system.md` for env/runtime-config wiring, dynamic registry, SSR no-FOUC, and `next.config` decision points.
+
+## Prompt 3 — E2E matrix
+
+Execute `03-metaboost-e2e-matrix.md` to cover all env combinations plus fetch/validation failure fallback.
+
+## Prompt 4 — Abcmemory/doc sync
+
+Execute `04-abcmemory-and-doc-sync.md` so example fixture and docs stay aligned with CSS variable changes.
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule and **plan-files-convention** skill:
+
+1. Mark each prompt `[x]` below when done.
+2. Move each finished `NN-*.md` to `.llm/plans/completed/custom-css-remote-file-operator-themes/`.
+3. When all four prompts are done, move the whole set:
+
+```bash
+mv .llm/plans/active/custom-css-remote-file-operator-themes .llm/plans/completed/
+```
diff --git a/.llm/plans/active/metaboost-podverse-alignment/.gitkeep b/.llm/plans/active/metaboost-podverse-alignment/.gitkeep
deleted file mode 100644
index e69de29b..00000000
diff --git a/.llm/plans/completed/LLM-PLANS-COMPLETED.md b/.llm/plans/completed/LLM-PLANS-COMPLETED.md
new file mode 100644
index 00000000..df9b5ed3
--- /dev/null
+++ b/.llm/plans/completed/LLM-PLANS-COMPLETED.md
@@ -0,0 +1,6 @@
+# `.llm/plans/completed/`
+
+Finished plan sets moved from `plans/active/`. Historical record of how large work was broken down and executed.
+
+- Do not start new active work here; create a new folder under `plans/active/`.
+- See **plan-files-convention** skill, **plan-execution-completion-tracking** rule, and [LLM.md](/.llm/LLM.md).
diff --git a/.llm/plans/completed/atomic-publish-version-reservation/00-EXECUTION-ORDER.md b/.llm/plans/completed/atomic-publish-version-reservation/00-EXECUTION-ORDER.md
index 01b359a9..6d2b7203 100644
--- a/.llm/plans/completed/atomic-publish-version-reservation/00-EXECUTION-ORDER.md
+++ b/.llm/plans/completed/atomic-publish-version-reservation/00-EXECUTION-ORDER.md
@@ -27,7 +27,7 @@ ones are removed in Phase 2 to keep the diff reviewable).
 
 ## Phase 3 — Documentation
 
-4. `04-docs-publish-update.md` — Update [docs/PUBLISH.md](../../../../docs/PUBLISH.md)
+4. `04-docs-publish-update.md` — Update [docs/PUBLISH.md](/docs/PUBLISH.md)
    to describe atomic reservation via Git ref API; clarify GHCR is image storage only.
 
 ## Phase 4 — Verify on a real run
diff --git a/.llm/plans/completed/atomic-publish-version-reservation/01-reserve-version-job.md b/.llm/plans/completed/atomic-publish-version-reservation/01-reserve-version-job.md
index 5f42e298..c8628873 100644
--- a/.llm/plans/completed/atomic-publish-version-reservation/01-reserve-version-job.md
+++ b/.llm/plans/completed/atomic-publish-version-reservation/01-reserve-version-job.md
@@ -2,7 +2,7 @@
 
 ## Scope
 
-Add a new job to [.github/workflows/publish-alpha.yml](../../../../.github/workflows/publish-alpha.yml)
+Add a new job to [.github/workflows/publish-staging.yml](/.github/workflows/publish-staging.yml)
 that atomically reserves the next publish version by creating
 `refs/tags/X.Y.Z-{suffix}.N` at the workflow commit. The job runs **after**
 `validate` and **before** `publish-docker`.
@@ -239,7 +239,7 @@ Same names the rest of the workflow consumes today:
 
 ## Key files
 
-- [.github/workflows/publish-alpha.yml](../../../../.github/workflows/publish-alpha.yml)
+- [.github/workflows/publish-staging.yml](/.github/workflows/publish-staging.yml)
 
 ## Verification (this step)
 
diff --git a/.llm/plans/completed/atomic-publish-version-reservation/02-rewire-needs-and-outputs.md b/.llm/plans/completed/atomic-publish-version-reservation/02-rewire-needs-and-outputs.md
index f92a5b5f..8cf74eb8 100644
--- a/.llm/plans/completed/atomic-publish-version-reservation/02-rewire-needs-and-outputs.md
+++ b/.llm/plans/completed/atomic-publish-version-reservation/02-rewire-needs-and-outputs.md
@@ -3,7 +3,7 @@
 ## Scope
 
 Repoint every downstream job in
-[.github/workflows/publish-alpha.yml](../../../../.github/workflows/publish-alpha.yml)
+[.github/workflows/publish-staging.yml](/.github/workflows/publish-staging.yml)
 that currently reads `needs.validate.outputs.{version,float_tag,is_prod}` so that it
 reads `needs.reserve-version.outputs.*` instead, and add `reserve-version` to each
 job's `needs:` list.
@@ -101,7 +101,7 @@ makes Phase 1 safe to ship without Phase 2.
 
 ## Key files
 
-- [.github/workflows/publish-alpha.yml](../../../../.github/workflows/publish-alpha.yml)
+- [.github/workflows/publish-staging.yml](/.github/workflows/publish-staging.yml)
 
 ## Verification (this step)
 
diff --git a/.llm/plans/completed/atomic-publish-version-reservation/03-remove-git-tag-staging-and-validate-version.md b/.llm/plans/completed/atomic-publish-version-reservation/03-remove-git-tag-staging-and-validate-version.md
index 62f967d6..b8cea610 100644
--- a/.llm/plans/completed/atomic-publish-version-reservation/03-remove-git-tag-staging-and-validate-version.md
+++ b/.llm/plans/completed/atomic-publish-version-reservation/03-remove-git-tag-staging-and-validate-version.md
@@ -3,7 +3,7 @@
 ## Scope
 
 After Phase 1 has been shipped and verified, clean up the legacy bits in
-[.github/workflows/publish-alpha.yml](../../../../.github/workflows/publish-alpha.yml):
+[.github/workflows/publish-staging.yml](/.github/workflows/publish-staging.yml):
 
 1. Delete the `git-tag-staging` job (its work is now done by `reserve-version`).
 2. Delete the `Calculate unified version` step from `validate` and remove
@@ -65,7 +65,7 @@ tag and the API is the source of truth.
 
 ## Key files
 
-- [.github/workflows/publish-alpha.yml](../../../../.github/workflows/publish-alpha.yml)
+- [.github/workflows/publish-staging.yml](/.github/workflows/publish-staging.yml)
 
 ## Verification (this step)
 
diff --git a/.llm/plans/completed/atomic-publish-version-reservation/04-docs-publish-update.md b/.llm/plans/completed/atomic-publish-version-reservation/04-docs-publish-update.md
index 0bb5014f..2812ed6b 100644
--- a/.llm/plans/completed/atomic-publish-version-reservation/04-docs-publish-update.md
+++ b/.llm/plans/completed/atomic-publish-version-reservation/04-docs-publish-update.md
@@ -3,7 +3,7 @@
 ## Scope
 
 Reflect the new atomic version reservation in
-[docs/PUBLISH.md](../../../../docs/PUBLISH.md). Specifically:
+[docs/PUBLISH.md](/docs/PUBLISH.md). Specifically:
 
 1. Replace any wording that says version `N` is auto-incremented from **GHCR tags**
    with wording that says it's reserved via the **GitHub Git Refs API** (atomic create).
@@ -69,8 +69,8 @@ and to this plan set for context.
 
 ## Key files
 
-- [docs/PUBLISH.md](../../../../docs/PUBLISH.md)
-- [.github/workflows/publish-alpha.yml](../../../../.github/workflows/publish-alpha.yml) (cross-reference only)
+- [docs/PUBLISH.md](/docs/PUBLISH.md)
+- [.github/workflows/publish-staging.yml](/.github/workflows/publish-staging.yml) (cross-reference only)
 
 ## Verification (this step)
 
diff --git a/.llm/plans/completed/atomic-publish-version-reservation/05-verification.md b/.llm/plans/completed/atomic-publish-version-reservation/05-verification.md
index c36140e0..291d52c6 100644
--- a/.llm/plans/completed/atomic-publish-version-reservation/05-verification.md
+++ b/.llm/plans/completed/atomic-publish-version-reservation/05-verification.md
@@ -65,4 +65,4 @@ resulting commit on `alpha`.
 
 When 1–8 are green and at least the "concurrent runs" negative test has been done
 (or you've decided to skip it), proceed to the podverse plan set:
-[`podverse/.llm/plans/active/ci-atomic-version-reservation/`](../../../../../podverse/.llm/plans/active/ci-atomic-version-reservation/00-EXECUTION-ORDER.md).
+`podverse/.llm/plans/active/ci-atomic-version-reservation/00-EXECUTION-ORDER.md` (sibling Podverse repo).
diff --git a/.llm/plans/completed/canonical-terms-bootstrap/00-SUMMARY.md b/.llm/plans/completed/canonical-terms-bootstrap/00-SUMMARY.md
index 0bce690f..658b33b2 100644
--- a/.llm/plans/completed/canonical-terms-bootstrap/00-SUMMARY.md
+++ b/.llm/plans/completed/canonical-terms-bootstrap/00-SUMMARY.md
@@ -2,9 +2,9 @@
 
 ## Problem
 
-- [`0008_seed_local_terms_version.sql`](../../../../infra/k8s/base/db/postgres-init/0008_seed_local_terms_version.sql) is mounted **only** in local Docker Compose.
-- K8s postgres-init ConfigMaps ([`infra/k8s/base/stack/kustomization.yaml`](../../../../infra/k8s/base/stack/kustomization.yaml), [`infra/k8s/base/db/kustomization.yaml`](../../../../infra/k8s/base/db/kustomization.yaml)) include **`0001`–`0006` only**.
-- A clean production cluster therefore creates schema but **no** `terms_version` row; [`TermsVersionService.assertConfiguredForStartup()`](../../../../packages/orm/src/services/TermsVersionService.ts) prevents API/management-api from starting until operators manually seed terms.
+- Legacy `0008_seed_local_terms_version.sql` under `postgres-init/` was mounted **only** in local Docker Compose (removed in favor of linear migrations).
+- K8s postgres-init ConfigMaps ([`/infra/k8s/base/db/kustomization.yaml`](/infra/k8s/base/db/kustomization.yaml)) use the current linear-migration bundle.
+- A clean production cluster therefore creates schema but **no** `terms_version` row; [`TermsVersionService.assertConfiguredForStartup()`](/packages/orm/src/services/TermsVersionService.ts) prevents API/management-api from starting until operators manually seed terms.
 
 ## Goal
 
@@ -15,7 +15,7 @@
 ## Decisions
 
 - **Neutral bootstrap row:** version_key/title/content_hash are placeholders; real legal lifecycle continues to be managed via migrations / operator process / `terms_version` tables.
-- **Timestamps:** align default `effective_at` / `enforcement_starts_at` with documented [`API_LATEST_TERMS_EFFECTIVE_AT`](../../../../apps/api/src/lib/startup/validation.ts) expectations (same baseline as current `0008`, e.g. `2026-01-01` UTC), unless product chooses a different canonical date—document the choice in the SQL comment.
+- **Timestamps:** align default `effective_at` / `enforcement_starts_at` with documented [`API_LATEST_TERMS_EFFECTIVE_AT`](/apps/api/src/lib/startup/validation.ts) expectations (same baseline as current `0008`, e.g. `2026-01-01` UTC), unless product chooses a different canonical date—document the choice in the SQL comment.
 - **Filename / ordering:** add as **`0007_*`** in canonical `postgres-init/` so K8s runs it immediately after `0006`. Renumber **local user** seed from `0007_seed_local_user.sql` → **`0008_seed_local_user.sql`** so lexicographic order stays: canonical terms first, then local dev user.
 
 ## Plan files
diff --git a/.llm/plans/completed/canonical-terms-bootstrap/01-infra-canonical-bootstrap.md b/.llm/plans/completed/canonical-terms-bootstrap/01-infra-canonical-bootstrap.md
index a1053f90..ff1258f3 100644
--- a/.llm/plans/completed/canonical-terms-bootstrap/01-infra-canonical-bootstrap.md
+++ b/.llm/plans/completed/canonical-terms-bootstrap/01-infra-canonical-bootstrap.md
@@ -9,7 +9,7 @@ Make the default **active** `terms_version` row part of **canonical** DB initial
 ### 1. Canonical SQL
 
 - Add **`infra/k8s/base/db/postgres-init/0007_default_terms_version.sql`** (new file).
-- Content: move/adapt the `INSERT` from existing [`0008_seed_local_terms_version.sql`](../../../../infra/k8s/base/db/postgres-init/0008_seed_local_terms_version.sql).
+- Content: move/adapt the `INSERT` from the legacy Docker-only `0008_seed_local_terms_version.sql` seed (removed; see linear migrations).
 - Header comments must state:
   - This runs on **first** Postgres init for **all** environments that use this bundle (not Docker-only).
   - Operators may supersede via migrations / terms lifecycle later.
@@ -19,17 +19,17 @@ Make the default **active** `terms_version` row part of **canonical** DB initial
 
 Update **both** generators so new SQL runs after `0006`:
 
-- [`infra/k8s/base/stack/kustomization.yaml`](../../../../infra/k8s/base/stack/kustomization.yaml) — under `configMapGenerator` → `metaboost-postgres-init` → `files:`, add:
+- [`/infra/k8s/base/db/kustomization.yaml`](/infra/k8s/base/db/kustomization.yaml) — under postgres-init `files:`, add:
   - `- ../db/postgres-init/0007_default_terms_version.sql`
   - Keep lexicographic order consistent with comments (place after `0006_management_grants.sh`).
-- [`infra/k8s/base/db/kustomization.yaml`](../../../../infra/k8s/base/db/kustomization.yaml) — under `metaboost-db-postgres-init`, add:
+- [`infra/k8s/base/db/kustomization.yaml`](/infra/k8s/base/db/kustomization.yaml) — under `metaboost-db-postgres-init`, add:
   - `- postgres-init/0007_default_terms_version.sql`
 
 Update inline comments that currently say **`0001`–`0006` only** if present.
 
 ### 3. Docker Compose (local)
 
-- [`infra/docker/local/docker-compose.yml`](../../../../infra/docker/local/docker-compose.yml):
+- [`infra/docker/local/docker-compose.yml`](/infra/docker/local/docker-compose.yml):
   - Mount **`0007_default_terms_version.sql`** to `docker-entrypoint-initdb.d/` with a filename that sorts **before** the local user seed (e.g. `0007_default_terms_version.sql`).
   - Rename **`0007_seed_local_user.sql`** → preserve behavior but **renumber file** to **`0008_seed_local_user.sql`** (filesystem + compose mount target).
   - **Remove** mount for **`0008_seed_local_terms_version.sql`** (superseded by canonical `0007`).
@@ -37,8 +37,8 @@ Update inline comments that currently say **`0001`–`0006` only** if present.
 
 ### 4. Docs
 
-- [`infra/docker/local/INFRA-DOCKER-LOCAL.md`](../../../../infra/docker/local/INFRA-DOCKER-LOCAL.md): describe init order as `0001`–`0007` (canonical terms), then **`0008_seed_local_user.sql`** (local-only user).
-- [`infra/k8s/INFRA-K8S.md`](../../../../infra/k8s/INFRA-K8S.md) (or relevant postgres-init section): note that **`0007_default_terms_version.sql`** is part of cluster bootstrap so API can satisfy `assertConfiguredForStartup`.
+- [`infra/docker/local/INFRA-DOCKER-LOCAL.md`](/infra/docker/local/INFRA-DOCKER-LOCAL.md): describe init order as `0001`–`0007` (canonical terms), then **`0008_seed_local_user.sql`** (local-only user).
+- [`infra/k8s/INFRA-K8S.md`](/infra/k8s/INFRA-K8S.md) (or relevant postgres-init section): note that **`0007_default_terms_version.sql`** is part of cluster bootstrap so API can satisfy `assertConfiguredForStartup`.
 
 ### 5. Verification scripts / CI
 
diff --git a/.llm/plans/completed/doc-link-path-missed-followup/00-SUMMARY.md b/.llm/plans/completed/doc-link-path-missed-followup/00-SUMMARY.md
new file mode 100644
index 00000000..21926315
--- /dev/null
+++ b/.llm/plans/completed/doc-link-path-missed-followup/00-SUMMARY.md
@@ -0,0 +1,10 @@
+# Missed doc links — follow-up (done)
+
+See Podverse `doc-link-path-missed-followup/00-SUMMARY.md` for full context. Metaboost steps 02–03 completed in this repo.
+
+## Verify
+
+```bash
+rg '\]\(\.\./' --glob '*.{md,mdc}' --glob '!.llm/history/**'
+node scripts/development/normalize-markdown-links.mjs --verify
+```
diff --git a/.llm/plans/completed/doc-link-path-missed-followup/02-metaboost-docs-wrong-paths.md b/.llm/plans/completed/doc-link-path-missed-followup/02-metaboost-docs-wrong-paths.md
new file mode 100644
index 00000000..bd427fb6
--- /dev/null
+++ b/.llm/plans/completed/doc-link-path-missed-followup/02-metaboost-docs-wrong-paths.md
@@ -0,0 +1,21 @@
+# 02 — Metaboost docs wrong-path fixes
+
+Script skipped these because resolved paths did not exist. Replace manually:
+
+| File | Current | Replace with |
+| --- | --- | --- |
+| `docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md` (×2) | `../development/ENV-REFERENCE.md` | `/docs/development/env/ENV-REFERENCE.md` |
+| `docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md` (×2) | same | same |
+| `docs/testing/E2E-PAGE-TESTING.md` | `../development/ENV-REFERENCE.md` | `/docs/development/env/ENV-REFERENCE.md` |
+| `docs/development/env/LOCAL-ENV-OVERRIDES.md` | `../QUICK-START.md` | `/docs/QUICK-START.md` |
+| `docs/development/tooling/LOCKFILE-LINUX.md` | `../QUICK-START.md` | `/docs/QUICK-START.md` |
+| `docs/development/security/SECURITY-REVIEW-CHECKLIST.md` | `../CURSOR-NIX-WITH-ENV.md` | `/docs/CURSOR-NIX-WITH-ENV.md` |
+| `infra/k8s/INFRA-K8S.md` | `../../docs/QUICKSTART.md` | `/docs/QUICK-START.md` |
+
+## Verify
+
+```bash
+rg '\]\(\.\./' docs/ infra/k8s/INFRA-K8S.md --glob '*.{md,mdc}'
+```
+
+Expected: no matches in these paths.
diff --git a/.llm/plans/completed/doc-link-path-missed-followup/03-metaboost-completed-plans-stale.md b/.llm/plans/completed/doc-link-path-missed-followup/03-metaboost-completed-plans-stale.md
new file mode 100644
index 00000000..4ed7a813
--- /dev/null
+++ b/.llm/plans/completed/doc-link-path-missed-followup/03-metaboost-completed-plans-stale.md
@@ -0,0 +1,33 @@
+# 03 — Metaboost completed plans (stale targets)
+
+Editorial fixes in archived plans — not auto-convertible.
+
+## atomic-publish-version-reservation (9 links)
+
+Replace `../../../../.github/workflows/publish-alpha.yml` with:
+
+`/github/workflows/publish-staging.yml` (or `publish-main.yml` if context is production).
+
+Add short note: `publish-alpha.yml` was renamed/removed.
+
+Files:
+
+- `01-reserve-version-job.md`
+- `02-rewire-needs-and-outputs.md`
+- `03-remove-git-tag-staging-and-validate-version.md`
+- `04-docs-publish-update.md`
+
+## canonical-terms-bootstrap (4 links)
+
+- `0008_seed_local_terms_version.sql` — map to current bootstrap/migration path under `infra/k8s/base/db/` or link `/cursor/skills/linear-db-migrations/SKILL.md` if file was removed.
+- `infra/k8s/base/stack/kustomization.yaml` — use `/infra/k8s/base/db/kustomization.yaml` or remove if obsolete.
+
+Files: `00-SUMMARY.md`, `01-infra-canonical-bootstrap.md`
+
+## tiered-import-specifiers (1 link)
+
+`05-documentation-skills-rules.md`: remove link to `../../../../.llm/exports/`; prose only (exports prohibited).
+
+## Cross-repo (1 link)
+
+`atomic-publish-version-reservation/05-verification.md`: replace markdown link to `podverse/.llm/...` with plain text (no in-repo href).
diff --git a/.llm/plans/completed/doc-link-path-missed-followup/04-verify-and-script-aliases.md b/.llm/plans/completed/doc-link-path-missed-followup/04-verify-and-script-aliases.md
new file mode 100644
index 00000000..ea2d3762
--- /dev/null
+++ b/.llm/plans/completed/doc-link-path-missed-followup/04-verify-and-script-aliases.md
@@ -0,0 +1,33 @@
+# 04 — Verify and optional script aliases
+
+## Verify both repos
+
+```bash
+# Podverse
+cd /path/to/podverse
+node scripts/development/normalize-markdown-links.mjs --verify
+rg '\]\(\.\./' --glob '*.{md,mdc}' --glob '!.llm/history/**'
+
+# Metaboost
+cd /path/to/metaboost
+node scripts/development/normalize-markdown-links.mjs --verify
+rg '\]\(\.\./' --glob '*.{md,mdc}' --glob '!.llm/history/**'
+```
+
+Expected: **0** matches outside `.llm/history/`.
+
+## Optional: extend normalize-markdown-links.mjs
+
+Add alias candidates in both repos:
+
+- `docs/development/ENV-REFERENCE.md` → `docs/development/env/ENV-REFERENCE.md`
+- `docs/QUICKSTART.md` → `docs/QUICK-START.md`
+- `docs/development/QUICK-START.md` → `docs/QUICK-START.md`
+- `docs/development/CURSOR-NIX-WITH-ENV.md` → `docs/CURSOR-NIX-WITH-ENV.md`
+- `.github/workflows/publish-alpha.yml` → `.github/workflows/publish-staging.yml` (only when documenting renames in plans)
+
+Re-run after Phases 01–03:
+
+```bash
+node scripts/development/normalize-markdown-links.mjs --write
+```
diff --git a/.llm/plans/completed/metaboost-abcmemory-align/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-abcmemory-align/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..b0c9e412
--- /dev/null
+++ b/.llm/plans/completed/metaboost-abcmemory-align/00-EXECUTION-ORDER.md
@@ -0,0 +1,15 @@
+# MetaBoost abcmemory align — Execution order
+
+## Phase 1 — Rules (sequential)
+
+1. `01-adopt-podverse-process-rules.md` — add missing Podverse process rules first.
+2. `02-port-drifted-shared-rules.md` — port drifted shared rules (depends on new rules existing for cross-refs).
+
+## Phase 2 — Skills + root config (parallel-safe)
+
+3. `03-port-drifted-shared-skills.md` — port drifted skills (parallel with 4).
+4. `04-align-cursorrules.md` — update `.cursorrules` (parallel with 3).
+
+**Wait for Phase 2 before moving this set to `completed/`.**
+
+When done: `mv .llm/plans/active/metaboost-abcmemory-align .llm/plans/completed/`
diff --git a/.llm/plans/completed/metaboost-abcmemory-align/00-SUMMARY.md b/.llm/plans/completed/metaboost-abcmemory-align/00-SUMMARY.md
new file mode 100644
index 00000000..90f2574e
--- /dev/null
+++ b/.llm/plans/completed/metaboost-abcmemory-align/00-SUMMARY.md
@@ -0,0 +1,34 @@
+# MetaBoost abcmemory align — Summary
+
+## Purpose
+
+Port and adopt Podverse (source of truth) `.cursor/` agent guidance into MetaBoost after triage Plan
+03 found structural parity (hooks/prompts) but **process-rule gaps** and **content drift** on shared
+rules/skills.
+
+## Scope
+
+- Adopt missing generic Podverse process rules (adapt repo names/paths).
+- Port drifted shared rules and skills from Podverse counterparts.
+- Update `.cursorrules` to include operator-only git and other Podverse LLM workflow sections.
+- **Keep** MetaBoost-only rules/skills (`api-no-pii-credentials`, `path-casing-imports`,
+  `single-readme`, `commands-from-metaboost-root`, `plan-execution-completion-tracking`).
+
+Out of scope: Podverse-product-specific rules (media player, lighthouse, workers, add-by-rss) —
+handled in Plan 09 `metaboost-podverse-parity-gaps`.
+
+## Plans
+
+| File | Focus |
+| --- | --- |
+| 01-adopt-podverse-process-rules.md | Add missing `.mdc` rules from Podverse |
+| 02-port-drifted-shared-rules.md | Sync shared rules that differ from Podverse |
+| 03-port-drifted-shared-skills.md | Sync shared skills; `@metaboost/*` path adaptation |
+| 04-align-cursorrules.md | Merge Podverse `.cursorrules` sections into MetaBoost |
+
+## Verification
+
+```bash
+diff <(ls /Users/mitcheldowney/repos/pv/metaboost/.cursor/rules | sort) <(ls /Users/mitcheldowney/repos/pv/podverse/.cursor/rules | sort)
+npm run lint
+```
diff --git a/.llm/plans/completed/metaboost-abcmemory-align/01-adopt-podverse-process-rules.md b/.llm/plans/completed/metaboost-abcmemory-align/01-adopt-podverse-process-rules.md
new file mode 100644
index 00000000..324831e0
--- /dev/null
+++ b/.llm/plans/completed/metaboost-abcmemory-align/01-adopt-podverse-process-rules.md
@@ -0,0 +1,46 @@
+# 01 — Adopt Podverse process rules
+
+## Scope
+
+Add MetaBoost copies of **generic** Podverse rules that triage Plan 03 marked PARITY-GAP. Source files
+live under `podverse/.cursor/rules/`. Adapt only repo-specific strings (`Podverse` → `Metaboost`,
+`@podverse/*` → `@metaboost/*`, doc paths).
+
+## Rules to add
+
+Copy from Podverse and adapt:
+
+| Podverse rule | Adapt notes |
+| --- | --- |
+| `operator-only-git-operations.mdc` | Change Publish workflow names to MetaBoost staging/main |
+| `documentation-updates.mdc` | Update doc path examples to MB tree |
+| `github-actions-yaml.mdc` | Reference MB `.github/workflows/` |
+| `test-timeout-budget.mdc` | MB make/e2e targets |
+| `startup-validation-env-order.mdc` | MB app validation scripts paths |
+| `config-type-safety.mdc` | MB `apps/*/src/config` layout |
+| `build-order-doc-sync.mdc` | MB package build order |
+| `infra-k8s.mdc` | MB `infra/k8s/` paths |
+| `plan-lifecycle.mdc` | **Reconcile** with existing `plan-execution-completion-tracking.mdc` — merge into one always-applied rule or cross-link; do not duplicate conflicting guidance |
+| `openapi-sync.mdc` | Cross-link MB `swagger-openapi` skill; avoid duplicate OpenAPI policy |
+| `shared-ui-i18n.mdc` | `@metaboost/ui`; apps `web` + `management-web` |
+| `prefer-shared-ui-web-management.mdc` | Same adaptation |
+
+## Do not add (N/A for MetaBoost)
+
+Podverse-product-specific: `extensions-env`, `custom-themes-operator-sample-sync`,
+`e2e-seed-id-text-limits`, `font-preloads-route-aware`, `navbar-sticky-chrome`,
+`management-web-form-eyebrow`, `management-web-tables`, `linear-baseline-0003` (MB uses
+`linear-baseline-gz-sync` skill instead — note in `infra-k8s` cross-ref).
+
+## Steps
+
+1. For each rule above, read Podverse source, adapt strings, write to `metaboost/.cursor/rules/`.
+2. Update `CURSOR-RULES.md` only if it should list new always-applied rules (optional one-line note).
+3. Ensure `AGENTS.md` § When to use which skill references new rules where relevant.
+
+## Verification
+
+```bash
+test -f .cursor/rules/operator-only-git-operations.mdc && echo ok
+npm run lint
+```
diff --git a/.llm/plans/completed/metaboost-abcmemory-align/02-port-drifted-shared-rules.md b/.llm/plans/completed/metaboost-abcmemory-align/02-port-drifted-shared-rules.md
new file mode 100644
index 00000000..19f53e46
--- /dev/null
+++ b/.llm/plans/completed/metaboost-abcmemory-align/02-port-drifted-shared-rules.md
@@ -0,0 +1,31 @@
+# 02 — Port drifted shared rules
+
+## Scope
+
+Update MetaBoost rules that exist in both repos but **drift** from Podverse source of truth.
+
+## Files
+
+| MetaBoost rule | Podverse source | Notes |
+| --- | --- | --- |
+| `css-custom-properties-no-var-fallbacks.mdc` | same name | Port Podverse clarity; keep MB token paths (`packages/ui/src/styles/_themes.scss` etc.) accurate for MB |
+| `end-with-targeted-make-report-verify.mdc` | same name | Port Podverse structure; **preserve** MB `E2E_API_GATE_MODE=off` default and MB make target names |
+| `plan-creation.mdc` | same name | Align wording; both use `.llm/plans/active/` |
+
+Also review modified rules from the pending diff for export/changelog cleanup only — no change unless
+still referencing removed systems:
+
+- `llm-cursor-source.mdc` — should match post-exports Podverse policy (cursor-only, no `.llm/exports/`)
+
+## Steps
+
+1. Side-by-side diff each file against Podverse.
+2. Port Podverse content; adapt repo names, keep MetaBoost-specific policy where triage marked KEEP.
+3. Run `npm run lint:fix` if markdown in rules needs formatting.
+
+## Verification
+
+```bash
+diff -q .cursor/rules/llm-cursor-source.mdc ../podverse/.cursor/rules/llm-cursor-source.mdc
+npm run lint
+```
diff --git a/.llm/plans/completed/metaboost-abcmemory-align/03-port-drifted-shared-skills.md b/.llm/plans/completed/metaboost-abcmemory-align/03-port-drifted-shared-skills.md
new file mode 100644
index 00000000..1b0491dd
--- /dev/null
+++ b/.llm/plans/completed/metaboost-abcmemory-align/03-port-drifted-shared-skills.md
@@ -0,0 +1,36 @@
+# 03 — Port drifted shared skills
+
+## Scope
+
+Sync MetaBoost skills that have Podverse counterparts but content drift. Adapt paths and package
+names; keep MetaBoost-only skills untouched.
+
+## Files to port
+
+| Skill | Podverse source | Keep MB-specific |
+| --- | --- | --- |
+| `abcmemory` | yes | MB doc links |
+| `docker-runtime-workspace-parity` | yes | `@metaboost/*`, MB Docker paths |
+| `import-specifiers-tiered` | yes | MB import-specifiers doc path |
+| `management-post-save-navigation` | yes | MB `ROUTES`, management-web paths |
+| `llm-cursor-source` | yes | MB branch prefix `llm/` |
+| `response-ending-make-verify` | yes | MB make targets, `E2E_API_GATE_MODE` |
+| `reusable-components` | yes | `@metaboost/ui` |
+
+## MetaBoost-only skills (do not delete)
+
+`plan-files-convention`, `argocd-gitops-push`, `linear-baseline-gz-sync`, `path-casing-imports`,
+`single-readme`, and other MB-only dirs from triage Plan 03 — **KEEP** as-is unless a direct
+Podverse duplicate exists with clearer wording.
+
+## Steps
+
+1. For each skill in the table, diff against Podverse `SKILL.md`.
+2. Port structure and policy; replace `@podverse` → `@metaboost`, app paths, doc links.
+3. Update `.cursor/skills/INDEX.md` quick-ref if a newly critical skill should appear (optional).
+
+## Verification
+
+```bash
+npm run lint
+```
diff --git a/.llm/plans/completed/metaboost-abcmemory-align/04-align-cursorrules.md b/.llm/plans/completed/metaboost-abcmemory-align/04-align-cursorrules.md
new file mode 100644
index 00000000..7eba8045
--- /dev/null
+++ b/.llm/plans/completed/metaboost-abcmemory-align/04-align-cursorrules.md
@@ -0,0 +1,32 @@
+# 04 — Align `.cursorrules` with Podverse
+
+## Scope
+
+Merge Podverse LLM workflow sections into MetaBoost `.cursorrules` while keeping MetaBoost-specific
+content.
+
+## Add from Podverse (adapt)
+
+- **Commands / Terminal** — commands-from-repo-root (reference `commands-from-metaboost-root` rule).
+- **Issue linking** — ask once for related GitHub issue.
+- **Operator-only git and publish** — reference new `operator-only-git-operations` rule.
+- Richer **Code Quality** bullets where they apply (`import type`, tiered import specifiers doc link).
+
+## Keep MetaBoost-specific
+
+- `E2E_API_GATE_MODE=off` default in agent/plan work section.
+- MetaBoost stack/architecture references (`@metaboost/*` not `@podverse/*`).
+- No Podverse-only sections: shared UI promotion to `@podverse/ui`, workers commands, etc.
+
+## Steps
+
+1. Diff `metaboost/.cursorrules` vs `podverse/.cursorrules`.
+2. Merge missing process sections; do not bloat with product-specific Podverse-only bullets.
+3. Ensure abcmemory / abcremember vocabulary matches `abcmemory-vocabulary` rule.
+
+## Verification
+
+```bash
+grep -n "operator-only\|E2E_API_GATE" .cursorrules
+npm run lint
+```
diff --git a/.llm/plans/completed/metaboost-abcmemory-align/COPY-PASTA.md b/.llm/plans/completed/metaboost-abcmemory-align/COPY-PASTA.md
new file mode 100644
index 00000000..7a6ce61e
--- /dev/null
+++ b/.llm/plans/completed/metaboost-abcmemory-align/COPY-PASTA.md
@@ -0,0 +1,53 @@
+# MetaBoost abcmemory align — Copy-Pasta
+
+## Phase 1 (sequential)
+
+### Agent 1 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-abcmemory-align/01-adopt-podverse-process-rules.md
+
+Add missing Podverse process rules to MetaBoost .cursor/rules (adapt paths). Reconcile plan-lifecycle
+with plan-execution-completion-tracking.
+```
+
+### Agent 2 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-abcmemory-align/02-port-drifted-shared-rules.md
+
+Port drifted shared rules from Podverse; preserve MetaBoost E2E_API_GATE_MODE policy in
+end-with-targeted-make-report-verify.
+```
+
+**Wait for Agent 2 before Phase 2.**
+
+## Phase 2 (parallel)
+
+### Agent 3A — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-abcmemory-align/03-port-drifted-shared-skills.md
+
+Port drifted shared skills from Podverse with @metaboost/* and MB doc paths.
+```
+
+### Agent 3B — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-abcmemory-align/04-align-cursorrules.md
+
+Merge Podverse LLM workflow sections into .cursorrules; keep MetaBoost-specific test/git policy.
+```
+
+When all complete, move this set to `.llm/plans/completed/metaboost-abcmemory-align/`.
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule: mark each agent prompt `[x]` when done; move each
+finished `NN-*.md` to `.llm/plans/completed/metaboost-abcmemory-align/`; then move the whole set.
+
+```bash
+npm run lint
+grep -n "operator-only" .cursor/rules/operator-only-git-operations.mdc .cursorrules
+```
diff --git a/.llm/plans/completed/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..fbde58d3
--- /dev/null
+++ b/.llm/plans/completed/metaboost-bucket-webpush-foundation/00-EXECUTION-ORDER.md
@@ -0,0 +1,19 @@
+# Execution order - Metaboost Bucket Webpush Foundation
+
+**Copy-paste prompts:** [COPY-PASTA.md](./COPY-PASTA.md)
+
+## Phase order
+
+1. [01-backend-domain-and-schema.md](./01-backend-domain-and-schema.md) (completed)
+2. [02-api-and-webpush-channel.md](./02-api-and-webpush-channel.md) (completed)
+3. [03-web-ui-and-service-worker.md](./03-web-ui-and-service-worker.md) (completed)
+4. [04-env-vapid-and-local-setup.md](./04-env-vapid-and-local-setup.md) (completed)
+5. [05-tests-and-verification.md](./05-tests-and-verification.md) (completed)
+
+## Why this order
+
+- Backend schema and inheritance rules must land first so API and UI can use stable contracts.
+- API endpoints and channel orchestration come next to establish end-to-end behavior.
+- Web UI work follows once APIs exist (bell toggle, modal scope choice, subscription flow).
+- Env and VAPID wiring is finalized after code paths are known.
+- Tests and verification run last to validate complete behavior across API and web.
\ No newline at end of file
diff --git a/.llm/plans/completed/metaboost-bucket-webpush-foundation/01-backend-domain-and-schema.md b/.llm/plans/completed/metaboost-bucket-webpush-foundation/01-backend-domain-and-schema.md
new file mode 100644
index 00000000..46b10ad0
--- /dev/null
+++ b/.llm/plans/completed/metaboost-bucket-webpush-foundation/01-backend-domain-and-schema.md
@@ -0,0 +1,35 @@
+# 01 - Backend Domain and Schema (Metaboost)
+
+## Scope
+
+- Add per-user, per-bucket notification preferences.
+- Add Web Push subscription storage.
+- Ensure sub-bucket inheritance on creation.
+- Keep design channel-agnostic for future push channels.
+
+## Steps
+
+1. Add notification preference persistence.
+   - New table/entity: user + bucket + enabled + timestamps.
+   - Unique key on (user_id, bucket_id).
+2. Add Web Push endpoint persistence.
+   - New table/entity for endpoint, keys (p256dh/auth), locale, user ownership, timestamps.
+   - Unique endpoint constraint.
+3. Add service methods for upsert/list/delete for both preference and webpush device records.
+4. Add inheritance behavior for child bucket creation.
+   - When creating a child bucket, copy explicit parent preference rows to the new child bucket.
+   - Apply in shared bucket create flow so it works for manual child creation and RSS sync-created item buckets.
+5. Add linear SQL migration updates and ORM mappings.
+
+## Key files
+
+- packages/orm/src/entities/Bucket.ts
+- packages/orm/src/entities/BucketSettings.ts
+- packages/orm/src/services/BucketService.ts
+- infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql
+
+## Exit criteria
+
+- New persistence tables/entities exist and compile.
+- Child bucket creation inherits parent notification preferences.
+- No bucket-global notification flag is introduced (preference stays per-user).
\ No newline at end of file
diff --git a/.llm/plans/completed/metaboost-bucket-webpush-foundation/02-api-and-webpush-channel.md b/.llm/plans/completed/metaboost-bucket-webpush-foundation/02-api-and-webpush-channel.md
new file mode 100644
index 00000000..e8ff827e
--- /dev/null
+++ b/.llm/plans/completed/metaboost-bucket-webpush-foundation/02-api-and-webpush-channel.md
@@ -0,0 +1,44 @@
+# 02 - API and Webpush Channel (Metaboost)
+
+## Scope
+
+- Expose authenticated endpoints for preference and subscription lifecycle.
+- Add channel-aware notification orchestration with Web Push as first channel.
+- Trigger notifications on new bucket messages with threshold-aware gating.
+
+## Steps
+
+1. Add bucket notification preference endpoints.
+   - Read current user preference for a bucket.
+   - Update preference for a bucket.
+   - Support applyToDescendants for preference update.
+2. Add Web Push device endpoints (account-scoped pattern aligned with Podverse).
+   - Create, update, delete, list-all-for-account.
+3. Add Joi schemas and helpers-requests request/response types for all new endpoints.
+4. Add notification orchestrator abstraction.
+   - Channel-neutral service switch (future mobile push compatible).
+   - Web Push channel implementation using VAPID-backed web-push admin setup.
+5. Hook dispatch into message creation flows.
+   - mb-v1 and mbrss-v1 boost create paths.
+   - Dispatch should be non-blocking relative to message persistence response.
+6. Apply threshold behavior for send eligibility.
+   - Use root/effective minimum threshold logic and existing threshold snapshot values.
+   - Only send notifications for qualifying messages.
+
+## Key files
+
+- apps/api/src/routes/buckets.ts
+- apps/api/src/routes/auth.ts
+- apps/api/src/controllers/bucketsController.ts
+- apps/api/src/controllers/mbV1Controller.ts
+- apps/api/src/controllers/mbrssV1Controller.ts
+- apps/api/src/lib/standardIngest/persistBoostMessage.ts
+- apps/api/src/lib/message-threshold-filter.ts
+- apps/api/src/schemas/buckets.ts
+- packages/helpers-requests/src/web/buckets.ts
+
+## Exit criteria
+
+- API can persist and query per-user bucket preferences and webpush subscriptions.
+- Notifications are dispatched on new messages through orchestrator + webpush channel.
+- Threshold filtering is enforced for notification sending.
\ No newline at end of file
diff --git a/.llm/plans/completed/metaboost-bucket-webpush-foundation/03-web-ui-and-service-worker.md b/.llm/plans/completed/metaboost-bucket-webpush-foundation/03-web-ui-and-service-worker.md
new file mode 100644
index 00000000..40001b63
--- /dev/null
+++ b/.llm/plans/completed/metaboost-bucket-webpush-foundation/03-web-ui-and-service-worker.md
@@ -0,0 +1,44 @@
+# 03 - Web UI and Service Worker (Metaboost Web)
+
+## Scope
+
+- Add bell toggle on bucket pages.
+- Add apply-scope modal when bucket has sub-buckets.
+- Implement browser Web Push lifecycle (permission, subscribe, unsubscribe, service worker).
+
+## Steps
+
+1. Add bell control in bucket page header action area.
+   - Show enabled/disabled state for current user + current bucket.
+2. On toggle, resolve whether bucket has sub-buckets.
+   - If no children: apply directly.
+   - If children: show modal with
+     - apply to this bucket only
+     - apply to all sub-buckets
+3. Reuse existing scope-modal UX language/pattern from bucket settings flow.
+4. Enable flow.
+   - Request browser notification permission.
+   - Register service worker.
+   - Subscribe with PushManager using VAPID public key.
+   - Persist subscription via API create/update endpoint.
+5. Disable flow.
+   - Unsubscribe push subscription.
+   - Delete server-side subscription.
+   - Update bucket preference state.
+6. Service worker behavior.
+   - Handle push events (foreground and background).
+   - Handle notification click navigation into web app route.
+
+## Key files
+
+- apps/web/src/app/(main)/bucket/[id]/BucketDetailTabShell.tsx
+- apps/web/src/app/(main)/bucket/[id]/BucketDetailTabsClient.tsx
+- apps/web/src/app/(main)/buckets/BucketForm.tsx
+- apps/web/src/lib/buckets.ts
+- apps/web/public/webpush-sw.js (new)
+
+## Exit criteria
+
+- Bell toggle is available on web bucket pages.
+- Scope modal appears only when sub-buckets exist.
+- Subscribe/unsubscribe flow is functional end-to-end with API persistence.
\ No newline at end of file
diff --git a/.llm/plans/completed/metaboost-bucket-webpush-foundation/04-env-vapid-and-local-setup.md b/.llm/plans/completed/metaboost-bucket-webpush-foundation/04-env-vapid-and-local-setup.md
new file mode 100644
index 00000000..79567537
--- /dev/null
+++ b/.llm/plans/completed/metaboost-bucket-webpush-foundation/04-env-vapid-and-local-setup.md
@@ -0,0 +1,42 @@
+# 04 - Env, VAPID, and Local Setup (Metaboost)
+
+## Scope
+
+- Add env surfaces for API and web runtime.
+- Add VAPID key generation workflow.
+- Integrate with local setup and override scripts.
+
+## Steps
+
+1. Add API env keys.
+   - WEBPUSH_ENABLED
+   - WEBPUSH_VAPID_PUBLIC_KEY
+   - WEBPUSH_VAPID_PRIVATE_KEY
+   - WEBPUSH_VAPID_SUBJECT
+2. Add web runtime config key(s) via sidecar.
+   - NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY
+   - optional NEXT_PUBLIC_WEBPUSH_ENABLED if feature-gating in UI
+3. Update runtime config typing, sidecar validation, and web config accessors.
+4. Add VAPID generation script and invocation docs.
+   - Script should generate key pair and print/export values for local env consumption.
+5. Update local env setup/override flow.
+   - Add notifications override file to home override stub generation/link flow.
+   - Ensure local_env_setup can preserve provided VAPID values.
+6. Update env examples and docs.
+
+## Key files
+
+- apps/api/.env.example
+- apps/web/sidecar/.env.example
+- apps/web/src/config/runtime-config.ts
+- apps/web/sidecar/src/server.ts
+- scripts/local-env/setup.sh
+- scripts/env-overrides/home-override-env-files.inc.sh
+- scripts/env-overrides/write-home-override-stubs.rb
+- docs/development/env/LOCAL-ENV-OVERRIDES.md
+
+## Exit criteria
+
+- API and web runtime expose required Web Push config.
+- VAPID key generation is documented and script-backed.
+- local_env_prepare/link/setup flows support notification env values.
\ No newline at end of file
diff --git a/.llm/plans/completed/metaboost-bucket-webpush-foundation/05-tests-and-verification.md b/.llm/plans/completed/metaboost-bucket-webpush-foundation/05-tests-and-verification.md
new file mode 100644
index 00000000..df78afb5
--- /dev/null
+++ b/.llm/plans/completed/metaboost-bucket-webpush-foundation/05-tests-and-verification.md
@@ -0,0 +1,52 @@
+# 05 - Tests and Verification (Metaboost)
+
+## Scope
+
+- Add API integration coverage.
+- Add web E2E coverage.
+- Verify manual behavior and local setup.
+
+## API integration tests
+
+1. Preference CRUD
+   - read/update per-user bucket preference.
+2. Apply-to-descendants behavior
+   - this bucket only vs all sub-buckets.
+3. Inheritance on child creation
+   - manual child create.
+   - RSS sync-created item bucket.
+4. Webpush device CRUD
+   - create/update/delete/list for authenticated user.
+5. Dispatch behavior
+   - new message triggers notification attempt.
+   - below-threshold message does not trigger send.
+
+## Web E2E tests
+
+1. Bell icon visible on bucket page for authenticated user.
+2. Toggle with no children applies immediately.
+3. Toggle with children opens scope modal and both buttons work.
+4. Page reload reflects persisted preference state.
+5. Subscription lifecycle handles enable/disable transitions.
+
+## Manual checks
+
+1. Generate VAPID keys and wire env.
+2. Enable notifications on parent with apply-to-all.
+3. Create new child and confirm inherited preference.
+4. Send qualifying and non-qualifying boosts and validate dispatch difference.
+
+## Verification commands
+
+```bash
+./scripts/nix/with-env npm run build
+./scripts/nix/with-env npm run lint
+./scripts/nix/with-env npm run test:e2e:api
+./scripts/nix/with-env make e2e_test_web
+```
+
+## Exit criteria
+
+- API and web tests pass for the new notification behavior.
+- Manual threshold and inheritance behavior matches requirements.
+- Plan can be executed phase-by-phase without hidden dependencies.
\ No newline at end of file
diff --git a/.llm/plans/completed/metaboost-bucket-webpush-foundation/COPY-PASTA.md b/.llm/plans/completed/metaboost-bucket-webpush-foundation/COPY-PASTA.md
new file mode 100644
index 00000000..daa4d9a6
--- /dev/null
+++ b/.llm/plans/completed/metaboost-bucket-webpush-foundation/COPY-PASTA.md
@@ -0,0 +1,86 @@
+# Copy-Paste Prompts
+
+Use these prompts to execute plans in **strict sequential order** from [`00-EXECUTION-ORDER.md`](./00-EXECUTION-ORDER.md). Finish each step before starting the next.
+
+Paths below are relative to the **Metaboost** repository root.
+
+After completing a step, update this file to mark the step completed (per **plan-execution-completion-tracking**) and move completed numbered plans to `.llm/plans/completed/metaboost-bucket-webpush-foundation/` when appropriate.
+
+---
+
+## Phase 1 — Backend schema and domain
+
+### Step 1 — `01-backend-domain-and-schema`
+
+**Status:** completed (see `.llm/plans/completed/metaboost-bucket-webpush-foundation/01-backend-domain-and-schema.md`).
+
+```text
+Implement plan file `.llm/plans/completed/metaboost-bucket-webpush-foundation/01-backend-domain-and-schema.md` exactly as written.
+Follow Metaboost linear migrations and ORM conventions (forward-only SQL under infra/k8s, ops kustomization bundle sync if adding migration files).
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+```
+
+---
+
+## Phase 2 — API and Web Push channel
+
+### Step 2 — `02-api-and-webpush-channel`
+
+**Status:** completed (see `.llm/plans/completed/metaboost-bucket-webpush-foundation/02-api-and-webpush-channel.md`).
+
+```text
+Implement plan file `.llm/plans/completed/metaboost-bucket-webpush-foundation/02-api-and-webpush-channel.md` exactly as written.
+Assume step 1 (01-backend-domain-and-schema) is complete.
+Include Joi schemas, helpers-requests types, non-blocking dispatch on message persistence, and threshold-aware gating per the plan.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+```
+
+---
+
+## Phase 3 — Web UI and service worker
+
+### Step 3 — `03-web-ui-and-service-worker`
+
+**Status:** completed (see `.llm/plans/completed/metaboost-bucket-webpush-foundation/03-web-ui-and-service-worker.md`).
+
+```text
+Implement plan file `.llm/plans/completed/metaboost-bucket-webpush-foundation/03-web-ui-and-service-worker.md` exactly as written.
+Assume steps 1–2 are complete so APIs and contracts exist.
+Reuse existing bucket scope-modal patterns where the plan says to align UX.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+```
+
+---
+
+## Phase 4 — Env, VAPID, local setup
+
+### Step 4 — `04-env-vapid-and-local-setup`
+
+**Status:** completed (see `.llm/plans/completed/metaboost-bucket-webpush-foundation/04-env-vapid-and-local-setup.md`).
+
+```text
+Implement plan file `.llm/plans/completed/metaboost-bucket-webpush-foundation/04-env-vapid-and-local-setup.md` exactly as written.
+Assume steps 1–3 are complete so required env keys and runtime surfaces are known from implemented code.
+Keep canonical `.env.example`, sidecar, and local env override flows aligned per Metaboost env conventions.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+```
+
+---
+
+## Phase 5 — Tests and verification
+
+### Step 5 — `05-tests-and-verification`
+
+**Status:** completed (see `.llm/plans/completed/metaboost-bucket-webpush-foundation/05-tests-and-verification.md`).
+
+```text
+Implement plan file `.llm/plans/completed/metaboost-bucket-webpush-foundation/05-tests-and-verification.md` exactly as written.
+Assume steps 1–4 are complete.
+Add or update API integration tests and web E2E tests per the plan; do not skip threshold/dispatch or inheritance cases listed there.
+Do not modify unrelated files.
+When done, summarize changed files, verification commands run (or to run locally), and any follow-up risks.
+```
diff --git a/.llm/plans/completed/metaboost-build-config-align/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-build-config-align/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..a3273144
--- /dev/null
+++ b/.llm/plans/completed/metaboost-build-config-align/00-EXECUTION-ORDER.md
@@ -0,0 +1,7 @@
+# MetaBoost build config align — Execution order
+
+1. `01-fix-eslint-stale-globs-and-commit-rules.md`
+2. `02-complete-vitest-package-wiring.md`
+3. `03-remove-lint-staged-from-package-json.md` (after dev-scripts-align plan 01 if doing hooks first)
+
+Move set to `completed/` when done.
diff --git a/.llm/plans/completed/metaboost-build-config-align/00-SUMMARY.md b/.llm/plans/completed/metaboost-build-config-align/00-SUMMARY.md
new file mode 100644
index 00000000..389e62db
--- /dev/null
+++ b/.llm/plans/completed/metaboost-build-config-align/00-SUMMARY.md
@@ -0,0 +1,22 @@
+# MetaBoost build config align — Summary
+
+## Purpose
+
+Align MetaBoost build/lint/test toolchain with Podverse after triage Plan 08: fix incomplete vitest
+wiring, remove stale ESLint globs, and optional lint-staged cleanup.
+
+## Plans
+
+| File | Focus |
+| --- | --- |
+| 01-fix-eslint-stale-globs-and-commit-rules.md | Remove `scripts/llm/**` block; commit `eslint-rules/` |
+| 02-complete-vitest-package-wiring.md | `packages/ui` test script + vitest deps |
+| 03-remove-lint-staged-from-package-json.md | Coordinate with dev-scripts-align (pre-commit dropped) |
+
+## Verification
+
+```bash
+./scripts/nix/with-env npm run lint
+./scripts/nix/with-env npm run test:unit
+./scripts/nix/with-env npm run build:packages
+```
diff --git a/.llm/plans/completed/metaboost-build-config-align/01-fix-eslint-stale-globs-and-commit-rules.md b/.llm/plans/completed/metaboost-build-config-align/01-fix-eslint-stale-globs-and-commit-rules.md
new file mode 100644
index 00000000..e64f0cbc
--- /dev/null
+++ b/.llm/plans/completed/metaboost-build-config-align/01-fix-eslint-stale-globs-and-commit-rules.md
@@ -0,0 +1,27 @@
+# 01 — Fix ESLint stale globs and commit rules
+
+## Scope
+
+Triage found:
+
+- Stale block `files: ['scripts/llm/**/*.mjs', ...]` in `eslint.config.mjs` (scripts deleted in Plan 01)
+- `require-relative-js-extension` wiring added — **KEEP** (matches Podverse tiered import rule)
+- `eslint-rules/` untracked — commit per Plan 07
+
+## Steps
+
+1. Delete the `scripts/llm/**` override block from `eslint.config.mjs`.
+2. Ensure tier A/B/C file globs match Podverse intent (already aligned in pending diff).
+3. Commit `eslint-rules/require-relative-js-extension.mjs`.
+
+## Do not change (pre-existing MB choices)
+
+- `eslint-plugin-perfectionist` vs Podverse `eslint-plugin-simple-import-sort` — record PARITY-GAP
+  for Plan 09; not in scope unless explicitly adopting simple-import-sort.
+
+## Verification
+
+```bash
+./scripts/nix/with-env npm run lint
+rg -n "scripts/llm" eslint.config.mjs || echo "stale glob removed"
+```
diff --git a/.llm/plans/completed/metaboost-build-config-align/02-complete-vitest-package-wiring.md b/.llm/plans/completed/metaboost-build-config-align/02-complete-vitest-package-wiring.md
new file mode 100644
index 00000000..e87ea84d
--- /dev/null
+++ b/.llm/plans/completed/metaboost-build-config-align/02-complete-vitest-package-wiring.md
@@ -0,0 +1,28 @@
+# 02 — Complete vitest package wiring
+
+## Scope
+
+Pending change adds `vitest.config.ts` for `helpers-requests`, `orm`, and `ui`, extends root
+`test:unit`, and adds `test` scripts to `helpers-requests` and `orm` package.json.
+
+**Gap:** `packages/ui/package.json` has no `test` script or vitest devDependencies, but root
+`test:unit` invokes `npm run test -w @metaboost/ui`.
+
+## Steps
+
+1. Add to `packages/ui/package.json`:
+   - `"test": "vitest run"`
+   - devDependencies: `vitest`, `@vitejs/plugin-react`, `jsdom` (match Podverse ui package versions)
+2. Confirm `packages/ui/vitest.config.ts` matches Podverse (jsdom, react plugin, include patterns).
+3. Confirm `packages/orm/tsconfig.json` excludes `**/*.test.ts` (already in pending diff — KEEP).
+4. Optional ALIGN: simplify `helpers-requests/vitest.config.ts` to match Podverse (drop
+   `fileParallelism`/`maxWorkers` unless needed for flakiness).
+
+## Verification
+
+```bash
+./scripts/nix/with-env npm run test -w @metaboost/helpers-requests
+./scripts/nix/with-env npm run test -w @metaboost/orm
+./scripts/nix/with-env npm run test -w @metaboost/ui
+./scripts/nix/with-env npm run test:unit
+```
diff --git a/.llm/plans/completed/metaboost-build-config-align/03-remove-lint-staged-from-package-json.md b/.llm/plans/completed/metaboost-build-config-align/03-remove-lint-staged-from-package-json.md
new file mode 100644
index 00000000..2e6c0154
--- /dev/null
+++ b/.llm/plans/completed/metaboost-build-config-align/03-remove-lint-staged-from-package-json.md
@@ -0,0 +1,19 @@
+# 03 — Remove lint-staged from package.json
+
+## Scope
+
+Podverse has no `lint-staged` in root `package.json`. Plan 07 aligns git hooks to pre-push only.
+Remove lint-staged config and devDependency when pre-commit hook is dropped.
+
+## Steps
+
+1. Complete `metaboost-dev-scripts-align/01-align-git-hooks-with-podverse.md` first (or in same PR).
+2. Remove `lint-staged` from `devDependencies` and delete the `lint-staged` key in root `package.json`.
+3. Run `npm install` and commit lockfile (run `update-lockfile-linux.sh` if on macOS).
+
+## Verification
+
+```bash
+rg -n "lint-staged" package.json || echo "lint-staged removed"
+./scripts/nix/with-env npm run lint
+```
diff --git a/.llm/plans/completed/metaboost-build-config-align/COPY-PASTA.md b/.llm/plans/completed/metaboost-build-config-align/COPY-PASTA.md
new file mode 100644
index 00000000..b903cd6b
--- /dev/null
+++ b/.llm/plans/completed/metaboost-build-config-align/COPY-PASTA.md
@@ -0,0 +1,28 @@
+# MetaBoost build config align — Copy-Pasta
+
+### Agent 1 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-build-config-align/01-fix-eslint-stale-globs-and-commit-rules.md
+```
+
+### Agent 2 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-build-config-align/02-complete-vitest-package-wiring.md
+```
+
+### Agent 3 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-build-config-align/03-remove-lint-staged-from-package-json.md
+
+Run after metaboost-dev-scripts-align plan 01 if dropping pre-commit in the same PR.
+```
+
+Move set to `.llm/plans/completed/metaboost-build-config-align/` when complete.
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule: mark each agent prompt `[x]` when done; move each
+finished `NN-*.md` to `.llm/plans/completed/metaboost-build-config-align/`; then move the whole set.
diff --git a/.llm/plans/completed/metaboost-ci-ops-align/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-ci-ops-align/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..ee9b2051
--- /dev/null
+++ b/.llm/plans/completed/metaboost-ci-ops-align/00-EXECUTION-ORDER.md
@@ -0,0 +1,8 @@
+# MetaBoost CI ops align — Execution order
+
+1. `01-adopt-podverse-ci-workflows.md`
+2. `02-align-ci-yml-gates.md`
+3. `03-align-publish-and-dependabot.md`
+4. `04-align-repo-management-docs.md`
+
+Move to `completed/` when done.
diff --git a/.llm/plans/completed/metaboost-ci-ops-align/00-SUMMARY.md b/.llm/plans/completed/metaboost-ci-ops-align/00-SUMMARY.md
new file mode 100644
index 00000000..61792266
--- /dev/null
+++ b/.llm/plans/completed/metaboost-ci-ops-align/00-SUMMARY.md
@@ -0,0 +1,23 @@
+# MetaBoost CI ops align — Summary
+
+## Purpose
+
+Align MetaBoost GitHub Actions, Dependabot, and repo-management docs with Podverse ops conventions
+after triage Plan 05. Preserve MetaBoost-only workflows (`publish-metaboost-signing.yml`,
+`metaboost-infra-alpha-contracts.yml`).
+
+## Plans
+
+| File | Focus |
+| --- | --- |
+| 01-adopt-podverse-ci-workflows.md | `complete-feature.yml`, `vulnerability-scanner.yml` |
+| 02-align-ci-yml-gates.md | `ci.yml` — OpenAPI check, npm ci retries, step naming parity |
+| 03-align-publish-and-dependabot.md | Publish workflows + `dependabot.yml` |
+| 04-align-repo-management-docs.md | `docs/repo-management/*`, release doc cross-refs |
+
+## Verification
+
+```bash
+rg -n "CHANGELOG|llm-exports" .github/workflows || echo "clean"
+diff <(ls .github/workflows | sort) <(ls ../podverse/.github/workflows | sort)
+```
diff --git a/.llm/plans/completed/metaboost-ci-ops-align/01-adopt-podverse-ci-workflows.md b/.llm/plans/completed/metaboost-ci-ops-align/01-adopt-podverse-ci-workflows.md
new file mode 100644
index 00000000..1b80ba42
--- /dev/null
+++ b/.llm/plans/completed/metaboost-ci-ops-align/01-adopt-podverse-ci-workflows.md
@@ -0,0 +1,27 @@
+# 01 — Adopt Podverse CI workflows
+
+## Scope
+
+Add MetaBoost copies of Podverse workflows missing after export/changelog cleanup.
+
+## Workflows to add
+
+| Podverse workflow | Action |
+| --- | --- |
+| `complete-feature.yml` | Adapt for MetaBoost (`.llm/history/` paths, `develop` branch). Coordinate with `metaboost-llm-workspace-align` plan 04 — avoid duplicate work. |
+| `vulnerability-scanner.yml` | Port scheduled npm audit scan; use MB audit gate docs (`NPM-AUDIT-ALLOWLIST.md`). |
+
+## Do not add
+
+- `llm-exports-*.yml` (removed; Plan 01 KEEP)
+
+## MB-only (keep)
+
+- `publish-metaboost-signing.yml`
+- `metaboost-infra-alpha-contracts.yml`
+
+## Verification
+
+```bash
+test -f .github/workflows/vulnerability-scanner.yml && echo ok
+```
diff --git a/.llm/plans/completed/metaboost-ci-ops-align/02-align-ci-yml-gates.md b/.llm/plans/completed/metaboost-ci-ops-align/02-align-ci-yml-gates.md
new file mode 100644
index 00000000..b5c4b632
--- /dev/null
+++ b/.llm/plans/completed/metaboost-ci-ops-align/02-align-ci-yml-gates.md
@@ -0,0 +1,34 @@
+# 02 — Align `ci.yml` gates
+
+## Scope
+
+Reconcile MetaBoost `ci.yml` with Podverse CI intent while keeping MetaBoost test ports (5632/6579)
+and dual-database env.
+
+## Podverse gates MetaBoost should adopt
+
+| Gate | Podverse | MetaBoost today |
+| --- | --- | --- |
+| OpenAPI check | `OpenAPI check` step | **Missing** — add if MB publishes OpenAPI (see `swagger-openapi` skill) |
+| `make check_k8s_postgres_init_sync` | present | MB has `Validate db init sync` — verify equivalent |
+| npm ci retry loop | 5 attempts | **Missing** in CI — add |
+| Linear baseline step naming | `db-baseline-0003` | MB uses `Verify generated linear baseline artifacts` — ALIGN naming/docs only |
+
+## MetaBoost extras (KEEP)
+
+- GHA `services:` postgres/valkey (Podverse uses docker pull — both valid; **KEEP** MB approach unless flaky)
+- `i18n validate`, `Type-check` steps if not in Podverse CI — **KEEP** if valuable
+- MetaBoost-specific DB role env vars
+
+## Steps
+
+1. Diff full `ci.yml` files side-by-side.
+2. Add npm ci retry pattern from Podverse to install step.
+3. Add OpenAPI check step if applicable to MetaBoost API surface.
+4. Ensure no changelog/export references remain.
+
+## Verification
+
+```bash
+grep -n "OpenAPI\|npm ci failed" .github/workflows/ci.yml
+```
diff --git a/.llm/plans/completed/metaboost-ci-ops-align/03-align-publish-and-dependabot.md b/.llm/plans/completed/metaboost-ci-ops-align/03-align-publish-and-dependabot.md
new file mode 100644
index 00000000..f08af770
--- /dev/null
+++ b/.llm/plans/completed/metaboost-ci-ops-align/03-align-publish-and-dependabot.md
@@ -0,0 +1,26 @@
+# 03 — Align publish workflows and Dependabot
+
+## Scope
+
+Port Podverse resilience patterns into MetaBoost publish workflows; align Dependabot config.
+
+## Publish workflows
+
+| File | Changes from Podverse triage |
+| --- | --- |
+| `publish-staging.yml` | Add npm ci retry loop; port reserve-version logging/error handling improvements where compatible with MB semver line |
+| `publish-main.yml` | Same retry/resilience patterns |
+| `publish-metaboost-signing.yml` | MB-only — verify no changelog hooks; align npm ci retry if present |
+
+Confirmed: **no** `CHANGELOG` or `llm-exports` references in publish workflows (Plan 01/02).
+
+## Dependabot
+
+- Align comment structure and `@types/node` ignore policy with Podverse where MB claims “aligned with Podverse”.
+- **Keep** MB docker path `infra/docker/local/*` (Podverse may use different docker layout).
+
+## Verification
+
+```bash
+rg -n "CHANGELOG|llm-exports" .github/workflows .github/dependabot.yml || echo clean
+```
diff --git a/.llm/plans/completed/metaboost-ci-ops-align/04-align-repo-management-docs.md b/.llm/plans/completed/metaboost-ci-ops-align/04-align-repo-management-docs.md
new file mode 100644
index 00000000..272ec0f8
--- /dev/null
+++ b/.llm/plans/completed/metaboost-ci-ops-align/04-align-repo-management-docs.md
@@ -0,0 +1,29 @@
+# 04 — Align repo-management and release docs
+
+## Scope
+
+Update MetaBoost repo-management and release docs to match current workflows (no changelog/export
+pipelines).
+
+## Files
+
+- `docs/repo-management/BRANCH-PROTECTION.md`
+- `docs/repo-management/DEPENDABOT.md`
+- `docs/repo-management/GITHUB-LABELS.md`
+- `docs/repo-management/GITHUB-SETUP.md`
+- `scripts/github/setup-all-labels.sh`, `scripts/github/SCRIPTS-GITHUB.md`
+- `docs/PUBLISH.md`, `docs/GITFLOW.md`
+- `docs/development/release/STAGING-MAIN-PROMOTION.md`
+- `docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md`
+
+## Steps
+
+1. Remove stale references to deleted changelog or llm-export workflows.
+2. Document new/ adopted workflows (`vulnerability-scanner`, `complete-feature` if adopted).
+3. Cross-link `github-actions-yaml` rule once added via `metaboost-abcmemory-align`.
+
+## Verification
+
+```bash
+rg -n "llm-exports|CHANGELOG-UPCOMING|release-changelog" docs/repo-management docs/PUBLISH.md docs/GITFLOW.md || echo clean
+```
diff --git a/.llm/plans/completed/metaboost-ci-ops-align/COPY-PASTA.md b/.llm/plans/completed/metaboost-ci-ops-align/COPY-PASTA.md
new file mode 100644
index 00000000..313daaac
--- /dev/null
+++ b/.llm/plans/completed/metaboost-ci-ops-align/COPY-PASTA.md
@@ -0,0 +1,32 @@
+# MetaBoost CI ops align — Copy-Pasta
+
+### Agent 1 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-ci-ops-align/01-adopt-podverse-ci-workflows.md
+```
+
+### Agent 2 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-ci-ops-align/02-align-ci-yml-gates.md
+```
+
+### Agent 3 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-ci-ops-align/03-align-publish-and-dependabot.md
+```
+
+### Agent 4 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-ci-ops-align/04-align-repo-management-docs.md
+```
+
+When done, move set to `.llm/plans/completed/metaboost-ci-ops-align/`.
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule: mark each agent prompt `[x]` when done; move each
+finished `NN-*.md` to `.llm/plans/completed/metaboost-ci-ops-align/`; then move the whole set.
diff --git a/.llm/plans/completed/metaboost-dev-scripts-align/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-dev-scripts-align/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..4d1268fb
--- /dev/null
+++ b/.llm/plans/completed/metaboost-dev-scripts-align/00-EXECUTION-ORDER.md
@@ -0,0 +1,7 @@
+# MetaBoost dev scripts align — Execution order
+
+1. `01-align-git-hooks-with-podverse.md`
+2. `02-sync-parity-dev-tooling-files.md`
+3. `03-review-bump-version-audit-gate.md`
+
+Move set to `completed/` when done.
diff --git a/.llm/plans/completed/metaboost-dev-scripts-align/00-SUMMARY.md b/.llm/plans/completed/metaboost-dev-scripts-align/00-SUMMARY.md
new file mode 100644
index 00000000..f03df7a2
--- /dev/null
+++ b/.llm/plans/completed/metaboost-dev-scripts-align/00-SUMMARY.md
@@ -0,0 +1,25 @@
+# MetaBoost dev scripts align — Summary
+
+## Purpose
+
+Align MetaBoost git hooks and dev scripts with Podverse after triage Plan 07. Primary drift:
+MetaBoost still installs a **pre-commit** lint-staged hook; Podverse removed pre-commit and only
+installs **pre-push** (branch naming).
+
+## Plans
+
+| File | Focus |
+| --- | --- |
+| 01-align-git-hooks-with-podverse.md | `install-hooks.sh`, drop pre-commit install |
+| 02-sync-parity-dev-tooling-files.md | Commit/sync `normalize-markdown-links.mjs`, `eslint-rules/` |
+| 03-review-bump-version-audit-gate.md | Audit allowlist parity vs Podverse |
+
+Coordinate lint-staged removal from `package.json` with Plan 08 if dropping pre-commit fully.
+
+## Verification
+
+```bash
+bash scripts/git-hooks/install-hooks.sh
+test ! -f .git/hooks/pre-commit && echo "pre-commit absent OK"
+rg -n "CHANGELOG|llm-exports|guard-exports" scripts || echo "scripts clean"
+```
diff --git a/.llm/plans/completed/metaboost-dev-scripts-align/01-align-git-hooks-with-podverse.md b/.llm/plans/completed/metaboost-dev-scripts-align/01-align-git-hooks-with-podverse.md
new file mode 100644
index 00000000..d30a8f31
--- /dev/null
+++ b/.llm/plans/completed/metaboost-dev-scripts-align/01-align-git-hooks-with-podverse.md
@@ -0,0 +1,32 @@
+# 01 — Align git hooks with Podverse
+
+## Scope
+
+Podverse `scripts/git-hooks/install-hooks.sh`:
+
+- Skips install when no git context (CI/Docker safe)
+- Uses `git rev-parse --git-path hooks`
+- **Removes** legacy `pre-commit` (`rm -f`)
+- Installs **pre-push** only
+
+MetaBoost still copies `pre-commit` (lint-staged) and uses a simpler `.git/hooks` path.
+
+## Steps
+
+1. Port Podverse `install-hooks.sh` behavior to MetaBoost (keep MetaBoost paths/comments).
+2. Stop installing `pre-commit`; optionally delete `scripts/git-hooks/pre-commit` or leave
+   documented as unused legacy (Podverse deleted the file entirely).
+3. Confirm `pre-push` matches Podverse after pending diff (already includes `llm/` branch).
+4. Coordinate with Plan 08: remove `lint-staged` from root `package.json` if no longer used, or
+   document manual `npx lint-staged` only.
+
+## Reference
+
+Podverse: `scripts/git-hooks/install-hooks.sh`
+
+## Verification
+
+```bash
+bash scripts/git-hooks/install-hooks.sh
+ls -la "$(git rev-parse --git-path hooks)"
+```
diff --git a/.llm/plans/completed/metaboost-dev-scripts-align/02-sync-parity-dev-tooling-files.md b/.llm/plans/completed/metaboost-dev-scripts-align/02-sync-parity-dev-tooling-files.md
new file mode 100644
index 00000000..9a6cd1d0
--- /dev/null
+++ b/.llm/plans/completed/metaboost-dev-scripts-align/02-sync-parity-dev-tooling-files.md
@@ -0,0 +1,22 @@
+# 02 — Sync parity dev tooling files
+
+## Scope
+
+Both repos have `scripts/development/normalize-markdown-links.mjs` and
+`eslint-rules/require-relative-js-extension.mjs`. MetaBoost copies are untracked/new in the
+working tree; content is nearly identical to Podverse (trivial diff only).
+
+## Steps
+
+1. Commit `scripts/development/normalize-markdown-links.mjs` — align trivial diff with Podverse
+   (`_filePath` unused param, verify message punctuation).
+2. Commit `eslint-rules/require-relative-js-extension.mjs` if not already tracked.
+3. Ensure Plan 08 wires the rule in `eslint.config.mjs` (not this plan's scope if already done).
+4. Add npm script or doc pointer if Podverse documents link normalizer usage (grep Podverse docs).
+
+## Verification
+
+```bash
+node scripts/development/normalize-markdown-links.mjs --verify
+diff -q scripts/development/normalize-markdown-links.mjs /path/to/podverse/scripts/development/normalize-markdown-links.mjs || true
+```
diff --git a/.llm/plans/completed/metaboost-dev-scripts-align/03-review-bump-version-audit-gate.md b/.llm/plans/completed/metaboost-dev-scripts-align/03-review-bump-version-audit-gate.md
new file mode 100644
index 00000000..627d5329
--- /dev/null
+++ b/.llm/plans/completed/metaboost-dev-scripts-align/03-review-bump-version-audit-gate.md
@@ -0,0 +1,24 @@
+# 03 — Review bump-version audit gate
+
+## Scope
+
+Podverse `bump-version.sh` passes advisory allowlist `"1117015"` to `check-audit-gate.sh` (Next/postcss
+nested dep). MetaBoost passes `""` (strict — no allowlist).
+
+Changelog creation/removal is **KEEP** (Plan 02). Lockfile-linux step matches Podverse — **KEEP**.
+
+Workspace discovery differs (Podverse: `jq` + `npm query`; MetaBoost: Node expansion script) — **KEEP**
+if functionally equivalent for MB workspaces.
+
+## Steps
+
+1. Run bump-version dry path or audit gate on current lockfile.
+2. If release blocked by advisory 1117015 (or MB equivalent), add documented allowlist to
+   `bump-version.sh` and `docs/development/NPM-AUDIT-ALLOWLIST.md` matching Podverse pattern.
+3. If strict mode is intentional for MetaBoost, document in `NPM-AUDIT-ALLOWLIST.md` — no script change.
+
+## Verification
+
+```bash
+scripts/lib/check-audit-gate.sh "" release
+```
diff --git a/.llm/plans/completed/metaboost-dev-scripts-align/COPY-PASTA.md b/.llm/plans/completed/metaboost-dev-scripts-align/COPY-PASTA.md
new file mode 100644
index 00000000..254433fb
--- /dev/null
+++ b/.llm/plans/completed/metaboost-dev-scripts-align/COPY-PASTA.md
@@ -0,0 +1,26 @@
+# MetaBoost dev scripts align — Copy-Pasta
+
+### Agent 1 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-dev-scripts-align/01-align-git-hooks-with-podverse.md
+```
+
+### Agent 2 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-dev-scripts-align/02-sync-parity-dev-tooling-files.md
+```
+
+### Agent 3 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-dev-scripts-align/03-review-bump-version-audit-gate.md
+```
+
+Move set to `.llm/plans/completed/metaboost-dev-scripts-align/` when complete.
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule: mark each agent prompt `[x]` when done; move each
+finished `NN-*.md` to `.llm/plans/completed/metaboost-dev-scripts-align/`; then move the whole set.
diff --git a/.llm/plans/completed/metaboost-infra-env-align/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-infra-env-align/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..bf0075bb
--- /dev/null
+++ b/.llm/plans/completed/metaboost-infra-env-align/00-EXECUTION-ORDER.md
@@ -0,0 +1,7 @@
+# MetaBoost infra env align — Execution order
+
+1. `01-sync-k8s-env-sources-with-templates.md`
+2. `02-regenerate-linear-baseline-gz.md`
+3. `03-verify-alpha-product-membership-wiring.md`
+
+Push GitOps/infra changes to the Argo CD–tracked branch when done. Move set to `completed/`.
diff --git a/.llm/plans/completed/metaboost-infra-env-align/00-SUMMARY.md b/.llm/plans/completed/metaboost-infra-env-align/00-SUMMARY.md
new file mode 100644
index 00000000..edb95978
--- /dev/null
+++ b/.llm/plans/completed/metaboost-infra-env-align/00-SUMMARY.md
@@ -0,0 +1,22 @@
+# MetaBoost infra env align — Summary
+
+## Purpose
+
+Complete MetaBoost k8s/env ops alignment after triage Plan 06: env source/template sync, linear
+baseline regeneration, and alpha GitOps wiring. **Push to Argo CD branch after `infra/k8s/**`
+changes** (see `argocd-gitops-push` skill).
+
+## Plans
+
+| File | Focus |
+| --- | --- |
+| 01-sync-k8s-env-sources-with-templates.md | WEBPUSH + release placeholder parity |
+| 02-regenerate-linear-baseline-gz.md | Regenerate `0003a_app_linear_baseline.sql.gz` after SQL ops changes |
+| 03-verify-alpha-product-membership-wiring.md | Confirm `alpha/common` owns product-membership remote base |
+
+## Verification
+
+```bash
+grep WEBPUSH infra/k8s/base/api/source/api.env infra/config/env-templates/api.env.example
+make help_test
+```
diff --git a/.llm/plans/completed/metaboost-infra-env-align/01-sync-k8s-env-sources-with-templates.md b/.llm/plans/completed/metaboost-infra-env-align/01-sync-k8s-env-sources-with-templates.md
new file mode 100644
index 00000000..8735b680
--- /dev/null
+++ b/.llm/plans/completed/metaboost-infra-env-align/01-sync-k8s-env-sources-with-templates.md
@@ -0,0 +1,31 @@
+# 01 — Sync k8s env sources with templates
+
+## Scope
+
+Triage found `infra/config/env-templates/` and `apps/*/ .env.example` include **WEBPUSH_** keys but
+`infra/k8s/base/api/source/api.env` does not yet. Align k8s ConfigMap sources with canonical templates
+per **env-file-formatting** skill.
+
+## Files
+
+| Source (k8s base) | Template |
+| --- | --- |
+| `infra/k8s/base/api/source/api.env` | `infra/config/env-templates/api.env.example` |
+| `infra/k8s/base/web/source/web-sidecar.env` | `infra/config/env-templates/web-sidecar.env.example` |
+| `infra/k8s/base/management-api/source/management-api.env` | `infra/config/env-templates/management-api.env.example` |
+| `infra/k8s/base/management-web/source/management-web-sidecar.env` | sidecar template if exists |
+
+Also confirm `API_RELEASE` / `READINESS_API_EXPECTED_RELEASE` use consistent `X.Y.Z-staging.N`
+placeholders across base + alpha apps (pending diff already does this — **KEEP**).
+
+## Steps
+
+1. Add WEBPUSH keys to k8s base env files matching template order/comments (empty values for secrets).
+2. Add `NEXT_PUBLIC_WEBPUSH_*` to `web-sidecar.env` if missing vs template.
+3. Do not hand-edit generated gz or migration SQL in this plan (plan 02).
+
+## Verification
+
+```bash
+diff <(grep -E '^[A-Z]' infra/config/env-templates/api.env.example | cut -d= -f1) <(grep -E '^[A-Z]' infra/k8s/base/api/source/api.env | tr '=' ' ' | awk '{print $1}' | sed 's/$/=/') || true
+```
diff --git a/.llm/plans/completed/metaboost-infra-env-align/02-regenerate-linear-baseline-gz.md b/.llm/plans/completed/metaboost-infra-env-align/02-regenerate-linear-baseline-gz.md
new file mode 100644
index 00000000..c720a96d
--- /dev/null
+++ b/.llm/plans/completed/metaboost-infra-env-align/02-regenerate-linear-baseline-gz.md
@@ -0,0 +1,29 @@
+# 02 — Regenerate linear baseline gz
+
+## Scope
+
+Pending changes add +39 lines to both:
+
+- `infra/k8s/base/db/source/app/0001_app_schema.sql`
+- `infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql`
+
+and update `infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz` (9197 → 9640 bytes).
+
+Ops-flow check: the gz must be **generated**, not hand-edited. Follow **linear-baseline-gz-sync**
+skill (MetaBoost) / Podverse `make db_regen_linear_baseline` equivalent.
+
+## Steps
+
+1. Identify MetaBoost make target for linear baseline regeneration (grep Makefile for `linear` /
+   `baseline` / `0003a`).
+2. Run regeneration after SQL sources are final.
+3. Commit updated gz with matching SQL sources in same PR.
+4. Operator runs CI `/test` or local `verify-linear-baseline.sh` if available.
+
+## Verification
+
+```bash
+bash scripts/database/verify-linear-baseline.sh
+```
+
+(if script exists in MetaBoost — else use CI db-baseline step)
diff --git a/.llm/plans/completed/metaboost-infra-env-align/03-verify-alpha-product-membership-wiring.md b/.llm/plans/completed/metaboost-infra-env-align/03-verify-alpha-product-membership-wiring.md
new file mode 100644
index 00000000..6d8f3fba
--- /dev/null
+++ b/.llm/plans/completed/metaboost-infra-env-align/03-verify-alpha-product-membership-wiring.md
@@ -0,0 +1,26 @@
+# 03 — Verify alpha product-membership wiring
+
+## Scope
+
+Pending change moves `base/product-membership` remote resource from `alpha/api` to `alpha/common`.
+Docs in `INFRA-K8S-BASE.md` already updated. Verify GitOps child apps still mount config correctly.
+
+## Steps
+
+1. Confirm `alpha/common/kustomization.yaml` includes product-membership remote base.
+2. Confirm `alpha/api/kustomization.yaml` no longer duplicates product-membership (api uses
+   envFrom referencing shared ConfigMap).
+3. Run `kustomize build` for `infra/k8s/alpha/common` and `infra/k8s/alpha/api` (or rely on
+   `metaboost-infra-alpha-contracts.yml` CI workflow).
+4. Update `ARGOCD-GITOPS-METABOOST.md` if operator steps changed.
+
+## Verification
+
+```bash
+kustomize build --load-restrictor LoadRestrictionsNone infra/k8s/alpha/common >/dev/null
+kustomize build --load-restrictor LoadRestrictionsNone infra/k8s/alpha/api >/dev/null
+```
+
+## Argo CD
+
+After merge, push to GitOps branch and sync `metaboost-alpha` apps per **argocd-gitops-push**.
diff --git a/.llm/plans/completed/metaboost-infra-env-align/COPY-PASTA.md b/.llm/plans/completed/metaboost-infra-env-align/COPY-PASTA.md
new file mode 100644
index 00000000..68584885
--- /dev/null
+++ b/.llm/plans/completed/metaboost-infra-env-align/COPY-PASTA.md
@@ -0,0 +1,28 @@
+# MetaBoost infra env align — Copy-Pasta
+
+### Agent 1 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-infra-env-align/01-sync-k8s-env-sources-with-templates.md
+```
+
+### Agent 2 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-infra-env-align/02-regenerate-linear-baseline-gz.md
+```
+
+### Agent 3 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-infra-env-align/03-verify-alpha-product-membership-wiring.md
+
+Push infra/k8s changes to the Argo CD–tracked branch when done.
+```
+
+Move set to `.llm/plans/completed/metaboost-infra-env-align/` when complete.
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule: mark each agent prompt `[x]` when done; move each
+finished `NN-*.md` to `.llm/plans/completed/metaboost-infra-env-align/`; then move the whole set.
diff --git a/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..9e87b177
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/00-EXECUTION-ORDER.md
@@ -0,0 +1,7 @@
+# MetaBoost LLM exports reference cleanup — Execution order
+
+## Phase 1 (single step)
+
+1. `01-remove-stale-eslint-llm-glob.md` — delete the orphaned ESLint config block.
+
+When complete, move this set to `.llm/plans/completed/metaboost-llm-exports-reference-cleanup/`.
diff --git a/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/00-SUMMARY.md b/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/00-SUMMARY.md
new file mode 100644
index 00000000..5eb41473
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/00-SUMMARY.md
@@ -0,0 +1,19 @@
+# MetaBoost LLM exports reference cleanup — Summary
+
+## Purpose
+
+Remove the last dangling reference to the retired multi-LLM export pipeline after triage Plan 01
+found the deletions align with Podverse and are otherwise complete.
+
+## Scope
+
+- Remove dead ESLint override for deleted `scripts/llm/**` in `eslint.config.mjs`.
+
+Out of scope: re-litigating export removal (already done per
+`.llm/plans/completed/remove-multi-llm-exports/`).
+
+## Verification
+
+```bash
+rg -n "scripts/llm" /Users/mitcheldowney/repos/pv/metaboost --glob '!.llm/plans/**' || echo "clean"
+```
diff --git a/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/01-remove-stale-eslint-llm-glob.md b/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/01-remove-stale-eslint-llm-glob.md
new file mode 100644
index 00000000..01c8079b
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/01-remove-stale-eslint-llm-glob.md
@@ -0,0 +1,33 @@
+# 01 — Remove stale ESLint `scripts/llm` glob
+
+## Scope
+
+The export pipeline under `scripts/llm/` was deleted. `eslint.config.mjs` still contains an override
+block targeting that path.
+
+## File
+
+[`eslint.config.mjs`](/eslint.config.mjs) — remove the config object at lines 81–86:
+
+```javascript
+  {
+    files: ['scripts/llm/**/*.mjs', 'scripts/llm/**/*.js', 'scripts/llm/**/*.cjs'],
+    rules: {
+      'no-console': ['warn', { allow: ['warn', 'error'] }],
+    },
+  },
+```
+
+The general `scripts/**` override (lines 75–80) already covers remaining scripts.
+
+## Steps
+
+1. Delete the block above (including trailing comma as needed for valid JS).
+2. Confirm no other `scripts/llm` references remain.
+
+## Verification
+
+```bash
+rg -n "scripts/llm" /Users/mitcheldowney/repos/pv/metaboost --glob '!.llm/plans/**' || echo "clean"
+npm run lint
+```
diff --git a/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/COPY-PASTA.md b/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/COPY-PASTA.md
new file mode 100644
index 00000000..4c8572b9
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-exports-reference-cleanup/COPY-PASTA.md
@@ -0,0 +1,23 @@
+# MetaBoost LLM exports reference cleanup — Copy-Pasta
+
+## Agent 1 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-llm-exports-reference-cleanup/01-remove-stale-eslint-llm-glob.md
+
+Remove the dead scripts/llm ESLint override block. When done, move this plan set to
+.llm/plans/completed/metaboost-llm-exports-reference-cleanup/.
+```
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule: mark Agent 1 `[x]` when done; move
+`01-remove-stale-eslint-llm-glob.md` to `.llm/plans/completed/metaboost-llm-exports-reference-cleanup/`;
+then move the whole set.
+
+## Verification
+
+```bash
+rg -n "scripts/llm" /Users/mitcheldowney/repos/pv/metaboost --glob '!.llm/plans/**' || echo "clean"
+npm run lint
+```
diff --git a/.llm/plans/completed/metaboost-llm-workspace-align/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-llm-workspace-align/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..42b359fa
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-workspace-align/00-EXECUTION-ORDER.md
@@ -0,0 +1,8 @@
+# MetaBoost LLM workspace align — Execution order
+
+1. `01-align-llm-root-and-dev-docs.md`
+2. `02-align-llm-index-and-context.md`
+3. `03-cleanup-llm-local.md`
+4. `04-complete-feature-workflow-gap.md` (operator chooses adopt vs document-only)
+
+Move to `completed/` when done.
diff --git a/.llm/plans/completed/metaboost-llm-workspace-align/00-SUMMARY.md b/.llm/plans/completed/metaboost-llm-workspace-align/00-SUMMARY.md
new file mode 100644
index 00000000..e0faaf74
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-workspace-align/00-SUMMARY.md
@@ -0,0 +1,23 @@
+# MetaBoost LLM workspace align — Summary
+
+## Purpose
+
+Align MetaBoost `.llm/` workspace layout docs and `docs/development/llm/` contributor policy with
+Podverse after triage Plan 04. **Do not** replace MetaBoost-specific `architecture.md` with Podverse
+content.
+
+## Plans
+
+| File | Focus |
+| --- | --- |
+| 01-align-llm-root-and-dev-docs.md | `.llm/LLM.md`, `DOCS-DEVELOPMENT-LLM.md`, history archive |
+| 02-align-llm-index-and-context.md | Index files, `LLM-CONTEXT.md`, `conventions.md` |
+| 03-cleanup-llm-local.md | Remove or document empty `.llm/local/` |
+| 04-complete-feature-workflow-gap.md | Optional: adopt Podverse `complete-feature.yml` or document manual-only history |
+
+## Verification
+
+```bash
+diff <(find .llm -maxdepth 2 -type d | sort) <(cd ../podverse && find .llm -maxdepth 2 -type d | sort)
+rg -n "llm/exports" .llm/LLM.md docs/development/llm/DOCS-DEVELOPMENT-LLM.md
+```
diff --git a/.llm/plans/completed/metaboost-llm-workspace-align/01-align-llm-root-and-dev-docs.md b/.llm/plans/completed/metaboost-llm-workspace-align/01-align-llm-root-and-dev-docs.md
new file mode 100644
index 00000000..83c1ce9b
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-workspace-align/01-align-llm-root-and-dev-docs.md
@@ -0,0 +1,33 @@
+# 01 — Align LLM root and dev docs
+
+## Scope
+
+Port Podverse wording into MetaBoost planning/contributor LLM docs while **keeping** MetaBoost-specific
+policy (exports prohibition, `plan-files-convention` + `plan-execution-completion-tracking`).
+
+## Files
+
+### `.llm/LLM.md`
+
+- **Keep** the `.llm/exports/` prohibition row (Podverse removed this row; MetaBoost correctly documents the ban).
+- **Add** Podverse “Completing features (GitHub Actions)” section for `complete-feature.yml`, with a
+  note if the workflow is not yet adopted (see plan 04).
+- **Plans section:** cross-reference both `plan-files-convention` and Podverse `plan-completion` skill
+  (adopt skill in abcmemory-align or link as optional).
+
+### `docs/development/llm/DOCS-DEVELOPMENT-LLM.md`
+
+- **Keep** “What we removed” exports prohibition block.
+- Align plan/history sections with Podverse structure; reference MB plan completion rule/skill.
+- Add complete-feature workflow paragraph when plan 04 adopts the workflow.
+
+### `docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md`
+
+- Port substantive updates from Podverse archive doc (retired workflow description for humans only).
+- Ensure `.cursorignore` still lists this path.
+
+## Verification
+
+```bash
+rg -n "complete-feature|plan-completion|llm/exports" .llm/LLM.md docs/development/llm/
+```
diff --git a/.llm/plans/completed/metaboost-llm-workspace-align/02-align-llm-index-and-context.md b/.llm/plans/completed/metaboost-llm-workspace-align/02-align-llm-index-and-context.md
new file mode 100644
index 00000000..3b3d7c88
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-workspace-align/02-align-llm-index-and-context.md
@@ -0,0 +1,22 @@
+# 02 — Align LLM index and context
+
+## Scope
+
+Sync index/helper docs under `.llm/`; **do not** overwrite MetaBoost `architecture.md` with Podverse.
+
+## Files
+
+| File | Action |
+| --- | --- |
+| `plans/active/LLM-PLANS-ACTIVE.md` | Align wording with Podverse; keep MB skill names |
+| `plans/completed/LLM-PLANS-COMPLETED.md` | Same if present |
+| `history/active/LLM-HISTORY-ACTIVE.md` | Compare to Podverse; align if drifted |
+| `context/LLM-CONTEXT.md` | Port Podverse structure |
+| `context/conventions.md` | Port generic Podverse sections (git branches, naming); keep MB references |
+| `context/architecture.md` | **Review only** — verify MB tier table matches current packages; update if stale, do not copy Podverse tiers |
+
+## Verification
+
+```bash
+test -f .llm/context/architecture.md && grep -n "management-orm" .llm/context/architecture.md
+```
diff --git a/.llm/plans/completed/metaboost-llm-workspace-align/03-cleanup-llm-local.md b/.llm/plans/completed/metaboost-llm-workspace-align/03-cleanup-llm-local.md
new file mode 100644
index 00000000..70336fb1
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-workspace-align/03-cleanup-llm-local.md
@@ -0,0 +1,24 @@
+# 03 — Cleanup `.llm/local/`
+
+## Scope
+
+MetaBoost has an empty `.llm/local/` directory not present in Podverse.
+
+## Options (pick one)
+
+1. **Remove** the empty directory (recommended if unused).
+2. **Document** in `.llm/LLM.md` as operator-local-only (not committed content) and add to
+   `.gitignore` if future local notes land there.
+
+## Steps
+
+1. Confirm directory is empty and unused in git history intent.
+2. Apply chosen option.
+3. Re-run directory structure diff vs Podverse.
+
+## Operator git (if removing)
+
+```bash
+rmdir .llm/local
+git add -A .llm/
+```
diff --git a/.llm/plans/completed/metaboost-llm-workspace-align/04-complete-feature-workflow-gap.md b/.llm/plans/completed/metaboost-llm-workspace-align/04-complete-feature-workflow-gap.md
new file mode 100644
index 00000000..cda5cf75
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-workspace-align/04-complete-feature-workflow-gap.md
@@ -0,0 +1,24 @@
+# 04 — Complete-feature workflow gap
+
+## Scope
+
+Podverse automates `.llm/history/active/` → `completed/` on PR merge via
+`.github/workflows/complete-feature.yml`. MetaBoost lacks this workflow.
+
+## Option A — Adopt (recommended for parity)
+
+1. Copy/adapt `podverse/.github/workflows/complete-feature.yml` for MetaBoost (branch `develop`,
+   paths under `.llm/history/`).
+2. Ensure required GitHub App secrets exist (document in `docs/repo-management/` if needed).
+3. Update `DOCS-DEVELOPMENT-LLM.md` and `.llm/LLM.md` to describe automation.
+
+## Option B — Document manual-only
+
+1. In `.llm/LLM.md` and `DOCS-DEVELOPMENT-LLM.md`, state history archival is **manual** in MetaBoost.
+2. Reference `plan-execution-completion-tracking` rule for plan-set moves.
+
+## Verification (Option A)
+
+```bash
+test -f .github/workflows/complete-feature.yml && echo ok
+```
diff --git a/.llm/plans/completed/metaboost-llm-workspace-align/COPY-PASTA.md b/.llm/plans/completed/metaboost-llm-workspace-align/COPY-PASTA.md
new file mode 100644
index 00000000..1bb8b9ac
--- /dev/null
+++ b/.llm/plans/completed/metaboost-llm-workspace-align/COPY-PASTA.md
@@ -0,0 +1,38 @@
+# MetaBoost LLM workspace align — Copy-Pasta
+
+### Agent 1 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-llm-workspace-align/01-align-llm-root-and-dev-docs.md
+
+Align .llm/LLM.md and docs/development/llm/; keep MetaBoost exports prohibition text.
+```
+
+### Agent 2 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-llm-workspace-align/02-align-llm-index-and-context.md
+
+Align index/context docs; do not replace architecture.md with Podverse content.
+```
+
+### Agent 3 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-llm-workspace-align/03-cleanup-llm-local.md
+```
+
+### Agent 4 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-llm-workspace-align/04-complete-feature-workflow-gap.md
+
+Choose adopt vs manual-only for complete-feature history automation; implement choice.
+```
+
+When done, move set to `.llm/plans/completed/metaboost-llm-workspace-align/`.
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule: mark each agent prompt `[x]` when done; move each
+finished `NN-*.md` to `.llm/plans/completed/metaboost-llm-workspace-align/`; then move the whole set.
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..f34298f6
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/00-EXECUTION-ORDER.md
@@ -0,0 +1,89 @@
+# MetaBoost ↔ Podverse Alignment Triage — Execution Order
+
+## How to read this file
+
+- **Phases run sequentially.** Finish a phase before starting the next.
+- **Within a phase, agents marked "parallel" run simultaneously.** Wait for all of them before
+  moving on.
+- Every triage plan is **read-only analysis**: it inspects MetaBoost's pending changes, compares to
+  Podverse, writes a Decisions section into its own plan file, and (only if work remains) authors a
+  stage-2 plan set. No code/config edits occur in any phase here.
+
+## Phase 1 — Theme triage (parallel, read-only)
+
+Plans 01–08 inspect independent areas of the diff and do not conflict. Run them in parallel
+(up to 8 agents) using the COPY-PASTA prompts. Each plan writes its own Decisions section and may
+author a stage-2 plan set.
+
+- 01 — `01-llm-exports-removal-triage.md`
+- 02 — `02-changelog-removal-triage.md`
+- 03 — `03-cursor-abcmemory-triage.md`
+- 04 — `04-llm-workspace-docs-triage.md`
+- 05 — `05-ci-github-workflows-triage.md`
+- 06 — `06-k8s-alpha-infra-env-triage.md`
+- 07 — `07-git-hooks-dev-scripts-triage.md`
+- 08 — `08-build-package-config-triage.md`
+
+**Wait for all of Phase 1 to complete before Phase 2.**
+
+## Phase 2 — Podverse parity inventory (single agent)
+
+- 09 — `09-podverse-parity-inventory.md`
+
+Runs after Phase 1 so it can incorporate any PARITY-GAP rows the theme plans surfaced. Produces the
+consolidated `metaboost-podverse-parity-gaps` stage-2 plan set (if gaps are accepted).
+
+**Wait for Phase 2 to complete before Phase 3.**
+
+## Phase 3 — Consolidation (single agent)
+
+- Collect every stage-2 plan set spawned in Phases 1–2 into a single index appended to this file
+  (a `Spawned stage-2 plan sets` section), so the operator has one place to drive follow-up work.
+- Recommend (do not run) the git actions implied by all DISCARD decisions, grouped by plan, in one
+  fenced `bash` block for the operator.
+- When the whole triage set is finished and all spawned stage-2 sets are either executed or queued,
+  move this set to `.llm/plans/completed/metaboost-podverse-alignment-triage/`.
+
+## Parallelization summary
+
+```
+Phase 1: 8 agents in parallel (plans 01-08)  -> WAIT
+Phase 2: 1 agent (plan 09)                    -> WAIT
+Phase 3: 1 agent (consolidation)              -> done
+```
+
+## Spawned stage-2 plan sets
+
+**Phase 3 consolidated:** 2026-06-21. Run each set's `COPY-PASTA.md` to implement alignment (not
+during triage). Suggested order: exports cleanup → abcmemory → build/dev scripts → CI → infra →
+llm workspace → parity gaps (skills/tooling last; defers to abcmemory + ci-ops for rules/workflows).
+
+| Source plan | Stage-2 set path | Plans | Status |
+| --- | --- | --- | --- |
+| 01 | `.llm/plans/active/metaboost-llm-exports-reference-cleanup/` | 1 | **Queued** — stale ESLint `scripts/llm` glob |
+| 02 | _(none)_ | — | **Resolved** — KEEP only (changelog removal) |
+| 03 | `.llm/plans/active/metaboost-abcmemory-align/` | 4 | **Queued** — adopt rules, port drifted abcmemory |
+| 04 | `.llm/plans/active/metaboost-llm-workspace-align/` | 4 | **Queued** — `.llm/` + LLM docs |
+| 05 | `.llm/plans/active/metaboost-ci-ops-align/` | 4 | **Queued** — workflows, ci.yml, dependabot |
+| 06 | `.llm/plans/active/metaboost-infra-env-align/` | 3 | **Queued** — k8s env, linear baseline gz |
+| 07 | `.llm/plans/active/metaboost-dev-scripts-align/` | 3 | **Queued** — git hooks, dev scripts |
+| 08 | `.llm/plans/active/metaboost-build-config-align/` | 3 | **Queued** — ESLint, vitest, lint-staged |
+| 09 | `.llm/plans/active/metaboost-podverse-parity-gaps/` | 5 + notes | **Queued** — ADOPT skills, run-workspaces |
+
+**Total:** 8 stage-2 sets, 27 numbered implementation plans (+ `PROMOTE-TO-PODVERSE-NOTES.md`).
+
+## DISCARD decisions — operator git actions
+
+Only one DISCARD row across all triage plans. Run from MetaBoost repo root:
+
+```bash
+# Plan 04 — DISCARD empty .llm/local/ (not in Podverse; unused)
+rmdir .llm/local 2>/dev/null || rm -rf .llm/local
+```
+
+All other themes: **KEEP** deletions/commits proceed via stage-2 alignment PRs; no revert needed.
+
+## Triage completion
+
+All 10 COPY-PASTA prompts complete. This set moved to
+`.llm/plans/completed/metaboost-podverse-alignment-triage/`.
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/00-SUMMARY.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/00-SUMMARY.md
new file mode 100644
index 00000000..1b687bef
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/00-SUMMARY.md
@@ -0,0 +1,93 @@
+# MetaBoost ↔ Podverse Alignment Triage — Summary
+
+## Purpose
+
+This is a **stage-1 triage plan set**. Its job is to comb through MetaBoost's accumulated pending
+changes (staged + unstaged + untracked), decide which are still valid, align them to Podverse
+conventions, and **spawn stage-2 work plan sets** only where real work remains.
+
+This pass (authoring these plan files) and the triage execution pass both produce **markdown plan
+files only**. No product code, config, infra, or non-plan files are edited by the triage plans. Git
+actions (unstage/revert/commit) are only ever **recommended to the operator**, never run by an agent.
+
+## Source of truth
+
+The **Podverse monorepo** (`/Users/mitcheldowney/repos/pv/podverse`) is the source of truth for
+process, ops flow, and LLM standards. MetaBoost (`/Users/mitcheldowney/repos/pv/metaboost`) should
+emulate it. When a MetaBoost change moves it toward Podverse conventions, that is good; when it
+diverges, that is a finding.
+
+## Scope
+
+In scope: **process / ops-flow / LLM-standards / infra / CI** themes.
+
+Out of scope: product-feature code (web push notifications, error boundaries, the helpers-requests
+web auth/buckets refactor, ORM entity/service code). That work was already triaged by the completed
+set `.llm/plans/completed/metaboost-staged-changes-cleanup/`. If a triage plan notices feature code
+that contradicts a process/ops finding, it records a pointer but does not re-triage the feature code.
+
+## Decision framework
+
+Every pending change examined by a triage plan is classified as exactly one of:
+
+| Decision     | Meaning                                                          | Action                                       |
+| ------------ | --------------------------------------------------------------- | -------------------------------------------- |
+| KEEP         | Already matches Podverse; valid as-is                           | Recommend operator commit it                 |
+| ALIGN        | Right direction, but needs edits to match Podverse              | Spawn a stage-2 work plan set                |
+| DISCARD      | Divergent, stale, or abandoned                                  | Recommend operator revert/unstage            |
+| PARITY-GAP   | Podverse has something MetaBoost lacks (or vice versa)          | Spawn a stage-2 work plan set                |
+
+Each triage plan ends by writing a **Decisions** section (a table mapping changed paths to one of the
+above) and, when any ALIGN or PARITY-GAP rows exist, creating a focused stage-2 plan set under
+`.llm/plans/active/`.
+
+## Theme inventory (mapped to changed paths)
+
+| Plan | Theme                          | Representative changed paths                                                                 |
+| ---- | ------------------------------ | ------------------------------------------------------------------------------------------- |
+| 01   | Multi-LLM exports removal      | `.llm/exports/**`, `scripts/llm/**`, `.github/workflows/llm-exports-*.yml`, export docs      |
+| 02   | Changelog system removal       | `docs/development/CHANGELOGS/**`, `docs/operations/CHANGELOG-*`, `release-changelog` skill   |
+| 03   | Cursor abcmemory additions     | `.cursor/hooks/`, `.cursor/prompts/`, new `.cursor/rules/*`, new `.cursor/skills/*`          |
+| 04   | LLM workspace + docs restructure | `.llm/LLM.md`, `.llm/context/`, `.llm/history/`, `.llm/templates/`, `docs/development/llm/**` |
+| 05   | CI / GitHub workflows + repo mgmt | `.github/workflows/**`, `.github/dependabot.yml`, `scripts/github/**`, `docs/repo-management/**` |
+| 06   | K8s alpha + infra + env        | `infra/k8s/alpha/**`, `infra/k8s/base/**` env, `infra/config/env-templates/**`, infra docs   |
+| 07   | Git hooks + dev scripts        | `scripts/git-hooks/**`, `scripts/start-feature.sh`, `scripts/local-env/setup.sh`, `eslint-rules/` |
+| 08   | Build / package / lint config  | `package.json`, `eslint.config.mjs`, `packages/*/package.json`, `*/vitest.config.ts`         |
+| 09   | Podverse parity inventory      | Full bidirectional `.cursor` rules/skills, workflows, Makefiles, scripts, docs, infra        |
+
+## Confirmed parity facts (already verified during planning)
+
+These are high-confidence facts gathered while creating this set. Triage plans should re-confirm but
+can treat them as strong priors:
+
+- Podverse has **no** `.llm/exports/`, **no** `scripts/llm/`, **no** `llm-exports-*` workflows.
+  MetaBoost's removal of all of these **aligns** → expected KEEP (Plan 01).
+- Podverse has **no** `docs/development/CHANGELOGS/` and **no** `release-changelog` skill. MetaBoost's
+  removal **aligns** → expected KEEP (Plan 02).
+- Podverse **has** web push (`apps/web/src/lib/notifications/webpush/`), `apps/web/src/app/error.tsx`,
+  and `apps/web/src/app/global-error.tsx`. MetaBoost adding equivalents **aligns** (feature code is
+  out of scope here, but this confirms direction).
+- Podverse **has** `.cursor/hooks/` and `.cursor/prompts/`. MetaBoost adding them **aligns** (Plan 03).
+- Podverse has **74** skills vs MetaBoost **69**; Podverse has several process/ops rules MetaBoost
+  lacks (see Plan 09). MetaBoost has a few rules Podverse lacks (evaluate for adoption).
+
+## Stage-1 → stage-2 contract
+
+```
+Stage 1 (this set):  triage plans analyze + record decisions + (if work) author stage-2 plan sets
+Stage 2 (spawned):   focused work plan sets that actually edit code/config (executed later)
+```
+
+A triage plan that finds nothing to do simply records KEEP rows and marks its theme resolved. A
+triage plan that finds ALIGN/PARITY-GAP rows creates a new directory under `.llm/plans/active/`
+(e.g. `metaboost-podverse-parity-gaps/`) following the plan-files-convention, then references it from
+its Decisions section. Stage-2 sets are not executed during triage.
+
+## Conventions
+
+- Follows [plan-files-convention](/.cursor/skills/plan-files-convention/SKILL.md) and
+  [parallel-plan-execution](/.cursor/skills/parallel-plan-execution/SKILL.md).
+- Markdown follows the markdown-formatting rule (100-char lines, aligned tables, blank lines).
+- Each plan file stays under ~300 lines; split into `NN-part-N-*.md` if a theme grows.
+- Existing active sets (`custom-css-remote-file-operator-themes`, `doc-link-path-missed-followup`)
+  are left untouched.
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/01-llm-exports-removal-triage.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/01-llm-exports-removal-triage.md
new file mode 100644
index 00000000..878c5458
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/01-llm-exports-removal-triage.md
@@ -0,0 +1,97 @@
+# 01 — Multi-LLM Exports Removal Triage
+
+## Scope
+
+MetaBoost previously generated per-vendor LLM guidance (GitHub Copilot, OpenCode) from the Cursor
+source via a `scripts/llm/` export pipeline, committed the generated output under `.llm/exports/`,
+and ran sync workflows. This theme triages the **removal** of that entire system.
+
+Podverse (source of truth) has **no** export pipeline: no `.llm/exports/`, no `scripts/llm/`, no
+`llm-exports-*` workflows. So the expected outcome is that MetaBoost's removal is correct and should
+be kept; the work is to confirm the removal is complete and no dangling references remain.
+
+## Changed paths (deletions unless noted)
+
+- `.llm/exports/**` (entire tree: `github-copilot/`, `opencode/`, `.state/`, `LLM-EXPORTS.md`)
+- `scripts/llm/allowed-targets.mjs`, `scripts/llm/export-from-cursor.mjs`,
+  `scripts/llm/guard-exports-prompt.sh`, `scripts/llm/vendor-config.mjs`,
+  `scripts/llm/vendor-selector.mjs`, `scripts/llm/lib/*-adapter.mjs`
+- `.github/workflows/llm-exports-full-sync.yml`, `.github/workflows/llm-exports-sync.yml`,
+  `.github/workflows/llm-exports-optional-cloud-llm.yml`
+- `.cursor/skills/llm-exports-scripts/SKILL.md`, `.cursor/skills/llm-history/SKILL.md` (verify
+  whether `llm-history` belongs to this theme or Plan 04)
+- `.cursor/rules/llm-exports-ci.mdc`, `.cursor/rules/llm-history-tracking.mdc`
+- `docs/development/llm/EXPORT-TARGETS.md`, `docs/development/llm/GH-EXPORTS-SETUP.md`,
+  `docs/development/llm/CURSOR-COPILOT-SYNC.md`, `docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md`
+- `.gitignore`, `.cursorignore` (entries that referenced exports/state)
+
+## Triage method
+
+1. Confirm Podverse has none of these constructs (already verified: true).
+2. Search MetaBoost's **remaining** tree for dangling references to the removed system:
+   - `rg -n "llm/exports|export-from-cursor|vendor-selector|EXPORT-TARGETS|GH-EXPORTS|copilot-instructions|opencode-instructions|llm-exports" --glob '!.llm/plans/**'`
+   - Check `.cursorrules`, `AGENTS.md`, `docs/development/llm/DOCS-DEVELOPMENT-LLM.md`,
+     `package.json` scripts, Makefiles, and any workflow for references to export targets/scripts.
+3. Confirm `.gitignore` / `.cursorignore` no longer reference now-deleted export/state paths in a way
+   that is misleading.
+4. Cross-check the completed set `.llm/plans/completed/remove-multi-llm-exports/` to avoid
+   re-deciding what was already settled; this triage only verifies completeness.
+
+## Expected decisions
+
+Most rows should be **KEEP** (removal aligns to Podverse). Create ALIGN rows only for dangling
+references that still need cleanup.
+
+| Path / group                     | Decision | Notes                                             |
+| -------------------------------- | -------- | ------------------------------------------------- |
+| `.llm/exports/**`                | KEEP     | Podverse has no exports tree                       |
+| `scripts/llm/**`                 | KEEP     | Podverse has no export scripts                     |
+| `.github/workflows/llm-exports-*`| KEEP     | Podverse has no export workflows                   |
+| export docs (4 files)            | KEEP     | confirm no inbound links remain                    |
+| `.cursorignore` / `.gitignore`   | TBD      | KEEP if clean; ALIGN if stale entries remain       |
+| dangling references (if any)     | ALIGN    | spawn stage-2 cleanup if found                     |
+
+(Fill the table with concrete results during execution.)
+
+## Decisions
+
+**Executed:** 2026-06-21  
+**Podverse check:** No `.llm/exports/`, `scripts/llm/`, or `llm-exports-*` workflows (aligned).  
+**Prior work:** `.llm/plans/completed/remove-multi-llm-exports/` — removal largely complete; this
+triage verifies completeness only.
+
+| Path / group | Decision | Notes |
+| --- | --- | --- |
+| `.llm/exports/**` | **KEEP** | Gone from working tree; Podverse has no exports tree |
+| `scripts/llm/**` | **KEEP** | Gone; Podverse has no export scripts |
+| `.github/workflows/llm-exports-*` (3 files) | **KEEP** | Gone; Podverse has no export workflows |
+| `docs/development/llm/EXPORT-TARGETS.md` etc. (4 files) | **KEEP** | Gone; no inbound links to deleted paths |
+| `.cursor/skills/llm-exports-scripts` | **KEEP** | Gone; INDEX.md has no export skill entry |
+| `.cursor/skills/llm-history` | **KEEP** | Gone; tied to removed `llm-history-tracking` rule. Optional human archive in `LLM-HISTORY-WORKFLOW-ARCHIVE.md` (`.cursorignore`) — not agent guidance; Plan 04 owns workspace history policy |
+| `.cursor/rules/llm-exports-ci.mdc` | **KEEP** | Gone |
+| `.cursor/rules/llm-history-tracking.mdc` | **KEEP** | Gone |
+| `.gitignore` | **KEEP** | No stale `.llm/exports` or export-state entries |
+| `.cursorignore` | **KEEP** | Only lists archived history doc (intentional) |
+| `docs/development/llm/DOCS-DEVELOPMENT-LLM.md` § "What we removed" | **KEEP** | Mentions `.llm/exports/` as **prohibited** policy — correct, not a dangling ref |
+| `docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md` | **KEEP** | Historical archive of retired rule; cursorignored |
+| `eslint.config.mjs` `scripts/llm/**` override block | **ALIGN** | Dead ESLint glob (lines 81–86); directory deleted |
+| `package.json` / Makefiles / git hooks | **KEEP** | No export script refs; `llm/` branch prefix is unrelated (LLM-only PRs) |
+| `AGENTS.md` / `.cursorrules` | **KEEP** | Cursor-only policy; no export pipeline refs |
+
+**Stage-2 spawned:** `.llm/plans/active/metaboost-llm-exports-reference-cleanup/` (one stale ESLint block).
+
+**Operator git (KEEP deletions):** Stage and commit the export-removal deletions when ready — no
+DISCARD rows in this theme.
+
+## Stage-2 spawn rule
+
+If step 2 finds dangling references, create
+`.llm/plans/active/metaboost-llm-exports-reference-cleanup/` with a focused plan listing each
+reference and the exact edit, following the plan-files-convention. Otherwise record "no stage-2
+needed".
+
+## Verification (for the operator, later)
+
+```bash
+rg -n "llm/exports|export-from-cursor|vendor-selector|llm-exports" /Users/mitcheldowney/repos/pv/metaboost --glob '!.llm/plans/**' || echo "no dangling references"
+```
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/02-changelog-removal-triage.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/02-changelog-removal-triage.md
new file mode 100644
index 00000000..0be6f5da
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/02-changelog-removal-triage.md
@@ -0,0 +1,80 @@
+# 02 — Changelog System Removal Triage
+
+## Scope
+
+MetaBoost maintained a manual changelog system: per-version files under
+`docs/development/CHANGELOGS/`, an "upcoming"/"archive" pair under `docs/operations/`, per-package
+`CHANGELOG.md` files, a `release-changelog` skill, and changelog steps inside the version bump
+script. This theme triages the **removal** of that system.
+
+Podverse (source of truth) has **no** changelog system: no `docs/development/CHANGELOGS/`, no
+`release-changelog` skill. Expected outcome: MetaBoost's removal aligns and should be kept; the work
+is to confirm release/publish flows no longer depend on changelogs.
+
+## Changed paths
+
+- `docs/development/CHANGELOGS/0.1.10.md` … `0.1.15.md` (deleted)
+- `docs/operations/CHANGELOG-UPCOMING.md`, `docs/operations/CHANGELOG-ARCHIVE/*` (deleted)
+- `packages/metaboost-signing/CHANGELOG.md` (deleted)
+- `.cursor/skills/release-changelog/SKILL.md` (deleted)
+- `scripts/publish/bump-version.sh` (modified — changelog hooks removed)
+- `.cursor/skills/INDEX.md` (modified — release-changelog entry removed)
+- `docs/development/DEVELOPMENT.md` (modified — changelog reference removed)
+
+## Triage method
+
+1. Confirm Podverse has no changelog system (already verified: true).
+2. Confirm the changelog removal is internally consistent:
+   - `rg -n "CHANGELOG|changelog|release-changelog" --glob '!.llm/plans/**'` across the repo.
+   - Inspect `scripts/publish/bump-version.sh` and the publish workflows (`publish-main.yml`,
+     `publish-staging.yml`, `publish-metaboost-signing.yml`) for any remaining changelog steps or
+     references (coordinate with Plan 05, which owns those workflows).
+   - Check `docs/PUBLISH.md`, `docs/GITFLOW.md`, and release runbooks for stale changelog mentions.
+3. Compare MetaBoost's resulting release/version-bump flow to Podverse's (`scripts/` and publish
+   workflows) to confirm parity of the "no changelog" approach.
+
+## Expected decisions
+
+| Path / group                       | Decision | Notes                                          |
+| ---------------------------------- | -------- | ---------------------------------------------- |
+| `docs/development/CHANGELOGS/**`   | KEEP     | Podverse has no changelogs                       |
+| `docs/operations/CHANGELOG-*`      | KEEP     | confirm no inbound links                         |
+| `packages/*/CHANGELOG.md`          | KEEP     | Podverse packages have no changelogs             |
+| `release-changelog` skill          | KEEP     | confirm removed from INDEX + .cursorrules        |
+| `bump-version.sh` changes          | TBD      | KEEP if clean; ALIGN if half-removed             |
+| stale changelog references (if any)| ALIGN    | spawn stage-2 cleanup                            |
+
+## Decisions
+
+**Executed:** 2026-06-21  
+**Podverse check:** No `docs/development/CHANGELOGS/`, no `release-changelog` skill (aligned).
+
+| Path / group | Decision | Notes |
+| --- | --- | --- |
+| `docs/development/CHANGELOGS/**` (0.1.10–0.1.15) | **KEEP** | Gone; Podverse has no per-version changelog files |
+| `docs/operations/CHANGELOG-UPCOMING.md` + archive | **KEEP** | Gone; no inbound links from active docs |
+| `packages/metaboost-signing/CHANGELOG.md` | **KEEP** | Gone |
+| `.cursor/skills/release-changelog` | **KEEP** | Gone; `INDEX.md` has no release-changelog entry |
+| `scripts/publish/bump-version.sh` | **KEEP** | Changelog hooks removed; audit gate + version bump + Linux lockfile only |
+| `docs/development/DEVELOPMENT.md` | **KEEP** | No changelog section in index |
+| `docs/PUBLISH.md` | **KEEP** | GitHub Release auto-descriptions only; no file-based changelog system |
+| `docs/development/release/STAGING-MAIN-PROMOTION.md` | **KEEP** | No changelog workflow refs |
+| `.github/workflows/publish-*.yml` | **KEEP** | No `changelog-pr-to-develop` job in current workflows (removed; see completed `atomic-publish-version-reservation` archive) |
+| Active tree `rg -i changelog` | **KEEP** | **Zero matches** outside `.llm/plans/**` and `.llm/history/**` (historical notes only) |
+| `.llm/history/active/semver-changelog-workflow/` | **KEEP** | Optional human history of retired system — not operational guidance |
+
+**Stage-2 spawned:** none — removal is complete and consistent with Podverse's no-changelog approach.
+
+**Operator git (KEEP deletions):** Commit staged changelog deletions when bundling the alignment PR; no DISCARD rows.
+
+## Stage-2 spawn rule
+
+If any changelog references remain (docs, scripts, workflows), create
+`.llm/plans/active/metaboost-changelog-reference-cleanup/` enumerating each and the exact edit.
+Otherwise record "no stage-2 needed".
+
+## Verification (for the operator, later)
+
+```bash
+rg -n "CHANGELOG|release-changelog" /Users/mitcheldowney/repos/pv/metaboost --glob '!.llm/plans/**' || echo "no changelog references"
+```
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/03-cursor-abcmemory-triage.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/03-cursor-abcmemory-triage.md
new file mode 100644
index 00000000..3738107b
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/03-cursor-abcmemory-triage.md
@@ -0,0 +1,149 @@
+# 03 — Cursor abcmemory Additions Triage
+
+## Scope
+
+"abcmemory" = committed Cursor agent guidance under `.cursor/` plus `.cursorrules` / `.cursorignore`.
+This theme triages MetaBoost's **new and modified** abcmemory files and aligns them with Podverse's
+equivalents (content, naming, and structure). Podverse is the source of truth for what these rules
+and skills should say.
+
+Podverse has `.cursor/hooks/` and `.cursor/prompts/`, so MetaBoost adding them aligns. Podverse has
+74 skills vs MetaBoost's 69, and a broader rule set; the bidirectional gap accounting is owned by
+Plan 09, but this plan triages the specific files MetaBoost has changed/added.
+
+## Changed paths
+
+New (untracked):
+
+- `.cursor/hooks/`, `.cursor/hooks.json` (if present), `.cursor/prompts/`
+- `.cursor/rules/CURSOR-RULES.md`, `.cursor/rules/abcmemory-vocabulary.mdc`,
+  `.cursor/rules/app-local-ui-wrappers.mdc`, `.cursor/rules/architecture-tier-dependencies.mdc`,
+  `.cursor/rules/css-custom-properties-no-var-fallbacks.mdc`,
+  `.cursor/rules/import-specifiers-tiered.mdc`
+- `.cursor/skills/CURSOR-SKILLS.md`, `.cursor/skills/abcmemory/`,
+  `.cursor/skills/docker-runtime-workspace-parity/`, `.cursor/skills/import-specifiers-tiered/`,
+  `.cursor/skills/management-post-save-navigation/`
+
+Modified:
+
+- `.cursorrules`, `.cursorignore`, `.cursor/skills/INDEX.md`
+- Many `.cursor/rules/*.mdc` and `.cursor/skills/*/SKILL.md` (see `git diff --stat` for the full list:
+  e.g. `api`, `argocd-gitops-push`, `documentation-conventions`, `e2e-page-tests`,
+  `env-file-formatting`, `global`, `k8s`, `linear-db-migrations`, `llm-cursor-source`,
+  `plan-files-convention`, `response-ending-make-verify`, `reusable-components`,
+  `storybook-component-docs`).
+
+## Triage method
+
+For each new/modified MetaBoost abcmemory file:
+
+1. Find the Podverse counterpart (same rule/skill name under `podverse/.cursor/`). For example
+   `abcmemory-vocabulary.mdc`, `architecture-tier-dependencies.mdc`,
+   `css-custom-properties-no-var-fallbacks.mdc`, `import-specifiers-tiered.mdc`, and the `abcmemory`
+   skill all exist in Podverse.
+2. Diff the MetaBoost version against Podverse's. Classify:
+   - identical-intent (only repo-name/path differences) → KEEP.
+   - drifted content (Podverse has newer/clearer guidance) → ALIGN (port Podverse's wording).
+   - MetaBoost-specific with no Podverse counterpart → KEEP, but note for Plan 09 (candidate for
+     Podverse adoption or intentional divergence).
+3. Validate index/aggregation files are consistent: `.cursor/skills/INDEX.md`,
+   `.cursor/rules/CURSOR-RULES.md`, `.cursor/skills/CURSOR-SKILLS.md` should list exactly the files
+   that exist. Flag any missing/extra entries.
+4. Confirm `.cursorrules` and `.cursorignore` changes match Podverse's structure/intent where the
+   topics overlap.
+5. Verify hooks/prompts: compare `.cursor/hooks/` and `.cursor/prompts/` to Podverse
+   (`CURSOR-HOOKS.md`, `CURSOR-PROMPTS.md`) for structural parity.
+
+## Expected decisions
+
+| File group                                  | Decision | Notes                                              |
+| ------------------------------------------- | -------- | -------------------------------------------------- |
+| new hooks / prompts                         | KEEP     | aligns; confirm structure matches Podverse          |
+| rules with Podverse counterparts            | TBD      | KEEP if matched; ALIGN if drifted                   |
+| skills with Podverse counterparts           | TBD      | KEEP if matched; ALIGN if drifted                   |
+| MetaBoost-only rules/skills                 | KEEP     | note in Plan 09 for adoption/divergence decision    |
+| INDEX / CURSOR-RULES / CURSOR-SKILLS        | TBD      | ALIGN if listings are stale                          |
+
+## Decisions
+
+**Executed:** 2026-06-21  
+**Podverse check:** `.cursor/hooks/` and `.cursor/prompts/` match Podverse byte-for-byte; Podverse has
+no `INDEX.md` (MetaBoost-specific quick-ref — **KEEP**).
+
+### New / untracked abcmemory
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `.cursor/hooks/`, `.cursor/prompts/` | **KEEP** | Identical to Podverse (`CURSOR-HOOKS.md`, `CURSOR-PROMPTS.md`) |
+| `.cursor/rules/CURSOR-RULES.md` | **KEEP** | Identical to Podverse |
+| `.cursor/skills/CURSOR-SKILLS.md` | **KEEP** | Identical to Podverse |
+| `.cursor/rules/abcmemory-vocabulary.mdc` | **KEEP** | Matches Podverse |
+| `.cursor/rules/architecture-tier-dependencies.mdc` | **KEEP** | Matches Podverse |
+| `.cursor/rules/import-specifiers-tiered.mdc` | **KEEP** | Matches Podverse |
+| `.cursor/rules/css-custom-properties-no-var-fallbacks.mdc` | **ALIGN** | Drift: token source paths (`_themes.scss` vs Podverse `_variables-root.scss` + `_themes.scss`) |
+| `.cursor/skills/abcmemory/` | **ALIGN** | Minor formatting/table drift vs Podverse; port PV table alignment |
+| `.cursor/skills/docker-runtime-workspace-parity/` | **ALIGN** | Drift vs Podverse; port with `@metaboost/*` paths |
+| `.cursor/skills/import-specifiers-tiered/` | **ALIGN** | Drift vs Podverse; port with MB doc paths |
+| `.cursor/skills/management-post-save-navigation/` | **ALIGN** | Drift vs Podverse; port with MB routes/apps |
+| No `.cursor/hooks.json` | **KEEP** | Podverse also has no `hooks.json` (placeholder dirs only) |
+
+### Modified shared abcmemory (drift vs Podverse)
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `.cursor/rules/end-with-targeted-make-report-verify.mdc` | **ALIGN** | Port Podverse wording; **retain** MetaBoost `E2E_API_GATE_MODE` default-off policy |
+| `.cursor/rules/plan-creation.mdc` | **ALIGN** | Minor drift; align to Podverse (same `.llm/plans/active/` convention) |
+| `.cursor/skills/llm-cursor-source/` | **ALIGN** | Post-exports rewrite drift; port Podverse cursor-only policy |
+| `.cursor/skills/response-ending-make-verify/` | **ALIGN** | Port Podverse; keep MB make targets / API gate notes |
+| `.cursor/skills/reusable-components/` | **ALIGN** | Port Podverse; adapt `@metaboost/ui` + app names |
+| Other modified skills (`api`, `k8s`, `global`, etc.) | **KEEP** | Repo-specific paths; spot-check during stage-2 only if touched by 03-port plan |
+
+### MetaBoost-only (no Podverse counterpart)
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `api-no-pii-credentials-in-responses.mdc` | **KEEP** | MB-specific security; candidate PROMOTE in Plan 09 |
+| `commands-from-metaboost-root.mdc` | **KEEP** | Mirror of Podverse `commands-from-monorepo-root` |
+| `path-casing-imports.mdc` + skill | **KEEP** | MB/CI lesson learned |
+| `single-readme.mdc` + skill | **KEEP** | MB doc layout policy |
+| `i18n-locale-language.mdc` | **KEEP** | Overlaps Podverse `i18n-management`; MB-specific |
+| `plan-execution-completion-tracking.mdc` | **KEEP** | Overlaps Podverse `plan-lifecycle`; reconcile in stage-2 |
+| `.cursor/skills/INDEX.md` | **KEEP** | Podverse has no INDEX; quick-ref is MB convention |
+
+### Podverse-only process rules MetaBoost lacks (PARITY-GAP → stage-2)
+
+| Rule | Decision | Notes |
+| --- | --- | --- |
+| `operator-only-git-operations.mdc` | **ALIGN** | In Podverse `.cursorrules`; **missing** MB rule file |
+| `documentation-updates.mdc` | **ALIGN** | Generic process standard |
+| `github-actions-yaml.mdc` | **ALIGN** | Pairs with CI triage Plan 05 |
+| `test-timeout-budget.mdc` | **ALIGN** | Test ops standard |
+| `startup-validation-env-order.mdc` | **ALIGN** | Env ops standard (+ skill in PV) |
+| `config-type-safety.mdc` | **ALIGN** | Config standard |
+| `build-order-doc-sync.mdc` | **ALIGN** | Build ops standard |
+| `infra-k8s.mdc` | **ALIGN** | Infra standard (+ MB `k8s` skill exists) |
+| `plan-lifecycle.mdc` | **ALIGN** | Reconcile with MB `plan-execution-completion-tracking` |
+| `openapi-sync.mdc` | **ALIGN** | MB has `swagger-openapi` skill; align naming/content |
+| `shared-ui-i18n.mdc`, `prefer-shared-ui-web-management.mdc` | **ALIGN** | Adapt for `@metaboost/ui` |
+| Product-specific PV rules (media, lighthouse, extensions, etc.) | **N/A** | Defer to Plan 09 |
+
+### `.cursorrules`
+
+| Decision | Notes |
+| --- | --- |
+| **ALIGN** | Missing Podverse sections: issue linking, **operator-only git**, commands-from-root detail, richer code-quality bullets; retain MB-specific `E2E_API_GATE_MODE` test policy |
+
+**Stage-2 spawned:** `.llm/plans/active/metaboost-abcmemory-align/` (4 implementation plans + COPY-PASTA).
+
+## Stage-2 spawn rule
+
+If any rules/skills are drifted vs Podverse or any index file is stale, create
+`.llm/plans/active/metaboost-abcmemory-align/` enumerating each file with the exact wording/structure
+to port from Podverse. Otherwise record "no stage-2 needed".
+
+## Verification (for the operator, later)
+
+```bash
+diff <(ls /Users/mitcheldowney/repos/pv/metaboost/.cursor/rules) <(ls /Users/mitcheldowney/repos/pv/podverse/.cursor/rules)
+diff <(ls /Users/mitcheldowney/repos/pv/metaboost/.cursor/skills) <(ls /Users/mitcheldowney/repos/pv/podverse/.cursor/skills)
+```
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/04-llm-workspace-docs-triage.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/04-llm-workspace-docs-triage.md
new file mode 100644
index 00000000..f47cabf8
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/04-llm-workspace-docs-triage.md
@@ -0,0 +1,83 @@
+# 04 — LLM Workspace + Docs Restructure Triage
+
+## Scope
+
+The `.llm/` tree is a **planning workspace** (plans, history, context, templates) — not abcmemory.
+This theme triages MetaBoost's restructure of `.llm/` and its LLM-process documentation under
+`docs/development/llm/`, aligning the workspace shape and the contributor-facing LLM docs to
+Podverse.
+
+This is distinct from Plan 03 (committed `.cursor/` agent memory) and Plan 01 (the removed exports
+pipeline). Where a file is ambiguous between themes (e.g. `llm-history` skill), Plan 01 owns the
+exports/history-tracking removal and this plan owns the workspace structure + docs.
+
+## Changed paths
+
+- `.llm/LLM.md` (modified — large rewrite per diff stat)
+- `.llm/context/` (new), `.llm/history/active/`, `.llm/history/completed/` (new index files),
+  `.llm/templates/LLM-TEMPLATES.md` (new), `.llm/plans/active/LLM-PLANS-ACTIVE.md`,
+  `.llm/plans/completed/LLM-PLANS-COMPLETED.md` (new index files)
+- `docs/development/llm/DOCS-DEVELOPMENT-LLM.md` (modified)
+- `docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md` (new)
+- Note: deleted LLM docs (`EXPORT-TARGETS.md`, `GH-EXPORTS-SETUP.md`, `CURSOR-COPILOT-SYNC.md`,
+  `LLM-EDITOR-ALIGNMENT-PROMPT.md`) are triaged in Plan 01.
+
+## Triage method
+
+1. Compare MetaBoost `.llm/` structure to Podverse `.llm/` (directories: `plans/active`,
+   `plans/completed`, `history/active`, `history/completed`, `context`, `templates`). Confirm
+   MetaBoost's new index files (`LLM-*.md`) match Podverse's naming and purpose.
+2. Diff `docs/development/llm/DOCS-DEVELOPMENT-LLM.md` against Podverse's contributor LLM policy doc.
+   Classify drift as KEEP/ALIGN.
+3. Confirm `.llm/LLM.md` rewrite reflects the post-exports world (no references to the removed export
+   pipeline) and matches Podverse's `.llm/LLM.md` intent where applicable.
+4. Check `.llm/context/` content for accuracy (e.g. architecture tier table referenced by
+   `architecture-tier-dependencies` rule) against Podverse's `.llm/context/architecture.md`.
+5. Confirm the new active history/plan folders that are untracked are intended to be committed vs.
+   left local (compare to Podverse's `.gitignore`/policy for `.llm/`).
+
+## Expected decisions
+
+| File group                              | Decision | Notes                                              |
+| --------------------------------------- | -------- | -------------------------------------------------- |
+| `.llm/` directory structure + indexes   | TBD      | KEEP if parity; ALIGN if shape differs from Podverse|
+| `.llm/LLM.md` rewrite                    | TBD      | KEEP if consistent + export-free                    |
+| `DOCS-DEVELOPMENT-LLM.md`               | TBD      | ALIGN if drifted from Podverse policy               |
+| `LLM-HISTORY-WORKFLOW-ARCHIVE.md`       | TBD      | KEEP if matches Podverse history workflow           |
+| `.llm/context/` content                 | TBD      | ALIGN if architecture context is stale/incorrect    |
+
+## Decisions
+
+**Executed:** 2026-06-21  
+**Podverse check:** Same top-level `.llm/` layout (`context/`, `history/`, `plans/`, `templates/`);
+same `docs/development/llm/` files (2 docs each). MetaBoost has extra `.llm/local/` (empty).
+
+| Path / group | Decision | Notes |
+| --- | --- | --- |
+| `.llm/` directory structure | **KEEP** | Matches Podverse except `.llm/local/` (empty legacy dir) |
+| `.llm/plans/active/LLM-PLANS-ACTIVE.md` + completed index | **ALIGN** | Minor wording: MB cites `plan-files-convention`; PV cites `plan-completion` |
+| `.llm/history/active/LLM-HISTORY-ACTIVE.md` | **KEEP** | Same pattern as Podverse |
+| `.llm/templates/LLM-TEMPLATES.md` | **KEEP** | Present in both; no blocking drift checked |
+| `.llm/LLM.md` rewrite | **ALIGN** | MB adds exports-prohibition row (KEEP that); missing Podverse **complete-feature.yml** history automation section |
+| `docs/development/llm/DOCS-DEVELOPMENT-LLM.md` | **ALIGN** | Drift: plan-completion vs plan-files-convention refs; MB has extra “What we removed” exports policy (**KEEP**); missing complete-feature workflow paragraph |
+| `docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md` | **ALIGN** | Large drift (~195 diff lines) vs Podverse archive doc |
+| `.llm/context/architecture.md` | **KEEP** | **MetaBoost-specific** tier table (correct for MB packages); do not replace with Podverse architecture |
+| `.llm/context/conventions.md` | **ALIGN** | Drift vs Podverse; port generic sections, keep MB package/app names |
+| `.llm/context/LLM-CONTEXT.md` | **ALIGN** | Differs from Podverse; align structure |
+| `.llm/local/` | **DISCARD** | Empty dir not in Podverse; remove or gitignore (operator) |
+| Export pipeline refs in LLM docs | **KEEP** | Prohibition text in `LLM.md` + `DOCS-DEVELOPMENT-LLM.md` is correct post-removal policy |
+| `.github/workflows/complete-feature.yml` | **PARITY-GAP** | Podverse has it; MetaBoost does not — cross-ref Plan 05 CI or stage-2 plan 04 |
+
+**Stage-2 spawned:** `.llm/plans/active/metaboost-llm-workspace-align/`
+
+## Stage-2 spawn rule
+
+If the workspace structure or LLM docs drift from Podverse, create
+`.llm/plans/active/metaboost-llm-workspace-align/` listing each file and the structure/wording to
+port. Otherwise record "no stage-2 needed".
+
+## Verification (for the operator, later)
+
+```bash
+diff <(cd /Users/mitcheldowney/repos/pv/metaboost && find .llm -maxdepth 2 -type d | sort) <(cd /Users/mitcheldowney/repos/pv/podverse && find .llm -maxdepth 2 -type d | sort)
+```
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/05-ci-github-workflows-triage.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/05-ci-github-workflows-triage.md
new file mode 100644
index 00000000..516890cf
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/05-ci-github-workflows-triage.md
@@ -0,0 +1,110 @@
+# 05 — CI / GitHub Workflows + Repo Management Triage
+
+## Scope
+
+This theme triages MetaBoost's continuous-integration and GitHub repo-management changes — the ops
+flow around code: PR/CI gates, publish/release workflows, dependabot, labels, and branch protection.
+Podverse is the reference for what the ops flow should look like.
+
+## Changed paths
+
+Workflows (`.github/workflows/`):
+
+- Deleted: `llm-exports-full-sync.yml`, `llm-exports-sync.yml`, `llm-exports-optional-cloud-llm.yml`
+  (these are confirmed/owned by Plan 01 — only verify they are gone from CI graph here).
+- Modified: `ci.yml`, `i18n.yml`, `pr-labeler.yml`, `publish-main.yml`, `publish-staging.yml`,
+  `publish-metaboost-signing.yml`.
+
+Repo management:
+
+- `.github/dependabot.yml`
+- `scripts/github/setup-all-labels.sh`, `scripts/github/SCRIPTS-GITHUB.md`
+- `docs/repo-management/BRANCH-PROTECTION.md`, `docs/repo-management/DEPENDABOT.md`,
+  `docs/repo-management/GITHUB-LABELS.md`, `docs/repo-management/GITHUB-SETUP.md`
+- Release docs: `docs/PUBLISH.md`, `docs/GITFLOW.md`,
+  `docs/development/release/STAGING-MAIN-PROMOTION.md`,
+  `docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md`
+
+## Triage method
+
+1. For each modified workflow, diff against the **intent** of the matching Podverse workflow under
+   `podverse/.github/workflows/`. Podverse has a `github-actions-yaml` rule and a documented CI/
+   publish flow; check MetaBoost's workflows follow the same conventions (job naming, concurrency,
+   permissions, lint/test gates, Linux lockfile usage).
+2. Confirm the publish workflows no longer reference the removed changelog system (coordinate with
+   Plan 02) or the removed exports system (Plan 01).
+3. Compare dependabot config, label setup, and branch-protection docs to Podverse's repo-management
+   docs for parity of process.
+4. Identify CI capabilities Podverse has that MetaBoost lacks (e.g. specific gates/linters/jobs) and
+   record them as PARITY-GAP rows for Plan 09.
+
+## Expected decisions
+
+| File group                          | Decision | Notes                                                |
+| ----------------------------------- | -------- | ---------------------------------------------------- |
+| `ci.yml` / `i18n.yml` / `pr-labeler`| TBD      | KEEP if aligned; ALIGN if conventions drift           |
+| publish-* workflows                 | TBD      | KEEP if changelog/export refs gone; ALIGN otherwise   |
+| `dependabot.yml` + label scripts    | TBD      | KEEP/ALIGN vs Podverse repo-management                |
+| repo-management + release docs      | TBD      | ALIGN if stale paths/process vs Podverse              |
+| Podverse-only CI gates              | PARITY-GAP | record for Plan 09                                   |
+
+## Decisions
+
+**Executed:** 2026-06-21  
+**Export/changelog in workflows:** **clean** (no `llm-exports` or `CHANGELOG` refs — Plans 01/02 confirmed).
+
+### Deleted workflows (Plan 01)
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `llm-exports-full-sync.yml`, `llm-exports-sync.yml`, `llm-exports-optional-cloud-llm.yml` | **KEEP** | Gone; correct |
+
+### Shared workflows (drift vs Podverse)
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `ci.yml` | **ALIGN** | MB uses GHA postgres/valkey **services** (KEEP); missing Podverse **OpenAPI check** and **npm ci retry** loop; MB adds i18n validate + type-check (KEEP) |
+| `i18n.yml` | **ALIGN** | Differs; port Podverse conventions (`github-actions-yaml` rule) |
+| `pr-labeler.yml` | **ALIGN** | Differs; minor — align with Podverse |
+| `publish-staging.yml` | **ALIGN** | No changelog refs; port npm ci retries + reserve-version logging from Podverse |
+| `publish-main.yml` | **ALIGN** | Same as staging |
+
+### MetaBoost-only workflows
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `publish-metaboost-signing.yml` | **KEEP** | No Podverse counterpart; publish workflows clean of changelog |
+| `metaboost-infra-alpha-contracts.yml` | **KEEP** | MB kustomize alpha validation; valuable |
+
+### Podverse-only workflows (PARITY-GAP)
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `complete-feature.yml` | **ALIGN** | Also in `metaboost-llm-workspace-align` plan 04 — adopt once |
+| `vulnerability-scanner.yml` | **ALIGN** | Scheduled npm audit; adopt in stage-2 |
+
+### Repo management
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `.github/dependabot.yml` | **ALIGN** | Comment/ignore-list drift vs Podverse; same intent |
+| `scripts/github/setup-all-labels.sh` | **ALIGN** | Review label set vs Podverse |
+| `docs/repo-management/*` | **ALIGN** | Remove stale export/changelog refs if any |
+| Release docs (`PUBLISH.md`, `GITFLOW.md`, etc.) | **KEEP** | Already no changelog system (Plan 02); minor cross-link updates only |
+
+**Stage-2 spawned:** `.llm/plans/active/metaboost-ci-ops-align/`
+
+**Plan 09 input:** Podverse `github-actions-yaml` rule (adopt via abcmemory-align); OpenAPI CI gate.
+
+## Stage-2 spawn rule
+
+If workflows/docs drift from Podverse conventions, create
+`.llm/plans/active/metaboost-ci-ops-align/` with exact workflow/doc edits. Record any
+Podverse-only CI gates as input to Plan 09's `metaboost-podverse-parity-gaps` set.
+
+## Verification (for the operator, later)
+
+```bash
+diff <(ls /Users/mitcheldowney/repos/pv/metaboost/.github/workflows) <(ls /Users/mitcheldowney/repos/pv/podverse/.github/workflows)
+rg -n "CHANGELOG|llm-exports" /Users/mitcheldowney/repos/pv/metaboost/.github/workflows || echo "clean"
+```
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/06-k8s-alpha-infra-env-triage.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/06-k8s-alpha-infra-env-triage.md
new file mode 100644
index 00000000..483f3a61
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/06-k8s-alpha-infra-env-triage.md
@@ -0,0 +1,128 @@
+# 06 — K8s Alpha + Infra + Env Triage
+
+## Scope
+
+This theme triages MetaBoost's infrastructure changes: the `alpha` Kustomize overlay, base K8s env
+sources, env templates, and infra documentation. Focus is **ops-flow consistency** (deploy/GitOps
+shape, env layout, readiness/liveness conventions), not application SQL/column patterns.
+
+Podverse is the reference for K8s/env conventions (it has `infra-k8s`, `linear-baseline-0003`,
+`startup-validation-env-order`, `extensions-env`, `env-file-formatting` rules/skills).
+
+## Changed paths
+
+K8s overlay (`infra/k8s/alpha/`):
+
+- `alpha-application.yaml`, `alpha/common/kustomization.yaml`, `alpha/*/kustomization.yaml`
+  (api, db, keyvaldb, management-api, management-web, ops, web)
+- `alpha/apps/*.yaml` (api, common, db, keyvaldb, management-api, management-web, ops, web)
+
+K8s base + env:
+
+- `infra/k8s/base/api/source/api.env`,
+  `infra/k8s/base/management-api/source/management-api.env`,
+  `infra/k8s/base/management-web/source/management-web-sidecar.env`,
+  `infra/k8s/base/web/source/web-sidecar.env`,
+  `infra/k8s/base/product-membership/source/product-membership-settings.env`
+- `infra/k8s/base/db/source/app/0001_app_schema.sql`,
+  `infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz`,
+  `infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql`
+- `infra/config/env-templates/api.env.example`,
+  `infra/config/env-templates/management-api.env.example`,
+  `infra/config/env-templates/web-sidecar.env.example`
+
+Docs:
+
+- `infra/INFRA.md`, `infra/k8s/INFRA-K8S.md`, `infra/k8s/INFRA-K8S-BASE.md`,
+  `infra/docker/local/INFRA-DOCKER-LOCAL.md`,
+  `infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md`
+- `docs/development/k8s/ARGOCD-GITOPS-METABOOST.md`, `docs/development/k8s/K3D-ARGOCD-LOCAL.md`,
+  `docs/development/k8s/REMOTE-K8S-GITOPS.md`
+
+## Triage method
+
+1. For the `alpha` overlay diff (mostly small kustomization edits + readiness/liveness probes per
+   recent commits), confirm changes follow Podverse's overlay conventions and the `infra-k8s` rule.
+   Many edits look like probe/version alignment — classify KEEP if consistent.
+2. For base + template `.env` files, apply `env-file-formatting` rules (quoting, alignment with
+   `.env.example`, ordering) and confirm parity with Podverse env layout. The
+   `argocd-gitops-push` skill applies: note that infra changes must be pushed to the Argo CD branch.
+3. For the SQL/baseline files (`0001_app_schema.sql`, `0003a_..._baseline.sql.gz`): only verify the
+   **ops flow** is consistent (the linear-baseline gz is generated, not hand-edited; per the
+   `linear-baseline-gz-sync` skill it must be regenerated and committed). Do not review
+   column-level schema patterns (out of scope). Flag if the gz appears hand-edited or out of sync
+   with the SQL source.
+4. Record any Podverse infra conventions MetaBoost lacks as PARITY-GAP rows for Plan 09.
+
+## Expected decisions
+
+| File group                         | Decision | Notes                                                |
+| ---------------------------------- | -------- | ---------------------------------------------------- |
+| `alpha/**` kustomizations + apps   | TBD      | KEEP if probe/overlay conventions match Podverse      |
+| base/template `.env` files         | TBD      | ALIGN if env-file-formatting/parity issues             |
+| SQL + linear-baseline gz           | TBD      | KEEP if gz regenerated from source; ALIGN if drifted   |
+| infra/k8s docs                     | TBD      | ALIGN if stale paths/process                           |
+| Podverse-only infra conventions    | PARITY-GAP | record for Plan 09                                   |
+
+## Decisions
+
+**Executed:** 2026-06-21  
+**Scope note:** SQL +39 lines treated as ops-flow only (webpush-related schema); column review out of scope.
+
+### Alpha overlay (`infra/k8s/alpha/`)
+
+| Path / group | Decision | Notes |
+| --- | --- | --- |
+| `alpha/apps/*.yaml` targetRevision | **KEEP** | `X.X.X-staging.N` → `X.Y.Z-staging.N` placeholder alignment |
+| `alpha/*/kustomization.yaml` remote refs | **KEEP** | Same placeholder update across overlays |
+| `alpha/api` removes product-membership resource | **KEEP** | Moved to `alpha/common` — matches updated `INFRA-K8S-BASE.md` |
+| `alpha/common/kustomization.yaml` adds product-membership | **KEEP** | Shared ConfigMap composition pattern; verify kustomize build in stage-2 |
+| Probe/readiness changes (recent commits) | **KEEP** | No conflicting drift vs Podverse in pending diff |
+
+### Base + template env
+
+| Path / group | Decision | Notes |
+| --- | --- | --- |
+| `infra/config/env-templates/*.env.example` WEBPUSH keys | **KEEP** | Aligns with feature env; templates updated |
+| `infra/k8s/base/api/source/api.env` | **ALIGN** | Missing WEBPUSH keys present in templates — sync in stage-2 |
+| `infra/k8s/base/web/source/web-sidecar.env` | **ALIGN** | Add `NEXT_PUBLIC_WEBPUSH_*` to match template |
+| Release placeholders in base env | **KEEP** | `X.Y.Z-staging.N` consistent with alpha apps |
+| `product-membership-settings.env` comment | **KEEP** | Documents alpha/common composition |
+
+### SQL + linear baseline (ops flow)
+
+| Path / group | Decision | Notes |
+| --- | --- | --- |
+| `0001_app_schema.sql` (+39 lines, db + linear-migrations) | **KEEP** | Feature schema; ops: both paths updated together |
+| `0003a_app_linear_baseline.sql.gz` | **ALIGN** | Size changed with SQL — **verify/regenerate** via linear-baseline-gz-sync workflow in stage-2 |
+
+### Infra docs
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `INFRA-K8S-BASE.md` | **KEEP** | product-membership → alpha/common; doc link fix |
+| Other infra/k8s docs (pending diff) | **KEEP** | Minor path/link updates; no export/changelog refs |
+
+### Podverse-only (PARITY-GAP → Plan 09 / abcmemory)
+
+| Item | Notes |
+| --- | --- |
+| `infra-k8s.mdc` rule | Adopt via abcmemory-align |
+| Podverse `extensions-env`, workers/mq k8s bases | N/A for MetaBoost app set |
+
+**Stage-2 spawned:** `.llm/plans/active/metaboost-infra-env-align/`
+
+**Argo CD reminder:** stage-2 execution must push `infra/k8s/**` to GitOps branch.
+
+## Stage-2 spawn rule
+
+If env formatting/parity or infra-doc drift is found, create
+`.llm/plans/active/metaboost-infra-env-align/`. If the linear baseline gz is out of sync, that work
+belongs in a dedicated stage-2 plan referencing the `linear-baseline-gz-sync` skill. Note: any
+resulting `infra/k8s/**` edits require an Argo CD branch push (see `argocd-gitops-push`).
+
+## Verification (for the operator, later)
+
+```bash
+diff <(ls /Users/mitcheldowney/repos/pv/metaboost/infra/config/env-templates) <(ls /Users/mitcheldowney/repos/pv/podverse/infra/config/env-templates 2>/dev/null) || true
+```
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/07-git-hooks-dev-scripts-triage.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/07-git-hooks-dev-scripts-triage.md
new file mode 100644
index 00000000..b5bd84c4
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/07-git-hooks-dev-scripts-triage.md
@@ -0,0 +1,104 @@
+# 07 — Git Hooks + Dev Scripts Triage
+
+## Scope
+
+This theme triages MetaBoost's developer-workflow tooling: git hooks, the feature-start helper, local
+env setup, the version bump script, env-override tooling, a new markdown link normalizer, and a new
+local ESLint rules directory. These shape the "process around the code" for contributors.
+
+Podverse is the reference for these dev-workflow scripts and hooks.
+
+## Changed paths
+
+- `scripts/git-hooks/pre-commit` (modified — lines removed), `scripts/git-hooks/pre-push` (modified)
+- `scripts/start-feature.sh` (modified — large diff per stat)
+- `scripts/local-env/setup.sh` (modified)
+- `scripts/publish/bump-version.sh` (modified — changelog hooks owned by Plan 02; here review the
+  rest: lockfile-linux step, version propagation)
+- `scripts/env-overrides/home-override-env-files.inc.sh`,
+  `scripts/env-overrides/write-home-override-stubs.rb` (modified)
+- `scripts/development/normalize-markdown-links.mjs` (new)
+- `eslint-rules/` (new — local custom ESLint rules; coordinate scope with Plan 08 which owns
+  `eslint.config.mjs`)
+
+## Triage method
+
+1. Diff each modified script against its Podverse counterpart (`podverse/scripts/...`) where one
+   exists. Classify KEEP if behavior matches the Podverse process; ALIGN if drift.
+   - `pre-commit` / `pre-push`: confirm the removed lines were exports/changelog guards (now
+     obsolete) and that remaining checks match Podverse's hooks.
+   - `start-feature.sh`: confirm branch-naming/flow matches Podverse's gitflow.
+   - `local-env/setup.sh`: confirm env seeding aligns with Podverse's local env setup conventions.
+2. `normalize-markdown-links.mjs`: determine whether Podverse has an equivalent (it has a
+   `markdown-formatting` rule and documentation link policy). If MetaBoost-only, classify KEEP and
+   record as a candidate for Podverse adoption in Plan 09.
+3. `eslint-rules/`: confirm these custom rules correspond to documented conventions and whether
+   Podverse has equivalents (record gap for Plan 09). Wiring into `eslint.config.mjs` is verified in
+   Plan 08.
+4. Confirm no script still references removed systems (exports/changelog).
+
+## Expected decisions
+
+| File group                          | Decision | Notes                                               |
+| ----------------------------------- | -------- | --------------------------------------------------- |
+| `pre-commit` / `pre-push`           | TBD      | KEEP if removed lines were obsolete guards            |
+| `start-feature.sh`                  | TBD      | KEEP/ALIGN vs Podverse gitflow                        |
+| `local-env/setup.sh`                | TBD      | KEEP/ALIGN vs Podverse env setup                      |
+| `bump-version.sh` (non-changelog)   | TBD      | KEEP if lockfile-linux + version steps match          |
+| env-override tooling                | TBD      | KEEP/ALIGN vs Podverse                                 |
+| `normalize-markdown-links.mjs`      | KEEP     | note for Plan 09 (Podverse adoption candidate)        |
+| `eslint-rules/`                     | KEEP     | confirm wiring (Plan 08); note for Plan 09            |
+
+## Decisions
+
+**Executed:** 2026-06-21  
+**Stale refs check:** `rg` on `scripts/` — no CHANGELOG / llm-exports / guard-exports references.
+
+### Git hooks
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `pre-commit` (removed guard-exports block) | **KEEP** | Obsolete exports guard removal aligns with Plan 01 |
+| `pre-commit` (lint-staged still installed) | **ALIGN** | Podverse **removed** pre-commit entirely; `install-hooks.sh` runs `rm -f pre-commit` |
+| `pre-push` (+ `llm/` branch pattern) | **KEEP** | Matches Podverse after pending diff |
+| `install-hooks.sh` | **ALIGN** | MB copies pre-commit + uses `.git/hooks`; PV uses `git rev-parse --git-path`, CI skip, pre-push only |
+
+### Dev scripts
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `start-feature.sh` | **KEEP** | Matches Podverse flow (llm type, history scaffold disabled); MB fork slug `podverse/metaboost` |
+| `local-env/setup.sh` (WEBPUSH block) | **KEEP** | Same pattern as Podverse notifications handling; feature-specific keys |
+| `bump-version.sh` (changelog removal) | **KEEP** | Plan 02; lockfile-linux step matches Podverse |
+| `bump-version.sh` (audit allowlist) | **ALIGN** | PV allows advisory `1117015`; MB strict `""` — verify on next release bump |
+| `bump-version.sh` (workspace discovery) | **KEEP** | Node expansion vs PV `jq`/`npm query` — equivalent intent, MB-specific |
+| `env-overrides/*` (+ notifications.env) | **KEEP** | MB home-override flow; Podverse uses `scripts/local-env/prepare-overrides.sh` (different layout, documented) |
+
+### New / parity tooling
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `normalize-markdown-links.mjs` | **KEEP** | **Podverse has equivalent** (not MB-only); trivial diff; commit untracked copy |
+| `eslint-rules/require-relative-js-extension.mjs` | **KEEP** | **Podverse has same rule**; wiring in Plan 08 |
+
+### MetaBoost-only vs Podverse (Plan 09 inputs)
+
+| Item | Notes |
+| --- | --- |
+| `scripts/env-overrides/` layout | MB-specific; PV uses `local-env/prepare-overrides.sh` |
+| Root `lint-staged` in `package.json` | MB only; remove when pre-commit dropped (coordinate Plan 08) |
+| `pre-commit` hook file | PV deleted; MB should align |
+
+**Stage-2 spawned:** `.llm/plans/active/metaboost-dev-scripts-align/`
+
+## Stage-2 spawn rule
+
+If scripts/hooks drift from Podverse, create `.llm/plans/active/metaboost-dev-scripts-align/` with
+exact edits. Record MetaBoost-only tooling (link normalizer, custom eslint rules) as inputs to Plan
+09's parity set.
+
+## Verification (for the operator, later)
+
+```bash
+rg -n "CHANGELOG|llm-exports|export-from-cursor" /Users/mitcheldowney/repos/pv/metaboost/scripts || echo "scripts clean"
+```
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/08-build-package-config-triage.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/08-build-package-config-triage.md
new file mode 100644
index 00000000..3dad67be
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/08-build-package-config-triage.md
@@ -0,0 +1,111 @@
+# 08 — Build / Package / Lint Config Triage
+
+## Scope
+
+This theme triages MetaBoost's build, packaging, and lint configuration changes — the toolchain that
+governs how the monorepo builds, lints, and tests. Podverse is the reference for these conventions
+(ESM tiering, lint rules, vitest layout, Linux-canonical lockfile).
+
+## Changed paths
+
+- `package.json` (root — script/dep changes), `package-lock.json`
+- `eslint.config.mjs` (modified — new rules added per stat), `eslint-rules/` (new; rule source owned
+  by Plan 07, wiring owned here)
+- `packages/helpers-requests/package.json`, `packages/orm/package.json`,
+  `packages/metaboost-signing/package.json`
+- `packages/orm/tsconfig.json`
+- New vitest configs (untracked): `packages/helpers-requests/vitest.config.ts`,
+  `packages/orm/vitest.config.ts`, `packages/ui/vitest.config.ts`
+
+## Triage method
+
+1. Diff root `package.json` scripts against Podverse's. Confirm script names/orchestration
+   (`build:packages`, `lint`, `lint:fix`, `test:unit`, `test:e2e:api`, etc.) follow Podverse
+   conventions. Flag any script that referenced removed systems (exports/changelog).
+2. Diff `eslint.config.mjs` and confirm new rules align with Podverse's ESLint setup and the local
+   `eslint-rules/` (cross-check Plan 07). Confirm tiered import-specifier enforcement matches the
+   `import-specifiers-tiered` rule shared with Podverse.
+3. For new `vitest.config.ts` files, confirm they match Podverse's per-package vitest conventions
+   (test layout, environment, include/exclude) — Podverse drives `test:unit` across packages.
+4. For `tsconfig.json` and per-package `package.json` changes, confirm ESM/NodeNext settings and
+   workspace dependency declarations follow Podverse tier conventions
+   (`architecture-tier-dependencies`).
+5. `package-lock.json`: confirm it is the **Linux-canonical** lockfile (per `LOCKFILE-LINUX.md`) and
+   in sync with all workspace `package.json` files. This is mostly an ops-flow check (was the lockfile
+   regenerated correctly), not a line-by-line review.
+
+## Expected decisions
+
+| File group                         | Decision | Notes                                                |
+| ---------------------------------- | -------- | ---------------------------------------------------- |
+| root `package.json` scripts        | TBD      | KEEP if aligned + no removed-system refs              |
+| `eslint.config.mjs` + `eslint-rules`| TBD     | KEEP/ALIGN vs Podverse lint setup                     |
+| per-package `vitest.config.ts`     | TBD      | KEEP if matches Podverse vitest conventions           |
+| `tsconfig.json` + pkg deps         | TBD      | KEEP/ALIGN vs tier conventions                        |
+| `package-lock.json`                | TBD      | KEEP if Linux-canonical + in sync; ALIGN otherwise    |
+
+## Decisions
+
+**Executed:** 2026-06-21  
+**Stale refs:** no CHANGELOG / llm-exports in `package.json` or workspace package.json files.
+
+### Root `package.json`
+
+| Path / change | Decision | Notes |
+| --- | --- | --- |
+| Removed `llm:exports:*` / `llm:vendors` scripts | **KEEP** | Aligns with Plan 01 exports removal |
+| `test:unit` adds helpers-requests, orm, ui | **KEEP** | Matches new vitest configs and tests |
+| `lint-staged` devDependency + config | **ALIGN** | Podverse has none; remove with dev-scripts-align |
+| Script orchestration (`build:packages`, `lint`, `test:e2e:*`) | **KEEP** | MB-specific workspace lists; same intent as Podverse |
+| `test:unit` explicit chain vs PV `run-workspaces.mjs` | **PARITY-GAP** | Podverse uses `scripts/ci/run-workspaces.mjs --all`; candidate for Plan 09 |
+
+### `eslint.config.mjs` + `eslint-rules/`
+
+| Path / change | Decision | Notes |
+| --- | --- | --- |
+| `require-relative-js-extension` wiring (tier A/B/C) | **KEEP** | Matches Podverse import-specifiers-tiered enforcement |
+| Stale `scripts/llm/**` override block | **ALIGN** | Delete — directory removed |
+| `eslint-plugin-perfectionist` vs PV `simple-import-sort` | **PARITY-GAP** | Pre-existing MB choice; not changed in pending diff |
+| `eslint-plugin-storybook` flat config | **KEEP** | MB Storybook in `@metaboost/ui`; PV may differ |
+| Ignores `**/.llm/**` vs PV `**/.llm/plans/**` | **KEEP** | Broader ignore acceptable for MB |
+
+### Vitest configs (new)
+
+| Package | Decision | Notes |
+| --- | --- | --- |
+| `helpers-requests/vitest.config.ts` | **KEEP** | Node env; extra serial settings vs PV — acceptable |
+| `orm/vitest.config.ts` | **KEEP** | Node env; no `@orm` alias needed (tests use relative imports) |
+| `ui/vitest.config.ts` | **KEEP** | jsdom + react plugin; aligns with Podverse ui config |
+| `packages/ui/package.json` missing `test` + vitest deps | **ALIGN** | Root `test:unit` will fail until fixed |
+
+### Per-package `package.json` / tsconfig
+
+| Path | Decision | Notes |
+| --- | --- | --- |
+| `helpers-requests` + `orm` add `test` + vitest | **KEEP** | Correct wiring |
+| `orm/tsconfig.json` exclude `**/*.test.ts` | **KEEP** | Standard pattern |
+| `metaboost-signing` remove CHANGELOG from `files` | **KEEP** | Plan 02 |
+
+### `package-lock.json`
+
+| Item | Decision | Notes |
+| --- | --- | --- |
+| web-push / `@types/web-push` (api) | **KEEP** | Feature deps |
+| vitest/jsdom/cssom tree additions | **KEEP** | From new package tests |
+| Linux-canonical optional deps | **ALIGN** | Operator runs `update-lockfile-linux.sh` after dep changes on macOS |
+
+**Stage-2 spawned:** `.llm/plans/active/metaboost-build-config-align/`
+
+## Stage-2 spawn rule
+
+If build/lint/test config drifts from Podverse, create
+`.llm/plans/active/metaboost-build-config-align/` with exact edits. If the lockfile is not
+Linux-canonical or out of sync, that belongs in a dedicated stage-2 plan referencing
+`LOCKFILE-LINUX.md`.
+
+## Verification (for the operator, later)
+
+```bash
+cd /Users/mitcheldowney/repos/pv/metaboost && ./scripts/nix/with-env npm run lint
+cd /Users/mitcheldowney/repos/pv/metaboost && ./scripts/nix/with-env npm run build
+```
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/09-podverse-parity-inventory.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/09-podverse-parity-inventory.md
new file mode 100644
index 00000000..e9ab7ad2
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/09-podverse-parity-inventory.md
@@ -0,0 +1,191 @@
+# 09 — Podverse Parity Inventory (bidirectional)
+
+## Scope
+
+A full bidirectional inventory of **process / ops / LLM standards** between Podverse (source of
+truth) and MetaBoost. Runs in Phase 2, after the theme triages (01–08) so it can absorb any
+PARITY-GAP rows they surfaced. Output: a consolidated stage-2 plan set
+`.llm/plans/active/metaboost-podverse-parity-gaps/` for the gaps that are accepted as in-scope for
+MetaBoost.
+
+This plan looks at `.cursor` rules/skills, CI workflows, Makefiles, scripts, docs structure, and
+infra conventions in **both directions**.
+
+## Method
+
+1. Recompute the deltas (seeded below) at execution time, since other branches may have moved them:
+   - `comm -23 <(ls podverse/.cursor/skills|sort) <(ls metaboost/.cursor/skills|sort)` and the
+     reverse; same for `.cursor/rules`.
+2. For each Podverse-only rule/skill, classify:
+   - **ADOPT** — generic process/ops/LLM standard MetaBoost should emulate.
+   - **N/A** — Podverse-product-specific (e.g. media player, add-by-rss, workers, lighthouse) with no
+     MetaBoost analogue.
+3. For each MetaBoost-only rule/skill, classify:
+   - **MB-SPECIFIC** — legitimately MetaBoost-only (keep).
+   - **PROMOTE-TO-PODVERSE** — generic enough that Podverse should arguably adopt it (record as a
+     note for the Podverse repo; do not edit Podverse from MetaBoost work).
+4. Compare CI workflows, Makefiles, `scripts/`, `docs/` top-level structure for process/ops parity.
+5. Produce the `metaboost-podverse-parity-gaps` stage-2 set listing only ADOPT items (+ any
+   PARITY-GAP rows from 01–08), each as a focused work item.
+
+## Seeded delta — `.cursor/rules`
+
+Podverse-only rules (candidate ADOPT vs N/A):
+
+| Rule                                   | Suggested class | Rationale                                      |
+| -------------------------------------- | --------------- | ---------------------------------------------- |
+| `operator-only-git-operations`         | ADOPT           | Core agent/ops policy; MetaBoost lacks it        |
+| `plan-lifecycle`                       | ADOPT?          | Compare to MB `plan-execution-completion-tracking`|
+| `commands-from-monorepo-root`          | N/A (have)      | MB has `commands-from-metaboost-root` equivalent  |
+| `documentation-updates`                | ADOPT           | Generic docs-maintenance standard                 |
+| `github-actions-yaml`                  | ADOPT           | CI/ops standard; pairs with Plan 05               |
+| `test-timeout-budget`                  | ADOPT           | Test/ops standard                                 |
+| `startup-validation-env-order`         | ADOPT           | Env/ops standard (also a skill)                   |
+| `openapi-sync`                         | ADOPT?          | MB has `swagger-openapi` skill; check overlap      |
+| `config-type-safety`                   | ADOPT           | Config/env standard                               |
+| `build-order-doc-sync`                 | ADOPT?          | Build/ops; MB has no build-order skill             |
+| `infra-k8s`                            | ADOPT           | Infra/ops standard; pairs with Plan 06            |
+| `linear-baseline-0003`                 | ADOPT?          | MB has `linear-baseline-gz-sync`; check overlap    |
+| `shared-ui-i18n`                       | ADOPT?          | UI/i18n standard                                  |
+| `prefer-shared-ui-web-management`      | ADOPT?          | UI standard; MB has `reusable-components`          |
+| `extensions-env`                       | N/A?            | Check if MB has extensions concept                 |
+| `e2e-seed-id-text-limits`              | ADOPT?          | E2E standard                                       |
+| `ui-change-e2e-screenshot-report`      | ADOPT?          | MB has `end-with-targeted-make-report-verify`      |
+| `app-internal-import-aliases`          | ADOPT?          | Import standard                                    |
+| `typescript-express`                   | ADOPT?          | MB has `api` skill; check overlap                  |
+| `i18n-management`                      | ADOPT?          | MB has `i18n` skill + `i18n-locale-language` rule  |
+| `management-web-*`, `navbar-sticky-chrome`, `font-preloads-route-aware`, `custom-themes-operator-sample-sync` | N/A? | Likely Podverse-product-specific; confirm |
+
+MetaBoost-only rules (MB-SPECIFIC vs PROMOTE):
+
+| Rule                                    | Suggested class | Rationale                                       |
+| --------------------------------------- | --------------- | ----------------------------------------------- |
+| `api-no-pii-credentials-in-responses`   | PROMOTE?        | Security standard; Podverse may want it           |
+| `commands-from-metaboost-root`          | MB-SPECIFIC     | Mirror of Podverse's monorepo-root rule           |
+| `i18n-locale-language`                  | MB-SPECIFIC?    | Overlaps Podverse `i18n-management`               |
+| `path-casing-imports`                   | PROMOTE?        | Generic cross-platform safety                     |
+| `plan-execution-completion-tracking`    | MB-SPECIFIC     | Overlaps Podverse `plan-lifecycle`                |
+| `single-readme`                         | MB-SPECIFIC?    | Repo-structure choice                             |
+
+## Seeded delta — `.cursor/skills`
+
+Podverse-only skills that are **generic process/ops/LLM** (candidate ADOPT): `build-order`,
+`parallel-plan-execution`, `plan-completion`, `startup-validation-env-order`,
+`unit-test-priority-confident`, `unit-test-new-code-gate`, `unit-test-design-no-overgranularity`,
+`env-defaults-match-code`, `git-worktree-sibling`, `github`, `logging`, `observability`,
+`native-deps-platform-mismatch`, `ui-e2e-screenshot-report`, `ui-component-promotion`,
+`modal-layout-contract`, `styles-source-of-truth`, `styles-import-last`, `time-format-local`,
+`rate-limit-message`, `routing-url-params`.
+
+Podverse-only skills that are **product-specific (N/A)**: `add-by-rss-components-sync`,
+`add-by-rss-parity-sync`, `media-player-architecture`, `workers`, `bundle-optimization`,
+`lighthouse-docker-sync`, `lighthouse-env-alignment`, `header-hero-image-sources`,
+`integrations-web`, `management-api`, `orm`, `linear-sql-greenfield-only`,
+`e2e-membership-state-matrix`, `e2e-seed-nano-id-limits`, `form-primary-actions-row`.
+
+MetaBoost-only skills (mostly MB-SPECIFIC or finer-grained variants of Podverse rules):
+`argocd-gitops-push`, `avoid-line-height`, `avoid-unknown-types`, `avoid-unused-props-vars`,
+`avoid-wrapper-elements`, `button-loading-async`, `catch-unused-error`, `database-schema-naming`,
+`e2e-permission-actor-matrix`, `focus-outline-visible`, `generate-data-sync`,
+`helpers-requests-req-pattern`, `i18n`, `linear-baseline-gz-sync`, `linear-db-migrations`,
+`local-docker-env-alignment`, `management-edit-breadcrumbs`, `management-edit-page-tabs`,
+`nested-resource-prefix-naming`, `password-strength-on-set-update`, `path-casing-imports`,
+`plan-files-convention`, `roles-schema-sync`, `single-focus-indicator`, `storybook-component-docs`,
+`swagger-openapi`, `tab-active-state-url-match`, `typeorm-orderby-property-names`,
+`unit-tests-confident-granularity`, `unit-tests-risk-first`, `use-form-component`. Several are
+PROMOTE candidates for Podverse (e.g. `argocd-gitops-push`, `linear-baseline-gz-sync`).
+
+Note: `INDEX.md` appears as a "skill" only because it sits in the skills dir — exclude it.
+
+## Other parity dimensions to check at execution
+
+- CI: jobs/gates Podverse runs that MetaBoost does not (feeds from Plan 05).
+- Makefiles: targets/conventions present in Podverse but missing in MetaBoost.
+- `scripts/`: dev/ops helpers present in one repo only (feeds from Plan 07).
+- `docs/` top-level structure and AGENTS.md sections.
+
+## Stage-2 output
+
+Create `.llm/plans/active/metaboost-podverse-parity-gaps/` with:
+
+- `00-SUMMARY.md` / `00-EXECUTION-ORDER.md`
+- One numbered plan per accepted ADOPT cluster (e.g. `01-ops-git-policy-rules.md`,
+  `02-ci-and-infra-standards.md`, `03-testing-standards.md`, `04-build-and-config-standards.md`).
+- A `PROMOTE-TO-PODVERSE-NOTES.md` capturing MetaBoost-only items worth proposing back to Podverse
+  (informational; not executed against the Podverse repo from here).
+- `COPY-PASTA.md`.
+
+Record N/A and MB-SPECIFIC classifications in this file's Decisions section so they are not
+re-litigated.
+
+## Decisions
+
+**Executed:** 2026-06-21  
+**Method:** Recomputed `comm` deltas on `.cursor/rules` and `.cursor/skills`; merged PARITY-GAP rows
+from Plans 01–08; compared workflows, `scripts/ci/`, Makefiles.
+
+### Podverse-only rules — classification
+
+| Rule | Class | Notes |
+| --- | --- | --- |
+| `operator-only-git-operations` | **ADOPT** | → `metaboost-abcmemory-align/01` |
+| `documentation-updates` | **ADOPT** | → abcmemory-align |
+| `github-actions-yaml` | **ADOPT** | → abcmemory-align; pairs with ci-ops-align |
+| `test-timeout-budget` | **ADOPT** | → abcmemory-align |
+| `startup-validation-env-order` | **ADOPT** | → abcmemory-align + parity-gaps plan 02 skill |
+| `config-type-safety` | **ADOPT** | → abcmemory-align |
+| `build-order-doc-sync` | **ADOPT** | → abcmemory-align + parity-gaps plan 02 skill |
+| `infra-k8s` | **ADOPT** | → abcmemory-align |
+| `plan-lifecycle` | **ADOPT** | Reconcile with MB `plan-execution-completion-tracking` |
+| `openapi-sync` | **ADOPT** | → abcmemory-align; cross-link `swagger-openapi` skill |
+| `shared-ui-i18n`, `prefer-shared-ui-web-management` | **ADOPT** | → abcmemory-align |
+| `app-internal-import-aliases` | **ADOPT** | → parity-gaps plan 04 |
+| `e2e-seed-id-text-limits` | **ADOPT** | → parity-gaps plan 01 |
+| `typescript-express` | **N/A** | MB `api` skill covers Express patterns |
+| `ui-change-e2e-screenshot-report` | **N/A** | Overlaps MB `end-with-targeted-make-report-verify` |
+| `i18n-management` | **N/A** | MB `i18n` skill + `i18n-locale-language` rule |
+| `linear-baseline-0003` | **N/A** | MB `linear-baseline-gz-sync` skill |
+| `extensions-env` | **N/A** | No MB extensions sidecar model |
+| Product UI rules (themes, navbar, management-web-*, font-preloads) | **N/A** | Podverse product |
+| `commands-from-monorepo-root` | **N/A** | MB has `commands-from-metaboost-root` |
+
+### Podverse-only skills — classification
+
+| Skill | Class |
+| --- | --- |
+| `build-order`, `startup-validation-env-order`, `env-defaults-match-code`, `native-deps-platform-mismatch` | **ADOPT** → parity-gaps 02 |
+| `logging`, `observability`, `github`, `git-worktree-sibling`, `parallel-plan-execution`, `plan-completion` | **ADOPT** → parity-gaps 03 |
+| `unit-test-*` (3 skills) | **ADOPT** → parity-gaps 01 |
+| Modal/styles/UI skills (8 listed in plan 04) | **ADOPT** → parity-gaps 04 |
+| Product skills (add-by-rss, workers, orm, lighthouse, media-player, etc.) | **N/A** |
+| `css-custom-properties-no-var-fallbacks` skill | **N/A** | MB has same-named rule |
+
+### MetaBoost-only — classification
+
+| Item | Class |
+| --- | --- |
+| `commands-from-metaboost-root`, `plan-execution-completion-tracking`, `i18n-locale-language`, `single-readme`, `INDEX.md` | **MB-SPECIFIC** |
+| `api-no-pii-credentials-in-responses`, `path-casing-imports`, `argocd-gitops-push`, `linear-baseline-gz-sync`, `plan-files-convention`, UI/a11y skills | **PROMOTE** → `PROMOTE-TO-PODVERSE-NOTES.md` |
+
+### PARITY-GAP from Plans 01–08 (deduped)
+
+| Item | Disposition |
+| --- | --- |
+| Process rules (Plan 03) | `metaboost-abcmemory-align` |
+| CI workflows (Plans 04–05) | `metaboost-ci-ops-align` |
+| Infra env (Plan 06) | `metaboost-infra-env-align` |
+| Git hooks (Plan 07) | `metaboost-dev-scripts-align` |
+| Build/eslint/vitest (Plan 08) | `metaboost-build-config-align` |
+| `run-workspaces.mjs` (Plan 08) | `metaboost-podverse-parity-gaps/05` |
+| `eslint-plugin-perfectionist` vs `simple-import-sort` | **MB-SPECIFIC** (intentional) |
+
+### CI / scripts / Makefiles
+
+| Dimension | Class |
+| --- | --- |
+| PV-only workflows `complete-feature`, `vulnerability-scanner` | **ADOPT** → ci-ops-align |
+| MB-only workflows signing + alpha-contracts | **KEEP** |
+| PV-only Makefiles (v4v, extensions, alpha Jenkins) | **N/A** |
+| Missing `scripts/ci/` in MB | **ADOPT** run-workspaces |
+
+**Stage-2 spawned:** `.llm/plans/active/metaboost-podverse-parity-gaps/`
diff --git a/.llm/plans/completed/metaboost-podverse-alignment-triage/COPY-PASTA.md b/.llm/plans/completed/metaboost-podverse-alignment-triage/COPY-PASTA.md
new file mode 100644
index 00000000..fec8a392
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-alignment-triage/COPY-PASTA.md
@@ -0,0 +1,181 @@
+# MetaBoost ↔ Podverse Alignment Triage — Copy-Pasta Prompts
+
+## Execution rules
+
+- **Phases are sequential.** Finish a phase before starting the next.
+- **Within Phase 1, the 8 prompts are parallel-safe** (independent areas of the diff). Run up to 8
+  agents at once, or run them one at a time — but wait for all of Phase 1 before Phase 2.
+- Every triage prompt is a **triage pass** (not implementation):
+  1. Inspect MetaBoost's pending changes and compare to Podverse.
+  2. Write a `## Decisions` section into the referenced triage plan file.
+  3. **If ALIGN or PARITY-GAP work remains**, create a full **stage-2 plan set** under
+     `.llm/plans/active/<name>/` (`00-SUMMARY.md`, `00-EXECUTION-ORDER.md`, numbered plans,
+     `COPY-PASTA.md`) — this is required output, not optional.
+  4. **Do not** edit product code, `.cursor/` abcmemory, config, or infra during triage — that
+     happens when the operator runs the spawned stage-2 COPY-PASTA prompts later.
+- "Read-only" means **read-only toward the repo being aligned**, not read-only toward plan files.
+- Recommend git actions (unstage/revert/commit) to the operator; never run them.
+
+## When this set is complete (what you should have locally)
+
+After all 10 prompts finish, you should have **new stage-2 plan sets** under
+`.llm/plans/active/` — one per theme that still needs work (examples: `metaboost-abcmemory-align/`,
+`metaboost-podverse-parity-gaps/`, `metaboost-ci-ops-align/`). Themes that are fully aligned
+(KEEP only) spawn **nothing**.
+
+Each spawned set is a **full plan package** ready for a **second COPY-PASTA run**:
+
+```
+.llm/plans/active/<spawned-name>/
+├── 00-SUMMARY.md
+├── 00-EXECUTION-ORDER.md
+├── 01-….md … NN-….md    # implementation steps
+└── COPY-PASTA.md          # paste these prompts next to do the real edits
+```
+
+**This triage set does not implement alignment.** It only decides what to keep and authors the
+implementation plans. Run each spawned set's `COPY-PASTA.md` in a **separate session** (or parallel
+where allowed) to port Podverse rules, fix CI, clean refs, etc.
+
+Phase 3 (Agent 10) updates `00-EXECUTION-ORDER.md` with an index of every spawned set so you have one
+checklist of what to run next.
+
+## Status tracker
+
+| Prompt | Plan                              | Done |
+| ------ | --------------------------------- | ---- |
+| 1      | 01-llm-exports-removal-triage     | [x]  |
+| 2      | 02-changelog-removal-triage       | [x]  |
+| 3      | 03-cursor-abcmemory-triage        | [x]  |
+| 4      | 04-llm-workspace-docs-triage      | [x]  |
+| 5      | 05-ci-github-workflows-triage     | [x]  |
+| 6      | 06-k8s-alpha-infra-env-triage     | [x]  |
+| 7      | 07-git-hooks-dev-scripts-triage   | [x]  |
+| 8      | 08-build-package-config-triage    | [x]  |
+| 9      | 09-podverse-parity-inventory      | [x]  |
+| 10     | Phase 3 consolidation             | [x]  |
+
+---
+
+## PHASE 1 — Theme triage (8 agents, parallel-safe)
+
+### Agent 1
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-alignment-triage/01-llm-exports-removal-triage.md
+
+Triage the multi-LLM exports removal vs Podverse (source of truth). Classify each change KEEP/ALIGN/
+DISCARD, write a Decisions section into the plan file, and if dangling references remain create
+metaboost-llm-exports-reference-cleanup under .llm/plans/active/ (full plan set). No product/config
+edits during triage; recommend git actions, do not run them.
+```
+
+### Agent 2
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-alignment-triage/02-changelog-removal-triage.md
+
+Triage the changelog system removal vs Podverse. Classify KEEP/ALIGN/DISCARD, write a Decisions
+section, and if changelog references remain create metaboost-changelog-reference-cleanup under
+.llm/plans/active/ (full plan set). No product/config edits during triage.
+```
+
+### Agent 3
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-alignment-triage/03-cursor-abcmemory-triage.md
+
+Triage new/modified .cursor abcmemory files (hooks, prompts, rules, skills, indexes) vs Podverse
+counterparts. Classify KEEP/ALIGN, write a Decisions section, and if files drift from Podverse create
+metaboost-abcmemory-align under .llm/plans/active/ (full plan set). No .cursor/ edits during triage.
+```
+
+### Agent 4
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-alignment-triage/04-llm-workspace-docs-triage.md
+
+Triage the .llm/ workspace restructure and docs/development/llm changes vs Podverse. Classify
+KEEP/ALIGN, write a Decisions section, and if drift exists create metaboost-llm-workspace-align
+under .llm/plans/active/ (full plan set). No product/config edits during triage.
+```
+
+### Agent 5
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-alignment-triage/05-ci-github-workflows-triage.md
+
+Triage CI/GitHub workflows, dependabot, labels, and repo-management/release docs vs Podverse ops
+flow. Classify KEEP/ALIGN, capture Podverse-only CI gates as PARITY-GAP for Plan 09, write a
+Decisions section, and if drift exists create metaboost-ci-ops-align under .llm/plans/active/
+(full plan set). No product/config edits during triage.
+```
+
+### Agent 6
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-alignment-triage/06-k8s-alpha-infra-env-triage.md
+
+Triage the k8s alpha overlay, base/template env files, infra docs, and linear-baseline ops flow vs
+Podverse conventions (ops-flow only, not column-level SQL). Classify KEEP/ALIGN, write a Decisions
+section, and if drift exists create metaboost-infra-env-align under .llm/plans/active/ (full plan
+set). No infra/k8s edits during triage (Argo CD push applies to stage-2 execution).
+```
+
+### Agent 7
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-alignment-triage/07-git-hooks-dev-scripts-triage.md
+
+Triage git hooks and dev scripts (start-feature, local-env setup, bump-version non-changelog parts,
+env-overrides, markdown link normalizer, eslint-rules) vs Podverse. Classify KEEP/ALIGN, note
+MetaBoost-only tooling for Plan 09, write a Decisions section, and if drift exists create
+metaboost-dev-scripts-align under .llm/plans/active/ (full plan set). No script edits during triage.
+```
+
+### Agent 8
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-alignment-triage/08-build-package-config-triage.md
+
+Triage build/package/lint config (package.json, eslint.config.mjs, eslint-rules wiring, vitest
+configs, tsconfig, lockfile) vs Podverse conventions. Classify KEEP/ALIGN, write a Decisions section,
+and if drift exists create metaboost-build-config-align under .llm/plans/active/ (full plan set).
+No product/config edits during triage.
+```
+
+**WAIT for all 8 Phase 1 agents to complete before Phase 2.**
+
+---
+
+## PHASE 2 — Parity inventory (1 agent)
+
+### Agent 9
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-alignment-triage/09-podverse-parity-inventory.md
+
+Recompute the bidirectional .cursor rules/skills deltas and incorporate PARITY-GAP rows from Plans
+01-08. Classify each Podverse-only item ADOPT vs N/A and each MetaBoost-only item MB-SPECIFIC vs
+PROMOTE. Write a Decisions section and create metaboost-podverse-parity-gaps under
+.llm/plans/active/ (full plan set) for accepted ADOPT items plus PROMOTE-TO-PODVERSE-NOTES.md.
+No edits to the Podverse repo; no MetaBoost product/config edits during triage.
+```
+
+**WAIT for Phase 2 to complete before Phase 3.**
+
+---
+
+## PHASE 3 — Consolidation (1 agent)
+
+### Agent 10
+
+```
+Read .llm/plans/active/metaboost-podverse-alignment-triage/00-EXECUTION-ORDER.md and consolidate the
+triage results: fill in the "Spawned stage-2 plan sets" index with every stage-2 set created in
+Phases 1-2, and produce one fenced bash block of recommended git actions for all DISCARD decisions
+(grouped by plan) for the operator to run manually. Then, if every theme is resolved and stage-2
+sets are queued, move this set to
+.llm/plans/completed/metaboost-podverse-alignment-triage/. Read-only except for the plan-file
+updates and the move; do not edit product code.
+```
diff --git a/.llm/plans/completed/metaboost-podverse-alignment/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-podverse-alignment/00-EXECUTION-ORDER.md
index e0e5975d..ad5824ce 100644
--- a/.llm/plans/completed/metaboost-podverse-alignment/00-EXECUTION-ORDER.md
+++ b/.llm/plans/completed/metaboost-podverse-alignment/00-EXECUTION-ORDER.md
@@ -7,19 +7,19 @@ Greenfield breaking alignment from Metaboost to Podverse conventions across env
 2. Finalize target contracts for env templates, expiration variable names, migration directory contract, CI parity surface, and k8s app-of-apps structure.
 3. Freeze naming and migration rules: no compatibility aliases, no legacy references, no transitional comments, breaking cutover only.
 4. Phase B env system replacement (blocks most later work).
-5. Phase B is complete: [01-env-overhaul.md](../../completed/metaboost-podverse-alignment/01-env-overhaul.md) and completed sub-plans [01a-env-contract-source-of-truth.md](../../completed/metaboost-podverse-alignment/01a-env-contract-source-of-truth.md), [01b-env-script-and-make-cutover.md](../../completed/metaboost-podverse-alignment/01b-env-script-and-make-cutover.md), and [01c-env-docs-and-verification.md](../../completed/metaboost-podverse-alignment/01c-env-docs-and-verification.md).
+5. Phase B is complete: [01-env-overhaul.md](/.llm/plans/completed/metaboost-podverse-alignment/01-env-overhaul.md) and completed sub-plans [01a-env-contract-source-of-truth.md](/.llm/plans/completed/metaboost-podverse-alignment/01a-env-contract-source-of-truth.md), [01b-env-script-and-make-cutover.md](/.llm/plans/completed/metaboost-podverse-alignment/01b-env-script-and-make-cutover.md), and [01c-env-docs-and-verification.md](/.llm/plans/completed/metaboost-podverse-alignment/01c-env-docs-and-verification.md).
 6. Phase C expiration contract cutover (depends on Phase B).
-7. Phase C is complete: [02-expiration-rename.md](../../completed/metaboost-podverse-alignment/02-expiration-rename.md).
+7. Phase C is complete: [02-expiration-rename.md](/.llm/plans/completed/metaboost-podverse-alignment/02-expiration-rename.md).
 8. Phase D .llm exports parity (may run in parallel with late Phase C only after 02 reaches file-rename completion).
-9. Phase D is complete: [03-llm-exports-parity.md](../../completed/metaboost-podverse-alignment/03-llm-exports-parity.md).
+9. Phase D is complete: [03-llm-exports-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/03-llm-exports-parity.md).
 10. Phase E CI parity (may run in parallel with Phase D after env and expiration names are stable).
-11. Phase E is complete: [04-ci-parity.md](../../completed/metaboost-podverse-alignment/04-ci-parity.md).
+11. Phase E is complete: [04-ci-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/04-ci-parity.md).
 12. Phase F linear migrations parity (depends on Phases B and C).
-13. Phase F is complete: [05-linear-migrations.md](../../completed/metaboost-podverse-alignment/05-linear-migrations.md), [05a-linear-contract-and-baseline-artifacts.md](../../completed/metaboost-podverse-alignment/05a-linear-contract-and-baseline-artifacts.md), [05b-linear-runner-scripts-and-make-targets.md](../../completed/metaboost-podverse-alignment/05b-linear-runner-scripts-and-make-targets.md), and [05c-linear-ci-validation-and-docs.md](../../completed/metaboost-podverse-alignment/05c-linear-ci-validation-and-docs.md).
+13. Phase F is complete: [05-linear-migrations.md](/.llm/plans/completed/metaboost-podverse-alignment/05-linear-migrations.md), [05a-linear-contract-and-baseline-artifacts.md](/.llm/plans/completed/metaboost-podverse-alignment/05a-linear-contract-and-baseline-artifacts.md), [05b-linear-runner-scripts-and-make-targets.md](/.llm/plans/completed/metaboost-podverse-alignment/05b-linear-runner-scripts-and-make-targets.md), and [05c-linear-ci-validation-and-docs.md](/.llm/plans/completed/metaboost-podverse-alignment/05c-linear-ci-validation-and-docs.md).
 14. Phase G k8s base and alpha app-of-apps alignment (depends on Phases B, C, and F).
-15. Phase G is complete: [06-k8s-base-alpha-appofapps.md](../../completed/metaboost-podverse-alignment/06-k8s-base-alpha-appofapps.md), [06a-k8s-base-structure-parity.md](../../completed/metaboost-podverse-alignment/06a-k8s-base-structure-parity.md), [06b-k8s-alpha-app-of-apps-parity.md](../../completed/metaboost-podverse-alignment/06b-k8s-alpha-app-of-apps-parity.md), and [06c-k8s-ops-env-integration-verification.md](../../completed/metaboost-podverse-alignment/06c-k8s-ops-env-integration-verification.md).
+15. Phase G is complete: [06-k8s-base-alpha-appofapps.md](/.llm/plans/completed/metaboost-podverse-alignment/06-k8s-base-alpha-appofapps.md), [06a-k8s-base-structure-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/06a-k8s-base-structure-parity.md), [06b-k8s-alpha-app-of-apps-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/06b-k8s-alpha-app-of-apps-parity.md), and [06c-k8s-ops-env-integration-verification.md](/.llm/plans/completed/metaboost-podverse-alignment/06c-k8s-ops-env-integration-verification.md).
 16. Phase H documentation alignment and cleanup (after all implementation phases).
-17. Phase H is complete: [07-docs-alignment.md](../../completed/metaboost-podverse-alignment/07-docs-alignment.md).
+17. Phase H is complete: [07-docs-alignment.md](/.llm/plans/completed/metaboost-podverse-alignment/07-docs-alignment.md).
 18. Run full verification matrix, including repository-wide zero-template contract-reference checks in maintained source/docs paths, and produce implementation report.
 
 ## Verification
diff --git a/.llm/plans/completed/metaboost-podverse-alignment/00-SUMMARY.md b/.llm/plans/completed/metaboost-podverse-alignment/00-SUMMARY.md
index 88af8c68..4c77fdf7 100644
--- a/.llm/plans/completed/metaboost-podverse-alignment/00-SUMMARY.md
+++ b/.llm/plans/completed/metaboost-podverse-alignment/00-SUMMARY.md
@@ -22,22 +22,22 @@ The plan is intentionally breaking-first:
 There are no remaining active implementation plan files for this plan set.
 
 ## Completed Plan Files
-1. [01a-env-contract-source-of-truth.md](../../completed/metaboost-podverse-alignment/01a-env-contract-source-of-truth.md)
-2. [01b-env-script-and-make-cutover.md](../../completed/metaboost-podverse-alignment/01b-env-script-and-make-cutover.md)
-3. [01c-env-docs-and-verification.md](../../completed/metaboost-podverse-alignment/01c-env-docs-and-verification.md)
-4. [02-expiration-rename.md](../../completed/metaboost-podverse-alignment/02-expiration-rename.md)
-5. [03-llm-exports-parity.md](../../completed/metaboost-podverse-alignment/03-llm-exports-parity.md)
-6. [04-ci-parity.md](../../completed/metaboost-podverse-alignment/04-ci-parity.md)
-7. [01-env-overhaul.md](../../completed/metaboost-podverse-alignment/01-env-overhaul.md)
-8. [05a-linear-contract-and-baseline-artifacts.md](../../completed/metaboost-podverse-alignment/05a-linear-contract-and-baseline-artifacts.md)
-9. [05b-linear-runner-scripts-and-make-targets.md](../../completed/metaboost-podverse-alignment/05b-linear-runner-scripts-and-make-targets.md)
-10. [06a-k8s-base-structure-parity.md](../../completed/metaboost-podverse-alignment/06a-k8s-base-structure-parity.md)
-11. [06b-k8s-alpha-app-of-apps-parity.md](../../completed/metaboost-podverse-alignment/06b-k8s-alpha-app-of-apps-parity.md)
-12. [07-docs-alignment.md](../../completed/metaboost-podverse-alignment/07-docs-alignment.md)
-13. [05-linear-migrations.md](../../completed/metaboost-podverse-alignment/05-linear-migrations.md)
-14. [05c-linear-ci-validation-and-docs.md](../../completed/metaboost-podverse-alignment/05c-linear-ci-validation-and-docs.md)
-15. [06-k8s-base-alpha-appofapps.md](../../completed/metaboost-podverse-alignment/06-k8s-base-alpha-appofapps.md)
-16. [06c-k8s-ops-env-integration-verification.md](../../completed/metaboost-podverse-alignment/06c-k8s-ops-env-integration-verification.md)
+1. [01a-env-contract-source-of-truth.md](/.llm/plans/completed/metaboost-podverse-alignment/01a-env-contract-source-of-truth.md)
+2. [01b-env-script-and-make-cutover.md](/.llm/plans/completed/metaboost-podverse-alignment/01b-env-script-and-make-cutover.md)
+3. [01c-env-docs-and-verification.md](/.llm/plans/completed/metaboost-podverse-alignment/01c-env-docs-and-verification.md)
+4. [02-expiration-rename.md](/.llm/plans/completed/metaboost-podverse-alignment/02-expiration-rename.md)
+5. [03-llm-exports-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/03-llm-exports-parity.md)
+6. [04-ci-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/04-ci-parity.md)
+7. [01-env-overhaul.md](/.llm/plans/completed/metaboost-podverse-alignment/01-env-overhaul.md)
+8. [05a-linear-contract-and-baseline-artifacts.md](/.llm/plans/completed/metaboost-podverse-alignment/05a-linear-contract-and-baseline-artifacts.md)
+9. [05b-linear-runner-scripts-and-make-targets.md](/.llm/plans/completed/metaboost-podverse-alignment/05b-linear-runner-scripts-and-make-targets.md)
+10. [06a-k8s-base-structure-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/06a-k8s-base-structure-parity.md)
+11. [06b-k8s-alpha-app-of-apps-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/06b-k8s-alpha-app-of-apps-parity.md)
+12. [07-docs-alignment.md](/.llm/plans/completed/metaboost-podverse-alignment/07-docs-alignment.md)
+13. [05-linear-migrations.md](/.llm/plans/completed/metaboost-podverse-alignment/05-linear-migrations.md)
+14. [05c-linear-ci-validation-and-docs.md](/.llm/plans/completed/metaboost-podverse-alignment/05c-linear-ci-validation-and-docs.md)
+15. [06-k8s-base-alpha-appofapps.md](/.llm/plans/completed/metaboost-podverse-alignment/06-k8s-base-alpha-appofapps.md)
+16. [06c-k8s-ops-env-integration-verification.md](/.llm/plans/completed/metaboost-podverse-alignment/06c-k8s-ops-env-integration-verification.md)
 
 ## Dependency Map
 1. Foundation contracts must be set before implementation phases.
diff --git a/.llm/plans/completed/metaboost-podverse-alignment/01-env-overhaul.md b/.llm/plans/completed/metaboost-podverse-alignment/01-env-overhaul.md
index 0e90eb4f..42bdc8b8 100644
--- a/.llm/plans/completed/metaboost-podverse-alignment/01-env-overhaul.md
+++ b/.llm/plans/completed/metaboost-podverse-alignment/01-env-overhaul.md
@@ -4,9 +4,9 @@ Replace Metaboost template contract as env source-of-truth with Podverse-style t
 
 This phase is split into smaller executable plans to reduce risk and review size:
 
-1. [01a-env-contract-source-of-truth.md](../../completed/metaboost-podverse-alignment/01a-env-contract-source-of-truth.md) (completed)
-2. [01b-env-script-and-make-cutover.md](../../completed/metaboost-podverse-alignment/01b-env-script-and-make-cutover.md) (completed)
-3. [01c-env-docs-and-verification.md](../../completed/metaboost-podverse-alignment/01c-env-docs-and-verification.md) (completed)
+1. [01a-env-contract-source-of-truth.md](/.llm/plans/completed/metaboost-podverse-alignment/01a-env-contract-source-of-truth.md) (completed)
+2. [01b-env-script-and-make-cutover.md](/.llm/plans/completed/metaboost-podverse-alignment/01b-env-script-and-make-cutover.md) (completed)
+3. [01c-env-docs-and-verification.md](/.llm/plans/completed/metaboost-podverse-alignment/01c-env-docs-and-verification.md) (completed)
 
 ## Steps
 1. 01a, 01b, and 01c are complete.
diff --git a/.llm/plans/completed/metaboost-podverse-alignment/05-linear-migrations.md b/.llm/plans/completed/metaboost-podverse-alignment/05-linear-migrations.md
index 1f4d3fc8..1680a9f6 100644
--- a/.llm/plans/completed/metaboost-podverse-alignment/05-linear-migrations.md
+++ b/.llm/plans/completed/metaboost-podverse-alignment/05-linear-migrations.md
@@ -4,8 +4,8 @@ Align Metaboost linear migration workflow with Podverse contract for canonical m
 
 This phase is split into smaller executable plans to reduce risk and review size:
 
-1. [05a-linear-contract-and-baseline-artifacts.md](../../completed/metaboost-podverse-alignment/05a-linear-contract-and-baseline-artifacts.md) (completed)
-2. [05b-linear-runner-scripts-and-make-targets.md](../../completed/metaboost-podverse-alignment/05b-linear-runner-scripts-and-make-targets.md) (completed)
+1. [05a-linear-contract-and-baseline-artifacts.md](/.llm/plans/completed/metaboost-podverse-alignment/05a-linear-contract-and-baseline-artifacts.md) (completed)
+2. [05b-linear-runner-scripts-and-make-targets.md](/.llm/plans/completed/metaboost-podverse-alignment/05b-linear-runner-scripts-and-make-targets.md) (completed)
 3. [05c-linear-ci-validation-and-docs.md](05c-linear-ci-validation-and-docs.md)
 
 ## Steps
diff --git a/.llm/plans/completed/metaboost-podverse-alignment/06-k8s-base-alpha-appofapps.md b/.llm/plans/completed/metaboost-podverse-alignment/06-k8s-base-alpha-appofapps.md
index 77c8d4c7..f11de146 100644
--- a/.llm/plans/completed/metaboost-podverse-alignment/06-k8s-base-alpha-appofapps.md
+++ b/.llm/plans/completed/metaboost-podverse-alignment/06-k8s-base-alpha-appofapps.md
@@ -4,8 +4,8 @@ Adopt Podverse-like in-repo alpha app-of-apps structure while preserving thin-ov
 
 This phase is split into smaller executable plans to reduce risk and review size:
 
-1. [06a-k8s-base-structure-parity.md](../../completed/metaboost-podverse-alignment/06a-k8s-base-structure-parity.md) (completed)
-2. [06b-k8s-alpha-app-of-apps-parity.md](../../completed/metaboost-podverse-alignment/06b-k8s-alpha-app-of-apps-parity.md) (completed)
+1. [06a-k8s-base-structure-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/06a-k8s-base-structure-parity.md) (completed)
+2. [06b-k8s-alpha-app-of-apps-parity.md](/.llm/plans/completed/metaboost-podverse-alignment/06b-k8s-alpha-app-of-apps-parity.md) (completed)
 3. [06c-k8s-ops-env-integration-verification.md](06c-k8s-ops-env-integration-verification.md)
 
 ## Steps
diff --git a/.llm/plans/completed/metaboost-podverse-parity-gaps/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-podverse-parity-gaps/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..4b7a1144
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-parity-gaps/00-EXECUTION-ORDER.md
@@ -0,0 +1,13 @@
+# MetaBoost ↔ Podverse parity gaps — Execution order
+
+Run **after** `metaboost-abcmemory-align` (rules) and `metaboost-ci-ops-align` (workflows).
+
+1. `01-adopt-podverse-testing-standards.md`
+2. `02-adopt-podverse-build-env-ops-skills.md`
+3. `03-adopt-podverse-engineering-ops-skills.md`
+4. `04-adopt-podverse-ui-shared-standards.md`
+5. `05-adopt-run-workspaces-ci-script.md`
+
+Review `PROMOTE-TO-PODVERSE-NOTES.md` separately in Podverse repo when convenient.
+
+Move set to `completed/` when done.
diff --git a/.llm/plans/completed/metaboost-podverse-parity-gaps/00-SUMMARY.md b/.llm/plans/completed/metaboost-podverse-parity-gaps/00-SUMMARY.md
new file mode 100644
index 00000000..75f75146
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-parity-gaps/00-SUMMARY.md
@@ -0,0 +1,39 @@
+# MetaBoost ↔ Podverse parity gaps — Summary
+
+## Purpose
+
+Consolidated stage-2 plan set for **accepted ADOPT items** from triage Plan 09 and PARITY-GAP rows
+from Plans 01–08 that are **not** already covered by other active stage-2 sets.
+
+## Execute other stage-2 sets first
+
+| Set | Covers |
+| --- | --- |
+| `metaboost-llm-exports-reference-cleanup/` | Stale ESLint `scripts/llm` glob |
+| `metaboost-abcmemory-align/` | Missing process **rules**, drifted shared rules/skills, `.cursorrules` |
+| `metaboost-llm-workspace-align/` | `.llm/` docs, complete-feature doc refs |
+| `metaboost-ci-ops-align/` | `complete-feature.yml`, `vulnerability-scanner.yml`, `ci.yml` gates |
+| `metaboost-infra-env-align/` | K8s env sources, linear baseline gz |
+| `metaboost-dev-scripts-align/` | Git hooks, bump-version audit, dev scripts |
+| `metaboost-build-config-align/` | ESLint stale globs, vitest wiring, lint-staged |
+
+**This set** adds Podverse **skills** and **tooling** MetaBoost lacks, plus records N/A / PROMOTE
+classifications so they are not re-litigated.
+
+## Plans in this set
+
+| File | Focus |
+| --- | --- |
+| 01-adopt-podverse-testing-standards.md | Unit-test skills + `e2e-seed-id-text-limits` |
+| 02-adopt-podverse-build-env-ops-skills.md | `build-order`, env/startup/native-deps skills |
+| 03-adopt-podverse-engineering-ops-skills.md | logging, observability, github, git-worktree, plan skills |
+| 04-adopt-podverse-ui-shared-standards.md | Modal/styles/UI promotion + import alias rule |
+| 05-adopt-run-workspaces-ci-script.md | `scripts/ci/run-workspaces.mjs` + `test:unit` |
+| `PROMOTE-TO-PODVERSE-NOTES.md` | MB-only items worth proposing to Podverse (informational) |
+
+## Verification
+
+```bash
+comm -23 <(ls ../podverse/.cursor/skills | sort) <(ls .cursor/skills | sort) | grep -v INDEX
+./scripts/nix/with-env npm run test:unit
+```
diff --git a/.llm/plans/completed/metaboost-podverse-parity-gaps/01-adopt-podverse-testing-standards.md b/.llm/plans/completed/metaboost-podverse-parity-gaps/01-adopt-podverse-testing-standards.md
new file mode 100644
index 00000000..7a3fcf47
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-parity-gaps/01-adopt-podverse-testing-standards.md
@@ -0,0 +1,34 @@
+# 01 — Adopt Podverse testing standards
+
+## Scope
+
+Podverse-only **generic** testing guidance MetaBoost lacks. `test-timeout-budget` **rule** is adopted
+via `metaboost-abcmemory-align/01` — this plan adds **skills** and one E2E rule.
+
+## ADOPT
+
+| Item | Source | Notes |
+| --- | --- | --- |
+| `unit-test-priority-confident` skill | Podverse | Map to MB `unit-tests-risk-first` — merge or adopt PV naming |
+| `unit-test-new-code-gate` skill | Podverse | Complements MB unit-test skills |
+| `unit-test-design-no-overgranularity` skill | Podverse | Complements MB `unit-tests-confident-granularity` |
+| `e2e-seed-id-text-limits` rule | Podverse | Generic E2E seed/id contract; adapt MB seed paths |
+
+## Reconcile (do not duplicate)
+
+| MB existing | Action |
+| --- | --- |
+| `unit-tests-risk-first`, `unit-tests-confident-granularity` | Cross-link or merge with Podverse trio above |
+| `e2e-permission-actor-matrix` | **KEEP** MB-specific; N/A Podverse counterpart |
+
+## Steps
+
+1. Port each skill from Podverse; adapt make targets and package names.
+2. Add `e2e-seed-id-text-limits.mdc` adapted for MetaBoost E2E seed.
+3. Update `AGENTS.md` skills table.
+
+## Verification
+
+```bash
+test -d .cursor/skills/unit-test-new-code-gate && echo ok
+```
diff --git a/.llm/plans/completed/metaboost-podverse-parity-gaps/02-adopt-podverse-build-env-ops-skills.md b/.llm/plans/completed/metaboost-podverse-parity-gaps/02-adopt-podverse-build-env-ops-skills.md
new file mode 100644
index 00000000..20ac1f7f
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-parity-gaps/02-adopt-podverse-build-env-ops-skills.md
@@ -0,0 +1,33 @@
+# 02 — Adopt Podverse build and env ops skills
+
+## Scope
+
+Generic build/env/process skills from Podverse. Overlapping **rules** (`startup-validation-env-order`,
+`build-order-doc-sync`, `config-type-safety`) are handled in `metaboost-abcmemory-align/01`.
+
+## ADOPT
+
+| Skill | Notes |
+| --- | --- |
+| `build-order` | MB package build order; pairs with `build-order-doc-sync` rule |
+| `startup-validation-env-order` | Pairs with same-named rule; MB validation script paths |
+| `env-defaults-match-code` | Env template ↔ code parity |
+| `native-deps-platform-mismatch` | Lockfile Linux/darwin; pairs with `LOCKFILE-LINUX.md` |
+
+## N/A (Podverse-only)
+
+| Item | Rationale |
+| --- | --- |
+| `linear-sql-greenfield-only` | Podverse linear migration policy variant |
+| `linear-baseline-0003` rule | MB uses `linear-baseline-gz-sync` skill instead |
+
+## Steps
+
+1. Port each skill; replace `@podverse` → `@metaboost`, doc paths, package lists.
+2. Cross-link `linear-baseline-gz-sync` in `build-order` / infra docs.
+
+## Verification
+
+```bash
+test -f .cursor/skills/build-order/SKILL.md && echo ok
+```
diff --git a/.llm/plans/completed/metaboost-podverse-parity-gaps/03-adopt-podverse-engineering-ops-skills.md b/.llm/plans/completed/metaboost-podverse-parity-gaps/03-adopt-podverse-engineering-ops-skills.md
new file mode 100644
index 00000000..c8c0cc7e
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-parity-gaps/03-adopt-podverse-engineering-ops-skills.md
@@ -0,0 +1,34 @@
+# 03 — Adopt Podverse engineering ops skills
+
+## Scope
+
+Contributor/process skills with no MetaBoost counterpart.
+
+## ADOPT
+
+| Skill | Notes |
+| --- | --- |
+| `logging` | Log dir / console policy |
+| `observability` | OTLP/metrics patterns where applicable |
+| `github` | gh CLI / PR workflow for agents |
+| `git-worktree-sibling` | Parallel branch worktrees |
+| `parallel-plan-execution` | Multi-agent plan runs |
+| `plan-completion` | Final verification commands; cross-link MB `plan-files-convention` |
+
+## Reconcile
+
+| MB existing | Action |
+| --- | --- |
+| `plan-files-convention` | **KEEP**; merge plan-completion COPY-PASTA dedupe policy |
+| `plan-execution-completion-tracking` rule | Reconcile with Podverse `plan-lifecycle` in abcmemory-align |
+
+## Steps
+
+1. Port skills from Podverse; adapt repo names.
+2. Update `.cursor/skills/INDEX.md` if used.
+
+## Verification
+
+```bash
+test -f .cursor/skills/github/SKILL.md && echo ok
+```
diff --git a/.llm/plans/completed/metaboost-podverse-parity-gaps/04-adopt-podverse-ui-shared-standards.md b/.llm/plans/completed/metaboost-podverse-parity-gaps/04-adopt-podverse-ui-shared-standards.md
new file mode 100644
index 00000000..b257506f
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-parity-gaps/04-adopt-podverse-ui-shared-standards.md
@@ -0,0 +1,50 @@
+# 04 — Adopt Podverse UI and shared standards
+
+## Scope
+
+Shared UI/docs/import standards. Some **rules** (`shared-ui-i18n`, `prefer-shared-ui-web-management`)
+are adopted in `metaboost-abcmemory-align/01` — this plan adds **skills** and remaining rules.
+
+## ADOPT — skills
+
+| Skill | Notes |
+| --- | --- |
+| `modal-layout-contract` | `@metaboost/ui` Modal API |
+| `styles-source-of-truth` | SCSS tokens in `packages/ui` |
+| `styles-import-last` | Component import order |
+| `ui-component-promotion` | Cross-app promotion; cross-link `reusable-components` |
+| `ui-e2e-screenshot-report` | Narrow make report targets; cross-link `response-ending-make-verify` |
+| `time-format-local` | Display time formatting |
+| `rate-limit-message` | API rate-limit UX copy |
+| `routing-url-params` | Next.js URL state |
+
+## ADOPT — rules
+
+| Rule | Notes |
+| --- | --- |
+| `app-internal-import-aliases` | App `src/` alias conventions |
+
+## N/A (Podverse product UI)
+
+`form-primary-actions-row`, `header-hero-image-sources`, `navbar-sticky-chrome`,
+`font-preloads-route-aware`, `custom-themes-operator-sample-sync`, `management-web-*` rules,
+`integrations-web`, `media-player-architecture`, `add-by-rss-*`, `lighthouse-*`, `bundle-optimization`.
+
+## Overlap — do not duplicate
+
+| Existing MB | Notes |
+| --- | --- |
+| `reusable-components` skill | Keep; cross-link `ui-component-promotion` |
+| `end-with-targeted-make-report-verify` rule | Keep MB `E2E_API_GATE_MODE` policy |
+| `i18n` skill + `i18n-locale-language` rule | Keep vs Podverse `i18n-management` |
+
+## Steps
+
+1. Port skills; adapt `@metaboost/ui`, app paths.
+2. Add `app-internal-import-aliases.mdc` from Podverse.
+
+## Verification
+
+```bash
+test -f .cursor/skills/modal-layout-contract/SKILL.md && echo ok
+```
diff --git a/.llm/plans/completed/metaboost-podverse-parity-gaps/05-adopt-run-workspaces-ci-script.md b/.llm/plans/completed/metaboost-podverse-parity-gaps/05-adopt-run-workspaces-ci-script.md
new file mode 100644
index 00000000..d5849f1f
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-parity-gaps/05-adopt-run-workspaces-ci-script.md
@@ -0,0 +1,29 @@
+# 05 — Adopt run-workspaces CI script
+
+## Scope
+
+Triage Plan 08 PARITY-GAP: Podverse `test:unit` uses `scripts/ci/run-workspaces.mjs`; MetaBoost uses
+an explicit `npm run test -w ...` chain.
+
+## ADOPT
+
+1. Port `scripts/ci/run-workspaces.mjs` from Podverse (adapt workspace exclude list:
+   `--exclude apps/api --exclude apps/management-api`).
+2. Optionally port `scripts/ci/lint-with-summary.mjs` if CI adopts it later (out of scope unless
+   needed).
+3. Change root `package.json` `test:unit` to Podverse pattern:
+   `node scripts/ci/run-workspaces.mjs --script test --all --exclude apps/api --exclude apps/management-api`
+4. Document in `commands-from-metaboost-root` rule / `AGENTS.md`.
+
+## Intentional divergence (not ADOPT)
+
+| Item | Class | Notes |
+| --- | --- | --- |
+| `eslint-plugin-perfectionist` vs `simple-import-sort` | **MB-SPECIFIC** | Pre-existing; both enforce import order |
+| Podverse-only Makefiles (`Makefile.local.v4v`, extensions, alpha Jenkins) | **N/A** | No MB analogue |
+
+## Verification
+
+```bash
+./scripts/nix/with-env npm run test:unit
+```
diff --git a/.llm/plans/completed/metaboost-podverse-parity-gaps/COPY-PASTA.md b/.llm/plans/completed/metaboost-podverse-parity-gaps/COPY-PASTA.md
new file mode 100644
index 00000000..a93ebf11
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-parity-gaps/COPY-PASTA.md
@@ -0,0 +1,42 @@
+# MetaBoost ↔ Podverse parity gaps — Copy-Pasta
+
+Run after `metaboost-abcmemory-align` and `metaboost-ci-ops-align`.
+
+### Agent 1 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-parity-gaps/01-adopt-podverse-testing-standards.md
+```
+
+### Agent 2 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-parity-gaps/02-adopt-podverse-build-env-ops-skills.md
+```
+
+### Agent 3 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-parity-gaps/03-adopt-podverse-engineering-ops-skills.md
+```
+
+### Agent 4 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-parity-gaps/04-adopt-podverse-ui-shared-standards.md
+```
+
+### Agent 5 — [x]
+
+```
+Read and execute .llm/plans/active/metaboost-podverse-parity-gaps/05-adopt-run-workspaces-ci-script.md
+```
+
+Review `PROMOTE-TO-PODVERSE-NOTES.md` when opening Podverse issues (no Podverse edits from here).
+
+Move set to `.llm/plans/completed/metaboost-podverse-parity-gaps/` when complete.
+
+## Completion tracking
+
+Per **plan-execution-completion-tracking** rule: mark each agent prompt `[x]` when done; move each
+finished `NN-*.md` to `.llm/plans/completed/metaboost-podverse-parity-gaps/`; then move the whole set.
diff --git a/.llm/plans/completed/metaboost-podverse-parity-gaps/PROMOTE-TO-PODVERSE-NOTES.md b/.llm/plans/completed/metaboost-podverse-parity-gaps/PROMOTE-TO-PODVERSE-NOTES.md
new file mode 100644
index 00000000..363c629e
--- /dev/null
+++ b/.llm/plans/completed/metaboost-podverse-parity-gaps/PROMOTE-TO-PODVERSE-NOTES.md
@@ -0,0 +1,46 @@
+# Promote to Podverse — notes (informational)
+
+MetaBoost-only process/ops items worth proposing in the **Podverse** repo. Do **not** edit Podverse
+from MetaBoost workstreams; copy this list into a Podverse issue or PR when convenient.
+
+## High priority (security / ops)
+
+| Item | Type | Rationale |
+| --- | --- | --- |
+| `api-no-pii-credentials-in-responses` rule | rule | Safe API serialization (`userToJson`, no credential leaks) |
+| `argocd-gitops-push` skill | skill | Reminder to push `infra/k8s/**` for GitOps sync |
+| `path-casing-imports` rule + skill | rule/skill | Linux CI case-sensitivity for imports |
+| `linear-baseline-gz-sync` skill | skill | Explicit gz regeneration workflow (PV has `linear-baseline-0003` rule) |
+
+## Medium priority (DX / quality)
+
+| Item | Type | Rationale |
+| --- | --- | --- |
+| `plan-files-convention` skill | skill | COPY-PASTA / 00-EXECUTION-ORDER layout (vs `plan-lifecycle` only) |
+| `local-docker-env-alignment` skill | skill | Docker env parity with k8s templates |
+| `helpers-requests-req-pattern` skill | skill | Shared HTTP client boundaries |
+| `database-schema-naming` + `typeorm-orderby-property-names` | skills | ORM/DDL naming consistency |
+| `storybook-component-docs` skill | skill | UI package Storybook conventions |
+| `button-loading-async`, `use-form-component`, `password-strength-on-set-update` | skills | Form UX patterns |
+| `focus-outline-visible`, `single-focus-indicator`, `avoid-line-height`, `avoid-wrapper-elements` | skills/rules | a11y/style constraints |
+| `catch-unused-error` skill | skill | ESLint unused catch binding pattern |
+| `e2e-permission-actor-matrix` skill | skill | Management E2E authz matrix |
+
+## Lower priority / repo policy
+
+| Item | Type | Rationale |
+| --- | --- | --- |
+| `single-readme` rule + skill | rule/skill | One README at repo root policy |
+| `metaboost-infra-alpha-contracts.yml` workflow | workflow | Kustomize build CI for alpha overlay (adapt paths) |
+| `scripts/env-overrides/` home override flow | scripts | Alternative to Podverse `local-env/prepare-overrides.sh` |
+
+## Not promoted (MetaBoost-specific product)
+
+`generate-data-sync`, `roles-schema-sync`, `nested-resource-prefix-naming`,
+`management-edit-breadcrumbs`, `management-edit-page-tabs`, `tab-active-state-url-match`,
+`publish-metaboost-signing.yml`, MB billing/membership docs.
+
+## Bidirectional parity already shared
+
+Both repos already have: `normalize-markdown-links.mjs`, `eslint-rules/require-relative-js-extension.mjs`,
+tiered import-specifier enforcement, `.cursor/hooks/` + `.cursor/prompts/` (identical).
diff --git a/.llm/plans/completed/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md b/.llm/plans/completed/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..ecc2c67d
--- /dev/null
+++ b/.llm/plans/completed/metaboost-staged-changes-cleanup/00-EXECUTION-ORDER.md
@@ -0,0 +1,39 @@
+# 00 - Execution order - Metaboost staged-changes cleanup
+
+**Copy-paste prompts:** [COPY-PASTA.md](./COPY-PASTA.md)
+
+## Phase order
+
+Each phase is sequential. Within Phase 1 + Phase 2 there are no internal parallel
+groups; their underlying steps are short. Phases 3 and 4 can run in parallel after
+Phase 2 if two agents are available, since they touch disjoint files; otherwise run
+them sequentially.
+
+1. [01-error-boundaries-shared-ui.md](./01-error-boundaries-shared-ui.md) (completed)
+2. [02-notification-dispatch-perf.md](./02-notification-dispatch-perf.md) (completed)
+3. [03-shared-api-contract-types.md](./03-shared-api-contract-types.md) (completed)
+4. [04-schema-and-error-helpers.md](./04-schema-and-error-helpers.md) (completed)
+5. [05-helpers-and-bell-refactor.md](./05-helpers-and-bell-refactor.md) (completed)
+6. [06-style-and-import-hygiene.md](./06-style-and-import-hygiene.md) (completed)
+
+## Why this order
+
+- **Phase 1 first** - largest single-PR DRY win and unblocks any future shared-UI
+  consumers; touches `@metaboost/ui` only and two thin app wrappers, so it cannot
+  break server code while the rest of the cleanup is in flight.
+- **Phase 2 next** - real correctness/scaling fixes (N+1 query, serial sends,
+  per-row descendant upsert). Independent from Phase 1, so could swap if needed.
+- **Phase 3** before Phases 4/5 because moving the canonical TS types to
+  `helpers-requests` lets later phases import them without duplication.
+- **Phase 4** small dedup phase; safe to run in parallel with Phase 3 if the
+  `helpers-requests` exports are already merged.
+- **Phase 5** is the largest cleanup phase and depends on the type-shape work in
+  Phases 3-4 and the helpers added there.
+- **Phase 6** is style + import hygiene and runs last so it can verify Phase 1's
+  shared components carry no inline styles either.
+
+## Parallel-execution guidance
+
+- Phases 3 and 4 are file-disjoint after Phase 2 lands. If running with two
+  agents, kick them off together; otherwise sequential.
+- Phase 5 always runs after both 3 and 4 are merged (it imports their helpers).
diff --git a/.llm/plans/completed/metaboost-staged-changes-cleanup/00-SUMMARY.md b/.llm/plans/completed/metaboost-staged-changes-cleanup/00-SUMMARY.md
new file mode 100644
index 00000000..3533736e
--- /dev/null
+++ b/.llm/plans/completed/metaboost-staged-changes-cleanup/00-SUMMARY.md
@@ -0,0 +1,73 @@
+# 00 - Summary - Metaboost staged-changes cleanup
+
+## Scope
+
+Clean up DRY violations and inefficiencies introduced by the bucket-webpush-foundation
+changeset and a few adjacent additions. The cleanup is dependency-ordered into six
+phases that can each ship as a focused PR. Phase 1 has the largest line-count impact
+(removes ~250 lines of duplicate error-boundary code). Phases 2-3 fix correctness and
+scaling issues (N+1 dispatch, per-row descendant upsert, drifted API/client types).
+Phases 4-6 are smaller dedup and hygiene passes.
+
+## Plan files
+
+- [01-error-boundaries-shared-ui.md](./01-error-boundaries-shared-ui.md) - Move
+  duplicated `error.tsx` / `global-error.tsx` into `@metaboost/ui` components.
+- [02-notification-dispatch-perf.md](./02-notification-dispatch-perf.md) - Fix N+1 and
+  serial sends in webpush channel; bulk-upsert descendant notification preferences.
+- [03-shared-api-contract-types.md](./03-shared-api-contract-types.md) - Move
+  webpush + notification-preference TS types to `@metaboost/helpers-requests` so the
+  API and client share one declaration.
+- [04-schema-and-error-helpers.md](./04-schema-and-error-helpers.md) - Extract
+  `WebPushSubscriptionKeys` in OpenAPI + Joi; add `isPgUniqueViolation` helper in
+  `@metaboost/orm`; add web-push status-code helper.
+- [05-helpers-and-bell-refactor.md](./05-helpers-and-bell-refactor.md) - Auth
+  boilerplate helper, cookie helper, server-fetch helper, single-query upserts,
+  split `BucketNotificationsBell` into hook + modal hook + presentational.
+- [06-style-and-import-hygiene.md](./06-style-and-import-hygiene.md) - Inline
+  styles to SCSS modules, web-push named imports, logger alignment.
+
+## Dependency map
+
+```mermaid
+flowchart LR
+  P1[Phase 1\nError boundaries -> @metaboost/ui]
+  P2[Phase 2\nDispatch perf]
+  P3[Phase 3\nShared API types]
+  P4[Phase 4\nSchema + error helpers]
+  P5[Phase 5\nHelpers + bell refactor]
+  P6[Phase 6\nStyle + imports]
+
+  P1 --> P6
+  P2 --> P5
+  P3 --> P4
+  P3 --> P5
+  P4 --> P5
+  P5 --> P6
+```
+
+Phase 1 is independent (UI tree). Phase 2 is independent (server only). Phase 3
+unblocks the schema and helper phases (they import canonical types). Phase 5 depends
+on Phases 3 and 4. Phase 6 is the last polish pass.
+
+## Key decisions
+
+- Error-boundary shape: move to `@metaboost/ui` rather than an internal shared module,
+  per `reusable-components` and `ui-component-promotion` skills (user choice).
+- Auth narrowing: add a `requireUser(req, res)` helper rather than a typed
+  `AuthenticatedRequest`, to keep the change local and avoid a request-type rewrite.
+- Push send fan-out: use `Promise.allSettled` (not `Promise.all`) so one bad
+  endpoint cannot abort the whole batch.
+- Postgres errors: a single shared `isPgUniqueViolation` helper in `@metaboost/orm`
+  replaces both inline guards and removes two `as` assertions flagged by
+  `avoid-type-assertions`.
+- Out of scope: a sweep of pre-existing duplication elsewhere in
+  `helpers-requests/web/buckets.ts` and the auth-boilerplate pattern in controllers
+  not touched by the staged changes.
+
+## Verification
+
+End each phase with the make targets in that phase's plan file. After Phase 1 and
+Phase 6 (the only UI-visible changes), the response must end with the corresponding
+`make e2e_test_*_report_spec` block per the `end-with-targeted-make-report-verify`
+rule.
diff --git a/.llm/plans/completed/metaboost-staged-changes-cleanup/01-error-boundaries-shared-ui.md b/.llm/plans/completed/metaboost-staged-changes-cleanup/01-error-boundaries-shared-ui.md
new file mode 100644
index 00000000..63bb6b35
--- /dev/null
+++ b/.llm/plans/completed/metaboost-staged-changes-cleanup/01-error-boundaries-shared-ui.md
@@ -0,0 +1,86 @@
+# 01 - Cross-app error boundaries to `@metaboost/ui`
+
+## Scope
+
+Replace ~250 lines of duplicated client code in
+[apps/web/src/app/error.tsx](/apps/web/src/app/error.tsx),
+[apps/web/src/app/global-error.tsx](/apps/web/src/app/global-error.tsx),
+[apps/management-web/src/app/error.tsx](/apps/management-web/src/app/error.tsx),
+and
+[apps/management-web/src/app/global-error.tsx](/apps/management-web/src/app/global-error.tsx)
+with shared components in `@metaboost/ui`. The two `error.tsx` files are
+byte-identical today; the two `global-error.tsx` files differ only by a
+`SETTINGS_COOKIE_NAME` constant.
+
+This aligns with the `app-local-ui-wrappers` rule and the `reusable-components`
+and `ui-component-promotion` skills.
+
+## Steps
+
+1. **Create `AppErrorBoundary` in `packages/ui`.**
+   - Path: `packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.tsx`.
+   - Pure presentational client component; takes localized strings + `error`,
+     `reset`, `onReload`, `onGoHome` props.
+   - SCSS module `AppErrorBoundary.module.scss` for the action row, dev-only
+     `<details>` block, and pre-formatted error spacing - no inline `style={{}}`.
+     Use `@metaboost/ui` design tokens per `styles-source-of-truth`.
+   - No `next-intl` import here; copy is fully prop-driven per `shared-ui-i18n`.
+
+2. **Create `GlobalErrorBoundary` in `packages/ui`.**
+   - Path: `packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.tsx`.
+   - Renders `<html><body><ThemeWrapper settingsCookieName={...}>...` shell.
+   - Accepts: `settingsCookieName`, `loadStrings: () => Promise<Record<string,string>>`,
+     `defaultStrings`, `error`, `reset`, optional `onReload` (defaults to
+     `window.location.reload`).
+   - Move `isPlainRecord`, `filterErrorStrings`, and the `useEffect`/state pattern
+     here. Apps inject the locale-specific `i18n/originals/<locale>.json` import
+     via `loadStrings`, since dynamic imports must remain in the app to keep
+     Webpack bundling local.
+   - SCSS module instead of inline styles.
+
+3. **Add Storybook stories** for both components per `storybook-component-docs`,
+   covering: default state, dev-mode `details` open, all-strings-fallback path
+   (so we exercise `defaultStrings`).
+
+4. **Export from `packages/ui/src/index.ts`** and update
+   [packages/ui/PACKAGES-UI.md](/packages/ui/PACKAGES-UI.md) feedback section.
+
+5. **Replace app files with thin wrappers.**
+   - `apps/web/src/app/error.tsx` and `apps/management-web/src/app/error.tsx`:
+     `'use client'` + `useTranslations('errors')` + `<AppErrorBoundary ...t-prop bag />`.
+     Drop inline styles and the duplicated layout entirely.
+   - `apps/web/src/app/global-error.tsx`: pass `settingsCookieName="web-settings"`
+     and a `loadStrings` callback that does the dynamic
+     `import('../../i18n/originals/<locale>.json')`.
+   - `apps/management-web/src/app/global-error.tsx`: same but
+     `settingsCookieName="management-settings"`.
+
+6. **Leave i18n keys unchanged.** The `errors.boundary_title`, `errors.global_title`,
+   etc. keys already exist in both apps' `i18n/originals/en-US.json` and `es.json`.
+
+## Key files
+
+- `packages/ui/src/components/feedback/AppErrorBoundary/` (new)
+- `packages/ui/src/components/feedback/GlobalErrorBoundary/` (new)
+- `packages/ui/src/index.ts`
+- `packages/ui/PACKAGES-UI.md`
+- `apps/web/src/app/error.tsx`, `apps/web/src/app/global-error.tsx`
+- `apps/management-web/src/app/error.tsx`, `apps/management-web/src/app/global-error.tsx`
+
+## Tests
+
+- Unit (Vitest in `packages/ui`): render `AppErrorBoundary` with all props,
+  assert dev-mode `details` is shown only when `NODE_ENV === 'development'`,
+  assert all three buttons fire their callbacks.
+- Storybook visual review covers the global shell.
+- Existing E2E redirect/auth specs keep passing; no spec change needed unless
+  one currently asserts `data-testid="error-page"` (verify and preserve).
+
+## Verification
+
+```bash
+make e2e_test_report_scoped WEB_SPEC=e2e/dashboard-bucket-owner.spec.ts MGMT_SPEC=e2e/dashboard-super-admin-full-crud.spec.ts
+```
+
+Pick one cross-app pair that exercises the standard layout shell so the new
+shared component is rendered in both apps.
diff --git a/.llm/plans/completed/metaboost-staged-changes-cleanup/02-notification-dispatch-perf.md b/.llm/plans/completed/metaboost-staged-changes-cleanup/02-notification-dispatch-perf.md
new file mode 100644
index 00000000..25fded2f
--- /dev/null
+++ b/.llm/plans/completed/metaboost-staged-changes-cleanup/02-notification-dispatch-perf.md
@@ -0,0 +1,87 @@
+# 02 - Notification dispatch performance
+
+## Scope
+
+Two real scaling problems landed in the bucket-webpush-foundation work:
+
+- N+1 query in
+  [apps/api/src/lib/notifications/webPushChannel.ts](/apps/api/src/lib/notifications/webPushChannel.ts)
+  (one DB round-trip per enabled user) and serial `await webpush.sendNotification`
+  inside the inner loop.
+- Per-row descendant upsert loop in
+  [apps/api/src/controllers/bucketsController.ts](/apps/api/src/controllers/bucketsController.ts)
+  `updateBucketNotificationPreference` when `applyToDescendants === true`.
+
+Both replace existing logic with patterns already used elsewhere in the repo, so
+the changes are small but impactful at scale.
+
+## Steps
+
+1. **Add `UserWebPushSubscriptionService.listByUserIds(userIds: string[])`** in
+   [packages/orm/src/services/UserWebPushSubscriptionService.ts](/packages/orm/src/services/UserWebPushSubscriptionService.ts).
+   - Single `WHERE user_id IN (...)` query; returns the rows ordered by
+     `(userId, createdAt ASC)` so callers can group deterministically.
+   - Keep `listByUser(userId)` for the user-self CRUD path.
+
+2. **Rewrite `webPushChannel.sendWebPushForNewBucketMessage`.**
+   - One call to `listByUserIds(enabledUserIds)`.
+   - Build the JSON payload once, then dispatch with `Promise.allSettled` over
+     all subscriptions.
+   - Iterate the settled results to delete subscriptions that returned 404 or
+     410 (re-using the new helper from Phase 4 once available; until then keep
+     the inline status-code discriminator with a TODO referencing Phase 4).
+   - Bound parallelism only if a follow-up specifies it; for now `allSettled` is
+     enough.
+
+3. **Add `BucketNotificationPreferenceService.upsertManyForUser(userId, bucketIds, enabled)`**
+   in [packages/orm/src/services/BucketNotificationPreferenceService.ts](/packages/orm/src/services/BucketNotificationPreferenceService.ts).
+   - Single SQL like:
+
+     ```sql
+     INSERT INTO bucket_notification_preference
+       (user_id, bucket_id, enabled, created_at, updated_at)
+     SELECT $1::uuid, id, $2::boolean, NOW(), NOW()
+       FROM bucket
+      WHERE id = ANY($3::uuid[])
+     ON CONFLICT (user_id, bucket_id)
+        DO UPDATE SET enabled = EXCLUDED.enabled, updated_at = NOW();
+     ```
+   - Mirrors the pattern already used by
+     `BucketService.applyGeneralSettingsToDescendants` so style + safety match.
+
+4. **Use the bulk service in the controller.**
+   - Replace the `for (const childId of descendantIds) await upsert(...)` loop
+     in `updateBucketNotificationPreference` with a single `upsertManyForUser`
+     call when `descendantIds.length > 0`.
+
+5. **Tests.**
+   - Extend
+     [apps/api/src/test/notification-webpush.test.ts](/apps/api/src/test/notification-webpush.test.ts)
+     with:
+     - `applyToDescendants` over a tree with at least 5 descendants asserts all
+       descendant rows are written and that only one DB round-trip per call is
+       made (spy on the service or use a query log if available).
+     - Multi-subscriber dispatch case: two users with notifications enabled,
+       each with multiple subscriptions; assert `webpush.sendNotification` is
+       called the expected total count and that `listByUserIds` is invoked
+       exactly once.
+
+## Key files
+
+- `packages/orm/src/services/UserWebPushSubscriptionService.ts`
+- `packages/orm/src/services/BucketNotificationPreferenceService.ts`
+- `apps/api/src/lib/notifications/webPushChannel.ts`
+- `apps/api/src/controllers/bucketsController.ts`
+- `apps/api/src/test/notification-webpush.test.ts`
+
+## Verification
+
+```bash
+npm run test:e2e:api
+```
+
+Plus the existing webpush E2E spec to confirm UI behavior is unchanged:
+
+```bash
+make e2e_test_web_report_spec SPEC=e2e/bucket-notifications-webpush-bucket-owner.spec.ts
+```
diff --git a/.llm/plans/completed/metaboost-staged-changes-cleanup/03-shared-api-contract-types.md b/.llm/plans/completed/metaboost-staged-changes-cleanup/03-shared-api-contract-types.md
new file mode 100644
index 00000000..a0caa27f
--- /dev/null
+++ b/.llm/plans/completed/metaboost-staged-changes-cleanup/03-shared-api-contract-types.md
@@ -0,0 +1,74 @@
+# 03 - Shared API contract types in one place
+
+## Scope
+
+`AGENTS.md` says "Shared request/response types may live in `packages/helpers-requests`
+or `packages/helpers`." Today the new webpush + notification-preference types are
+declared once in the API and again in `helpers-requests`, with no compile-time
+guarantee they stay in sync. This phase makes `helpers-requests` the canonical
+home and has the API import from there.
+
+## Duplicated declarations to consolidate
+
+- `UpsertWebPushSubscriptionBody` and `UpdateWebPushSubscriptionBody`
+  - Defined in
+    [apps/api/src/schemas/webPushSubscriptions.ts](/apps/api/src/schemas/webPushSubscriptions.ts).
+  - Re-declared in
+    [packages/helpers-requests/src/web/auth.ts](/packages/helpers-requests/src/web/auth.ts).
+- `BucketNotificationPreferenceResponse` and `UpdateBucketNotificationPreferenceBody`
+  - Defined in
+    [apps/api/src/schemas/buckets.ts](/apps/api/src/schemas/buckets.ts).
+  - Re-declared in
+    [packages/helpers-requests/src/web/buckets.ts](/packages/helpers-requests/src/web/buckets.ts).
+- `WebPushSubscriptionDto` already lives in `helpers-requests` but the API's
+  `subscriptionToJson` builds a matching object without using the type.
+
+## Steps
+
+1. **Designate `helpers-requests` as canonical** for these four types. The
+   existing declarations in `web/auth.ts` and `web/buckets.ts` stay; tighten
+   them as needed (e.g. ensure `keys` is shared).
+
+2. **Have the API schemas import the canonical TS types.**
+   - In `apps/api/src/schemas/webPushSubscriptions.ts`, replace the local
+     `export type Upsert.../Update...Body` blocks with
+     `import type { UpsertWebPushSubscriptionBody, UpdateWebPushSubscriptionBody }
+     from '@metaboost/helpers-requests';` + `export type { ... };`.
+   - Same in `apps/api/src/schemas/buckets.ts` for the notification-preference
+     types.
+
+3. **Type the controller responses.**
+   - In
+     [apps/api/src/controllers/webPushSubscriptionsController.ts](/apps/api/src/controllers/webPushSubscriptionsController.ts),
+     annotate
+     `subscriptionToJson(row: UserWebPushSubscription): WebPushSubscriptionDto`
+     so the handler cannot drift from the client type.
+   - Annotate `getBucketNotificationPreference` / `updateBucketNotificationPreference`
+     responses with the canonical types via explicit `Response<...>` type or
+     a typed factory.
+
+4. **Verify there are no other re-declarations.**
+   - `rg "type BucketNotificationPreferenceResponse"` should return one hit.
+   - `rg "type UpsertWebPushSubscriptionBody"` should return one hit (in
+     `helpers-requests`) plus the schema file's `export type { ... }`.
+
+## Key files
+
+- `packages/helpers-requests/src/web/auth.ts`
+- `packages/helpers-requests/src/web/buckets.ts`
+- `apps/api/src/schemas/webPushSubscriptions.ts`
+- `apps/api/src/schemas/buckets.ts`
+- `apps/api/src/controllers/webPushSubscriptionsController.ts`
+- `apps/api/src/controllers/bucketsController.ts`
+
+## Tests
+
+No behavior change. Existing API integration tests in
+`apps/api/src/test/notification-webpush.test.ts` cover the response shape and
+will catch any accidental drift.
+
+## Verification
+
+```bash
+npm run test:e2e:api
+```
diff --git a/.llm/plans/completed/metaboost-staged-changes-cleanup/04-schema-and-error-helpers.md b/.llm/plans/completed/metaboost-staged-changes-cleanup/04-schema-and-error-helpers.md
new file mode 100644
index 00000000..e8e5483b
--- /dev/null
+++ b/.llm/plans/completed/metaboost-staged-changes-cleanup/04-schema-and-error-helpers.md
@@ -0,0 +1,134 @@
+# 04 - Schema dedup + Postgres/web-push error helpers
+
+## Scope
+
+Three small DRY consolidations that remove duplication and remove `as` type
+assertions flagged by the always-applied `avoid-type-assertions` rule.
+
+## Steps
+
+### 1. OpenAPI: extract `WebPushSubscriptionKeys`
+
+In [apps/api/src/openapi.ts](/apps/api/src/openapi.ts), both
+`UpsertWebPushSubscriptionBody` and `UpdateWebPushSubscriptionBody` inline an
+identical `keys` object schema (`p256dh`, `auth`).
+
+- Add a shared component:
+
+  ```ts
+  WebPushSubscriptionKeys: {
+    type: 'object',
+    required: ['p256dh', 'auth'],
+    properties: {
+      p256dh: { type: 'string', minLength: 1 },
+      auth: { type: 'string', minLength: 1 },
+    },
+  }
+  ```
+
+- Reference it from both bodies via
+  `keys: { $ref: '#/components/schemas/WebPushSubscriptionKeys' }`.
+
+### 2. Joi: extract `webPushKeysObject`
+
+In
+[apps/api/src/schemas/webPushSubscriptions.ts](/apps/api/src/schemas/webPushSubscriptions.ts):
+
+- Extract:
+
+  ```ts
+  const webPushKeysObject = Joi.object({
+    p256dh: webPushKey.required(),
+    auth: webPushKey.required(),
+  });
+  ```
+
+- Use it in both schemas:
+
+  ```ts
+  upsertWebPushSubscriptionSchema = Joi.object({
+    endpoint: ...,
+    keys: webPushKeysObject.required(),
+    locale: ...,
+  });
+
+  updateWebPushSubscriptionSchema = Joi.object({
+    endpoint: ...,
+    keys: webPushKeysObject.optional(),
+    locale: ...,
+  }).min(1);
+  ```
+
+### 3. Postgres unique-violation helper
+
+The same shape appears in two new code paths:
+
+- [apps/api/src/controllers/bucketsController.ts](/apps/api/src/controllers/bucketsController.ts)
+  `isUniqueViolation`.
+- Inline check inside `BucketService.create` in
+  [packages/orm/src/services/BucketService.ts](/packages/orm/src/services/BucketService.ts).
+
+Both currently use `(error as { code: string }).code === '23505'`. Centralize:
+
+- Add to `@metaboost/orm` (e.g. `packages/orm/src/lib/pgError.ts`):
+
+  ```ts
+  export function getPgErrorCode(err: unknown): string | undefined {
+    if (err === null || typeof err !== 'object' || !('code' in err)) {
+      return undefined;
+    }
+    const code = (err as { code: unknown }).code;
+    return typeof code === 'string' ? code : undefined;
+  }
+
+  export function isPgUniqueViolation(err: unknown): boolean {
+    return getPgErrorCode(err) === '23505';
+  }
+  ```
+
+- Confine the single `as` to the helper, with a short comment documenting why.
+- Export from `packages/orm/src/index.ts`.
+- Replace both inline guards with `isPgUniqueViolation(err)`.
+
+### 4. Web-push status-code helper
+
+The 8-line discriminator in
+[apps/api/src/lib/notifications/webPushChannel.ts](/apps/api/src/lib/notifications/webPushChannel.ts)
+that pulls `statusCode` off web-push errors should be its own helper next to the
+channel:
+
+```ts
+function getWebPushErrorStatusCode(err: unknown): number | undefined {
+  if (err === null || typeof err !== 'object' || !('statusCode' in err)) {
+    return undefined;
+  }
+  const status = (err as { statusCode: unknown }).statusCode;
+  return typeof status === 'number' ? status : undefined;
+}
+```
+
+Use it in the cleanup branch in `Promise.allSettled` results (Phase 2).
+
+## Key files
+
+- `apps/api/src/openapi.ts`
+- `apps/api/src/schemas/webPushSubscriptions.ts`
+- `packages/orm/src/lib/pgError.ts` (new)
+- `packages/orm/src/index.ts`
+- `apps/api/src/controllers/bucketsController.ts`
+- `packages/orm/src/services/BucketService.ts`
+- `apps/api/src/lib/notifications/webPushChannel.ts`
+
+## Tests
+
+- Unit (Vitest in `packages/orm`): `isPgUniqueViolation` covers
+  `null`/`undefined`/non-object/`{ code: '23505' }`/`{ code: '23503' }`/
+  `{ code: 23505 }` (number).
+- Existing webpush E2E and integration tests already exercise the unique-violation
+  branch in `BucketService.create` (RSS channel duplicate guid).
+
+## Verification
+
+```bash
+npm run test:e2e:api
+```
diff --git a/.llm/plans/completed/metaboost-staged-changes-cleanup/05-helpers-and-bell-refactor.md b/.llm/plans/completed/metaboost-staged-changes-cleanup/05-helpers-and-bell-refactor.md
new file mode 100644
index 00000000..4b026da3
--- /dev/null
+++ b/.llm/plans/completed/metaboost-staged-changes-cleanup/05-helpers-and-bell-refactor.md
@@ -0,0 +1,159 @@
+# 05 - Helpers + bell refactor + single-query upsert
+
+## Scope
+
+The largest cleanup phase. Five independent steps; ship them in one PR or split
+if review surface is too large. Each step removes a localized duplication or
+inefficiency. No behavior change.
+
+## Steps
+
+### 1. `requireUser` auth-check helper
+
+Today, every newly added handler in
+[apps/api/src/controllers/webPushSubscriptionsController.ts](/apps/api/src/controllers/webPushSubscriptionsController.ts)
+opens with the same 4-line `req.user === undefined` guard (4 occurrences in one
+new file; 6 across the touched controllers). The runtime check is dead code in
+practice because every handler is mounted behind `requireAuthMiddleware`.
+
+- Add a helper in `apps/api/src/middleware/auth.ts` (or co-located near
+  `asyncHandler`) that returns the user or sends 401 and returns `null`:
+
+  ```ts
+  export function requireUser(req: Request, res: Response): User | null {
+    if (req.user === undefined) {
+      res.status(401).json({ message: 'Authentication required' });
+      return null;
+    }
+    return req.user;
+  }
+  ```
+
+- Replace the four occurrences in `webPushSubscriptionsController.ts` and the
+  newly-touched handlers in `bucketsController.ts` (`listBuckets`,
+  `createBucket`).
+- Drop the unreachable `subscriptionId` validation in `update`/`delete`
+  handlers (Express has matched the route param). If a typed param is needed,
+  move it to a single `validateParams` middleware later.
+
+### 2. `cookieHeaderToHeaders` helper in `helpers-requests`
+
+[packages/helpers-requests/src/web/buckets.ts](/packages/helpers-requests/src/web/buckets.ts)
+contains the same conditional 11 times:
+
+```ts
+...(cookieHeader !== undefined && cookieHeader !== ''
+  ? { headers: { Cookie: cookieHeader } }
+  : {}),
+```
+
+- Add to [packages/helpers-requests/src/request.ts](/packages/helpers-requests/src/request.ts):
+
+  ```ts
+  export function cookieHeaderToHeaders(
+    cookieHeader: string | undefined
+  ): { headers: { Cookie: string } } | object {
+    return cookieHeader !== undefined && cookieHeader !== ''
+      ? { headers: { Cookie: cookieHeader } }
+      : {};
+  }
+  ```
+
+- Replace all 11 sites in `web/buckets.ts`. Limit scope to that file in this PR
+  (other helpers can adopt the helper in a follow-up sweep).
+
+### 3. `withServerCookie` helper in `apps/web/src/lib`
+
+The new `fetchBucketNotificationPreference` follows the same shape as
+`fetchBucket`, `fetchChildBuckets`, `fetchMessages`, etc. in
+[apps/web/src/lib/buckets.ts](/apps/web/src/lib/buckets.ts):
+
+```ts
+const cookieHeader = await getCookieHeader();
+const baseUrl = getServerApiBaseUrl();
+const res = await webBuckets.reqXxx(baseUrl, ..., cookieHeader);
+if (!res.ok || res.data === undefined) return defaultValue;
+return res.data;
+```
+
+- Add to [apps/web/src/lib/server-request.ts](/apps/web/src/lib/server-request.ts):
+
+  ```ts
+  export async function withServerCookie<T>(
+    call: (baseUrl: string, cookieHeader: string) => Promise<ApiResponse<T>>
+  ): Promise<{ ok: boolean; data: T | undefined }> {
+    const cookieHeader = await getCookieHeader();
+    const baseUrl = getServerApiBaseUrl();
+    const res = await call(baseUrl, cookieHeader);
+    return { ok: res.ok, data: res.data };
+  }
+  ```
+
+- Refactor the `fetch*` helpers in `lib/buckets.ts` to use `withServerCookie`.
+  Leave the per-helper default-value handling in the caller; the helper just
+  removes the cookie/baseUrl preamble.
+
+### 4. Single-query upserts in two new ORM services
+
+Both new services do a `repo.upsert` followed by `repo.findOne` (two queries):
+
+- [packages/orm/src/services/UserWebPushSubscriptionService.ts](/packages/orm/src/services/UserWebPushSubscriptionService.ts)
+  `upsert`.
+- [packages/orm/src/services/BucketNotificationPreferenceService.ts](/packages/orm/src/services/BucketNotificationPreferenceService.ts)
+  `upsert`.
+
+Replace each with raw SQL (use `appDataSourceReadWrite.query`) of the form
+`INSERT ... ON CONFLICT (...) DO UPDATE SET ... RETURNING *` and parse the row.
+Drop the post-upsert `findOne`. Trade-off: bypasses TypeORM repository hooks,
+but neither entity declares any. Document this with a one-line comment.
+
+### 5. Split `BucketNotificationsBell`
+
+[apps/web/src/app/(main)/bucket/[id]/BucketNotificationsBell.tsx](/apps/web/src/app/(main)/bucket/[id]/BucketNotificationsBell.tsx)
+is 227 lines mixing browser-side push subscription, server preference patching,
+scope modal state, error display, and visual chrome. Split:
+
+- `apps/web/src/app/(main)/bucket/[id]/useBucketWebPushSubscription.ts`:
+  hook returning `{ enabled, loading, errorMessage, enable, disable }`. Owns
+  Notification permission, PushManager subscribe/unsubscribe, server upsert,
+  `reqPatchBucketNotificationPreference`. Generic over scope.
+- `apps/web/src/components/useApplyToDescendantsModal.tsx`: hook + modal that
+  returns `{ openFor, open, dismiss, confirm }` for any future preference toggle
+  with an "apply to descendants" decision. Lives in `apps/web/src/components`
+  because future toggles may use it outside the bucket detail page.
+- `BucketNotificationsBell.tsx`: presentational only - composes the two hooks,
+  renders the bell button, tooltip, and error text.
+
+## Key files
+
+- `apps/api/src/middleware/auth.ts` (or new helper file)
+- `apps/api/src/controllers/webPushSubscriptionsController.ts`
+- `apps/api/src/controllers/bucketsController.ts`
+- `packages/helpers-requests/src/request.ts`
+- `packages/helpers-requests/src/web/buckets.ts`
+- `apps/web/src/lib/server-request.ts`
+- `apps/web/src/lib/buckets.ts`
+- `packages/orm/src/services/UserWebPushSubscriptionService.ts`
+- `packages/orm/src/services/BucketNotificationPreferenceService.ts`
+- `apps/web/src/app/(main)/bucket/[id]/BucketNotificationsBell.tsx`
+- `apps/web/src/app/(main)/bucket/[id]/useBucketWebPushSubscription.ts` (new)
+- `apps/web/src/components/useApplyToDescendantsModal.tsx` (new)
+
+## Tests
+
+- Unit (Vitest in `apps/api`): `requireUser` returns user when set; sends 401
+  + returns `null` when not.
+- Unit (Vitest in `packages/helpers-requests`): `cookieHeaderToHeaders` for
+  `undefined`, `''`, `'k=v'`.
+- Existing webpush E2E spec covers the bell behavior end to end; if the split
+  changes any aria labels or button structure, update the spec accordingly.
+- API integration: existing `notification-webpush.test.ts` exercises the
+  upsert path; assert returned row has the expected `id` after the rewrite.
+
+## Verification
+
+```bash
+npm run test:unit
+npm run test:e2e:api
+make e2e_test_web_report_spec SPEC=e2e/bucket-notifications-webpush-bucket-owner.spec.ts
+```
diff --git a/.llm/plans/completed/metaboost-staged-changes-cleanup/06-style-and-import-hygiene.md b/.llm/plans/completed/metaboost-staged-changes-cleanup/06-style-and-import-hygiene.md
new file mode 100644
index 00000000..194fd60d
--- /dev/null
+++ b/.llm/plans/completed/metaboost-staged-changes-cleanup/06-style-and-import-hygiene.md
@@ -0,0 +1,80 @@
+# 06 - Style + import hygiene + logger alignment
+
+## Scope
+
+Final polish pass. Three small adjustments aligned with already-applied repo
+rules and skills.
+
+## Steps
+
+### 1. Replace inline styles in bucket detail `bucketName`
+
+[apps/web/src/app/(main)/bucket/[id]/page.tsx](/apps/web/src/app/(main)/bucket/[id]/page.tsx)
+renders the bucket name inside a `span` with two `style={{ display: 'inline-flex',
+... }}` blocks (outer flex row + inner public/lock icon span). Per
+`styles-source-of-truth` and `avoid-wrapper-elements`, use SCSS classes:
+
+- Add a co-located SCSS module (e.g. `BucketName.module.scss`) with classes for
+  the row and icon spans, using `@metaboost/ui` design tokens.
+- If the same name + visibility pattern shows up in any other bucket page,
+  extract a small `BucketNameWithVisibility` component instead and import it.
+- Verify the four error-page files (now in `@metaboost/ui` after Phase 1)
+  carry no inline styles. This is a checkpoint, not new work, since Phase 1
+  already required SCSS modules for those components.
+
+### 2. Web-push named imports
+
+[apps/api/src/lib/notifications/webPushChannel.ts](/apps/api/src/lib/notifications/webPushChannel.ts)
+uses a default import:
+
+```ts
+import webpush from 'web-push';
+```
+
+Per `prefer-named-exports`:
+
+```ts
+import { setVapidDetails, sendNotification } from 'web-push';
+```
+
+The `web-push` package exports both as named symbols. Update call sites
+accordingly. The mock in
+[apps/api/src/test/notification-webpush.test.ts](/apps/api/src/test/notification-webpush.test.ts)
+must be updated to use named exports too:
+
+```ts
+vi.mock('web-push', () => ({
+  setVapidDetails: vi.fn(),
+  sendNotification: vi.fn().mockResolvedValue(undefined),
+}));
+```
+
+### 3. Replace `console.error` in webpush channel
+
+The single `console.error('webPushChannel: sendNotification failed', ...)` call
+is the only `console.*` use in the API runtime path for this feature. Switch to
+the standard logger used by other Metaboost API controllers (check
+`apps/api/src/lib/logger.ts` or the existing import pattern in nearby
+controllers; mirror it). This aligns with the Podverse `logging` skill and is
+consistent with the surrounding code style.
+
+## Key files
+
+- `apps/web/src/app/(main)/bucket/[id]/page.tsx`
+- `apps/web/src/app/(main)/bucket/[id]/BucketName.module.scss` (new)
+- `apps/api/src/lib/notifications/webPushChannel.ts`
+- `apps/api/src/test/notification-webpush.test.ts`
+
+## Tests
+
+- No new tests required; the existing webpush integration test already exercises
+  the error branch (one `expect(webpush.sendNotification).toHaveBeenCalled()`
+  case). After updating the mock to named exports, all existing assertions must
+  still pass.
+
+## Verification
+
+```bash
+npm run test:e2e:api
+make e2e_test_web_report_spec SPEC=e2e/bucket-notifications-webpush-bucket-owner.spec.ts
+```
diff --git a/.llm/plans/completed/metaboost-staged-changes-cleanup/COPY-PASTA.md b/.llm/plans/completed/metaboost-staged-changes-cleanup/COPY-PASTA.md
new file mode 100644
index 00000000..3a9adcc4
--- /dev/null
+++ b/.llm/plans/completed/metaboost-staged-changes-cleanup/COPY-PASTA.md
@@ -0,0 +1,108 @@
+# Copy-paste prompts - Metaboost staged-changes cleanup
+
+Use these prompts to execute plans in the order defined by
+[`00-EXECUTION-ORDER.md`](./00-EXECUTION-ORDER.md). Phases are sequential.
+
+Paths below are relative to the **Metaboost** repository root.
+
+After completing a step, update this file to mark the step completed (per
+**plan-execution-completion-tracking**) and move completed numbered plans to
+`.llm/plans/completed/metaboost-staged-changes-cleanup/` when appropriate.
+
+---
+
+## Phase 1 - Cross-app error boundaries -> @metaboost/ui
+
+### Step 1 - `01-error-boundaries-shared-ui`
+
+**Status:** completed (plan moved to `.llm/plans/completed/metaboost-staged-changes-cleanup/01-error-boundaries-shared-ui.md`).
+
+```text
+Implement plan file `.llm/plans/active/metaboost-staged-changes-cleanup/01-error-boundaries-shared-ui.md` exactly as written.
+Move the duplicated error.tsx and global-error.tsx logic into shared @metaboost/ui components with SCSS modules and Storybook stories per the plan.
+Apps must end up with thin client wrappers that pass translations and the cookie name.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+```
+
+---
+
+## Phase 2 - Notification dispatch performance
+
+### Step 2 - `02-notification-dispatch-perf`
+
+**Status:** completed (plan moved to `.llm/plans/completed/metaboost-staged-changes-cleanup/02-notification-dispatch-perf.md`).
+
+```text
+Implement plan file `.llm/plans/active/metaboost-staged-changes-cleanup/02-notification-dispatch-perf.md` exactly as written.
+Add UserWebPushSubscriptionService.listByUserIds, switch the webpush channel to a single batched query and Promise.allSettled, and add BucketNotificationPreferenceService.upsertManyForUser using INSERT ... SELECT ... ON CONFLICT.
+Update notification-webpush.test.ts with the multi-subscriber and applyToDescendants-many-descendants cases per the plan.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+```
+
+---
+
+## Phase 3 - Shared API contract types
+
+### Step 3 - `03-shared-api-contract-types`
+
+**Status:** completed (plan moved to `.llm/plans/completed/metaboost-staged-changes-cleanup/03-shared-api-contract-types.md`).
+
+```text
+Implement plan file `.llm/plans/active/metaboost-staged-changes-cleanup/03-shared-api-contract-types.md` exactly as written.
+Make @metaboost/helpers-requests the canonical home for the four duplicated request/response types and have apps/api/src/schemas re-export from there.
+Annotate subscriptionToJson with WebPushSubscriptionDto.
+Do not modify unrelated files or the Joi schemas' runtime shape.
+When done, summarize changed files and any follow-up risks.
+```
+
+---
+
+## Phase 4 - Schema dedup + pg/web-push helpers
+
+### Step 4 - `04-schema-and-error-helpers`
+
+**Status:** completed (plan moved to `.llm/plans/completed/metaboost-staged-changes-cleanup/04-schema-and-error-helpers.md`).
+
+```text
+Implement plan file `.llm/plans/active/metaboost-staged-changes-cleanup/04-schema-and-error-helpers.md` exactly as written.
+Extract WebPushSubscriptionKeys in OpenAPI, webPushKeysObject in Joi, isPgUniqueViolation/getPgErrorCode in @metaboost/orm, and getWebPushErrorStatusCode next to the channel.
+Replace inline guards in bucketsController and BucketService.create.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+```
+
+Phase 3 and Phase 4 are file-disjoint; if running with two agents, they may
+proceed in parallel after Phase 2 lands.
+
+---
+
+## Phase 5 - Helpers + bell refactor + single-query upsert
+
+### Step 5 - `05-helpers-and-bell-refactor`
+
+**Status:** completed (plan moved to `.llm/plans/completed/metaboost-staged-changes-cleanup/05-helpers-and-bell-refactor.md`).
+
+```text
+Implement plan file `.llm/plans/active/metaboost-staged-changes-cleanup/05-helpers-and-bell-refactor.md` exactly as written.
+Add requireUser, cookieHeaderToHeaders, withServerCookie helpers; rewrite the two new ORM upserts as INSERT ... ON CONFLICT ... RETURNING; split BucketNotificationsBell into useBucketWebPushSubscription + useApplyToDescendantsModal + presentational.
+Update existing tests as the plan describes.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+```
+
+---
+
+## Phase 6 - Style + import hygiene
+
+### Step 6 - `06-style-and-import-hygiene`
+
+**Status:** completed (plan moved to `.llm/plans/completed/metaboost-staged-changes-cleanup/06-style-and-import-hygiene.md`).
+
+```text
+Implement plan file `.llm/plans/active/metaboost-staged-changes-cleanup/06-style-and-import-hygiene.md` exactly as written.
+Replace inline styles on the bucket detail page with an SCSS module (or a small shared component if the pattern repeats), switch web-push to named imports, replace console.error with the standard logger, and update the test mock accordingly.
+Do not modify unrelated files.
+When done, summarize changed files and any follow-up risks.
+```
diff --git a/.llm/plans/completed/remove-multi-llm-exports/00-EXECUTION-ORDER.md b/.llm/plans/completed/remove-multi-llm-exports/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..23f21f14
--- /dev/null
+++ b/.llm/plans/completed/remove-multi-llm-exports/00-EXECUTION-ORDER.md
@@ -0,0 +1,29 @@
+# Execution order — Remove multi-LLM exports (Metaboost)
+
+Run prompts from [COPY-PASTA.md](./COPY-PASTA.md).
+
+**Coordination:** Podverse plans 01–04 should land first or in parallel; see `podverse/.llm/plans/active/remove-multi-llm-exports/00-EXECUTION-ORDER.md`.
+
+## Phase 1 — Metaboost pipeline removal
+
+| Step | Plan | Outcome |
+| ---- | ---- | ------- |
+| 1.1 | [01-remove-scripts-and-ci.md](./01-remove-scripts-and-ci.md) | No export scripts or CI |
+| 1.2 | [02-remove-exports-tree-and-gitignore.md](./02-remove-exports-tree-and-gitignore.md) | No `.llm/exports/` |
+
+## Phase 2 — Metaboost guidance and docs
+
+| Step | Plan | Outcome |
+| ---- | ---- | ------- |
+| 2.1 | [03-rewrite-cursor-guidance.md](./03-rewrite-cursor-guidance.md) | Cursor-only rules/skills |
+| 2.2 | [04-revise-llm-docs.md](./04-revise-llm-docs.md) | Export docs removed |
+
+**Gate:** `./scripts/nix/with-env npm run lint` passes.
+
+## Phase 3 — Remote cleanup (after merge)
+
+| Step | Plan | Outcome |
+| ---- | ---- | ------- |
+| 3.1 | [06-remote-and-operator-cleanup.md](./06-remote-and-operator-cleanup.md) | GitHub branches/PRs cleaned (both repos) |
+
+See Podverse plan 06 for identical remote steps.
diff --git a/.llm/plans/completed/remove-multi-llm-exports/00-SUMMARY.md b/.llm/plans/completed/remove-multi-llm-exports/00-SUMMARY.md
new file mode 100644
index 00000000..6d6b1f4e
--- /dev/null
+++ b/.llm/plans/completed/remove-multi-llm-exports/00-SUMMARY.md
@@ -0,0 +1,46 @@
+# Remove multi-LLM export system — summary (Metaboost)
+
+Created: 2026-05-23  
+Scope: **Metaboost** (mirrors Podverse export removal).
+
+## Goal
+
+Same as Podverse: retire multi-editor LLM export tooling. **Cursor-only** going forward — `.cursor/` + `.cursorrules` are the sole AI guidance source.
+
+## Coordination with Podverse
+
+Podverse owns the master execution order at:
+
+`podverse/.llm/plans/active/remove-multi-llm-exports/`
+
+This Metaboost directory contains **repo-local plans 01–04** (Metaboost paths). Execute via Podverse plan **05-metaboost-parity.md** or run these plans directly.
+
+Recommended order:
+
+1. Complete Podverse plans 01–04
+2. Complete Metaboost plans 01–04 (this directory)
+3. Run remote cleanup (plan 06 in either repo)
+
+## Plan files (Metaboost)
+
+| File | Focus |
+| ---- | ----- |
+| [01-remove-scripts-and-ci.md](./01-remove-scripts-and-ci.md) | Delete `scripts/llm/`, workflows, npm scripts, pre-commit guard |
+| [02-remove-exports-tree-and-gitignore.md](./02-remove-exports-tree-and-gitignore.md) | Delete `.llm/exports/`, clean gitignore/cursorignore |
+| [03-rewrite-cursor-guidance.md](./03-rewrite-cursor-guidance.md) | Delete export skill/rule; simplify `llm-cursor-source`; update INDEX, AGENTS.md |
+| [04-revise-llm-docs.md](./04-revise-llm-docs.md) | Delete export docs; rewrite `DOCS-DEVELOPMENT-LLM.md` |
+| [06-remote-and-operator-cleanup.md](./06-remote-and-operator-cleanup.md) | GitHub branch/PR cleanup (both repos) |
+
+## Keep
+
+- `.cursor/**`, `.llm/plans/`, `.llm/history/`, `.llm/context/`
+- `i18n-llm-translations` (unrelated)
+- Completed plan archives mentioning exports
+
+## Metaboost-specific
+
+- Update `.cursor/skills/INDEX.md` (remove `llm-exports-scripts`)
+- Update `docs/QUICK-START.md` if it references exports
+- No `complete-feature.yml` in Metaboost
+
+Execute via [00-EXECUTION-ORDER.md](./00-EXECUTION-ORDER.md) and [COPY-PASTA.md](./COPY-PASTA.md).
diff --git a/.llm/plans/completed/remove-multi-llm-exports/01-remove-scripts-and-ci.md b/.llm/plans/completed/remove-multi-llm-exports/01-remove-scripts-and-ci.md
new file mode 100644
index 00000000..896d2bb6
--- /dev/null
+++ b/.llm/plans/completed/remove-multi-llm-exports/01-remove-scripts-and-ci.md
@@ -0,0 +1,52 @@
+# Plan 01 — Remove scripts and CI (Metaboost)
+
+## Objective
+
+Delete the deterministic export pipeline and all CI that publishes `.llm/exports/` mirrors.
+
+## Scope
+
+Metaboost repo root: `/Users/mitcheldowney/repos/pv/metaboost`
+
+## Steps
+
+### 1. Delete `scripts/llm/` entirely
+
+Same 8-file layout as Podverse — remove the whole `scripts/llm/` directory.
+
+### 2. Delete GitHub Actions workflows
+
+Remove:
+
+- `.github/workflows/llm-exports-sync.yml`
+- `.github/workflows/llm-exports-full-sync.yml`
+- `.github/workflows/llm-exports-optional-cloud-llm.yml`
+
+### 3. Remove npm scripts from root `package.json`
+
+Delete: `llm:exports:sync`, `llm:exports:sync:full`, `llm:exports:check`, `llm:exports:restore`, `llm:vendors`.
+
+### 4. Remove pre-commit export guard
+
+In `scripts/git-hooks/pre-commit`, remove the `GUARD_EXPORTS` / `guard-exports-prompt.sh` block.
+
+### 5. Remove `llm` label from PR labeler
+
+In `.github/workflows/pr-labeler.yml`, remove the line adding label `llm` for `.cursor/**` changes.
+
+### 6. Optional: remove `llm` label from `scripts/github/setup-all-labels.sh`
+
+## Verification
+
+```bash
+test ! -d scripts/llm
+test ! -f .github/workflows/llm-exports-sync.yml
+```
+
+## Acceptance checklist
+
+- [ ] `scripts/llm/` gone
+- [ ] Three export workflows gone
+- [ ] Five npm scripts removed
+- [ ] Pre-commit guard removed
+- [ ] PR labeler updated
diff --git a/.llm/plans/completed/remove-multi-llm-exports/02-remove-exports-tree-and-gitignore.md b/.llm/plans/completed/remove-multi-llm-exports/02-remove-exports-tree-and-gitignore.md
new file mode 100644
index 00000000..faa91c6e
--- /dev/null
+++ b/.llm/plans/completed/remove-multi-llm-exports/02-remove-exports-tree-and-gitignore.md
@@ -0,0 +1,43 @@
+# Plan 02 — Remove exports tree and git config (Metaboost)
+
+## Objective
+
+Remove `.llm/exports/` and git/cursor configuration for multi-editor mirrors.
+
+## Scope
+
+Metaboost repo root.
+
+## Steps
+
+### 1. Delete `.llm/exports/` directory
+
+Remove entire tree: `LLM-EXPORTS.md`, `.state/`, `github-copilot/`, `opencode/`.
+
+### 2. Untrack cached paths
+
+```bash
+git rm -r --cached .llm/exports 2>/dev/null || true
+```
+
+### 3. Clean `.gitignore`
+
+Remove export-related blocks (`/.llm/local/vendors.json`, per-target generated paths, export policy comments).
+
+### 4. Clean `.cursorignore`
+
+Remove `.llm/exports/` hide entry.
+
+## Verification
+
+```bash
+test ! -d .llm/exports
+git ls-files .llm/exports
+# Expect empty
+```
+
+## Acceptance checklist
+
+- [ ] `.llm/exports/` deleted
+- [ ] No tracked export files
+- [ ] `.gitignore` and `.cursorignore` cleaned
diff --git a/.llm/plans/completed/remove-multi-llm-exports/03-rewrite-cursor-guidance.md b/.llm/plans/completed/remove-multi-llm-exports/03-rewrite-cursor-guidance.md
new file mode 100644
index 00000000..233a3e92
--- /dev/null
+++ b/.llm/plans/completed/remove-multi-llm-exports/03-rewrite-cursor-guidance.md
@@ -0,0 +1,66 @@
+# Plan 03 — Rewrite Cursor guidance (Metaboost)
+
+## Objective
+
+Remove export-specific rules/skills; simplify to Cursor-only policy.
+
+## Scope
+
+Metaboost `.cursor/`, `AGENTS.md`, `.llm/LLM.md`, `docs/QUICK-START.md`.
+
+## Steps
+
+### 1. Delete export-only artifacts
+
+- `.cursor/skills/llm-exports-scripts/` — delete
+- `.cursor/rules/llm-exports-ci.mdc` — delete
+
+### 2. Rewrite `llm-cursor-source` rule and skill
+
+Same Cursor-only content as Podverse plan 03:
+
+- Source of truth: `.cursor/skills/`, `.cursor/rules/`, `.cursorrules`, `.cursorignore`
+- No `.llm/exports/`, no CI branches, no `LLM_EXPORT_ALLOW_LOCAL`, no non-Cursor editors
+
+Files:
+
+- `.cursor/rules/llm-cursor-source.mdc`
+- `.cursor/skills/llm-cursor-source/SKILL.md`
+
+### 3. Update `.cursor/skills/INDEX.md`
+
+Remove `llm-exports-scripts` from the skills index table/list.
+
+### 4. Update `AGENTS.md`
+
+Remove export/Actions/alignment-prompt paragraphs from LLM section.
+
+### 5. Update `.llm/LLM.md`
+
+Remove "Machine-generated exports" section.
+
+### 6. Update `docs/QUICK-START.md`
+
+Remove references to export pipeline or `.llm/exports/` if present.
+
+### 7. Stale reference sweep
+
+```bash
+rg -l 'llm-exports|export-from-cursor|LLM_EXPORT|LLM-EDITOR-ALIGNMENT|llm:exports|llm-exports-scripts' \
+  --glob '!**/.llm/plans/completed/**' --glob '!**/node_modules/**'
+```
+
+Fix hits outside completed archives.
+
+## Verification
+
+```bash
+./scripts/nix/with-env npm run lint
+```
+
+## Acceptance checklist
+
+- [ ] Export skill/rule deleted
+- [ ] `INDEX.md` updated
+- [ ] `llm-cursor-source` is Cursor-only
+- [ ] `AGENTS.md`, `.llm/LLM.md`, `QUICK-START.md` updated
diff --git a/.llm/plans/completed/remove-multi-llm-exports/04-revise-llm-docs.md b/.llm/plans/completed/remove-multi-llm-exports/04-revise-llm-docs.md
new file mode 100644
index 00000000..a4e7226d
--- /dev/null
+++ b/.llm/plans/completed/remove-multi-llm-exports/04-revise-llm-docs.md
@@ -0,0 +1,43 @@
+# Plan 04 — Revise LLM docs (Metaboost)
+
+## Objective
+
+Remove export docs; replace main LLM policy with Cursor-only guide.
+
+## Scope
+
+`docs/development/llm/` and inbound links.
+
+## Steps
+
+### 1. Delete export-specific docs
+
+- `docs/development/llm/EXPORT-TARGETS.md`
+- `docs/development/llm/GH-EXPORTS-SETUP.md`
+- `docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md`
+- `docs/development/llm/CURSOR-COPILOT-SYNC.md`
+
+### 2. Rewrite `DOCS-DEVELOPMENT-LLM.md`
+
+Same structure as Podverse plan 04: Cursor-only source of truth, commit policy, plans/history, no export pipeline.
+
+### 3. Fix inbound links
+
+Grep `docs/`, `.cursor/`, `AGENTS.md` for links to deleted files; update or remove.
+
+### 4. Keep `LLM-HISTORY-WORKFLOW-ARCHIVE.md`
+
+Retain if useful; strip export references if any.
+
+## Verification
+
+```bash
+rg 'EXPORT-TARGETS|GH-EXPORTS-SETUP|LLM-EDITOR-ALIGNMENT|github-copilot' docs .cursor AGENTS.md \
+  --glob '!**/.llm/plans/completed/**'
+```
+
+## Acceptance checklist
+
+- [ ] Four export docs deleted
+- [ ] `DOCS-DEVELOPMENT-LLM.md` rewritten
+- [ ] No broken inbound links
diff --git a/.llm/plans/completed/remove-multi-llm-exports/06-remote-and-operator-cleanup.md b/.llm/plans/completed/remove-multi-llm-exports/06-remote-and-operator-cleanup.md
new file mode 100644
index 00000000..000148a9
--- /dev/null
+++ b/.llm/plans/completed/remove-multi-llm-exports/06-remote-and-operator-cleanup.md
@@ -0,0 +1,36 @@
+# Plan 06 — Remote and operator cleanup
+
+## Objective
+
+Clean up GitHub state after removal PRs merge to `develop`.
+
+## Scope
+
+**Both** Podverse and Metaboost GitHub repositories. Identical to Podverse plan 06.
+
+## Steps (per repo)
+
+1. Close open PRs from branches `llm` and `llm-full` into `develop`
+2. Delete remote branches `llm` and `llm-full`
+3. Optionally delete GitHub label `llm`
+4. Confirm export workflow Actions no longer appear
+
+```bash
+gh pr list --head llm --state open
+gh pr list --head llm-full --state open
+git push origin --delete llm llm-full
+```
+
+Run for **Podverse** and **Metaboost** remotes.
+
+## Prerequisites
+
+- Metaboost and Podverse plans 01–04 merged to `develop`
+- Export workflow YAML removed from `develop`
+
+## Acceptance checklist
+
+- [ ] No open `llm` / `llm-full` PRs (both repos)
+- [ ] Remote branches deleted (both repos)
+
+See also: `podverse/.llm/plans/active/remove-multi-llm-exports/06-remote-and-operator-cleanup.md`
diff --git a/.llm/plans/completed/remove-multi-llm-exports/COPY-PASTA.md b/.llm/plans/completed/remove-multi-llm-exports/COPY-PASTA.md
new file mode 100644
index 00000000..3aa3c965
--- /dev/null
+++ b/.llm/plans/completed/remove-multi-llm-exports/COPY-PASTA.md
@@ -0,0 +1,72 @@
+# Remove multi-LLM exports — COPY-PASTA prompts (Metaboost)
+
+**Plan set:** `metaboost/.llm/plans/active/remove-multi-llm-exports/`
+
+**Coordination:** Podverse master set at `podverse/.llm/plans/active/remove-multi-llm-exports/`
+
+**Do not implement until ready.** After each step: mark ✅; move completed plans to `.llm/plans/completed/remove-multi-llm-exports/`.
+
+---
+
+## Phase 1 — Pipeline removal
+
+### Step 1.1
+
+```
+Read and execute .llm/plans/active/remove-multi-llm-exports/01-remove-scripts-and-ci.md
+
+Verify:
+test ! -d scripts/llm
+```
+
+### Step 1.2
+
+```
+Read and execute .llm/plans/active/remove-multi-llm-exports/02-remove-exports-tree-and-gitignore.md
+
+Verify:
+test ! -d .llm/exports
+```
+
+---
+
+## Phase 2 — Guidance and docs
+
+### Step 2.1
+
+```
+Read and execute .llm/plans/active/remove-multi-llm-exports/03-rewrite-cursor-guidance.md
+
+Verify:
+./scripts/nix/with-env npm run lint
+```
+
+### Step 2.2
+
+```
+Read and execute .llm/plans/active/remove-multi-llm-exports/04-revise-llm-docs.md
+```
+
+---
+
+## Phase 3 — Remote cleanup (after merge)
+
+### Step 3.1
+
+```
+Read and execute .llm/plans/active/remove-multi-llm-exports/06-remote-and-operator-cleanup.md
+
+Apply to both Podverse and Metaboost GitHub repos.
+```
+
+---
+
+## Completion checklist
+
+- [x] 01-remove-scripts-and-ci.md
+- [x] 02-remove-exports-tree-and-gitignore.md
+- [x] 03-rewrite-cursor-guidance.md
+- [x] 04-revise-llm-docs.md
+- [x] 06-remote-and-operator-cleanup.md (run after merge — see Podverse completed plan 06)
+
+Move directory to `.llm/plans/completed/remove-multi-llm-exports/` when done.
diff --git a/.llm/plans/completed/s-endpoint-signing-rollout/00-EXECUTION-ORDER.md b/.llm/plans/completed/s-endpoint-signing-rollout/00-EXECUTION-ORDER.md
index 34421d5e..b6b07ecd 100644
--- a/.llm/plans/completed/s-endpoint-signing-rollout/00-EXECUTION-ORDER.md
+++ b/.llm/plans/completed/s-endpoint-signing-rollout/00-EXECUTION-ORDER.md
@@ -114,7 +114,7 @@ Exit criteria:
 
 - Cross-repo rollout, smoke testing, rollback, and cutover steps are implementation-ready for Metaboost and registry.
 
-**Status:** Satisfied — [STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md](../../../../docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md) and [STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md](../../../../docs/api/STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md) delivered.
+**Status:** Satisfied — [STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md](/docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md) and [STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md](/docs/api/STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md) delivered.
 
 ## Handoff Notes
 
diff --git a/.llm/plans/completed/s-endpoint-signing-rollout/00-SUMMARY.md b/.llm/plans/completed/s-endpoint-signing-rollout/00-SUMMARY.md
index f21c8142..5add2462 100644
--- a/.llm/plans/completed/s-endpoint-signing-rollout/00-SUMMARY.md
+++ b/.llm/plans/completed/s-endpoint-signing-rollout/00-SUMMARY.md
@@ -60,7 +60,7 @@ flowchart LR
 - Consumer integration docs/examples (`08`, `09`) depend on stable helper APIs from `03` and `04`.
 - Gate **10** is complete (published `metaboost-signing` on npm; minimum semver **0.2.1** recorded in [COPY-PASTA.md](./COPY-PASTA.md) Phase 5; plan file [`10-npm-publish-verification-gate.md`](./10-npm-publish-verification-gate.md)).
 - Podverse (**12**) is complete: signed mbrss-v1 ingest via Podverse API mint + web client (see completed plan **12**).
-- Rollout validation (`11`) is complete: [STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md](../../../../docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md) and [STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md](../../../../docs/api/STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md). Podverse integration work was scoped in **12**, not **11**.
+- Rollout validation (`11`) is complete: [STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md](/docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md) and [STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md](/docs/api/STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md). Podverse integration work was scoped in **12**, not **11**.
 
 ## Key Decisions Captured
 
diff --git a/.llm/plans/completed/s-endpoint-signing-rollout/10-npm-publish-verification-gate.md b/.llm/plans/completed/s-endpoint-signing-rollout/10-npm-publish-verification-gate.md
index 992288c1..4843adce 100644
--- a/.llm/plans/completed/s-endpoint-signing-rollout/10-npm-publish-verification-gate.md
+++ b/.llm/plans/completed/s-endpoint-signing-rollout/10-npm-publish-verification-gate.md
@@ -27,7 +27,7 @@ defines the publish workflow; this gate proves the artifact exists for consumers
    ```
 
 2. Confirm the **latest** (or chosen) version matches a **git tag** per
-   [METABOOST-SIGNING-DISTRIBUTION.md](../../../../docs/api/METABOOST-SIGNING-DISTRIBUTION.md)
+   [METABOOST-SIGNING-DISTRIBUTION.md](/docs/api/METABOOST-SIGNING-DISTRIBUTION.md)
    (`metaboost-signing-vX.Y.Z` on the Metaboost default branch).
 
 3. Optional smoke install:
diff --git a/.llm/plans/completed/s-endpoint-signing-rollout/11-cross-repo-rollout-validation.md b/.llm/plans/completed/s-endpoint-signing-rollout/11-cross-repo-rollout-validation.md
index 7d46bfc9..62c3e2fb 100644
--- a/.llm/plans/completed/s-endpoint-signing-rollout/11-cross-repo-rollout-validation.md
+++ b/.llm/plans/completed/s-endpoint-signing-rollout/11-cross-repo-rollout-validation.md
@@ -1,6 +1,6 @@
 # 11 - Cross-Repo Rollout Validation
 
-> **Status:** **Completed.** Deliverables: [STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md](../../../../docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md), [STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md](../../../../docs/api/STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md). Completion recorded in [COPY-PASTA.md](./COPY-PASTA.md) Phase 7.
+> **Status:** **Completed.** Deliverables: [STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md](/docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md), [STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md](/docs/api/STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md). Completion recorded in [COPY-PASTA.md](./COPY-PASTA.md) Phase 7.
 
 ## Scope
 
@@ -65,9 +65,9 @@ Define final integration validation, rollout sequencing, compatibility checks, a
 
 ## Suggested Files
 
-- [`docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md`](../../../../docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md)
-- [`docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md`](../../../../docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md) (cross-links updated to runbook + report template)
-- [`packages/`](../../../../packages/)
+- [`docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md`](/docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md)
+- [`docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md`](/docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md) (cross-links updated to runbook + report template)
+- [`packages/`](/packages)
 
 ## Verification
 
diff --git a/.llm/plans/completed/s-endpoint-signing-rollout/12-podverse-standard-endpoint-signing-integration.md b/.llm/plans/completed/s-endpoint-signing-rollout/12-podverse-standard-endpoint-signing-integration.md
index 498d0b60..8acf9c39 100644
--- a/.llm/plans/completed/s-endpoint-signing-rollout/12-podverse-standard-endpoint-signing-integration.md
+++ b/.llm/plans/completed/s-endpoint-signing-rollout/12-podverse-standard-endpoint-signing-integration.md
@@ -6,7 +6,7 @@
 
 Integrate **signed `POST`** requests to Metaboost **`/v1/standard/*`** mbrss-v1 routes from the **Podverse**
 monorepo, using the published **`metaboost-signing`** npm package and the same AppAssertion
-contract as [STANDARD-ENDPOINT-APP-SIGNING.md](../../../../docs/api/STANDARD-ENDPOINT-APP-SIGNING.md).
+contract as [STANDARD-ENDPOINT-APP-SIGNING.md](/docs/api/STANDARD-ENDPOINT-APP-SIGNING.md).
 
 ## Hard dependency
 
@@ -17,7 +17,7 @@ contract as [STANDARD-ENDPOINT-APP-SIGNING.md](../../../../docs/api/STANDARD-END
 
 - **Private signing keys** stay on a **trusted server** only. The browser may perform the **final**
   `POST` to Metaboost with `Authorization: AppAssertion <jwt>`, but the JWT must be **minted** where
-  the PEM lives (see [STANDARD-ENDPOINT-APP-SIGNING.md](../../../../docs/api/STANDARD-ENDPOINT-APP-SIGNING.md) “Signing placement”).
+  the PEM lives (see [STANDARD-ENDPOINT-APP-SIGNING.md](/docs/api/STANDARD-ENDPOINT-APP-SIGNING.md) “Signing placement”).
 - Request body bytes used for claim **`bh`** must be **identical** to the bytes sent in the `POST`
   (hash the exact JSON serialized for the wire).
 
@@ -53,7 +53,7 @@ contract as [STANDARD-ENDPOINT-APP-SIGNING.md](../../../../docs/api/STANDARD-END
 - [`podverse/packages/v4v-metaboost/`](https://github.com/podverse/podverse/tree/develop/packages/v4v-metaboost) — URL normalization / `metaBoostStandard` if paths still assume `/v1/s/`.
 - **New or existing server route** under [`podverse/apps/api/`](https://github.com/podverse/podverse/tree/develop/apps/api) — **mint** AppAssertion for a given body + path.
 
-Cross-reference implementation details with [STANDARD-ENDPOINT-INTEGRATION-GUIDE.md](../../../../docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md).
+Cross-reference implementation details with [STANDARD-ENDPOINT-INTEGRATION-GUIDE.md](/docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md).
 
 ## Verification
 
diff --git a/.llm/plans/completed/tiered-import-specifiers-node-vs-next/00-EXECUTION-ORDER.md b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..a96534f8
--- /dev/null
+++ b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/00-EXECUTION-ORDER.md
@@ -0,0 +1,14 @@
+# Tiered import specifiers — execution order
+
+Read `00-SUMMARY.md` first.
+
+1. `01-tier-boundaries-and-scope.md`
+2. `02-verification-spike.md`
+3. `03-eslint-enforcement.md`
+4. `04-monorepo-sweep-matrix.md`
+5. `05-documentation-skills-rules.md`
+6. `06-future-convergence-todo.md`
+
+Use `COPY-PASTA.md` for checkbox prompts.
+
+Per [plan-execution-completion-tracking](/.cursor/rules/plan-execution-completion-tracking.mdc): update COPY-PASTA as steps complete; move this folder from `.llm/plans/active/` to `.llm/plans/completed/tiered-import-specifiers-node-vs-next/` when finished.
diff --git a/.llm/plans/completed/tiered-import-specifiers-node-vs-next/00-SUMMARY.md b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/00-SUMMARY.md
new file mode 100644
index 00000000..ec103a61
--- /dev/null
+++ b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/00-SUMMARY.md
@@ -0,0 +1,35 @@
+# Tiered import specifiers — summary
+
+## Problem
+
+TypeScript with **`moduleResolution: NodeNext`** expects **relative import specifiers** to use a **`.js` extension** when they refer to emitted JS next to sources. That matches **`tsc` output** and Node’s ESM loader for **packages** and **Node apps**.
+
+**Next.js** (`next build` with **Turbopack**) often **does not** resolve `./Foo.js` to `Foo.tsx` on disk (parity gap vs webpack’s `resolve.extensionAlias`). See [vercel/next.js#82945](https://github.com/vercel/next.js/issues/82945).
+
+## Strategy (two tiers)
+
+| Tier | Scope | Relative imports |
+| ---- | ----- | ---------------- |
+| **A** | `packages/*`, `apps/api`, `apps/management-api`, `apps/*/sidecar`, `tools/**` | Prefer **`.js` specifiers** (NodeNext); enforce via ESLint where configured. |
+| **B** | `apps/web/src/**`, `apps/management-web/src/**`; Playwright `e2e/**` under those apps | **Extension-flexible** (prefer **extensionless** until Turbopack supports `.js`→`.tsx`); ESLint **does not** require `.js` here. |
+
+```mermaid
+flowchart TB
+  tierA[TierA packages api sidecars tools]
+  tierB[TierB Next app src and colocated e2e]
+  nodenext[NodeNext tsc emit uses dot js]
+  turbopack[Turbopack resolves TS sources]
+  tierA --> nodenext
+  tierB --> turbopack
+```
+
+## Outcomes
+
+1. **Documented** split ([`docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md`](/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md)).
+2. **ESLint** enforces Tier A; Tier B overridden off for import extensions.
+3. **Sweep** Tier A (`04-monorepo-sweep-matrix.md`).
+4. **Future:** converge Tier B when upstream fixes land (`06-future-convergence-todo.md`).
+
+## Repo
+
+Metaboost monorepo (`@metaboost/*`). Podverse has the same plan under `.llm/plans/active/tiered-import-specifiers-node-vs-next/` with `@podverse/*` paths.
diff --git a/.llm/plans/completed/tiered-import-specifiers-node-vs-next/01-tier-boundaries-and-scope.md b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/01-tier-boundaries-and-scope.md
new file mode 100644
index 00000000..98dd44ec
--- /dev/null
+++ b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/01-tier-boundaries-and-scope.md
@@ -0,0 +1,41 @@
+# Tier boundaries and scope (Metaboost)
+
+## Tier A — NodeNext `.js` specifiers (enforce)
+
+| Path pattern | Notes |
+| ------------ | ----- |
+| `packages/**/*.ts`, `packages/**/*.tsx` **except** `packages/ui/**` | Workspace packages (`packages/ui` is **Tier C**) |
+| `apps/api/**/*.ts`, `apps/api/**/*.tsx` | Main API |
+| `apps/management-api/**/*.ts`, `apps/management-api/**/*.tsx` | Management API |
+| `apps/web/sidecar/**/*.ts`, `apps/web/sidecar/**/*.tsx` | Web sidecar |
+| `apps/management-web/sidecar/**/*.ts`, `apps/management-web/sidecar/**/*.tsx` | Management sidecar |
+| `tools/**/*.ts`, `tools/**/*.tsx` | e.g. `tools/generate-data` |
+
+## Tier B — Next.js app bundles
+
+| Path pattern | Notes |
+| ------------ | ----- |
+| `apps/web/src/**` | Next web |
+| `apps/management-web/src/**` | Next management-web |
+| `apps/web/e2e/**` | Playwright |
+| `apps/management-web/e2e/**` | Playwright |
+
+## Tier C — `packages/ui` (extensionless relatives; ESLint rule off)
+
+| Path pattern | Notes |
+| ------------ | ----- |
+| `packages/ui/**` | Shared UI transpiled by Next consumers; **no** `.js` suffix on relatives |
+
+## Tier A package workspaces
+
+`packages/helpers`, `packages/helpers-currency`, `packages/helpers-backend-api`,
+`packages/helpers-i18n`, `packages/helpers-requests`, `packages/helpers-valkey`,
+`packages/metaboost-signing`, `packages/rss-parser`, `packages/orm`,
+`packages/management-orm`.
+
+**Tier C package:** `packages/ui`.
+
+Tier A apps: `apps/api`, `apps/management-api`, sidecars under `apps/web/sidecar`,
+`apps/management-web/sidecar`.
+
+Tier B: `apps/web` and `apps/management-web` **src** (and e2e) only.
diff --git a/.llm/plans/completed/tiered-import-specifiers-node-vs-next/02-verification-spike.md b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/02-verification-spike.md
new file mode 100644
index 00000000..c25980df
--- /dev/null
+++ b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/02-verification-spike.md
@@ -0,0 +1,12 @@
+# Verification spike (optional)
+
+Same as Podverse: confirm Turbopack **production build** when importing `./Module.js` with only `Module.tsx` on disk.
+
+Steps: see Podverse twin file; use Metaboost workspace commands:
+
+```bash
+./scripts/nix/with-env npm run build -w @metaboost/web
+./scripts/nix/with-env npm run build -w @metaboost/management-web
+```
+
+Reference: [vercel/next.js#82945](https://github.com/vercel/next.js/issues/82945).
diff --git a/.llm/plans/completed/tiered-import-specifiers-node-vs-next/03-eslint-enforcement.md b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/03-eslint-enforcement.md
new file mode 100644
index 00000000..41e42a7a
--- /dev/null
+++ b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/03-eslint-enforcement.md
@@ -0,0 +1,33 @@
+# ESLint enforcement (Metaboost)
+
+## Approach: local rule (not `import-x/extensions`)
+
+`eslint-plugin-import-x`’s `import-x/extensions` resolves TypeScript on disk and conflicts with **NodeNext** (specifiers use `.js` while files are `.ts`). This repo instead uses a **local ESLint rule** (kept in sync with Podverse):
+
+- **File:** [eslint-rules/require-relative-js-extension.mjs](/eslint-rules/require-relative-js-extension.mjs)
+- **Plugin id:** `nodeNextRelativeImports`
+- **Rule id:** `require-relative-js-extension`
+
+The rule uses the filesystem to distinguish **sibling** modules (`.js` after `.ts`) from **directory barrels** (`/index.js`).
+
+## Wiring
+
+Root [eslint.config.mjs](/eslint.config.mjs):
+
+- **Tier A (error):** `packages/**/*.{ts,tsx}`, `apps/api/**`, `apps/management-api/**`, `apps/web/sidecar/**`, `apps/management-web/sidecar/**`, `tools/**/*.{ts,tsx}`, `scripts/**/*.{ts,mts}`
+- **Tier C (off):** `packages/ui/**/*.{ts,tsx}` — extensionless relatives (bundler-transpiled shared UI)
+- **Tier B (off):** `apps/web/src/**`, `apps/management-web/src/**`, `apps/web/e2e/**`, `apps/management-web/e2e/**`
+
+## Tier C wiring note
+
+The **`packages/ui`** override must register **only** `rules` (rule **off**). Do not repeat `plugins.nodeNextRelativeImports` in that block — Tier A already attaches the plugin to `packages/**/*`, and duplicating the plugin object causes ESLint **“Cannot redefine plugin”**.
+
+## Interaction with **`perfectionist/sort-imports`**
+
+Keep sort order and this rule compatible—run `npm run lint:fix`. Tier C and Tier B override blocks must follow Tier A in flat config.
+
+## Verification
+
+```bash
+./scripts/nix/with-env npm run lint
+```
diff --git a/.llm/plans/completed/tiered-import-specifiers-node-vs-next/04-monorepo-sweep-matrix.md b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/04-monorepo-sweep-matrix.md
new file mode 100644
index 00000000..34a6847a
--- /dev/null
+++ b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/04-monorepo-sweep-matrix.md
@@ -0,0 +1,55 @@
+# Monorepo sweep matrix (Metaboost)
+
+## Rollout status (implementation)
+
+- **Tier A:** Root ESLint local rule `nodeNextRelativeImports/require-relative-js-extension` is **on**; packages (except `packages/ui`) and Node-side apps were swept with targeted `eslint --fix` where needed. Verify with `./scripts/nix/with-env npx eslint` over Tier A globs from repo root if needed.
+- **Tier C (`packages/ui`):** Extensionless relatives only; rule **off**. Do not sweep to `.js` — breaks Next bundling of `.tsx` sources.
+- **Tier B:** **No** `.js` specifier sweep — Next `src` and colocated `e2e` stay extension-flexible per Turbopack constraints ([vercel/next.js#82945](https://github.com/vercel/next.js/issues/82945)).
+
+
+## Tier A — packages
+
+| Workspace | Tier | Sweep | Lint | Notes |
+| --------- | ---- | ----- | ---- | ----- |
+| `packages/helpers` | A | | | |
+| `packages/helpers-currency` | A | | | |
+| `packages/helpers-backend-api` | A | | | |
+| `packages/helpers-i18n` | A | | | |
+| `packages/helpers-requests` | A | | | |
+| `packages/helpers-valkey` | A | | | |
+| `packages/metaboost-signing` | A | | | |
+| `packages/rss-parser` | A | | | |
+| `packages/orm` | A | | | |
+| `packages/management-orm` | A | | | |
+
+## Tier C — shared UI package
+
+| Workspace / path | Tier | Sweep | Lint | Notes |
+| ---------------- | ---- | ----- | ---- | ----- |
+| `packages/ui` | C | | | Extensionless relatives; Next `transpilePackages`; same style as Tier B |
+
+## Tier A — apps
+
+| Workspace | Tier | Sweep | Lint | Notes |
+| --------- | ---- | ----- | ---- | ----- |
+| `apps/api` | A | | | |
+| `apps/management-api` | A | | | |
+| `apps/web/sidecar` | A | | | |
+| `apps/management-web/sidecar` | A | | | |
+| `tools/generate-data` | A | | | |
+
+## Tier B
+
+| Path | Tier | Notes |
+| ---- | ---- | ----- |
+| `apps/web/src` | B | Extension-flexible |
+| `apps/web/e2e` | B | |
+| `apps/management-web/src` | B | |
+| `apps/management-web/e2e` | B | |
+
+## Verification
+
+```bash
+./scripts/nix/with-env npm run build -w @metaboost/web
+./scripts/nix/with-env npm run build -w @metaboost/management-web
+```
diff --git a/.llm/plans/completed/tiered-import-specifiers-node-vs-next/05-documentation-skills-rules.md b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/05-documentation-skills-rules.md
new file mode 100644
index 00000000..d7a43fc3
--- /dev/null
+++ b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/05-documentation-skills-rules.md
@@ -0,0 +1,23 @@
+# Documentation, skills, rules (Metaboost)
+
+## Canonical doc
+
+[`docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md`](/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md)
+
+## AGENTS.md
+
+Add bullet linking the tooling doc.
+
+## Cursor rule
+
+[`.cursor/rules/import-specifiers-tiered.mdc`](/.cursor/rules/import-specifiers-tiered.mdc) — globs for Next `src` and `packages/ui` (Tier C).
+
+## Skill
+
+[`.cursor/skills/import-specifiers-tiered/SKILL.md`](/.cursor/skills/import-specifiers-tiered/SKILL.md)
+
+## Skills index
+
+Update [`.cursor/skills/INDEX.md`](/.cursor/skills/INDEX.md) with `import-specifiers-tiered` row.
+
+Do not recreate `.llm/exports/` (prohibited per DOCS-DEVELOPMENT-LLM).
diff --git a/.llm/plans/completed/tiered-import-specifiers-node-vs-next/06-future-convergence-todo.md b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/06-future-convergence-todo.md
new file mode 100644
index 00000000..2e4966db
--- /dev/null
+++ b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/06-future-convergence-todo.md
@@ -0,0 +1,3 @@
+# Future convergence — Tier B → `.js` (living checklist)
+
+Same procedure as Podverse: watch [vercel/next.js#82945](https://github.com/vercel/next.js/issues/82945); when native extension alias exists in a Next release you adopt, re-spike Metaboost web builds, then unify ESLint tiers and update [`docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md`](/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md).
diff --git a/.llm/plans/completed/tiered-import-specifiers-node-vs-next/COPY-PASTA.md b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/COPY-PASTA.md
new file mode 100644
index 00000000..a7a7974c
--- /dev/null
+++ b/.llm/plans/completed/tiered-import-specifiers-node-vs-next/COPY-PASTA.md
@@ -0,0 +1,10 @@
+# Tiered import specifiers — copy-pasta (Metaboost)
+
+- [x] Read `00-SUMMARY.md`.
+- [x] Confirm `01-tier-boundaries-and-scope.md` (@metaboost paths).
+- [x] Optional: `02-verification-spike.md`.
+- [x] Implement `03-eslint-enforcement.md`; `./scripts/nix/with-env npm run lint`.
+- [x] Sweep `04-monorepo-sweep-matrix.md`.
+- [x] Land doc + rule + skill + AGENTS per `05-documentation-skills-rules.md`.
+- [x] Track `06-future-convergence-todo.md`.
+- [x] Move plan folder to `.llm/plans/completed/` when complete.
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md
new file mode 100644
index 00000000..32761e99
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/00-EXECUTION-ORDER.md
@@ -0,0 +1,30 @@
+# Execution order — Vendor-Agnostic Billing Foundation (Metaboost)
+
+**Status: all phases completed** (see numbered files in this directory).
+
+## Phase order (completed)
+
+1. [02-pricing-catalog-and-schema.md](./02-pricing-catalog-and-schema.md) (completed)
+2. [04-membership-settings-bootstrap.md](./04-membership-settings-bootstrap.md) (completed)
+3. [03-services-api-and-orchestration.md](./03-services-api-and-orchestration.md) (completed)
+4. [06-public-api-billing-read-models.md](./06-public-api-billing-read-models.md) (completed)
+5. [05-management-pricing-governance.md](./05-management-pricing-governance.md) (completed)
+6. [07-tests-and-rollout-verification.md](./07-tests-and-rollout-verification.md) (completed)
+
+## Also
+
+- Summary: [00-SUMMARY.md](./00-SUMMARY.md)
+- Domain period policy: [01-domain-and-period-policy.md](./01-domain-and-period-policy.md)
+- Rollout gates: [ROLLOUT-CHECKLIST.md](./ROLLOUT-CHECKLIST.md)
+
+## Why this order
+
+- Completed: domain period policy — see [01-domain-and-period-policy.md](./01-domain-and-period-policy.md).
+- Completed: pricing catalog and schema — see [02-pricing-catalog-and-schema.md](./02-pricing-catalog-and-schema.md).
+- Completed: membership settings bootstrap — see [04-membership-settings-bootstrap.md](./04-membership-settings-bootstrap.md).
+- Completed: services, API, and orchestration — see [03-services-api-and-orchestration.md](./03-services-api-and-orchestration.md).
+- Completed: public API billing read models — see [06-public-api-billing-read-models.md](./06-public-api-billing-read-models.md).
+- Service and orchestration logic follows once policy and schema contracts are stable.
+- Public read-model contracts are defined before management UI so client payloads are stable.
+- Management pricing governance and billing-adjacent UI work comes after API contracts.
+- Verification and rollout checks run last as a gated completion phase.
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/00-SUMMARY.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/00-SUMMARY.md
new file mode 100644
index 00000000..4ffc2617
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/00-SUMMARY.md
@@ -0,0 +1,45 @@
+# Summary — Vendor-Agnostic Billing Foundation (Metaboost)
+
+## Objective
+
+Create a future-focused billing foundation for Metaboost that standardizes month-safe renewal
+math, moves pricing source-of-truth to DB, and adds non-vendor-specific renewal and extension
+workflows.
+
+## Scope of this plan set
+
+- Premium membership is the first purchasable product.
+- Schema and services must support additional purchasable products without redesign.
+- Monthly renewal uses calendar-month clamp semantics.
+- Auto-renew attempts are due in the near-expiry window (within 24 hours).
+- Billing-adjacent management UI is included only where required for pricing governance.
+- Documentation and naming remain future-focused and product-neutral.
+
+## Explicit non-goals
+
+- Feed status replacement and feed lifecycle migrations.
+- Parser, archiver, and RSS policy migrations.
+- Unrelated object storage and worker-secret work.
+- Broad management-web refactors outside billing/pricing pages.
+
+## Planned outputs
+
+- Centralized period policy module for month/year extension behavior.
+- Billing product + pricing tables with audit-friendly history.
+- Membership settings storage with idempotent env bootstrap behavior.
+- Billing domain event log and renewal retry/backoff metadata contracts.
+- Vendor-agnostic billing domain service contracts and extension APIs.
+- Near-expiry renewal orchestrator with idempotent attempt handling.
+- Public and authenticated API billing read models usable by web and future app clients.
+- Management pricing governance API and billing-focused management-web flows.
+- Integration and E2E verification gates for all billing contracts.
+
+## Plan files
+
+1. [01-domain-and-period-policy.md](./01-domain-and-period-policy.md) (completed)
+2. [02-pricing-catalog-and-schema.md](./02-pricing-catalog-and-schema.md) (completed)
+3. [04-membership-settings-bootstrap.md](./04-membership-settings-bootstrap.md) (completed)
+4. [03-services-api-and-orchestration.md](./03-services-api-and-orchestration.md) (completed)
+5. [06-public-api-billing-read-models.md](./06-public-api-billing-read-models.md) (completed)
+6. [05-management-pricing-governance.md](./05-management-pricing-governance.md) (completed)
+7. [07-tests-and-rollout-verification.md](./07-tests-and-rollout-verification.md) (completed)
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/01-domain-and-period-policy.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/01-domain-and-period-policy.md
new file mode 100644
index 00000000..0f0928af
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/01-domain-and-period-policy.md
@@ -0,0 +1,30 @@
+# 01 — Domain and Period Policy (Metaboost)
+
+## Scope
+
+- Define vendor-agnostic billing domain language for purchasable products.
+- Centralize membership extension math with calendar-clamp monthly behavior.
+
+## Steps
+
+1. Add shared domain types for `BillingCadence`, `BillingProductCode`, and extension reasons.
+2. Create or refine a pure period policy helper for:
+   - extend from current expiry when still active
+   - extend from now when expired or unset
+   - monthly calendar clamp at month end
+   - annual extension behavior aligned to the same policy surface
+3. Route all membership expiry mutation paths through this policy helper.
+4. Add deterministic unit tests for month-end and leap-year boundaries.
+
+## Key files to touch later
+
+- `packages/helpers/src/time/addMonths.ts`
+- `packages/orm/src/lib/defaultMembershipExpiresAt.ts`
+- `packages/orm/src/services/UserService.ts`
+- `apps/management-web/src/lib/createUserFormDefaults.ts`
+
+## Verification
+
+- Unit tests prove Jan/Mar/Feb boundary behavior.
+- All extension paths call one period policy helper.
+- No service computes membership expiry using ad-hoc month arithmetic.
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/02-pricing-catalog-and-schema.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/02-pricing-catalog-and-schema.md
new file mode 100644
index 00000000..6542ea76
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/02-pricing-catalog-and-schema.md
@@ -0,0 +1,36 @@
+# 02 — Pricing Catalog and Schema (Metaboost)
+
+## Scope
+
+- Make DB the source of truth for pricing and cadence-linked product offers.
+- Keep env pricing values as bootstrap defaults and safety fallback only.
+
+## Steps
+
+1. Add product and price schema primitives, including effective-window support:
+   - `billing_product`
+   - `billing_price`
+   - optional `billing_price_change_audit`
+2. Extend trust or adjacent billing profile storage with renewal-operational metadata:
+   - cadence, auto-renew mode, next/last renewal attempt, last status
+   - idempotency key material for extension and renewal attempts
+3. Seed DB defaults for premium membership:
+   - monthly: 3.00 USD
+   - annual: 30.00 USD
+4. Add migration-safe bootstrap logic that can initialize pricing from env defaults only when DB
+   values are missing.
+5. Add permission model requirements for management price updates.
+
+## Key files to touch later
+
+- `infra/k8s/base/ops/source/database/linear-migrations/app/`
+- `packages/orm/src/entities/`
+- `packages/orm/src/services/`
+- `apps/management-api/src/controllers/`
+- `apps/management-api/src/schemas/`
+
+## Verification
+
+- Migration creates catalog and pricing tables with required constraints.
+- Seeded pricing rows are queryable and active.
+- Runtime pricing reads resolve DB values first and only fallback when expected.
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/03-services-api-and-orchestration.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/03-services-api-and-orchestration.md
new file mode 100644
index 00000000..46845689
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/03-services-api-and-orchestration.md
@@ -0,0 +1,39 @@
+# 03 — Services, API, and Orchestration (Metaboost)
+
+## Scope
+
+- Build provider-agnostic billing workflows for extension and auto-renew orchestration.
+- Add management governance for pricing updates with auditability.
+
+## Steps
+
+1. Implement normalized billing domain events and handlers:
+   - payment settled
+   - renewal succeeded/failed
+   - pay-on-demand extension requested
+2. Add idempotent extension service that always delegates expiry math to the period policy helper.
+3. Add management API endpoints for pricing operations:
+   - list active prices
+   - create/schedule price changes
+   - activate/deprecate prices
+4. Add near-expiry renewal scheduler/cron behavior:
+   - scan due accounts within 24h
+   - emit renewal attempts through provider-agnostic adapter boundary
+   - persist attempt outcomes and retry strategy metadata
+5. Expose client-safe billing and pricing read models for web and future React Native.
+6. Add integration and E2E coverage for renewal visibility and admin pricing governance.
+
+## Key files to touch later
+
+- `apps/api/src/controllers/`
+- `apps/api/src/routes/`
+- `apps/management-api/src/controllers/`
+- `apps/management-api/src/routes/`
+- `apps/management-web/src/`
+- scheduler location in app runtime or K8s cron manifests
+
+## Verification
+
+- Renewal attempts only trigger inside due window with idempotency checks.
+- Pricing changes are permission-guarded and audited.
+- API read models expose consistent tier, expiry, cadence, auto-renew, and price fields.
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/04-membership-settings-bootstrap.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/04-membership-settings-bootstrap.md
new file mode 100644
index 00000000..3bdba428
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/04-membership-settings-bootstrap.md
@@ -0,0 +1,36 @@
+# 04 — Membership Settings Bootstrap (Metaboost)
+
+## Scope
+
+- Define canonical membership product settings storage for trial and product defaults.
+- Make DB-backed settings resolution deterministic with safe env bootstrap.
+
+## Steps
+
+1. Add a dedicated membership settings table for canonical defaults.
+   - prefer one-row keyed settings for current premium membership product
+   - include free-trial expiration in seconds
+   - include timestamps and update trigger patterns consistent with repo conventions
+2. Add ORM entity/service wiring for settings resolution.
+3. Implement startup-safe seeding logic:
+   - read env defaults
+   - insert/update only when DB values are missing
+   - avoid overwriting intentional DB-managed values
+4. Wire settings resolution into price/product catalog resolution service.
+5. Align env template and validation references to settings bootstrap behavior.
+
+## Key files to touch later
+
+- `infra/k8s/base/ops/source/database/linear-migrations/app/`
+- `packages/orm/src/entities/`
+- `packages/orm/src/services/`
+- `packages/helpers/src/membership/`
+- `apps/api/src/lib/startup/validation.ts`
+- `apps/management-api/src/lib/startup/validation.ts`
+
+## Verification
+
+- Settings table exists with expected constraints.
+- Bootstrap is idempotent across repeated startups.
+- Runtime reads resolve DB values first and use env only as bootstrap source.
+- No endpoint returns unresolved or partially merged settings payloads.
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/05-management-pricing-governance.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/05-management-pricing-governance.md
new file mode 100644
index 00000000..d7ade27c
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/05-management-pricing-governance.md
@@ -0,0 +1,38 @@
+# 05 — Management Pricing Governance (Metaboost)
+
+## Scope
+
+- Add billing-focused management API and management-web governance for pricing operations.
+- Keep UI scope limited to pricing and membership-product surfaces.
+
+## Steps
+
+1. Extend management permission model for pricing governance operations.
+   - add required CRUD permission dimensions in management schema/migrations
+   - wire authz checks for list/create/schedule/activate/deprecate operations
+2. Add management API routes/controllers/schemas for pricing lifecycle.
+   - list active and scheduled prices
+   - create/schedule effective-window changes
+   - deprecate or supersede pricing rows with audit trail entries
+3. Add billing-focused management-web pages or sections:
+   - product membership defaults visibility
+   - pricing history and upcoming effective changes
+   - mutation flows with clear validation messaging
+4. Update i18n keys only for billing-adjacent UI introduced in this phase.
+5. Add E2E coverage for management pricing governance workflows.
+
+## Key files to touch later
+
+- `apps/management-api/src/lib/database/tablePolicy.ts`
+- `apps/management-api/src/lib/authz/`
+- `apps/management-api/src/routes/`
+- `apps/management-api/src/schemas/`
+- `apps/management-web/src/app/(management)/products/`
+- `apps/management-web/e2e/`
+
+## Verification
+
+- Pricing governance endpoints are permission-guarded and auditable.
+- Management-web can list and update pricing without touching unrelated UI domains.
+- E2E confirms core create/read/update/deprecate pricing behavior.
+- No feed/parser/lifecycle UI or route changes are introduced in this phase.
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/06-public-api-billing-read-models.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/06-public-api-billing-read-models.md
new file mode 100644
index 00000000..9062dc4f
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/06-public-api-billing-read-models.md
@@ -0,0 +1,36 @@
+# 06 — Public API Billing Read Models (Metaboost)
+
+## Scope
+
+- Define stable billing read-model endpoints for public and authenticated use cases.
+- Provide client-safe payloads for web and future app clients.
+
+## Steps
+
+1. Add product membership read routes under the product namespace.
+   - resolved membership/product defaults payload
+   - pricing payload behavior for signup-gated scenarios
+2. Add authenticated billing read-model endpoint.
+   - tier, expiry, cadence, auto-renew mode, renewal attempt summary
+   - resolved monthly/annual pricing and currency information
+3. Define strict response contracts and field names.
+   - avoid ambiguous naming
+   - ensure nullable fields are intentional and documented
+4. Ensure read model controllers are DB-first with deterministic fallback behavior.
+5. Add integration tests for route contracts and access controls.
+
+## Key files to touch later
+
+- `apps/api/src/routes/`
+- `apps/api/src/controllers/`
+- `apps/api/src/schemas/`
+- `apps/api/src/test/`
+- `packages/helpers-requests/src/`
+- `packages/helpers/src/`
+
+## Verification
+
+- Endpoint responses stay stable for authenticated and unauthenticated flows.
+- Billing read-model includes tier, expiry, cadence, auto-renew, and renewal metadata.
+- Contract tests lock required fields and expected nullability.
+- API payloads contain only client-safe data.
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/07-tests-and-rollout-verification.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/07-tests-and-rollout-verification.md
new file mode 100644
index 00000000..248d7fd3
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/07-tests-and-rollout-verification.md
@@ -0,0 +1,40 @@
+# 07 — Tests and Rollout Verification (Metaboost)
+
+## Scope
+
+- Consolidate acceptance gates across schema, services, API, and management UI.
+- Prevent rollout with partial billing contracts or cross-domain drift.
+
+## Steps
+
+1. Add/update integration tests for billing service behavior.
+   - idempotent extension calls
+   - renewal due-window selection
+   - retry/backoff behavior and event logging expectations
+2. Add/update API integration tests for:
+   - product membership resolved payloads
+   - billing read-model access control and response contracts
+   - management pricing governance authorization boundaries
+3. Add/update E2E tests for management pricing and membership-product pages.
+4. Add rollout checklist to ensure:
+   - migration ordering safety
+   - bootstrap idempotency
+   - permissions and role mapping are validated
+5. Confirm non-goal boundaries:
+   - no feed/parser/lifecycle/object-storage work included
+   - no broad unrelated management-web refactors included
+
+## Key files to touch later
+
+- `apps/api/src/test/`
+- `apps/management-api/src/test/`
+- `apps/management-web/e2e/`
+- `infra/k8s/base/ops/source/database/linear-migrations/`
+- `.llm/plans/active/vendor-agnostic-billing-foundation/`
+
+## Verification
+
+- All acceptance tests pass for billing scope.
+- Permissions and audit behavior are covered by tests.
+- Rollout checklist is complete and references each implemented phase.
+- Phase cannot be marked complete if any earlier phase contract is missing.
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/COPY-PASTA.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/COPY-PASTA.md
new file mode 100644
index 00000000..260d7be7
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/COPY-PASTA.md
@@ -0,0 +1,20 @@
+# COPY-PASTA prompts — Vendor-Agnostic Billing Foundation (Metaboost)
+
+**Plan set complete.** All numbered prompts have been executed; artifacts live under
+`.llm/plans/completed/vendor-agnostic-billing-foundation/`.
+
+## Rollout
+
+Before production rollout, use:
+
+- `.llm/plans/completed/vendor-agnostic-billing-foundation/ROLLOUT-CHECKLIST.md`
+
+## Completed prompts (archive paths)
+
+- `01-domain-and-period-policy.md` → `completed/…`
+- `02-pricing-catalog-and-schema.md` → `completed/…`
+- `04-membership-settings-bootstrap.md` → `completed/…`
+- `03-services-api-and-orchestration.md` → `completed/…`
+- `06-public-api-billing-read-models.md` → `completed/…`
+- `05-management-pricing-governance.md` → `completed/…`
+- `07-tests-and-rollout-verification.md` → `completed/…`
diff --git a/.llm/plans/completed/vendor-agnostic-billing-foundation/ROLLOUT-CHECKLIST.md b/.llm/plans/completed/vendor-agnostic-billing-foundation/ROLLOUT-CHECKLIST.md
new file mode 100644
index 00000000..2f23cabe
--- /dev/null
+++ b/.llm/plans/completed/vendor-agnostic-billing-foundation/ROLLOUT-CHECKLIST.md
@@ -0,0 +1,47 @@
+# Rollout checklist — Vendor-agnostic billing foundation (Metaboost)
+
+Use before enabling billing features in a new environment or after merging the full plan set.
+
+## Phase contract traceability
+
+| Phase | Topic | Outcome |
+| --- | --- | --- |
+| 01 | Domain and period policy | Completed — see `completed/01-domain-and-period-policy.md` |
+| 02 | Pricing catalog and schema | Linear SQL + catalog tables |
+| 03 | Services, API, orchestration | ORM services, main API, CLI renewals |
+| 04 | Membership settings bootstrap | `product_membership_settings` + env alignment |
+| 05 | Management pricing governance | Management API + `/products/membership` UI |
+| 06 | Public API billing read models | `GET /product/membership`, `GET /auth/billing/membership-summary` |
+| 07 | Tests and rollout verification | This checklist + integration/E2E acceptance |
+
+## Database and migrations
+
+- [ ] Linear app/management migrations applied in **numeric order**; no manual skips.
+- [ ] `make db_regen_linear_baseline` (or repo equivalent) run if linear SQL under `linear-migrations/` changed, and committed baseline artifacts updated.
+- [ ] Test DBs (`make test_deps`) come up clean for `npm run test:e2e:api` and management-api tests.
+
+## Bootstrap and idempotency
+
+- [ ] `BillingPriceCatalogService` / product membership resolution can run repeatedly without duplicate open price windows (unique constraints + `resolveProductMembership` idempotent seeding).
+- [ ] `MembershipPeriodExtensionService` dedupes on `lastExtensionIdempotencyKey` (covered by `membership-period-extension.test.ts`).
+- [ ] Renewal job / `process-due-renewals` safe to re-run; stub or real adapter honors idempotency keys.
+
+## Permissions and management API
+
+- [ ] `admin_permissions.billing_prices_crud` present; roles that need pricing UI include read (and create/update for mutators).
+- [ ] Super-admins bypass; non–super-admins without billing read get **403** on `/billing-prices*`, `/product/membership`, and schedule/deprecate (covered by `billing-prices.test.ts`).
+
+## Application verification (local/CI)
+
+- [ ] `npm run lint` (repo root) passes.
+- [ ] `npm run test:e2e:api` passes (Postgres + Valkey test ports; `make test_deps` if needed).
+- [ ] Management-web E2E: `make e2e_test_management_web_report_spec SPEC=e2e/products-membership-billing.spec.ts` (and dashboard link spec if nav changed).
+
+## Non-goals (confirm unchanged)
+
+- [ ] No feed/parser/lifecycle or object-storage work bundled with this billing rollout.
+- [ ] No broad management-web refactors outside billing-adjacent routes and i18n keys for this feature set.
+
+## GitOps (if K8s env templates changed in a release)
+
+- [ ] Push the GitOps branch your Argo CD instance tracks (e.g. `develop`) so the cluster can sync new env and migration markers.
diff --git a/.llm/templates/LLM-TEMPLATES.md b/.llm/templates/LLM-TEMPLATES.md
new file mode 100644
index 00000000..c5aa5c21
--- /dev/null
+++ b/.llm/templates/LLM-TEMPLATES.md
@@ -0,0 +1,9 @@
+# `.llm/templates/`
+
+Human copy-paste **blanks and wrappers** for optional history notes and plan authoring. **Not** abcmemory.
+
+- **Do not** put active or completed plan sets here — use `.llm/plans/active/<name>/` and move to `plans/completed/` when done.
+- Copy a template, then create a new folder under `plans/active/` for the real plan content.
+- Use for session logs and similar operator workflows.
+- For reusable agent prompt snippets committed as guidance, use `.cursor/prompts/` instead.
+- See [LLM.md](/.llm/LLM.md) and [CURSOR-PROMPTS.md](/.cursor/prompts/CURSOR-PROMPTS.md).
diff --git a/AGENTS.md b/AGENTS.md
index e62008e3..cf9d049c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2,7 +2,7 @@
 
 Quick reference for AI assistants working on the Metaboost repo (HTTP API + Next.js app).
 
-Authoritative AI rules: **`.cursor/`**, **`.cursorrules`**. **Machine-generated** exports: [`.llm/exports/`](.llm/exports/) (produced and published by **`llm-exports-sync`** / **`llm-exports-full`**; not by default local `npm` runs). `LLM_EXPORT_ALLOW_LOCAL=1` is only for [scripts/llm/](scripts/llm/) development; see [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md) and [`llm-cursor-source`](.cursor/skills/llm-cursor-source/SKILL.md). Non-Cursor: use exports first, then [docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md](docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md) if needed. Policy and `gh` setup: [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md), [docs/development/llm/GH-EXPORTS-SETUP.md](docs/development/llm/GH-EXPORTS-SETUP.md).
+Authoritative AI rules: **`.cursor/`**, **`.cursorrules`**. Contributor policy and plans: [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md) and [`llm-cursor-source`](.cursor/skills/llm-cursor-source/SKILL.md).
 
 ## Stack
 
@@ -41,7 +41,7 @@ Node and npm are provided by the repo's Nix flake, not a global install. When ru
 ## Local env
 
 Secrets (JWT, DB, Valkey, etc.) are **auto-generated** by `make local_env_setup` via
-`scripts/env-setup-secrets.sh`. **Canonical contributor-facing env templates/examples** are **`apps/*/.env.example`**, **`apps/*/sidecar/.env.example`**, and **`infra/config/env-templates/*.env.example`** (see [docs/development/env/ENV-REFERENCE.md](docs/development/env/ENV-REFERENCE.md)). `scripts/local-env/setup.sh` generates app and `infra/config/local/*.env` files from those templates when missing. Optional override files under `dev/env-overrides/local/*.env` (symlinked from `~/.config/metaboost/local-env-overrides/` via prepare/link) are merged by **`setup.sh`** when present — **info.env**, **user-agent.env**, **mailer.env**, **auth.env**, **locale.env** (see [docs/development/env/LOCAL-ENV-OVERRIDES.md](docs/development/env/LOCAL-ENV-OVERRIDES.md)). **`API_CORS_ORIGINS`** and **`MANAGEMENT_API_CORS_ORIGINS`** should match local web base URLs for local dev. **WEB_BASE_URL** / **WEB_URL** stay as local dev defaults in generated app env (not in home override stubs).
+`scripts/env-setup-secrets.sh`. **Canonical contributor-facing env templates/examples** are **`apps/*/.env.example`**, **`apps/*/sidecar/.env.example`**, and **`infra/config/env-templates/*.env.example`** (see [docs/development/env/ENV-REFERENCE.md](docs/development/env/ENV-REFERENCE.md)). `scripts/local-env/setup.sh` generates app and `infra/config/local/*.env` files from those templates when missing. Optional override files under `dev/env-overrides/local/*.env` (symlinked from `~/.config/metaboost/local-env-overrides/` via prepare/link) are merged by **`setup.sh`** when present — **info.env**, **user-agent.env**, **mailer.env**, **auth.env**, **locale.env**, **notifications.env** (see [docs/development/env/LOCAL-ENV-OVERRIDES.md](docs/development/env/LOCAL-ENV-OVERRIDES.md)). **`API_CORS_ORIGINS`** and **`MANAGEMENT_API_CORS_ORIGINS`** should match local web base URLs for local dev. **WEB_BASE_URL** / **WEB_URL** stay as local dev defaults in generated app env (not in home override stubs).
 
 - **Prepare:** `make local_env_prepare` — ensures `~/.config/metaboost/local-env-overrides/` exists and creates missing override `.env` files with keys/defaults seeded from canonical `.env.example` templates (`write-home-override-stubs.rb`; never overwrites existing `KEY=` lines; appends missing keys with defaults); edit for non-default values
 - **Link:** `make local_env_link` — symlinks `dev/env-overrides/local/*.env` to existing files in the home overrides directory
@@ -51,11 +51,9 @@ Secrets (JWT, DB, Valkey, etc.) are **auto-generated** by `make local_env_setup`
 
 See [docs/development/env/LOCAL-ENV-OVERRIDES.md](docs/development/env/LOCAL-ENV-OVERRIDES.md).
 
-## LLM History
+## Optional `.llm/history/` notes
 
-See [.llm/LLM.md](.llm/LLM.md) for full guidelines. Use the **llm-history** skill when updating history or starting feature work. The **llm-history-tracking** rule (always applied) requires updating `.llm/history/active/[feature]/` on any file-modifying response.
-
-- Follow `.cursor/skills/llm-history/SKILL.md` for history timing, format, and 10-session limit.
+See [.llm/LLM.md](.llm/LLM.md) if your team keeps optional markdown notes under `.llm/history/`.
 
 ## Security review
 
@@ -65,18 +63,27 @@ For PRs touching auth, CORS, outbound HTTP, redirects, SQL query builders, or pr
 
 When implementing features or executing plans that touch **api** or **management-api**, include **integration tests** (see api-testing). When they touch **web** or **management-web**, include **E2E tests** (see e2e-page-tests). If an API change affects UI in web or management-web, add or update the relevant E2E specs as well.
 
+### AI agents: write tests, do not run them
+
+- **During agent or plan implementation:** do **not** run test, lint, or verification commands (`npm run test*`, `make e2e_*`, or `npm run lint` as verification gates).
+- **Do** add or update tests when the change requires them (see paragraph above and **feature-implementation-testing**).
+- **After each implementation response:** tell the **operator** which command(s) to run in a fenced `bash` block — see **response-ending-make-verify** skill, **end-with-targeted-make-report-verify** rule, and `.cursorrules` § Agent/plan work.
+- **Final COPY-PASTA step:** when completing the last prompt in a plan set, list **all** cumulative verification commands for the whole set (assume the operator ran all COPY-PASTA prompts without testing until the end). See **plan-files-convention** and **plan-execution-completion-tracking** rule.
+- Default E2E verification commands for the operator **without** `E2E_API_GATE_MODE` unless API or integration code changed across the set.
+- The maintainer merge checklist below applies to **operators and humans**, not to in-session agent runs.
+
 ### Root npm scripts
 
-| Script                         | What it runs                                                                                                                             | Services needed                                       |
-| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
-| `npm run test:unit`            | Vitest in `@metaboost/helpers`, `@metaboost/helpers-currency`, `@metaboost/helpers-valkey`, `metaboost-signing`, `@metaboost/rss-parser` | None (pure Node)                                      |
-| `npm run test:e2e:api`         | `check-test-requirements` then Vitest in `apps/api` + `apps/management-api`                                                              | Postgres **5632**, Valkey **6579** (`make test_deps`) |
-| `npm run test:e2e:web`         | `make e2e_test` (Playwright: web + management-web)                                                                                       | Full E2E stack (`make test_deps` + seeds)             |
-| `npm run test:e2e:web:reports` | `make e2e_test_report` (HTML step-screenshot reports)                                                                                    | Same as `test:e2e:web`                                |
-| `npm run test:reports`         | `test:unit` → `test:e2e:api` → `test:e2e:web:reports`                                                                                    | All tiers                                             |
-| `npm test`                     | `test:unit` → `test:e2e:api` → `test:e2e:web`                                                                                            | All tiers (slow — runs locally, not in CI)            |
+| Script                         | What it runs                                                                                                                                               | Services needed                                       |
+| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
+| `npm run test:unit`            | `scripts/ci/run-workspaces.mjs` — Vitest in every workspace with a `test` script except `apps/api` and `apps/management-api` (packages + `apps/web`, etc.) | None (pure Node; no DB for unit tier)                 |
+| `npm run test:e2e:api`         | `check-test-requirements` then Vitest in `apps/api` + `apps/management-api`                                                                                | Postgres **5632**, Valkey **6579** (`make test_deps`) |
+| `npm run test:e2e:web`         | `make e2e_test` (Playwright: web + management-web)                                                                                                         | Full E2E stack (`make test_deps` + seeds)             |
+| `npm run test:e2e:web:reports` | `make e2e_test_report` (HTML step-screenshot reports)                                                                                                      | Same as `test:e2e:web`                                |
+| `npm run test:reports`         | `test:unit` → `test:e2e:api` → `test:e2e:web:reports`                                                                                                      | All tiers                                             |
+| `npm test`                     | `test:unit` → `test:e2e:api` → `test:e2e:web`                                                                                                              | All tiers (slow — runs locally, not in CI)            |
 
-Full `npm test` including Playwright is intentionally **slow** and meant for **developer-local** runs. CI skips the full suite; maintainers run `make test_deps` and npm test targets locally before merge.
+Full `npm test` including Playwright is intentionally **slow** and meant for **developer-local** runs. CI skips the full suite; maintainers run `make test_deps` and npm test targets locally before merge. That describes **operator/human** verification, not in-session agent runs.
 
 ### API integration tests
 
@@ -123,6 +130,7 @@ One setup file ([apps/api/src/test/setup.ts](apps/api/src/test/setup.ts)) provid
 - Strict equality (`===` / `!==` only)
 - Avoid type assertions (`as`); prefer types and narrowing
 - Semicolons in JS/TS
+- **Import specifiers:** Tier A (packages except `packages/ui`, APIs, sidecars, tools) uses NodeNext **`.js`** relative specifiers; Tier C (`packages/ui`) and Tier B (`apps/web/src`, `apps/management-web/src`) stay **extensionless** for shared UI / Turbopack — [docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md](docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md), [`.cursor/skills/import-specifiers-tiered/SKILL.md`](.cursor/skills/import-specifiers-tiered/SKILL.md)
 
 ### Import order
 
@@ -131,24 +139,26 @@ Imports must follow a consistent hierarchy and be alphabetized within groups: (1
 ## Skills and Rules
 
 - **.cursor/skills/** – Project skills (one SKILL.md per directory). Use when the task matches the skill’s “when to use” so the agent follows the right patterns.
-- **.cursor/rules/** – Glob-triggered or always-applied rules (e.g. eqeqeq, avoid-type-assertions, llm-history-tracking, path-casing). Rules apply automatically when editing matching files.
+- **.cursor/rules/** – Glob-triggered or always-applied rules (e.g. eqeqeq, avoid-type-assertions, path-casing). Rules apply automatically when editing matching files.
 
 All configuration is project-scoped (no home-directory skills or rules).
 
 ### When to use which skill
 
-| Task or area                | Skill(s) to use                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **LLM / exports (tooling)** | **llm-exports-scripts** when changing `scripts/llm/**` (export sync, adapters, vendor selector). **llm-cursor-source** for what to commit and `.llm/exports` automation policy.                                                                                                                                                                                                                                                          |
-| **History / plans**         | **llm-history** when updating history or starting feature work. **plan-files-convention** when creating, saving, or completing multi-step plans (e.g. COPY-PASTA execution). **single-readme** when adding index/overview docs (repo has only one README at root). Plans live in `.llm/plans/active/`; split if over 300 lines (see **plan-creation** rule).                                                                             |
-| **API**                     | **api** for Express API patterns. **api-testing** when adding or changing API routes, auth, or env-dependent behavior (integration tests). **swagger-openapi** when changing API surface. **api-no-pii-credentials** rule applies to responses. **Run:** `npm run test:e2e:api` (integration), `npm run test:unit` (packages only).                                                                                                      |
-| **Web / management-web**    | **web** for Next.js app patterns. **e2e-page-tests** when layout or behavior changes in web/management-web. **response-ending-make-verify** (and **end-with-targeted-make-report-verify** rule) for E2E verification commands. Use **make** E2E targets only (**e2e-run-with-make-only**). **Run:** `make e2e_test_web`, `make e2e_test_report`.                                                                                         |
-| **Testing (general)**       | **feature-implementation-testing** — tests are required for features touching api/management-api/web/management-web. **unit-tests-risk-first** for prioritizing unit tests. **unit-tests-confident-granularity** for test depth. **unit-tests-security-authz-template** for auth/permission tests. **Run:** `npm test` (full), `npm run test:unit` (no DB), `npm run test:e2e:api` (DB needed), `npm run test:reports` (full with HTML). |
-| **i18n**                    | **i18n** when adding/editing translation keys, locales, or generating translations.                                                                                                                                                                                                                                                                                                                                                      |
-| **Forms / UI**              | **use-form-component**, **button-loading-async**, **password-strength-on-set-update**. **avoid-type-assertions**, **eqeqeq-strict-equality** rules apply.                                                                                                                                                                                                                                                                                |
-| **DB / ORM**                | **database-schema-naming**, **typeorm-orderby-property-names**, **generate-data-sync** when schema or entities change. **nested-resource-prefix-naming** for nested resources.                                                                                                                                                                                                                                                           |
-| **K8s / Argo CD**           | **Remote cluster runbook:** [docs/development/k8s/REMOTE-K8S-GITOPS.md](docs/development/k8s/REMOTE-K8S-GITOPS.md). **argocd-gitops-push** when changing files under `infra/k8s/` or sync targets for k8s (add push-to-Git reminder in response so Argo CD can sync).                                                                                                                                                                    |
-| **Env / templates**         | Keep env work anchored to canonical templates/examples (`scripts/local-env/setup.sh`, `scripts/env-overrides/prepare-home-env-overrides.sh`). For remote K8s, maintain env/manifests directly in your GitOps repository.                                                                                                                                                                                                                 |
-| **Imports / paths**         | **path-casing-imports** when adding or changing relative imports (rule also applies on .ts/.tsx). **type-imports-separate-line** rule for type-only imports.                                                                                                                                                                                                                                                                             |
-
-For **file-modifying work**: update `.llm/history/active/[feature]/` per **llm-history** and the **llm-history-tracking** rule. For **large or multi-step plans**: save under `.llm/plans/active/` and use **plan-files-convention**; execute via COPY-PASTA prompts one plan at a time.
+| Task or area                  | Skill(s) to use                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **LLM / Cursor guidance**     | **llm-cursor-source** when adding or editing skills, rules, `.cursorrules`, or `.cursorignore`. **github** for gh CLI read patterns and repo URLs. **operator-only-git-operations** rule for agent git/gh policy. See [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](docs/development/llm/DOCS-DEVELOPMENT-LLM.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| **Plans**                     | **plan-files-convention** when creating or saving plan sets. **parallel-plan-execution** when decomposing large work into COPY-PASTA phases. **plan-completion** and **plan-execution-completion-tracking** rule when archiving finished plans. **single-readme** when adding index/overview docs (repo has only one README at root). Plans live in `.llm/plans/active/`; split if over 300 lines (see **plan-creation** rule).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| **Engineering ops**           | **logging** for LOG*DIR / console-only policy. **observability** when adding OTLP/tracing (future). **git-worktree-sibling** for sibling `metaboost*\*` worktrees. **github** for issues/PRs/Dependabot. **response-ending-make-verify** for operator verification blocks.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| **API**                       | **api** for Express API patterns. **api-testing** when adding or changing API routes, auth, or env-dependent behavior (integration tests). **swagger-openapi** skill and **openapi-sync** rule when changing API surface. **api-no-pii-credentials-in-responses** rule applies to responses. **config-type-safety** rule and **startup-validation-env-order** skill for env/config. **Operator runs:** `npm run test:e2e:api` (integration), `npm run test:unit` (unit tier; excludes API apps).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| **Web / management-web**      | **web** for Next.js app patterns. **prefer-shared-ui-web-management** and **shared-ui-i18n** rules. **styles-source-of-truth**, **styles-import-last**, **modal-layout-contract**, **ui-component-promotion**, **reusable-components** for shared UI. **ui-e2e-screenshot-report** for targeted screenshot reports. **time-format-local**, **rate-limit-message**, **routing-url-params** for display and URL conventions. **e2e-page-tests** when layout or behavior changes in web/management-web. **test-timeout-budget** rule for E2E/unit timeouts. **e2e-seed-nano-id-limits** when adding E2E fixture `id_text` values. **management-post-save-navigation** when adding/changing dedicated **create** or **edit** pages that save one row (redirect to list via **`ROUTES`** after success, except invite-link / password-only / detail flows). **response-ending-make-verify** (and **end-with-targeted-make-report-verify** rule) for E2E verification commands. Use **make** E2E targets only (**e2e-run-with-make-only**). **Operator runs:** `make e2e_test_web`, `make e2e_test_report`. |
+| **Testing (general)**         | **feature-implementation-testing** — tests are required for features touching api/management-api/web/management-web. **unit-test-priority-confident** and **unit-tests-risk-first** for prioritizing unit tests. **unit-test-design-no-overgranularity** and **unit-tests-confident-granularity** for test depth. **unit-test-new-code-gate** when adding critical logic. **unit-tests-security-authz-template** for auth/permission tests. **e2e-seed-nano-id-limits** and **e2e-seed-id-text-limits** rule when changing E2E seed `id_text` values. **e2e-permission-actor-matrix** for management-web authz E2E. **Operator runs:** `npm test` (full), `npm run test:unit` (no DB), `npm run test:e2e:api` (DB needed), `npm run test:reports` (full with HTML).                                                                                                                                                                                                                                                                                                                                   |
+| **i18n**                      | **i18n** when adding/editing translation keys, locales, or generating translations. **time-format-local** for client date/time display.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| **Forms / UI**                | **use-form-component**, **button-loading-async**, **password-strength-on-set-update**. **modal-layout-contract** for dialog footers. **avoid-type-assertions**, **eqeqeq-strict-equality** rules apply.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| **DB / ORM**                  | **database-schema-naming**, **typeorm-orderby-property-names**, **generate-data-sync** when schema or entities change. **nested-resource-prefix-naming** for nested resources.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| **K8s / Argo CD**             | **k8s** skill and **infra-k8s** rule. **github-actions-yaml** rule for workflow edits. Remote cluster runbook: [docs/development/k8s/REMOTE-K8S-GITOPS.md](docs/development/k8s/REMOTE-K8S-GITOPS.md). **argocd-gitops-push** when changing files under `infra/k8s/` or sync targets for k8s (add push-to-Git reminder in response so Argo CD can sync).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| **Env / templates**           | **env-file-formatting**, **env-expiration-naming**, **env-defaults-match-code** when adding env vars or templates. **startup-validation-env-order** when editing `validation.ts`. Keep env work anchored to canonical templates/examples (`scripts/local-env/setup.sh`, `scripts/env-overrides/prepare-home-env-overrides.sh`). **config-type-safety** rule for app config modules. For remote K8s, maintain env/manifests directly in your GitOps repository.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| **Imports / paths**           | **path-casing-imports** when adding or changing relative imports (rule also applies on .ts/.tsx). **import-specifiers-tiered** when editing imports across Tier A vs Next `src` or considering codemods. **type-imports-separate-line** rule for type-only imports. **app-internal-import-aliases** rule for `@api/*` and `@management-api/*` in Node apps.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| **Build / lockfile / Docker** | **build-order** and **build-order-doc-sync** when changing root build scripts. **native-deps-platform-mismatch** when diagnosing missing platform binaries after lockfile refresh. **docker-runtime-workspace-parity** when adding `packages/*`, changing `@metaboost/*` app dependencies, or editing `infra/docker/local/**` Dockerfiles. **linear-baseline-gz-sync** when linear migration SQL changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+
+For **large or multi-step plans**: save under `.llm/plans/active/` and use **plan-files-convention**; execute via COPY-PASTA prompts one plan at a time.
diff --git a/README.md b/README.md
index 87a35479..4e135fa4 100644
--- a/README.md
+++ b/README.md
@@ -81,7 +81,7 @@ The API is versioned under a path prefix (default **/v1**; set `API_VERSION_PATH
 
 ## Gitflow and CI
 
-Default branch is **develop**; open PRs against `develop`. Use `npm run start-feature` to create branches (e.g. `feature/name`, `fix/name`). CI runs when a PR targets develop (on open/update) and when a maintainer comments **/test** on a PR. See [docs/GITFLOW.md](docs/GITFLOW.md).
+Default branch is **develop**; open PRs against `develop`. Use `npm run start-feature` to create branches (e.g. `feature/name`, `fix/name`, `llm/name`). CI runs when a PR targets develop (on open/update) and when a maintainer comments **/test** on a PR. See [docs/GITFLOW.md](docs/GITFLOW.md).
 
 ## Scripts
 
diff --git a/apps/api/.env.example b/apps/api/.env.example
index d8c4ad0a..5e2d57f7 100644
--- a/apps/api/.env.example
+++ b/apps/api/.env.example
@@ -19,11 +19,14 @@ DB_APP_READ_USER="metaboost_app_read"
 DB_APP_READ_PASSWORD=
 DB_APP_READ_WRITE_USER="metaboost_app_read_write"
 DB_APP_READ_WRITE_PASSWORD=
-MEMBERSHIP_DEFAULT_TRIAL_MONTHS=
-MEMBERSHIP_DEFAULT_PREMIUM_MONTHS=
+# Membership product bootstrap (main DB): seeds missing rows; runtime reads DB first (see infra templates).
+# MEMBERSHIP_FREE_TRIAL_EXPIRATION: trial length in seconds (default 31 days = 2678400 if unset).
+MEMBERSHIP_FREE_TRIAL_EXPIRATION="2678400"
+MEMBERSHIP_PREMIUM_COST_MONTHLY="3"
+MEMBERSHIP_PREMIUM_COST_ANNUALLY="30"
 API_PORT="4000"
 API_VERSION_PATH="/v1"
-API_RELEASE="X.X.X-staging.N"
+API_RELEASE="X.Y.Z-staging.N"
 API_PUBLIC_BASE_URL="http://localhost:4000"
 API_SERVER_BASE_URL="http://localhost:4000"
 WEB_PORT="4002"
@@ -51,3 +54,10 @@ STANDARD_ENDPOINT_REGISTRY_POLL_SECONDS="300"
 STANDARD_ENDPOINT_REGISTRY_TIMEOUT_MS="10000"
 STANDARD_ENDPOINT_REQUIRE_HTTPS="false"
 STANDARD_ENDPOINT_TRUST_PROXY="false"
+# Web Push (VAPID). Optional — omit keys or set WEBPUSH_ENABLED="false" to disable outbound push.
+WEBPUSH_ENABLED=
+WEBPUSH_VAPID_PUBLIC_KEY=
+WEBPUSH_VAPID_PRIVATE_KEY=
+# mailto: or https: URL (web-push VAPID subject).
+WEBPUSH_VAPID_SUBJECT=
+# Legacy aliases (still read if WEBPUSH_* keys are unset): API_WEB_PUSH_VAPID_PUBLIC_KEY, API_WEB_PUSH_VAPID_PRIVATE_KEY, API_WEB_PUSH_VAPID_CONTACT
diff --git a/apps/api/package.json b/apps/api/package.json
index fddf7c96..f5d7706b 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -14,7 +14,8 @@
     "type-check": "tsc --noEmit",
     "clean": "rm -rf dist",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "webpush:generate-vapid-keys": "web-push generate-vapid-keys"
   },
   "dependencies": {
     "@metaboost/helpers": "*",
@@ -25,6 +26,7 @@
     "@metaboost/helpers-valkey": "*",
     "@metaboost/orm": "*",
     "@metaboost/rss-parser": "*",
+    "@types/web-push": "^3.6.4",
     "bcrypt": "^6.0.0",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
@@ -34,7 +36,8 @@
     "jsonwebtoken": "^9.0.2",
     "nodemailer": "^8.0.7",
     "rate-limit-redis": "^4.3.1",
-    "swagger-ui-express": "^5.0.1"
+    "swagger-ui-express": "^5.0.1",
+    "web-push": "^3.6.7"
   },
   "devDependencies": {
     "@sqltools/formatter": "^1.2.5",
diff --git a/apps/api/src/app.ts b/apps/api/src/app.ts
index 68f99e3b..53fb6b81 100644
--- a/apps/api/src/app.ts
+++ b/apps/api/src/app.ts
@@ -18,6 +18,7 @@ import { createAuthRouter } from './routes/auth.js';
 import { createBucketAdminInvitationsRouter } from './routes/bucketAdminInvitations.js';
 import { createBucketsRouter } from './routes/buckets.js';
 import { createExchangeRatesRouter } from './routes/exchangeRates.js';
+import { createProductRouter } from './routes/product.js';
 import { createStandardEndpointRouter } from './routes/standardEndpoint.js';
 
 /**
@@ -89,6 +90,7 @@ export function createApp(): Express {
     '/auth',
     createAuthRouter(authMiddleware, config.accountSignupModeCapabilities)
   );
+  versionedRouter.use('/product', createProductRouter());
   versionedRouter.use('/buckets', createBucketsRouter(authMiddleware));
   versionedRouter.use('/exchange-rates', createExchangeRatesRouter());
   versionedRouter.use('/admin-invitations', createBucketAdminInvitationsRouter(authMiddleware));
diff --git a/apps/api/src/config/index.ts b/apps/api/src/config/index.ts
index ab17eb13..bf276625 100644
--- a/apps/api/src/config/index.ts
+++ b/apps/api/src/config/index.ts
@@ -38,6 +38,17 @@ const getEnvOptionalTrimmed = (key: string): string | undefined => {
   return t === '' ? undefined : t;
 };
 
+/** First non-empty trimmed value among keys (canonical names before legacy aliases). */
+function getEnvFirstTrimmed(keys: readonly string[]): string | undefined {
+  for (const key of keys) {
+    const v = getEnvOptionalTrimmed(key);
+    if (v !== undefined) {
+      return v;
+    }
+  }
+  return undefined;
+}
+
 export type AccountSignupMode = AccountSignupModeValue;
 export type AccountSignupModeCapabilities = SharedAccountSignupModeCapabilities;
 
@@ -214,6 +225,38 @@ export const config = {
     }
     return n;
   })(),
+  /**
+   * Web Push (VAPID). When any key is missing, outbound Web Push is skipped (no startup failure).
+   * Contact must be a mailto: or https: URL per web-push library expectations.
+   *
+   * Canonical env: WEBPUSH_* (WEBPUSH_ENABLED, WEBPUSH_VAPID_PUBLIC_KEY, WEBPUSH_VAPID_PRIVATE_KEY,
+   * WEBPUSH_VAPID_SUBJECT). Legacy aliases API_WEB_PUSH_VAPID_* remain supported.
+   */
+  get webPushVapid(): { publicKey: string; privateKey: string; contact: string } | null {
+    const enabledRaw = getEnvOptionalTrimmed('WEBPUSH_ENABLED');
+    if (enabledRaw !== undefined && parseEnvBooleanToken(enabledRaw) === false) {
+      return null;
+    }
+    const publicKey = getEnvFirstTrimmed([
+      'WEBPUSH_VAPID_PUBLIC_KEY',
+      'API_WEB_PUSH_VAPID_PUBLIC_KEY',
+    ]);
+    const privateKey = getEnvFirstTrimmed([
+      'WEBPUSH_VAPID_PRIVATE_KEY',
+      'API_WEB_PUSH_VAPID_PRIVATE_KEY',
+    ]);
+    if (publicKey === undefined || privateKey === undefined) {
+      return null;
+    }
+    const contactRaw = getEnvFirstTrimmed(['WEBPUSH_VAPID_SUBJECT', 'API_WEB_PUSH_VAPID_CONTACT']);
+    const contact =
+      contactRaw !== undefined && contactRaw !== '' ? contactRaw : 'mailto:noreply@localhost';
+    return {
+      publicKey,
+      privateKey,
+      contact,
+    };
+  },
 };
 
 export { buildAppRegistryRecordUrl, resolveStandardEndpointRegistryFromEnv };
diff --git a/apps/api/src/controllers/billingController.ts b/apps/api/src/controllers/billingController.ts
new file mode 100644
index 00000000..1a438a41
--- /dev/null
+++ b/apps/api/src/controllers/billingController.ts
@@ -0,0 +1,31 @@
+import type { Request, Response } from 'express';
+
+import { BillingPriceCatalogService } from '@metaboost/orm';
+
+import { buildAuthenticatedBillingMembershipReadModel } from '../lib/billingReadModelSerialization.js';
+
+const catalog = new BillingPriceCatalogService();
+
+/**
+ * Authenticated billing + catalog read model (client-safe; ISO strings for instants).
+ */
+export async function membershipSummary(req: Request, res: Response): Promise<void> {
+  const user = req.user;
+  if (user === undefined) {
+    res.status(401).json({ message: 'Authentication required' });
+    return;
+  }
+  const trust = user.trustSettings;
+  if (trust === undefined) {
+    res.status(404).json({ message: 'Membership settings not found' });
+    return;
+  }
+
+  const catalogResolved = await catalog.resolveProductMembership();
+  const data = buildAuthenticatedBillingMembershipReadModel({
+    user,
+    catalog: catalogResolved,
+  });
+
+  res.status(200).json({ data });
+}
diff --git a/apps/api/src/controllers/bucketsController.ts b/apps/api/src/controllers/bucketsController.ts
index aedb5439..16bb0459 100644
--- a/apps/api/src/controllers/bucketsController.ts
+++ b/apps/api/src/controllers/bucketsController.ts
@@ -1,7 +1,10 @@
 import type {
+  BucketNotificationPreferencePatchResponse,
+  BucketNotificationPreferenceResponse,
   CreateBucketBody,
-  UpdateBucketBody,
   CreateChildBucketBody,
+  UpdateBucketBody,
+  UpdateBucketNotificationPreferenceBody,
 } from '../schemas/buckets.js';
 import type { Bucket } from '@metaboost/orm';
 import type { Request, Response } from 'express';
@@ -9,10 +12,12 @@ import type { Request, Response } from 'express';
 import { compareStringsEmptyLastLexicographic, parseSortOrderQueryParam } from '@metaboost/helpers';
 import { normalizeCurrencyCode } from '@metaboost/helpers-currency';
 import {
-  BucketService,
   BucketMessageService,
+  BucketNotificationPreferenceService,
   BucketRSSChannelInfoService,
   BucketRSSItemInfoService,
+  BucketService,
+  isPgUniqueViolation,
 } from '@metaboost/orm';
 import { normalizeMinimalRss, parseMinimalRss, MinimalRssParserError } from '@metaboost/rss-parser';
 
@@ -29,6 +34,7 @@ import { toBucketResponse } from '../lib/bucket-response.js';
 import { recomputeRootThresholdSnapshots } from '../lib/recompute-threshold-snapshots.js';
 import { fetchRssFeedXmlWithTimeout } from '../lib/rss-safe-fetch.js';
 import { verifyAndSyncRssChannelBucket } from '../lib/rss-sync.js';
+import { requireUser } from '../middleware/auth.js';
 type BucketRssInfoResponse = {
   rssFeedUrl: string;
   rssPodcastGuid: string;
@@ -143,15 +149,6 @@ async function parseRssChannelFromFeedUrl(rssFeedUrl: string): Promise<ParsedRss
   };
 }
 
-function isUniqueViolation(error: unknown): boolean {
-  return (
-    error !== null &&
-    typeof error === 'object' &&
-    'code' in error &&
-    (error as { code: string }).code === '23505'
-  );
-}
-
 async function isAncestorChainPublic(bucket: Bucket): Promise<boolean> {
   let parentId = bucket.parentBucketId;
   while (parentId !== null) {
@@ -199,7 +196,7 @@ async function createRssChannelBucket(input: {
       rssChannelTitle: parsed.channelTitle,
     });
   } catch (error) {
-    if (isUniqueViolation(error)) {
+    if (isPgUniqueViolation(error)) {
       throw new MinimalRssParserError({
         code: 'invalid_input',
         message: 'RSS channel already exists for this podcast guid.',
@@ -216,9 +213,8 @@ async function createRssChannelBucket(input: {
 }
 
 export async function listBuckets(req: Request, res: Response): Promise<void> {
-  const user = req.user;
-  if (user === undefined) {
-    res.status(401).json({ message: 'Authentication required' });
+  const user = requireUser(req, res);
+  if (user === null) {
     return;
   }
   const search =
@@ -245,9 +241,8 @@ export async function listBuckets(req: Request, res: Response): Promise<void> {
 }
 
 export async function createBucket(req: Request, res: Response): Promise<void> {
-  const user = req.user;
-  if (user === undefined) {
-    res.status(401).json({ message: 'Authentication required' });
+  const user = requireUser(req, res);
+  if (user === null) {
     return;
   }
   const body = req.body as CreateBucketBody;
@@ -514,6 +509,46 @@ export async function createChildBucket(req: Request, res: Response): Promise<vo
   res.status(201).json({ bucket: await toBucketApiResponse(childBucket, overrides) });
 }
 
+export async function getBucketNotificationPreference(req: Request, res: Response): Promise<void> {
+  const ctx = await getBucketContext(req, res, { paramKey: 'bucketId', can: canReadBucket });
+  if (ctx === null) return;
+  const bucketId = ctx.resolved.effectiveBucket.id;
+  const pref = await BucketNotificationPreferenceService.findByUserAndBucket(ctx.user.id, bucketId);
+  const payload: BucketNotificationPreferenceResponse = {
+    bucketId,
+    enabled: pref?.enabled ?? false,
+    hasExplicitPreference: pref !== null,
+  };
+  res.status(200).json(payload);
+}
+
+export async function updateBucketNotificationPreference(
+  req: Request,
+  res: Response
+): Promise<void> {
+  const ctx = await getBucketContext(req, res, { paramKey: 'bucketId', can: canReadBucket });
+  if (ctx === null) return;
+  const bucketId = ctx.resolved.effectiveBucket.id;
+  const body = req.body as UpdateBucketNotificationPreferenceBody;
+  await BucketNotificationPreferenceService.upsert(ctx.user.id, bucketId, body.enabled);
+  if (body.applyToDescendants === true) {
+    const descendantIds = await BucketService.findDescendantIds(bucketId);
+    if (descendantIds.length > 0) {
+      await BucketNotificationPreferenceService.upsertManyForUser(
+        ctx.user.id,
+        descendantIds,
+        body.enabled
+      );
+    }
+  }
+  const payload: BucketNotificationPreferencePatchResponse = {
+    bucketId,
+    enabled: body.enabled,
+    applyToDescendants: body.applyToDescendants === true,
+  };
+  res.status(200).json(payload);
+}
+
 export async function verifyRssChannel(req: Request, res: Response): Promise<void> {
   const ctx = await getBucketContext(req, res, { paramKey: 'bucketId', can: canUpdateBucket });
   if (ctx === null) {
diff --git a/apps/api/src/controllers/productController.ts b/apps/api/src/controllers/productController.ts
new file mode 100644
index 00000000..0512b9ee
--- /dev/null
+++ b/apps/api/src/controllers/productController.ts
@@ -0,0 +1,20 @@
+import type { Request, Response } from 'express';
+
+import { BillingPriceCatalogService } from '@metaboost/orm';
+
+import { config } from '../config/index.js';
+import { buildPublicProductMembershipReadModel } from '../lib/billingReadModelSerialization.js';
+
+const catalog = new BillingPriceCatalogService();
+
+/**
+ * Public read model: resolved membership trial/pricing and signup visibility flag.
+ */
+export async function getPublicProductMembership(_req: Request, res: Response): Promise<void> {
+  const resolvedProductMembership = await catalog.resolveProductMembership();
+  const data = buildPublicProductMembershipReadModel({
+    resolvedProductMembership,
+    selfServePublicSignupOpen: config.accountSignupModeCapabilities.canPublicSignup,
+  });
+  res.status(200).json({ data });
+}
diff --git a/apps/api/src/controllers/webPushSubscriptionsController.ts b/apps/api/src/controllers/webPushSubscriptionsController.ts
new file mode 100644
index 00000000..935fa75c
--- /dev/null
+++ b/apps/api/src/controllers/webPushSubscriptionsController.ts
@@ -0,0 +1,101 @@
+import type {
+  UpsertWebPushSubscriptionBody,
+  UpdateWebPushSubscriptionBody,
+} from '../schemas/webPushSubscriptions.js';
+import type { WebPushSubscriptionDto } from '@metaboost/helpers-requests';
+import type { UserWebPushSubscription } from '@metaboost/orm';
+import type { Request, Response } from 'express';
+
+import { UserWebPushSubscriptionService } from '@metaboost/orm';
+
+import { requireUser } from '../middleware/auth.js';
+
+function subscriptionToJson(row: UserWebPushSubscription): WebPushSubscriptionDto {
+  return {
+    id: row.id,
+    endpoint: row.endpoint,
+    locale: row.locale,
+    createdAt: row.createdAt.toISOString(),
+    updatedAt: row.updatedAt.toISOString(),
+  };
+}
+
+export async function listWebPushSubscriptions(req: Request, res: Response): Promise<void> {
+  const user = requireUser(req, res);
+  if (user === null) {
+    return;
+  }
+  const rows = await UserWebPushSubscriptionService.listByUser(user.id);
+  res.status(200).json({ subscriptions: rows.map(subscriptionToJson) });
+}
+
+export async function upsertWebPushSubscription(req: Request, res: Response): Promise<void> {
+  const user = requireUser(req, res);
+  if (user === null) {
+    return;
+  }
+  const body = req.body as UpsertWebPushSubscriptionBody;
+  const row = await UserWebPushSubscriptionService.upsert({
+    userId: user.id,
+    endpoint: body.endpoint,
+    keyP256dh: body.keys.p256dh,
+    keyAuth: body.keys.auth,
+    locale: body.locale ?? null,
+  });
+  res.status(200).json({ subscription: subscriptionToJson(row) });
+}
+
+export async function updateWebPushSubscription(req: Request, res: Response): Promise<void> {
+  const user = requireUser(req, res);
+  if (user === null) {
+    return;
+  }
+  const subscriptionIdParam = req.params.subscriptionId;
+  if (typeof subscriptionIdParam !== 'string') {
+    res.status(400).json({ message: 'Invalid subscription id' });
+    return;
+  }
+  const subscriptionId = subscriptionIdParam;
+  const body = req.body as UpdateWebPushSubscriptionBody;
+  const patch: {
+    endpoint?: string;
+    keyP256dh?: string;
+    keyAuth?: string;
+    locale?: string | null;
+  } = {};
+  if (body.endpoint !== undefined) {
+    patch.endpoint = body.endpoint;
+  }
+  if (body.keys !== undefined) {
+    patch.keyP256dh = body.keys.p256dh;
+    patch.keyAuth = body.keys.auth;
+  }
+  if (body.locale !== undefined) {
+    patch.locale = body.locale === '' ? null : body.locale;
+  }
+  const row = await UserWebPushSubscriptionService.updateForUser(subscriptionId, user.id, patch);
+  if (row === null) {
+    res.status(404).json({ message: 'Subscription not found' });
+    return;
+  }
+  res.status(200).json({ subscription: subscriptionToJson(row) });
+}
+
+export async function deleteWebPushSubscription(req: Request, res: Response): Promise<void> {
+  const user = requireUser(req, res);
+  if (user === null) {
+    return;
+  }
+  const subscriptionIdParam = req.params.subscriptionId;
+  if (typeof subscriptionIdParam !== 'string') {
+    res.status(400).json({ message: 'Invalid subscription id' });
+    return;
+  }
+  const subscriptionId = subscriptionIdParam;
+  const ok = await UserWebPushSubscriptionService.delete(subscriptionId, user.id);
+  if (!ok) {
+    res.status(404).json({ message: 'Subscription not found' });
+    return;
+  }
+  res.status(204).send();
+}
diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index edcfba98..07d02f63 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -34,13 +34,16 @@ const run = async (): Promise<void> => {
   const { validateStartupRequirements } = await import('./lib/startup/validation.js');
   validateStartupRequirements();
 
-  const { appDataSourceRead, appDataSourceReadWrite } = await import('@metaboost/orm');
+  const { appDataSourceRead, appDataSourceReadWrite, BillingPriceCatalogService } =
+    await import('@metaboost/orm');
   await appDataSourceRead.initialize();
   await appDataSourceReadWrite.initialize();
 
   const { validateTermsVersionReady } = await import('./lib/startup/validateTermsVersionReady.js');
   await validateTermsVersionReady();
 
+  await new BillingPriceCatalogService().resolveProductMembership(new Date());
+
   const { config } = await import('./config/index.js');
   let registryUrl: URL;
   try {
diff --git a/apps/api/src/lib/billingReadModelSerialization.ts b/apps/api/src/lib/billingReadModelSerialization.ts
new file mode 100644
index 00000000..9b586437
--- /dev/null
+++ b/apps/api/src/lib/billingReadModelSerialization.ts
@@ -0,0 +1,67 @@
+import type {
+  AuthenticatedBillingMembershipReadModelData,
+  BillingRenewalLastStatus,
+  PublicProductMembershipReadModelData,
+  ResolvedProductMembership,
+} from '@metaboost/helpers';
+import type { UserWithRelations } from '@metaboost/orm';
+
+import { BILLING_LIST_PRICE_CURRENCY_CODE } from '@metaboost/helpers';
+
+export function toIsoUtcOrNull(value: Date | null | undefined): string | null {
+  if (value === null || value === undefined) {
+    return null;
+  }
+  return value.toISOString();
+}
+
+export function renewalLastStatusFromStored(raw: string): BillingRenewalLastStatus {
+  if (raw === 'succeeded' || raw === 'failed' || raw === 'none') {
+    return raw;
+  }
+  return 'none';
+}
+
+export function premiumBillingCadenceFromTrust(raw: string | null): 'monthly' | 'annual' | null {
+  if (raw === 'monthly' || raw === 'annual') {
+    return raw;
+  }
+  return null;
+}
+
+export function buildPublicProductMembershipReadModel(params: {
+  resolvedProductMembership: ResolvedProductMembership;
+  selfServePublicSignupOpen: boolean;
+}): PublicProductMembershipReadModelData {
+  return {
+    ...params.resolvedProductMembership,
+    listPriceCurrencyCode: BILLING_LIST_PRICE_CURRENCY_CODE,
+    selfServePublicSignupOpen: params.selfServePublicSignupOpen,
+  };
+}
+
+export function buildAuthenticatedBillingMembershipReadModel(params: {
+  user: UserWithRelations;
+  catalog: ResolvedProductMembership;
+}): AuthenticatedBillingMembershipReadModelData {
+  const trust = params.user.trustSettings;
+  if (trust === undefined) {
+    throw new Error('buildAuthenticatedBillingMembershipReadModel: missing trust settings');
+  }
+  return {
+    listPriceCurrencyCode: BILLING_LIST_PRICE_CURRENCY_CODE,
+    membership: {
+      tier: trust.membershipTier,
+      expiresAtIso: toIsoUtcOrNull(trust.membershipExpiresAt),
+      premiumBillingCadence: premiumBillingCadenceFromTrust(trust.billingCadence),
+      autoRenewMode: trust.autoRenewMode,
+    },
+    renewal: {
+      lastStatus: renewalLastStatusFromStored(trust.lastRenewalStatus),
+      lastAttemptAtIso: toIsoUtcOrNull(trust.lastRenewalAttemptAt),
+      nextAttemptAtIso: toIsoUtcOrNull(trust.nextRenewalAttemptAt),
+      retryCount: trust.renewalRetryCount,
+    },
+    catalog: params.catalog,
+  };
+}
diff --git a/apps/api/src/lib/logger.ts b/apps/api/src/lib/logger.ts
new file mode 100644
index 00000000..8d7fe411
--- /dev/null
+++ b/apps/api/src/lib/logger.ts
@@ -0,0 +1,13 @@
+/**
+ * API runtime logging. Centralizes stderr output so a structured backend logger can be
+ * swapped in without touching feature modules.
+ */
+export const logger = {
+  error(message: string, context?: Record<string, unknown>): void {
+    if (context !== undefined) {
+      console.error(message, context);
+    } else {
+      console.error(message);
+    }
+  },
+};
diff --git a/apps/api/src/lib/message-threshold-filter.ts b/apps/api/src/lib/message-threshold-filter.ts
index ca61f75d..b02dda60 100644
--- a/apps/api/src/lib/message-threshold-filter.ts
+++ b/apps/api/src/lib/message-threshold-filter.ts
@@ -69,6 +69,28 @@ export async function resolveEffectiveThresholdFilter(input: {
   return thresholdContext;
 }
 
+/**
+ * True when a persisted boost message meets the root bucket's effective public minimum
+ * threshold (same rule as list filters with no extra request minimum).
+ */
+export async function boostMessageMeetsRootPublicMinimumThreshold(input: {
+  rootBucketId: string;
+  message: BucketMessage;
+}): Promise<boolean> {
+  if (input.message.action !== 'boost') {
+    return false;
+  }
+  const amount = input.message.thresholdAmountMinorAtCreate;
+  if (amount === null || amount === undefined) {
+    return false;
+  }
+  const thresholdFilter = await resolveEffectiveThresholdFilter({
+    rootBucketId: input.rootBucketId,
+    requestMinimumAmountMinor: undefined,
+  });
+  return amount >= thresholdFilter.minimumAmountMinor;
+}
+
 export async function listFilteredBoostMessagesByBucketIds(
   input: ListFilteredBoostMessagesInput
 ): Promise<ListFilteredBoostMessagesResult> {
diff --git a/apps/api/src/lib/notifications/notifyNewBucketMessage.ts b/apps/api/src/lib/notifications/notifyNewBucketMessage.ts
new file mode 100644
index 00000000..1548cf29
--- /dev/null
+++ b/apps/api/src/lib/notifications/notifyNewBucketMessage.ts
@@ -0,0 +1,31 @@
+import type { BucketMessage } from '@metaboost/orm';
+
+import { BucketService } from '@metaboost/orm';
+
+import { boostMessageMeetsRootPublicMinimumThreshold } from '../message-threshold-filter.js';
+import { sendWebPushForNewBucketMessage } from './webPushChannel.js';
+
+/**
+ * Channel-neutral hook for new bucket messages. Web Push is the first channel;
+ * additional transports can subscribe here later.
+ */
+export async function notifyNewBucketMessage(input: {
+  bucketId: string;
+  message: BucketMessage;
+}): Promise<void> {
+  const rootBucketId = await BucketService.resolveRootBucketId(input.bucketId);
+  if (rootBucketId === null) {
+    return;
+  }
+  const meetsThreshold = await boostMessageMeetsRootPublicMinimumThreshold({
+    rootBucketId,
+    message: input.message,
+  });
+  if (!meetsThreshold) {
+    return;
+  }
+  await sendWebPushForNewBucketMessage({
+    bucketId: input.bucketId,
+    message: input.message,
+  });
+}
diff --git a/apps/api/src/lib/notifications/webPushChannel.ts b/apps/api/src/lib/notifications/webPushChannel.ts
new file mode 100644
index 00000000..5eed6161
--- /dev/null
+++ b/apps/api/src/lib/notifications/webPushChannel.ts
@@ -0,0 +1,108 @@
+import type { BucketMessage, UserWebPushSubscription } from '@metaboost/orm';
+
+import webPush from 'web-push';
+
+import {
+  BucketNotificationPreferenceService,
+  BucketService,
+  UserWebPushSubscriptionService,
+} from '@metaboost/orm';
+
+import { config } from '../../config/index.js';
+import { logger } from '../logger.js';
+
+let vapidConfigured = false;
+
+function ensureVapidConfigured(): boolean {
+  const vapid = config.webPushVapid;
+  if (vapid === null) {
+    return false;
+  }
+  if (!vapidConfigured) {
+    webPush.setVapidDetails(vapid.contact, vapid.publicKey, vapid.privateKey);
+    vapidConfigured = true;
+  }
+  return true;
+}
+
+/** Reads HTTP status from web-push send failures (single assertion for library error shape). */
+function getWebPushErrorStatusCode(err: unknown): number | undefined {
+  if (err === null || typeof err !== 'object' || !('statusCode' in err)) {
+    return undefined;
+  }
+  const status = (err as { statusCode: unknown }).statusCode;
+  return typeof status === 'number' ? status : undefined;
+}
+
+export async function sendWebPushForNewBucketMessage(input: {
+  bucketId: string;
+  message: BucketMessage;
+}): Promise<void> {
+  if (!ensureVapidConfigured()) {
+    return;
+  }
+
+  const preferences = await BucketNotificationPreferenceService.listByBucket(input.bucketId);
+  const enabledUserIds = preferences.filter((p) => p.enabled).map((p) => p.userId);
+  if (enabledUserIds.length === 0) {
+    return;
+  }
+
+  const bucket = await BucketService.findById(input.bucketId);
+  if (bucket === null) {
+    return;
+  }
+
+  const payload = JSON.stringify({
+    type: 'bucket_boost_message',
+    bucketId: bucket.id,
+    bucketIdText: bucket.idText,
+    messageGuid: input.message.messageGuid,
+  });
+
+  /* Intersection documents batch list API; root `@metaboost/orm` typings come from `dist` — run `npm run build -w @metaboost/orm` if your IDE still shows a stale surface. */
+  const subscriptionService =
+    UserWebPushSubscriptionService as typeof UserWebPushSubscriptionService & {
+      listByUserIds: (userIds: string[]) => Promise<UserWebPushSubscription[]>;
+    };
+  const subscriptions = await subscriptionService.listByUserIds(enabledUserIds);
+  if (subscriptions.length === 0) {
+    return;
+  }
+
+  const sendResults = await Promise.allSettled(
+    subscriptions.map((sub: UserWebPushSubscription) =>
+      webPush.sendNotification(
+        {
+          endpoint: sub.endpoint,
+          keys: {
+            p256dh: sub.keyP256dh,
+            auth: sub.keyAuth,
+          },
+        },
+        payload
+      )
+    )
+  );
+
+  for (let i = 0; i < sendResults.length; i++) {
+    const settled = sendResults[i];
+    const sub = subscriptions[i];
+    if (settled === undefined || sub === undefined) {
+      continue;
+    }
+    if (settled.status === 'fulfilled') {
+      continue;
+    }
+    const statusCode = getWebPushErrorStatusCode(settled.reason);
+    if (statusCode === 404 || statusCode === 410) {
+      await UserWebPushSubscriptionService.delete(sub.id, sub.userId);
+    } else {
+      logger.error('webPushChannel: sendNotification failed', {
+        userId: sub.userId,
+        statusCode,
+        err: settled.reason,
+      });
+    }
+  }
+}
diff --git a/apps/api/src/lib/standardIngest/persistBoostMessage.ts b/apps/api/src/lib/standardIngest/persistBoostMessage.ts
index 72e3d7ed..8aa4995f 100644
--- a/apps/api/src/lib/standardIngest/persistBoostMessage.ts
+++ b/apps/api/src/lib/standardIngest/persistBoostMessage.ts
@@ -5,6 +5,7 @@ import { MAX_PUBLIC_BOOST_DISPLAY_MINIMUM_MINOR } from '@metaboost/helpers';
 import { BucketMessageService, BucketService } from '@metaboost/orm';
 
 import { convertToBaselineMinorAmount, getExchangeRates } from '../exchangeRates.js';
+import { notifyNewBucketMessage } from '../notifications/notifyNewBucketMessage.js';
 
 type NormalizedCurrency = { currency: string; amountUnit: string };
 
@@ -99,5 +100,11 @@ export async function persistStandardBoostMessage(input: {
     timePosition: body.time_position ?? null,
   });
 
+  void notifyNewBucketMessage({ bucketId: targetBucketId, message: storedMessage }).catch(
+    (err: unknown) => {
+      console.error('persistStandardBoostMessage: notifyNewBucketMessage failed', err);
+    }
+  );
+
   return { streamResponse: false, messageGuid: storedMessage.id };
 }
diff --git a/apps/api/src/lib/startup/validation.ts b/apps/api/src/lib/startup/validation.ts
index 75c64712..3c14e595 100644
--- a/apps/api/src/lib/startup/validation.ts
+++ b/apps/api/src/lib/startup/validation.ts
@@ -387,17 +387,22 @@ function apiValidationResults(): ValidationResult[] {
     validateRequired('DB_APP_READ_WRITE_USER', 'Database'),
     validateRequired('DB_APP_READ_WRITE_PASSWORD', 'Database'),
     validateRequired('KEYVALDB_PASSWORD', 'Valkey'),
+    // Env seeds missing DB rows only; optional. Same semantics as management-api bootstrap vars.
     validateOptionalPositiveNumber(
-      'MEMBERSHIP_DEFAULT_TRIAL_MONTHS',
-      'Membership defaults',
+      'MEMBERSHIP_FREE_TRIAL_EXPIRATION',
+      'Membership bootstrap (seconds; seeds DB when row missing)',
       1,
-      120
+      31_536_000
     ),
     validateOptionalPositiveNumber(
-      'MEMBERSHIP_DEFAULT_PREMIUM_MONTHS',
-      'Membership defaults',
-      1,
-      120
+      'MEMBERSHIP_PREMIUM_COST_MONTHLY',
+      'Membership bootstrap pricing (seeds DB when price missing)',
+      0
+    ),
+    validateOptionalPositiveNumber(
+      'MEMBERSHIP_PREMIUM_COST_ANNUALLY',
+      'Membership bootstrap pricing (seeds DB when price missing)',
+      0
     ),
   ];
   const accountSignupMode = resolveAccountSignupMode();
diff --git a/apps/api/src/middleware/auth.ts b/apps/api/src/middleware/auth.ts
new file mode 100644
index 00000000..f968af0d
--- /dev/null
+++ b/apps/api/src/middleware/auth.ts
@@ -0,0 +1,14 @@
+import type { UserWithRelations } from '@metaboost/orm';
+import type { Request, Response } from 'express';
+
+/**
+ * Handlers mounted after requireAuth should always have req.user set; this guard
+ * keeps TypeScript narrow and preserves a consistent 401 JSON shape if wiring changes.
+ */
+export function requireUser(req: Request, res: Response): UserWithRelations | null {
+  if (req.user === undefined) {
+    res.status(401).json({ message: 'Authentication required' });
+    return null;
+  }
+  return req.user;
+}
diff --git a/apps/api/src/openapi.ts b/apps/api/src/openapi.ts
index 2783102d..5b90e5fb 100644
--- a/apps/api/src/openapi.ts
+++ b/apps/api/src/openapi.ts
@@ -168,6 +168,65 @@ export const openApiDocument = {
         type: 'object',
         properties: { token: { type: 'string' } },
       },
+      WebPushSubscriptionKeys: {
+        type: 'object',
+        required: ['p256dh', 'auth'],
+        properties: {
+          p256dh: { type: 'string', minLength: 1 },
+          auth: { type: 'string', minLength: 1 },
+        },
+      },
+      WebPushSubscriptionPublic: {
+        type: 'object',
+        properties: {
+          id: { type: 'string', format: 'uuid' },
+          endpoint: { type: 'string', description: 'Push service URL for this subscription' },
+          locale: { type: 'string', nullable: true },
+          createdAt: { type: 'string', format: 'date-time' },
+          updatedAt: { type: 'string', format: 'date-time' },
+        },
+      },
+      UpsertWebPushSubscriptionBody: {
+        type: 'object',
+        required: ['endpoint', 'keys'],
+        properties: {
+          endpoint: { type: 'string', format: 'uri', maxLength: 2048 },
+          keys: { $ref: '#/components/schemas/WebPushSubscriptionKeys' },
+          locale: { type: 'string', nullable: true },
+        },
+      },
+      UpdateWebPushSubscriptionBody: {
+        type: 'object',
+        properties: {
+          endpoint: { type: 'string', format: 'uri', maxLength: 2048 },
+          keys: { $ref: '#/components/schemas/WebPushSubscriptionKeys' },
+          locale: { type: 'string', nullable: true },
+        },
+      },
+      BucketNotificationPreferenceGetResponse: {
+        type: 'object',
+        properties: {
+          bucketId: { type: 'string', format: 'uuid' },
+          enabled: { type: 'boolean' },
+          hasExplicitPreference: { type: 'boolean' },
+        },
+      },
+      UpdateBucketNotificationPreferenceBody: {
+        type: 'object',
+        required: ['enabled'],
+        properties: {
+          enabled: { type: 'boolean' },
+          applyToDescendants: { type: 'boolean' },
+        },
+      },
+      BucketNotificationPreferencePatchResponse: {
+        type: 'object',
+        properties: {
+          bucketId: { type: 'string', format: 'uuid' },
+          enabled: { type: 'boolean' },
+          applyToDescendants: { type: 'boolean' },
+        },
+      },
       ErrorMessage: {
         type: 'object',
         properties: { message: { type: 'string' } },
@@ -327,6 +386,84 @@ export const openApiDocument = {
           metadata: { $ref: '#/components/schemas/ConversionMetadata' },
         },
       },
+      ResolvedProductMembership: {
+        type: 'object',
+        description:
+          'DB-resolved trial window (seconds) and premium list prices (major currency units). Env bootstraps missing rows only.',
+        required: [
+          'freeTrialExpirationSeconds',
+          'premiumMembershipCostMonthly',
+          'premiumMembershipCostAnnually',
+        ],
+        properties: {
+          freeTrialExpirationSeconds: { type: 'integer', minimum: 1 },
+          premiumMembershipCostMonthly: { type: 'number', minimum: 0 },
+          premiumMembershipCostAnnually: { type: 'number', minimum: 0 },
+        },
+      },
+      PublicProductMembershipReadModel: {
+        allOf: [
+          { $ref: '#/components/schemas/ResolvedProductMembership' },
+          {
+            type: 'object',
+            required: ['listPriceCurrencyCode', 'selfServePublicSignupOpen'],
+            properties: {
+              listPriceCurrencyCode: { type: 'string', enum: ['USD'] },
+              selfServePublicSignupOpen: {
+                type: 'boolean',
+                description:
+                  'When false, anonymous clients must not treat premium list prices as actionable for self-serve signup.',
+              },
+            },
+          },
+        ],
+      },
+      PublicProductMembershipResponse: {
+        type: 'object',
+        required: ['data'],
+        properties: {
+          data: { $ref: '#/components/schemas/PublicProductMembershipReadModel' },
+        },
+      },
+      AuthenticatedBillingMembershipReadModel: {
+        type: 'object',
+        required: ['listPriceCurrencyCode', 'membership', 'renewal', 'catalog'],
+        properties: {
+          listPriceCurrencyCode: { type: 'string', enum: ['USD'] },
+          membership: {
+            type: 'object',
+            required: ['tier', 'expiresAtIso', 'premiumBillingCadence', 'autoRenewMode'],
+            properties: {
+              tier: { type: 'string' },
+              expiresAtIso: { type: 'string', format: 'date-time', nullable: true },
+              premiumBillingCadence: {
+                type: 'string',
+                nullable: true,
+                enum: ['monthly', 'annual'],
+              },
+              autoRenewMode: { type: 'string', enum: ['off', 'on'] },
+            },
+          },
+          renewal: {
+            type: 'object',
+            required: ['lastStatus', 'lastAttemptAtIso', 'nextAttemptAtIso', 'retryCount'],
+            properties: {
+              lastStatus: { type: 'string', enum: ['none', 'succeeded', 'failed'] },
+              lastAttemptAtIso: { type: 'string', format: 'date-time', nullable: true },
+              nextAttemptAtIso: { type: 'string', format: 'date-time', nullable: true },
+              retryCount: { type: 'integer', minimum: 0 },
+            },
+          },
+          catalog: { $ref: '#/components/schemas/ResolvedProductMembership' },
+        },
+      },
+      AuthenticatedBillingMembershipResponse: {
+        type: 'object',
+        required: ['data'],
+        properties: {
+          data: { $ref: '#/components/schemas/AuthenticatedBillingMembershipReadModel' },
+        },
+      },
     },
   },
   paths: {
@@ -376,6 +513,24 @@ export const openApiDocument = {
         },
       },
     },
+    '/product/membership': {
+      get: {
+        summary: 'Public product membership read model',
+        description:
+          'Unauthenticated read model: resolved trial length and USD premium list prices (DB-first), flattened under data with list currency and signup visibility.',
+        operationId: 'getPublicProductMembership',
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/PublicProductMembershipResponse' },
+              },
+            },
+          },
+        },
+      },
+    },
     '/auth/login': {
       post: {
         summary: 'Login',
@@ -469,6 +624,189 @@ export const openApiDocument = {
         },
       },
     },
+    '/auth/web-push-subscriptions': {
+      get: {
+        summary: 'List Web Push subscriptions for the authenticated account',
+        operationId: 'listWebPushSubscriptions',
+        security: [{ bearerAuth: [] }],
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: {
+                  type: 'object',
+                  properties: {
+                    subscriptions: {
+                      type: 'array',
+                      items: { $ref: '#/components/schemas/WebPushSubscriptionPublic' },
+                    },
+                  },
+                  required: ['subscriptions'],
+                },
+              },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+      post: {
+        summary: 'Register or refresh a Web Push subscription (upsert by endpoint)',
+        operationId: 'upsertWebPushSubscription',
+        security: [{ bearerAuth: [] }],
+        requestBody: {
+          required: true,
+          content: {
+            'application/json': {
+              schema: { $ref: '#/components/schemas/UpsertWebPushSubscriptionBody' },
+            },
+          },
+        },
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: {
+                  type: 'object',
+                  properties: {
+                    subscription: { $ref: '#/components/schemas/WebPushSubscriptionPublic' },
+                  },
+                  required: ['subscription'],
+                },
+              },
+            },
+          },
+          '400': {
+            description: 'Validation error',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+    },
+    '/auth/web-push-subscriptions/{subscriptionId}': {
+      patch: {
+        summary: 'Update a Web Push subscription owned by the authenticated account',
+        operationId: 'updateWebPushSubscription',
+        security: [{ bearerAuth: [] }],
+        parameters: [
+          {
+            name: 'subscriptionId',
+            in: 'path',
+            required: true,
+            schema: { type: 'string', format: 'uuid' },
+          },
+        ],
+        requestBody: {
+          required: true,
+          content: {
+            'application/json': {
+              schema: { $ref: '#/components/schemas/UpdateWebPushSubscriptionBody' },
+            },
+          },
+        },
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: {
+                  type: 'object',
+                  properties: {
+                    subscription: { $ref: '#/components/schemas/WebPushSubscriptionPublic' },
+                  },
+                  required: ['subscription'],
+                },
+              },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '404': {
+            description: 'Subscription not found',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+      delete: {
+        summary: 'Delete a Web Push subscription',
+        operationId: 'deleteWebPushSubscription',
+        security: [{ bearerAuth: [] }],
+        parameters: [
+          {
+            name: 'subscriptionId',
+            in: 'path',
+            required: true,
+            schema: { type: 'string', format: 'uuid' },
+          },
+        ],
+        responses: {
+          '204': { description: 'Deleted' },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '404': {
+            description: 'Subscription not found',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+    },
+    '/auth/billing/membership-summary': {
+      get: {
+        summary: 'Authenticated billing membership read model',
+        description:
+          'Membership tier, renewal metadata, and resolved catalog pricing (client-safe; instant fields are ISO 8601 UTC).',
+        operationId: 'getAuthenticatedBillingMembershipSummary',
+        security: [{ bearerAuth: [] }],
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/AuthenticatedBillingMembershipResponse' },
+              },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '404': {
+            description: 'Trust settings missing',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+    },
     '/auth/terms-acceptance': {
       patch: {
         summary: 'Accept latest Terms of Service',
@@ -989,6 +1327,110 @@ export const openApiDocument = {
         },
       },
     },
+    '/buckets/{bucketId}/notification-preference': {
+      get: {
+        summary: 'Current user bucket notification preference',
+        description:
+          'Returns whether the authenticated user has notifications enabled for this bucket (default false when unset).',
+        operationId: 'getBucketNotificationPreference',
+        security: [{ bearerAuth: [] }],
+        parameters: [
+          {
+            name: 'bucketId',
+            in: 'path',
+            required: true,
+            schema: { type: 'string' },
+            description: 'Bucket id (UUID) or short id',
+          },
+        ],
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/BucketNotificationPreferenceGetResponse' },
+              },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '403': {
+            description: 'Forbidden',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '404': {
+            description: 'Bucket not found',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+      patch: {
+        summary: 'Update bucket notification preference',
+        description:
+          'Upserts per-user preference for this bucket. Optionally applies the same enabled flag to all descendant buckets.',
+        operationId: 'updateBucketNotificationPreference',
+        security: [{ bearerAuth: [] }],
+        parameters: [
+          {
+            name: 'bucketId',
+            in: 'path',
+            required: true,
+            schema: { type: 'string' },
+            description: 'Bucket id (UUID) or short id',
+          },
+        ],
+        requestBody: {
+          required: true,
+          content: {
+            'application/json': {
+              schema: { $ref: '#/components/schemas/UpdateBucketNotificationPreferenceBody' },
+            },
+          },
+        },
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/BucketNotificationPreferencePatchResponse' },
+              },
+            },
+          },
+          '400': {
+            description: 'Validation error',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '403': {
+            description: 'Forbidden',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '404': {
+            description: 'Bucket not found',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+    },
     '/buckets/{bucketId}/blocked-senders': {
       get: {
         summary: 'List blocked senders',
diff --git a/apps/api/src/routes/auth.ts b/apps/api/src/routes/auth.ts
index d74a35a5..797e732a 100644
--- a/apps/api/src/routes/auth.ts
+++ b/apps/api/src/routes/auth.ts
@@ -4,6 +4,8 @@ import type { RequestHandler } from 'express';
 import { Router } from 'express';
 
 import * as authController from '../controllers/authController.js';
+import * as billingController from '../controllers/billingController.js';
+import * as webPushSubscriptionsController from '../controllers/webPushSubscriptionsController.js';
 import { asyncHandler } from '../middleware/asyncHandler.js';
 import { moderateAuthRateLimiter, strictAuthRateLimiter } from '../middleware/rateLimit.js';
 import { validateBody } from '../middleware/validateBody.js';
@@ -20,6 +22,10 @@ import {
   confirmEmailChangeSchema,
   verifyEmailSchema,
 } from '../schemas/auth.js';
+import {
+  updateWebPushSubscriptionSchema,
+  upsertWebPushSubscriptionSchema,
+} from '../schemas/webPushSubscriptions.js';
 
 export function createAuthRouter(
   requireAuthMiddleware: RequestHandler,
@@ -49,6 +55,33 @@ export function createAuthRouter(
     asyncHandler(authController.changePassword)
   );
   router.get('/me', requireAuthMiddleware, asyncHandler(authController.me));
+  router.get(
+    '/web-push-subscriptions',
+    requireAuthMiddleware,
+    asyncHandler(webPushSubscriptionsController.listWebPushSubscriptions)
+  );
+  router.post(
+    '/web-push-subscriptions',
+    requireAuthMiddleware,
+    validateBody(upsertWebPushSubscriptionSchema),
+    asyncHandler(webPushSubscriptionsController.upsertWebPushSubscription)
+  );
+  router.patch(
+    '/web-push-subscriptions/:subscriptionId',
+    requireAuthMiddleware,
+    validateBody(updateWebPushSubscriptionSchema),
+    asyncHandler(webPushSubscriptionsController.updateWebPushSubscription)
+  );
+  router.delete(
+    '/web-push-subscriptions/:subscriptionId',
+    requireAuthMiddleware,
+    asyncHandler(webPushSubscriptionsController.deleteWebPushSubscription)
+  );
+  router.get(
+    '/billing/membership-summary',
+    requireAuthMiddleware,
+    asyncHandler(billingController.membershipSummary)
+  );
   router.get(
     '/username-available',
     moderateAuthRateLimiter,
diff --git a/apps/api/src/routes/buckets.ts b/apps/api/src/routes/buckets.ts
index 303a69ad..aea138b7 100644
--- a/apps/api/src/routes/buckets.ts
+++ b/apps/api/src/routes/buckets.ts
@@ -24,6 +24,7 @@ import {
   updateBucketRoleSchema,
   addBlockedAppSchema,
   addBlockedSenderSchema,
+  updateBucketNotificationPreferenceSchema,
 } from '../schemas/buckets.js';
 
 export function createBucketsRouter(requireAuthMiddleware: RequestHandler): Router {
@@ -73,6 +74,18 @@ export function createBucketsRouter(requireAuthMiddleware: RequestHandler): Rout
     asyncHandler(bucketsController.verifyRssChannel)
   );
 
+  router.get(
+    '/:bucketId/notification-preference',
+    requireAuthMiddleware,
+    asyncHandler(bucketsController.getBucketNotificationPreference)
+  );
+  router.patch(
+    '/:bucketId/notification-preference',
+    requireAuthMiddleware,
+    validateBody(updateBucketNotificationPreferenceSchema),
+    asyncHandler(bucketsController.updateBucketNotificationPreference)
+  );
+
   router.get(
     '/:bucketId/admins',
     requireAuthMiddleware,
diff --git a/apps/api/src/routes/product.ts b/apps/api/src/routes/product.ts
new file mode 100644
index 00000000..0bd2f478
--- /dev/null
+++ b/apps/api/src/routes/product.ts
@@ -0,0 +1,13 @@
+import { Router } from 'express';
+
+import * as productController from '../controllers/productController.js';
+import { asyncHandler } from '../middleware/asyncHandler.js';
+
+/**
+ * Unauthenticated product/membership read routes (public resolved trial/pricing read model).
+ */
+export function createProductRouter(): Router {
+  const router = Router();
+  router.get('/membership', asyncHandler(productController.getPublicProductMembership));
+  return router;
+}
diff --git a/apps/api/src/schemas/buckets.ts b/apps/api/src/schemas/buckets.ts
index c7481975..c06d38c8 100644
--- a/apps/api/src/schemas/buckets.ts
+++ b/apps/api/src/schemas/buckets.ts
@@ -1,3 +1,9 @@
+import type {
+  BucketNotificationPreferencePatchResponse,
+  BucketNotificationPreferenceResponse,
+  UpdateBucketNotificationPreferenceBody,
+} from '@metaboost/helpers-requests';
+
 import Joi from 'joi';
 
 import {
@@ -117,6 +123,11 @@ export const addBlockedAppSchema = Joi.object({
   appNameSnapshot: Joi.string().max(SHORT_TEXT_MAX_LENGTH).allow(null, '').optional(),
 });
 
+export const updateBucketNotificationPreferenceSchema = Joi.object({
+  enabled: Joi.boolean().required(),
+  applyToDescendants: Joi.boolean().optional(),
+});
+
 export type CreateBucketBody =
   | { type: 'rss-network'; name: string; isPublic?: boolean }
   | { type: 'rss-channel'; rssFeedUrl: string; isPublic?: boolean }
@@ -155,9 +166,16 @@ export type CreateBucketRoleBody = {
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
 };
+
 export type UpdateBucketRoleBody = {
   name?: string;
   bucketCrud?: number;
   bucketMessagesCrud?: number;
   bucketAdminsCrud?: number;
 };
+
+export type {
+  BucketNotificationPreferencePatchResponse,
+  BucketNotificationPreferenceResponse,
+  UpdateBucketNotificationPreferenceBody,
+};
diff --git a/apps/api/src/schemas/webPushSubscriptions.ts b/apps/api/src/schemas/webPushSubscriptions.ts
new file mode 100644
index 00000000..91224fb8
--- /dev/null
+++ b/apps/api/src/schemas/webPushSubscriptions.ts
@@ -0,0 +1,29 @@
+import type {
+  UpsertWebPushSubscriptionBody,
+  UpdateWebPushSubscriptionBody,
+} from '@metaboost/helpers-requests';
+
+import Joi from 'joi';
+
+import { SHORT_TEXT_MAX_LENGTH, URL_MAX_LENGTH } from '@metaboost/helpers';
+
+const webPushKey = Joi.string().min(1);
+
+const webPushKeysObject = Joi.object({
+  p256dh: webPushKey.required(),
+  auth: webPushKey.required(),
+});
+
+export const upsertWebPushSubscriptionSchema = Joi.object({
+  endpoint: Joi.string().uri().max(URL_MAX_LENGTH).required(),
+  keys: webPushKeysObject.required(),
+  locale: Joi.string().max(SHORT_TEXT_MAX_LENGTH).allow(null, '').optional(),
+});
+
+export const updateWebPushSubscriptionSchema = Joi.object({
+  endpoint: Joi.string().uri().max(URL_MAX_LENGTH).optional(),
+  keys: webPushKeysObject.optional(),
+  locale: Joi.string().max(SHORT_TEXT_MAX_LENGTH).allow(null, '').optional(),
+}).min(1);
+
+export type { UpsertWebPushSubscriptionBody, UpdateWebPushSubscriptionBody };
diff --git a/apps/api/src/test/billing-membership-summary.test.ts b/apps/api/src/test/billing-membership-summary.test.ts
new file mode 100644
index 00000000..d994eeb2
--- /dev/null
+++ b/apps/api/src/test/billing-membership-summary.test.ts
@@ -0,0 +1,69 @@
+/**
+ * Authenticated billing membership read model (GET /auth/billing/membership-summary).
+ */
+import request from 'supertest';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import { MembershipTier } from '@metaboost/helpers';
+import { UserService } from '@metaboost/orm';
+
+import { hashPassword } from '../lib/auth/hash.js';
+import { restoreDefaultApiTestProcessEnv } from './helpers/apiTestAuthEnv.js';
+import { createApiLoginAgent } from './helpers/login-agent.js';
+import { createApiTestApp, destroyApiTestDataSources } from './helpers/setup.js';
+
+const FILE_PREFIX = 'billing-summary';
+
+describe('GET /auth/billing/membership-summary', () => {
+  let app: Awaited<ReturnType<typeof createApiTestApp>>;
+  let API: string;
+  const email = `${FILE_PREFIX}-${Date.now()}@example.com`;
+  const password = `${FILE_PREFIX}-password-1`;
+
+  beforeAll(async () => {
+    restoreDefaultApiTestProcessEnv();
+    const { config } = await import('../config/index.js');
+    API = config.apiVersionPath;
+    app = await createApiTestApp();
+    const hashed = await hashPassword(password);
+    await UserService.create({
+      email,
+      password: hashed,
+      displayName: 'Billing Summary User',
+      membershipTier: MembershipTier.Trial,
+    });
+  });
+
+  afterAll(async () => {
+    await destroyApiTestDataSources();
+    restoreDefaultApiTestProcessEnv();
+  });
+
+  it('returns 401 without session', async () => {
+    const res = await request(app).get(`${API}/auth/billing/membership-summary`).expect(401);
+    expect(res.body).toMatchObject({ message: 'Authentication required' });
+  });
+
+  it('returns nested membership, renewal, and catalog pricing when authenticated', async () => {
+    const agent = await createApiLoginAgent(app, { email, password });
+    const res = await agent.get(`${API}/auth/billing/membership-summary`).expect(200);
+    expect(res.body.data.listPriceCurrencyCode).toBe('USD');
+    expect(res.body.data.membership).toMatchObject({
+      tier: 'trial',
+      expiresAtIso: expect.any(String),
+      premiumBillingCadence: null,
+      autoRenewMode: expect.stringMatching(/^(off|on)$/),
+    });
+    expect(res.body.data.renewal).toMatchObject({
+      lastStatus: 'none',
+      lastAttemptAtIso: null,
+      nextAttemptAtIso: null,
+      retryCount: expect.any(Number),
+    });
+    expect(res.body.data.catalog).toMatchObject({
+      freeTrialExpirationSeconds: expect.any(Number),
+      premiumMembershipCostMonthly: expect.any(Number),
+      premiumMembershipCostAnnually: expect.any(Number),
+    });
+  });
+});
diff --git a/apps/api/src/test/billing-renewal-orchestrator.test.ts b/apps/api/src/test/billing-renewal-orchestrator.test.ts
new file mode 100644
index 00000000..735a85ae
--- /dev/null
+++ b/apps/api/src/test/billing-renewal-orchestrator.test.ts
@@ -0,0 +1,207 @@
+import type { BillingRenewalProviderAdapter } from '@metaboost/helpers';
+
+/**
+ * Near-expiry renewal orchestration (stub adapter).
+ */
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import { MembershipTier } from '@metaboost/helpers';
+import {
+  UserService,
+  appDataSourceReadWrite,
+  BillingRenewalOrchestratorService,
+} from '@metaboost/orm';
+
+import { hashPassword } from '../lib/auth/hash.js';
+import { restoreDefaultApiTestProcessEnv } from './helpers/apiTestAuthEnv.js';
+import { createApiTestApp, destroyApiTestDataSources } from './helpers/setup.js';
+
+const FILE_PREFIX = 'billing-renewal';
+
+describe('BillingRenewalOrchestratorService', () => {
+  beforeAll(async () => {
+    restoreDefaultApiTestProcessEnv();
+    await createApiTestApp();
+  });
+
+  afterAll(async () => {
+    await destroyApiTestDataSources();
+    restoreDefaultApiTestProcessEnv();
+  });
+
+  it('extends premium membership when expiry is inside the lookahead window', async () => {
+    const email = `${FILE_PREFIX}-${Date.now()}@example.com`;
+    const password = `${FILE_PREFIX}-password-1`;
+    const hashed = await hashPassword(password);
+    const nearExpiry = new Date(Date.now() + 2 * 60 * 60 * 1000);
+    const user = await UserService.create({
+      email,
+      password: hashed,
+      displayName: 'Renewal User',
+      membershipTier: MembershipTier.Premium,
+      premiumBillingCadence: 'monthly',
+      membershipExpiresAt: nearExpiry,
+      autoRenew: true,
+    });
+
+    await appDataSourceReadWrite.query(
+      `
+      UPDATE user_trust_settings
+      SET billing_cadence = $1,
+          auto_renew_mode = $2,
+          membership_expires_at = $3
+      WHERE user_id = $4
+      `,
+      ['monthly', 'on', nearExpiry, user.id]
+    );
+
+    const orchestrator = new BillingRenewalOrchestratorService();
+    const summary = await orchestrator.processDueRenewals({
+      now: new Date(),
+      lookaheadHours: 24,
+    });
+
+    expect(summary.attempted).toBeGreaterThanOrEqual(1);
+    expect(summary.succeeded).toBeGreaterThanOrEqual(1);
+
+    const refreshed = await UserService.findById(user.id);
+    expect(refreshed?.trustSettings?.membershipExpiresAt).not.toBeNull();
+    expect(refreshed?.trustSettings?.membershipExpiresAt?.getTime() ?? 0).toBeGreaterThan(
+      nearExpiry.getTime()
+    );
+
+    const events = (await appDataSourceReadWrite.query(
+      `
+      SELECT event_type
+      FROM billing_domain_event
+      WHERE user_id = $1
+      ORDER BY id DESC
+      LIMIT 5
+      `,
+      [user.id]
+    )) as Array<{ event_type: string }>;
+    const types = events.map((row) => row.event_type);
+    expect(types).toContain('renewal_succeeded');
+  });
+
+  it('does not select premium users whose expiry is beyond the lookahead horizon', async () => {
+    const email = `${FILE_PREFIX}-far-${Date.now()}@example.com`;
+    const password = `${FILE_PREFIX}-password-1`;
+    const hashed = await hashPassword(password);
+    const farExpiry = new Date(Date.now() + 14 * 24 * 60 * 60 * 1000);
+    const user = await UserService.create({
+      email,
+      password: hashed,
+      displayName: 'Far Expiry User',
+      membershipTier: MembershipTier.Premium,
+      premiumBillingCadence: 'monthly',
+      membershipExpiresAt: farExpiry,
+      autoRenew: true,
+    });
+
+    await appDataSourceReadWrite.query(
+      `
+      UPDATE user_trust_settings
+      SET billing_cadence = $1,
+          auto_renew_mode = $2,
+          membership_expires_at = $3
+      WHERE user_id = $4
+      `,
+      ['monthly', 'on', farExpiry, user.id]
+    );
+
+    const now = new Date();
+    const lookaheadHours = 24;
+    const horizon = new Date(now.getTime() + lookaheadHours * 60 * 60 * 1000);
+
+    const eligible = (await appDataSourceReadWrite.query(
+      `
+      SELECT user_id
+      FROM user_trust_settings
+      WHERE user_id = $1
+        AND membership_tier = $2
+        AND auto_renew_mode = $3
+        AND billing_cadence IS NOT NULL
+        AND membership_expires_at IS NOT NULL
+        AND membership_expires_at > $4
+        AND membership_expires_at <= $5
+      `,
+      [user.id, MembershipTier.Premium, 'on', now, horizon]
+    )) as Array<{ user_id: string }>;
+
+    expect(eligible.length).toBe(0);
+  });
+
+  it('records renewal_failed and schedules retry when the adapter returns failed', async () => {
+    const email = `${FILE_PREFIX}-fail-${Date.now()}@example.com`;
+    const password = `${FILE_PREFIX}-password-1`;
+    const hashed = await hashPassword(password);
+    const nearExpiry = new Date(Date.now() + 2 * 60 * 60 * 1000);
+    const user = await UserService.create({
+      email,
+      password: hashed,
+      displayName: 'Renewal Fail User',
+      membershipTier: MembershipTier.Premium,
+      premiumBillingCadence: 'monthly',
+      membershipExpiresAt: nearExpiry,
+      autoRenew: true,
+    });
+
+    await appDataSourceReadWrite.query(
+      `
+      UPDATE user_trust_settings
+      SET billing_cadence = $1,
+          auto_renew_mode = $2,
+          membership_expires_at = $3,
+          renewal_retry_count = 0,
+          next_renewal_attempt_at = NULL,
+          renewal_retry_backoff_until = NULL
+      WHERE user_id = $4
+      `,
+      ['monthly', 'on', nearExpiry, user.id]
+    );
+
+    const failingAdapter: BillingRenewalProviderAdapter = {
+      async attemptRenewal() {
+        return { status: 'failed', retryAfterSeconds: 120 };
+      },
+    };
+
+    const orchestrator = new BillingRenewalOrchestratorService(failingAdapter);
+    const summary = await orchestrator.processDueRenewals({
+      now: new Date(),
+      lookaheadHours: 24,
+    });
+
+    expect(summary.failed).toBeGreaterThanOrEqual(1);
+
+    const trustRows = (await appDataSourceReadWrite.query(
+      `
+      SELECT renewal_retry_count, next_renewal_attempt_at, last_renewal_status
+      FROM user_trust_settings
+      WHERE user_id = $1
+      `,
+      [user.id]
+    )) as Array<{
+      renewal_retry_count: number;
+      next_renewal_attempt_at: Date | null;
+      last_renewal_status: string;
+    }>;
+
+    expect(trustRows[0]?.renewal_retry_count).toBeGreaterThanOrEqual(1);
+    expect(trustRows[0]?.next_renewal_attempt_at).not.toBeNull();
+    expect(trustRows[0]?.last_renewal_status).toBe('failed');
+
+    const failEvents = (await appDataSourceReadWrite.query(
+      `
+      SELECT event_type
+      FROM billing_domain_event
+      WHERE user_id = $1
+      ORDER BY id DESC
+      LIMIT 5
+      `,
+      [user.id]
+    )) as Array<{ event_type: string }>;
+    expect(failEvents.map((row) => row.event_type)).toContain('renewal_failed');
+  });
+});
diff --git a/apps/api/src/test/helpers/setup.ts b/apps/api/src/test/helpers/setup.ts
index 9af7c7bf..757bd3b6 100644
--- a/apps/api/src/test/helpers/setup.ts
+++ b/apps/api/src/test/helpers/setup.ts
@@ -1,6 +1,7 @@
 import {
   appDataSourceRead,
   appDataSourceReadWrite,
+  BillingPriceCatalogService,
   DEFAULT_TERMS_LOCALIZED_CONTENT,
   DEFAULT_TERMS_TITLE,
   DEFAULT_TERMS_VERSION_KEY,
@@ -23,6 +24,7 @@ export async function createApiTestApp(): Promise<ApiTestApp> {
     defaultTitle: DEFAULT_TERMS_TITLE,
     defaultLocalizedContent: DEFAULT_TERMS_LOCALIZED_CONTENT,
   });
+  await new BillingPriceCatalogService().resolveProductMembership(new Date());
   return createApp();
 }
 
diff --git a/apps/api/src/test/membership-period-extension.test.ts b/apps/api/src/test/membership-period-extension.test.ts
new file mode 100644
index 00000000..328e1000
--- /dev/null
+++ b/apps/api/src/test/membership-period-extension.test.ts
@@ -0,0 +1,76 @@
+/**
+ * Membership period extension idempotency (catalog billing surface).
+ */
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import { MembershipTier } from '@metaboost/helpers';
+import {
+  MembershipPeriodExtensionService,
+  UserService,
+  appDataSourceReadWrite,
+} from '@metaboost/orm';
+
+import { hashPassword } from '../lib/auth/hash.js';
+import { restoreDefaultApiTestProcessEnv } from './helpers/apiTestAuthEnv.js';
+import { createApiTestApp, destroyApiTestDataSources } from './helpers/setup.js';
+
+const FILE_PREFIX = 'membership-extension';
+
+describe('MembershipPeriodExtensionService.extendPremiumByCadence', () => {
+  beforeAll(async () => {
+    restoreDefaultApiTestProcessEnv();
+    await createApiTestApp();
+  });
+
+  afterAll(async () => {
+    await destroyApiTestDataSources();
+    restoreDefaultApiTestProcessEnv();
+  });
+
+  it('returns applied false when the same idempotency key is reused', async () => {
+    const email = `${FILE_PREFIX}-${Date.now()}@example.com`;
+    const password = `${FILE_PREFIX}-password-1`;
+    const hashed = await hashPassword(password);
+    const user = await UserService.create({
+      email,
+      password: hashed,
+      displayName: 'Extension Idempotency User',
+      membershipTier: MembershipTier.Premium,
+      premiumBillingCadence: 'monthly',
+      membershipExpiresAt: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000),
+      autoRenew: true,
+    });
+
+    const idempotencyKey = `${FILE_PREFIX}-idem-${Date.now()}`;
+
+    const first = await MembershipPeriodExtensionService.extendPremiumByCadence({
+      userId: user.id,
+      cadence: 'monthly',
+      idempotencyKey,
+      reason: 'payment_settled',
+    });
+
+    expect(first.applied).toBe(true);
+    expect(first.membershipExpiresAt).not.toBeNull();
+
+    const second = await MembershipPeriodExtensionService.extendPremiumByCadence({
+      userId: user.id,
+      cadence: 'monthly',
+      idempotencyKey,
+      reason: 'payment_settled',
+    });
+
+    expect(second.applied).toBe(false);
+    expect(second.membershipExpiresAt?.getTime()).toBe(first.membershipExpiresAt?.getTime());
+
+    const rows = (await appDataSourceReadWrite.query(
+      `
+      SELECT COUNT(*)::int AS c
+      FROM billing_domain_event
+      WHERE user_id = $1 AND idempotency_key = $2
+      `,
+      [user.id, idempotencyKey]
+    )) as Array<{ c: number }>;
+    expect(rows[0]?.c).toBe(1);
+  });
+});
diff --git a/apps/api/src/test/notification-webpush.test.ts b/apps/api/src/test/notification-webpush.test.ts
new file mode 100644
index 00000000..3cbe58fd
--- /dev/null
+++ b/apps/api/src/test/notification-webpush.test.ts
@@ -0,0 +1,479 @@
+import type { Mock } from 'vitest';
+
+/**
+ * API integration tests: bucket notification preferences, Web Push subscriptions, inheritance,
+ * apply-to-descendants, dispatch gating (threshold), and web-push send attempts.
+ */
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import webPush from 'web-push';
+
+import {
+  BucketAdminService,
+  BucketMessageService,
+  BucketNotificationPreferenceService,
+  BucketRSSChannelInfoService,
+  BucketService,
+  UserTermsAcceptanceService,
+  UserService,
+  UserWebPushSubscriptionService,
+} from '@metaboost/orm';
+
+import { config } from '../config/index.js';
+import { hashPassword } from '../lib/auth/hash.js';
+import { notifyNewBucketMessage } from '../lib/notifications/notifyNewBucketMessage.js';
+import { createApiLoginAgent } from './helpers/login-agent.js';
+import { createApiTestApp, destroyApiTestDataSources } from './helpers/setup.js';
+
+vi.mock('web-push', () => ({
+  default: {
+    setVapidDetails: vi.fn(),
+    sendNotification: vi.fn().mockResolvedValue(undefined),
+  },
+}));
+
+const API = config.apiVersionPath;
+const FILE_PREFIX = 'webpush';
+
+async function deleteAllWebPushSubscriptionsForUser(userId: string): Promise<void> {
+  const subs = await UserWebPushSubscriptionService.listByUser(userId);
+  for (const sub of subs) {
+    await UserWebPushSubscriptionService.delete(sub.id, userId);
+  }
+}
+
+describe('notification web push (API integration)', () => {
+  let app: Awaited<ReturnType<typeof createApiTestApp>>;
+  const ownerPassword = `${FILE_PREFIX}-pwd`;
+  let ownerEmail: string;
+  let ownerId: string;
+
+  beforeAll(async () => {
+    process.env.WEBPUSH_VAPID_PUBLIC_KEY = 'BP_notification_integration_public_xxxxx';
+    process.env.WEBPUSH_VAPID_PRIVATE_KEY = 'notification_integration_private_xxxxx';
+    process.env.WEBPUSH_VAPID_SUBJECT = 'mailto:notification-test@example.com';
+
+    app = await createApiTestApp();
+    ownerEmail = `${FILE_PREFIX}-owner-${Date.now()}@example.com`;
+    const hashed = await hashPassword(ownerPassword);
+    const owner = await UserService.create({
+      email: ownerEmail,
+      password: hashed,
+      displayName: 'WebPush Owner',
+    });
+    ownerId = owner.id;
+    await UserTermsAcceptanceService.recordAcceptanceForCurrentVersion(owner.id);
+  });
+
+  beforeEach(() => {
+    vi.mocked(webPush.sendNotification).mockClear();
+  });
+
+  afterAll(async () => {
+    delete process.env.WEBPUSH_VAPID_PUBLIC_KEY;
+    delete process.env.WEBPUSH_VAPID_PRIVATE_KEY;
+    delete process.env.WEBPUSH_VAPID_SUBJECT;
+    await destroyApiTestDataSources();
+  });
+
+  it('GET /buckets/:bucketId/notification-preference returns defaults before explicit preference', async () => {
+    const agent = await createApiLoginAgent(app, {
+      email: ownerEmail,
+      password: ownerPassword,
+    });
+    const bucket = await BucketService.createMbRoot({
+      ownerId,
+      name: 'Pref Root',
+      isPublic: true,
+    });
+    const res = await agent
+      .get(`${API}/buckets/${bucket.idText}/notification-preference`)
+      .expect(200);
+    expect(res.body.enabled).toBe(false);
+    expect(res.body.hasExplicitPreference).toBe(false);
+    expect(res.body.bucketId).toBe(bucket.id);
+  });
+
+  it('PATCH notification preference updates state for this bucket only', async () => {
+    const agent = await createApiLoginAgent(app, {
+      email: ownerEmail,
+      password: ownerPassword,
+    });
+    const bucket = await BucketService.createMbRoot({
+      ownerId,
+      name: 'Patch Solo Root',
+      isPublic: true,
+    });
+    await agent
+      .patch(`${API}/buckets/${bucket.idText}/notification-preference`)
+      .send({ enabled: true })
+      .expect(200);
+    const row = await BucketNotificationPreferenceService.findByUserAndBucket(ownerId, bucket.id);
+    expect(row?.enabled).toBe(true);
+    const getRes = await agent
+      .get(`${API}/buckets/${bucket.idText}/notification-preference`)
+      .expect(200);
+    expect(getRes.body.enabled).toBe(true);
+    expect(getRes.body.hasExplicitPreference).toBe(true);
+  });
+
+  it('PATCH with applyToDescendants updates all descendant buckets', async () => {
+    const agent = await createApiLoginAgent(app, {
+      email: ownerEmail,
+      password: ownerPassword,
+    });
+    const root = await BucketService.createMbRoot({
+      ownerId,
+      name: 'Desc Root',
+      isPublic: true,
+    });
+    const mid = await BucketService.createMbMid({
+      ownerId,
+      parentBucketId: root.id,
+      name: 'Desc Mid',
+      isPublic: true,
+    });
+    await BucketNotificationPreferenceService.upsert(ownerId, mid.id, false);
+    await agent
+      .patch(`${API}/buckets/${root.idText}/notification-preference`)
+      .send({ enabled: true, applyToDescendants: true })
+      .expect(200);
+    const midPref = await BucketNotificationPreferenceService.findByUserAndBucket(ownerId, mid.id);
+    expect(midPref?.enabled).toBe(true);
+    const rootPref = await BucketNotificationPreferenceService.findByUserAndBucket(
+      ownerId,
+      root.id
+    );
+    expect(rootPref?.enabled).toBe(true);
+  });
+
+  it('PATCH applyToDescendants bulk-upserts at least five descendants in one service call', async () => {
+    /* Vitest spy typing; ORM method exists at runtime after packages build. */
+    const bulkSpy = vi.spyOn(
+      BucketNotificationPreferenceService,
+      'upsertManyForUser' as never
+    ) as unknown as Mock;
+    const agent = await createApiLoginAgent(app, {
+      email: ownerEmail,
+      password: ownerPassword,
+    });
+    const root = await BucketService.createMbRoot({
+      ownerId,
+      name: 'Bulk Desc Root',
+      isPublic: true,
+    });
+    const descendantIds: string[] = [];
+    for (let i = 0; i < 5; i++) {
+      const child = await BucketService.createMbMid({
+        ownerId,
+        parentBucketId: root.id,
+        name: `Bulk Desc Mid ${i}`,
+        isPublic: true,
+      });
+      descendantIds.push(child.id);
+      await BucketNotificationPreferenceService.upsert(ownerId, child.id, false);
+    }
+    await agent
+      .patch(`${API}/buckets/${root.idText}/notification-preference`)
+      .send({ enabled: true, applyToDescendants: true })
+      .expect(200);
+    expect(bulkSpy).toHaveBeenCalledTimes(1);
+    const bulkCall = bulkSpy.mock.calls[0];
+    expect(bulkCall?.[0]).toBe(ownerId);
+    const bulkBucketIds = bulkCall?.[1];
+    expect(Array.isArray(bulkBucketIds)).toBe(true);
+    if (!Array.isArray(bulkBucketIds)) {
+      throw new Error('expected upsertManyForUser second argument to be bucket id array');
+    }
+    expect(bulkBucketIds).toEqual(expect.arrayContaining(descendantIds));
+    expect(bulkBucketIds).toHaveLength(descendantIds.length);
+    expect(bulkCall?.[2]).toBe(true);
+    for (const id of descendantIds) {
+      const pref = await BucketNotificationPreferenceService.findByUserAndBucket(ownerId, id);
+      expect(pref?.enabled).toBe(true);
+    }
+    bulkSpy.mockRestore();
+  });
+
+  it('PATCH without applyToDescendants leaves descendant preferences unchanged', async () => {
+    const agent = await createApiLoginAgent(app, {
+      email: ownerEmail,
+      password: ownerPassword,
+    });
+    const root = await BucketService.createMbRoot({
+      ownerId,
+      name: 'NoApply Root',
+      isPublic: true,
+    });
+    const mid = await BucketService.createMbMid({
+      ownerId,
+      parentBucketId: root.id,
+      name: 'NoApply Mid',
+      isPublic: true,
+    });
+    await BucketNotificationPreferenceService.upsert(ownerId, mid.id, false);
+    await agent
+      .patch(`${API}/buckets/${root.idText}/notification-preference`)
+      .send({ enabled: true, applyToDescendants: false })
+      .expect(200);
+    const midPref = await BucketNotificationPreferenceService.findByUserAndBucket(ownerId, mid.id);
+    expect(midPref?.enabled).toBe(false);
+    const rootPref = await BucketNotificationPreferenceService.findByUserAndBucket(
+      ownerId,
+      root.id
+    );
+    expect(rootPref?.enabled).toBe(true);
+  });
+
+  it('creating mb-mid child copies parent notification preferences', async () => {
+    const root = await BucketService.createMbRoot({
+      ownerId,
+      name: 'Inherit Mb Root',
+      isPublic: true,
+    });
+    await BucketNotificationPreferenceService.upsert(ownerId, root.id, true);
+    const mid = await BucketService.createMbMid({
+      ownerId,
+      parentBucketId: root.id,
+      name: 'Inherit Mb Mid',
+      isPublic: true,
+    });
+    const midPref = await BucketNotificationPreferenceService.findByUserAndBucket(ownerId, mid.id);
+    expect(midPref?.enabled).toBe(true);
+  });
+
+  it('creating rss-item child copies parent notification preferences', async () => {
+    const channel = await BucketService.createRssChannel({
+      ownerId,
+      name: 'Inherit Rss Channel',
+      isPublic: true,
+    });
+    await BucketRSSChannelInfoService.upsert({
+      bucketId: channel.id,
+      rssPodcastGuid: `rss-guid-${FILE_PREFIX}-${Date.now()}`,
+      rssChannelTitle: 'Channel Title',
+    });
+    await BucketNotificationPreferenceService.upsert(ownerId, channel.id, false);
+    const item = await BucketService.createRssItem({
+      ownerId,
+      parentBucketId: channel.id,
+      name: 'Inherit Rss Item',
+      isPublic: true,
+    });
+    const itemPref = await BucketNotificationPreferenceService.findByUserAndBucket(
+      ownerId,
+      item.id
+    );
+    expect(itemPref?.enabled).toBe(false);
+  });
+
+  it('authenticated web-push-subscriptions CRUD', async () => {
+    const agent = await createApiLoginAgent(app, {
+      email: ownerEmail,
+      password: ownerPassword,
+    });
+    const endpoint = `https://example.invalid/push/${FILE_PREFIX}-${Date.now()}`;
+    const upsertBody = {
+      endpoint,
+      keys: {
+        p256dh: 'BKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
+        auth: 'xxxxxxxxxxxxxxxxxxxx',
+      },
+      locale: 'en-US',
+    };
+    const postRes = await agent
+      .post(`${API}/auth/web-push-subscriptions`)
+      .send(upsertBody)
+      .expect(200);
+    const subscriptionUnknown = postRes.body.subscription;
+    expect(typeof subscriptionUnknown === 'object' && subscriptionUnknown !== null).toBe(true);
+    if (typeof subscriptionUnknown !== 'object' || subscriptionUnknown === null) {
+      throw new Error('expected subscription object in POST response');
+    }
+    const rawSubId = Reflect.get(subscriptionUnknown, 'id');
+    expect(typeof rawSubId === 'string' && rawSubId !== '').toBe(true);
+    if (typeof rawSubId !== 'string' || rawSubId === '') {
+      throw new Error('expected subscription id string');
+    }
+    const subId = rawSubId;
+
+    const loaded = await UserWebPushSubscriptionService.findByIdForUser(subId, ownerId);
+    expect(loaded).not.toBeNull();
+    expect(loaded?.id).toBe(subId);
+    expect(loaded?.endpoint).toBe(endpoint);
+
+    const listRes = await agent.get(`${API}/auth/web-push-subscriptions`).expect(200);
+    const subs = listRes.body.subscriptions as Array<{ id: string; endpoint: string }>;
+    expect(subs.some((s) => s.endpoint === endpoint)).toBe(true);
+
+    await agent
+      .patch(`${API}/auth/web-push-subscriptions/${subId}`)
+      .send({ locale: null })
+      .expect(200);
+
+    await agent.delete(`${API}/auth/web-push-subscriptions/${subId}`).expect(204);
+
+    const afterDel = await agent.get(`${API}/auth/web-push-subscriptions`).expect(200);
+    const subsAfter = afterDel.body.subscriptions as Array<{ endpoint: string }>;
+    expect(subsAfter.some((s) => s.endpoint === endpoint)).toBe(false);
+  });
+
+  it('notifyNewBucketMessage loads subscriptions once and sends to every endpoint across users', async () => {
+    const listSpy = vi.spyOn(
+      UserWebPushSubscriptionService,
+      'listByUserIds' as never
+    ) as unknown as Mock;
+    const bucket = await BucketService.createMbRoot({
+      ownerId,
+      name: 'Multi-subscriber Root',
+      isPublic: true,
+    });
+    await BucketService.update(bucket.id, { publicBoostDisplayMinimumMinor: 100 });
+
+    const otherEmailAddr = `${FILE_PREFIX}-other-${Date.now()}@example.com`;
+    const otherPassword = `${FILE_PREFIX}-other-pwd`;
+    const otherHashed = await hashPassword(otherPassword);
+    const otherUser = await UserService.create({
+      email: otherEmailAddr,
+      password: otherHashed,
+      displayName: 'WebPush Other',
+    });
+    await UserTermsAcceptanceService.recordAcceptanceForCurrentVersion(otherUser.id);
+    await BucketAdminService.create({
+      bucketId: bucket.id,
+      userId: otherUser.id,
+      bucketCrud: 1,
+      bucketMessagesCrud: 0,
+      bucketAdminsCrud: 0,
+    });
+
+    await BucketNotificationPreferenceService.upsert(ownerId, bucket.id, true);
+    await BucketNotificationPreferenceService.upsert(otherUser.id, bucket.id, true);
+
+    const ownerSubCount = 2;
+    const otherSubCount = 3;
+    for (let i = 0; i < ownerSubCount; i++) {
+      await UserWebPushSubscriptionService.upsert({
+        userId: ownerId,
+        endpoint: `https://example.invalid/push/${FILE_PREFIX}-multi-owner-${Date.now()}-${i}`,
+        keyP256dh: 'BKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
+        keyAuth: 'xxxxxxxxxxxxxxxxxxxx',
+        locale: null,
+      });
+    }
+    for (let j = 0; j < otherSubCount; j++) {
+      await UserWebPushSubscriptionService.upsert({
+        userId: otherUser.id,
+        endpoint: `https://example.invalid/push/${FILE_PREFIX}-multi-other-${Date.now()}-${j}`,
+        keyP256dh: 'BKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
+        keyAuth: 'xxxxxxxxxxxxxxxxxxxx',
+        locale: null,
+      });
+    }
+
+    const msg = await BucketMessageService.create({
+      bucketId: bucket.id,
+      senderName: 'Sender',
+      body: 'multi subscriber',
+      currency: 'USD',
+      amount: 10,
+      amountUnit: 'cents',
+      thresholdCurrencyAtCreate: 'USD',
+      thresholdAmountMinorAtCreate: 150,
+      action: 'boost',
+      appName: 'App',
+      senderGuid: 'c0eebc99-9c0b-4ef8-bb6d-6bb9bd380a33',
+    });
+
+    await notifyNewBucketMessage({ bucketId: bucket.id, message: msg });
+
+    expect(listSpy).toHaveBeenCalledTimes(1);
+    const listCall = listSpy.mock.calls[0];
+    const firstArg = listCall?.[0];
+    expect(Array.isArray(firstArg)).toBe(true);
+    if (!Array.isArray(firstArg)) {
+      throw new Error('expected listByUserIds first argument to be an array');
+    }
+    expect(firstArg).toHaveLength(2);
+    expect(firstArg).toEqual(expect.arrayContaining([ownerId, otherUser.id]));
+    expect(vi.mocked(webPush.sendNotification)).toHaveBeenCalledTimes(
+      ownerSubCount + otherSubCount
+    );
+    await deleteAllWebPushSubscriptionsForUser(ownerId);
+    await deleteAllWebPushSubscriptionsForUser(otherUser.id);
+    listSpy.mockRestore();
+  });
+
+  it('notifyNewBucketMessage triggers web-push send when preference enabled and boost meets threshold', async () => {
+    await deleteAllWebPushSubscriptionsForUser(ownerId);
+    const bucket = await BucketService.createMbRoot({
+      ownerId,
+      name: 'Dispatch Root',
+      isPublic: true,
+    });
+    await BucketService.update(bucket.id, { publicBoostDisplayMinimumMinor: 100 });
+    await BucketNotificationPreferenceService.upsert(ownerId, bucket.id, true);
+    const endpoint = `https://example.invalid/push/${FILE_PREFIX}-dispatch-${Date.now()}`;
+    await UserWebPushSubscriptionService.upsert({
+      userId: ownerId,
+      endpoint,
+      keyP256dh: 'BKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
+      keyAuth: 'xxxxxxxxxxxxxxxxxxxx',
+      locale: null,
+    });
+
+    const msg = await BucketMessageService.create({
+      bucketId: bucket.id,
+      senderName: 'Sender',
+      body: 'hello threshold',
+      currency: 'USD',
+      amount: 10,
+      amountUnit: 'cents',
+      thresholdCurrencyAtCreate: 'USD',
+      thresholdAmountMinorAtCreate: 150,
+      action: 'boost',
+      appName: 'App',
+      senderGuid: 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11',
+    });
+
+    await notifyNewBucketMessage({ bucketId: bucket.id, message: msg });
+
+    expect(vi.mocked(webPush.sendNotification)).toHaveBeenCalledTimes(1);
+  });
+
+  it('notifyNewBucketMessage does not send when boost is below root public minimum threshold', async () => {
+    await deleteAllWebPushSubscriptionsForUser(ownerId);
+    const bucket = await BucketService.createMbRoot({
+      ownerId,
+      name: 'Low Threshold Root',
+      isPublic: true,
+    });
+    await BucketService.update(bucket.id, { publicBoostDisplayMinimumMinor: 500 });
+    await BucketNotificationPreferenceService.upsert(ownerId, bucket.id, true);
+    const endpoint = `https://example.invalid/push/${FILE_PREFIX}-low-${Date.now()}`;
+    await UserWebPushSubscriptionService.upsert({
+      userId: ownerId,
+      endpoint,
+      keyP256dh: 'BKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
+      keyAuth: 'xxxxxxxxxxxxxxxxxxxx',
+      locale: null,
+    });
+
+    const msg = await BucketMessageService.create({
+      bucketId: bucket.id,
+      senderName: 'Sender',
+      body: 'below floor',
+      currency: 'USD',
+      amount: 1,
+      amountUnit: 'cents',
+      thresholdCurrencyAtCreate: 'USD',
+      thresholdAmountMinorAtCreate: 50,
+      action: 'boost',
+      appName: 'App',
+      senderGuid: 'b0eebc99-9c0b-4ef8-bb6d-6bb9bd380a22',
+    });
+
+    await notifyNewBucketMessage({ bucketId: bucket.id, message: msg });
+
+    expect(vi.mocked(webPush.sendNotification)).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/api/src/test/product-membership.test.ts b/apps/api/src/test/product-membership.test.ts
new file mode 100644
index 00000000..6789b952
--- /dev/null
+++ b/apps/api/src/test/product-membership.test.ts
@@ -0,0 +1,37 @@
+/**
+ * Public GET /product/membership — billing read model for anonymous clients.
+ */
+import request from 'supertest';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import { restoreDefaultApiTestProcessEnv } from './helpers/apiTestAuthEnv.js';
+import { createApiTestApp, destroyApiTestDataSources } from './helpers/setup.js';
+
+describe('GET /product/membership', () => {
+  let app: Awaited<ReturnType<typeof createApiTestApp>>;
+  let API: string;
+
+  beforeAll(async () => {
+    restoreDefaultApiTestProcessEnv();
+    const { config } = await import('../config/index.js');
+    API = config.apiVersionPath;
+    app = await createApiTestApp();
+  });
+
+  afterAll(async () => {
+    await destroyApiTestDataSources();
+    restoreDefaultApiTestProcessEnv();
+  });
+
+  it('returns 200 without authentication with stable contract fields', async () => {
+    const res = await request(app).get(`${API}/product/membership`).expect(200);
+    expect(res.body.data).toMatchObject({
+      listPriceCurrencyCode: 'USD',
+      selfServePublicSignupOpen: expect.any(Boolean),
+      freeTrialExpirationSeconds: expect.any(Number),
+      premiumMembershipCostMonthly: expect.any(Number),
+      premiumMembershipCostAnnually: expect.any(Number),
+    });
+    expect(res.body.data.freeTrialExpirationSeconds).toBeGreaterThan(0);
+  });
+});
diff --git a/apps/api/src/test/require-user.test.ts b/apps/api/src/test/require-user.test.ts
new file mode 100644
index 00000000..648a945a
--- /dev/null
+++ b/apps/api/src/test/require-user.test.ts
@@ -0,0 +1,35 @@
+import type { UserWithRelations } from '@metaboost/orm';
+import type { Request, Response } from 'express';
+
+import { describe, expect, it, vi } from 'vitest';
+
+import { requireUser } from '../middleware/auth.js';
+
+describe('requireUser', () => {
+  it('returns null, sets 401 JSON when req.user is undefined', () => {
+    const json = vi.fn();
+    const status = vi.fn().mockReturnValue({ json });
+    const res = { status } as unknown as Response;
+    const req = { user: undefined } as unknown as Request;
+
+    const user = requireUser(req, res);
+
+    expect(user).toBeNull();
+    expect(status).toHaveBeenCalledWith(401);
+    expect(json).toHaveBeenCalledWith({ message: 'Authentication required' });
+  });
+
+  it('returns req.user when present', () => {
+    const minimalUser = { id: 'user-1' } as unknown as UserWithRelations;
+    const json = vi.fn();
+    const status = vi.fn().mockReturnValue({ json });
+    const res = { status } as unknown as Response;
+    const req = { user: minimalUser } as unknown as Request;
+
+    const user = requireUser(req, res);
+
+    expect(user).toBe(minimalUser);
+    expect(status).not.toHaveBeenCalled();
+    expect(json).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/management-api/.env.example b/apps/management-api/.env.example
index 34254aa4..65caecbe 100644
--- a/apps/management-api/.env.example
+++ b/apps/management-api/.env.example
@@ -24,9 +24,14 @@ DB_MANAGEMENT_READ_WRITE_USER="metaboost_management_read_write"
 DB_MANAGEMENT_READ_WRITE_PASSWORD=
 DB_MANAGEMENT_READ_USER="metaboost_management_read"
 DB_MANAGEMENT_READ_PASSWORD=
+# Membership bootstrap (main app DB): seeds missing `product_membership_settings` / prices; runtime reads DB first.
+# MEMBERSHIP_FREE_TRIAL_EXPIRATION: trial length in seconds (empty = default 31 days in helpers).
+MEMBERSHIP_FREE_TRIAL_EXPIRATION="2678400"
+MEMBERSHIP_PREMIUM_COST_MONTHLY="3"
+MEMBERSHIP_PREMIUM_COST_ANNUALLY="30"
 API_PORT="4000"
 MANAGEMENT_API_VERSION_PATH="/v1"
-MANAGEMENT_API_RELEASE="X.X.X-staging.N"
+MANAGEMENT_API_RELEASE="X.Y.Z-staging.N"
 API_PUBLIC_BASE_URL="http://localhost:4000"
 API_SERVER_BASE_URL="http://localhost:4000"
 WEB_PORT="4002"
diff --git a/apps/management-api/src/app.ts b/apps/management-api/src/app.ts
index 82ce173b..774ee202 100644
--- a/apps/management-api/src/app.ts
+++ b/apps/management-api/src/app.ts
@@ -12,14 +12,17 @@ import { isEnvLogLevelDebug } from '@metaboost/helpers';
 
 import { config } from './config/index.js';
 import { registerHealthRoutes } from './lib/health/registerHealthRoutes.js';
+import { requireCrud } from './middleware/requireCrud.js';
 import { requireManagementAuth } from './middleware/requireManagementAuth.js';
 import { requireSuperAdmin } from './middleware/requireSuperAdmin.js';
 import { openApiDocument } from './openapi.js';
 import { createAdminsRouter } from './routes/admins.js';
 import { createAppsRouter } from './routes/apps.js';
 import { createAuthRouter } from './routes/auth.js';
+import { createBillingPricesRouter } from './routes/billingPrices.js';
 import { createBucketsRouter } from './routes/buckets.js';
 import { createEventsRouter } from './routes/events.js';
+import { createProductRouter } from './routes/product.js';
 import { createTermsVersionsRouter } from './routes/termsVersions.js';
 import { createUsersRouter } from './routes/users.js';
 
@@ -66,6 +69,11 @@ export function createApp(): Express {
   versionedRouter.get('/', (_req: Request, res: Response): void => {
     res.status(200).json({ status: 'ok', message: 'Management API is online' });
   });
+  versionedRouter.use(
+    '/product',
+    createProductRouter(requireAuth, requireCrud('billingPrices', 'read'))
+  );
+  versionedRouter.use('/billing-prices', createBillingPricesRouter(requireAuth));
   versionedRouter.use('/auth', createAuthRouter(requireAuth));
   versionedRouter.use('/admins', createAdminsRouter(requireAuth, requireSuperAdminMiddleware));
   versionedRouter.use('/apps', createAppsRouter(requireAuth));
diff --git a/apps/management-api/src/controllers/adminRolesController.ts b/apps/management-api/src/controllers/adminRolesController.ts
index 6a0ec236..b9acc8f0 100644
--- a/apps/management-api/src/controllers/adminRolesController.ts
+++ b/apps/management-api/src/controllers/adminRolesController.ts
@@ -20,6 +20,7 @@ function predefinedRoleToJson(role: (typeof PREDEFINED_MANAGEMENT_ADMIN_ROLES)[n
     bucketsCrud: role.bucketsCrud,
     bucketMessagesCrud: role.bucketMessagesCrud,
     bucketAdminsCrud: role.bucketAdminsCrud,
+    billingPricesCrud: role.billingPricesCrud,
     eventVisibility: role.eventVisibility,
     isPredefined: true as const,
     createdAt: null as string | null,
@@ -35,6 +36,7 @@ function customRoleToJson(role: ManagementAdminRole) {
     bucketsCrud: role.bucketsCrud,
     bucketMessagesCrud: role.bucketMessagesCrud,
     bucketAdminsCrud: role.bucketAdminsCrud,
+    billingPricesCrud: role.billingPricesCrud,
     eventVisibility: role.eventVisibility,
     isPredefined: false as const,
     createdAt:
@@ -57,6 +59,7 @@ export async function createManagementAdminRole(req: Request, res: Response): Pr
     bucketsCrud: body.bucketsCrud,
     bucketMessagesCrud: body.bucketMessagesCrud,
     bucketAdminsCrud: body.bucketAdminsCrud,
+    billingPricesCrud: body.billingPricesCrud,
     eventVisibility: body.eventVisibility,
   });
   res.status(201).json({ role: customRoleToJson(role) });
@@ -77,6 +80,7 @@ export async function updateManagementAdminRole(req: Request, res: Response): Pr
     bucketsCrud?: number;
     bucketMessagesCrud?: number;
     bucketAdminsCrud?: number;
+    billingPricesCrud?: number;
     eventVisibility?: 'own' | 'all_admins' | 'all';
   } = {};
   if (body.name !== undefined) updates.name = body.name.trim();
@@ -85,6 +89,7 @@ export async function updateManagementAdminRole(req: Request, res: Response): Pr
   if (body.bucketsCrud !== undefined) updates.bucketsCrud = body.bucketsCrud;
   if (body.bucketMessagesCrud !== undefined) updates.bucketMessagesCrud = body.bucketMessagesCrud;
   if (body.bucketAdminsCrud !== undefined) updates.bucketAdminsCrud = body.bucketAdminsCrud;
+  if (body.billingPricesCrud !== undefined) updates.billingPricesCrud = body.billingPricesCrud;
   if (body.eventVisibility !== undefined) updates.eventVisibility = body.eventVisibility;
   if (Object.keys(updates).length > 0) {
     await ManagementAdminRoleService.update(roleId, updates);
@@ -114,6 +119,7 @@ export async function resolveManagementAdminRole(roleId: string): Promise<{
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: 'own' | 'all_admins' | 'all';
 } | null> {
   const predefined = getPredefinedManagementAdminRoleById(roleId);
@@ -124,6 +130,7 @@ export async function resolveManagementAdminRole(roleId: string): Promise<{
       bucketsCrud: predefined.bucketsCrud,
       bucketMessagesCrud: predefined.bucketMessagesCrud,
       bucketAdminsCrud: predefined.bucketAdminsCrud,
+      billingPricesCrud: predefined.billingPricesCrud,
       eventVisibility: predefined.eventVisibility,
     };
   }
@@ -135,6 +142,7 @@ export async function resolveManagementAdminRole(roleId: string): Promise<{
     bucketsCrud: custom.bucketsCrud,
     bucketMessagesCrud: custom.bucketMessagesCrud,
     bucketAdminsCrud: custom.bucketAdminsCrud,
+    billingPricesCrud: custom.billingPricesCrud,
     eventVisibility: custom.eventVisibility,
   };
 }
diff --git a/apps/management-api/src/controllers/adminsController.ts b/apps/management-api/src/controllers/adminsController.ts
index dd62402d..57dcd4b7 100644
--- a/apps/management-api/src/controllers/adminsController.ts
+++ b/apps/management-api/src/controllers/adminsController.ts
@@ -101,6 +101,7 @@ export async function createAdmin(req: Request, res: Response): Promise<void> {
     bucketsCrud: rolePermissions?.bucketsCrud ?? body.bucketsCrud,
     bucketMessagesCrud: rolePermissions?.bucketMessagesCrud ?? body.bucketMessagesCrud,
     bucketAdminsCrud: rolePermissions?.bucketAdminsCrud ?? body.bucketAdminsCrud,
+    billingPricesCrud: rolePermissions?.billingPricesCrud ?? body.billingPricesCrud,
     eventVisibility: rolePermissions?.eventVisibility ?? body.eventVisibility,
   });
   await recordEvent({
@@ -159,6 +160,7 @@ export async function updateAdmin(req: Request, res: Response): Promise<void> {
     'bucketsCrud',
     'bucketMessagesCrud',
     'bucketAdminsCrud',
+    'billingPricesCrud',
     'eventVisibility',
   ] as const;
   const hasPermissionUpdate = permissionKeys.some((k) => body[k] !== undefined);
@@ -186,6 +188,7 @@ export async function updateAdmin(req: Request, res: Response): Promise<void> {
       updates.bucketsCrud = rolePermissions.bucketsCrud;
       updates.bucketMessagesCrud = rolePermissions.bucketMessagesCrud;
       updates.bucketAdminsCrud = rolePermissions.bucketAdminsCrud;
+      updates.billingPricesCrud = rolePermissions.billingPricesCrud;
       updates.eventVisibility = rolePermissions.eventVisibility;
     } else {
       if (body.adminsCrud !== undefined) updates.adminsCrud = body.adminsCrud;
@@ -194,6 +197,7 @@ export async function updateAdmin(req: Request, res: Response): Promise<void> {
       if (body.bucketMessagesCrud !== undefined)
         updates.bucketMessagesCrud = body.bucketMessagesCrud;
       if (body.bucketAdminsCrud !== undefined) updates.bucketAdminsCrud = body.bucketAdminsCrud;
+      if (body.billingPricesCrud !== undefined) updates.billingPricesCrud = body.billingPricesCrud;
       if (body.eventVisibility !== undefined) updates.eventVisibility = body.eventVisibility;
     }
   }
diff --git a/apps/management-api/src/controllers/billingPricesController.ts b/apps/management-api/src/controllers/billingPricesController.ts
new file mode 100644
index 00000000..d3adab34
--- /dev/null
+++ b/apps/management-api/src/controllers/billingPricesController.ts
@@ -0,0 +1,111 @@
+import type {
+  DeprecateBillingPriceBody,
+  ScheduleBillingPriceBody,
+} from '../schemas/billingPrices.js';
+import type { Request, Response } from 'express';
+
+import {
+  BILLING_PRICE_GOVERNANCE_DEFAULT_CURRENCY,
+  BillingPriceGovernanceService,
+} from '@metaboost/orm';
+
+const governance = new BillingPriceGovernanceService();
+
+export async function listActivePrices(req: Request, res: Response): Promise<void> {
+  if (req.managementUser === undefined) {
+    res.status(401).json({ message: 'Authentication required' });
+    return;
+  }
+  const prices = await governance.listActivePrices();
+  res.json({
+    data: {
+      prices,
+      defaultCurrency: BILLING_PRICE_GOVERNANCE_DEFAULT_CURRENCY,
+    },
+  });
+}
+
+export async function schedulePriceChange(req: Request, res: Response): Promise<void> {
+  const user = req.managementUser;
+  if (user === undefined) {
+    res.status(401).json({ message: 'Authentication required' });
+    return;
+  }
+  const body = req.body as ScheduleBillingPriceBody;
+  const effectiveFrom =
+    body.effectiveFrom instanceof Date ? body.effectiveFrom : new Date(body.effectiveFrom);
+  const result = await governance.schedulePriceChange({
+    currencyCode: body.currencyCode,
+    billingCadence: body.billingCadence,
+    amountCents: body.amountCents,
+    effectiveFrom,
+    changeReason: body.changeReason === '' ? null : (body.changeReason ?? null),
+    changedByManagementUserId: user.id,
+  });
+  res.status(201).json({ data: result });
+}
+
+export async function listPriceWindows(req: Request, res: Response): Promise<void> {
+  if (req.managementUser === undefined) {
+    res.status(401).json({ message: 'Authentication required' });
+    return;
+  }
+  const windows = await governance.listPriceWindows();
+  res.json({
+    data: {
+      windows,
+      defaultCurrency: BILLING_PRICE_GOVERNANCE_DEFAULT_CURRENCY,
+    },
+  });
+}
+
+export async function listPriceChangeAudit(req: Request, res: Response): Promise<void> {
+  if (req.managementUser === undefined) {
+    res.status(401).json({ message: 'Authentication required' });
+    return;
+  }
+  const rawLimit = req.query.limit;
+  let limit = 100;
+  if (typeof rawLimit === 'string') {
+    const parsed = Number.parseInt(rawLimit, 10);
+    if (Number.isFinite(parsed) && parsed > 0) {
+      limit = Math.min(parsed, 200);
+    }
+  }
+  const entries = await governance.listPriceChangeAudit(limit);
+  res.json({ data: { entries } });
+}
+
+export async function deprecatePrice(req: Request, res: Response): Promise<void> {
+  const user = req.managementUser;
+  if (user === undefined) {
+    res.status(401).json({ message: 'Authentication required' });
+    return;
+  }
+  const rawParam = req.params.id;
+  const idSegment = Array.isArray(rawParam) ? rawParam[0] : rawParam;
+  if (typeof idSegment !== 'string' || idSegment === '') {
+    res.status(400).json({ message: 'Invalid price id' });
+    return;
+  }
+  const priceId = Number.parseInt(idSegment, 10);
+  if (!Number.isFinite(priceId) || String(priceId) !== idSegment) {
+    res.status(400).json({ message: 'Invalid price id' });
+    return;
+  }
+  const body = req.body as DeprecateBillingPriceBody;
+  try {
+    await governance.deprecatePrice({
+      priceId,
+      changeReason: body.changeReason === '' ? null : (body.changeReason ?? null),
+      changedByManagementUserId: user.id,
+    });
+  } catch (err) {
+    if (err instanceof Error && err.message.includes('not found')) {
+      res.status(404).json({ message: 'Price not found' });
+      return;
+    }
+    throw err;
+  }
+  res.status(204).send();
+}
diff --git a/apps/management-api/src/controllers/usersController.ts b/apps/management-api/src/controllers/usersController.ts
index 570f6ce0..bd44ea99 100644
--- a/apps/management-api/src/controllers/usersController.ts
+++ b/apps/management-api/src/controllers/usersController.ts
@@ -1,6 +1,6 @@
 import type { CreateUserBody, UpdateUserBody, ChangeUserPasswordBody } from '../schemas/users.js';
 import type { SqlSortDirection } from '@metaboost/helpers';
-import type { UserWithRelations } from '@metaboost/orm';
+import type { PremiumBillingCadence, UserWithRelations } from '@metaboost/orm';
 import type { Request, Response } from 'express';
 
 import crypto from 'crypto';
@@ -210,6 +210,13 @@ export async function createUser(req: Request, res: Response): Promise<void> {
       ? new Date(body.membershipExpiresAt)
       : undefined;
 
+  const premiumBillingCadence: PremiumBillingCadence | undefined =
+    requestedMembershipTier === MembershipTier.Premium
+      ? body.premiumBillingCadence === 'monthly'
+        ? 'monthly'
+        : 'annual'
+      : undefined;
+
   const user = await UserService.create({
     email: email ?? undefined,
     username: username ?? undefined,
@@ -218,6 +225,7 @@ export async function createUser(req: Request, res: Response): Promise<void> {
     membershipTier: requestedMembershipTier,
     membershipExpiresAt,
     autoRenew: body.autoRenew,
+    premiumBillingCadence,
   });
 
   let setPasswordLink: string | undefined;
diff --git a/apps/management-api/src/index.ts b/apps/management-api/src/index.ts
index b69205a9..77150d57 100644
--- a/apps/management-api/src/index.ts
+++ b/apps/management-api/src/index.ts
@@ -24,6 +24,7 @@ const run = async (): Promise<void> => {
   const {
     appDataSourceRead,
     appDataSourceReadWrite,
+    BillingPriceCatalogService,
     DEFAULT_TERMS_LOCALIZED_CONTENT,
     DEFAULT_TERMS_TITLE,
     DEFAULT_TERMS_VERSION_KEY,
@@ -37,6 +38,8 @@ const run = async (): Promise<void> => {
     defaultLocalizedContent: DEFAULT_TERMS_LOCALIZED_CONTENT,
   });
 
+  await new BillingPriceCatalogService().resolveProductMembership(new Date());
+
   const { managementDataSource } = await import('@metaboost/management-orm');
   await managementDataSource.initialize();
 
diff --git a/apps/management-api/src/lib/managementUserToJson.ts b/apps/management-api/src/lib/managementUserToJson.ts
index 8f2fddde..340b5de6 100644
--- a/apps/management-api/src/lib/managementUserToJson.ts
+++ b/apps/management-api/src/lib/managementUserToJson.ts
@@ -20,6 +20,7 @@ export interface PublicManagementUser {
     bucketsCrud: number;
     bucketMessagesCrud: number;
     bucketAdminsCrud: number;
+    billingPricesCrud: number;
     eventVisibility: EventVisibility;
   } | null;
 }
@@ -41,6 +42,7 @@ export function managementUserToJson(user: ManagementUser): PublicManagementUser
             bucketsCrud: perm.bucketsCrud,
             bucketMessagesCrud: perm.bucketMessagesCrud,
             bucketAdminsCrud: perm.bucketAdminsCrud,
+            billingPricesCrud: perm.billingPricesCrud,
             eventVisibility: perm.eventVisibility,
           }
         : null,
diff --git a/apps/management-api/src/lib/startup/validation.ts b/apps/management-api/src/lib/startup/validation.ts
index 1350707d..6eea3027 100644
--- a/apps/management-api/src/lib/startup/validation.ts
+++ b/apps/management-api/src/lib/startup/validation.ts
@@ -210,17 +210,22 @@ function managementApiValidationResults() {
     validateRequired('DB_APP_READ_PASSWORD', 'Main DB'),
     validateRequired('DB_APP_READ_WRITE_USER', 'Main DB'),
     validateRequired('DB_APP_READ_WRITE_PASSWORD', 'Main DB'),
+    // Env seeds missing DB rows only; optional. Invalid values fail startup when set (non-empty).
     validateOptionalPositiveNumber(
-      'MEMBERSHIP_DEFAULT_TRIAL_MONTHS',
-      'Membership defaults',
+      'MEMBERSHIP_FREE_TRIAL_EXPIRATION',
+      'Membership bootstrap (seconds; seeds DB when row missing)',
       1,
-      120
+      31_536_000
     ),
     validateOptionalPositiveNumber(
-      'MEMBERSHIP_DEFAULT_PREMIUM_MONTHS',
-      'Membership defaults',
-      1,
-      120
+      'MEMBERSHIP_PREMIUM_COST_MONTHLY',
+      'Membership bootstrap pricing (seeds DB when price missing)',
+      0
+    ),
+    validateOptionalPositiveNumber(
+      'MEMBERSHIP_PREMIUM_COST_ANNUALLY',
+      'Membership bootstrap pricing (seeds DB when price missing)',
+      0
     ),
   ];
 }
diff --git a/apps/management-api/src/middleware/requireCrud.ts b/apps/management-api/src/middleware/requireCrud.ts
index bbd0cd04..1844ab1b 100644
--- a/apps/management-api/src/middleware/requireCrud.ts
+++ b/apps/management-api/src/middleware/requireCrud.ts
@@ -2,7 +2,7 @@ import type { Request, Response, NextFunction } from 'express';
 
 import { hasCrud, type CrudOp } from '@metaboost/management-orm';
 
-type Resource = 'admins' | 'users' | 'buckets' | 'messages' | 'bucketAdmins';
+type Resource = 'admins' | 'users' | 'buckets' | 'messages' | 'bucketAdmins' | 'billingPrices';
 
 function getCrudForResource(
   permissions: {
@@ -11,6 +11,7 @@ function getCrudForResource(
     bucketsCrud: number;
     bucketMessagesCrud: number;
     bucketAdminsCrud: number;
+    billingPricesCrud: number;
   },
   resource: Resource
 ): number {
@@ -25,6 +26,8 @@ function getCrudForResource(
       return permissions.bucketMessagesCrud;
     case 'bucketAdmins':
       return permissions.bucketAdminsCrud;
+    case 'billingPrices':
+      return permissions.billingPricesCrud;
   }
 }
 
@@ -55,6 +58,7 @@ export function requireCrud(resource: Resource, op: CrudOp) {
         bucketsCrud: permissions.bucketsCrud,
         bucketMessagesCrud: permissions.bucketMessagesCrud,
         bucketAdminsCrud: permissions.bucketAdminsCrud,
+        billingPricesCrud: permissions.billingPricesCrud,
       },
       resource
     );
diff --git a/apps/management-api/src/openapi.ts b/apps/management-api/src/openapi.ts
index 6a746239..623d961b 100644
--- a/apps/management-api/src/openapi.ts
+++ b/apps/management-api/src/openapi.ts
@@ -7,7 +7,7 @@ export const openApiDocument = {
   openapi: '3.0.0',
   info: {
     title: 'Metaboost Management API',
-    version: '0.1.2',
+    version: '0.1.3',
     description:
       'Management API for super admin and admins. JWT from POST /auth/login. Use **Authorize** to set the Bearer token. Permissions (admins_crud, users_crud bitmasks, event_visibility) apply to admins; super admin has full access. Capabilities such as changing passwords or assigning permissions are implied by the relevant CRUD bits.',
   },
@@ -67,6 +67,12 @@ export const openApiDocument = {
                 maximum: 15,
                 description: 'CRUD bitmask for bucket admins and invitations',
               },
+              billingPricesCrud: {
+                type: 'integer',
+                minimum: 0,
+                maximum: 15,
+                description: 'CRUD bitmask for billing price catalog governance',
+              },
               eventVisibility: { type: 'string', enum: ['own', 'all_admins', 'all'] },
             },
           },
@@ -122,6 +128,7 @@ export const openApiDocument = {
           bucketsCrud: { type: 'integer', minimum: 0, maximum: 15, default: 0 },
           bucketMessagesCrud: { type: 'integer', minimum: 0, maximum: 15, default: 0 },
           bucketAdminsCrud: { type: 'integer', minimum: 0, maximum: 15, default: 0 },
+          billingPricesCrud: { type: 'integer', minimum: 0, maximum: 15, default: 0 },
           eventVisibility: {
             type: 'string',
             enum: ['own', 'all_admins', 'all'],
@@ -140,6 +147,7 @@ export const openApiDocument = {
           bucketsCrud: { type: 'integer', minimum: 0, maximum: 15 },
           bucketMessagesCrud: { type: 'integer', minimum: 0, maximum: 15 },
           bucketAdminsCrud: { type: 'integer', minimum: 0, maximum: 15 },
+          billingPricesCrud: { type: 'integer', minimum: 0, maximum: 15 },
           eventVisibility: { type: 'string', enum: ['own', 'all_admins', 'all'] },
         },
       },
@@ -408,6 +416,149 @@ export const openApiDocument = {
           status: { type: 'string', enum: ['draft', 'upcoming'] },
         },
       },
+      ResolvedProductMembership: {
+        type: 'object',
+        description:
+          'Resolved membership product values: DB-backed (`product_membership_settings`, active `billing_price` rows) with env used only to bootstrap missing rows. Not secret.',
+        properties: {
+          freeTrialExpirationSeconds: { type: 'integer', minimum: 1 },
+          premiumMembershipCostMonthly: { type: 'number', minimum: 0 },
+          premiumMembershipCostAnnually: { type: 'number', minimum: 0 },
+        },
+        required: [
+          'freeTrialExpirationSeconds',
+          'premiumMembershipCostMonthly',
+          'premiumMembershipCostAnnually',
+        ],
+      },
+      ResolvedProductMembershipResponse: {
+        type: 'object',
+        properties: {
+          data: { $ref: '#/components/schemas/ResolvedProductMembership' },
+        },
+        required: ['data'],
+      },
+      ActiveBillingPrice: {
+        type: 'object',
+        properties: {
+          id: { type: 'integer' },
+          billingProductId: { type: 'integer' },
+          productCode: { type: 'string' },
+          currencyCode: { type: 'string', minLength: 3, maxLength: 3 },
+          billingCadence: { type: 'string', enum: ['monthly', 'annual'] },
+          amountCents: { type: 'integer', minimum: 0 },
+          effectiveFrom: { type: 'string', format: 'date-time' },
+          effectiveTo: { type: 'string', format: 'date-time', nullable: true },
+          source: { type: 'string' },
+        },
+      },
+      BillingPricesListResponse: {
+        type: 'object',
+        properties: {
+          data: {
+            type: 'object',
+            properties: {
+              prices: {
+                type: 'array',
+                items: { $ref: '#/components/schemas/ActiveBillingPrice' },
+              },
+              defaultCurrency: { type: 'string', minLength: 3, maxLength: 3 },
+            },
+            required: ['prices', 'defaultCurrency'],
+          },
+        },
+        required: ['data'],
+      },
+      BillingPriceWindow: {
+        allOf: [
+          { $ref: '#/components/schemas/ActiveBillingPrice' },
+          {
+            type: 'object',
+            properties: {
+              status: { type: 'string', enum: ['active', 'scheduled', 'historical'] },
+            },
+            required: ['status'],
+          },
+        ],
+      },
+      BillingPriceWindowsResponse: {
+        type: 'object',
+        properties: {
+          data: {
+            type: 'object',
+            properties: {
+              windows: {
+                type: 'array',
+                items: { $ref: '#/components/schemas/BillingPriceWindow' },
+              },
+              defaultCurrency: { type: 'string', minLength: 3, maxLength: 3 },
+            },
+            required: ['windows', 'defaultCurrency'],
+          },
+        },
+        required: ['data'],
+      },
+      BillingPriceAuditEntry: {
+        type: 'object',
+        properties: {
+          id: { type: 'integer' },
+          billingPriceId: { type: 'integer', nullable: true },
+          changedByManagementUserId: { type: 'string', format: 'uuid', nullable: true },
+          changeReason: { type: 'string', nullable: true },
+          previousAmountCents: { type: 'integer', minimum: 0, nullable: true },
+          newAmountCents: { type: 'integer', minimum: 0, nullable: true },
+          previousEffectiveFrom: { type: 'string', format: 'date-time', nullable: true },
+          previousEffectiveTo: { type: 'string', format: 'date-time', nullable: true },
+          newEffectiveFrom: { type: 'string', format: 'date-time', nullable: true },
+          newEffectiveTo: { type: 'string', format: 'date-time', nullable: true },
+          createdAt: { type: 'string', format: 'date-time' },
+          currencyCode: { type: 'string', minLength: 3, maxLength: 3, nullable: true },
+          billingCadence: { type: 'string', enum: ['monthly', 'annual'], nullable: true },
+          productCode: { type: 'string', nullable: true },
+        },
+      },
+      BillingPriceAuditListResponse: {
+        type: 'object',
+        properties: {
+          data: {
+            type: 'object',
+            properties: {
+              entries: {
+                type: 'array',
+                items: { $ref: '#/components/schemas/BillingPriceAuditEntry' },
+              },
+            },
+            required: ['entries'],
+          },
+        },
+        required: ['data'],
+      },
+      ScheduleBillingPriceBody: {
+        type: 'object',
+        required: ['currencyCode', 'billingCadence', 'amountCents', 'effectiveFrom'],
+        properties: {
+          currencyCode: { type: 'string', minLength: 3, maxLength: 3 },
+          billingCadence: { type: 'string', enum: ['monthly', 'annual'] },
+          amountCents: { type: 'integer', minimum: 0 },
+          effectiveFrom: { type: 'string', format: 'date-time' },
+          changeReason: { type: 'string', maxLength: 2000, nullable: true },
+        },
+      },
+      ScheduleBillingPriceResponse: {
+        type: 'object',
+        properties: {
+          data: {
+            type: 'object',
+            properties: { newPriceId: { type: 'integer' } },
+            required: ['newPriceId'],
+          },
+        },
+        required: ['data'],
+      },
+      DeprecateBillingPriceBody: {
+        type: 'object',
+        properties: { changeReason: { type: 'string', maxLength: 2000, nullable: true } },
+      },
       ErrorMessage: {
         type: 'object',
         properties: { message: { type: 'string' } },
@@ -461,6 +612,232 @@ export const openApiDocument = {
         },
       },
     },
+    '/product/membership': {
+      get: {
+        summary: 'Resolved product membership',
+        description:
+          'Trial window (seconds) and premium list prices resolved from the main app database (env seeds missing rows only). Requires `billingPrices` read permission (super admin bypasses).',
+        operationId: 'getResolvedProductMembership',
+        security: [{ bearerAuth: [] }],
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/ResolvedProductMembershipResponse' },
+              },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '403': {
+            description: 'Insufficient permissions',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+    },
+    '/billing-prices/windows': {
+      get: {
+        summary: 'List billing price windows',
+        description:
+          'Membership premium price rows with lifecycle status (active, scheduled, historical) from the main app database (`billingPrices` read permission).',
+        operationId: 'listBillingPriceWindows',
+        security: [{ bearerAuth: [] }],
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/BillingPriceWindowsResponse' },
+              },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '403': {
+            description: 'Insufficient permissions',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+    },
+    '/billing-prices/audit': {
+      get: {
+        summary: 'List billing price change audit',
+        description:
+          'Recent `billing_price_change_audit` rows (newest first; optional `limit` query, max 200; default 100). Requires `billingPrices` read.',
+        operationId: 'listBillingPriceChangeAudit',
+        security: [{ bearerAuth: [] }],
+        parameters: [
+          {
+            name: 'limit',
+            in: 'query',
+            required: false,
+            schema: { type: 'integer', minimum: 1, maximum: 200 },
+          },
+        ],
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/BillingPriceAuditListResponse' },
+              },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '403': {
+            description: 'Insufficient permissions',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+    },
+    '/billing-prices': {
+      get: {
+        summary: 'List active billing prices',
+        description:
+          'Active membership premium price rows from the main app database (`billingPrices` read permission).',
+        operationId: 'listBillingPrices',
+        security: [{ bearerAuth: [] }],
+        responses: {
+          '200': {
+            description: 'OK',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/BillingPricesListResponse' },
+              },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '403': {
+            description: 'Insufficient permissions',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+      post: {
+        summary: 'Schedule or apply a price change',
+        description:
+          'Closes the open price window for the same currency/cadence and inserts a new row; writes `billing_price_change_audit` (`billingPrices` create permission).',
+        operationId: 'scheduleBillingPrice',
+        security: [{ bearerAuth: [] }],
+        requestBody: {
+          required: true,
+          content: {
+            'application/json': {
+              schema: { $ref: '#/components/schemas/ScheduleBillingPriceBody' },
+            },
+          },
+        },
+        responses: {
+          '201': {
+            description: 'Created',
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/ScheduleBillingPriceResponse' },
+              },
+            },
+          },
+          '400': {
+            description: 'Validation error',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '403': {
+            description: 'Insufficient permissions',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+    },
+    '/billing-prices/{id}/deprecate': {
+      post: {
+        summary: 'Deprecate a price row',
+        description:
+          'Sets `effective_to` to now for the given price id (`billingPrices` update permission).',
+        operationId: 'deprecateBillingPrice',
+        security: [{ bearerAuth: [] }],
+        parameters: [
+          {
+            name: 'id',
+            in: 'path',
+            required: true,
+            schema: { type: 'integer' },
+          },
+        ],
+        requestBody: {
+          content: {
+            'application/json': {
+              schema: { $ref: '#/components/schemas/DeprecateBillingPriceBody' },
+            },
+          },
+        },
+        responses: {
+          '204': { description: 'Deprecated' },
+          '400': {
+            description: 'Invalid price id',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '401': {
+            description: 'Authentication required',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '403': {
+            description: 'Insufficient permissions',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+          '404': {
+            description: 'Price not found',
+            content: {
+              'application/json': { schema: { $ref: '#/components/schemas/ErrorMessage' } },
+            },
+          },
+        },
+      },
+    },
     '/auth/login': {
       post: {
         summary: 'Login',
diff --git a/apps/management-api/src/routes/billingPrices.ts b/apps/management-api/src/routes/billingPrices.ts
new file mode 100644
index 00000000..a1264390
--- /dev/null
+++ b/apps/management-api/src/routes/billingPrices.ts
@@ -0,0 +1,45 @@
+import type { RequestHandler } from 'express';
+
+import { Router } from 'express';
+
+import * as billingPricesController from '../controllers/billingPricesController.js';
+import { requireCrud } from '../middleware/requireCrud.js';
+import { validateBody } from '../middleware/validateBody.js';
+import {
+  deprecateBillingPriceSchema,
+  scheduleBillingPriceSchema,
+} from '../schemas/billingPrices.js';
+
+export function createBillingPricesRouter(requireAuth: RequestHandler): Router {
+  const router = Router();
+
+  router.get('/windows', requireAuth, requireCrud('billingPrices', 'read'), (req, res, next) => {
+    billingPricesController.listPriceWindows(req, res).catch(next);
+  });
+  router.get('/audit', requireAuth, requireCrud('billingPrices', 'read'), (req, res, next) => {
+    billingPricesController.listPriceChangeAudit(req, res).catch(next);
+  });
+  router.get('/', requireAuth, requireCrud('billingPrices', 'read'), (req, res, next) => {
+    billingPricesController.listActivePrices(req, res).catch(next);
+  });
+  router.post(
+    '/',
+    requireAuth,
+    requireCrud('billingPrices', 'create'),
+    validateBody(scheduleBillingPriceSchema),
+    (req, res, next) => {
+      billingPricesController.schedulePriceChange(req, res).catch(next);
+    }
+  );
+  router.post(
+    '/:id/deprecate',
+    requireAuth,
+    requireCrud('billingPrices', 'update'),
+    validateBody(deprecateBillingPriceSchema),
+    (req, res, next) => {
+      billingPricesController.deprecatePrice(req, res).catch(next);
+    }
+  );
+
+  return router;
+}
diff --git a/apps/management-api/src/routes/product.ts b/apps/management-api/src/routes/product.ts
new file mode 100644
index 00000000..e1f01d4f
--- /dev/null
+++ b/apps/management-api/src/routes/product.ts
@@ -0,0 +1,31 @@
+import type { NextFunction, Request, RequestHandler, Response } from 'express';
+
+import { Router } from 'express';
+
+import { BillingPriceCatalogService } from '@metaboost/orm';
+
+export function createProductRouter(
+  requireAuth: RequestHandler,
+  requireBillingPricesRead: RequestHandler
+): Router {
+  const catalog = new BillingPriceCatalogService();
+
+  const membershipRouter = Router();
+  membershipRouter.get(
+    '/',
+    requireAuth,
+    requireBillingPricesRead,
+    async (_req: Request, res: Response, next: NextFunction): Promise<void> => {
+      try {
+        const data = await catalog.resolveProductMembership();
+        res.json({ data });
+      } catch (err) {
+        next(err);
+      }
+    }
+  );
+
+  const productRouter = Router();
+  productRouter.use('/membership', membershipRouter);
+  return productRouter;
+}
diff --git a/apps/management-api/src/schemas/admins.ts b/apps/management-api/src/schemas/admins.ts
index a4618869..c1fe2adf 100644
--- a/apps/management-api/src/schemas/admins.ts
+++ b/apps/management-api/src/schemas/admins.ts
@@ -26,6 +26,7 @@ export const createAdminSchema = Joi.object({
   bucketsCrud: crudSchema.default(0),
   bucketMessagesCrud: crudSchema.default(0),
   bucketAdminsCrud: crudSchema.default(0),
+  billingPricesCrud: crudSchema.default(0),
   eventVisibility: eventVisibilitySchema.default('all_admins'),
 });
 
@@ -39,6 +40,7 @@ export const updateAdminSchema = Joi.object({
   bucketsCrud: crudSchema,
   bucketMessagesCrud: crudSchema,
   bucketAdminsCrud: crudSchema,
+  billingPricesCrud: crudSchema,
   eventVisibility: eventVisibilitySchema,
 }).min(1);
 
@@ -49,6 +51,7 @@ export const createManagementAdminRoleSchema = Joi.object({
   bucketsCrud: crudSchema.required(),
   bucketMessagesCrud: crudSchema.required(),
   bucketAdminsCrud: crudSchema.required(),
+  billingPricesCrud: crudSchema.required(),
   eventVisibility: eventVisibilitySchema.required(),
 });
 
@@ -59,6 +62,7 @@ export const updateManagementAdminRoleSchema = Joi.object({
   bucketsCrud: crudSchema,
   bucketMessagesCrud: crudSchema,
   bucketAdminsCrud: crudSchema,
+  billingPricesCrud: crudSchema,
   eventVisibility: eventVisibilitySchema,
 }).min(1);
 
@@ -69,6 +73,7 @@ export type CreateManagementAdminRoleBody = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: 'own' | 'all_admins' | 'all';
 };
 
@@ -79,6 +84,7 @@ export type UpdateManagementAdminRoleBody = {
   bucketsCrud?: number;
   bucketMessagesCrud?: number;
   bucketAdminsCrud?: number;
+  billingPricesCrud?: number;
   eventVisibility?: 'own' | 'all_admins' | 'all';
 };
 
diff --git a/apps/management-api/src/schemas/billingPrices.ts b/apps/management-api/src/schemas/billingPrices.ts
new file mode 100644
index 00000000..415324d3
--- /dev/null
+++ b/apps/management-api/src/schemas/billingPrices.ts
@@ -0,0 +1,27 @@
+import Joi from 'joi';
+
+const currencyCode = Joi.string().length(3).uppercase();
+
+export const scheduleBillingPriceSchema = Joi.object({
+  currencyCode: currencyCode.required(),
+  billingCadence: Joi.string().valid('monthly', 'annual').required(),
+  amountCents: Joi.number().integer().min(0).required(),
+  effectiveFrom: Joi.date().required(),
+  changeReason: Joi.string().max(2000).allow(null, ''),
+});
+
+export const deprecateBillingPriceSchema = Joi.object({
+  changeReason: Joi.string().max(2000).allow(null, ''),
+});
+
+export type ScheduleBillingPriceBody = {
+  currencyCode: string;
+  billingCadence: 'monthly' | 'annual';
+  amountCents: number;
+  effectiveFrom: string | Date;
+  changeReason?: string | null;
+};
+
+export type DeprecateBillingPriceBody = {
+  changeReason?: string | null;
+};
diff --git a/apps/management-api/src/schemas/users.ts b/apps/management-api/src/schemas/users.ts
index 072d2a99..47d0991a 100644
--- a/apps/management-api/src/schemas/users.ts
+++ b/apps/management-api/src/schemas/users.ts
@@ -42,6 +42,7 @@ export const createUserSchema = Joi.object({
     .optional(),
   membershipExpiresAt: Joi.date().iso().allow(null).optional(),
   autoRenew: Joi.boolean().optional(),
+  premiumBillingCadence: Joi.string().valid('monthly', 'annual').optional(),
 })
   .custom((value) => {
     const e =
diff --git a/apps/management-api/src/test/billing-prices.test.ts b/apps/management-api/src/test/billing-prices.test.ts
new file mode 100644
index 00000000..c9a7acbf
--- /dev/null
+++ b/apps/management-api/src/test/billing-prices.test.ts
@@ -0,0 +1,189 @@
+/**
+ * Management API: billing price governance (read + schedule + deprecate).
+ */
+import request from 'supertest';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+import { CRUD_BITS } from '@metaboost/helpers';
+import { appDataSourceRead } from '@metaboost/orm';
+
+import { config } from '../config/index.js';
+import { createManagementLoginAgent } from './helpers/login-agent.js';
+import {
+  createManagementApiTestAppWithSuperAdmin,
+  destroyManagementApiTestDataSources,
+} from './helpers/setup.js';
+
+const API = config.apiVersionPath;
+const FILE_PREFIX = 'billing-prices';
+const superAdminUsername = `${FILE_PREFIX}-super-admin`;
+const superAdminPassword = `${FILE_PREFIX}-super-admin-password-1`;
+const billingReaderUsername = `${FILE_PREFIX}-billing-read`;
+const billingReaderPassword = `${FILE_PREFIX}-billing-read-password-1`;
+const noBillingUsername = `${FILE_PREFIX}-no-billing`;
+const noBillingPassword = `${FILE_PREFIX}-no-billing-password-1`;
+
+describe('management-api billing-prices', () => {
+  let app: Awaited<ReturnType<typeof createManagementApiTestAppWithSuperAdmin>>;
+  let superAdminAgent: ReturnType<typeof request.agent>;
+  let billingReaderAgent: ReturnType<typeof request.agent>;
+  let noBillingAgent: ReturnType<typeof request.agent>;
+
+  beforeAll(async () => {
+    app = await createManagementApiTestAppWithSuperAdmin(superAdminUsername, superAdminPassword);
+    superAdminAgent = await createManagementLoginAgent(app, {
+      username: superAdminUsername,
+      password: superAdminPassword,
+    });
+    await superAdminAgent
+      .post(`${API}/admins`)
+      .send({
+        username: billingReaderUsername,
+        password: billingReaderPassword,
+        displayName: 'Billing Reader',
+        adminsCrud: 0,
+        usersCrud: 0,
+        bucketsCrud: 0,
+        bucketMessagesCrud: 0,
+        bucketAdminsCrud: 0,
+        billingPricesCrud: CRUD_BITS.read,
+        eventVisibility: 'own',
+      })
+      .expect(201);
+    billingReaderAgent = await createManagementLoginAgent(app, {
+      username: billingReaderUsername,
+      password: billingReaderPassword,
+    });
+    await superAdminAgent
+      .post(`${API}/admins`)
+      .send({
+        username: noBillingUsername,
+        password: noBillingPassword,
+        displayName: 'No Billing',
+        adminsCrud: 0,
+        usersCrud: CRUD_BITS.read,
+        bucketsCrud: 0,
+        bucketMessagesCrud: 0,
+        bucketAdminsCrud: 0,
+        billingPricesCrud: 0,
+        eventVisibility: 'own',
+      })
+      .expect(201);
+    noBillingAgent = await createManagementLoginAgent(app, {
+      username: noBillingUsername,
+      password: noBillingPassword,
+    });
+  });
+
+  afterAll(async () => {
+    await destroyManagementApiTestDataSources();
+  });
+
+  describe('GET /product/membership', () => {
+    it('returns 200 for admin with billingPrices read', async () => {
+      const res = await billingReaderAgent.get(`${API}/product/membership`).expect(200);
+      expect(res.body.data).toMatchObject({
+        freeTrialExpirationSeconds: expect.any(Number),
+        premiumMembershipCostMonthly: expect.any(Number),
+        premiumMembershipCostAnnually: expect.any(Number),
+      });
+    });
+  });
+
+  describe('GET /billing-prices/windows', () => {
+    it('returns 401 without authentication', async () => {
+      await request(app).get(`${API}/billing-prices/windows`).expect(401);
+    });
+
+    it('returns windows with status for billing reader', async () => {
+      const res = await billingReaderAgent.get(`${API}/billing-prices/windows`).expect(200);
+      expect(res.body.data.defaultCurrency).toBe('USD');
+      expect(Array.isArray(res.body.data.windows)).toBe(true);
+      expect(res.body.data.windows.length).toBeGreaterThanOrEqual(2);
+      const first = res.body.data.windows[0] as { status?: string };
+      expect(['active', 'scheduled', 'historical']).toContain(first?.status);
+    });
+  });
+
+  describe('GET /billing-prices/audit', () => {
+    it('returns audit entries for billing reader', async () => {
+      const res = await billingReaderAgent.get(`${API}/billing-prices/audit?limit=5`).expect(200);
+      expect(Array.isArray(res.body.data.entries)).toBe(true);
+    });
+  });
+
+  describe('Authorization boundaries', () => {
+    it('returns 403 when authed admin lacks billingPrices read', async () => {
+      await noBillingAgent.get(`${API}/billing-prices`).expect(403);
+      await noBillingAgent.get(`${API}/billing-prices/windows`).expect(403);
+      await noBillingAgent.get(`${API}/product/membership`).expect(403);
+    });
+
+    it('returns 403 when billing reader attempts schedule or deprecate', async () => {
+      const effectiveFrom = new Date();
+      await billingReaderAgent
+        .post(`${API}/billing-prices`)
+        .send({
+          currencyCode: 'USD',
+          billingCadence: 'monthly',
+          amountCents: 30200,
+          effectiveFrom: effectiveFrom.toISOString(),
+          changeReason: 'should be forbidden',
+        })
+        .expect(403);
+      await billingReaderAgent.post(`${API}/billing-prices/1/deprecate`).send({}).expect(403);
+    });
+  });
+
+  describe('GET /billing-prices', () => {
+    it('returns 401 without authentication', async () => {
+      const res = await request(app).get(`${API}/billing-prices`).expect(401);
+      expect(res.body).toMatchObject({ message: 'Authentication required' });
+    });
+
+    it('returns active premium prices when authenticated', async () => {
+      const res = await superAdminAgent.get(`${API}/billing-prices`).expect(200);
+      expect(res.body.data.defaultCurrency).toBe('USD');
+      expect(Array.isArray(res.body.data.prices)).toBe(true);
+      expect(res.body.data.prices.length).toBeGreaterThanOrEqual(2);
+      const cadences = res.body.data.prices.map(
+        (row: { billingCadence: string }) => row.billingCadence
+      );
+      expect(cadences).toContain('monthly');
+      expect(cadences).toContain('annual');
+    });
+  });
+
+  describe('POST /billing-prices (schedule)', () => {
+    it('creates a new price row and audit trail', async () => {
+      const effectiveFrom = new Date();
+      const res = await superAdminAgent
+        .post(`${API}/billing-prices`)
+        .send({
+          currencyCode: 'USD',
+          billingCadence: 'monthly',
+          amountCents: 30100,
+          effectiveFrom: effectiveFrom.toISOString(),
+          changeReason: 'billing-prices integration test',
+        })
+        .expect(201);
+      expect(res.body.data.newPriceId).toEqual(expect.any(Number));
+
+      const auditRows = (await appDataSourceRead.query(
+        `SELECT COUNT(*)::int AS c FROM billing_price_change_audit WHERE billing_price_id = $1`,
+        [res.body.data.newPriceId]
+      )) as Array<{ c: number }>;
+      expect(auditRows[0]?.c).toBeGreaterThanOrEqual(1);
+    });
+  });
+
+  describe('POST /billing-prices/:id/deprecate', () => {
+    it('returns 400 for invalid id', async () => {
+      await superAdminAgent.post(`${API}/billing-prices/not-an-int/deprecate`).send({}).expect(400);
+    });
+
+    it('returns 404 for unknown price id', async () => {
+      await superAdminAgent.post(`${API}/billing-prices/999999999/deprecate`).send({}).expect(404);
+    });
+  });
+});
diff --git a/apps/management-api/src/test/helpers/setup.ts b/apps/management-api/src/test/helpers/setup.ts
index eef92a49..fa3df50b 100644
--- a/apps/management-api/src/test/helpers/setup.ts
+++ b/apps/management-api/src/test/helpers/setup.ts
@@ -2,6 +2,7 @@ import { managementDataSource } from '@metaboost/management-orm';
 import {
   appDataSourceRead,
   appDataSourceReadWrite,
+  BillingPriceCatalogService,
   DEFAULT_TERMS_LOCALIZED_CONTENT,
   DEFAULT_TERMS_TITLE,
   DEFAULT_TERMS_VERSION_KEY,
@@ -21,6 +22,7 @@ export async function initializeManagementApiTestDataSources(): Promise<void> {
     defaultTitle: DEFAULT_TERMS_TITLE,
     defaultLocalizedContent: DEFAULT_TERMS_LOCALIZED_CONTENT,
   });
+  await new BillingPriceCatalogService().resolveProductMembership(new Date());
   await managementDataSource.initialize();
 }
 
diff --git a/apps/management-api/src/test/management-admin-roles.test.ts b/apps/management-api/src/test/management-admin-roles.test.ts
index 890fd2db..255f4330 100644
--- a/apps/management-api/src/test/management-admin-roles.test.ts
+++ b/apps/management-api/src/test/management-admin-roles.test.ts
@@ -26,6 +26,7 @@ const validRoleBody = {
   bucketsCrud: 0,
   bucketMessagesCrud: 0,
   bucketAdminsCrud: 0,
+  billingPricesCrud: 0,
   eventVisibility: 'all_admins' as const,
 };
 
@@ -69,6 +70,7 @@ describe('management-api admin roles', () => {
         expect(role).toHaveProperty('bucketsCrud');
         expect(role).toHaveProperty('bucketMessagesCrud');
         expect(role).toHaveProperty('bucketAdminsCrud');
+        expect(role).toHaveProperty('billingPricesCrud');
         expect(role).toHaveProperty('eventVisibility');
         expect(role).toHaveProperty('isPredefined', true);
         expect(role.createdAt).toBeNull();
@@ -144,6 +146,7 @@ describe('management-api admin roles', () => {
       expect(res.body.role.bucketsCrud).toBe(0);
       expect(res.body.role.bucketMessagesCrud).toBe(0);
       expect(res.body.role.bucketAdminsCrud).toBe(0);
+      expect(res.body.role.billingPricesCrud).toBe(0);
       expect(res.body.role.eventVisibility).toBe('all_admins');
       expect(res.body.role.isPredefined).toBe(false);
       expect(res.body.role).toHaveProperty('id');
diff --git a/apps/management-api/src/test/management-api.test.ts b/apps/management-api/src/test/management-api.test.ts
index abb75e0c..5a43a213 100644
--- a/apps/management-api/src/test/management-api.test.ts
+++ b/apps/management-api/src/test/management-api.test.ts
@@ -46,6 +46,23 @@ describe('management-api', () => {
     });
   });
 
+  describe('GET /product/membership', () => {
+    it('returns 401 without authentication', async () => {
+      const res = await request(app).get(`${API}/product/membership`).expect(401);
+      expect(res.body).toMatchObject({ message: 'Authentication required' });
+    });
+
+    it('returns 200 with numeric defaults when authenticated as super admin', async () => {
+      const res = await superAdminAgent.get(`${API}/product/membership`).expect(200);
+      expect(res.body.data).toMatchObject({
+        freeTrialExpirationSeconds: expect.any(Number),
+        premiumMembershipCostMonthly: expect.any(Number),
+        premiumMembershipCostAnnually: expect.any(Number),
+      });
+      expect(res.body.data.freeTrialExpirationSeconds).toBeGreaterThan(0);
+    });
+  });
+
   describe('POST /auth/login', () => {
     it('returns 400 when username or password missing', async () => {
       await request(app).post(`${API}/auth/login`).send({}).expect(400);
diff --git a/apps/management-web/e2e/bucket-detail-admin-with-buckets-read-bucket-admins-permission.spec.ts b/apps/management-web/e2e/bucket-detail-admin-with-buckets-read-bucket-admins-permission.spec.ts
index b7c2f47c..a6fbd283 100644
--- a/apps/management-web/e2e/bucket-detail-admin-with-buckets-read-bucket-admins-permission.spec.ts
+++ b/apps/management-web/e2e/bucket-detail-admin-with-buckets-read-bucket-admins-permission.spec.ts
@@ -30,7 +30,7 @@ test.describe('Management bucket-detail-page for the admin (buckets:R bucket_adm
     await loginAsManagementAdminWithBucketAdmins(page);
     await page.goto(`/bucket/${E2E_BUCKET1_ID}`);
     await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID}`));
-    await expect(page.getByText(/E2E Bucket One/)).toBeVisible();
+    await expect(page.getByRole('heading', { name: 'E2E Bucket One' })).toBeVisible();
     await expect(page.getByRole('link', { name: /buckets/i })).toBeVisible();
     await expect(page.getByRole('link', { name: /public page/i })).toBeVisible();
     await expect(page.getByRole('link', { name: /messages/i })).toHaveCount(0);
@@ -59,7 +59,7 @@ test.describe('Management bucket-detail-page for the admin (buckets:R bucket_adm
       }
     );
     await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID}(?:/|$)`));
-    await expect(page.getByText(/E2E Bucket One/)).toBeVisible();
+    await expect(page.getByRole('heading', { name: 'E2E Bucket One' })).toBeVisible();
     await capturePageLoad(
       page,
       testInfo,
diff --git a/apps/management-web/e2e/bucket-detail-super-admin-full-crud.spec.ts b/apps/management-web/e2e/bucket-detail-super-admin-full-crud.spec.ts
index 48871a65..1a689bb8 100644
--- a/apps/management-web/e2e/bucket-detail-super-admin-full-crud.spec.ts
+++ b/apps/management-web/e2e/bucket-detail-super-admin-full-crud.spec.ts
@@ -38,7 +38,7 @@ test.describe('Management bucket-detail-page for the super-admin user', () => {
       }
     );
     await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID}`));
-    await expect(page.getByText(/E2E Bucket One/)).toBeVisible();
+    await expect(page.getByRole('heading', { name: 'E2E Bucket One' })).toBeVisible();
     await expect(page.getByRole('link', { name: /messages/i })).toBeVisible();
     await expect(page.getByRole('link', { name: /buckets/i })).toBeVisible();
     await expect(page.getByRole('link', { name: /settings/i })).toBeVisible();
diff --git a/apps/management-web/e2e/bucket-detail-url-state-contract.spec.ts b/apps/management-web/e2e/bucket-detail-url-state-contract.spec.ts
index f71bf140..0d9d72be 100644
--- a/apps/management-web/e2e/bucket-detail-url-state-contract.spec.ts
+++ b/apps/management-web/e2e/bucket-detail-url-state-contract.spec.ts
@@ -1,3 +1,5 @@
+import type { Page } from '@playwright/test';
+
 import { expect, test } from '@playwright/test';
 
 import { loginAsManagementSuperAdmin } from './helpers/advancedFixtures';
@@ -7,6 +9,11 @@ import { setE2EUserContext } from './helpers/userContext';
 /** UUID from tools/web/seed-e2e.mjs E2E_BUCKET1_ID (main DB; management E2E runs after full seed). */
 const E2E_BUCKET1_ID = '22222222-2222-4222-a222-222222222222';
 
+/** Breadcrumb + child row "E2E Bucket One Child" also match getByText; heading is unique. */
+function bucketOnePageHeading(page: Page) {
+  return page.getByRole('heading', { name: 'E2E Bucket One' });
+}
+
 test.describe('URL-state contracts for the management bucket-detail-page (tab, sortBy, sortOrder)', () => {
   test('When the super-admin opens the bucket-detail-page with tab=buckets and sortBy=name and sortOrder=asc, the URL preserves the params and the buckets-tab content is visible.', async ({
     page,
@@ -24,11 +31,11 @@ test.describe('URL-state contracts for the management bucket-detail-page (tab, s
         expect(url.searchParams.get('tab')).toBe('buckets');
         expect(url.searchParams.get('sortBy')).toBe('name');
         expect(url.searchParams.get('sortOrder')).toBe('asc');
-        await expect(page.getByText(/E2E Bucket One/)).toBeVisible();
+        await expect(bucketOnePageHeading(page)).toBeVisible();
         await expect(page.getByRole('link', { name: /buckets/i }).first()).toBeVisible();
       }
     );
-    const bucketTitle = page.getByText(/E2E Bucket One/);
+    const bucketTitle = bucketOnePageHeading(page);
     await capturePageLoad(
       page,
       testInfo,
@@ -52,10 +59,10 @@ test.describe('URL-state contracts for the management bucket-detail-page (tab, s
         expect(url.pathname).toBe(`/bucket/${E2E_BUCKET1_ID}`);
         expect(url.searchParams.get('tab')).toBe('messages');
         expect(url.searchParams.get('sort')).toBe('oldest');
-        await expect(page.getByText(/E2E Bucket One/)).toBeVisible();
+        await expect(bucketOnePageHeading(page)).toBeVisible();
       }
     );
-    const bucketTitle = page.getByText(/E2E Bucket One/);
+    const bucketTitle = bucketOnePageHeading(page);
     await capturePageLoad(
       page,
       testInfo,
diff --git a/apps/management-web/e2e/dashboard-super-admin-full-crud.spec.ts b/apps/management-web/e2e/dashboard-super-admin-full-crud.spec.ts
index 057e30e9..91336ba2 100644
--- a/apps/management-web/e2e/dashboard-super-admin-full-crud.spec.ts
+++ b/apps/management-web/e2e/dashboard-super-admin-full-crud.spec.ts
@@ -35,6 +35,7 @@ test.describe('Management dashboard-page for the super-admin user', () => {
         await expect(page.locator('a[href="/terms-versions"]')).toHaveCount(1);
         await expect(page.locator('a[href="/users"]')).toHaveCount(1);
         await expect(page.locator('a[href="/buckets"]')).toHaveCount(1);
+        await expect(page.locator('a[href="/products/membership"]')).toHaveCount(1);
       }
     );
   });
diff --git a/apps/management-web/e2e/helpers/advancedFixtures.ts b/apps/management-web/e2e/helpers/advancedFixtures.ts
index 1d2a0498..64f9a567 100644
--- a/apps/management-web/e2e/helpers/advancedFixtures.ts
+++ b/apps/management-web/e2e/helpers/advancedFixtures.ts
@@ -175,6 +175,7 @@ export async function createAdminRoleFixture(
       bucketsCrud: 2,
       bucketMessagesCrud: 2,
       bucketAdminsCrud: 2,
+      billingPricesCrud: 2,
       eventVisibility: 'all_admins',
     },
   });
diff --git a/apps/management-web/e2e/helpers/seedConstants.ts b/apps/management-web/e2e/helpers/seedConstants.ts
new file mode 100644
index 00000000..a150f2f5
--- /dev/null
+++ b/apps/management-web/e2e/helpers/seedConstants.ts
@@ -0,0 +1,5 @@
+/**
+ * Entity id guaranteed absent from tools/web/seed-e2e.mjs.
+ * Do not use 99999999-9999-4999-a999-999999999999 for "missing user" cases — that is E2E_USER7_ID (Terms Delete).
+ */
+export const E2E_NONEXISTENT_ENTITY_ID = '00000000-0000-0000-0000-000000000000';
diff --git a/apps/management-web/e2e/products-membership-billing.spec.ts b/apps/management-web/e2e/products-membership-billing.spec.ts
new file mode 100644
index 00000000..c40bdceb
--- /dev/null
+++ b/apps/management-web/e2e/products-membership-billing.spec.ts
@@ -0,0 +1,30 @@
+import { test, expect } from '@playwright/test';
+
+import { loginAsManagementSuperAdmin } from './helpers/advancedFixtures';
+import { actionAndCapture, capturePageLoad } from './helpers/stepScreenshots';
+import { setE2EUserContext } from './helpers/userContext';
+
+test.describe('Membership billing page for the super-admin user', () => {
+  test('When the super-admin opens membership billing, the page shows governance sections for resolved membership pricing and price windows.', async ({
+    page,
+  }, testInfo) => {
+    setE2EUserContext(testInfo, 'super-admin');
+    await actionAndCapture(
+      page,
+      testInfo,
+      'User logs in as the seeded super-admin identity and navigates to the membership billing governance page.',
+      async () => {
+        await loginAsManagementSuperAdmin(page);
+        await page.goto('/products/membership');
+        await expect(page.getByRole('heading', { name: /membership billing/i })).toBeVisible();
+        await expect(page.getByText(/resolved membership pricing/i)).toBeVisible();
+        await expect(page.getByText(/price windows/i)).toBeVisible();
+      }
+    );
+    await capturePageLoad(
+      page,
+      testInfo,
+      'The membership billing page remains visible with primary governance sections after navigation.'
+    );
+  });
+});
diff --git a/apps/management-web/e2e/user-detail-limited-admin-users-read.spec.ts b/apps/management-web/e2e/user-detail-limited-admin-users-read.spec.ts
index 171d7270..73b869bf 100644
--- a/apps/management-web/e2e/user-detail-limited-admin-users-read.spec.ts
+++ b/apps/management-web/e2e/user-detail-limited-admin-users-read.spec.ts
@@ -2,6 +2,7 @@ import { expect, test } from '@playwright/test';
 
 import { loginAsLimitedAdmin } from './helpers/advancedFixtures';
 import { expectInvalidRouteShowsNotFound } from './helpers/flowHelpers';
+import { E2E_NONEXISTENT_ENTITY_ID } from './helpers/seedConstants';
 import { actionAndCapture, capturePageLoad } from './helpers/stepScreenshots';
 import { setE2EUserContext } from './helpers/userContext';
 
@@ -18,7 +19,7 @@ test.describe('Management user-detail-page for the admin (admins users events:ow
       testInfo,
       'User navigates to the management user-detail-page with an invalid user id and sees not found.',
       async () => {
-        await page.goto('/user/99999999-9999-4999-a999-999999999999');
+        await page.goto(`/user/${E2E_NONEXISTENT_ENTITY_ID}`);
       }
     );
   });
diff --git a/apps/management-web/e2e/user-detail-super-admin-full-crud.spec.ts b/apps/management-web/e2e/user-detail-super-admin-full-crud.spec.ts
index 1187f414..cae0fc56 100644
--- a/apps/management-web/e2e/user-detail-super-admin-full-crud.spec.ts
+++ b/apps/management-web/e2e/user-detail-super-admin-full-crud.spec.ts
@@ -2,6 +2,7 @@ import { expect, test } from '@playwright/test';
 
 import { loginAsManagementSuperAdmin } from './helpers/advancedFixtures';
 import { expectInvalidRouteShowsNotFound } from './helpers/flowHelpers';
+import { E2E_NONEXISTENT_ENTITY_ID } from './helpers/seedConstants';
 import { actionAndCapture, capturePageLoad } from './helpers/stepScreenshots';
 import { setE2EUserContext } from './helpers/userContext';
 
@@ -18,7 +19,7 @@ test.describe('Management user-detail-page for the super-admin user', () => {
       testInfo,
       'User navigates to the management user-detail-page with an invalid user id and sees not found.',
       async () => {
-        await page.goto('/user/99999999-9999-4999-a999-999999999999');
+        await page.goto(`/user/${E2E_NONEXISTENT_ENTITY_ID}`);
       }
     );
   });
diff --git a/apps/management-web/e2e/users-new-super-admin-full-crud.spec.ts b/apps/management-web/e2e/users-new-super-admin-full-crud.spec.ts
index b62d832e..e992f9ca 100644
--- a/apps/management-web/e2e/users-new-super-admin-full-crud.spec.ts
+++ b/apps/management-web/e2e/users-new-super-admin-full-crud.spec.ts
@@ -91,13 +91,15 @@ test.describe('Management users-new-page for the super-admin user', () => {
 
     const currentPath = new URL(page.url()).pathname;
     if (currentPath === '/users/new') {
-      await expect(page.getByText(/user created|set-password link/i).first()).toBeVisible();
+      await expect(
+        page.getByText(/user created|invitation link|set-password link/i).first()
+      ).toBeVisible();
       await expect(page.getByRole('button', { name: /back to users/i })).toBeVisible();
       await expect(page.getByRole('button', { name: /copy link|link copied/i })).toBeVisible();
       await capturePageLoad(
         page,
         testInfo,
-        'The users-new-page shows success state with set-password link.'
+        'The users-new-page shows success state with invitation or set-password link.'
       );
       return;
     }
diff --git a/apps/management-web/i18n/originals/en-US.json b/apps/management-web/i18n/originals/en-US.json
index a34b0879..5a7fccad 100644
--- a/apps/management-web/i18n/originals/en-US.json
+++ b/apps/management-web/i18n/originals/en-US.json
@@ -126,6 +126,7 @@
   "common": {
     "loading": "Loading…",
     "globalBlockedApps": "Global blocked apps",
+    "productsMembership": "Membership billing",
     "dashboard": "Dashboard",
     "profile": "Profile",
     "settings": "Settings",
@@ -261,6 +262,7 @@
       "bucketsCrud": "Buckets CRUD",
       "bucketMessagesCrud": "Bucket Messages CRUD",
       "bucketAdminsCrud": "Bucket Admins CRUD",
+      "billingPricesCrud": "Billing Prices CRUD",
       "eventVisibility": "Event visibility",
       "eventVisibilityOwn": "Own events only",
       "eventVisibilityAllAdmins": "All admin events",
@@ -440,16 +442,17 @@
       "emailOptional": "Email (optional)",
       "usernameOptional": "Username (optional)",
       "emailOrUsernameRequired": "Enter at least one: email or username",
-      "emailOrUsernameHint": "At least one of email or username is required. If you leave password blank, a set-password link will be generated.",
+      "emailOrUsernameHint": "At least one of email or username is required.",
       "passwordOptional": "Password (optional)",
+      "passwordInviteHint": "If you leave password blank, the user receives an invitation link you can share so they can set their password.",
       "username": "Username",
       "usernameRequired": "Username is required",
       "initialBucketAdmins": "Add as admin to buckets (optional)",
-      "setPasswordLinkLabel": "Set-password link (share with user)",
+      "setPasswordLinkLabel": "Invitation link (share with user)",
       "copyLink": "Copy link",
       "linkCopied": "Link copied",
       "backToList": "Back to users",
-      "userCreatedWithLink": "User created. Share the set-password link with them.",
+      "userCreatedWithLink": "User created. Share the invitation link with them.",
       "membershipTierLabel": "Membership status",
       "membershipTierTrial": "Trial",
       "membershipTierPremium": "Premium",
@@ -458,6 +461,10 @@
       "membershipStatusMembership": "Membership",
       "membershipStatusLabel": "Status shown to user",
       "membershipTrialLimitations": "Trial has reduced feature access until the account is upgraded.",
+      "premiumBillingCadenceLabel": "Premium billing cadence",
+      "premiumBillingCadenceMonthly": "Monthly",
+      "premiumBillingCadenceAnnual": "Annual",
+      "premiumBillingCadenceHint": "Used with Premium to suggest membership end date (+1 month vs +12 months from today).",
       "membershipExpiresAtLabel": "Membership expires at",
       "autoRenewLabel": "Auto renew",
       "trustTierLabel": "Trust tier",
@@ -504,9 +511,52 @@
       },
       "buckets": {
         "description": "Manage buckets, admins, roles, and messages."
+      },
+      "productsMembership": {
+        "description": "Review membership defaults, price windows, scheduled changes, and audit history."
       }
     }
   },
+  "billingGovernance": {
+    "pageTitle": "Membership billing",
+    "resolvedMembership": "Resolved membership pricing",
+    "freeTrialSeconds": "Free trial duration (seconds)",
+    "premiumMonthly": "Premium monthly (list currency)",
+    "premiumAnnual": "Premium annual (list currency)",
+    "priceWindows": "Price windows",
+    "auditLog": "Price change audit",
+    "columnStatus": "Status",
+    "columnCurrency": "Currency",
+    "columnCadence": "Cadence",
+    "columnAmount": "Amount",
+    "columnEffectiveFrom": "Effective from",
+    "columnEffectiveTo": "Effective to",
+    "columnSource": "Source",
+    "columnWhen": "When",
+    "columnReason": "Reason",
+    "columnActor": "Actor",
+    "cadenceMonthly": "Monthly",
+    "cadenceAnnual": "Annual",
+    "statusActive": "Active",
+    "statusScheduled": "Scheduled",
+    "statusHistorical": "Historical",
+    "scheduleHeading": "Schedule or apply a price change",
+    "currencyCode": "Currency code",
+    "billingCadence": "Billing cadence",
+    "amountDollars": "Amount (major units)",
+    "effectiveFrom": "Effective from (local)",
+    "changeReasonOptional": "Reason (optional)",
+    "scheduleSubmit": "Schedule change",
+    "deprecate": "Close window now",
+    "deprecateReasonOptional": "Deprecation reason (optional)",
+    "loadError": "Failed to load billing data.",
+    "validationAmount": "Enter a valid non-negative amount.",
+    "validationEffective": "Choose an effective date and time.",
+    "scheduleSuccess": "Price change recorded.",
+    "deprecateSuccess": "Price window closed.",
+    "columnActions": "Actions",
+    "unknownCurrency": "—"
+  },
   "profile": {
     "title": "Profile",
     "profileInformation": "Info",
@@ -552,7 +602,15 @@
     "loginFailed": "Login failed",
     "failedToLoadAdmins": "Failed to load admins",
     "failedToLoadEvents": "Failed to load events",
-    "deleteFailed": "Delete failed"
+    "deleteFailed": "Delete failed",
+    "boundary_title": "Something went wrong",
+    "boundary_message": "An unexpected error occurred. Please try again.",
+    "global_title": "Application error",
+    "global_message": "A critical error occurred. Please refresh the page.",
+    "details_development_only": "Error details (development only)",
+    "try_again": "Try again",
+    "reload_page": "Reload page",
+    "return_to_home_page": "Go to home"
   },
   "ui": {
     "auth": {
diff --git a/apps/management-web/i18n/originals/es.json b/apps/management-web/i18n/originals/es.json
index e88a815c..64cd280b 100644
--- a/apps/management-web/i18n/originals/es.json
+++ b/apps/management-web/i18n/originals/es.json
@@ -126,6 +126,7 @@
   "common": {
     "loading": "Cargando…",
     "globalBlockedApps": "Apps bloqueadas globalmente",
+    "productsMembership": "Facturación de membresía",
     "dashboard": "Panel",
     "profile": "Perfil",
     "settings": "Ajustes",
@@ -261,6 +262,7 @@
       "bucketsCrud": "CRUD de buckets",
       "bucketMessagesCrud": "CRUD de mensajes del bucket",
       "bucketAdminsCrud": "CRUD de administradores de bucket",
+      "billingPricesCrud": "CRUD de precios de facturación",
       "eventVisibility": "Visibilidad de eventos",
       "eventVisibilityOwn": "Solo mis eventos",
       "eventVisibilityAllAdmins": "Todos los eventos de administradores",
@@ -442,6 +444,7 @@
       "emailOrUsernameRequired": "Introduce al menos uno: correo o nombre de usuario",
       "emailOrUsernameHint": "Es obligatorio indicar al menos correo o nombre de usuario. Si dejas la contraseña en blanco, se generará un enlace para establecerla.",
       "passwordOptional": "Contraseña (opcional)",
+      "passwordInviteHint": "Si dejas la contraseña en blanco, el usuario recibe un enlace de invitación que puedes compartir para que establezca su contraseña.",
       "username": "Nombre de usuario",
       "usernameRequired": "El nombre de usuario es obligatorio",
       "initialBucketAdmins": "Añadir como administrador a buckets (opcional)",
@@ -452,12 +455,16 @@
       "userCreatedWithLink": "Usuario creado. Comparte con ellos el enlace para establecer la contraseña.",
       "membershipTierLabel": "Estado de membresía",
       "membershipTierTrial": "Prueba",
-      "membershipTierPremium": "Premium",
+      "membershipTierPremium": "",
       "membershipTierTrialHelp": "Prueba asigna por defecto nivel no confiable y límites más ajustados.",
       "membershipTierPremiumHelp": "Premium asigna por defecto nivel confiable y acceso más amplio.",
       "membershipStatusMembership": "Membresía",
       "membershipStatusLabel": "Estado mostrado al usuario",
       "membershipTrialLimitations": "Prueba tiene acceso reducido a funciones hasta que la cuenta se actualice.",
+      "premiumBillingCadenceLabel": "Periodicidad de facturación Premium",
+      "premiumBillingCadenceMonthly": "Mensual",
+      "premiumBillingCadenceAnnual": "Anual",
+      "premiumBillingCadenceHint": "Se usa con Premium para sugerir la fecha de fin de membresía (+1 mes frente a +12 meses desde hoy).",
       "membershipExpiresAtLabel": "La membresía vence el",
       "autoRenewLabel": "Renovación automática",
       "trustTierLabel": "Nivel de confianza",
@@ -504,9 +511,52 @@
       },
       "buckets": {
         "description": "Administra buckets, administradores, roles y mensajes."
+      },
+      "productsMembership": {
+        "description": "Revisa valores por defecto de membresía, ventanas de precio, cambios programados e historial de auditoría."
       }
     }
   },
+  "billingGovernance": {
+    "pageTitle": "Facturación de membresía",
+    "resolvedMembership": "Precios de membresía resueltos",
+    "freeTrialSeconds": "Duración de prueba gratuita (segundos)",
+    "premiumMonthly": "Premium mensual (moneda de lista)",
+    "premiumAnnual": "Premium anual (moneda de lista)",
+    "priceWindows": "Ventanas de precio",
+    "auditLog": "Auditoría de cambios de precio",
+    "columnStatus": "Estado",
+    "columnCurrency": "Moneda",
+    "columnCadence": "Cadencia",
+    "columnAmount": "Importe",
+    "columnEffectiveFrom": "Vigente desde",
+    "columnEffectiveTo": "Vigente hasta",
+    "columnSource": "Origen",
+    "columnWhen": "Cuándo",
+    "columnReason": "Motivo",
+    "columnActor": "Actor",
+    "cadenceMonthly": "Mensual",
+    "cadenceAnnual": "Anual",
+    "statusActive": "Activo",
+    "statusScheduled": "Programado",
+    "statusHistorical": "Histórico",
+    "scheduleHeading": "Programar o aplicar un cambio de precio",
+    "currencyCode": "Código de moneda",
+    "billingCadence": "Cadencia de facturación",
+    "amountDollars": "Importe (unidades mayores)",
+    "effectiveFrom": "Vigente desde (local)",
+    "changeReasonOptional": "Motivo (opcional)",
+    "scheduleSubmit": "Programar cambio",
+    "deprecate": "Cerrar ventana ahora",
+    "deprecateReasonOptional": "Motivo de cierre (opcional)",
+    "loadError": "No se pudieron cargar los datos de facturación.",
+    "validationAmount": "Introduce un importe válido no negativo.",
+    "validationEffective": "Elige una fecha y hora de vigencia.",
+    "scheduleSuccess": "Cambio de precio registrado.",
+    "deprecateSuccess": "Ventana de precio cerrada.",
+    "columnActions": "Acciones",
+    "unknownCurrency": "—"
+  },
   "profile": {
     "title": "Perfil",
     "profileInformation": "Información",
@@ -552,7 +602,15 @@
     "loginFailed": "Error al iniciar sesión",
     "failedToLoadAdmins": "Error al cargar administradores",
     "failedToLoadEvents": "Error al cargar eventos",
-    "deleteFailed": "Error al eliminar"
+    "deleteFailed": "Error al eliminar",
+    "boundary_title": "Algo salió mal",
+    "boundary_message": "Ocurrió un error inesperado. Por favor, inténtalo de nuevo.",
+    "global_title": "Error de la aplicación",
+    "global_message": "Ocurrió un error crítico. Por favor, actualiza la página.",
+    "details_development_only": "Detalles del error (solo desarrollo)",
+    "try_again": "Intentar de nuevo",
+    "reload_page": "Recargar página",
+    "return_to_home_page": "Ir al inicio"
   },
   "ui": {
     "auth": {
diff --git a/apps/management-web/i18n/overrides/es.json b/apps/management-web/i18n/overrides/es.json
index 0a44baad..a4953c30 100644
--- a/apps/management-web/i18n/overrides/es.json
+++ b/apps/management-web/i18n/overrides/es.json
@@ -126,6 +126,7 @@
   "common": {
     "loading": "",
     "globalBlockedApps": "",
+    "productsMembership": "",
     "dashboard": "",
     "profile": "",
     "settings": "",
@@ -261,6 +262,7 @@
       "bucketsCrud": "",
       "bucketMessagesCrud": "",
       "bucketAdminsCrud": "",
+      "billingPricesCrud": "",
       "eventVisibility": "",
       "eventVisibilityOwn": "",
       "eventVisibilityAllAdmins": "",
@@ -442,6 +444,7 @@
       "emailOrUsernameRequired": "",
       "emailOrUsernameHint": "",
       "passwordOptional": "",
+      "passwordInviteHint": "",
       "username": "",
       "usernameRequired": "",
       "initialBucketAdmins": "",
@@ -458,6 +461,10 @@
       "membershipStatusMembership": "",
       "membershipStatusLabel": "",
       "membershipTrialLimitations": "",
+      "premiumBillingCadenceLabel": "",
+      "premiumBillingCadenceMonthly": "",
+      "premiumBillingCadenceAnnual": "",
+      "premiumBillingCadenceHint": "",
       "membershipExpiresAtLabel": "",
       "autoRenewLabel": "",
       "trustTierLabel": "",
@@ -504,9 +511,52 @@
       },
       "buckets": {
         "description": ""
+      },
+      "productsMembership": {
+        "description": ""
       }
     }
   },
+  "billingGovernance": {
+    "pageTitle": "",
+    "resolvedMembership": "",
+    "freeTrialSeconds": "",
+    "premiumMonthly": "",
+    "premiumAnnual": "",
+    "priceWindows": "",
+    "auditLog": "",
+    "columnStatus": "",
+    "columnCurrency": "",
+    "columnCadence": "",
+    "columnAmount": "",
+    "columnEffectiveFrom": "",
+    "columnEffectiveTo": "",
+    "columnSource": "",
+    "columnWhen": "",
+    "columnReason": "",
+    "columnActor": "",
+    "cadenceMonthly": "",
+    "cadenceAnnual": "",
+    "statusActive": "",
+    "statusScheduled": "",
+    "statusHistorical": "",
+    "scheduleHeading": "",
+    "currencyCode": "",
+    "billingCadence": "",
+    "amountDollars": "",
+    "effectiveFrom": "",
+    "changeReasonOptional": "",
+    "scheduleSubmit": "",
+    "deprecate": "",
+    "deprecateReasonOptional": "",
+    "loadError": "",
+    "validationAmount": "",
+    "validationEffective": "",
+    "scheduleSuccess": "",
+    "deprecateSuccess": "",
+    "columnActions": "",
+    "unknownCurrency": ""
+  },
   "profile": {
     "title": "",
     "profileInformation": "",
@@ -552,7 +602,15 @@
     "loginFailed": "",
     "failedToLoadAdmins": "",
     "failedToLoadEvents": "",
-    "deleteFailed": ""
+    "deleteFailed": "",
+    "boundary_title": "",
+    "boundary_message": "",
+    "global_title": "",
+    "global_message": "",
+    "details_development_only": "",
+    "try_again": "",
+    "reload_page": "",
+    "return_to_home_page": ""
   },
   "ui": {
     "auth": {
diff --git a/apps/management-web/sidecar/src/server.ts b/apps/management-web/sidecar/src/server.ts
index 33fab2c5..60eb7c61 100644
--- a/apps/management-web/sidecar/src/server.ts
+++ b/apps/management-web/sidecar/src/server.ts
@@ -28,7 +28,10 @@ const requiredKeys = [
   'MANAGEMENT_API_SERVER_BASE_URL',
 ] as const;
 
-const allKeys = [...requiredKeys];
+/** Optional public keys — keep in sync with apps/management-web/src/config/runtime-config.ts */
+const optionalKeys = [] as const;
+
+const allKeys = [...requiredKeys, ...optionalKeys];
 
 function validateManagementWebSidecarPort(): ValidationResult {
   const value = process.env.MANAGEMENT_WEB_SIDECAR_PORT;
@@ -111,6 +114,9 @@ function buildValidationResults(): ValidationResult[] {
   for (const key of requiredKeys) {
     results.push(validateOne(key));
   }
+  for (const key of optionalKeys) {
+    results.push(validateOne(key));
+  }
   return results;
 }
 
diff --git a/apps/management-web/src/app/(main)/admin/[id]/edit/page.tsx b/apps/management-web/src/app/(main)/admin/[id]/edit/page.tsx
index 2bb214d6..575fae11 100644
--- a/apps/management-web/src/app/(main)/admin/[id]/edit/page.tsx
+++ b/apps/management-web/src/app/(main)/admin/[id]/edit/page.tsx
@@ -6,12 +6,14 @@ import { getTranslations } from 'next-intl/server';
 import { notFound, redirect } from 'next/navigation';
 
 import { request } from '@metaboost/helpers-requests';
-import { Breadcrumbs, ContentPageLayout, Link } from '@metaboost/ui';
+import { Breadcrumbs, ContentPageLayout } from '@metaboost/ui';
 
 import { AdminForm } from '../../../../../components/admins/AdminForm';
+import { ManagementBreadcrumbLink } from '../../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../../components/ResourcePageCard';
 import { getServerManagementApiBaseUrl } from '../../../../../config/env';
 import { getCrudFlags } from '../../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../../lib/management-breadcrumbs';
 import { ROUTES, adminViewRoute } from '../../../../../lib/routes';
 import { getServerUser } from '../../../../../lib/server-auth';
 import { getCookieHeader } from '../../../../../lib/server-request';
@@ -66,31 +68,15 @@ export default async function EditAdminPage({ params }: EditAdminPageProps) {
 
   const tCommon = await getTranslations('common');
   const adminLabel = admin.displayName ?? admin.username;
-  const breadcrumbItems: BreadcrumbItem[] = [
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
     { label: tCommon('admins'), href: ROUTES.ADMINS },
     { label: adminLabel, href: adminViewRoute(id) },
     { label: tCommon('edit'), href: undefined },
-  ];
-
-  function BreadcrumbLink({
-    href,
-    children,
-    className,
-  }: {
-    href: string;
-    children: React.ReactNode;
-    className?: string;
-  }) {
-    return (
-      <Link href={href} className={className}>
-        {children}
-      </Link>
-    );
-  }
+  ]);
 
   return (
     <ContentPageLayout
-      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={BreadcrumbLink} />}
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
       contentMaxWidth="form"
     >
       <ResourcePageCard title={tCommon('editAdminTitle', { name: adminLabel })} skipContainer>
diff --git a/apps/management-web/src/app/(main)/admin/[id]/page.tsx b/apps/management-web/src/app/(main)/admin/[id]/page.tsx
index c6e75e37..7d29b788 100644
--- a/apps/management-web/src/app/(main)/admin/[id]/page.tsx
+++ b/apps/management-web/src/app/(main)/admin/[id]/page.tsx
@@ -1,16 +1,26 @@
 import type { ManagementUser } from '../../../../types/management-api';
 import type { CrudBit } from '@metaboost/helpers';
+import type { BreadcrumbItem } from '@metaboost/ui';
 
 import { getTranslations } from 'next-intl/server';
 import { notFound, redirect } from 'next/navigation';
 
 import { bitmaskToFlags } from '@metaboost/helpers';
 import { request } from '@metaboost/helpers-requests';
-import { ButtonLink, FormActions, Stack, Text } from '@metaboost/ui';
+import {
+  Breadcrumbs,
+  ButtonLink,
+  ContentPageLayout,
+  FormActions,
+  Stack,
+  Text,
+} from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../components/ResourcePageCard';
 import { getServerManagementApiBaseUrl } from '../../../../config/env';
 import { getCrudFlags, hasReadPermission } from '../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../lib/management-breadcrumbs';
 import { ROUTES, adminEditRoute } from '../../../../lib/routes';
 import { getServerUser } from '../../../../lib/server-auth';
 import { getCookieHeader } from '../../../../lib/server-request';
@@ -77,46 +87,58 @@ export default async function ViewAdminPage({ params }: ViewAdminPageProps) {
     return set.length > 0 ? set.join(', ') : '—';
   }
 
+  const adminLabel = admin.displayName ?? admin.username;
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: tCommon('admins'), href: ROUTES.ADMINS },
+    { label: adminLabel, href: undefined },
+  ]);
+
   return (
-    <ResourcePageCard
-      title={tCommon('viewAdminTitle', { name: admin.displayName ?? admin.username })}
+    <ContentPageLayout
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
+      contentMaxWidth="form"
     >
-      <Stack>
-        <Text>
-          <strong>{tCommon('adminsTable.displayName')}:</strong> {admin.displayName ?? '—'}
-        </Text>
-        <Text>
-          <strong>{tCommon('adminsTable.username')}:</strong> {admin.username}
-        </Text>
-        {admin.isSuperAdmin !== true &&
-          admin.permissions !== undefined &&
-          admin.permissions !== null && (
-            <>
-              <Text>
-                <strong>{tForm('adminsCrud')}:</strong>{' '}
-                {formatCrudFlags(admin.permissions.adminsCrud)}
-              </Text>
-              <Text>
-                <strong>{tForm('usersCrud')}:</strong>{' '}
-                {formatCrudFlags(admin.permissions.usersCrud)}
-              </Text>
-              <Text>
-                <strong>{tForm('eventVisibility')}:</strong> {admin.permissions.eventVisibility}
-              </Text>
-            </>
-          )}
-        {admin.isSuperAdmin === true && <Text>{tCommon('viewAdminSuperAdminNote')}</Text>}
-        <FormActions>
-          <ButtonLink href={ROUTES.ADMINS} variant="secondary">
-            {tCommon('adminForm.cancel')}
-          </ButtonLink>
-          {canEdit && (
-            <ButtonLink href={adminEditRoute(id)} variant="primary">
-              {tCommon('adminsTable.edit')}
+      <ResourcePageCard
+        title={tCommon('viewAdminTitle', { name: admin.displayName ?? admin.username })}
+        skipContainer
+      >
+        <Stack>
+          <Text>
+            <strong>{tCommon('adminsTable.displayName')}:</strong> {admin.displayName ?? '—'}
+          </Text>
+          <Text>
+            <strong>{tCommon('adminsTable.username')}:</strong> {admin.username}
+          </Text>
+          {admin.isSuperAdmin !== true &&
+            admin.permissions !== undefined &&
+            admin.permissions !== null && (
+              <>
+                <Text>
+                  <strong>{tForm('adminsCrud')}:</strong>{' '}
+                  {formatCrudFlags(admin.permissions.adminsCrud)}
+                </Text>
+                <Text>
+                  <strong>{tForm('usersCrud')}:</strong>{' '}
+                  {formatCrudFlags(admin.permissions.usersCrud)}
+                </Text>
+                <Text>
+                  <strong>{tForm('eventVisibility')}:</strong> {admin.permissions.eventVisibility}
+                </Text>
+              </>
+            )}
+          {admin.isSuperAdmin === true && <Text>{tCommon('viewAdminSuperAdminNote')}</Text>}
+          <FormActions>
+            <ButtonLink href={ROUTES.ADMINS} variant="secondary">
+              {tCommon('adminForm.cancel')}
             </ButtonLink>
-          )}
-        </FormActions>
-      </Stack>
-    </ResourcePageCard>
+            {canEdit && (
+              <ButtonLink href={adminEditRoute(id)} variant="primary">
+                {tCommon('adminsTable.edit')}
+              </ButtonLink>
+            )}
+          </FormActions>
+        </Stack>
+      </ResourcePageCard>
+    </ContentPageLayout>
   );
 }
diff --git a/apps/management-web/src/app/(main)/admins/new/page.tsx b/apps/management-web/src/app/(main)/admins/new/page.tsx
index 2929b27a..28911144 100644
--- a/apps/management-web/src/app/(main)/admins/new/page.tsx
+++ b/apps/management-web/src/app/(main)/admins/new/page.tsx
@@ -3,30 +3,16 @@ import type { BreadcrumbItem } from '@metaboost/ui';
 import { getTranslations } from 'next-intl/server';
 import { redirect } from 'next/navigation';
 
-import { Breadcrumbs, ContentPageLayout, Link } from '@metaboost/ui';
+import { Breadcrumbs, ContentPageLayout } from '@metaboost/ui';
 
 import { AdminForm } from '../../../../components/admins/AdminForm';
+import { ManagementBreadcrumbLink } from '../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../components/ResourcePageCard';
 import { getCrudFlags } from '../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../../lib/routes';
 import { getServerUser } from '../../../../lib/server-auth';
 
-function BreadcrumbLink({
-  href,
-  children,
-  className,
-}: {
-  href: string;
-  children: React.ReactNode;
-  className?: string;
-}) {
-  return (
-    <Link href={href} className={className}>
-      {children}
-    </Link>
-  );
-}
-
 export default async function NewAdminPage() {
   const user = await getServerUser();
 
@@ -42,14 +28,14 @@ export default async function NewAdminPage() {
   const canEditPermissions = crud.create || crud.update;
 
   const tCommon = await getTranslations('common');
-  const breadcrumbItems: BreadcrumbItem[] = [
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
     { label: tCommon('admins'), href: ROUTES.ADMINS },
     { label: tCommon('addAdminTitle'), href: undefined },
-  ];
+  ]);
 
   return (
     <ContentPageLayout
-      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={BreadcrumbLink} />}
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
       contentMaxWidth="form"
     >
       <ResourcePageCard title={tCommon('addAdminTitle')} skipContainer>
diff --git a/apps/management-web/src/app/(main)/admins/page.tsx b/apps/management-web/src/app/(main)/admins/page.tsx
index bd49b52c..d38371ca 100644
--- a/apps/management-web/src/app/(main)/admins/page.tsx
+++ b/apps/management-web/src/app/(main)/admins/page.tsx
@@ -1,4 +1,5 @@
 import type { ManagementUser } from '../../../types/management-api';
+import type { BreadcrumbItem } from '@metaboost/ui';
 
 import { getTranslations } from 'next-intl/server';
 import { cookies } from 'next/headers';
@@ -7,6 +8,7 @@ import { redirect } from 'next/navigation';
 import { DEFAULT_PAGE_LIMIT } from '@metaboost/helpers';
 import { request } from '@metaboost/helpers-requests';
 import {
+  Breadcrumbs,
   FilterTablePageLayout,
   getSortPrefsFromCookieValue,
   getTableListStateEntryFromCookieValue,
@@ -14,9 +16,11 @@ import {
 } from '@metaboost/ui';
 
 import { AdminsTableWithFilter } from '../../../components/AdminsTableWithFilter';
+import { ManagementBreadcrumbLink } from '../../../components/ManagementBreadcrumbLink';
 import { getManagementApiBaseUrl, getServerManagementApiBaseUrl } from '../../../config/env';
 import { TABLE_LIST_STATE_COOKIE_NAME, TABLE_SORT_PREFS_COOKIE_NAME } from '../../../lib/cookies';
 import { getCrudFlags, hasReadPermission } from '../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../lib/management-breadcrumbs';
 import { parseFilterColumns } from '../../../lib/parseFilterColumns';
 import { ROUTES } from '../../../lib/routes';
 import { getServerUser } from '../../../lib/server-auth';
@@ -134,6 +138,9 @@ export default async function AdminsPage({ searchParams }: PageProps) {
       : cookieSort?.sortOrder;
 
   const tCommon = await getTranslations('common');
+  const listBreadcrumbs: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: tCommon('admins'), href: undefined },
+  ]);
   const { data, error } = await fetchAdmins(
     page,
     limit,
@@ -177,6 +184,7 @@ export default async function AdminsPage({ searchParams }: PageProps) {
 
   return (
     <FilterTablePageLayout
+      breadcrumbs={<Breadcrumbs items={listBreadcrumbs} LinkComponent={ManagementBreadcrumbLink} />}
       title={tCommon('admins')}
       error={error !== null ? error : undefined}
       errorVariant="error"
diff --git a/apps/management-web/src/app/(main)/admins/roles/new/page.tsx b/apps/management-web/src/app/(main)/admins/roles/new/page.tsx
index 7c0871f5..804c2159 100644
--- a/apps/management-web/src/app/(main)/admins/roles/new/page.tsx
+++ b/apps/management-web/src/app/(main)/admins/roles/new/page.tsx
@@ -1,11 +1,16 @@
+import type { BreadcrumbItem } from '@metaboost/ui';
+
 import { getTranslations } from 'next-intl/server';
 import { redirect } from 'next/navigation';
 
 import { resolveReturnUrlFromQuery } from '@metaboost/helpers';
+import { Breadcrumbs, ContentPageLayout } from '@metaboost/ui';
 
 import { AdminRoleForm } from '../../../../../components/admins/AdminRoleForm';
+import { ManagementBreadcrumbLink } from '../../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../../components/ResourcePageCard';
 import { getCrudFlags } from '../../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../../../lib/routes';
 import { getServerUser } from '../../../../../lib/server-auth';
 
@@ -25,13 +30,23 @@ export default async function NewAdminRolePage({
   const fallbackNavigationHref = ROUTES.ADMINS;
   const returnUrl = resolveReturnUrlFromQuery(resolvedSearch.returnUrl, fallbackNavigationHref);
 
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: tCommon('admins'), href: ROUTES.ADMINS },
+    { label: tCommon('addRoleTitle'), href: undefined },
+  ]);
+
   return (
-    <ResourcePageCard title={tCommon('addRoleTitle')}>
-      <AdminRoleForm
-        returnUrl={returnUrl}
-        cancelUrl={returnUrl}
-        fallbackNavigationHref={fallbackNavigationHref}
-      />
-    </ResourcePageCard>
+    <ContentPageLayout
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
+      contentMaxWidth="form"
+    >
+      <ResourcePageCard title={tCommon('addRoleTitle')} skipContainer>
+        <AdminRoleForm
+          returnUrl={returnUrl}
+          cancelUrl={returnUrl}
+          fallbackNavigationHref={fallbackNavigationHref}
+        />
+      </ResourcePageCard>
+    </ContentPageLayout>
   );
 }
diff --git a/apps/management-web/src/app/(main)/bucket/[id]/new/page.tsx b/apps/management-web/src/app/(main)/bucket/[id]/new/page.tsx
index 7f6066a0..ed2f92a7 100644
--- a/apps/management-web/src/app/(main)/bucket/[id]/new/page.tsx
+++ b/apps/management-web/src/app/(main)/bucket/[id]/new/page.tsx
@@ -5,10 +5,12 @@ import { getTranslations } from 'next-intl/server';
 import { redirect, notFound } from 'next/navigation';
 
 import { request } from '@metaboost/helpers-requests';
-import { Breadcrumbs, Container, Link, SectionWithHeading } from '@metaboost/ui';
+import { Breadcrumbs, Container, SectionWithHeading } from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../../../components/ManagementBreadcrumbLink';
 import { getServerManagementApiBaseUrl } from '../../../../../config/env';
 import { getCrudFlags, hasReadPermission } from '../../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../../lib/management-breadcrumbs';
 import { ROUTES, bucketViewRoute } from '../../../../../lib/routes';
 import { getServerUser } from '../../../../../lib/server-auth';
 import { getCookieHeader } from '../../../../../lib/server-request';
@@ -40,22 +42,6 @@ async function fetchBucketAncestry(bucket: ManagementBucket): Promise<Management
   return parents;
 }
 
-function BreadcrumbLink({
-  href,
-  children,
-  className,
-}: {
-  href: string;
-  children: React.ReactNode;
-  className?: string;
-}) {
-  return (
-    <Link href={href} className={className}>
-      {children}
-    </Link>
-  );
-}
-
 export default async function NewChildBucketPage({ params }: { params: Promise<{ id: string }> }) {
   const user = await getServerUser();
   if (user === null) redirect(ROUTES.LOGIN);
@@ -74,17 +60,17 @@ export default async function NewChildBucketPage({ params }: { params: Promise<{
   const ancestors = await fetchBucketAncestry(bucket);
   const tCommon = await getTranslations('common');
   const parentHref = bucketViewRoute(bucket.idText);
-  const breadcrumbItems: BreadcrumbItem[] = [
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
     ...ancestors.map((a) => ({ label: a.name, href: bucketViewRoute(a.idText) })),
     { label: bucket.name, href: bucketViewRoute(bucket.idText) },
     { label: tCommon('bucketDetail.addBucket'), href: undefined },
-  ];
+  ]);
 
   return (
     <Container>
       <Breadcrumbs
         items={breadcrumbItems}
-        LinkComponent={BreadcrumbLink}
+        LinkComponent={ManagementBreadcrumbLink}
         ariaLabel={tCommon('bucketDetail.buckets')}
       />
       <SectionWithHeading title={tCommon('bucketDetail.addBucket')}>
diff --git a/apps/management-web/src/app/(main)/bucket/[id]/page.tsx b/apps/management-web/src/app/(main)/bucket/[id]/page.tsx
index 4e167123..90b9e288 100644
--- a/apps/management-web/src/app/(main)/bucket/[id]/page.tsx
+++ b/apps/management-web/src/app/(main)/bucket/[id]/page.tsx
@@ -25,6 +25,7 @@ import {
   TABLE_SORT_PREFS_COOKIE_NAME,
 } from '../../../../lib/cookies';
 import { getCrudFlags, hasReadPermission } from '../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../../lib/routes';
 import {
   bucketEditRoute,
@@ -291,11 +292,15 @@ export default async function BucketDetailPage({
       ? tCommon('bucketDetail.publicYes')
       : tCommon('bucketDetail.publicNo'),
   }));
-  const breadcrumbItems: BreadcrumbItem[] = ancestors.map((ancestor) => ({
+  const ancestryTrail: BreadcrumbItem[] = ancestors.map((ancestor) => ({
     label: ancestor.name,
     href: bucketViewRoute(ancestor.idText),
   }));
   const currentBreadcrumb: BreadcrumbItem = { label: bucket.name, href: undefined };
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    ...ancestryTrail,
+    currentBreadcrumb,
+  ]);
 
   const publicPageHref = bucket.isPublic
     ? (() => {
@@ -341,13 +346,11 @@ export default async function BucketDetailPage({
   return (
     <BucketDetailPageLayout
       breadcrumbs={
-        breadcrumbItems.length > 0 ? (
-          <Breadcrumbs
-            items={[...breadcrumbItems, currentBreadcrumb]}
-            LinkComponent={BreadcrumbLink}
-            ariaLabel={tCommon('bucketDetail.settings')}
-          />
-        ) : undefined
+        <Breadcrumbs
+          items={breadcrumbItems}
+          LinkComponent={BreadcrumbLink}
+          ariaLabel={tCommon('bucketDetail.settings')}
+        />
       }
     >
       <BucketDetailTabShell
diff --git a/apps/management-web/src/app/(main)/bucket/[id]/settings/BucketRolesClient.module.scss b/apps/management-web/src/app/(main)/bucket/[id]/settings/BucketRolesClient.module.scss
index 5afe5a5d..9f4777de 100644
--- a/apps/management-web/src/app/(main)/bucket/[id]/settings/BucketRolesClient.module.scss
+++ b/apps/management-web/src/app/(main)/bucket/[id]/settings/BucketRolesClient.module.scss
@@ -9,7 +9,7 @@
   align-items: center;
   gap: 1rem;
   padding: 0.5rem 0;
-  border-bottom: 1px solid var(--color-border, #eee);
+  border-bottom: 1px solid var(--color-border);
 }
 
 .roleName {
diff --git a/apps/management-web/src/app/(main)/bucket/[id]/settings/BucketSettingsLayoutClient.tsx b/apps/management-web/src/app/(main)/bucket/[id]/settings/BucketSettingsLayoutClient.tsx
index 7fce1d00..e0fb278f 100644
--- a/apps/management-web/src/app/(main)/bucket/[id]/settings/BucketSettingsLayoutClient.tsx
+++ b/apps/management-web/src/app/(main)/bucket/[id]/settings/BucketSettingsLayoutClient.tsx
@@ -24,6 +24,8 @@ type BucketSettingsLayoutClientProps = {
   bucketId: string;
   bucketName: string;
   bucketSettingsTitle: string;
+  /** Segments before bucket ancestry (e.g. Dashboard). */
+  leadingBreadcrumbItems?: BreadcrumbItem[];
   /** Parent buckets in hierarchy order (root first) for breadcrumbs. */
   ancestorItems?: BreadcrumbItem[];
   children: React.ReactNode;
@@ -45,6 +47,7 @@ export function BucketSettingsLayoutClient({
   bucketId,
   bucketName,
   bucketSettingsTitle,
+  leadingBreadcrumbItems = [],
   ancestorItems = [],
   children,
 }: BucketSettingsLayoutClientProps) {
@@ -67,6 +70,7 @@ export function BucketSettingsLayoutClient({
       <UISettingsLayout
         breadcrumbs={
           <BucketSettingsBreadcrumbs
+            leadingItems={leadingBreadcrumbItems}
             ancestorItems={ancestorItems}
             bucketName={bucketName}
             bucketDetailHref={bucketViewRoute(bucketId)}
diff --git a/apps/management-web/src/app/(main)/bucket/[id]/settings/layout.tsx b/apps/management-web/src/app/(main)/bucket/[id]/settings/layout.tsx
index 56119f91..71d0a120 100644
--- a/apps/management-web/src/app/(main)/bucket/[id]/settings/layout.tsx
+++ b/apps/management-web/src/app/(main)/bucket/[id]/settings/layout.tsx
@@ -8,6 +8,7 @@ import { request } from '@metaboost/helpers-requests';
 
 import { getServerManagementApiBaseUrl } from '../../../../../config/env';
 import { hasReadPermission } from '../../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../../../lib/routes';
 import { bucketViewRoute } from '../../../../../lib/routes';
 import { getServerUser } from '../../../../../lib/server-auth';
@@ -57,10 +58,12 @@ export default async function BucketSettingsLayout({
   const bucket = await fetchBucket(id);
   if (bucket === null) notFound();
 
-  const [t, ancestors] = await Promise.all([
+  const [t, tCommon, ancestors] = await Promise.all([
     getTranslations('buckets'),
+    getTranslations('common'),
     fetchBucketAncestry(bucket),
   ]);
+  const leadingBreadcrumbItems = withDashboardBreadcrumb(tCommon('dashboard'), []);
   const ancestorItems: BreadcrumbItem[] = ancestors.map((a) => ({
     label: a.name,
     href: bucketViewRoute(a.idText),
@@ -71,6 +74,7 @@ export default async function BucketSettingsLayout({
       bucketId={id}
       bucketName={bucket.name}
       bucketSettingsTitle={t('bucketSettings')}
+      leadingBreadcrumbItems={leadingBreadcrumbItems}
       ancestorItems={ancestorItems}
     >
       {children}
diff --git a/apps/management-web/src/app/(main)/buckets/new/page.tsx b/apps/management-web/src/app/(main)/buckets/new/page.tsx
index e55d7e05..53f4ce32 100644
--- a/apps/management-web/src/app/(main)/buckets/new/page.tsx
+++ b/apps/management-web/src/app/(main)/buckets/new/page.tsx
@@ -5,12 +5,14 @@ import { getTranslations } from 'next-intl/server';
 import { redirect } from 'next/navigation';
 
 import { request } from '@metaboost/helpers-requests';
-import { Breadcrumbs, ContentPageLayout, Link } from '@metaboost/ui';
+import { Breadcrumbs, ContentPageLayout } from '@metaboost/ui';
 
 import { BucketForm } from '../../../../components/buckets/BucketForm';
+import { ManagementBreadcrumbLink } from '../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../components/ResourcePageCard';
 import { getServerManagementApiBaseUrl } from '../../../../config/env';
 import { getCrudFlags } from '../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../../lib/routes';
 import { getServerUser } from '../../../../lib/server-auth';
 import { getCookieHeader } from '../../../../lib/server-request';
@@ -53,30 +55,14 @@ export default async function NewBucketPage() {
     label: (u.displayName !== null && u.displayName !== '' ? u.displayName : u.email) ?? u.id,
   }));
 
-  const breadcrumbItems: BreadcrumbItem[] = [
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
     { label: tCommon('buckets'), href: ROUTES.BUCKETS },
     { label: tCommon('addBucketTitle'), href: undefined },
-  ];
-
-  function BreadcrumbLink({
-    href,
-    children,
-    className,
-  }: {
-    href: string;
-    children: React.ReactNode;
-    className?: string;
-  }) {
-    return (
-      <Link href={href} className={className}>
-        {children}
-      </Link>
-    );
-  }
+  ]);
 
   return (
     <ContentPageLayout
-      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={BreadcrumbLink} />}
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
       contentMaxWidth="form"
     >
       <ResourcePageCard title={tCommon('addBucketTitle')} skipContainer>
diff --git a/apps/management-web/src/app/(main)/buckets/page.tsx b/apps/management-web/src/app/(main)/buckets/page.tsx
index f0444ce6..32156d1f 100644
--- a/apps/management-web/src/app/(main)/buckets/page.tsx
+++ b/apps/management-web/src/app/(main)/buckets/page.tsx
@@ -1,4 +1,5 @@
 import type { ListBucketsData } from '@metaboost/helpers-requests';
+import type { BreadcrumbItem } from '@metaboost/ui';
 
 import { getTranslations } from 'next-intl/server';
 import { cookies } from 'next/headers';
@@ -7,6 +8,7 @@ import { redirect } from 'next/navigation';
 import { coerceFirstQueryString } from '@metaboost/helpers';
 import { request } from '@metaboost/helpers-requests';
 import {
+  Breadcrumbs,
   FilterTablePageLayout,
   getSortPrefsFromCookieValue,
   getTableListStateEntryFromCookieValue,
@@ -14,9 +16,11 @@ import {
 } from '@metaboost/ui';
 
 import { BucketsTableWithFilter } from '../../../components/BucketsTableWithFilter';
+import { ManagementBreadcrumbLink } from '../../../components/ManagementBreadcrumbLink';
 import { getManagementApiBaseUrl, getServerManagementApiBaseUrl } from '../../../config/env';
 import { TABLE_LIST_STATE_COOKIE_NAME, TABLE_SORT_PREFS_COOKIE_NAME } from '../../../lib/cookies';
 import { getCrudFlags, hasReadPermission } from '../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../lib/routes';
 import { getServerUser } from '../../../lib/server-auth';
 import { getCookieHeader } from '../../../lib/server-request';
@@ -92,6 +96,9 @@ export default async function BucketsPage({ searchParams }: PageProps) {
     sortOrderParam === 'asc' || sortOrderParam === 'desc' ? sortOrderParam : cookieSort?.sortOrder;
 
   const tCommon = await getTranslations('common');
+  const listBreadcrumbs: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: tCommon('buckets'), href: undefined },
+  ]);
   const { data, error } = await fetchBuckets(page, limit, search, sortBy, sortOrder);
 
   const buckets = data?.buckets ?? [];
@@ -122,6 +129,7 @@ export default async function BucketsPage({ searchParams }: PageProps) {
 
   return (
     <FilterTablePageLayout
+      breadcrumbs={<Breadcrumbs items={listBreadcrumbs} LinkComponent={ManagementBreadcrumbLink} />}
       title={tCommon('buckets')}
       error={error !== null ? tCommon('failedToLoadBuckets') : undefined}
       errorVariant="error"
diff --git a/apps/management-web/src/app/(main)/dashboard/page.tsx b/apps/management-web/src/app/(main)/dashboard/page.tsx
index 7787ef44..f1614d97 100644
--- a/apps/management-web/src/app/(main)/dashboard/page.tsx
+++ b/apps/management-web/src/app/(main)/dashboard/page.tsx
@@ -26,6 +26,8 @@ export default async function DashboardPage() {
     if (labelKey === 'termsVersions') return tDashboard('links.termsVersions.description');
     if (labelKey === 'users') return tDashboard('links.users.description');
     if (labelKey === 'buckets') return tDashboard('links.buckets.description');
+    if (labelKey === 'productsMembership')
+      return tDashboard('links.productsMembership.description');
     return '';
   };
 
diff --git a/apps/management-web/src/app/(main)/events/page.tsx b/apps/management-web/src/app/(main)/events/page.tsx
index e8662ae9..419f99e4 100644
--- a/apps/management-web/src/app/(main)/events/page.tsx
+++ b/apps/management-web/src/app/(main)/events/page.tsx
@@ -1,3 +1,5 @@
+import type { BreadcrumbItem } from '@metaboost/ui';
+
 import { getLocale, getTranslations } from 'next-intl/server';
 import { cookies } from 'next/headers';
 import { redirect } from 'next/navigation';
@@ -6,16 +8,20 @@ import { DEFAULT_PAGE_LIMIT } from '@metaboost/helpers';
 import { formatDateTimeReadable } from '@metaboost/helpers-i18n/client';
 import { request } from '@metaboost/helpers-requests';
 import {
+  Breadcrumbs,
   Container,
   getSortPrefsFromCookieValue,
   getTableListStateEntryFromCookieValue,
   SectionWithHeading,
+  Stack,
   Text,
 } from '@metaboost/ui';
 
 import { EventsListClientSection } from '../../../components/EventsListClientSection';
+import { ManagementBreadcrumbLink } from '../../../components/ManagementBreadcrumbLink';
 import { getServerManagementApiBaseUrl } from '../../../config/env';
 import { TABLE_LIST_STATE_COOKIE_NAME, TABLE_SORT_PREFS_COOKIE_NAME } from '../../../lib/cookies';
+import { withDashboardBreadcrumb } from '../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../lib/routes';
 import { getServerUser } from '../../../lib/server-auth';
 import { getCookieHeader } from '../../../lib/server-request';
@@ -155,6 +161,9 @@ export default async function EventsPage({ searchParams }: PageProps) {
 
   const locale = await getLocale();
   const tCommon = await getTranslations('common');
+  const listBreadcrumbs: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: tCommon('events'), href: undefined },
+  ]);
   const { data, error } = await fetchEvents(
     page,
     limit,
@@ -210,37 +219,40 @@ export default async function EventsPage({ searchParams }: PageProps) {
 
   return (
     <Container>
-      <SectionWithHeading title={tCommon('events')}>
-        {error !== null && (
-          <Text variant="error" role="alert">
-            {error}
-          </Text>
-        )}
-        {error === null && (
-          <EventsListClientSection
-            locale={locale}
-            tableRows={tableRows}
-            emptyMessage={events.length === 0 ? tCommon('noEvents') : undefined}
-            columns={eventColumns}
-            initialFilterColumns={effectiveFilterColumns}
-            initialSearch={search}
-            basePath={ROUTES.EVENTS}
-            currentQueryParams={currentQueryParams}
-            currentPage={currentPage}
-            totalPages={totalPages}
-            limit={limit}
-            defaultLimit={DEFAULT_PAGE_LIMIT}
-            sort={sort}
-            maxGoToPage={500}
-            filterableColumnIds={['actor', 'action', 'target', 'details']}
-            sortTimelineLabel={tCommon('eventsSort.label')}
-            sortOptionLabels={{
-              recent: tCommon('eventsSortOptions.recent'),
-              oldest: tCommon('eventsSortOptions.oldest'),
-            }}
-          />
-        )}
-      </SectionWithHeading>
+      <Stack>
+        <Breadcrumbs items={listBreadcrumbs} LinkComponent={ManagementBreadcrumbLink} />
+        <SectionWithHeading title={tCommon('events')}>
+          {error !== null && (
+            <Text variant="error" role="alert">
+              {error}
+            </Text>
+          )}
+          {error === null && (
+            <EventsListClientSection
+              locale={locale}
+              tableRows={tableRows}
+              emptyMessage={events.length === 0 ? tCommon('noEvents') : undefined}
+              columns={eventColumns}
+              initialFilterColumns={effectiveFilterColumns}
+              initialSearch={search}
+              basePath={ROUTES.EVENTS}
+              currentQueryParams={currentQueryParams}
+              currentPage={currentPage}
+              totalPages={totalPages}
+              limit={limit}
+              defaultLimit={DEFAULT_PAGE_LIMIT}
+              sort={sort}
+              maxGoToPage={500}
+              filterableColumnIds={['actor', 'action', 'target', 'details']}
+              sortTimelineLabel={tCommon('eventsSort.label')}
+              sortOptionLabels={{
+                recent: tCommon('eventsSortOptions.recent'),
+                oldest: tCommon('eventsSortOptions.oldest'),
+              }}
+            />
+          )}
+        </SectionWithHeading>
+      </Stack>
     </Container>
   );
 }
diff --git a/apps/management-web/src/app/(main)/global-blocked-apps/page.tsx b/apps/management-web/src/app/(main)/global-blocked-apps/page.tsx
index 933788f8..0ef24e04 100644
--- a/apps/management-web/src/app/(main)/global-blocked-apps/page.tsx
+++ b/apps/management-web/src/app/(main)/global-blocked-apps/page.tsx
@@ -1,8 +1,13 @@
+import type { BreadcrumbItem } from '@metaboost/ui';
+
+import { getTranslations } from 'next-intl/server';
 import { redirect } from 'next/navigation';
 
-import { Container } from '@metaboost/ui';
+import { Breadcrumbs, Container, Stack } from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../components/ManagementBreadcrumbLink';
 import { hasReadPermission } from '../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../lib/routes';
 import { getServerUser } from '../../../lib/server-auth';
 import { GlobalBlockedAppsClient } from './GlobalBlockedAppsClient';
@@ -17,9 +22,16 @@ export default async function GlobalBlockedAppsPage() {
   if (!canReadAdmins) {
     redirect(ROUTES.DASHBOARD);
   }
+  const tCommon = await getTranslations('common');
+  const listBreadcrumbs: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: tCommon('globalBlockedApps'), href: undefined },
+  ]);
   return (
     <Container>
-      <GlobalBlockedAppsClient />
+      <Stack>
+        <Breadcrumbs items={listBreadcrumbs} LinkComponent={ManagementBreadcrumbLink} />
+        <GlobalBlockedAppsClient />
+      </Stack>
     </Container>
   );
 }
diff --git a/apps/management-web/src/app/(main)/products/membership/ProductsMembershipClient.tsx b/apps/management-web/src/app/(main)/products/membership/ProductsMembershipClient.tsx
new file mode 100644
index 00000000..9803ef2a
--- /dev/null
+++ b/apps/management-web/src/app/(main)/products/membership/ProductsMembershipClient.tsx
@@ -0,0 +1,399 @@
+'use client';
+
+import type { CrudFlags } from '../../../../lib/main-nav';
+import type { ResolvedProductMembership } from '@metaboost/helpers';
+
+import { useLocale, useTranslations } from 'next-intl';
+import { useCallback, useEffect, useState } from 'react';
+
+import { formatDateTimeReadable } from '@metaboost/helpers-i18n/client';
+import {
+  type BillingPriceAuditEntryDto,
+  type BillingPriceWindowDto,
+  managementWebBillingPrices,
+  managementWebProductMembership,
+} from '@metaboost/helpers-requests';
+import {
+  Button,
+  FormActions,
+  FormContainer,
+  Input,
+  SectionWithHeading,
+  Select,
+  Stack,
+  Table,
+  Text,
+} from '@metaboost/ui';
+
+import { getManagementApiBaseUrl } from '../../../../config/env';
+
+type ProductsMembershipClientProps = {
+  crudFlags: CrudFlags;
+};
+
+function formatMajorUnits(locale: string, currencyCode: string, amountCents: number): string {
+  try {
+    return (amountCents / 100).toLocaleString(locale, {
+      style: 'currency',
+      currency: currencyCode,
+    });
+  } catch {
+    return (amountCents / 100).toFixed(2);
+  }
+}
+
+function shortId(value: string | null): string {
+  if (value === null || value === '') {
+    return '—';
+  }
+  if (value.length <= 8) {
+    return value;
+  }
+  return `${value.slice(0, 4)}…${value.slice(-4)}`;
+}
+
+export function ProductsMembershipClient({ crudFlags }: ProductsMembershipClientProps) {
+  const t = useTranslations('billingGovernance');
+  const tCommon = useTranslations('common');
+  const tErrors = useTranslations('errors');
+  const locale = useLocale();
+  const baseUrl = getManagementApiBaseUrl();
+
+  const [loadError, setLoadError] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [membership, setMembership] = useState<ResolvedProductMembership | null>(null);
+  const [windows, setWindows] = useState<BillingPriceWindowDto[]>([]);
+  const [audit, setAudit] = useState<BillingPriceAuditEntryDto[]>([]);
+  const [flash, setFlash] = useState<string | null>(null);
+  const [formError, setFormError] = useState<string | null>(null);
+  const [deprecateReason, setDeprecateReason] = useState('');
+
+  const [currencyCode, setCurrencyCode] = useState('USD');
+  const [billingCadence, setBillingCadence] = useState<'monthly' | 'annual'>('monthly');
+  const [amountDollars, setAmountDollars] = useState('');
+  const [effectiveLocal, setEffectiveLocal] = useState('');
+  const [scheduleReason, setScheduleReason] = useState('');
+  const [scheduleLoading, setScheduleLoading] = useState(false);
+  const [deprecatingId, setDeprecatingId] = useState<number | null>(null);
+
+  const load = useCallback(async () => {
+    setLoadError(null);
+    setLoading(true);
+    const [memRes, winRes, audRes] = await Promise.all([
+      managementWebProductMembership.getResolvedProductMembership(baseUrl),
+      managementWebBillingPrices.listBillingPriceWindows(baseUrl),
+      managementWebBillingPrices.listBillingPriceAudit(baseUrl, { limit: 80 }),
+    ]);
+
+    if (!memRes.ok || memRes.data?.data === undefined) {
+      setLoadError(t('loadError'));
+      setLoading(false);
+      return;
+    }
+    if (!winRes.ok || winRes.data?.data.windows === undefined) {
+      setLoadError(t('loadError'));
+      setLoading(false);
+      return;
+    }
+    if (!audRes.ok || audRes.data?.data.entries === undefined) {
+      setLoadError(t('loadError'));
+      setLoading(false);
+      return;
+    }
+
+    setMembership(memRes.data.data);
+    setWindows(winRes.data.data.windows);
+    setAudit(audRes.data.data.entries);
+    setLoading(false);
+  }, [baseUrl, t]);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  const cadenceOptions = [
+    { value: 'monthly', label: t('cadenceMonthly') },
+    { value: 'annual', label: t('cadenceAnnual') },
+  ];
+
+  const scheduleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
+    e.preventDefault();
+    setFormError(null);
+    setFlash(null);
+    const trimmedAmount = amountDollars.trim();
+    const amountNum = Number(trimmedAmount);
+    if (!Number.isFinite(amountNum) || amountNum < 0) {
+      setFormError(t('validationAmount'));
+      return;
+    }
+    if (effectiveLocal.trim() === '') {
+      setFormError(t('validationEffective'));
+      return;
+    }
+    const effectiveDate = new Date(effectiveLocal);
+    if (Number.isNaN(effectiveDate.getTime())) {
+      setFormError(t('validationEffective'));
+      return;
+    }
+    const amountCents = Math.round(amountNum * 100);
+    setScheduleLoading(true);
+    const res = await managementWebBillingPrices.scheduleBillingPriceChange(
+      baseUrl,
+      {
+        currencyCode: currencyCode.trim().toUpperCase(),
+        billingCadence,
+        amountCents,
+        effectiveFrom: effectiveDate.toISOString(),
+        changeReason: scheduleReason.trim() === '' ? null : scheduleReason.trim(),
+      },
+      null
+    );
+    setScheduleLoading(false);
+    if (!res.ok) {
+      setFormError(res.error?.message ?? tErrors('requestFailed'));
+      return;
+    }
+    setFlash(t('scheduleSuccess'));
+    setAmountDollars('');
+    setScheduleReason('');
+    await load();
+  };
+
+  const deprecate = async (priceId: number) => {
+    setFormError(null);
+    setFlash(null);
+    setDeprecatingId(priceId);
+    const res = await managementWebBillingPrices.deprecateBillingPrice(
+      baseUrl,
+      priceId,
+      { changeReason: deprecateReason.trim() === '' ? null : deprecateReason.trim() },
+      null
+    );
+    setDeprecatingId(null);
+    if (!res.ok) {
+      setFormError(res.error?.message ?? tErrors('requestFailed'));
+      return;
+    }
+    setFlash(t('deprecateSuccess'));
+    setDeprecateReason('');
+    await load();
+  };
+
+  if (loading) {
+    return <Text variant="muted">{tCommon('loading')}</Text>;
+  }
+
+  if (loadError !== null) {
+    return (
+      <Text variant="error" role="alert">
+        {loadError}
+      </Text>
+    );
+  }
+
+  return (
+    <Stack>
+      {flash !== null && (
+        <Text variant="muted" role="status">
+          {flash}
+        </Text>
+      )}
+      {formError !== null && (
+        <Text variant="error" size="sm" as="p" role="alert">
+          {formError}
+        </Text>
+      )}
+
+      <SectionWithHeading title={t('resolvedMembership')}>
+        {membership !== null && (
+          <Stack>
+            <Text>
+              {t('freeTrialSeconds')}: {membership.freeTrialExpirationSeconds}
+            </Text>
+            <Text>
+              {t('premiumMonthly')}: {membership.premiumMembershipCostMonthly}
+            </Text>
+            <Text>
+              {t('premiumAnnual')}: {membership.premiumMembershipCostAnnually}
+            </Text>
+          </Stack>
+        )}
+      </SectionWithHeading>
+
+      <SectionWithHeading title={t('priceWindows')}>
+        <Table.ScrollContainer>
+          <Table>
+            <Table.Head>
+              <Table.Row>
+                <Table.HeaderCell>{t('columnStatus')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnCurrency')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnCadence')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnAmount')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnEffectiveFrom')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnEffectiveTo')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnSource')}</Table.HeaderCell>
+                {crudFlags.update ? (
+                  <Table.HeaderCell>{t('columnActions')}</Table.HeaderCell>
+                ) : null}
+              </Table.Row>
+            </Table.Head>
+            <Table.Body>
+              {windows.map((w) => {
+                const statusLabel =
+                  w.status === 'active'
+                    ? t('statusActive')
+                    : w.status === 'scheduled'
+                      ? t('statusScheduled')
+                      : t('statusHistorical');
+                const cadenceLabel =
+                  w.billingCadence === 'monthly' ? t('cadenceMonthly') : t('cadenceAnnual');
+                return (
+                  <Table.Row key={w.id}>
+                    <Table.Cell>{statusLabel}</Table.Cell>
+                    <Table.Cell>{w.currencyCode}</Table.Cell>
+                    <Table.Cell>{cadenceLabel}</Table.Cell>
+                    <Table.Cell>
+                      {formatMajorUnits(locale, w.currencyCode, w.amountCents)}
+                    </Table.Cell>
+                    <Table.Cell>{formatDateTimeReadable(locale, w.effectiveFrom)}</Table.Cell>
+                    <Table.Cell>
+                      {w.effectiveTo === null ? '—' : formatDateTimeReadable(locale, w.effectiveTo)}
+                    </Table.Cell>
+                    <Table.Cell>{w.source}</Table.Cell>
+                    {crudFlags.update ? (
+                      <Table.Cell>
+                        {w.status === 'active' ? (
+                          <Button
+                            type="button"
+                            variant="secondary"
+                            loading={deprecatingId === w.id}
+                            disabled={deprecatingId !== null}
+                            onClick={() => {
+                              void deprecate(w.id);
+                            }}
+                          >
+                            {t('deprecate')}
+                          </Button>
+                        ) : (
+                          '—'
+                        )}
+                      </Table.Cell>
+                    ) : null}
+                  </Table.Row>
+                );
+              })}
+            </Table.Body>
+          </Table>
+        </Table.ScrollContainer>
+        {crudFlags.update ? (
+          <Input
+            label={t('deprecateReasonOptional')}
+            value={deprecateReason}
+            onChange={setDeprecateReason}
+            disabled={deprecatingId !== null}
+          />
+        ) : null}
+      </SectionWithHeading>
+
+      <SectionWithHeading title={t('auditLog')}>
+        <Table.ScrollContainer>
+          <Table>
+            <Table.Head>
+              <Table.Row>
+                <Table.HeaderCell>{t('columnWhen')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnCurrency')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnCadence')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnAmount')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnReason')}</Table.HeaderCell>
+                <Table.HeaderCell>{t('columnActor')}</Table.HeaderCell>
+              </Table.Row>
+            </Table.Head>
+            <Table.Body>
+              {audit.map((a) => {
+                const displayAmount =
+                  a.newAmountCents !== null
+                    ? formatMajorUnits(locale, a.currencyCode ?? 'USD', a.newAmountCents)
+                    : a.previousAmountCents !== null
+                      ? formatMajorUnits(locale, a.currencyCode ?? 'USD', a.previousAmountCents)
+                      : '—';
+                return (
+                  <Table.Row key={a.id}>
+                    <Table.Cell>{formatDateTimeReadable(locale, a.createdAt)}</Table.Cell>
+                    <Table.Cell>{a.currencyCode ?? t('unknownCurrency')}</Table.Cell>
+                    <Table.Cell>
+                      {a.billingCadence === null
+                        ? '—'
+                        : a.billingCadence === 'monthly'
+                          ? t('cadenceMonthly')
+                          : t('cadenceAnnual')}
+                    </Table.Cell>
+                    <Table.Cell>{displayAmount}</Table.Cell>
+                    <Table.Cell>{a.changeReason ?? '—'}</Table.Cell>
+                    <Table.Cell>{shortId(a.changedByManagementUserId)}</Table.Cell>
+                  </Table.Row>
+                );
+              })}
+            </Table.Body>
+          </Table>
+        </Table.ScrollContainer>
+      </SectionWithHeading>
+
+      {crudFlags.create ? (
+        <SectionWithHeading title={t('scheduleHeading')}>
+          <FormContainer onSubmit={scheduleSubmit}>
+            <Stack>
+              <Input
+                label={t('currencyCode')}
+                value={currencyCode}
+                onChange={setCurrencyCode}
+                disabled={scheduleLoading}
+                maxLength={3}
+              />
+              <Select
+                label={t('billingCadence')}
+                options={cadenceOptions}
+                value={billingCadence}
+                onChange={(v) => {
+                  if (v === 'monthly' || v === 'annual') {
+                    setBillingCadence(v);
+                  }
+                }}
+                disabled={scheduleLoading}
+              />
+              <Input
+                label={t('amountDollars')}
+                value={amountDollars}
+                onChange={setAmountDollars}
+                disabled={scheduleLoading}
+                inputMode="decimal"
+              />
+              <Input
+                type="datetime-local"
+                label={t('effectiveFrom')}
+                value={effectiveLocal}
+                onChange={setEffectiveLocal}
+                disabled={scheduleLoading}
+              />
+              <Input
+                label={t('changeReasonOptional')}
+                value={scheduleReason}
+                onChange={setScheduleReason}
+                disabled={scheduleLoading}
+              />
+              <FormActions>
+                <Button
+                  type="submit"
+                  variant="primary"
+                  loading={scheduleLoading}
+                  disabled={scheduleLoading}
+                >
+                  {t('scheduleSubmit')}
+                </Button>
+              </FormActions>
+            </Stack>
+          </FormContainer>
+        </SectionWithHeading>
+      ) : null}
+    </Stack>
+  );
+}
diff --git a/apps/management-web/src/app/(main)/products/membership/page.tsx b/apps/management-web/src/app/(main)/products/membership/page.tsx
new file mode 100644
index 00000000..6195211f
--- /dev/null
+++ b/apps/management-web/src/app/(main)/products/membership/page.tsx
@@ -0,0 +1,44 @@
+import type { BreadcrumbItem } from '@metaboost/ui';
+
+import { getTranslations } from 'next-intl/server';
+import { redirect } from 'next/navigation';
+
+import { Breadcrumbs, ContentPageLayout } from '@metaboost/ui';
+
+import { ManagementBreadcrumbLink } from '../../../../components/ManagementBreadcrumbLink';
+import { getCrudFlags, hasReadPermission } from '../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../lib/management-breadcrumbs';
+import { ROUTES } from '../../../../lib/routes';
+import { getServerUser } from '../../../../lib/server-auth';
+import { ProductsMembershipClient } from './ProductsMembershipClient';
+
+export default async function ProductsMembershipPage() {
+  const user = await getServerUser();
+
+  if (user === null) {
+    redirect(ROUTES.LOGIN);
+  }
+
+  const canRead =
+    user.isSuperAdmin === true || hasReadPermission(user.permissions, 'billingPricesCrud');
+  if (!canRead) {
+    redirect(ROUTES.DASHBOARD);
+  }
+
+  const crud = getCrudFlags(user.isSuperAdmin === true, user.permissions, 'billingPricesCrud');
+  const tCommon = await getTranslations('common');
+  const t = await getTranslations('billingGovernance');
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: t('pageTitle'), href: undefined },
+  ]);
+
+  return (
+    <ContentPageLayout
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
+      title={t('pageTitle')}
+      contentMaxWidth="readable"
+    >
+      <ProductsMembershipClient crudFlags={crud} />
+    </ContentPageLayout>
+  );
+}
diff --git a/apps/management-web/src/app/(main)/terms-version/[id]/edit/page.tsx b/apps/management-web/src/app/(main)/terms-version/[id]/edit/page.tsx
index c6ee49d3..ea32b1cb 100644
--- a/apps/management-web/src/app/(main)/terms-version/[id]/edit/page.tsx
+++ b/apps/management-web/src/app/(main)/terms-version/[id]/edit/page.tsx
@@ -5,12 +5,14 @@ import { getTranslations } from 'next-intl/server';
 import { notFound, redirect } from 'next/navigation';
 
 import { request } from '@metaboost/helpers-requests';
-import { Breadcrumbs, ContentPageLayout, Link, Stack } from '@metaboost/ui';
+import { Breadcrumbs, ContentPageLayout, Stack } from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../../components/ResourcePageCard';
 import { TermsVersionActions } from '../../../../../components/terms-versions/TermsVersionActions';
 import { TermsVersionForm } from '../../../../../components/terms-versions/TermsVersionForm';
 import { getServerManagementApiBaseUrl } from '../../../../../config/env';
+import { withDashboardBreadcrumb } from '../../../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../../../lib/routes';
 import { getServerUser } from '../../../../../lib/server-auth';
 import { getCookieHeader } from '../../../../../lib/server-request';
@@ -37,22 +39,6 @@ async function fetchTermsVersion(id: string): Promise<ManagementTermsVersion | n
   }
 }
 
-function BreadcrumbLink({
-  href,
-  children,
-  className,
-}: {
-  href: string;
-  children: React.ReactNode;
-  className?: string;
-}) {
-  return (
-    <Link href={href} className={className}>
-      {children}
-    </Link>
-  );
-}
-
 export default async function EditTermsVersionPage({ params }: EditTermsVersionPageProps) {
   const user = await getServerUser();
   if (user === null) {
@@ -70,14 +56,14 @@ export default async function EditTermsVersionPage({ params }: EditTermsVersionP
   const tCommon = await getTranslations('common');
   const itemLabel = `${termsVersion.versionKey} - ${termsVersion.title}`;
   const canEdit = termsVersion.status === 'draft' || termsVersion.status === 'upcoming';
-  const breadcrumbItems: BreadcrumbItem[] = [
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
     { label: tCommon('termsVersions'), href: ROUTES.TERMS_VERSIONS },
     { label: itemLabel, href: undefined },
-  ];
+  ]);
 
   return (
     <ContentPageLayout
-      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={BreadcrumbLink} />}
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
       contentMaxWidth="form"
     >
       <ResourcePageCard title={tCommon('editTermsVersionTitle', { name: itemLabel })} skipContainer>
diff --git a/apps/management-web/src/app/(main)/terms-versions/new/page.tsx b/apps/management-web/src/app/(main)/terms-versions/new/page.tsx
index 28bfb1e2..286c4e9c 100644
--- a/apps/management-web/src/app/(main)/terms-versions/new/page.tsx
+++ b/apps/management-web/src/app/(main)/terms-versions/new/page.tsx
@@ -3,29 +3,15 @@ import type { BreadcrumbItem } from '@metaboost/ui';
 import { getTranslations } from 'next-intl/server';
 import { redirect } from 'next/navigation';
 
-import { Breadcrumbs, ContentPageLayout, Link } from '@metaboost/ui';
+import { Breadcrumbs, ContentPageLayout } from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../components/ResourcePageCard';
 import { TermsVersionForm } from '../../../../components/terms-versions/TermsVersionForm';
+import { withDashboardBreadcrumb } from '../../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../../lib/routes';
 import { getServerUser } from '../../../../lib/server-auth';
 
-function BreadcrumbLink({
-  href,
-  children,
-  className,
-}: {
-  href: string;
-  children: React.ReactNode;
-  className?: string;
-}) {
-  return (
-    <Link href={href} className={className}>
-      {children}
-    </Link>
-  );
-}
-
 export default async function NewTermsVersionPage() {
   const user = await getServerUser();
   if (user === null) {
@@ -36,14 +22,14 @@ export default async function NewTermsVersionPage() {
   }
 
   const tCommon = await getTranslations('common');
-  const breadcrumbItems: BreadcrumbItem[] = [
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
     { label: tCommon('termsVersions'), href: ROUTES.TERMS_VERSIONS },
     { label: tCommon('addTermsVersionTitle'), href: undefined },
-  ];
+  ]);
 
   return (
     <ContentPageLayout
-      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={BreadcrumbLink} />}
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
       contentMaxWidth="form"
     >
       <ResourcePageCard title={tCommon('addTermsVersionTitle')} skipContainer>
diff --git a/apps/management-web/src/app/(main)/terms-versions/page.tsx b/apps/management-web/src/app/(main)/terms-versions/page.tsx
index eff88891..894e1897 100644
--- a/apps/management-web/src/app/(main)/terms-versions/page.tsx
+++ b/apps/management-web/src/app/(main)/terms-versions/page.tsx
@@ -2,15 +2,18 @@ import type {
   ManagementTermsVersion,
   TermsVersionLifecycleStatus,
 } from '@metaboost/helpers-requests';
+import type { BreadcrumbItem } from '@metaboost/ui';
 
 import { getTranslations } from 'next-intl/server';
 import { redirect } from 'next/navigation';
 
 import { request } from '@metaboost/helpers-requests';
-import { FilterTablePageLayout, Stack } from '@metaboost/ui';
+import { Breadcrumbs, FilterTablePageLayout, Stack } from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../components/ManagementBreadcrumbLink';
 import { TermsVersionsTableWithFilter } from '../../../components/TermsVersionsTableWithFilter';
 import { getManagementApiBaseUrl, getServerManagementApiBaseUrl } from '../../../config/env';
+import { withDashboardBreadcrumb } from '../../../lib/management-breadcrumbs';
 import { parseFilterColumns } from '../../../lib/parseFilterColumns';
 import { ROUTES } from '../../../lib/routes';
 import { getServerUser } from '../../../lib/server-auth';
@@ -71,6 +74,9 @@ export default async function TermsVersionsPage({ searchParams }: PageProps) {
 
   const resolved = searchParams !== undefined ? await searchParams : {};
   const tCommon = await getTranslations('common');
+  const listBreadcrumbs: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: tCommon('termsVersions'), href: undefined },
+  ]);
   const { data, error } = await fetchTermsVersions();
   const termsVersions = data?.termsVersions ?? [];
 
@@ -178,6 +184,7 @@ export default async function TermsVersionsPage({ searchParams }: PageProps) {
 
   return (
     <FilterTablePageLayout
+      breadcrumbs={<Breadcrumbs items={listBreadcrumbs} LinkComponent={ManagementBreadcrumbLink} />}
       title={tCommon('termsVersions')}
       error={error !== null ? tCommon('failedToLoadTermsVersions') : undefined}
       errorVariant="error"
diff --git a/apps/management-web/src/app/(main)/user/[id]/edit/page.tsx b/apps/management-web/src/app/(main)/user/[id]/edit/page.tsx
index 22418167..aabdf182 100644
--- a/apps/management-web/src/app/(main)/user/[id]/edit/page.tsx
+++ b/apps/management-web/src/app/(main)/user/[id]/edit/page.tsx
@@ -11,11 +11,13 @@ import {
   toDateTimeLocalValue,
 } from '@metaboost/helpers';
 import { request } from '@metaboost/helpers-requests';
-import { Breadcrumbs, ContentPageLayout, Link } from '@metaboost/ui';
+import { Breadcrumbs, ContentPageLayout } from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../../components/ResourcePageCard';
 import { getServerManagementApiBaseUrl } from '../../../../../config/env';
 import { getCrudFlags } from '../../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../../lib/management-breadcrumbs';
 import { ROUTES, userViewRoute } from '../../../../../lib/routes';
 import { getServerUser } from '../../../../../lib/server-auth';
 import { getCookieHeader } from '../../../../../lib/server-request';
@@ -44,22 +46,6 @@ async function fetchUser(id: string): Promise<{ user: MainAppUser } | null> {
   }
 }
 
-function BreadcrumbLink({
-  href,
-  children,
-  className,
-}: {
-  href: string;
-  children: React.ReactNode;
-  className?: string;
-}) {
-  return (
-    <Link href={href} className={className}>
-      {children}
-    </Link>
-  );
-}
-
 export default async function EditUserPage({ params, searchParams }: EditUserPageProps) {
   const user = await getServerUser();
 
@@ -96,15 +82,15 @@ export default async function EditUserPage({ params, searchParams }: EditUserPag
   const tCommon = await getTranslations('common');
 
   const displayLabel = mainUser.displayName ?? mainUser.username ?? mainUser.email ?? id;
-  const breadcrumbItems: BreadcrumbItem[] = [
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
     { label: tCommon('users'), href: ROUTES.USERS },
     { label: displayLabel, href: userViewRoute(id) },
     { label: tCommon('edit'), href: undefined },
-  ];
+  ]);
 
   return (
     <ContentPageLayout
-      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={BreadcrumbLink} />}
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
       contentMaxWidth="form"
       constrainMainOnly
       fullWidthAboveConstrained={<EditUserTabs userId={id} activeTab={activeTab} />}
diff --git a/apps/management-web/src/app/(main)/user/[id]/page.tsx b/apps/management-web/src/app/(main)/user/[id]/page.tsx
index 4993b515..993d2ad5 100644
--- a/apps/management-web/src/app/(main)/user/[id]/page.tsx
+++ b/apps/management-web/src/app/(main)/user/[id]/page.tsx
@@ -1,15 +1,25 @@
 import type { MainAppUser } from '../../../../types/management-api';
+import type { BreadcrumbItem } from '@metaboost/ui';
 
 import { getTranslations } from 'next-intl/server';
 import { notFound, redirect } from 'next/navigation';
 
 import { MembershipTier, membershipTierFromStoredValue } from '@metaboost/helpers';
 import { request } from '@metaboost/helpers-requests';
-import { ButtonLink, FormActions, Stack, Text } from '@metaboost/ui';
+import {
+  Breadcrumbs,
+  ButtonLink,
+  ContentPageLayout,
+  FormActions,
+  Stack,
+  Text,
+} from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../components/ResourcePageCard';
 import { getServerManagementApiBaseUrl } from '../../../../config/env';
 import { getCrudFlags, hasReadPermission } from '../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../lib/management-breadcrumbs';
 import { ROUTES, userEditRoute } from '../../../../lib/routes';
 import { getServerUser } from '../../../../lib/server-auth';
 import { getCookieHeader } from '../../../../lib/server-request';
@@ -66,39 +76,49 @@ export default async function ViewUserPage({ params }: ViewUserPageProps) {
       ? tCommon('userForm.membershipTierTrial')
       : tCommon('userForm.membershipStatusMembership');
 
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: tCommon('users'), href: ROUTES.USERS },
+    { label: displayLabel, href: undefined },
+  ]);
+
   return (
-    <ResourcePageCard title={tCommon('viewUserTitle', { name: displayLabel })}>
-      <Stack>
-        <Text>
-          <strong>{tCommon('usersTable.email')}:</strong> {mainUser.email ?? '—'}
-        </Text>
-        {mainUser.username !== null &&
-          mainUser.username !== undefined &&
-          mainUser.username !== '' && (
-            <Text>
-              <strong>{tCommon('usersTable.username')}:</strong> {mainUser.username}
-            </Text>
+    <ContentPageLayout
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
+      contentMaxWidth="form"
+    >
+      <ResourcePageCard title={tCommon('viewUserTitle', { name: displayLabel })} skipContainer>
+        <Stack>
+          <Text>
+            <strong>{tCommon('usersTable.email')}:</strong> {mainUser.email ?? '—'}
+          </Text>
+          {mainUser.username !== null &&
+            mainUser.username !== undefined &&
+            mainUser.username !== '' && (
+              <Text>
+                <strong>{tCommon('usersTable.username')}:</strong> {mainUser.username}
+              </Text>
+            )}
+          <Text>
+            <strong>{tCommon('usersTable.displayName')}:</strong> {mainUser.displayName ?? '—'}
+          </Text>
+          <Text>
+            <strong>{tCommon('userForm.membershipStatusLabel')}:</strong> {membershipStatusLabel}
+          </Text>
+          {resolvedMembershipTier === MembershipTier.Trial && (
+            <Text>{tCommon('userForm.membershipTrialLimitations')}</Text>
           )}
-        <Text>
-          <strong>{tCommon('usersTable.displayName')}:</strong> {mainUser.displayName ?? '—'}
-        </Text>
-        <Text>
-          <strong>{tCommon('userForm.membershipStatusLabel')}:</strong> {membershipStatusLabel}
-        </Text>
-        {resolvedMembershipTier === MembershipTier.Trial && (
-          <Text>{tCommon('userForm.membershipTrialLimitations')}</Text>
-        )}
-        <FormActions>
-          <ButtonLink href={ROUTES.USERS} variant="secondary">
-            {tCommon('adminForm.cancel')}
-          </ButtonLink>
-          {crud.update && (
-            <ButtonLink href={userEditRoute(id)} variant="primary">
-              {tCommon('usersTable.edit')}
+          <FormActions>
+            <ButtonLink href={ROUTES.USERS} variant="secondary">
+              {tCommon('adminForm.cancel')}
             </ButtonLink>
-          )}
-        </FormActions>
-      </Stack>
-    </ResourcePageCard>
+            {crud.update && (
+              <ButtonLink href={userEditRoute(id)} variant="primary">
+                {tCommon('usersTable.edit')}
+              </ButtonLink>
+            )}
+          </FormActions>
+        </Stack>
+      </ResourcePageCard>
+    </ContentPageLayout>
   );
 }
diff --git a/apps/management-web/src/app/(main)/users/new/page.tsx b/apps/management-web/src/app/(main)/users/new/page.tsx
index e8566be9..8dbea350 100644
--- a/apps/management-web/src/app/(main)/users/new/page.tsx
+++ b/apps/management-web/src/app/(main)/users/new/page.tsx
@@ -3,30 +3,16 @@ import type { BreadcrumbItem } from '@metaboost/ui';
 import { getTranslations } from 'next-intl/server';
 import { redirect } from 'next/navigation';
 
-import { Breadcrumbs, ContentPageLayout, Link } from '@metaboost/ui';
+import { Breadcrumbs, ContentPageLayout } from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../../components/ManagementBreadcrumbLink';
 import { ResourcePageCard } from '../../../../components/ResourcePageCard';
 import { UserForm } from '../../../../components/users/UserForm';
 import { getCrudFlags } from '../../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../../lib/management-breadcrumbs';
 import { ROUTES } from '../../../../lib/routes';
 import { getServerUser } from '../../../../lib/server-auth';
 
-function BreadcrumbLink({
-  href,
-  children,
-  className,
-}: {
-  href: string;
-  children: React.ReactNode;
-  className?: string;
-}) {
-  return (
-    <Link href={href} className={className}>
-      {children}
-    </Link>
-  );
-}
-
 export default async function NewUserPage() {
   const user = await getServerUser();
 
@@ -40,14 +26,14 @@ export default async function NewUserPage() {
   }
 
   const tCommon = await getTranslations('common');
-  const breadcrumbItems: BreadcrumbItem[] = [
+  const breadcrumbItems: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
     { label: tCommon('users'), href: ROUTES.USERS },
     { label: tCommon('addUserTitle'), href: undefined },
-  ];
+  ]);
 
   return (
     <ContentPageLayout
-      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={BreadcrumbLink} />}
+      breadcrumbs={<Breadcrumbs items={breadcrumbItems} LinkComponent={ManagementBreadcrumbLink} />}
       contentMaxWidth="form"
     >
       <ResourcePageCard title={tCommon('addUserTitle')} skipContainer>
diff --git a/apps/management-web/src/app/(main)/users/page.tsx b/apps/management-web/src/app/(main)/users/page.tsx
index 563747ea..a76c891c 100644
--- a/apps/management-web/src/app/(main)/users/page.tsx
+++ b/apps/management-web/src/app/(main)/users/page.tsx
@@ -1,4 +1,5 @@
 import type { MainAppUser } from '../../../types/management-api';
+import type { BreadcrumbItem } from '@metaboost/ui';
 
 import { getTranslations } from 'next-intl/server';
 import { cookies } from 'next/headers';
@@ -6,16 +7,19 @@ import { redirect } from 'next/navigation';
 
 import { request } from '@metaboost/helpers-requests';
 import {
+  Breadcrumbs,
   FilterTablePageLayout,
   getSortPrefsFromCookieValue,
   getTableListStateEntryFromCookieValue,
   Stack,
 } from '@metaboost/ui';
 
+import { ManagementBreadcrumbLink } from '../../../components/ManagementBreadcrumbLink';
 import { UsersTableWithFilter } from '../../../components/UsersTableWithFilter';
 import { getManagementApiBaseUrl, getServerManagementApiBaseUrl } from '../../../config/env';
 import { TABLE_LIST_STATE_COOKIE_NAME, TABLE_SORT_PREFS_COOKIE_NAME } from '../../../lib/cookies';
 import { getCrudFlags, hasReadPermission } from '../../../lib/main-nav';
+import { withDashboardBreadcrumb } from '../../../lib/management-breadcrumbs';
 import { parseFilterColumns } from '../../../lib/parseFilterColumns';
 import { ROUTES } from '../../../lib/routes';
 import { getServerUser } from '../../../lib/server-auth';
@@ -119,6 +123,9 @@ export default async function UsersPage({ searchParams }: PageProps) {
       : cookieSort?.sortOrder;
 
   const tCommon = await getTranslations('common');
+  const listBreadcrumbs: BreadcrumbItem[] = withDashboardBreadcrumb(tCommon('dashboard'), [
+    { label: tCommon('users'), href: undefined },
+  ]);
   const { data, error } = await fetchUsers(search, effectiveFilterColumns, sortBy, sortOrder);
 
   const users = data?.users ?? [];
@@ -151,6 +158,7 @@ export default async function UsersPage({ searchParams }: PageProps) {
 
   return (
     <FilterTablePageLayout
+      breadcrumbs={<Breadcrumbs items={listBreadcrumbs} LinkComponent={ManagementBreadcrumbLink} />}
       title={tCommon('users')}
       error={error !== null ? tCommon('failedToLoadUsers') : undefined}
       errorVariant="error"
diff --git a/apps/management-web/src/app/error.tsx b/apps/management-web/src/app/error.tsx
new file mode 100644
index 00000000..f5c7dae6
--- /dev/null
+++ b/apps/management-web/src/app/error.tsx
@@ -0,0 +1,35 @@
+'use client';
+
+import { useTranslations } from 'next-intl';
+
+import { AppErrorBoundary } from '@metaboost/ui';
+
+type ErrorPageProps = {
+  error: Error & { digest?: string };
+  reset: () => void;
+};
+
+export default function Error({ error, reset }: ErrorPageProps) {
+  const t = useTranslations('errors');
+
+  return (
+    <AppErrorBoundary
+      error={error}
+      reset={reset}
+      onReload={() => {
+        window.location.reload();
+      }}
+      onGoHome={() => {
+        window.location.href = '/';
+      }}
+      strings={{
+        boundaryTitle: t('boundary_title'),
+        boundaryMessage: t('boundary_message'),
+        detailsDevelopmentOnly: t('details_development_only'),
+        tryAgain: t('try_again'),
+        reloadPage: t('reload_page'),
+        returnToHomePage: t('return_to_home_page'),
+      }}
+    />
+  );
+}
diff --git a/apps/management-web/src/app/global-error.tsx b/apps/management-web/src/app/global-error.tsx
new file mode 100644
index 00000000..a3e4f5a4
--- /dev/null
+++ b/apps/management-web/src/app/global-error.tsx
@@ -0,0 +1,55 @@
+'use client';
+
+import { useCallback } from 'react';
+
+import '@fortawesome/fontawesome-free/css/all.min.css';
+import { extractErrorsStringsFromMessagesDefault, GlobalErrorBoundary } from '@metaboost/ui';
+
+import '../styles/globals.scss';
+
+const SETTINGS_COOKIE_NAME = 'management-settings';
+
+const DEFAULT_ERROR_STRINGS: Record<string, string> = {
+  global_title: 'Application error',
+  global_message: 'A critical error occurred. Please refresh the page.',
+  details_development_only: 'Error details (development only)',
+  try_again: 'Try again',
+  reload_page: 'Reload page',
+};
+
+type GlobalErrorProps = {
+  error: Error & { digest?: string };
+  reset: () => void;
+};
+
+export default function GlobalError({ error, reset }: GlobalErrorProps) {
+  const loadStrings = useCallback(async () => {
+    try {
+      const localeCookie =
+        document.cookie
+          .split('; ')
+          .find((row) => row.startsWith('NEXT_LOCALE='))
+          ?.split('=')[1] || 'en-US';
+
+      const messages = await import(`../../i18n/originals/${localeCookie}.json`);
+      return extractErrorsStringsFromMessagesDefault(messages.default);
+    } catch {
+      try {
+        const messages = await import('../../i18n/originals/en-US.json');
+        return extractErrorsStringsFromMessagesDefault(messages.default);
+      } catch {
+        return {};
+      }
+    }
+  }, []);
+
+  return (
+    <GlobalErrorBoundary
+      settingsCookieName={SETTINGS_COOKIE_NAME}
+      loadStrings={loadStrings}
+      defaultStrings={DEFAULT_ERROR_STRINGS}
+      error={error}
+      reset={reset}
+    />
+  );
+}
diff --git a/apps/management-web/src/components/ManagementBreadcrumbLink.tsx b/apps/management-web/src/components/ManagementBreadcrumbLink.tsx
new file mode 100644
index 00000000..ca838a26
--- /dev/null
+++ b/apps/management-web/src/components/ManagementBreadcrumbLink.tsx
@@ -0,0 +1,19 @@
+'use client';
+
+import { Link } from '@metaboost/ui';
+
+export function ManagementBreadcrumbLink({
+  href,
+  children,
+  className,
+}: {
+  href: string;
+  children: React.ReactNode;
+  className?: string;
+}) {
+  return (
+    <Link href={href} className={className}>
+      {children}
+    </Link>
+  );
+}
diff --git a/apps/management-web/src/components/admins/AdminForm.tsx b/apps/management-web/src/components/admins/AdminForm.tsx
index e5f818de..1be398fb 100644
--- a/apps/management-web/src/components/admins/AdminForm.tsx
+++ b/apps/management-web/src/components/admins/AdminForm.tsx
@@ -40,6 +40,7 @@ type ManagementAdminRoleOption = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: EventVisibility;
 };
 
@@ -55,6 +56,7 @@ export type AdminFormInitialValues = {
     bucketsCrud: number;
     bucketMessagesCrud: number;
     bucketAdminsCrud: number;
+    billingPricesCrud: number;
     eventVisibility: EventVisibility;
   } | null;
 };
@@ -106,6 +108,7 @@ function roleToOption(
     bucketsCrud: role.bucketsCrud,
     bucketMessagesCrud: role.bucketMessagesCrud,
     bucketAdminsCrud: role.bucketAdminsCrud,
+    billingPricesCrud: role.billingPricesCrud,
     eventVisibility: role.eventVisibility,
   };
 }
@@ -116,7 +119,8 @@ function rolePermissionScore(role: ManagementAdminRoleOption): number {
     role.usersCrud +
     role.bucketsCrud +
     role.bucketMessagesCrud +
-    role.bucketAdminsCrud;
+    role.bucketAdminsCrud +
+    role.billingPricesCrud;
   const eventScore =
     role.eventVisibility === 'all' ? 2 : role.eventVisibility === 'all_admins' ? 1 : 0;
   return crudScore * 10 + eventScore;
@@ -157,6 +161,7 @@ export function AdminForm({
   const defaultBucketsCrud = defaultPerms?.bucketsCrud ?? 0;
   const defaultBucketMessagesCrud = defaultPerms?.bucketMessagesCrud ?? 0;
   const defaultBucketAdminsCrud = defaultPerms?.bucketAdminsCrud ?? 0;
+  const defaultBillingPricesCrud = defaultPerms?.billingPricesCrud ?? 0;
   const [adminsCrudFlags, setAdminsCrudFlags] = useState<CrudFlags>(
     bitmaskToFlags(defaultAdminsCrud)
   );
@@ -170,6 +175,9 @@ export function AdminForm({
   const [bucketAdminsCrudFlags, setBucketAdminsCrudFlags] = useState<CrudFlags>(
     bitmaskToFlags(defaultBucketAdminsCrud)
   );
+  const [billingPricesCrudFlags, setBillingPricesCrudFlags] = useState<CrudFlags>(
+    bitmaskToFlags(defaultBillingPricesCrud)
+  );
   const [eventVisibility, setEventVisibility] = useState<EventVisibility>(
     defaultPerms?.eventVisibility ?? 'all_admins'
   );
@@ -227,6 +235,7 @@ export function AdminForm({
     setBucketsCrudFlags(bitmaskToFlags(selectedRole.bucketsCrud));
     setBucketMessagesCrudFlags(bitmaskToFlags(selectedRole.bucketMessagesCrud));
     setBucketAdminsCrudFlags(bitmaskToFlags(selectedRole.bucketAdminsCrud));
+    setBillingPricesCrudFlags(bitmaskToFlags(selectedRole.billingPricesCrud));
     setEventVisibility(selectedRole.eventVisibility);
   }, [selectedRole]);
 
@@ -303,6 +312,10 @@ export function AdminForm({
     setBucketAdminsCrudFlags(next);
   };
 
+  const handleBillingPricesCrudChange = (next: CrudFlags) => {
+    setBillingPricesCrudFlags(next);
+  };
+
   const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
     e.preventDefault();
 
@@ -351,6 +364,7 @@ export function AdminForm({
           bucketsCrud: flagsToBitmask(bucketsCrudFlags),
           bucketMessagesCrud: flagsToBitmask(bucketMessagesCrudFlags),
           bucketAdminsCrud: flagsToBitmask(bucketAdminsCrudFlags),
+          billingPricesCrud: flagsToBitmask(billingPricesCrudFlags),
           eventVisibility,
         };
         const res = await managementWebAdmins.createAdmin(apiBaseUrl, body);
@@ -386,6 +400,7 @@ export function AdminForm({
             body.bucketsCrud = flagsToBitmask(bucketsCrudFlags);
             body.bucketMessagesCrud = flagsToBitmask(bucketMessagesCrudFlags);
             body.bucketAdminsCrud = flagsToBitmask(bucketAdminsCrudFlags);
+            body.billingPricesCrud = flagsToBitmask(billingPricesCrudFlags);
             body.eventVisibility = eventVisibility;
           }
         }
@@ -502,6 +517,13 @@ export function AdminForm({
               onChange={handleBucketMessagesCrudChange}
               disabled
             />
+            <CrudCheckboxes
+              label={t('billingPricesCrud')}
+              labels={crudLabels}
+              flags={billingPricesCrudFlags}
+              onChange={handleBillingPricesCrudChange}
+              disabled
+            />
             <Select
               label={t('eventVisibility')}
               value={eventVisibility}
diff --git a/apps/management-web/src/components/admins/AdminRoleForm.tsx b/apps/management-web/src/components/admins/AdminRoleForm.tsx
index a48578cf..ba15f2de 100644
--- a/apps/management-web/src/components/admins/AdminRoleForm.tsx
+++ b/apps/management-web/src/components/admins/AdminRoleForm.tsx
@@ -39,6 +39,7 @@ export function AdminRoleForm({
   const [bucketsFlags, setBucketsFlags] = useState<CrudFlags>(bitmaskToFlags(15));
   const [bucketMessagesFlags, setBucketMessagesFlags] = useState<CrudFlags>(bitmaskToFlags(15));
   const [bucketAdminsFlags, setBucketAdminsFlags] = useState<CrudFlags>(bitmaskToFlags(15));
+  const [billingPricesFlags, setBillingPricesFlags] = useState<CrudFlags>(bitmaskToFlags(0));
   const [eventVisibility, setEventVisibility] = useState<EventVisibility>('all_admins');
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
@@ -65,6 +66,7 @@ export function AdminRoleForm({
       bucketsCrud: flagsToBitmask(bucketsFlags),
       bucketMessagesCrud: flagsToBitmask(bucketMessagesFlags),
       bucketAdminsCrud: flagsToBitmask(bucketAdminsFlags),
+      billingPricesCrud: flagsToBitmask(billingPricesFlags),
       eventVisibility,
     });
     setLoading(false);
@@ -110,6 +112,12 @@ export function AdminRoleForm({
           flags={bucketMessagesFlags}
           onChange={setBucketMessagesFlags}
         />
+        <CrudCheckboxes
+          label={t('billingPricesCrud')}
+          labels={crudLabels}
+          flags={billingPricesFlags}
+          onChange={setBillingPricesFlags}
+        />
         <Select
           label={t('eventVisibility')}
           value={eventVisibility}
diff --git a/apps/management-web/src/components/buckets/BucketMessagesClient.module.scss b/apps/management-web/src/components/buckets/BucketMessagesClient.module.scss
index 8ad7eb5c..7aef3ab3 100644
--- a/apps/management-web/src/components/buckets/BucketMessagesClient.module.scss
+++ b/apps/management-web/src/components/buckets/BucketMessagesClient.module.scss
@@ -6,7 +6,7 @@
 
 .messageItem {
   padding: 0.75rem 0;
-  border-bottom: 1px solid var(--color-border, #eee);
+  border-bottom: 1px solid var(--color-border);
 }
 
 .senderName {
diff --git a/apps/management-web/src/components/users/UserForm.tsx b/apps/management-web/src/components/users/UserForm.tsx
index 6f2ac477..06c3b801 100644
--- a/apps/management-web/src/components/users/UserForm.tsx
+++ b/apps/management-web/src/components/users/UserForm.tsx
@@ -1,13 +1,23 @@
 'use client';
 
+import type { ResolvedProductMembership } from '@metaboost/helpers';
 import type { CreateUserBody, ManagementBucket } from '@metaboost/helpers-requests';
 
 import { useTranslations } from 'next-intl';
 import { useRouter } from 'next/navigation';
-import { useEffect, useState } from 'react';
+import { useEffect, useRef, useState } from 'react';
 
-import { MembershipTier, membershipTierToApiBodyValue, validatePassword } from '@metaboost/helpers';
-import { managementWebBuckets, managementWebUsers } from '@metaboost/helpers-requests';
+import {
+  MembershipTier,
+  type PremiumBillingCadence,
+  membershipTierToApiBodyValue,
+  validatePassword,
+} from '@metaboost/helpers';
+import {
+  managementWebBuckets,
+  managementWebProductMembership,
+  managementWebUsers,
+} from '@metaboost/helpers-requests';
 import {
   Button,
   CheckboxField,
@@ -17,11 +27,18 @@ import {
   FormSection,
   Input,
   PasswordStrengthMeter,
+  Select,
   Stack,
   Text,
 } from '@metaboost/ui';
 
 import { getManagementApiBaseUrl } from '../../config/env';
+import {
+  STORAGE_CADENCE_KEY,
+  STORAGE_EXPIRY_KEY,
+  computeDefaultMembershipExpiresAtInput,
+  fallbackProductMembershipFromEnv,
+} from '../../lib/createUserFormDefaults';
 import { ROUTES } from '../../lib/routes';
 
 export type UserFormInitialValues = {
@@ -47,6 +64,7 @@ function isValidEmail(value: string): boolean {
 export function UserForm({ mode, userId, initialValues, activeEditTab }: UserFormProps) {
   const router = useRouter();
   const t = useTranslations('common.userForm');
+  const tCommon = useTranslations('common');
   const apiBaseUrl = getManagementApiBaseUrl();
 
   const [email, setEmail] = useState(initialValues?.email ?? '');
@@ -60,6 +78,12 @@ export function UserForm({ mode, userId, initialValues, activeEditTab }: UserFor
     initialValues?.membershipExpiresAt ?? ''
   );
   const [autoRenew, setAutoRenew] = useState(initialValues?.autoRenew ?? false);
+  const [premiumBillingCadence, setPremiumBillingCadence] =
+    useState<PremiumBillingCadence>('annual');
+  const [createFormHydrated, setCreateFormHydrated] = useState(false);
+  const skipTierCadenceEffect = useRef(true);
+  const [resolvedProductMembership, setResolvedProductMembership] =
+    useState<ResolvedProductMembership | null>(null);
 
   const [initialBucketAdminIds, setInitialBucketAdminIds] = useState<string[]>([]);
   const [buckets, setBuckets] = useState<ManagementBucket[]>([]);
@@ -90,6 +114,81 @@ export function UserForm({ mode, userId, initialValues, activeEditTab }: UserFor
     };
   }, [mode, apiBaseUrl]);
 
+  useEffect(() => {
+    if (mode !== 'create') {
+      return;
+    }
+    let cancelled = false;
+    void (async () => {
+      const res = await managementWebProductMembership.getResolvedProductMembership(apiBaseUrl);
+      if (cancelled) {
+        return;
+      }
+      if (res.ok && res.data !== undefined) {
+        setResolvedProductMembership(res.data.data);
+      } else {
+        setResolvedProductMembership(fallbackProductMembershipFromEnv());
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [mode, apiBaseUrl]);
+
+  useEffect(() => {
+    if (mode !== 'create' || resolvedProductMembership === null) {
+      return;
+    }
+    const tierOnMount = initialValues?.membershipTier ?? MembershipTier.Trial;
+    const cadRaw = window.localStorage.getItem(STORAGE_CADENCE_KEY);
+    const cad: PremiumBillingCadence = cadRaw === 'monthly' ? 'monthly' : 'annual';
+    setPremiumBillingCadence(cad);
+    const savedExp = window.localStorage.getItem(STORAGE_EXPIRY_KEY);
+    if (savedExp !== null && savedExp.includes('T')) {
+      setMembershipExpiresAt(savedExp);
+    } else {
+      setMembershipExpiresAt(
+        computeDefaultMembershipExpiresAtInput({
+          membershipTier: tierOnMount,
+          premiumBillingCadence: cad,
+          trialExpirationSeconds: resolvedProductMembership.freeTrialExpirationSeconds,
+        })
+      );
+    }
+    setCreateFormHydrated(true);
+  }, [mode, initialValues?.membershipTier, resolvedProductMembership]);
+
+  useEffect(() => {
+    if (mode !== 'create' || !createFormHydrated || resolvedProductMembership === null) {
+      return;
+    }
+    if (skipTierCadenceEffect.current) {
+      skipTierCadenceEffect.current = false;
+      return;
+    }
+    setMembershipExpiresAt(
+      computeDefaultMembershipExpiresAtInput({
+        membershipTier,
+        premiumBillingCadence,
+        trialExpirationSeconds: resolvedProductMembership.freeTrialExpirationSeconds,
+      })
+    );
+  }, [membershipTier, premiumBillingCadence, createFormHydrated, mode, resolvedProductMembership]);
+
+  useEffect(() => {
+    if (mode !== 'create' || !createFormHydrated || membershipExpiresAt.trim() === '') {
+      return;
+    }
+    window.localStorage.setItem(STORAGE_EXPIRY_KEY, membershipExpiresAt);
+  }, [membershipExpiresAt, createFormHydrated, mode]);
+
+  useEffect(() => {
+    if (mode !== 'create' || !createFormHydrated) {
+      return;
+    }
+    window.localStorage.setItem(STORAGE_CADENCE_KEY, premiumBillingCadence);
+  }, [premiumBillingCadence, createFormHydrated, mode]);
+
   const passwordValidation =
     mode === 'create' || password !== ''
       ? validatePassword(password, {
@@ -162,6 +261,7 @@ export function UserForm({ mode, userId, initialValues, activeEditTab }: UserFor
           membershipTier: membershipTierToApiBodyValue(membershipTier),
           membershipExpiresAt: membershipExpiresAt.trim() === '' ? null : membershipExpiresAt,
           autoRenew,
+          ...(membershipTier === MembershipTier.Premium ? { premiumBillingCadence } : {}),
         };
         const res = await managementWebUsers.createUser(apiBaseUrl, body);
         if (!res.ok) {
@@ -252,6 +352,14 @@ export function UserForm({ mode, userId, initialValues, activeEditTab }: UserFor
     );
   }
 
+  if (mode === 'create' && resolvedProductMembership === null) {
+    return (
+      <Stack>
+        <Text variant="muted">{tCommon('loading')}</Text>
+      </Stack>
+    );
+  }
+
   return (
     <FormContainer
       onSubmit={(e) => {
@@ -289,32 +397,48 @@ export function UserForm({ mode, userId, initialValues, activeEditTab }: UserFor
               autoComplete="new-password"
             />
             <PasswordStrengthMeter password={password} />
+            <Text variant="muted">{t('passwordInviteHint')}</Text>
             <Input
               label={t('displayNameOptional')}
               value={displayName}
               onChange={setDisplayName}
               autoComplete="off"
             />
-            <label>{t('membershipTierLabel')}</label>
-            <select
+            <Select
+              label={t('membershipTierLabel')}
               value={membershipTier}
-              onChange={(e) => {
+              onChange={(value) => {
                 const nextTier =
-                  e.target.value === MembershipTier.Premium
-                    ? MembershipTier.Premium
-                    : MembershipTier.Trial;
+                  value === MembershipTier.Premium ? MembershipTier.Premium : MembershipTier.Trial;
                 setMembershipTier(nextTier);
                 setAutoRenew(nextTier === MembershipTier.Premium);
               }}
-            >
-              <option value={MembershipTier.Trial}>{t('membershipTierTrial')}</option>
-              <option value={MembershipTier.Premium}>{t('membershipTierPremium')}</option>
-            </select>
+              options={[
+                { value: MembershipTier.Trial, label: t('membershipTierTrial') },
+                { value: MembershipTier.Premium, label: t('membershipTierPremium') },
+              ]}
+            />
             <Text variant="muted">
               {membershipTier === MembershipTier.Trial
                 ? t('membershipTierTrialHelp')
                 : t('membershipTierPremiumHelp')}
             </Text>
+            {membershipTier === MembershipTier.Premium && (
+              <>
+                <Select
+                  label={t('premiumBillingCadenceLabel')}
+                  value={premiumBillingCadence}
+                  onChange={(value) =>
+                    setPremiumBillingCadence(value === 'monthly' ? 'monthly' : 'annual')
+                  }
+                  options={[
+                    { value: 'monthly', label: t('premiumBillingCadenceMonthly') },
+                    { value: 'annual', label: t('premiumBillingCadenceAnnual') },
+                  ]}
+                />
+                <Text variant="muted">{t('premiumBillingCadenceHint')}</Text>
+              </>
+            )}
             <Input
               label={t('membershipExpiresAtLabel')}
               type="datetime-local"
@@ -364,21 +488,20 @@ export function UserForm({ mode, userId, initialValues, activeEditTab }: UserFor
               onChange={setDisplayName}
               autoComplete="off"
             />
-            <label>{t('membershipTierLabel')}</label>
-            <select
+            <Select
+              label={t('membershipTierLabel')}
               value={membershipTier}
-              onChange={(e) => {
+              onChange={(value) => {
                 const nextTier =
-                  e.target.value === MembershipTier.Premium
-                    ? MembershipTier.Premium
-                    : MembershipTier.Trial;
+                  value === MembershipTier.Premium ? MembershipTier.Premium : MembershipTier.Trial;
                 setMembershipTier(nextTier);
                 setAutoRenew(nextTier === MembershipTier.Premium);
               }}
-            >
-              <option value={MembershipTier.Trial}>{t('membershipTierTrial')}</option>
-              <option value={MembershipTier.Premium}>{t('membershipTierPremium')}</option>
-            </select>
+              options={[
+                { value: MembershipTier.Trial, label: t('membershipTierTrial') },
+                { value: MembershipTier.Premium, label: t('membershipTierPremium') },
+              ]}
+            />
             <Text variant="muted">
               {membershipTier === MembershipTier.Trial
                 ? t('membershipTierTrialHelp')
diff --git a/apps/management-web/src/lib/createUserFormDefaults.ts b/apps/management-web/src/lib/createUserFormDefaults.ts
new file mode 100644
index 00000000..de523c1a
--- /dev/null
+++ b/apps/management-web/src/lib/createUserFormDefaults.ts
@@ -0,0 +1,41 @@
+import type {
+  MembershipTier,
+  PremiumBillingCadence,
+  ResolvedProductMembership,
+} from '@metaboost/helpers';
+
+import {
+  DEFAULT_FREE_TRIAL_EXPIRATION,
+  PRODUCT_MEMBERSHIP_DEFAULTS_FROM_ENV_FALLBACK,
+  resolveInitialMembershipExpiresAt,
+  toDateTimeLocalValue,
+} from '@metaboost/helpers';
+
+export const STORAGE_EXPIRY_KEY = 'metaboost-mgmt-create-user-membership-expires-at';
+export const STORAGE_CADENCE_KEY = 'metaboost-mgmt-create-user-premium-cadence';
+
+/** Client fallback when management-api is unreachable; matches `resolveProductMembershipDefaultsFromEnv` bootstrap numbers. */
+export function fallbackProductMembershipFromEnv(): ResolvedProductMembership {
+  return { ...PRODUCT_MEMBERSHIP_DEFAULTS_FROM_ENV_FALLBACK };
+}
+
+/**
+ * Default datetime-local value aligned with server defaults (trial: `trialExpirationSeconds`;
+ * premium: +1 or +12 months via membership period policy).
+ */
+export function computeDefaultMembershipExpiresAtInput(options: {
+  membershipTier: MembershipTier;
+  premiumBillingCadence: PremiumBillingCadence;
+  trialExpirationSeconds: number;
+}): string {
+  const sec =
+    options.trialExpirationSeconds > 0
+      ? options.trialExpirationSeconds
+      : DEFAULT_FREE_TRIAL_EXPIRATION;
+  const d = resolveInitialMembershipExpiresAt({
+    membershipTier: options.membershipTier,
+    premiumBillingCadence: options.premiumBillingCadence,
+    trialExpirationSeconds: sec,
+  });
+  return toDateTimeLocalValue(d);
+}
diff --git a/apps/management-web/src/lib/main-nav.ts b/apps/management-web/src/lib/main-nav.ts
index bccc3eee..70f04ba4 100644
--- a/apps/management-web/src/lib/main-nav.ts
+++ b/apps/management-web/src/lib/main-nav.ts
@@ -12,7 +12,12 @@ import { ROUTES } from './routes';
 /** Permission keys that hold a CRUD bitmask. Used to gate tab visibility by read access. */
 export type CrudPermissionKey = keyof Pick<
   ManagementUserPermissions,
-  'adminsCrud' | 'usersCrud' | 'bucketsCrud' | 'bucketMessagesCrud' | 'bucketAdminsCrud'
+  | 'adminsCrud'
+  | 'usersCrud'
+  | 'bucketsCrud'
+  | 'bucketMessagesCrud'
+  | 'bucketAdminsCrud'
+  | 'billingPricesCrud'
 >;
 
 export type MainNavEntry = {
@@ -34,6 +39,11 @@ export const MAIN_NAV_ENTRIES: MainNavEntry[] = [
     labelKey: 'globalBlockedApps',
     readPermission: 'adminsCrud',
   },
+  {
+    href: ROUTES.PRODUCTS_MEMBERSHIP,
+    labelKey: 'productsMembership',
+    readPermission: 'billingPricesCrud',
+  },
   { href: ROUTES.EVENTS, labelKey: 'events' },
   { href: ROUTES.TERMS_VERSIONS, labelKey: 'termsVersions', superAdminOnly: true },
   { href: ROUTES.USERS, labelKey: 'users', readPermission: 'usersCrud' },
diff --git a/apps/management-web/src/lib/management-breadcrumbs.ts b/apps/management-web/src/lib/management-breadcrumbs.ts
new file mode 100644
index 00000000..119700cb
--- /dev/null
+++ b/apps/management-web/src/lib/management-breadcrumbs.ts
@@ -0,0 +1,11 @@
+import type { BreadcrumbItem } from '@metaboost/ui';
+
+import { ROUTES } from './routes';
+
+/** Prepends a link to the management Dashboard as the first breadcrumb segment. */
+export function withDashboardBreadcrumb(
+  dashboardLabel: string,
+  items: BreadcrumbItem[]
+): BreadcrumbItem[] {
+  return [{ label: dashboardLabel, href: ROUTES.DASHBOARD }, ...items];
+}
diff --git a/apps/management-web/src/lib/routes.ts b/apps/management-web/src/lib/routes.ts
index 467de008..fc261ce7 100644
--- a/apps/management-web/src/lib/routes.ts
+++ b/apps/management-web/src/lib/routes.ts
@@ -18,6 +18,7 @@ export const ROUTES = {
   BUCKETS: '/buckets',
   BUCKETS_NEW: '/buckets/new',
   GLOBAL_BLOCKED_APPS: '/global-blocked-apps',
+  PRODUCTS_MEMBERSHIP: '/products/membership',
 } as const;
 
 /** Account settings tab; URL param ?tab= for profile, password. No email tab (management has no mailer). */
diff --git a/apps/management-web/src/types/management-api.ts b/apps/management-web/src/types/management-api.ts
index ce991020..3564e83d 100644
--- a/apps/management-web/src/types/management-api.ts
+++ b/apps/management-web/src/types/management-api.ts
@@ -18,6 +18,7 @@ export type ManagementUserPermissions = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: EventVisibility;
 };
 
diff --git a/apps/web/e2e/bucket-detail-bucket-admin.spec.ts b/apps/web/e2e/bucket-detail-bucket-admin.spec.ts
index d2c92786..f8007940 100644
--- a/apps/web/e2e/bucket-detail-bucket-admin.spec.ts
+++ b/apps/web/e2e/bucket-detail-bucket-admin.spec.ts
@@ -7,13 +7,16 @@ import { setE2EUserContext } from './helpers/userContext';
 
 const E2E_BUCKET1_ID_TEXT = 'e2ebkt000001';
 
+/** Seeded bucket one is rss-network with no rss-channel child; avoid server redirect to Add RSS channel. */
+const E2E_BUCKET1_DETAIL_URL = `/bucket/${E2E_BUCKET1_ID_TEXT}?skipEmptyRssNetworkRedirect=1`;
+
 test.describe('Bucket-detail-page for the bucket-admin user', () => {
   test('When the non-owner-admin with bucket access opens the bucket-detail-page, they see the bucket name and content.', async ({
     page,
   }, testInfo) => {
     setE2EUserContext(testInfo, 'bucket-admin');
     await loginAsWebE2EAdminWithPermission(page);
-    await page.goto(`/bucket/${E2E_BUCKET1_ID_TEXT}`);
+    await page.goto(E2E_BUCKET1_DETAIL_URL);
     await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID_TEXT}`));
     await expect(page.getByText('E2E Bucket One')).toBeVisible();
     await expect(page.getByRole('link', { name: /messages/i })).toBeVisible();
@@ -52,7 +55,7 @@ test.describe('Bucket-detail-page for the bucket-admin user', () => {
       async () => {
         await page.goto('/dashboard');
         await expect(page).toHaveURL(/\/dashboard/);
-        await page.getByRole('link', { name: 'E2E Bucket One' }).click();
+        await page.goto(E2E_BUCKET1_DETAIL_URL);
         await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID_TEXT}`));
         await expect(page.getByText('E2E Bucket One')).toBeVisible();
         await expect(page.getByRole('link', { name: /messages/i })).toBeVisible();
diff --git a/apps/web/e2e/bucket-detail-url-state-contract.spec.ts b/apps/web/e2e/bucket-detail-url-state-contract.spec.ts
index 5033cc21..41a71967 100644
--- a/apps/web/e2e/bucket-detail-url-state-contract.spec.ts
+++ b/apps/web/e2e/bucket-detail-url-state-contract.spec.ts
@@ -1,3 +1,5 @@
+import type { Page } from '@playwright/test';
+
 import { expect, test } from '@playwright/test';
 
 import { loginAsWebE2EUserAndExpectDashboard } from './helpers/advancedFixtures';
@@ -6,6 +8,14 @@ import { setE2EUserContext } from './helpers/userContext';
 
 const E2E_BUCKET1_ID_TEXT = 'e2ebkt000001';
 
+/** Seeded bucket one is rss-network with no rss-channel child; avoid server redirect to Add RSS channel. */
+const SKIP_EMPTY_RSS_NETWORK_REDIRECT = 'skipEmptyRssNetworkRedirect=1';
+
+/** Buckets tab lists "E2E Bucket One Child"; heading avoids substring match on getByText. */
+function bucketOnePageHeading(page: Page) {
+  return page.getByRole('heading', { name: 'E2E Bucket One' });
+}
+
 test.describe('URL-state contracts for the bucket-detail-page (tab, sortBy, sortOrder)', () => {
   test('When the user opens the bucket-detail-page with tab=buckets and sortBy=name and sortOrder=asc, the URL preserves the params and the buckets-tab content is visible.', async ({
     page,
@@ -17,17 +27,19 @@ test.describe('URL-state contracts for the bucket-detail-page (tab, sortBy, sort
       testInfo,
       'User navigates to the bucket-detail-page with tab=buckets and sortBy=name and sortOrder=asc and sees the URL and buckets-tab content.',
       async () => {
-        await page.goto(`/bucket/${E2E_BUCKET1_ID_TEXT}?tab=buckets&sortBy=name&sortOrder=asc`);
+        await page.goto(
+          `/bucket/${E2E_BUCKET1_ID_TEXT}?tab=buckets&sortBy=name&sortOrder=asc&${SKIP_EMPTY_RSS_NETWORK_REDIRECT}`
+        );
         const url = new URL(page.url());
         expect(url.pathname).toBe(`/bucket/${E2E_BUCKET1_ID_TEXT}`);
         expect(url.searchParams.get('tab')).toBe('buckets');
         expect(url.searchParams.get('sortBy')).toBe('name');
         expect(url.searchParams.get('sortOrder')).toBe('asc');
-        await expect(page.getByText('E2E Bucket One')).toBeVisible();
+        await expect(bucketOnePageHeading(page)).toBeVisible();
         await expect(page.getByRole('link', { name: /buckets/i }).first()).toBeVisible();
       }
     );
-    const bucketTitle = page.getByText('E2E Bucket One');
+    const bucketTitle = bucketOnePageHeading(page);
     await capturePageLoad(
       page,
       testInfo,
@@ -46,16 +58,18 @@ test.describe('URL-state contracts for the bucket-detail-page (tab, sortBy, sort
       testInfo,
       'User navigates to the bucket-detail-page with tab=buckets and sortBy=created and sortOrder=desc and sees the URL preserved.',
       async () => {
-        await page.goto(`/bucket/${E2E_BUCKET1_ID_TEXT}?tab=buckets&sortBy=created&sortOrder=desc`);
+        await page.goto(
+          `/bucket/${E2E_BUCKET1_ID_TEXT}?tab=buckets&sortBy=created&sortOrder=desc&${SKIP_EMPTY_RSS_NETWORK_REDIRECT}`
+        );
         const url = new URL(page.url());
         expect(url.pathname).toBe(`/bucket/${E2E_BUCKET1_ID_TEXT}`);
         expect(url.searchParams.get('tab')).toBe('buckets');
         expect(url.searchParams.get('sortBy')).toBe('created');
         expect(url.searchParams.get('sortOrder')).toBe('desc');
-        await expect(page.getByText('E2E Bucket One')).toBeVisible();
+        await expect(bucketOnePageHeading(page)).toBeVisible();
       }
     );
-    const bucketTitle = page.getByText('E2E Bucket One');
+    const bucketTitle = bucketOnePageHeading(page);
     await capturePageLoad(
       page,
       testInfo,
diff --git a/apps/web/e2e/bucket-messages-bucket-admin.spec.ts b/apps/web/e2e/bucket-messages-bucket-admin.spec.ts
index a847894e..eb25eafd 100644
--- a/apps/web/e2e/bucket-messages-bucket-admin.spec.ts
+++ b/apps/web/e2e/bucket-messages-bucket-admin.spec.ts
@@ -7,22 +7,17 @@ import { setE2EUserContext } from './helpers/userContext';
 
 const E2E_BUCKET1_ID_TEXT = 'e2ebkt000001';
 
+/** Seeded bucket one is rss-network with no rss-channel child; avoid server redirect to Add RSS channel. */
+const E2E_BUCKET1_DETAIL_URL = `/bucket/${E2E_BUCKET1_ID_TEXT}?skipEmptyRssNetworkRedirect=1`;
+
 test.describe('Bucket-messages-page for the bucket-admin user', () => {
   test('When the non-owner-admin with bucket access opens the bucket-messages-page, they see the messages-list or empty state.', async ({
     page,
   }, testInfo) => {
     setE2EUserContext(testInfo, 'bucket-admin');
     await loginAsWebE2EAdminWithPermission(page);
-    await page.goto(`/bucket/${E2E_BUCKET1_ID_TEXT}/messages`);
-    await expect
-      .poll(() => {
-        const url = new URL(page.url());
-        return (
-          url.pathname === `/bucket/${E2E_BUCKET1_ID_TEXT}/messages` ||
-          url.pathname === `/bucket/${E2E_BUCKET1_ID_TEXT}`
-        );
-      })
-      .toBe(true);
+    await page.goto(E2E_BUCKET1_DETAIL_URL);
+    await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID_TEXT}`));
     await expect(page.getByRole('heading', { name: /messages/i })).toBeVisible();
     await capturePageLoad(
       page,
@@ -56,18 +51,10 @@ test.describe('Bucket-messages-page for the bucket-admin user', () => {
       testInfo,
       'User navigates from bucket-detail to the messages link and sees the messages page.',
       async () => {
-        await page.goto(`/bucket/${E2E_BUCKET1_ID_TEXT}`);
+        await page.goto(E2E_BUCKET1_DETAIL_URL);
         await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID_TEXT}`));
         await page.getByRole('link', { name: /messages/i }).click();
-        await expect
-          .poll(() => {
-            const url = new URL(page.url());
-            return (
-              url.pathname === `/bucket/${E2E_BUCKET1_ID_TEXT}/messages` ||
-              url.pathname === `/bucket/${E2E_BUCKET1_ID_TEXT}`
-            );
-          })
-          .toBe(true);
+        await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID_TEXT}`));
         await expect(page.getByRole('heading', { name: /messages/i })).toBeVisible();
       }
     );
diff --git a/apps/web/e2e/bucket-messages-bucket-owner.spec.ts b/apps/web/e2e/bucket-messages-bucket-owner.spec.ts
index 94583594..ee5b0980 100644
--- a/apps/web/e2e/bucket-messages-bucket-owner.spec.ts
+++ b/apps/web/e2e/bucket-messages-bucket-owner.spec.ts
@@ -7,6 +7,9 @@ import { setE2EUserContext } from './helpers/userContext';
 
 const E2E_BUCKET1_ID_TEXT = 'e2ebkt000001';
 
+/** Seeded bucket one is rss-network with no rss-channel child; avoid server redirect to Add RSS channel. */
+const E2E_BUCKET1_DETAIL_URL = `/bucket/${E2E_BUCKET1_ID_TEXT}?skipEmptyRssNetworkRedirect=1`;
+
 test.describe('Bucket-messages-page for the bucket-owner user', () => {
   test('When an authenticated user opens the bucket-messages-page, they see the messages-list or empty state.', async ({
     page,
@@ -18,16 +21,8 @@ test.describe('Bucket-messages-page for the bucket-owner user', () => {
       testInfo,
       'User navigates to the bucket-messages-page and sees the messages-list or empty state.',
       async () => {
-        await page.goto(`/bucket/${E2E_BUCKET1_ID_TEXT}/messages`);
-        await expect
-          .poll(() => {
-            const url = new URL(page.url());
-            return (
-              url.pathname === `/bucket/${E2E_BUCKET1_ID_TEXT}/messages` ||
-              url.pathname === `/bucket/${E2E_BUCKET1_ID_TEXT}`
-            );
-          })
-          .toBe(true);
+        await page.goto(E2E_BUCKET1_DETAIL_URL);
+        await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID_TEXT}`));
         await expect(page.getByRole('heading', { name: /messages/i })).toBeVisible();
       }
     );
@@ -65,18 +60,10 @@ test.describe('Bucket-messages-page for the bucket-owner user', () => {
       testInfo,
       'User navigates from bucket-detail to the messages link and sees the messages page.',
       async () => {
-        await page.goto(`/bucket/${E2E_BUCKET1_ID_TEXT}`);
+        await page.goto(E2E_BUCKET1_DETAIL_URL);
         await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID_TEXT}`));
         await page.getByRole('link', { name: /messages/i }).click();
-        await expect
-          .poll(() => {
-            const url = new URL(page.url());
-            return (
-              url.pathname === `/bucket/${E2E_BUCKET1_ID_TEXT}/messages` ||
-              url.pathname === `/bucket/${E2E_BUCKET1_ID_TEXT}`
-            );
-          })
-          .toBe(true);
+        await expect(page).toHaveURL(new RegExp(`/bucket/${E2E_BUCKET1_ID_TEXT}`));
         await expect(page.getByRole('heading', { name: /messages/i })).toBeVisible();
       }
     );
diff --git a/apps/web/e2e/bucket-notifications-webpush-bucket-owner.spec.ts b/apps/web/e2e/bucket-notifications-webpush-bucket-owner.spec.ts
new file mode 100644
index 00000000..69749868
--- /dev/null
+++ b/apps/web/e2e/bucket-notifications-webpush-bucket-owner.spec.ts
@@ -0,0 +1,177 @@
+import { expect, test } from '@playwright/test';
+
+import { loginAsWebE2EUserAndExpectDashboard } from './helpers/advancedFixtures';
+import { getE2EApiV1BaseUrl } from './helpers/apiBase';
+import { actionAndCapture, capturePageLoad } from './helpers/stepScreenshots';
+import { setE2EUserContext } from './helpers/userContext';
+import { installWebPushBrowserStub } from './helpers/webPushBrowserStub';
+
+const BUCKET_LEAF_URL = '/bucket/e2ebkt000002?skipEmptyRssNetworkRedirect=1';
+const BUCKET_PARENT_URL = '/bucket/e2ebkt000001?skipEmptyRssNetworkRedirect=1';
+const E2E_CHILD_BUCKET_ID_TEXT = 'e2ebkt000003';
+
+async function patchBucketNotificationPref(
+  page: import('@playwright/test').Page,
+  bucketIdText: string,
+  body: { enabled: boolean; applyToDescendants?: boolean }
+): Promise<void> {
+  const response = await page.request.patch(
+    `${getE2EApiV1BaseUrl()}/buckets/${bucketIdText}/notification-preference`,
+    { data: body }
+  );
+  expect(response.ok()).toBe(true);
+}
+
+test.describe('Bucket Web Push notifications for the bucket-owner user', () => {
+  test.beforeEach(async ({ page }) => {
+    await installWebPushBrowserStub(page);
+    await page.context().grantPermissions(['notifications']);
+  });
+
+  test('When the bucket owner opens a seeded bucket detail page, they see the notification bell button.', async ({
+    page,
+  }, testInfo) => {
+    setE2EUserContext(testInfo, 'bucket-owner');
+    await loginAsWebE2EUserAndExpectDashboard(page);
+    await actionAndCapture(
+      page,
+      testInfo,
+      'User opens the seeded bucket detail page (no RSS empty-network redirect) and sees the notification bell.',
+      async () => {
+        await page.goto(BUCKET_LEAF_URL);
+        await expect(
+          page.getByRole('button', { name: /bucket notifications (on|off)/i })
+        ).toBeVisible();
+      }
+    );
+    await capturePageLoad(
+      page,
+      testInfo,
+      'The bucket detail page shows the notification bell control beside the bucket tabs.'
+    );
+  });
+
+  test('When notification preference is saved via the API, reloading the page shows the matching bell accessibility label.', async ({
+    page,
+  }, testInfo) => {
+    setE2EUserContext(testInfo, 'bucket-owner');
+    await loginAsWebE2EUserAndExpectDashboard(page);
+    await page.goto(BUCKET_LEAF_URL);
+    await patchBucketNotificationPref(page, 'e2ebkt000002', { enabled: true });
+    await page.reload();
+    await expect(page.getByRole('button', { name: 'Bucket notifications on' })).toBeVisible();
+    await patchBucketNotificationPref(page, 'e2ebkt000002', { enabled: false });
+    await page.reload();
+    await expect(page.getByRole('button', { name: 'Bucket notifications off' })).toBeVisible();
+  });
+
+  test('When the bucket has no child buckets, the bell toggles notifications on and off without a scope modal.', async ({
+    page,
+  }, testInfo) => {
+    setE2EUserContext(testInfo, 'bucket-owner');
+    await loginAsWebE2EUserAndExpectDashboard(page);
+    await patchBucketNotificationPref(page, 'e2ebkt000002', {
+      enabled: false,
+      applyToDescendants: true,
+    });
+    await page.goto(BUCKET_LEAF_URL);
+    await expect(page.getByRole('button', { name: 'Bucket notifications off' })).toBeVisible();
+    await actionAndCapture(
+      page,
+      testInfo,
+      'User enables bucket notifications on a bucket with no children and sees the bell switch to the on state.',
+      async () => {
+        await page.getByRole('button', { name: 'Bucket notifications off' }).click();
+        await expect(page.getByRole('button', { name: 'Bucket notifications on' })).toBeVisible();
+      }
+    );
+    await actionAndCapture(
+      page,
+      testInfo,
+      'User disables bucket notifications and sees the bell switch back to the off state.',
+      async () => {
+        await page.getByRole('button', { name: 'Bucket notifications on' }).click();
+        await expect(page.getByRole('button', { name: 'Bucket notifications off' })).toBeVisible();
+      }
+    );
+    await capturePageLoad(
+      page,
+      testInfo,
+      'After toggling off, the bucket detail page shows Bucket notifications off.'
+    );
+  });
+
+  test('When the bucket has child buckets, enabling opens the scope modal and "This bucket only" completes.', async ({
+    page,
+  }, testInfo) => {
+    setE2EUserContext(testInfo, 'bucket-owner');
+    await loginAsWebE2EUserAndExpectDashboard(page);
+    await patchBucketNotificationPref(page, 'e2ebkt000001', {
+      enabled: false,
+      applyToDescendants: true,
+    });
+    await patchBucketNotificationPref(page, E2E_CHILD_BUCKET_ID_TEXT, {
+      enabled: false,
+      applyToDescendants: true,
+    });
+    await page.goto(BUCKET_PARENT_URL);
+    await actionAndCapture(
+      page,
+      testInfo,
+      'User enables notifications on a parent bucket and chooses This bucket only in the scope modal.',
+      async () => {
+        await page.getByRole('button', { name: 'Bucket notifications off' }).click();
+        await expect(
+          page.getByText(/Apply these setting changes only to this bucket/i)
+        ).toBeVisible();
+        await page.getByRole('button', { name: 'This bucket only' }).click();
+        await expect(page.getByRole('button', { name: 'Bucket notifications on' })).toBeVisible();
+      }
+    );
+    await capturePageLoad(
+      page,
+      testInfo,
+      'The parent bucket shows Bucket notifications on after scope-only enable.'
+    );
+  });
+
+  test('When the bucket has child buckets, enabling with Apply to all sub-buckets turns on the descendant preference.', async ({
+    page,
+  }, testInfo) => {
+    setE2EUserContext(testInfo, 'bucket-owner');
+    await loginAsWebE2EUserAndExpectDashboard(page);
+    await patchBucketNotificationPref(page, 'e2ebkt000001', {
+      enabled: false,
+      applyToDescendants: true,
+    });
+    await patchBucketNotificationPref(page, E2E_CHILD_BUCKET_ID_TEXT, {
+      enabled: false,
+      applyToDescendants: true,
+    });
+    await page.goto(BUCKET_PARENT_URL);
+    await actionAndCapture(
+      page,
+      testInfo,
+      'User enables notifications and chooses Apply to all sub-buckets in the scope modal.',
+      async () => {
+        await page.getByRole('button', { name: 'Bucket notifications off' }).click();
+        await expect(
+          page.getByText(/Apply these setting changes only to this bucket/i)
+        ).toBeVisible();
+        await page.getByRole('button', { name: 'Apply to all sub-buckets' }).click();
+        await expect(page.getByRole('button', { name: 'Bucket notifications on' })).toBeVisible();
+      }
+    );
+    const childPrefResponse = await page.request.get(
+      `${getE2EApiV1BaseUrl()}/buckets/${E2E_CHILD_BUCKET_ID_TEXT}/notification-preference`
+    );
+    expect(childPrefResponse.ok()).toBe(true);
+    const childPrefJson = (await childPrefResponse.json()) as { enabled?: boolean };
+    expect(childPrefJson.enabled).toBe(true);
+    await capturePageLoad(
+      page,
+      testInfo,
+      'Descendant bucket notification preference is enabled after apply-to-all.'
+    );
+  });
+});
diff --git a/apps/web/e2e/helpers/webPushBrowserStub.ts b/apps/web/e2e/helpers/webPushBrowserStub.ts
new file mode 100644
index 00000000..586b20e0
--- /dev/null
+++ b/apps/web/e2e/helpers/webPushBrowserStub.ts
@@ -0,0 +1,54 @@
+import type { Page } from '@playwright/test';
+
+/**
+ * Playwright Chromium cannot complete real PushManager.subscribe against a service worker.
+ * Stub registration + subscription so bucket bell E2E exercises API preference toggles only.
+ */
+export async function installWebPushBrowserStub(page: Page): Promise<void> {
+  await page.addInitScript(() => {
+    if (typeof Notification !== 'undefined') {
+      Notification.requestPermission = async () => 'granted';
+    }
+
+    let currentSub: {
+      endpoint: string;
+      toJSON: () => { endpoint: string; keys: { p256dh: string; auth: string } };
+      unsubscribe: () => Promise<boolean>;
+    } | null = null;
+
+    const endpoint = 'https://example.invalid/e2e-webpush-endpoint';
+
+    const createSubscription = () => ({
+      endpoint,
+      toJSON() {
+        return {
+          endpoint,
+          keys: {
+            p256dh: 'BKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
+            auth: 'authkey123456',
+          },
+        };
+      },
+      unsubscribe: async () => {
+        currentSub = null;
+        return true;
+      },
+    });
+
+    const mockRegistration = {
+      pushManager: {
+        subscribe: async () => {
+          currentSub = createSubscription();
+          return currentSub;
+        },
+        getSubscription: async () => currentSub,
+      },
+    };
+
+    navigator.serviceWorker.register = async () => mockRegistration;
+    Object.defineProperty(navigator.serviceWorker, 'ready', {
+      configurable: true,
+      get: () => Promise.resolve(mockRegistration),
+    });
+  });
+}
diff --git a/apps/web/e2e/login-unauthenticated.spec.ts b/apps/web/e2e/login-unauthenticated.spec.ts
index eec67d8f..9d47b4b8 100644
--- a/apps/web/e2e/login-unauthenticated.spec.ts
+++ b/apps/web/e2e/login-unauthenticated.spec.ts
@@ -58,7 +58,7 @@ test.describe('Login-page for the unauthenticated user', () => {
     );
     await expect(page).toHaveURL(/\/dashboard/);
     await expectPostLoginDashboardVisible(page);
-    const nameColumn = page.getByRole('columnheader', { name: /^name$/i });
+    const nameColumn = page.getByRole('columnheader', { name: /name/i });
     await capturePageLoad(
       page,
       testInfo,
diff --git a/apps/web/i18n/originals/en-US.json b/apps/web/i18n/originals/en-US.json
index 4a02dee8..6eff5fc2 100644
--- a/apps/web/i18n/originals/en-US.json
+++ b/apps/web/i18n/originals/en-US.json
@@ -121,6 +121,12 @@
     "applySettingsScopePrompt": "Apply these setting changes only to this bucket, or to all sub-buckets too?",
     "applySettingsScopeThisBucketOnly": "This bucket only",
     "applySettingsScopeAllSubBuckets": "Apply to all sub-buckets",
+    "notificationBellAriaEnabled": "Bucket notifications on",
+    "notificationBellAriaDisabled": "Bucket notifications off",
+    "notificationBellTooltip": "Toggle browser notifications for new messages in this bucket.",
+    "notificationVapidMissing": "Push notifications are not configured for this deployment.",
+    "notificationEnableFailed": "Could not enable notifications. Check browser permission and try again.",
+    "notificationDisableFailed": "Could not update notification preference.",
     "bodyLabel": "Body",
     "messageLabel": "Message",
     "yourName": "Your name",
@@ -441,7 +447,15 @@
     "resetTokenRequired": "Reset token is required",
     "invalidOrExpiredLink": "Invalid or expired link",
     "loginFailed": "Login failed",
-    "deleteFailed": "Delete failed"
+    "deleteFailed": "Delete failed",
+    "boundary_title": "Something went wrong",
+    "boundary_message": "An unexpected error occurred. Please try again.",
+    "global_title": "Application error",
+    "global_message": "A critical error occurred. Please refresh the page.",
+    "details_development_only": "Error details (development only)",
+    "try_again": "Try again",
+    "reload_page": "Reload page",
+    "return_to_home_page": "Go to home"
   },
   "ui": {
     "auth": {
diff --git a/apps/web/i18n/originals/es.json b/apps/web/i18n/originals/es.json
index 5addba1f..921fc087 100644
--- a/apps/web/i18n/originals/es.json
+++ b/apps/web/i18n/originals/es.json
@@ -121,6 +121,12 @@
     "applySettingsScopePrompt": "¿Aplicar estos cambios de configuración solo a este bucket o también a todos los sub-buckets?",
     "applySettingsScopeThisBucketOnly": "Solo este bucket",
     "applySettingsScopeAllSubBuckets": "Aplicar a todos los sub-buckets",
+    "notificationBellAriaEnabled": "Notificaciones del bucket activadas",
+    "notificationBellAriaDisabled": "Notificaciones del bucket desactivadas",
+    "notificationBellTooltip": "Activa o desactiva las notificaciones del navegador para mensajes nuevos en este bucket.",
+    "notificationVapidMissing": "Las notificaciones push no están configuradas en este despliegue.",
+    "notificationEnableFailed": "No se pudieron activar las notificaciones. Comprueba el permiso del navegador e inténtalo de nuevo.",
+    "notificationDisableFailed": "No se pudo actualizar la preferencia de notificaciones.",
     "bodyLabel": "Cuerpo",
     "messageLabel": "Mensaje",
     "yourName": "Tu nombre",
@@ -441,7 +447,15 @@
     "resetTokenRequired": "Se requiere el token de restablecimiento",
     "invalidOrExpiredLink": "Enlace no válido o caducado",
     "loginFailed": "Error al iniciar sesión",
-    "deleteFailed": "Error al eliminar"
+    "deleteFailed": "Error al eliminar",
+    "boundary_title": "Algo salió mal",
+    "boundary_message": "Ocurrió un error inesperado. Por favor, inténtalo de nuevo.",
+    "global_title": "Error de la aplicación",
+    "global_message": "Ocurrió un error crítico. Por favor, actualiza la página.",
+    "details_development_only": "Detalles del error (solo desarrollo)",
+    "try_again": "Intentar de nuevo",
+    "reload_page": "Recargar página",
+    "return_to_home_page": "Ir al inicio"
   },
   "ui": {
     "auth": {
diff --git a/apps/web/i18n/overrides/es.json b/apps/web/i18n/overrides/es.json
index 3659245b..25549234 100644
--- a/apps/web/i18n/overrides/es.json
+++ b/apps/web/i18n/overrides/es.json
@@ -121,6 +121,12 @@
     "applySettingsScopePrompt": "",
     "applySettingsScopeThisBucketOnly": "",
     "applySettingsScopeAllSubBuckets": "",
+    "notificationBellAriaEnabled": "",
+    "notificationBellAriaDisabled": "",
+    "notificationBellTooltip": "",
+    "notificationVapidMissing": "",
+    "notificationEnableFailed": "",
+    "notificationDisableFailed": "",
     "bodyLabel": "",
     "messageLabel": "",
     "yourName": "",
@@ -441,7 +447,15 @@
     "resetTokenRequired": "",
     "invalidOrExpiredLink": "",
     "loginFailed": "",
-    "deleteFailed": ""
+    "deleteFailed": "",
+    "boundary_title": "",
+    "boundary_message": "",
+    "global_title": "",
+    "global_message": "",
+    "details_development_only": "",
+    "try_again": "",
+    "reload_page": "",
+    "return_to_home_page": ""
   },
   "ui": {
     "auth": {
diff --git a/apps/web/package.json b/apps/web/package.json
index 5e6be6d1..da60e53e 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -39,11 +39,13 @@
     "@types/node": "^24.10.12",
     "@types/react": "^19.2.11",
     "@types/react-dom": "^19.2.2",
+    "@vitejs/plugin-react": "^5.1.1",
     "concurrently": "^9.2.1",
     "dotenv": "^16.4.5",
+    "jsdom": "^26.1.0",
     "nodemon": "^3.1.10",
     "sass": "^1.98.0",
     "typescript": "^5.9.2",
-    "vitest": "^4.1.4"
+    "vitest": "^4.1.9"
   }
 }
diff --git a/apps/web/playwright.e2e-server-env.ts b/apps/web/playwright.e2e-server-env.ts
index f1e14c18..df6fffe4 100644
--- a/apps/web/playwright.e2e-server-env.ts
+++ b/apps/web/playwright.e2e-server-env.ts
@@ -19,6 +19,12 @@ const E2E_SIDECAR_PORT = '4011';
 const E2E_TEST_DB_PORT = '5632';
 const E2E_TEST_KEYVALDB_PORT = '6579';
 
+/** Stable VAPID pair for Playwright (generated via web-push; browser push subscription must match API keys). */
+const E2E_WEBPUSH_VAPID_PUBLIC_KEY =
+  'BOURXzjqrm8R8STaQuxjOrubvdV-S1Gr7vvoh4cGxJsWD9_IScOe5E3GVifH4XwxOuKgDIBO990CyIaqS4VlbM4';
+const E2E_WEBPUSH_VAPID_PRIVATE_KEY = 'Lu_hzIjfWtpEY0zXUI1fODMUd98VRyqmDOZEpSCZJyE';
+const E2E_WEBPUSH_VAPID_SUBJECT = 'mailto:e2e-webpush@example.com';
+
 function accountSignupModeUsesEmailFlows(mode: WebE2EAccountSignupMode): boolean {
   return mode === 'admin_only_email' || mode === 'user_signup_email';
 }
@@ -67,6 +73,9 @@ export function buildE2eWebApiEnv(mode: WebE2EAccountSignupMode): WebServerEnv {
     API_EXCHANGE_RATES_BTC_PROVIDER_URL:
       'https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd',
     API_EXCHANGE_RATES_CACHE_TTL_MS: '600000',
+    WEBPUSH_VAPID_PUBLIC_KEY: E2E_WEBPUSH_VAPID_PUBLIC_KEY,
+    WEBPUSH_VAPID_PRIVATE_KEY: E2E_WEBPUSH_VAPID_PRIVATE_KEY,
+    WEBPUSH_VAPID_SUBJECT: E2E_WEBPUSH_VAPID_SUBJECT,
   };
 
   if (accountSignupModeUsesEmailFlows(mode)) {
@@ -113,6 +122,7 @@ export function buildE2eWebSidecarEnvPrefix(mode: WebE2EAccountSignupMode): stri
     'NEXT_PUBLIC_DEFAULT_LOCALE=en-US',
     'NEXT_PUBLIC_SUPPORTED_LOCALES=en-US,es',
     `API_SERVER_BASE_URL=http://127.0.0.1:${E2E_API_PORT}`,
+    `NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY=${E2E_WEBPUSH_VAPID_PUBLIC_KEY}`,
   ].join(' ');
 }
 
@@ -129,5 +139,6 @@ export function buildE2eWebAppEnvPrefix(mode: WebE2EAccountSignupMode): string {
     'NEXT_PUBLIC_LEGAL_NAME="E2E Web Legal"',
     'NEXT_PUBLIC_WEB_BRAND_DOMAIN=localhost',
     'NEXT_PUBLIC_SESSION_REFRESH_INTERVAL_MS=600000',
+    `NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY=${E2E_WEBPUSH_VAPID_PUBLIC_KEY}`,
   ].join(' ');
 }
diff --git a/apps/web/public/webpush-sw.js b/apps/web/public/webpush-sw.js
new file mode 100644
index 00000000..c4b2618b
--- /dev/null
+++ b/apps/web/public/webpush-sw.js
@@ -0,0 +1,57 @@
+/* eslint-disable no-undef — service worker global scope */
+self.addEventListener('push', (event) => {
+  let payload = {};
+  try {
+    if (event.data) {
+      payload = event.data.json();
+    }
+  } catch {
+    payload = {};
+  }
+  const bucketIdText = typeof payload.bucketIdText === 'string' ? payload.bucketIdText : '';
+  const title = 'MetaBoost';
+  const body = bucketIdText !== '' ? 'New boost in bucket ' + bucketIdText : 'New bucket message';
+  const relativeUrl =
+    bucketIdText !== ''
+      ? '/bucket/' + encodeURIComponent(bucketIdText) + '?tab=messages'
+      : '/dashboard';
+  const url = new URL(relativeUrl, self.location.origin).href;
+  const tag =
+    payload.messageGuid !== undefined && payload.messageGuid !== null
+      ? String(payload.messageGuid)
+      : 'metaboost-push';
+  event.waitUntil(
+    self.registration.showNotification(title, {
+      body,
+      data: { url },
+      tag,
+    })
+  );
+});
+
+self.addEventListener('notificationclick', (event) => {
+  event.notification.close();
+  const targetUrl =
+    event.notification.data !== undefined &&
+    event.notification.data !== null &&
+    typeof event.notification.data.url === 'string'
+      ? event.notification.data.url
+      : null;
+  if (targetUrl === null || targetUrl === '') {
+    return;
+  }
+  event.waitUntil(
+    self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then((clientList) => {
+      for (let i = 0; i < clientList.length; i += 1) {
+        const client = clientList[i];
+        if (client.url === targetUrl && 'focus' in client) {
+          return client.focus();
+        }
+      }
+      if (self.clients.openWindow !== undefined) {
+        return self.clients.openWindow(targetUrl);
+      }
+      return undefined;
+    })
+  );
+});
diff --git a/apps/web/sidecar/.env.example b/apps/web/sidecar/.env.example
index 095276ca..02e21766 100644
--- a/apps/web/sidecar/.env.example
+++ b/apps/web/sidecar/.env.example
@@ -12,3 +12,8 @@ WEB_PORT="4002"
 NEXT_PUBLIC_WEB_BASE_URL="http://localhost:4002"
 WEB_SIDECAR_PORT="4001"
 NEXT_PUBLIC_SESSION_REFRESH_INTERVAL_MS="600000"
+# Web Push (browser). Optional — leave empty to disable subscription UI / client key.
+NEXT_PUBLIC_WEBPUSH_ENABLED=
+NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY=
+# Legacy alias for the public key (still supported):
+NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY=
diff --git a/apps/web/sidecar/src/server.ts b/apps/web/sidecar/src/server.ts
index 665d859b..a2d238b7 100644
--- a/apps/web/sidecar/src/server.ts
+++ b/apps/web/sidecar/src/server.ts
@@ -31,7 +31,14 @@ const requiredKeys = [
   'API_SERVER_BASE_URL',
 ] as const;
 
-const allKeys = [...requiredKeys];
+/** Optional keys forwarded in runtime-config JSON (must stay aligned with apps/web/src/config/runtime-config.ts). */
+const optionalKeys = [
+  'NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY',
+  'NEXT_PUBLIC_WEBPUSH_ENABLED',
+  'NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY',
+] as const;
+
+const allKeys = [...requiredKeys, ...optionalKeys];
 
 function validateWebSidecarPort(): ValidationResult {
   const value = process.env.WEB_SIDECAR_PORT;
@@ -82,6 +89,9 @@ function getCategory(key: string): string {
     NEXT_PUBLIC_DEFAULT_LOCALE: 'i18n',
     NEXT_PUBLIC_SUPPORTED_LOCALES: 'i18n',
     API_SERVER_BASE_URL: 'API',
+    NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY: 'Web Push',
+    NEXT_PUBLIC_WEBPUSH_ENABLED: 'Web Push',
+    NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY: 'Web Push',
   };
   return map[key] ?? 'Config';
 }
diff --git a/apps/web/src/app/(main)/bucket/[id]/BucketDetailTabShell.tsx b/apps/web/src/app/(main)/bucket/[id]/BucketDetailTabShell.tsx
index e9018597..c66ebd45 100644
--- a/apps/web/src/app/(main)/bucket/[id]/BucketDetailTabShell.tsx
+++ b/apps/web/src/app/(main)/bucket/[id]/BucketDetailTabShell.tsx
@@ -8,7 +8,7 @@ import type { ReactNode } from 'react';
 import { usePathname, useRouter, useSearchParams } from 'next/navigation';
 import { useCallback, useMemo, useState } from 'react';
 
-import { BucketDetailTabNavContext } from '@metaboost/ui';
+import { BucketDetailTabNavContext, Row } from '@metaboost/ui';
 
 import { WebBucketDetailContent } from '../../../../components/WebBucketDetailContent';
 import { BucketDetailTabsClient } from './BucketDetailTabsClient';
@@ -51,6 +51,8 @@ export type BucketDetailTabShellProps = Omit<
   childBucketsForContent: BucketDetailBucket[];
   bucketsSortBy: string | undefined;
   bucketsSortOrder: 'asc' | 'desc' | undefined;
+  /** Optional bucket notifications control (e.g. Web Push bell) rendered beside tab navigation. */
+  notificationBell?: ReactNode;
 };
 
 export function BucketDetailTabShell({
@@ -65,6 +67,7 @@ export function BucketDetailTabShell({
   childBucketsForContent,
   bucketsSortBy,
   bucketsSortOrder,
+  notificationBell,
   ...rest
 }: BucketDetailTabShellProps) {
   const [activeTab, setActiveTab] = useState<BucketDetailNavTab>(() => serverInitialTab);
@@ -116,11 +119,14 @@ export function BucketDetailTabShell({
       <WebBucketDetailContent
         {...rest}
         actionArea={
-          <BucketDetailTabsClient
-            items={tabItems}
-            activeItemKey={activeItemKey}
-            bucketPath={bucketPath}
-          />
+          <Row wrap>
+            {notificationBell}
+            <BucketDetailTabsClient
+              items={tabItems}
+              activeItemKey={activeItemKey}
+              bucketPath={bucketPath}
+            />
+          </Row>
         }
         messagesSlot={messagesSlot}
         messagesSlotMaxWidth={messagesSlotMaxWidth}
diff --git a/apps/web/src/app/(main)/bucket/[id]/BucketName.module.scss b/apps/web/src/app/(main)/bucket/[id]/BucketName.module.scss
new file mode 100644
index 00000000..7333f653
--- /dev/null
+++ b/apps/web/src/app/(main)/bucket/[id]/BucketName.module.scss
@@ -0,0 +1,16 @@
+@use '@metaboost/ui/styles/variables' as *;
+
+.row {
+  align-items: center;
+  display: inline-flex;
+  gap: $space-3;
+  justify-content: space-between;
+  width: 100%;
+}
+
+.visibilityIcon {
+  display: inline-flex;
+  flex-shrink: 0;
+  justify-content: center;
+  width: 1.25em;
+}
diff --git a/apps/web/src/app/(main)/bucket/[id]/BucketNotificationsBell.tsx b/apps/web/src/app/(main)/bucket/[id]/BucketNotificationsBell.tsx
new file mode 100644
index 00000000..be75e4ee
--- /dev/null
+++ b/apps/web/src/app/(main)/bucket/[id]/BucketNotificationsBell.tsx
@@ -0,0 +1,111 @@
+'use client';
+
+import { useTranslations } from 'next-intl';
+import { useMemo } from 'react';
+
+import { Button, Text, Tooltip } from '@metaboost/ui';
+
+import { useApplyToDescendantsModal } from '../../../../components/useApplyToDescendantsModal';
+import { useBucketWebPushSubscription } from './useBucketWebPushSubscription';
+
+export type BucketNotificationsBellProps = {
+  bucketId: string;
+  hasChildBuckets: boolean;
+  initialEnabled: boolean;
+  vapidPublicKey: string;
+};
+
+export function BucketNotificationsBell({
+  bucketId,
+  hasChildBuckets,
+  initialEnabled,
+  vapidPublicKey,
+}: BucketNotificationsBellProps) {
+  const t = useTranslations('buckets');
+  const webPush = useBucketWebPushSubscription({
+    bucketId,
+    initialEnabled,
+    vapidPublicKey,
+  });
+
+  const labels = useMemo(
+    () => ({
+      prompt: t('applySettingsScopePrompt'),
+      thisBucketOnly: t('applySettingsScopeThisBucketOnly'),
+      allSubBuckets: t('applySettingsScopeAllSubBuckets'),
+    }),
+    [t]
+  );
+
+  const descendantsModal = useApplyToDescendantsModal({
+    loading: webPush.loading,
+    labels,
+    onResolved: async (enable, applyToDescendants) => {
+      if (enable) {
+        await webPush.enable(applyToDescendants);
+      } else {
+        await webPush.disable(applyToDescendants);
+      }
+    },
+  });
+
+  const onBellClick = () => {
+    if (webPush.loading) {
+      return;
+    }
+    webPush.clearError();
+    const nextOn = !webPush.enabled;
+    if (nextOn) {
+      if (!webPush.vapidOk) {
+        void webPush.enable(false);
+        return;
+      }
+      if (hasChildBuckets) {
+        descendantsModal.openFor(true);
+        return;
+      }
+      void webPush.enable(false);
+      return;
+    }
+    if (hasChildBuckets) {
+      descendantsModal.openFor(false);
+      return;
+    }
+    void webPush.disable(false);
+  };
+
+  const ariaLabel = webPush.enabled
+    ? t('notificationBellAriaEnabled')
+    : t('notificationBellAriaDisabled');
+  const bellClass = webPush.enabled ? 'fa-solid fa-bell' : 'fa-solid fa-bell-slash';
+
+  const button = (
+    <Button
+      type="button"
+      variant="secondary"
+      onClick={onBellClick}
+      disabled={webPush.loading}
+      loading={webPush.loading}
+      aria-label={ariaLabel}
+      aria-pressed={webPush.enabled}
+    >
+      <i className={bellClass} aria-hidden />
+    </Button>
+  );
+
+  return (
+    <>
+      {!webPush.vapidOk && !webPush.enabled ? (
+        <Tooltip content={t('notificationVapidMissing')}>{button}</Tooltip>
+      ) : (
+        <Tooltip content={t('notificationBellTooltip')}>{button}</Tooltip>
+      )}
+      {webPush.errorMessage !== null ? (
+        <Text as="p" size="sm" variant="error" role="alert">
+          {webPush.errorMessage}
+        </Text>
+      ) : null}
+      {descendantsModal.modal}
+    </>
+  );
+}
diff --git a/apps/web/src/app/(main)/bucket/[id]/BucketRolesClient.module.scss b/apps/web/src/app/(main)/bucket/[id]/BucketRolesClient.module.scss
index 5afe5a5d..9f4777de 100644
--- a/apps/web/src/app/(main)/bucket/[id]/BucketRolesClient.module.scss
+++ b/apps/web/src/app/(main)/bucket/[id]/BucketRolesClient.module.scss
@@ -9,7 +9,7 @@
   align-items: center;
   gap: 1rem;
   padding: 0.5rem 0;
-  border-bottom: 1px solid var(--color-border, #eee);
+  border-bottom: 1px solid var(--color-border);
 }
 
 .roleName {
diff --git a/apps/web/src/app/(main)/bucket/[id]/page.tsx b/apps/web/src/app/(main)/bucket/[id]/page.tsx
index e6c6ce1a..358beffd 100644
--- a/apps/web/src/app/(main)/bucket/[id]/page.tsx
+++ b/apps/web/src/app/(main)/bucket/[id]/page.tsx
@@ -23,13 +23,18 @@ import {
 } from '@metaboost/ui';
 
 import { BucketSummaryPanel } from '../../../../components/BucketSummaryPanel';
-import { getWebBrandName } from '../../../../config/env';
+import {
+  getWebBrandName,
+  getWebPushClientEnabled,
+  getWebPushVapidPublicKey,
+} from '../../../../config/env';
 import { canCreateChildBuckets, canDeleteBucketMessages } from '../../../../lib/bucket-authz';
 import { mapBucketMessagesToListItems } from '../../../../lib/bucketMessagesMapShared';
 import {
   fetchBucket,
   fetchBucketAncestry,
   fetchBucketSummary,
+  fetchBucketNotificationPreference,
   fetchChildBuckets,
   fetchMessagesPaginated,
 } from '../../../../lib/buckets';
@@ -53,8 +58,11 @@ import { AddToRssPanel } from './AddToRssPanel';
 import { AddToRssTabLink } from './AddToRssTabLink';
 import { BucketDetailTabShell } from './BucketDetailTabShell';
 import { BucketMessagesTabClient } from './BucketMessagesTabClient';
+import { BucketNotificationsBell } from './BucketNotificationsBell';
 import { EndpointPanel } from './EndpointPanel';
 
+import bucketNameStyles from './BucketName.module.scss';
+
 type BucketSearchParams = {
   tab?: string;
   page?: string;
@@ -204,20 +212,22 @@ export default async function BucketDetailPage({
           ? 'endpoint'
           : 'messages';
 
-  const [childBuckets, ancestors, messagesResult, initialSummary] = await Promise.all([
-    fetchChildBuckets(id),
-    fetchBucketAncestry(bucket),
-    tabForQuery === 'messages'
-      ? fetchMessagesPaginated(id, page, DEFAULT_PAGE_LIMIT, sort, includeBlockedSenderMessages)
-      : Promise.resolve({
-          messages: [],
-          page: 1,
-          limit: DEFAULT_PAGE_LIMIT,
-          total: 0,
-          totalPages: 1,
-        }),
-    fetchBucketSummary(id, bucketSummaryInitialQuery),
-  ]);
+  const [childBuckets, ancestors, messagesResult, initialSummary, notificationPref] =
+    await Promise.all([
+      fetchChildBuckets(id),
+      fetchBucketAncestry(bucket),
+      tabForQuery === 'messages'
+        ? fetchMessagesPaginated(id, page, DEFAULT_PAGE_LIMIT, sort, includeBlockedSenderMessages)
+        : Promise.resolve({
+            messages: [],
+            page: 1,
+            limit: DEFAULT_PAGE_LIMIT,
+            total: 0,
+            totalPages: 1,
+          }),
+      fetchBucketSummary(id, bucketSummaryInitialQuery),
+      fetchBucketNotificationPreference(id),
+    ]);
 
   const skipEmptyRssNetworkRedirect = isTruthyQueryFlag(
     resolvedSearchParams.skipEmptyRssNetworkRedirect
@@ -311,6 +321,10 @@ export default async function BucketDetailPage({
     type: bucket.type,
   });
 
+  const notificationInitialEnabled = notificationPref?.enabled === true;
+  const vapidPublicKey = getWebPushVapidPublicKey() ?? '';
+  const showWebPushBell = getWebPushClientEnabled();
+
   return (
     <BucketDetailPageLayout
       breadcrumbs={
@@ -327,6 +341,16 @@ export default async function BucketDetailPage({
         serverInitialTab={tab}
         bucketPath={bucketDetailRoute(id)}
         bucketType={bucket.type}
+        notificationBell={
+          showWebPushBell ? (
+            <BucketNotificationsBell
+              bucketId={id}
+              hasChildBuckets={childBuckets.length > 0}
+              initialEnabled={notificationInitialEnabled}
+              vapidPublicKey={vapidPublicKey}
+            />
+          ) : undefined
+        }
         tabItems={tabItems}
         messagesPanel={
           <BucketMessagesTabClient
@@ -426,23 +450,10 @@ export default async function BucketDetailPage({
         bucketsSortOrder={bucketsSortOrder}
         bucketIdText={id}
         bucketName={
-          <span
-            style={{
-              display: 'inline-flex',
-              width: '100%',
-              alignItems: 'center',
-              justifyContent: 'space-between',
-              gap: '0.75rem',
-            }}
-          >
+          <span className={bucketNameStyles.row}>
             <span>{bucket.name}</span>
             <span
-              style={{
-                display: 'inline-flex',
-                width: '1.25em',
-                justifyContent: 'center',
-                flexShrink: 0,
-              }}
+              className={bucketNameStyles.visibilityIcon}
               role="img"
               aria-label={bucketVisibilityLabel}
               title={bucketVisibilityLabel}
diff --git a/apps/web/src/app/(main)/bucket/[id]/useBucketWebPushSubscription.ts b/apps/web/src/app/(main)/bucket/[id]/useBucketWebPushSubscription.ts
new file mode 100644
index 00000000..2d21df3c
--- /dev/null
+++ b/apps/web/src/app/(main)/bucket/[id]/useBucketWebPushSubscription.ts
@@ -0,0 +1,116 @@
+'use client';
+
+import { useTranslations } from 'next-intl';
+import { useCallback, useState } from 'react';
+
+import { webAuth, webBuckets } from '@metaboost/helpers-requests';
+
+import { getApiBaseUrl } from '../../../../config/env';
+import {
+  deleteServerSubscriptionIfMatches,
+  subscriptionBodyFromPushSubscription,
+  subscribeWithVapid,
+  unsubscribeCurrentBrowserPush,
+} from '../../../../lib/webPushBrowser';
+
+export function useBucketWebPushSubscription(options: {
+  bucketId: string;
+  initialEnabled: boolean;
+  vapidPublicKey: string;
+}) {
+  const t = useTranslations('buckets');
+  const [enabled, setEnabled] = useState(options.initialEnabled);
+  const [loading, setLoading] = useState(false);
+  const [errorMessage, setErrorMessage] = useState<string | null>(null);
+
+  const baseUrl = getApiBaseUrl();
+  const vapidOk = options.vapidPublicKey.trim() !== '';
+
+  const clearError = useCallback(() => {
+    setErrorMessage(null);
+  }, []);
+
+  const enable = useCallback(
+    async (applyToDescendants: boolean) => {
+      if (!vapidOk) {
+        setErrorMessage(t('notificationVapidMissing'));
+        return;
+      }
+      setLoading(true);
+      setErrorMessage(null);
+      try {
+        if (typeof Notification === 'undefined') {
+          setErrorMessage(t('notificationEnableFailed'));
+          return;
+        }
+        const perm = await Notification.requestPermission();
+        if (perm !== 'granted') {
+          setErrorMessage(t('notificationEnableFailed'));
+          return;
+        }
+        const sub = await subscribeWithVapid(options.vapidPublicKey.trim());
+        const subBody = subscriptionBodyFromPushSubscription(sub);
+        const locale =
+          typeof navigator !== 'undefined' && navigator.language.trim() !== ''
+            ? navigator.language
+            : null;
+        const upsert = await webAuth.reqUpsertWebPushSubscription(
+          baseUrl,
+          { ...subBody, locale },
+          {}
+        );
+        if (!upsert.ok) {
+          setErrorMessage(t('notificationEnableFailed'));
+          return;
+        }
+        const patch = await webBuckets.reqPatchBucketNotificationPreference(
+          baseUrl,
+          options.bucketId,
+          { enabled: true, applyToDescendants },
+          undefined
+        );
+        if (!patch.ok) {
+          setErrorMessage(t('notificationEnableFailed'));
+          return;
+        }
+        setEnabled(true);
+      } catch {
+        setErrorMessage(t('notificationEnableFailed'));
+      } finally {
+        setLoading(false);
+      }
+    },
+    [baseUrl, options.bucketId, options.vapidPublicKey, t, vapidOk]
+  );
+
+  const disable = useCallback(
+    async (applyToDescendants: boolean) => {
+      setLoading(true);
+      setErrorMessage(null);
+      try {
+        const endpoint = await unsubscribeCurrentBrowserPush();
+        if (endpoint !== null) {
+          await deleteServerSubscriptionIfMatches(endpoint);
+        }
+        const patch = await webBuckets.reqPatchBucketNotificationPreference(
+          baseUrl,
+          options.bucketId,
+          { enabled: false, applyToDescendants },
+          undefined
+        );
+        if (!patch.ok) {
+          setErrorMessage(t('notificationDisableFailed'));
+          return;
+        }
+        setEnabled(false);
+      } catch {
+        setErrorMessage(t('notificationDisableFailed'));
+      } finally {
+        setLoading(false);
+      }
+    },
+    [baseUrl, options.bucketId, t]
+  );
+
+  return { enabled, loading, errorMessage, enable, disable, clearError, vapidOk };
+}
diff --git a/apps/web/src/app/error.tsx b/apps/web/src/app/error.tsx
new file mode 100644
index 00000000..f5c7dae6
--- /dev/null
+++ b/apps/web/src/app/error.tsx
@@ -0,0 +1,35 @@
+'use client';
+
+import { useTranslations } from 'next-intl';
+
+import { AppErrorBoundary } from '@metaboost/ui';
+
+type ErrorPageProps = {
+  error: Error & { digest?: string };
+  reset: () => void;
+};
+
+export default function Error({ error, reset }: ErrorPageProps) {
+  const t = useTranslations('errors');
+
+  return (
+    <AppErrorBoundary
+      error={error}
+      reset={reset}
+      onReload={() => {
+        window.location.reload();
+      }}
+      onGoHome={() => {
+        window.location.href = '/';
+      }}
+      strings={{
+        boundaryTitle: t('boundary_title'),
+        boundaryMessage: t('boundary_message'),
+        detailsDevelopmentOnly: t('details_development_only'),
+        tryAgain: t('try_again'),
+        reloadPage: t('reload_page'),
+        returnToHomePage: t('return_to_home_page'),
+      }}
+    />
+  );
+}
diff --git a/apps/web/src/app/global-error.tsx b/apps/web/src/app/global-error.tsx
new file mode 100644
index 00000000..dae7bd3e
--- /dev/null
+++ b/apps/web/src/app/global-error.tsx
@@ -0,0 +1,55 @@
+'use client';
+
+import { useCallback } from 'react';
+
+import '@fortawesome/fontawesome-free/css/all.min.css';
+import { extractErrorsStringsFromMessagesDefault, GlobalErrorBoundary } from '@metaboost/ui';
+
+import '../styles/globals.scss';
+
+const SETTINGS_COOKIE_NAME = 'web-settings';
+
+const DEFAULT_ERROR_STRINGS: Record<string, string> = {
+  global_title: 'Application error',
+  global_message: 'A critical error occurred. Please refresh the page.',
+  details_development_only: 'Error details (development only)',
+  try_again: 'Try again',
+  reload_page: 'Reload page',
+};
+
+type GlobalErrorProps = {
+  error: Error & { digest?: string };
+  reset: () => void;
+};
+
+export default function GlobalError({ error, reset }: GlobalErrorProps) {
+  const loadStrings = useCallback(async () => {
+    try {
+      const localeCookie =
+        document.cookie
+          .split('; ')
+          .find((row) => row.startsWith('NEXT_LOCALE='))
+          ?.split('=')[1] || 'en-US';
+
+      const messages = await import(`../../i18n/originals/${localeCookie}.json`);
+      return extractErrorsStringsFromMessagesDefault(messages.default);
+    } catch {
+      try {
+        const messages = await import('../../i18n/originals/en-US.json');
+        return extractErrorsStringsFromMessagesDefault(messages.default);
+      } catch {
+        return {};
+      }
+    }
+  }, []);
+
+  return (
+    <GlobalErrorBoundary
+      settingsCookieName={SETTINGS_COOKIE_NAME}
+      loadStrings={loadStrings}
+      defaultStrings={DEFAULT_ERROR_STRINGS}
+      error={error}
+      reset={reset}
+    />
+  );
+}
diff --git a/apps/web/src/components/useApplyToDescendantsModal.tsx b/apps/web/src/components/useApplyToDescendantsModal.tsx
new file mode 100644
index 00000000..0853c54c
--- /dev/null
+++ b/apps/web/src/components/useApplyToDescendantsModal.tsx
@@ -0,0 +1,81 @@
+'use client';
+
+import { useCallback, useRef, useState } from 'react';
+
+import { Button, Modal, ModalDialogContent, Text } from '@metaboost/ui';
+
+export type ApplyToDescendantsModalLabels = {
+  prompt: string;
+  thisBucketOnly: string;
+  allSubBuckets: string;
+};
+
+export function useApplyToDescendantsModal(options: {
+  loading: boolean;
+  labels: ApplyToDescendantsModalLabels;
+  onResolved: (enable: boolean, applyToDescendants: boolean) => Promise<void>;
+}) {
+  const [isOpen, setIsOpen] = useState(false);
+  const forEnableRef = useRef(true);
+
+  const openFor = useCallback((enable: boolean) => {
+    forEnableRef.current = enable;
+    setIsOpen(true);
+  }, []);
+
+  const open = useCallback(() => {
+    setIsOpen(true);
+  }, []);
+
+  const dismiss = useCallback(() => {
+    if (!options.loading) {
+      setIsOpen(false);
+    }
+  }, [options.loading]);
+
+  const confirm = useCallback(
+    async (applyToDescendants: boolean) => {
+      try {
+        await options.onResolved(forEnableRef.current, applyToDescendants);
+      } finally {
+        setIsOpen(false);
+      }
+    },
+    [options.onResolved]
+  );
+
+  const modal = isOpen ? (
+    <Modal withBackdrop backdropOpaque onClose={options.loading ? undefined : dismiss}>
+      <ModalDialogContent
+        actions={
+          <>
+            <Button
+              type="button"
+              variant="secondary"
+              disabled={options.loading}
+              onClick={() => {
+                void confirm(false);
+              }}
+            >
+              {options.labels.thisBucketOnly}
+            </Button>
+            <Button
+              type="button"
+              variant="primary"
+              loading={options.loading}
+              onClick={() => {
+                void confirm(true);
+              }}
+            >
+              {options.labels.allSubBuckets}
+            </Button>
+          </>
+        }
+      >
+        <Text as="p">{options.labels.prompt}</Text>
+      </ModalDialogContent>
+    </Modal>
+  ) : null;
+
+  return { openFor, open, dismiss, confirm, modal };
+}
diff --git a/apps/web/src/config/env.ts b/apps/web/src/config/env.ts
index a75443ea..7ad8aeb8 100644
--- a/apps/web/src/config/env.ts
+++ b/apps/web/src/config/env.ts
@@ -5,6 +5,8 @@
 
 import type { WebRuntimeConfigEnvKey } from './runtime-config';
 
+import { parseEnvBooleanToken } from '@metaboost/helpers';
+
 import { getRuntimeConfig } from './runtime-config-store';
 
 function env(key: WebRuntimeConfigEnvKey): string | undefined {
@@ -108,3 +110,32 @@ export function getDefaultLocaleEnv(): string | undefined {
 export function getSupportedLocalesEnv(): string | undefined {
   return env('NEXT_PUBLIC_SUPPORTED_LOCALES')?.trim();
 }
+
+/**
+ * VAPID public key for Web Push subscription (URL-safe base64). Optional when push is disabled.
+ * Prefers NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY, then legacy NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY.
+ */
+export function getWebPushVapidPublicKey(): string | undefined {
+  const primary = env('NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY')?.trim();
+  if (primary !== undefined && primary !== '') {
+    return primary;
+  }
+  const legacy = env('NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY')?.trim();
+  return legacy !== undefined && legacy !== '' ? legacy : undefined;
+}
+
+/**
+ * When false, hide Web Push UI (bucket bell). Unset or invalid token defaults to true.
+ * Uses NEXT_PUBLIC_WEBPUSH_ENABLED from runtime config / sidecar.
+ */
+export function getWebPushClientEnabled(): boolean {
+  const raw = env('NEXT_PUBLIC_WEBPUSH_ENABLED')?.trim();
+  if (raw === undefined || raw === '') {
+    return true;
+  }
+  const parsed = parseEnvBooleanToken(raw);
+  if (parsed === null) {
+    return true;
+  }
+  return parsed;
+}
diff --git a/apps/web/src/config/runtime-config.ts b/apps/web/src/config/runtime-config.ts
index 03b6f317..aed61a94 100644
--- a/apps/web/src/config/runtime-config.ts
+++ b/apps/web/src/config/runtime-config.ts
@@ -13,6 +13,9 @@ export type WebRuntimeConfigEnvKey =
   | 'NEXT_PUBLIC_WEB_BASE_URL'
   | 'NEXT_PUBLIC_DEFAULT_LOCALE'
   | 'NEXT_PUBLIC_SUPPORTED_LOCALES'
+  | 'NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY'
+  | 'NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY'
+  | 'NEXT_PUBLIC_WEBPUSH_ENABLED'
   | 'API_SERVER_BASE_URL';
 
 export interface WebRuntimeConfig {
diff --git a/apps/web/src/lib/buckets.ts b/apps/web/src/lib/buckets.ts
index b7de3683..95d5f8d8 100644
--- a/apps/web/src/lib/buckets.ts
+++ b/apps/web/src/lib/buckets.ts
@@ -4,6 +4,7 @@ import type {
   Bucket,
   BucketBlockedSender,
   BucketMessage,
+  BucketNotificationPreferenceResponse,
   BucketRoleItem,
   BucketSummaryData,
   BucketSummaryRangePreset,
@@ -11,19 +12,19 @@ import type {
 
 import { request, webBuckets } from '@metaboost/helpers-requests';
 
-import { getCookieHeader, getServerApiBaseUrl } from './server-request';
+import { getCookieHeader, getServerApiBaseUrl, withServerCookie } from './server-request';
 
 /**
  * Server-side: fetch a single bucket by id. Returns null if not found or response invalid.
  */
 export async function fetchBucket(id: string): Promise<{ bucket: Bucket | null }> {
-  const cookieHeader = await getCookieHeader();
-  const baseUrl = getServerApiBaseUrl();
-  const res = await webBuckets.reqFetchBucket(baseUrl, id, cookieHeader);
-  if (!res.ok || res.data === undefined) {
+  const { ok, data } = await withServerCookie((baseUrl, cookieHeader) =>
+    webBuckets.reqFetchBucket(baseUrl, id, cookieHeader)
+  );
+  if (!ok || data === undefined) {
     return { bucket: null };
   }
-  const bucket = res.data.bucket;
+  const bucket = data.bucket;
   if (bucket === undefined || typeof bucket?.id !== 'string') {
     return { bucket: null };
   }
@@ -50,28 +51,41 @@ export async function fetchBucketAncestry(bucket: Bucket): Promise<Bucket[]> {
  * Server-side: fetch child buckets for a bucket. Returns [] on error or invalid response.
  */
 export async function fetchChildBuckets(bucketId: string): Promise<Bucket[]> {
-  const cookieHeader = await getCookieHeader();
-  const baseUrl = getServerApiBaseUrl();
-  const res = await webBuckets.reqFetchChildBuckets(baseUrl, bucketId, cookieHeader);
-  if (!res.ok || res.data === undefined) {
+  const { ok, data } = await withServerCookie((baseUrl, cookieHeader) =>
+    webBuckets.reqFetchChildBuckets(baseUrl, bucketId, cookieHeader)
+  );
+  if (!ok || data === undefined) {
     return [];
   }
-  const data = res.data;
   return Array.isArray(data.buckets) ? data.buckets : [];
 }
 
+/**
+ * Server-side: current user's notification preference for a bucket. Null on error or unauthenticated.
+ */
+export async function fetchBucketNotificationPreference(
+  bucketId: string
+): Promise<BucketNotificationPreferenceResponse | null> {
+  const { ok, data } = await withServerCookie((baseUrl, cookieHeader) =>
+    webBuckets.reqFetchBucketNotificationPreference(baseUrl, bucketId, cookieHeader)
+  );
+  if (!ok || data === undefined) {
+    return null;
+  }
+  return data;
+}
+
 /**
  * Server-side: fetch messages for a bucket (authenticated). Returns [] on error or invalid response.
  * Uses first page only; for pagination use fetchMessagesPaginated.
  */
 export async function fetchMessages(bucketId: string): Promise<BucketMessage[]> {
-  const cookieHeader = await getCookieHeader();
-  const baseUrl = getServerApiBaseUrl();
-  const res = await webBuckets.reqFetchBucketMessages(baseUrl, bucketId, cookieHeader);
-  if (!res.ok || res.data === undefined) {
+  const { ok, data } = await withServerCookie((baseUrl, cookieHeader) =>
+    webBuckets.reqFetchBucketMessages(baseUrl, bucketId, cookieHeader)
+  );
+  if (!ok || data === undefined) {
     return [];
   }
-  const data = res.data;
   return Array.isArray(data.messages) ? data.messages : [];
 }
 
@@ -85,13 +99,13 @@ export async function fetchDashboardBucketSummary(query?: {
   baselineCurrency?: string;
   includeBlockedSenderMessages?: boolean;
 }): Promise<BucketSummaryData | null> {
-  const cookieHeader = await getCookieHeader();
-  const baseUrl = getServerApiBaseUrl();
-  const res = await webBuckets.reqFetchDashboardBucketSummary(baseUrl, cookieHeader, query);
-  if (!res.ok || res.data === undefined) {
+  const { ok, data } = await withServerCookie((baseUrl, cookieHeader) =>
+    webBuckets.reqFetchDashboardBucketSummary(baseUrl, cookieHeader, query)
+  );
+  if (!ok || data === undefined) {
     return null;
   }
-  return res.data;
+  return data;
 }
 
 /**
@@ -107,13 +121,13 @@ export async function fetchBucketSummary(
     includeBlockedSenderMessages?: boolean;
   }
 ): Promise<BucketSummaryData | null> {
-  const cookieHeader = await getCookieHeader();
-  const baseUrl = getServerApiBaseUrl();
-  const res = await webBuckets.reqFetchBucketSummary(baseUrl, bucketId, cookieHeader, query);
-  if (!res.ok || res.data === undefined) {
+  const { ok, data } = await withServerCookie((baseUrl, cookieHeader) =>
+    webBuckets.reqFetchBucketSummary(baseUrl, bucketId, cookieHeader, query)
+  );
+  if (!ok || data === undefined) {
     return null;
   }
-  return res.data;
+  return data;
 }
 
 export type FetchMessagesPaginatedResult = {
@@ -134,15 +148,15 @@ export async function fetchMessagesPaginated(
   sort?: 'recent' | 'oldest',
   includeBlockedSenderMessages?: boolean
 ): Promise<FetchMessagesPaginatedResult> {
-  const cookieHeader = await getCookieHeader();
-  const baseUrl = getServerApiBaseUrl();
-  const res = await webBuckets.reqFetchBucketMessages(baseUrl, bucketId, cookieHeader, {
-    page,
-    limit,
-    sort,
-    ...(includeBlockedSenderMessages === true ? { includeBlockedSenderMessages: true } : {}),
-  });
-  if (!res.ok || res.data === undefined) {
+  const { ok, data } = await withServerCookie((baseUrl, cookieHeader) =>
+    webBuckets.reqFetchBucketMessages(baseUrl, bucketId, cookieHeader, {
+      page,
+      limit,
+      sort,
+      ...(includeBlockedSenderMessages === true ? { includeBlockedSenderMessages: true } : {}),
+    })
+  );
+  if (!ok || data === undefined) {
     return {
       messages: [],
       page: 1,
@@ -151,7 +165,6 @@ export async function fetchMessagesPaginated(
       totalPages: 1,
     };
   }
-  const data = res.data;
   const messages = Array.isArray(data.messages) ? data.messages : [];
   return {
     messages,
@@ -249,25 +262,24 @@ export async function fetchPendingInvitations(
  * Server-side: fetch bucket roles (predefined + custom). Returns [] on error or invalid response.
  */
 export async function fetchBucketRoles(bucketId: string): Promise<BucketRoleItem[]> {
-  const cookieHeader = await getCookieHeader();
-  const baseUrl = getServerApiBaseUrl();
-  const res = await webBuckets.reqListBucketRoles(baseUrl, bucketId, cookieHeader);
-  if (!res.ok || res.data === undefined) {
+  const { ok, data } = await withServerCookie((baseUrl, cookieHeader) =>
+    webBuckets.reqListBucketRoles(baseUrl, bucketId, cookieHeader)
+  );
+  if (!ok || data === undefined) {
     return [];
   }
-  const data = res.data;
   return Array.isArray(data.roles) ? data.roles : [];
 }
 
 /** Server-side: blocked senders for the bucket tree (API resolves root). */
 export async function fetchBlockedSenders(bucketId: string): Promise<BucketBlockedSender[]> {
-  const cookieHeader = await getCookieHeader();
-  const baseUrl = getServerApiBaseUrl();
-  const res = await webBuckets.reqFetchBlockedSenders(baseUrl, bucketId, cookieHeader);
-  if (!res.ok || res.data === undefined) {
+  const { ok, data } = await withServerCookie((baseUrl, cookieHeader) =>
+    webBuckets.reqFetchBlockedSenders(baseUrl, bucketId, cookieHeader)
+  );
+  if (!ok || data === undefined) {
     return [];
   }
-  return Array.isArray(res.data.blockedSenders) ? res.data.blockedSenders : [];
+  return Array.isArray(data.blockedSenders) ? data.blockedSenders : [];
 }
 
 /** Server-side: blocked apps for the bucket tree (API resolves root). */
diff --git a/apps/web/src/lib/server-request.ts b/apps/web/src/lib/server-request.ts
index 65369486..abc8b146 100644
--- a/apps/web/src/lib/server-request.ts
+++ b/apps/web/src/lib/server-request.ts
@@ -1,4 +1,6 @@
 import 'server-only';
+import type { ApiResponse } from '@metaboost/helpers-requests';
+
 import { cookies } from 'next/headers';
 
 import { parseFilterColumns as parseSharedFilterColumns } from '@metaboost/helpers';
@@ -7,6 +9,21 @@ import { getServerApiBaseUrl } from '../config/env';
 
 export { getServerApiBaseUrl };
 
+/**
+ * Runs an authenticated server-side API call using the current request cookies and API base URL.
+ */
+export async function withServerCookie<T>(
+  call: (baseUrl: string, cookieHeader: string) => Promise<ApiResponse<T>>
+): Promise<{ ok: boolean; data: T | undefined }> {
+  const cookieHeader = await getCookieHeader();
+  const baseUrl = getServerApiBaseUrl();
+  const res = await call(baseUrl, cookieHeader);
+  if (!res.ok) {
+    return { ok: false, data: undefined };
+  }
+  return { ok: true, data: res.data };
+}
+
 /**
  * Builds a Cookie header string from the current request's cookies.
  * Use when making server-side API requests that should forward auth.
diff --git a/apps/web/src/lib/webPushBrowser.ts b/apps/web/src/lib/webPushBrowser.ts
new file mode 100644
index 00000000..411cf00c
--- /dev/null
+++ b/apps/web/src/lib/webPushBrowser.ts
@@ -0,0 +1,72 @@
+import { webAuth } from '@metaboost/helpers-requests';
+
+import { getApiBaseUrl } from '../config/env';
+
+const SW_SCRIPT = '/webpush-sw.js';
+
+/** Decode VAPID public key for PushManager.subscribe. */
+export function urlBase64ToUint8Array(base64String: string): BufferSource {
+  const padding = '='.repeat((4 - (base64String.length % 4)) % 4);
+  const base64 = (base64String + padding).replace(/-/g, '+').replace(/_/g, '/');
+  const rawData = globalThis.atob(base64);
+  const outputArray = new Uint8Array(rawData.length);
+  for (let i = 0; i < rawData.length; i += 1) {
+    outputArray[i] = rawData.charCodeAt(i);
+  }
+  return outputArray;
+}
+
+export async function registerWebPushServiceWorker(): Promise<ServiceWorkerRegistration> {
+  return navigator.serviceWorker.register(SW_SCRIPT);
+}
+
+export async function subscribeWithVapid(vapidPublicKey: string): Promise<PushSubscription> {
+  const registration = await registerWebPushServiceWorker();
+  await navigator.serviceWorker.ready;
+  const sub = await registration.pushManager.subscribe({
+    userVisibleOnly: true,
+    applicationServerKey: urlBase64ToUint8Array(vapidPublicKey),
+  });
+  return sub;
+}
+
+export function subscriptionBodyFromPushSubscription(sub: PushSubscription): {
+  endpoint: string;
+  keys: { p256dh: string; auth: string };
+} {
+  const j = sub.toJSON();
+  const endpoint = j.endpoint;
+  const keys = j.keys;
+  if (
+    endpoint === undefined ||
+    keys === undefined ||
+    typeof keys.p256dh !== 'string' ||
+    typeof keys.auth !== 'string'
+  ) {
+    throw new Error('Invalid PushSubscription JSON');
+  }
+  return { endpoint, keys: { p256dh: keys.p256dh, auth: keys.auth } };
+}
+
+export async function unsubscribeCurrentBrowserPush(): Promise<string | null> {
+  const reg = await navigator.serviceWorker.ready;
+  const sub = await reg.pushManager.getSubscription();
+  if (sub === null) {
+    return null;
+  }
+  const endpoint = sub.endpoint;
+  await sub.unsubscribe();
+  return endpoint;
+}
+
+export async function deleteServerSubscriptionIfMatches(endpoint: string): Promise<void> {
+  const baseUrl = getApiBaseUrl();
+  const list = await webAuth.reqListWebPushSubscriptions(baseUrl, {});
+  if (!list.ok || list.data === undefined) {
+    return;
+  }
+  const match = list.data.subscriptions.find((s) => s.endpoint === endpoint);
+  if (match !== undefined) {
+    await webAuth.reqDeleteWebPushSubscription(baseUrl, match.id, {});
+  }
+}
diff --git a/apps/web/src/test/vitest-setup.ts b/apps/web/src/test/vitest-setup.ts
index f369b943..6703243c 100644
--- a/apps/web/src/test/vitest-setup.ts
+++ b/apps/web/src/test/vitest-setup.ts
@@ -1,4 +1,4 @@
-import { vi } from 'vitest';
+import { beforeEach, vi } from 'vitest';
 
 vi.mock('server-only', () => ({}));
 
@@ -18,3 +18,29 @@ vi.mock('../config/runtime-config-store', () => ({
     },
   }),
 }));
+
+// jsdom does not implement PointerEvent; drag/pointer unit tests need a minimal polyfill.
+if (typeof globalThis.PointerEvent === 'undefined') {
+  class PointerEventPolyfill extends MouseEvent {
+    public readonly pointerId: number;
+    public readonly pointerType: string;
+
+    constructor(type: string, params: PointerEventInit = {}) {
+      super(type, params);
+      this.pointerId = params.pointerId ?? 0;
+      this.pointerType = params.pointerType ?? 'mouse';
+    }
+  }
+  globalThis.PointerEvent = PointerEventPolyfill as unknown as typeof PointerEvent;
+}
+
+// jsdom intentionally does not implement HTMLMediaElement.play/pause/load.
+// When real component code calls those methods during mount (before a
+// per-instance fake is installed), jsdom logs a "Not implemented" warning to
+// stderr. Stubbing at the prototype level here silences that noise across the
+// whole apps/web test suite.
+beforeEach(() => {
+  HTMLMediaElement.prototype.play = vi.fn().mockResolvedValue(undefined);
+  HTMLMediaElement.prototype.pause = vi.fn();
+  HTMLMediaElement.prototype.load = vi.fn();
+});
diff --git a/apps/web/vitest.config.ts b/apps/web/vitest.config.ts
index a4a6f3e4..b74300a5 100644
--- a/apps/web/vitest.config.ts
+++ b/apps/web/vitest.config.ts
@@ -1,14 +1,11 @@
+import react from '@vitejs/plugin-react';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
+  plugins: [react()],
   test: {
-    environment: 'node',
-    globals: false,
-    include: ['src/**/*.test.ts'],
+    environment: 'jsdom',
+    include: ['src/**/*.test.ts', 'src/**/*.test.tsx'],
     setupFiles: ['src/test/vitest-setup.ts'],
-    pool: 'forks',
-  },
-  resolve: {
-    extensions: ['.ts', '.tsx', '.js'],
   },
 });
diff --git a/docs/CURSOR-NIX-WITH-ENV.md b/docs/CURSOR-NIX-WITH-ENV.md
index d7445642..1e547d29 100644
--- a/docs/CURSOR-NIX-WITH-ENV.md
+++ b/docs/CURSOR-NIX-WITH-ENV.md
@@ -16,11 +16,11 @@ We run any command that needs the flake's tools **inside** the Nix dev shell via
 
 ### What's in this repo
 
-| Item                                                                                | Purpose                                                                                                                                  |
-| ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| [scripts/nix/with-env](../scripts/nix/with-env)                                     | Bash script that runs `nix develop <repo_root> -c "$@"`. Use it to run a single command with node, npm, and other flake tools on `PATH`. |
-| [.cursor/rules/nix-terminal-wrapper.mdc](../.cursor/rules/nix-terminal-wrapper.mdc) | Cursor rule (always applied) that tells the AI to use `./scripts/nix/with-env` for node/npm/npx and other flake tools.                   |
-| [AGENTS.md](../AGENTS.md)                                                           | Contains a short "Nix / terminal (agent sandbox)" section that points to the wrapper and the rule.                                       |
+| Item                                                                              | Purpose                                                                                                                                  |
+| --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| [scripts/nix/with-env](/scripts/nix/with-env)                                     | Bash script that runs `nix develop <repo_root> -c "$@"`. Use it to run a single command with node, npm, and other flake tools on `PATH`. |
+| [.cursor/rules/nix-terminal-wrapper.mdc](/.cursor/rules/nix-terminal-wrapper.mdc) | Cursor rule (always applied) that tells the AI to use `./scripts/nix/with-env` for node/npm/npx and other flake tools.                   |
+| [AGENTS.md](/AGENTS.md)                                                           | Contains a short "Nix / terminal (agent sandbox)" section that points to the wrapper and the rule.                                       |
 
 ### How to use it
 
diff --git a/docs/GITFLOW.md b/docs/GITFLOW.md
index 5da6bf07..dfb7f704 100644
--- a/docs/GITFLOW.md
+++ b/docs/GITFLOW.md
@@ -3,7 +3,7 @@
 ## Branch model
 
 - **Default branch:** `develop`. All PRs merge into `develop`; release or hotfix branches may target `main` when used.
-- **Feature branches:** Create from `develop` with `npm run start-feature` (or `./scripts/start-feature.sh`). The script creates branches named e.g. `feature/name`, `fix/name`, `chore/name`, `docs/name`, `hotfix/name`, or `release/name`.
+- **Feature branches:** Create from `develop` with `npm run start-feature` (or `./scripts/start-feature.sh`). The script creates branches named e.g. `feature/name`, `fix/name`, `chore/name`, `docs/name`, `hotfix/name`, `release/name`, or `llm/name` (LLM-only paths; see [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](development/llm/DOCS-DEVELOPMENT-LLM.md)).
 - **Staging and main (mirrors, no direct feature commits on those branches):** `staging` is the preprod line—fast-forward it from `develop`, then run **Publish (staging)**. When you are ready for production, fast-forward `main` from `staging` (not from `develop` in one hop); **Publish (main)** promotes existing staging images in GHCR to `X.Y.Z` / `:latest` without rebuilding. See [PUBLISH.md](PUBLISH.md).
 
 ## When CI runs
@@ -14,7 +14,30 @@ CI does **not** run on push to `develop` or `main`, and it does **not** run auto
 
 ## Validate job
 
-The job runs: checkout, Node 24, `npm ci`, `npm run build`, `npm run lint`, `npm run type-check`. No database migration step is run unless one is added later.
+The `validate` job in [`.github/workflows/ci.yml`](/.github/workflows/ci.yml) runs when a maintainer comments **`/test`** on a PR. It includes:
+
+1. Linear migration file validation and linear baseline 0003 verification
+2. DB init sync check (`make check_k8s_postgres_init_sync`) and bootstrap contract verification
+3. Runtime `CREATE EXTENSION` guard
+4. `npm ci` (with retry), `npm run build:packages`, `npm run lint`, `npm run build:apps`
+5. `npm run i18n:validate` and `npm run type-check`
+6. Test database setup (Postgres/Valkey service containers on ports **5632** / **6579**)
+
+Unit and E2E tests are **skipped in CI**; run locally before merge (see [AGENTS.md](/AGENTS.md)).
+
+## Other GitHub Actions workflows
+
+| Workflow                                                                                      | Trigger                        | Purpose                                                                                  |
+| --------------------------------------------------------------------------------------------- | ------------------------------ | ---------------------------------------------------------------------------------------- |
+| [complete-feature.yml](/.github/workflows/complete-feature.yml)                               | PR merged to `develop`         | Moves `.llm/history/active/<feature>/` to `.llm/history/completed/YYYY-MM/` when present |
+| [vulnerability-scanner.yml](/.github/workflows/vulnerability-scanner.yml)                     | Schedule (2× daily) + manual   | `npm audit --omit=dev`; may open security issues                                         |
+| [i18n.yml](/.github/workflows/i18n.yml)                                                       | Push to `develop` (i18n paths) | Sync and compile translations                                                            |
+| [publish-staging.yml](/.github/workflows/publish-staging.yml)                                 | Push to `staging`              | Build and push staging images                                                            |
+| [publish-main.yml](/.github/workflows/publish-main.yml)                                       | Push to `main`                 | Promote staging images to RTM tags                                                       |
+| [publish-metaboost-signing.yml](/.github/workflows/publish-metaboost-signing.yml)             | Tag / manual                   | Publish `metaboost-signing` to npm                                                       |
+| [metaboost-infra-alpha-contracts.yml](/.github/workflows/metaboost-infra-alpha-contracts.yml) | Manual / schedule              | GitOps pin contract checks                                                               |
+
+Workflow authoring: [.cursor/rules/github-actions-yaml.mdc](/.cursor/rules/github-actions-yaml.mdc).
 
 ## Repository setup
 
diff --git a/docs/PUBLISH.md b/docs/PUBLISH.md
index 23bdad4c..2cc7c079 100644
--- a/docs/PUBLISH.md
+++ b/docs/PUBLISH.md
@@ -2,15 +2,15 @@
 
 Two workflows cover release artifacts:
 
-1. [`.github/workflows/publish-staging.yml`](../.github/workflows/publish-staging.yml) (display name **“Publish (staging)”**) — runs on every push to **`staging`** (or `workflow_dispatch`).
-2. [`.github/workflows/publish-main.yml`](../.github/workflows/publish-main.yml) (display name **“Publish (main)”**) — runs on every push to **`main`**. It does **not** rebuild app images; it **promotes** existing `X.Y.Z-staging.N` images in GHCR to immutable **`X.Y.Z`** and floating **`:latest`**, then creates the **Git tag** and a **non-prerelease** GitHub Release.
+1. [`.github/workflows/publish-staging.yml`](/.github/workflows/publish-staging.yml) (display name **“Publish (staging)”**) — runs on every push to **`staging`** (or `workflow_dispatch`).
+2. [`.github/workflows/publish-main.yml`](/.github/workflows/publish-main.yml) (display name **“Publish (main)”**) — runs on every push to **`main`**. It does **not** rebuild app images; it **promotes** existing `X.Y.Z-staging.N` images in GHCR to immutable **`X.Y.Z`** and floating **`:latest`**, then creates the **Git tag** and a **non-prerelease** GitHub Release.
 
 | Git branch | What happens         | Immutable image / Git tag pattern       | Floating GHCR tag |
 | ---------- | -------------------- | --------------------------------------- | ----------------- |
 | `staging`  | Full build + push    | `X.Y.Z-staging.N` (N via Git ref API)   | `staging`         |
 | `main`     | Promote (crane copy) | `X.Y.Z` (from root `package.json` base) | `latest`          |
 
-**Changelog:** Both **staging** prereleases (`X.Y.Z-staging.N`) and **main** RTM releases (`X.Y.Z`) read release notes from [`docs/development/CHANGELOGS/X.Y.Z.md`](development/CHANGELOGS/). Bump the base version at the start of work with `scripts/publish/bump-version.sh` so the semver changelog file exists immediately, then update that file continuously as work lands.
+**GitHub Releases:** Staging prereleases and main production releases get a short auto-generated description. Maintain richer notes on GitHub when needed.
 
 **Promotion:** all product changes land on **`develop`**. **Order:** **`sync-develop-to-staging.sh`**, then (after a green **Publish (staging)**) **`sync-staging-to-main.sh`**. Do **not** update **`main` directly from `develop`**; **`main`** only advances from **`staging`**. There is no **`beta`** publish line.
 
@@ -40,7 +40,7 @@ Pre-release image tags use **`X.Y.Z-staging.N`** and a floating **`:staging`** s
 
 ## What the staging branch is for
 
-The **`staging`** branch is the preprod build line. Default development branch remains **`develop`**. When you fast-forward `staging` from `develop` (or run **Publish (staging)** via **Run workflow** on a chosen ref), the GitHub Action validates, reserves `X.Y.Z-staging.N`, builds images, pushes to GHCR, verifies tags, creates a matching **Git tag**, and creates/updates a **prerelease GitHub Release** from `docs/development/CHANGELOGS/X.Y.Z.md`.
+The **`staging`** branch is the preprod build line. Default development branch remains **`develop`**. When you fast-forward `staging` from `develop` (or run **Publish (staging)** via **Run workflow** on a chosen ref), the GitHub Action validates, reserves `X.Y.Z-staging.N`, builds images, pushes to GHCR, verifies tags, creates a matching **Git tag**, and creates/updates a **prerelease GitHub Release** with a short auto-generated description.
 
 No Kubernetes manifests are applied from this repo to remote clusters. Clusters consume image pins from your **GitOps** repository (e.g. Argo CD `Application` `targetRevision`, Kustomize `newTag`).
 
@@ -50,11 +50,11 @@ Step-by-step GitOps file list: [METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md](deve
 
 1. **Preprod (staging):** fast-forward **`staging` from `develop`**: `./scripts/publish/sync-develop-to-staging.sh` (or a PR with the same result). `staging` has no feature commits of its own; it is a **mirror of `develop`** at the preprod milestone.
 
-2. **Build workflow:** [`.github/workflows/publish-staging.yml`](../.github/workflows/publish-staging.yml) runs on push to **`staging`**, or use **Run workflow** on a chosen ref. Wait for **Publish (staging)** to succeed.
+2. **Build workflow:** [`.github/workflows/publish-staging.yml`](/.github/workflows/publish-staging.yml) runs on push to **`staging`**, or use **Run workflow** on a chosen ref. Wait for **Publish (staging)** to succeed.
 
 3. **Optional — manual run (staging):** GitHub: Actions → **Publish (staging)** → **Run workflow**. You can set **version_override** (e.g. `0.1.2-staging.99`) to skip the default atomic auto-increment and reserve a specific tag on the staging line.
 
-4. **RTM (main):** when the staging line is what you want in production, fast-forward **`main` from `staging`**: `./scripts/publish/sync-staging-to-main.sh` (or a PR with the same result; do not promote **`main` directly from `develop`**). This push triggers [`.github/workflows/publish-main.yml`](../.github/workflows/publish-main.yml) (promote to **`X.Y.Z` / `:latest`**, no app rebuild in that run). **`main` has no feature commits of its own**; it is a **mirror of `staging`** (and of `develop` at a later milestone).
+4. **RTM (main):** when the staging line is what you want in production, fast-forward **`main` from `staging`**: `./scripts/publish/sync-staging-to-main.sh` (or a PR with the same result; do not promote **`main` directly from `develop`**). This push triggers [`.github/workflows/publish-main.yml`](/.github/workflows/publish-main.yml) (promote to **`X.Y.Z` / `:latest`**, no app rebuild in that run). **`main` has no feature commits of its own**; it is a **mirror of `staging`** (and of `develop` at a later milestone).
 
 When bumping version via `scripts/publish/bump-version.sh`, the script regenerates the lockfile
 under Linux (Docker) before committing so CI gets the correct optional deps. If you add or change
@@ -89,7 +89,7 @@ The pipeline publishes **`-staging.N`** and **`:staging`** as described above. G
 
 ## Main workflow (promote)
 
-Pushes to **`main`** do not run a Docker build for these six app images. The job selects a single **`X.Y.Z-staging.M`** (minimum across images of each image’s max `N` for the `package.json` base on the commit), **crane**-copies each image to **`X.Y.Z`** and **`:latest`**, then creates Git tag **`X.Y.Z`** and a **non-prerelease** GitHub Release. See [`.github/workflows/publish-main.yml`](../.github/workflows/publish-main.yml).
+Pushes to **`main`** do not run a Docker build for these six app images. The job selects a single **`X.Y.Z-staging.M`** (minimum across images of each image’s max `N` for the `package.json` base on the commit), **crane**-copies each image to **`X.Y.Z`** and **`:latest`**, then creates Git tag **`X.Y.Z`** and a **non-prerelease** GitHub Release. See [`.github/workflows/publish-main.yml`](/.github/workflows/publish-main.yml).
 
 For `version_override` (staging) and for exact reserved tags, `422 Reference already exists` is accepted only when
 the existing tag already points to the workflow commit SHA. If the existing tag points to a
@@ -126,9 +126,9 @@ For private repos, authenticate to GHCR first (e.g.
 
 ## Workflow reference
 
-- **Staging (build + push):** [`.github/workflows/publish-staging.yml`](../.github/workflows/publish-staging.yml) — runs
+- **Staging (build + push):** [`.github/workflows/publish-staging.yml`](/.github/workflows/publish-staging.yml) — runs
   on push to `staging` or `workflow_dispatch`. Display name: **Publish (staging)**.
-- **Main (promote + RTM):** [`.github/workflows/publish-main.yml`](../.github/workflows/publish-main.yml).
+- **Main (promote + RTM):** [`.github/workflows/publish-main.yml`](/.github/workflows/publish-main.yml).
 
 ## Secrets and permissions
 
@@ -152,17 +152,16 @@ Image push uses `GITHUB_TOKEN` with `packages:write` in the publish job.
 ## Atomic version reservation (staging)
 
 The `reserve-version` job in
-[`.github/workflows/publish-staging.yml`](../.github/workflows/publish-staging.yml) is the source of
+[`.github/workflows/publish-staging.yml`](/.github/workflows/publish-staging.yml) is the source of
 truth for build versions on the **staging** line.
 
 - It reserves the version by creating a Git tag via `POST /git/refs` at the workflow commit SHA.
 - It retries on `422` until an unused `N` is reserved.
-- For exact-tag reservations via `version_override`, it accepts `422` only when the tag
-  already resolves to the same commit SHA.
+- For exact-tag reservations via `version_override`, the workflow fails if the tag already exists (`422`).
 - `git ls-remote --tags` is only a smart-start hint to skip obvious gaps quickly.
 
 This plan set is tracked at
-[.llm/plans/completed/atomic-publish-version-reservation/00-EXECUTION-ORDER.md](../.llm/plans/completed/atomic-publish-version-reservation/00-EXECUTION-ORDER.md) as historical context.
+[.llm/plans/completed/atomic-publish-version-reservation/00-EXECUTION-ORDER.md](/.llm/plans/completed/atomic-publish-version-reservation/00-EXECUTION-ORDER.md) as historical context.
 
 ## Deployment contract
 
diff --git a/docs/QUICK-START.md b/docs/QUICK-START.md
index 12698923..6dc55408 100644
--- a/docs/QUICK-START.md
+++ b/docs/QUICK-START.md
@@ -12,7 +12,8 @@ Shortest path from a fresh clone to a running local instance. Two options: **API
 
 ## LLM / editor guidance
 
-**`.cursor/`** and **`.cursorrules`** are the source of truth. **`.llm/exports/`** holds machine-generated copies for other tools (`npm run llm:exports:sync` / CI; do not hand-edit). Prefer those paths for non-Cursor editors, then the prompt in [docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md](development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md) if you still need a local step. Re-sync after `.cursor` changes or PRs/issues labeled **`llm`**. Policy and operators: [docs/development/llm/DOCS-DEVELOPMENT-LLM.md](development/llm/README.md), [docs/development/llm/GH-EXPORTS-SETUP.md](development/llm/GH-EXPORTS-SETUP.md).
+**`.cursor/`** and **`.cursorrules`** are the source of truth for AI assistants. See
+[docs/development/llm/DOCS-DEVELOPMENT-LLM.md](development/llm/DOCS-DEVELOPMENT-LLM.md).
 
 ## Path A: API and web on host (Postgres and Valkey in Docker)
 
@@ -126,5 +127,5 @@ To remove local .env files and recreate them from templates (e.g. to test a clea
 
 - **Env templates:** `infra/config/env-templates/`. Local overrides (gitignored):
   `infra/config/local/`. To remove all local .env files: `make local_env_remove` (prompts for Y).
-- **Single README:** Only the root [README.md](../README.md) is named README; other docs use
-  full-path names (e.g. [INFRA.md](../infra/INFRA.md), [INFRA-DOCKER-LOCAL.md](../infra/docker/local/INFRA-DOCKER-LOCAL.md)).
+- **Single README:** Only the root [README.md](/README.md) is named README; other docs use
+  full-path names (e.g. [INFRA.md](/infra/INFRA.md), [INFRA-DOCKER-LOCAL.md](/infra/docker/local/INFRA-DOCKER-LOCAL.md)).
diff --git a/docs/api/METABOOST-SIGNING-DISTRIBUTION.md b/docs/api/METABOOST-SIGNING-DISTRIBUTION.md
index 11776f50..f223f3b7 100644
--- a/docs/api/METABOOST-SIGNING-DISTRIBUTION.md
+++ b/docs/api/METABOOST-SIGNING-DISTRIBUTION.md
@@ -1,6 +1,6 @@
 # metaboost-signing — distribution and releases
 
-This document describes how the **`metaboost-signing`** npm package is published, versioned, and consumed. Implementation lives under [`packages/metaboost-signing/`](../../packages/metaboost-signing/).
+This document describes how the **`metaboost-signing`** npm package is published, versioned, and consumed. Implementation lives under [`packages/metaboost-signing/`](/packages/metaboost-signing).
 
 ## Install
 
@@ -12,7 +12,7 @@ npm install metaboost-signing
 
 The package is published to **`https://registry.npmjs.org`**. Use a normal semver range in `package.json` (for example `^0.2.1`).
 
-The library is released under the **MIT** license (see `LICENSE` in [`packages/metaboost-signing/`](../../packages/metaboost-signing/LICENSE)), distinct from the AGPL-licensed Metaboost monorepo as a whole.
+The library is released under the **MIT** license (see `LICENSE` in [`packages/metaboost-signing/`](/packages/metaboost-signing/LICENSE)), distinct from the AGPL-licensed Metaboost monorepo as a whole.
 
 ## Publishing (maintainers)
 
@@ -57,22 +57,21 @@ For **`metaboost-signing`**, semver applies to the **documented public exports**
 
 **Minor** releases: backward-compatible additions (new optional parameters, new exports).
 
-**Major** releases: breaking changes to any of the above (removed exports, changed required parameters, changed claim or header semantics). Consumers should read `CHANGELOG.md` in the package and plan upgrades.
+**Major** releases: breaking changes to any of the above (removed exports, changed required parameters, changed claim or header semantics). Consumers should follow GitHub tags (`metaboost-signing-v*`) and `npm view metaboost-signing versions`.
 
 ## Deprecation and breaking changes
 
-- Breaking changes ship only in **major** versions, with entries in **`packages/metaboost-signing/CHANGELOG.md`**.
-- Deprecated APIs (if any) will be documented in the changelog and may be removed in the next major version after a reasonable deprecation window when practical.
+- Breaking changes ship only in **major** versions; announce breaking API changes in the package README or GitHub release notes when practical.
+- Deprecated APIs (if any) may be documented in the README and removed in the next major version after a reasonable deprecation window when practical.
 
 ## Release process (maintainers)
 
 Semantic versioning:
 
 1. Update **`packages/metaboost-signing/package.json`** `version` (semver).
-2. Update **`packages/metaboost-signing/CHANGELOG.md`** with a dated section for that version.
-3. Commit and push to the default branch.
-4. Create an annotated git tag **`metaboost-signing-vX.Y.Z`** pointing at the commit that contains the version bump (tag must match the package version).
-5. Push the tag; the **Publish metaboost-signing** GitHub Actions workflow runs `npm publish` for that workspace.
+2. Commit and push to the default branch.
+3. Create an annotated git tag **`metaboost-signing-vX.Y.Z`** pointing at the commit that contains the version bump (tag must match the package version).
+4. Push the tag; the **Publish metaboost-signing** GitHub Actions workflow runs `npm publish` for that workspace.
 
 **Required secret:** `NPM_TOKEN` — an npm token with permission to publish **`metaboost-signing`** (repository **Settings → Secrets and variables → Actions**).
 
@@ -90,4 +89,4 @@ Commit the updated lockfile. This is the primary consumer rollback path.
 
 ## Rollback for publishers (npm)
 
-npm allows **`npm unpublish`** only under [strict conditions](https://docs.npmjs.com/policies/unpublish) (time window, download counts, etc.). Prefer **shipping a forward fix** (e.g. `X.Y.Z+1`) when unpublish is not available. Document incidents in the changelog when a version must not be used.
+npm allows **`npm unpublish`** only under [strict conditions](https://docs.npmjs.com/policies/unpublish) (time window, download counts, etc.). Prefer **shipping a forward fix** (e.g. `X.Y.Z+1`) when unpublish is not available. Document incidents in GitHub release notes or the package README when a version must not be used.
diff --git a/docs/api/STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md b/docs/api/STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md
index 35c1f666..47fc9996 100644
--- a/docs/api/STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md
+++ b/docs/api/STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md
@@ -176,8 +176,8 @@ async function postWithAssertionOnce(
 
 Monorepo files (used by `metaboost-signing` contract test):
 
-- [`packages/metaboost-signing/fixtures/consumer-example-post-body.json`](../../packages/metaboost-signing/fixtures/consumer-example-post-body.json)
-- [`packages/metaboost-signing/fixtures/consumer-example-meta.json`](../../packages/metaboost-signing/fixtures/consumer-example-meta.json)
+- [`packages/metaboost-signing/fixtures/consumer-example-post-body.json`](/packages/metaboost-signing/fixtures/consumer-example-post-body.json)
+- [`packages/metaboost-signing/fixtures/consumer-example-meta.json`](/packages/metaboost-signing/fixtures/consumer-example-meta.json)
 
 The **`bh`** in `consumer-example-meta.json` is the SHA-256 hex of the **exact** post-body file
 bytes. **`p`** is example **`/v1/standard/mbrss-v1/boost/exampleBucketId`**. **`m`** is **`POST`**.
@@ -186,4 +186,4 @@ bytes. **`p`** is example **`/v1/standard/mbrss-v1/boost/exampleBucketId`**. **`
 
 - [METABOOST-APP-INTEGRATOR-QUICKSTART.md](./METABOOST-APP-INTEGRATOR-QUICKSTART.md)
 - [METABOOST-SIGNING-DISTRIBUTION.md](./METABOOST-SIGNING-DISTRIBUTION.md)
-- Package README: [`packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md`](../../packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md)
+- Package README: [`packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md`](/packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md)
diff --git a/docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md b/docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md
index 49bf4ce6..d262387e 100644
--- a/docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md
+++ b/docs/api/STANDARD-ENDPOINT-INTEGRATION-GUIDE.md
@@ -28,7 +28,7 @@ repository.
    in [`FIRST-APP-SUBMISSION.md`](https://github.com/v4v-io/metaboost-registry/blob/main/docs/FIRST-APP-SUBMISSION.md).
 3. Open a PR; required CI (**`validate-registry`**) must pass before merge.
 4. After merge, Metaboost will pick up your **`app_id`** and **`signing_keys[]`** on its next registry
-   poll (see env **`STANDARD_ENDPOINT_REGISTRY_*`** in [ENV-REFERENCE.md](../development/ENV-REFERENCE.md)).
+   poll (see env **`STANDARD_ENDPOINT_REGISTRY_*`** in [ENV-REFERENCE.md](/docs/development/env/ENV-REFERENCE.md)).
 
 Until your app is **active** in the registry, signed requests may fail with **`app_not_registered`**
 or **`app_suspended`**.
@@ -211,7 +211,7 @@ When clients call unsigned capability pre-checks with `app_id`:
 
 Outside local development, Metaboost may require HTTPS (`STANDARD_ENDPOINT_REQUIRE_HTTPS`). Ensure
 clients use **`https://`**, and that reverse proxies set **`X-Forwarded-Proto`** correctly when
-**`STANDARD_ENDPOINT_TRUST_PROXY`** applies. See [ENV-REFERENCE.md](../development/ENV-REFERENCE.md).
+**`STANDARD_ENDPOINT_TRUST_PROXY`** applies. See [ENV-REFERENCE.md](/docs/development/env/ENV-REFERENCE.md).
 
 ## See also
 
@@ -221,4 +221,4 @@ clients use **`https://`**, and that reverse proxies set **`X-Forwarded-Proto`**
 - [STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md](./STANDARD-ENDPOINT-POST-ROLLOUT-VALIDATION-REPORT-TEMPLATE.md) — post-cutover validation report template
 - [STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md](./STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md) — backend copy-paste patterns and fixtures
 - [METABOOST-SIGNING-DISTRIBUTION.md](./METABOOST-SIGNING-DISTRIBUTION.md) — install and releases
-- Package README: [`packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md`](../../packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md)
+- Package README: [`packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md`](/packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md)
diff --git a/docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md b/docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md
index dbe8afa1..a27d8366 100644
--- a/docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md
+++ b/docs/api/STANDARD-ENDPOINT-ROLLOUT-RUNBOOK.md
@@ -21,7 +21,7 @@ phase fails.
 | **G0 — Phase 0 decision locks**           | Decision locks are written as concrete, approved values (env names, hard-enforce policy, route prefixes).                                                                                                                                                                                                        | Approved `00A-DECISION-LOCKS` (or successor) in the plan set; no open disputes on verifier policy. |
 | **G1 — Registry readiness**               | Schema and contributor docs are complete; **`validate-registry`** is a **required** GitHub Actions check on `metaboost-registry` PRs and is green on main.                                                                                                                                                       | Screenshot or CI URL; contributor can run validation locally per registry docs.                    |
 | **G2 — Signing helpers on public npm**    | Consumers may depend on **`metaboost-signing`** from the **public** registry; version is pinned in runbooks (see plan **10** / COPY-PASTA minimum semver, e.g. **0.2.1**).                                                                                                                                       | `npm view metaboost-signing version` from a clean environment; npmjs.com page reachable.           |
-| **G3 — Metaboost verification readiness** | Standard Endpoint `POST` requests require a valid AppAssertion where enforcement is enabled; verifier, registry poll, replay store, and HTTPS policy behave per [ENV-REFERENCE.md](../development/ENV-REFERENCE.md).                                                                                             | Integration tests green; staging smoke (section 3) passes.                                         |
+| **G3 — Metaboost verification readiness** | Standard Endpoint `POST` requests require a valid AppAssertion where enforcement is enabled; verifier, registry poll, replay store, and HTTPS policy behave per [ENV-REFERENCE.md](/docs/development/env/ENV-REFERENCE.md).                                                                                      | Integration tests green; staging smoke (section 3) passes.                                         |
 | **G4 — Developer docs and examples**      | [METABOOST-APP-INTEGRATOR-QUICKSTART.md](./METABOOST-APP-INTEGRATOR-QUICKSTART.md), [STANDARD-ENDPOINT-INTEGRATION-GUIDE.md](./STANDARD-ENDPOINT-INTEGRATION-GUIDE.md), and [STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md](./STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md) are current and linked from the app-signing spec. | Doc review checklist complete.                                                                     |
 
 **Ordering:** Gate **G2** (npm) must pass **before** downstream repos add a production dependency on
@@ -40,7 +40,7 @@ Use this matrix in **non-production** first; record results in the [post-rollout
 | **App record missing**                         | **403** with `app_not_registered` until registry is merged and Metaboost has polled.                                                                                                                             |
 | **App suspended**                              | **403** with `app_suspended`; no successful write.                                                                                                                                                               |
 | **HTTPS vs insecure (non-local)**              | When `STANDARD_ENDPOINT_REQUIRE_HTTPS` is enabled for the environment, plain **http** `POST` to `/v1/standard/*` is **rejected** (documented HTTPS error); **https** succeeds when assertion and body are valid. |
-| **Local dev**                                  | HTTPS requirement may be relaxed per env template; behavior matches [ENV-REFERENCE.md](../development/ENV-REFERENCE.md).                                                                                         |
+| **Local dev**                                  | HTTPS requirement may be relaxed per env template; behavior matches [ENV-REFERENCE.md](/docs/development/env/ENV-REFERENCE.md).                                                                                  |
 
 ## 3. End-to-end smoke checklist (non-production)
 
diff --git a/docs/development/CHANGELOGS/0.1.10.md b/docs/development/CHANGELOGS/0.1.10.md
deleted file mode 100644
index 4f882fbd..00000000
--- a/docs/development/CHANGELOGS/0.1.10.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Changelog 0.1.10
-
-_Update this file continuously during development for version 0.1.10._
-
-## Highlights
-
-- Migrate changelog process to semver-named files and version-first authoring.
diff --git a/docs/development/CHANGELOGS/0.1.11.md b/docs/development/CHANGELOGS/0.1.11.md
deleted file mode 100644
index d029b409..00000000
--- a/docs/development/CHANGELOGS/0.1.11.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Changelog 0.1.11
-
-_Update this file continuously during development for version 0.1.11._
-
-## Highlights
-
-- Add notable changes for this version.
diff --git a/docs/development/CHANGELOGS/0.1.12.md b/docs/development/CHANGELOGS/0.1.12.md
deleted file mode 100644
index 7a115cd0..00000000
--- a/docs/development/CHANGELOGS/0.1.12.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Changelog 0.1.12
-
-_Update this file continuously during development for version 0.1.12._
-
-## Highlights
-
-- Add notable changes for this version.
diff --git a/docs/development/CHANGELOGS/0.1.13.md b/docs/development/CHANGELOGS/0.1.13.md
deleted file mode 100644
index 9de20a4b..00000000
--- a/docs/development/CHANGELOGS/0.1.13.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Changelog 0.1.13
-
-_Update this file continuously during development for version 0.1.13._
-
-## Highlights
-
-- Add notable changes for this version.
diff --git a/docs/development/CHANGELOGS/0.1.14.md b/docs/development/CHANGELOGS/0.1.14.md
deleted file mode 100644
index 5529e0c8..00000000
--- a/docs/development/CHANGELOGS/0.1.14.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Changelog 0.1.14
-
-_Update this file continuously during development for version 0.1.14._
-
-## Highlights
-
-- Add notable changes for this version.
diff --git a/docs/development/CHANGELOGS/0.1.15.md b/docs/development/CHANGELOGS/0.1.15.md
deleted file mode 100644
index 8cdb9a8b..00000000
--- a/docs/development/CHANGELOGS/0.1.15.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Changelog 0.1.15
-
-_Update this file continuously during development for version 0.1.15._
-
-## Highlights
-
-- Add notable changes for this version.
diff --git a/docs/development/DB-MIGRATIONS.md b/docs/development/DB-MIGRATIONS.md
index 3894dfe1..b78d8b1f 100644
--- a/docs/development/DB-MIGRATIONS.md
+++ b/docs/development/DB-MIGRATIONS.md
@@ -72,16 +72,28 @@ Suspended CronJobs:
 
 - `metaboost-db-migrate-app`
 - `metaboost-db-migrate-management`
+- `metaboost-db-verify-bootstrap-contract`
+- `metaboost-db-rebootstrap-roles`
 - `metaboost-management-superuser-create`
 - `metaboost-management-superuser-update`
 
-Trigger one-off jobs during first deploy and any deploy that introduces new migration files.
+Trigger one-off jobs during first deploy and any deploy that introduces new migration files. After schema or role recovery, run verify-bootstrap-contract or rebootstrap-roles manually before app rollout.
 
 Example on-demand triggers:
 
 ```bash
 K8S_NAMESPACE=<namespace> npm run management:superuser:create:k8s
 K8S_NAMESPACE=<namespace> npm run management:superuser:update:k8s
+kubectl -n <namespace> create job --from=cronjob/metaboost-db-migrate-app metaboost-db-migrate-app-manual-$(date +%s)
+kubectl -n <namespace> create job --from=cronjob/metaboost-db-migrate-management metaboost-db-migrate-management-manual-$(date +%s)
+kubectl -n <namespace> create job --from=cronjob/metaboost-db-verify-bootstrap-contract metaboost-db-verify-bootstrap-contract-manual-$(date +%s)
+kubectl -n <namespace> create job --from=cronjob/metaboost-db-rebootstrap-roles metaboost-db-rebootstrap-roles-manual-$(date +%s)
+```
+
+Local bootstrap contract check (requires `infra/config/local/db.env` and running Postgres):
+
+```bash
+make db_verify_bootstrap_contract
 ```
 
 ## Staleness protection
diff --git a/docs/development/DEVELOPMENT.md b/docs/development/DEVELOPMENT.md
index 13001385..2f855605 100644
--- a/docs/development/DEVELOPMENT.md
+++ b/docs/development/DEVELOPMENT.md
@@ -6,7 +6,6 @@ Use this page as a quick map for development documentation.
 
 - [DB-MIGRATIONS.md](./DB-MIGRATIONS.md)
 - [TERMS-LIFECYCLE-RUNBOOK.md](./TERMS-LIFECYCLE-RUNBOOK.md)
-- [CHANGELOGS](./CHANGELOGS/)
 
 ## Topic folders
 
diff --git a/docs/development/NPM-AUDIT-ALLOWLIST.md b/docs/development/NPM-AUDIT-ALLOWLIST.md
index 33e7afc7..7fef42ef 100644
--- a/docs/development/NPM-AUDIT-ALLOWLIST.md
+++ b/docs/development/NPM-AUDIT-ALLOWLIST.md
@@ -2,9 +2,31 @@
 
 ## Overview
 
-The `scripts/publish/bump-version.sh` script can include a security allowlist for specific npm audit advisories that cannot be resolved through normal package upgrades or npm overrides. This document explains the pattern and when to use it.
+Release and promote scripts call [scripts/lib/check-audit-gate.sh](/scripts/lib/check-audit-gate.sh),
+which fails on **moderate and higher** npm audit findings unless an advisory ID allowlist is passed.
 
-## When to Add an Allowlist Entry
+**Current state (strict mode):** All publish scripts pass an **empty** allowlist (`""`). No advisory
+IDs are allowlisted. `bump-version.sh` and the `sync-*` promote scripts block on any disallowed
+moderate+ finding.
+
+Podverse allowlists advisory **1117015** (`postcss` nested under `next`) in the same scripts because
+root overrides do not replace `next`'s nested `node_modules/postcss@8.4.31`. Metaboost keeps strict
+mode until an advisory is investigated and documented here.
+
+## Strict mode rationale (2026-06 review)
+
+`bash scripts/lib/check-audit-gate.sh "" release` on the current lockfile:
+
+- **1117015 is not reported** — root `"postcss": "^8.5.10"` override appears sufficient for
+  Metaboost's lockfile layout (no Podverse-style nested postcss gap at review time).
+- **Release is still blocked** by other moderate+ advisories (for example `next`, `nodemailer`,
+  `typeorm`, `joi`, `qs`, `brace-expansion`, `ip-address`). Those require dependency upgrades or
+  targeted overrides — not silent allowlisting.
+
+Do **not** copy Podverse's `1117015` allowlist unless investigation confirms the same nested
+`postcss` chain and documents why upgrades or overrides cannot fix it.
+
+## When to add an allowlist entry
 
 An advisory should be allowlisted only when:
 
@@ -14,7 +36,16 @@ An advisory should be allowlisted only when:
 4. **Risk is acceptable:** The vulnerability is transitive-only and not directly exploitable in Metaboost's deployment model
 5. **Clear revisit path exists:** A specific upstream package version milestone will resolve it
 
-## How to Add an Entry
+Pass comma-separated npm advisory `source` IDs as the first argument to `check-audit-gate.sh` in:
+
+- [scripts/publish/bump-version.sh](/scripts/publish/bump-version.sh)
+- [scripts/publish/sync-develop-to-staging.sh](/scripts/publish/sync-develop-to-staging.sh)
+- [scripts/publish/sync-staging-to-main.sh](/scripts/publish/sync-staging-to-main.sh)
+- [scripts/publish/sync-develop-to-beta.sh](/scripts/publish/sync-develop-to-beta.sh)
+
+Keep all call sites **in sync**.
+
+## How to add an entry
 
 ### Step 1: Investigate (see `.cursor/skills/npm-audit/SKILL.md`)
 
@@ -28,54 +59,28 @@ Trace the dependency chain:
 npm ls <vulnerable-package> --all
 ```
 
-### Step 2: Document Why
+### Step 2: Document why
 
-Update this file with an entry like:
+Add a subsection under **Current allowlisted advisories** with chain, rationale, risk, and revisit triggers.
 
-```markdown
-### Advisory XXXXX: <vulnerability name>
+### Step 3: Update publish scripts
 
-**Affected chain:** pkg1 → pkg2 → pkg3 → vulnerable-pkg
-
-**Why it's allowlisted:**
-- Latest pkg3@X.Y still pins vulnerable-pkg@<14
-- Downgrading pkg1 causes regressions (list them)
-- Replacing pkg1 would require major refactor
-
-**Risk level:** Transitive-only; not directly exploitable because [reason].
-
-### When to revisit:
-- When pkg1 releases X+1.0.0 with upgraded dependencies
-- When pkg3 releases Y+1.0.0 that drops the vulnerable dep
-```
-
-### Step 3: Update bump-version.sh
-
-Add the advisory ID to `ALLOWED_AUDIT_IDS` in `scripts/publish/bump-version.sh`:
+Example (Podverse pattern for nested postcss — only if investigation confirms the same issue):
 
 ```bash
-ALLOWED_AUDIT_IDS="1113977,1116970"  # See docs/development/NPM-AUDIT-ALLOWLIST.md
+"$SCRIPT_DIR/../lib/check-audit-gate.sh" "1117015" "release"
 ```
 
-### Step 4: Update Root npm Overrides
+### Step 4: Update root npm overrides (if applicable)
 
-If applicable, add root-level overrides in `package.json`:
-
-```json
-{
-  "overrides": {
-    "uuid": "14.0.0",
-    "@tootallnate/once": "3.0.1"
-  }
-}
-```
+If applicable, add root-level overrides in `package.json` before allowlisting.
 
-## Current Allowlisted Advisories
+## Current allowlisted advisories
 
-(None currently. When an advisory needs to be allowlisted, add it here with full details.)
+(None. Strict mode — empty allowlist in all publish scripts.)
 
 ## References
 
 - npm docs: [Dependency overrides](https://docs.npmjs.com/cli/v10/configuring-npm/package-json#overrides)
-- `.cursor/skills/npm-audit/SKILL.md` — Full investigation procedures
-- `scripts/publish/bump-version.sh` — Implementation
+- `.cursor/skills/npm-audit/SKILL.md` — investigation procedures
+- Podverse reference: `docs/development/security/NPM-AUDIT-ALLOWLIST.md` (1117015 pattern)
diff --git a/docs/development/env/ENV-REFERENCE.md b/docs/development/env/ENV-REFERENCE.md
index 8f161106..50380318 100644
--- a/docs/development/env/ENV-REFERENCE.md
+++ b/docs/development/env/ENV-REFERENCE.md
@@ -83,7 +83,7 @@ This keeps local CLI (`localhost` sidecar URLs) and local Docker/K8s (service-DN
 
 ## `API_USER_AGENT` / `MANAGEMENT_API_USER_AGENT` (env groups `api`, `management-api`)
 
-Outbound HTTP User-Agent strings per app. **Required** at runtime; defaults live in the template/contract defaults. Format: **three slash-separated segments** (`BrandPart/Middle/Version`); the first segment must contain the substring **`Bot`**. Profile **`remote_k8s`** defaults use a production-style value and can be overridden through env overlays. Both keys are **`user_agent`** anchors (optional overrides in **`user-agent.env`**); [`scripts/local-env/setup.sh`](../../scripts/local-env/setup.sh) applies them to the API and management-api env files (see [LOCAL-ENV-OVERRIDES.md](LOCAL-ENV-OVERRIDES.md)).
+Outbound HTTP User-Agent strings per app. **Required** at runtime; defaults live in the template/contract defaults. Format: **three slash-separated segments** (`BrandPart/Middle/Version`); the first segment must contain the substring **`Bot`**. Profile **`remote_k8s`** defaults use a production-style value and can be overridden through env overlays. Both keys are **`user_agent`** anchors (optional overrides in **`user-agent.env`**); [`scripts/local-env/setup.sh`](/scripts/local-env/setup.sh) applies them to the API and management-api env files (see [LOCAL-ENV-OVERRIDES.md](LOCAL-ENV-OVERRIDES.md)).
 
 ## `API_MESSAGES_TERMS_OF_SERVICE_URL` (env group `api`)
 
@@ -135,7 +135,7 @@ HTTPS policy for **Standard Endpoint** routes (`/v1/standard/*`):
 - **`STANDARD_ENDPOINT_TRUST_PROXY`** — When **`true`**, the app trusts **`X-Forwarded-Proto`** (first comma-separated value) so TLS termination at Ingress or a load balancer is reflected in scheme checks. Profile **`remote_k8s`** sets **`STANDARD_ENDPOINT_REQUIRE_HTTPS`** and **`STANDARD_ENDPOINT_TRUST_PROXY`** to **`true`** so cluster deployments honor ingress TLS; **`local_docker`** and **`local_k8s`** set both to **`false`** for plain HTTP inside the stack.
 - **Unsafe combination** — Startup validation **fails** if **`STANDARD_ENDPOINT_TRUST_PROXY=true`** together with **`STANDARD_ENDPOINT_REQUIRE_HTTPS=false`** (explicit). That pairing would let clients spoof **`X-Forwarded-Proto: https`** on cleartext hops.
 
-See [REMOTE-K8S-GITOPS.md](../k8s/REMOTE-K8S-GITOPS.md) § Standard Endpoint (`/v1/standard/*`) HTTPS (app layer).
+See [REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md) § Standard Endpoint (`/v1/standard/*`) HTTPS (app layer).
 
 ## `API_CORS_ORIGINS` / `MANAGEMENT_API_CORS_ORIGINS` (env groups `api`, `management-api`)
 
@@ -203,13 +203,13 @@ Optional **`Set-Cookie` `Domain`** for session and refresh cookies. The main API
 
 ## Override metadata (optional, orthogonal to `kind`)
 
-Use these fields when a key participates in **`~/.config/metaboost/`** local override flows and fan-out in [`scripts/local-env/setup.sh`](../../scripts/local-env/setup.sh). Remote GitOps handling is maintained outside this repository.
+Use these fields when a key participates in **`~/.config/metaboost/`** local override flows and fan-out in [`scripts/local-env/setup.sh`](/scripts/local-env/setup.sh). Remote GitOps handling is maintained outside this repository.
 
 | Field           | Values                                                     | Meaning                                                                                                                                                                                                                                 |
 | --------------- | ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `override_file` | Logical name (non-empty ⇒ home-override anchor)            | Maps to one home override file; see table below. Presence alone marks the key as an anchor (do not set `override_role: anchor`).                                                                                                        |
 | `override_role` | `derived` or `none`                                        | `derived` = filled from another variable after overrides load (requires `derived_from`). `none` = explicit opt-out (must not combine with `override_file` or `derived_from`). **`anchor`** is invalid (redundant with `override_file`). |
-| `derived_from`  | Variable name (required when `override_role` is `derived`) | Documents fan-out in [`scripts/local-env/setup.sh`](../../scripts/local-env/setup.sh) when not expressed purely by env merge (rare). **`merge-env` ignores `derived_from`** and uses each key’s **`default`** only.                     |
+| `derived_from`  | Variable name (required when `override_role` is `derived`) | Documents fan-out in [`scripts/local-env/setup.sh`](/scripts/local-env/setup.sh) when not expressed purely by env merge (rare). **`merge-env` ignores `derived_from`** and uses each key’s **`default`** only.                          |
 
 ## `local_generator` (optional)
 
diff --git a/docs/development/env/LOCAL-ENV-OVERRIDES.md b/docs/development/env/LOCAL-ENV-OVERRIDES.md
index 89cf41cd..953cde49 100644
--- a/docs/development/env/LOCAL-ENV-OVERRIDES.md
+++ b/docs/development/env/LOCAL-ENV-OVERRIDES.md
@@ -5,15 +5,15 @@ For the full classified variable list with expected defaults and where each key
 **Secrets (API and management API JWT, DB, Valkey, etc.)** are auto-generated by `make local_env_setup` in
 `scripts/local-env/setup.sh` using a consistent local generation approach: hex for passwords
 (`generate_hex_32`), UUID for JWT (`generate_uuid`), and `first_non_empty_or_generate` to reuse
-existing values across runs. **Postgres env is a single merged file**: `infra/config/local/db.env` holds all **`db`** env group keys (single flat **`vars`** block in **`base.yaml`**), generated by `merge-env --profile local_docker --group db`. Docker Compose uses `--env-file infra/config/local/db.env` for the `postgres` service and for compose variable interpolation so role-based keys (`DB_APP_OWNER_USER` / `DB_APP_OWNER_PASSWORD` / `DB_APP_NAME`) can bridge to the official image’s `POSTGRES_*` vars. API and management-api each use **`AUTH_JWT_SECRET`** with independent values in their respective env files. `scripts/env-setup-secrets.sh` only sets host connection defaults (e.g. DB_HOST=localhost, ports).
-**Canonical contributor-facing templates/examples** live in `apps/*/.env.example`, `apps/*/sidecar/.env.example`, and `infra/config/env-templates/*.env.example`. **Working override files** consumed by setup and by K8s render live under `dev/env-overrides/local/*.env` (and `dev/env-overrides/alpha/*.env` after link). Those files are used for
+existing values across runs. **Postgres env is a single merged file**: `infra/config/local/db.env` holds all **`db`** env group keys (single flat **`vars`** block in **`base.yaml`**), generated by `merge-env --profile local_docker --group db`. Docker Compose uses `--env-file infra/config/local/db.env` for the `postgres` service and for compose variable interpolation so role-based keys (`DB_APP_OWNER_USER` / `DB_APP_OWNER_PASSWORD` / `DB_APP_NAME`) can bridge to the official image’s `POSTGRES_*` vars. API and management-api each use **`AUTH_JWT_SECRET`** with independent values in their respective env files. `scripts/env-setup-secrets.sh` only sets host connection defaults (e.g. DB*HOST=localhost, ports).
+**Canonical contributor-facing templates/examples** live in `apps/*/.env.example`, `apps/_/sidecar/.env.example`, and `infra/config/env-templates/_.env.example`. **Working override files** consumed by setup and by K8s render live under `dev/env-overrides/local/_.env`(and`dev/env-overrides/alpha/_.env` after link). Those files are used for
 customizable values: app/legal display names (**`info.env`**: **`WEB_BRAND_NAME`**, **`LEGAL_NAME`**, **`MANAGEMENT_WEB_BRAND_NAME`**), auth mode, locale
-(sensible defaults), and mailer (no defaults — bring your own SMTP; tests use mailpit). The
+(sensible defaults), mailer (no defaults — bring your own SMTP; tests use mailpit), and optional Web Push / VAPID (**`notifications.env`**: \*\*`WEBPUSH\*\*`** keys). The
 prepare/link/setup flow and home-directory layout are consistent across local workflows. **WEB_BASE_URL, WEB_URL**
 and CORS allowlists (**`API_CORS_ORIGINS`** on **`api.vars`**, **`MANAGEMENT_API_CORS_ORIGINS`** on **`management-api.vars`**, with local defaults aligned to **`http`** web URLs) stay in generated env (not in home overrides). Web and
-management-web app `.env.example` files contain only `RUNTIME_CONFIG_URL`; the full list is in the
-sidecar env templates (sidecar env templates under each app’s **`sidecar/`** directory when present). **Two outputs** — same workload groups, different merge profiles: **`infra/config/local/web-sidecar.env`** and **`infra/config/local/management-web-sidecar.env`** are **`merge-env --profile local_docker`** for Docker Compose only (internal **`API_SERVER_BASE_URL`** / **`MANAGEMENT_API_SERVER_BASE_URL`**). **`apps/web/sidecar/.env`** and **`apps/management-web/sidecar/.env`** are **`merge-env --profile dev`** (same host profile as **`apps/web/.env.local`** / **`apps/management-web/.env.local`**) for **`npm run dev:all`** and runtime-config sidecars; they are **not** copied from infra. Host processes load sidecar env via `DOTENV_CONFIG_PATH=sidecar/.env` (see `dev:sidecar` in each app’s `package.json`). `make
-local_env_clean` removes generated `sidecar/.env` files along with other generated app env files.
+management-web app `.env.example`files contain only`RUNTIME_CONFIG_URL`; the full list is in the
+sidecar env templates (sidecar env templates under each app’s **`sidecar/`** directory when present). **Two outputs** — same workload groups, different merge profiles: **`infra/config/local/web-sidecar.env`** and **`infra/config/local/management-web-sidecar.env`** are **`merge-env --profile local_docker`** for Docker Compose only (internal **`API_SERVER_BASE_URL`** / **`MANAGEMENT_API_SERVER_BASE_URL`**). **`apps/web/sidecar/.env`** and **`apps/management-web/sidecar/.env`** are **`merge-env --profile dev`** (same host profile as **`apps/web/.env.local`** / **`apps/management-web/.env.local`**) for **`npm run dev:all`** and runtime-config sidecars; they are **not** copied from infra. Host processes load sidecar env via `DOTENV_CONFIG_PATH=sidecar/.env`(see`dev:sidecar`in each app’s`package.json`). `make
+local_env_clean`removes generated`sidecar/.env` files along with other generated app env files.
 
 Sidecars validate env at startup: missing
 or invalid required vars exit non-zero; `GET /runtime-config` returns 500 with `missingKeys` if
@@ -23,7 +23,7 @@ required values are absent.
 
 1. **Setup** — Generate app and infra env files (secrets generated in setup.sh when empty, then
    host defaults set by env-setup-secrets.sh; overrides from info.env,
-   mailer.env, auth.env, and locale.env applied when present):
+   mailer.env, auth.env, locale.env, and notifications.env applied when present):
 
    ```bash
    make local_env_setup
@@ -39,7 +39,7 @@ Alternatively, run **`make local_setup`** once: it runs `local_env_setup` and `l
 order.
 
 **Prepare and link (optional):** To use a single set of overrides across work trees, run
-`make local_env_prepare` (seeds `~/.config/metaboost/local-env-overrides/*.env` from canonical `.env.example` defaults via [`prepare-local-env-overrides.sh`](../../scripts/local-env/prepare-local-env-overrides.sh) → [`prepare-home-env-overrides.sh`](../../scripts/env-overrides/prepare-home-env-overrides.sh)), edit those files, then `make local_env_link` and
+`make local_env_prepare` (seeds `~/.config/metaboost/local-env-overrides/*.env` from canonical `.env.example` defaults via [`prepare-local-env-overrides.sh`](/scripts/local-env/prepare-local-env-overrides.sh) → [`prepare-home-env-overrides.sh`](/scripts/env-overrides/prepare-home-env-overrides.sh)), edit those files, then `make local_env_link` and
 `make local_env_setup`.
 
 ## Maintainer verification commands
@@ -67,12 +67,13 @@ rg -n "legacy env source-of-truth|canonical variable names and defaults live in"
 
 ## Override files and which apps they affect
 
-| Override file | Apps / env files that receive its values                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| info.env      | **`WEB_BRAND_NAME`** (API transactional email + web UI via **`NEXT_PUBLIC_WEB_BRAND_NAME`** on web-sidecar), **`LEGAL_NAME`** (Terms first-sentence interpolation via **`NEXT_PUBLIC_LEGAL_NAME`**), **`MANAGEMENT_WEB_BRAND_NAME`** (management-web UI via **`NEXT_PUBLIC_MANAGEMENT_WEB_BRAND_NAME`** on management-web-sidecar). Do not set the **`NEXT_PUBLIC_*`** keys in overrides; **`merge-env`** / **`setup.sh`** sync them from the canonical keys. |
-| mailer.env    | API (**`MAILER_HOST`**, **`MAILER_PORT`**, **`MAILER_FROM`**, **`MAILER_USERNAME`**, **`MAILER_PASSWORD`**). Bring your own SMTP; local tests use Mailpit without auth.                                                                                                                                                                                                                                                                                       |
-| auth.env      | **`ACCOUNT_SIGNUP_MODE`** (env group **`auth`**): API, management-api, and web (**`NEXT_PUBLIC_ACCOUNT_SIGNUP_MODE`** via [`scripts/local-env/setup.sh`](../../scripts/local-env/setup.sh)). Sensible default in example (admin_only_username).                                                                                                                                                                                                               |
-| locale.env    | API, web, management-api, management-web including sidecars (DEFAULT_LOCALE, SUPPORTED_LOCALES). Single source—do not set in other override files. Example: en-US, all-available.                                                                                                                                                                                                                                                                             |
+| Override file     | Apps / env files that receive its values                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| info.env          | **`WEB_BRAND_NAME`** (API transactional email + web UI via **`NEXT_PUBLIC_WEB_BRAND_NAME`** on web-sidecar), **`LEGAL_NAME`** (Terms first-sentence interpolation via **`NEXT_PUBLIC_LEGAL_NAME`**), **`MANAGEMENT_WEB_BRAND_NAME`** (management-web UI via **`NEXT_PUBLIC_MANAGEMENT_WEB_BRAND_NAME`** on management-web-sidecar). Do not set the **`NEXT_PUBLIC_*`** keys in overrides; **`merge-env`** / **`setup.sh`** sync them from the canonical keys. |
+| mailer.env        | API (**`MAILER_HOST`**, **`MAILER_PORT`**, **`MAILER_FROM`**, **`MAILER_USERNAME`**, **`MAILER_PASSWORD`**). Bring your own SMTP; local tests use Mailpit without auth.                                                                                                                                                                                                                                                                                       |
+| auth.env          | **`ACCOUNT_SIGNUP_MODE`** (env group **`auth`**): API, management-api, and web (**`NEXT_PUBLIC_ACCOUNT_SIGNUP_MODE`** via [`scripts/local-env/setup.sh`](/scripts/local-env/setup.sh)). Sensible default in example (admin_only_username).                                                                                                                                                                                                                    |
+| locale.env        | API, web, management-api, management-web including sidecars (DEFAULT_LOCALE, SUPPORTED_LOCALES). Single source—do not set in other override files. Example: en-US, all-available.                                                                                                                                                                                                                                                                             |
+| notifications.env | Optional Web Push (VAPID): **`WEBPUSH_ENABLED`**, **`WEBPUSH_VAPID_PUBLIC_KEY`**, **`WEBPUSH_VAPID_PRIVATE_KEY`**, **`WEBPUSH_VAPID_SUBJECT`**. Consumed by **`scripts/local-env/setup.sh`**, which applies them to the API env files and mirrors the public key into web **`NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY`** / legacy **`NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY`** on web + sidecar outputs. See [WEB-PUSH-LOCAL.md](WEB-PUSH-LOCAL.md).               |
 
 ### Mailer: SMTP authentication (Brevo, SendGrid, Mailpit)
 
@@ -87,8 +88,9 @@ Override files live in:
 
 ## See also
 
-- [QUICK-START.md](../QUICK-START.md) – Full local setup.
-- [REMOTE-K8S-POSTGRES-REINIT.md](../k8s/REMOTE-K8S-POSTGRES-REINIT.md) – Postgres password drift on a **remote** cluster (when DB credentials changed but the PVC still has old data).
+- [WEB-PUSH-LOCAL.md](WEB-PUSH-LOCAL.md) — generate VAPID keys and wire Web Push locally.
+- [QUICK-START.md](/docs/QUICK-START.md) – Full local setup.
+- [REMOTE-K8S-POSTGRES-REINIT.md](/docs/development/k8s/REMOTE-K8S-POSTGRES-REINIT.md) – Postgres password drift on a **remote** cluster (when DB credentials changed but the PVC still has old data).
 - `make local_env_clean` – Removes generated env files under `infra/config/local/` and app
   `.env`/`.env.local` files, but keeps `dev/env-overrides/local/` (and symlinks if present) intact.
   Uses repo root so it works no matter which directory you run `make` from. Aborts if local Docker
diff --git a/docs/development/env/WEB-PUSH-LOCAL.md b/docs/development/env/WEB-PUSH-LOCAL.md
new file mode 100644
index 00000000..9c9001f1
--- /dev/null
+++ b/docs/development/env/WEB-PUSH-LOCAL.md
@@ -0,0 +1,33 @@
+# Web Push (VAPID) — local development
+
+## Generate keys
+
+From the Metaboost repository root:
+
+```bash
+bash scripts/development/generate-webpush-vapid-keys.sh
+```
+
+This runs `npm run webpush:generate-vapid-keys -w @metaboost/api` (the `web-push` CLI) and prints a **public** and **private** key pair.
+
+## Wire env
+
+1. **API** — set canonical variables (see `apps/api/.env.example`):
+   - `WEBPUSH_VAPID_PUBLIC_KEY` — paste the generated public key.
+   - `WEBPUSH_VAPID_PRIVATE_KEY` — paste the generated private key (secret).
+   - `WEBPUSH_VAPID_SUBJECT` — typically `mailto:you@example.com` or an `https:` contact URL (required by the web-push library).
+   - `WEBPUSH_ENABLED` — optional; set to `false` to disable outbound Web Push without removing keys.
+
+   Legacy names `API_WEB_PUSH_VAPID_PUBLIC_KEY`, `API_WEB_PUSH_VAPID_PRIVATE_KEY`, and `API_WEB_PUSH_VAPID_CONTACT` are still read if the `WEBPUSH_*` keys are unset.
+
+2. **Web runtime** — the browser needs the **same public** key via runtime config (sidecar):
+   - `NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY` (canonical), or legacy `NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY`.
+
+   Optional: `NEXT_PUBLIC_WEBPUSH_ENABLED=false` hides the bucket notification bell without changing API behavior.
+
+3. **Home overrides** — optional file `notifications.env` (see [LOCAL-ENV-OVERRIDES.md](LOCAL-ENV-OVERRIDES.md)) can hold `WEBPUSH_*` keys. After `make local_env_setup`, `scripts/local-env/setup.sh` copies them into the API app env and syncs the public key to web sidecar keys.
+
+## Verify
+
+- API starts without VAPID keys (push is simply skipped).
+- With keys set, subscribe from a bucket page and confirm the service worker receives pushes when new messages are sent (see deployment docs for HTTPS requirements).
diff --git a/docs/development/k8s/ARGOCD-GITOPS-METABOOST.md b/docs/development/k8s/ARGOCD-GITOPS-METABOOST.md
index d06f78c6..aa4602dc 100644
--- a/docs/development/k8s/ARGOCD-GITOPS-METABOOST.md
+++ b/docs/development/k8s/ARGOCD-GITOPS-METABOOST.md
@@ -14,6 +14,22 @@ Alpha root and child Argo CD Applications are first-class and live in this repos
 This model can be applied directly, or consumed from an external GitOps repository that tracks this
 repo path and revision.
 
+## Alpha `common` and product-membership ConfigMap
+
+The **`metaboost-alpha-common`** child app (`infra/k8s/alpha/apps/common.yaml`, sync-wave **-3**)
+renders `infra/k8s/alpha/common/`, which includes:
+
+- Namespace `metaboost-alpha`
+- Remote base `infra/k8s/base/product-membership` → ConfigMap **`metaboost-product-membership-config`**
+
+**`alpha/api`** and **`alpha/management-api`** overlays reference only their workload bases
+(`base/api`, `base/management-api`). They do **not** embed `product-membership` again; Deployments
+mount the shared ConfigMap via `envFrom.configMapRef` (see base Deployments).
+
+Sync **common** before (or with) api and management-api so the ConfigMap exists when pods start.
+External GitOps repos should mirror the same split: **`apps/metaboost-alpha/common`** owns
+product-membership; workload overlays only reference the ConfigMap name.
+
 ## Where production and environment orchestration lives
 
 For **remote** clusters, treat your **GitOps repository** as the source of truth for:
@@ -50,9 +66,9 @@ alpha model by pointing Argo CD at this repository's `infra/k8s/alpha-applicatio
 
 ## Related
 
-- [METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md](../release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md) — overlay files to bump after publish.
+- [METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md](/docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md) — overlay files to bump after publish.
 - [REMOTE-K8S-GITOPS.md](REMOTE-K8S-GITOPS.md) — full remote GitOps runbook (safety gate, secrets, render, Argo apply/sync, verification).
 - [GITOPS-CUTOVER-STAGING-CHECKLIST.md](GITOPS-CUTOVER-STAGING-CHECKLIST.md) — staging rollout steps.
 - [GITOPS-FUTURE-ENVIRONMENTS.md](GITOPS-FUTURE-ENVIRONMENTS.md) — **future** beta/prod GitOps and
   promotion notes (not implemented; for when that work is scheduled).
-- [infra/k8s/INFRA-K8S.md](../../../infra/k8s/INFRA-K8S.md) — layout of `base/` and `alpha/`.
+- [infra/k8s/INFRA-K8S.md](/infra/k8s/INFRA-K8S.md) — layout of `base/` and `alpha/`.
diff --git a/docs/development/k8s/K3D-ARGOCD-LOCAL.md b/docs/development/k8s/K3D-ARGOCD-LOCAL.md
index b036733d..5f50d06b 100644
--- a/docs/development/k8s/K3D-ARGOCD-LOCAL.md
+++ b/docs/development/k8s/K3D-ARGOCD-LOCAL.md
@@ -1,5 +1,5 @@
 # Local k3d (removed)
 
-The in-repo **k3d + local Argo CD** workflow has been removed. Use **Docker Compose** for local development ([QUICK-START.md](../../QUICK-START.md), [LOCAL-ENV-OVERRIDES.md](../env/LOCAL-ENV-OVERRIDES.md)) and a **remote cluster + GitOps** for Kubernetes validation ([REMOTE-K8S-GITOPS.md](REMOTE-K8S-GITOPS.md), [ARGOCD-GITOPS-METABOOST.md](ARGOCD-GITOPS-METABOOST.md)).
+The in-repo **k3d + local Argo CD** workflow has been removed. Use **Docker Compose** for local development ([QUICK-START.md](/docs/QUICK-START.md), [LOCAL-ENV-OVERRIDES.md](/docs/development/env/LOCAL-ENV-OVERRIDES.md)) and a **remote cluster + GitOps** for Kubernetes validation ([REMOTE-K8S-GITOPS.md](REMOTE-K8S-GITOPS.md), [ARGOCD-GITOPS-METABOOST.md](ARGOCD-GITOPS-METABOOST.md)).
 
 **Postgres password drift** on a remote cluster: see [REMOTE-K8S-POSTGRES-REINIT.md](REMOTE-K8S-POSTGRES-REINIT.md).
diff --git a/docs/development/k8s/REMOTE-K8S-GITOPS.md b/docs/development/k8s/REMOTE-K8S-GITOPS.md
index 2b80ca9b..79227799 100644
--- a/docs/development/k8s/REMOTE-K8S-GITOPS.md
+++ b/docs/development/k8s/REMOTE-K8S-GITOPS.md
@@ -9,7 +9,7 @@ run from that GitOps repository, not from this Metaboost source repository.
 
 This repository is the source for reusable base manifests under `infra/k8s/base/` and reference
 secret-generator scripts under
-[`infra/k8s/scripts/secret-generators/`](../../../infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md).
+[`infra/k8s/scripts/secret-generators/`](/infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md).
 
 ## Scope and model
 
@@ -58,7 +58,7 @@ The Metaboost **application** repo also ships **`infra/k8s/alpha/apps/`** (App o
 ## Health readiness semantics (Podverse comparison)
 
 - **Main API:** Readiness checks database and Valkey (same idea as Podverse main API checking DB + KeyVal).
-- **Management API:** Readiness checks management DB, app DB, **and Valkey** unless `skipValkeyReachabilityCheck` is enabled in [`apps/management-api/src/lib/health/registerHealthRoutes.ts`](../../../apps/management-api/src/lib/health/registerHealthRoutes.ts). **Podverse** management-api readiness checks **both databases only**—no KeyVal probe—and base manifests omit a KeyVal wait on that workload. Metaboost base manifests include `wait-valkey` before management migrations so kube readiness matches app semantics.
+- **Management API:** Readiness checks management DB, app DB, **and Valkey** unless `skipValkeyReachabilityCheck` is enabled in [`apps/management-api/src/lib/health/registerHealthRoutes.ts`](/apps/management-api/src/lib/health/registerHealthRoutes.ts). **Podverse** management-api readiness checks **both databases only**—no KeyVal probe—and base manifests omit a KeyVal wait on that workload. Metaboost base manifests include `wait-valkey` before management migrations so kube readiness matches app semantics.
 - **Probe timings:** Base `Deployment` `readinessProbe` / `livenessProbe` delays for `api` and `management-api` match Podverse base timings (`infra/k8s/base`) for similar rollout curves.
 
 ## Encrypted secrets (GitOps repository)
@@ -76,16 +76,16 @@ Required secret names expected by current Metaboost base manifests:
 - optional: `metaboost-mailer-opaque`
 
 Reference generator scripts live in this repository under
-[`infra/k8s/scripts/secret-generators/`](../../../infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md).
+[`infra/k8s/scripts/secret-generators/`](/infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md).
 Many operators keep synced copies under `metaboost.cc/scripts/secret-generators/` (or equivalent)
 and run them there so outputs land directly in that repo’s `./secrets/` tree.
 
 If your ingress uses cert-manager DNS01 with Cloudflare, use
-[`scripts/infra/sops/create_cloudflare_api_token_secret.sh`](../../../scripts/infra/sops/create_cloudflare_api_token_secret.sh)
+[`scripts/infra/sops/create_cloudflare_api_token_secret.sh`](/scripts/infra/sops/create_cloudflare_api_token_secret.sh)
 to generate `secrets/cloudflare-api-token-secret.enc.yaml` in your GitOps repository.
 
 If Argo CD must clone a **private GitHub** GitOps repository, generate a repository `Secret` with
-[`infra/k8s/scripts/secret-generators/create_argocd_github_repo_secret.sh`](../../../infra/k8s/scripts/secret-generators/create_argocd_github_repo_secret.sh) from your GitOps repo root (the same script may be vendored in the Podverse monorepo or operator GitOps checkouts for discoverability). Use the script’s default **`<slug>-repo-creds`** and **`./secrets/<slug>-argoc-repo.enc.yaml`** naming so Metaboost and other private GitOps URLs align; namespace **`argocd`** only.
+[`infra/k8s/scripts/secret-generators/create_argocd_github_repo_secret.sh`](/infra/k8s/scripts/secret-generators/create_argocd_github_repo_secret.sh) from your GitOps repo root (the same script may be vendored in the Podverse monorepo or operator GitOps checkouts for discoverability). Use the script’s default **`<slug>-repo-creds`** and **`./secrets/<slug>-argoc-repo.enc.yaml`** naming so Metaboost and other private GitOps URLs align; namespace **`argocd`** only.
 
 ## End-to-end command checklist
 
@@ -247,7 +247,7 @@ kubectl -n argocd get applications
 - [ARGOCD-GITOPS-METABOOST.md](ARGOCD-GITOPS-METABOOST.md)
 - [GITOPS-CUTOVER-STAGING-CHECKLIST.md](GITOPS-CUTOVER-STAGING-CHECKLIST.md)
 - [K8S-ENV-RENDER.md](K8S-ENV-RENDER.md)
-- [infra/k8s/INFRA-K8S.md](../../../infra/k8s/INFRA-K8S.md)
+- [infra/k8s/INFRA-K8S.md](/infra/k8s/INFRA-K8S.md)
 
 Environment-specific alpha details (example GitOps layout, hostnames, and scripts) are documented in
 `metaboost.cc/docs/k8s/metaboost-alpha/README.md`.
diff --git a/docs/development/llm/CURSOR-COPILOT-SYNC.md b/docs/development/llm/CURSOR-COPILOT-SYNC.md
deleted file mode 100644
index ca830f15..00000000
--- a/docs/development/llm/CURSOR-COPILOT-SYNC.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Cursor/Copilot sync (retired)
-
-This repository **no longer** maintains VS Code Copilot mirrors under `.github/` or npm scripts to sync Cursor configuration to those paths.
-
-**Current policy:** [README.md](README.md)
-
-**Non-Cursor editors:** [LLM-EDITOR-ALIGNMENT-PROMPT.md](LLM-EDITOR-ALIGNMENT-PROMPT.md)
diff --git a/docs/development/llm/DOCS-DEVELOPMENT-LLM.md b/docs/development/llm/DOCS-DEVELOPMENT-LLM.md
index 7a2d9cff..feee2eb4 100644
--- a/docs/development/llm/DOCS-DEVELOPMENT-LLM.md
+++ b/docs/development/llm/DOCS-DEVELOPMENT-LLM.md
@@ -1,44 +1,75 @@
-# LLM and AI editor configuration
+# LLM and Cursor configuration
 
-## Source of truth (what we commit)
+## Source of truth
 
-This repository’s **authoritative** AI guidance is:
+Authoritative AI guidance for this repository lives only in:
 
 - `.cursor/skills/**` — one `SKILL.md` per directory
 - `.cursor/rules/**` — Cursor rules (`.mdc`)
+- `.cursor/prompts/**` — reusable agent-facing prompt snippets
+- `.cursor/hooks/**` and `.cursor/hooks.json` — optional Cursor project hooks (when used)
 - `.cursorrules` — root-level rules
+- `.cursorignore` — path-level ignores for Cursor
 
-[`.llm/exports/`](../../.llm/exports/) holds **machine-generated** per-target trees (`github-copilot`, `opencode`, etc.). The **`llm-exports-sync`** GitHub Action (**LLM exports sync**) is the **only normal producer**: it runs on pushes to **develop** (or manual dispatch) and updates branch **`llm`** and its PR into **`develop`**. Pull requests that change `.cursor` or export scripts are **not** required to pre-commit a matching export tree; merge to **develop** triggers the sync, then review/merge the rolling **`llm`** → **`develop`** PR when you want the mirrors updated. The separate **`llm-exports-full-sync`** Action (**LLM exports full**) is **on-demand** only: full regen (removes orphans under each target’s generated subtrees) and a PR on **`llm-full`**. For catch-up after large renames, run **LLM exports full** from the Actions tab.
+Cursor reads these paths directly after `git pull`. There is no separate generated mirror tree in the repo.
 
-**Local runs:** the export script **does not write** to `.llm/exports` outside GitHub Actions unless you set `LLM_EXPORT_ALLOW_LOCAL=1` (intended for **editing and testing** [scripts/llm/](../../../scripts/llm/) only). The npm scripts are `llm:exports:sync` (incremental) and `llm:exports:sync:full` (full). Example: `LLM_EXPORT_ALLOW_LOCAL=1 npm run llm:exports:sync`. For normal work on skills and rules, **do not** set this; commit `.cursor` changes and let the **`llm`** automation PR update exports.
+**`.llm/` is not abcmemory.** It is a planning workspace (plans, optional history, templates, context). **abcremember** writes to `.cursor/` by default, not `.llm/`, unless you explicitly say otherwise. See [.llm/LLM.md](/.llm/LLM.md).
 
-**Spurious `git` changes under `.llm/exports`:** if tracked export files show as modified (for example after an old local sync or tooling), run `npm run llm:exports:restore` to match the last commit, or `git restore .llm/exports` yourself.
+## What to commit
 
-The generated files remain **`.gitignore`d**; **`.llm/exports/`** is in **`.cursorignore`**. The workflow stages them with `git add -A -f` on the runner. The pre-commit hook can prompt if you try to add ignored export paths. See [`.llm/exports/LLM-EXPORTS.md`](../../.llm/exports/LLM-EXPORTS.md) and [EXPORT-TARGETS.md](EXPORT-TARGETS.md).
+When you add or change skills, rules, prompts, hooks, or root Cursor config:
 
-## Who should read this
+1. Edit files under `.cursor/`, `.cursorrules`, or `.cursorignore`.
+2. Commit and push **only** those source paths in your PR.
 
-- **Cursor users:** The paths above are what you get from `git pull`; no extra step.
-- **Other LLM tools or IDEs** that expect their own project-level instructions: use the alignment prompt on first clone and after `.cursor` changes (see below).
+Do not duplicate guidance under `.github/` or other ad-hoc trees. See the **llm-cursor-source** skill
+(`.cursor/skills/llm-cursor-source/SKILL.md`) and rule (`.cursor/rules/llm-cursor-source.mdc`).
 
-## Exports + GitHub (operators)
+## Branch naming
 
-- [GH-EXPORTS-SETUP.md](GH-EXPORTS-SETUP.md) — `gh` commands and notes for **Podverse and Metaboost** (labels, optional secrets, running workflows).
+Use an **`llm/<kebab-name>`** branch when the PR changes **only** LLM-related paths:
 
-## Non-Cursor editors: alignment prompt
+- **abcmemory:** `.cursor/**`, `.cursorrules`, `.cursorignore`
+- **Contributor LLM docs:** `docs/development/llm/**`, relevant LLM sections of `AGENTS.md`
+- **Planning workspace:** `.llm/**` (plans, templates, context, optional history)
 
-Use the checked-in **`.llm/exports/...`** trees when your editor can read from a repo path. If you still need a one-off local conversion, run this **first** when setting up, and **again** after you pull work that changes `.cursor` or `.cursorrules` (or when you see PRs and issues labeled **`llm`**):
+Product or app changes belong on `feature/`, `fix/`, `chore/`, or other standard prefixes — not `llm/`.
 
-- [LLM-EDITOR-ALIGNMENT-PROMPT.md](LLM-EDITOR-ALIGNMENT-PROMPT.md)
+Create a branch with `npm run start-feature` (choose **llm** in the type menu) or manually:
 
-That prompt asks your tool to create or refresh local config from the repo’s `.cursor` content, add ignore rules for any generated paths, and stay aligned over time.
+```bash
+git checkout -b llm/your-description develop
+```
 
-## GitHub: `llm` label
+Local pre-push hooks enforce allowed prefixes; see [BRANCH-PROTECTION.md](/docs/repo-management/BRANCH-PROTECTION.md).
 
-Pull requests that touch `.cursor/**` or `.cursorrules` are labeled **`llm`** so it is easy to see when shared AI guidance changed. For **issues** about the same, add the `llm` label when you file or triage the ticket (the PR labeler only runs on pull requests).
+## Plans and optional history
 
-## History
+- **Plans:** active work under `.llm/plans/active/`; completed sets under `.llm/plans/completed/`.
+  Keep individual plan files under 300 lines. When you finish a plan set, move files per
+  **plan-execution-completion-tracking** rule and `.cursor/skills/plan-files-convention/SKILL.md`
+  (Podverse documents the same lifecycle in **plan-completion** skill).
+- **History (optional):** some teams keep notes under `.llm/history/active/<feature>/`. That is not
+  required for contributing. A retired human-only workflow description is in
+  [LLM-HISTORY-WORKFLOW-ARCHIVE.md](LLM-HISTORY-WORKFLOW-ARCHIVE.md) (listed in `.cursorignore` so
+  Cursor does not treat it as agent instructions).
+- **Layout overview:** [.llm/LLM.md](/.llm/LLM.md).
 
-- The old “Cursor to Copilot sync” flow is retired. See [CURSOR-COPILOT-SYNC.md](CURSOR-COPILOT-SYNC.md) for a one-line pointer.
+When a PR merges to `develop`, `.github/workflows/complete-feature.yml` may detect a matching
+folder under `.llm/history/active/<feature-name>/` (derived from the branch name), set completion
+metadata, move it under `.llm/history/completed/YYYY-MM/`, and push. Requires GitHub App secrets —
+see [GITHUB-SETUP.md](/docs/repo-management/GITHUB-SETUP.md). If no folder exists, the job no-ops.
+Plan-set moves under `.llm/plans/` remain manual per **plan-execution-completion-tracking** rule.
 
-Local vendor setup is opt-in via `npm run llm:vendors` (default active vendor: `cursor`).
+## What we removed
+
+Do **not** add or recreate `.llm/exports/` or CI that published multi-editor mirrors. That path is prohibited — not merely retired. Cursor-only source under `.cursor/` is the policy going forward.
+
+## Related
+
+- Cross-tree markdown links use repo-root paths (leading `/`); see
+  [documentation-conventions](/.cursor/skills/documentation-conventions/SKILL.md).
+- [AGENTS.md](/AGENTS.md) — AI development guide for the monorepo
+- [.llm/LLM.md](/.llm/LLM.md) — `.llm/` directory layout
+- [complete-feature.yml](/.github/workflows/complete-feature.yml) — optional history archival on merge to `develop`
+- [LLM-HISTORY-WORKFLOW-ARCHIVE.md](LLM-HISTORY-WORKFLOW-ARCHIVE.md) — optional archived human workflow
diff --git a/docs/development/llm/EXPORT-TARGETS.md b/docs/development/llm/EXPORT-TARGETS.md
deleted file mode 100644
index 8a3a57b5..00000000
--- a/docs/development/llm/EXPORT-TARGETS.md
+++ /dev/null
@@ -1,44 +0,0 @@
-# LLM export targets (contracts)
-
-**Source of truth in git:** `.cursor/skills/`, `.cursor/rules/`, `.cursorrules`, and (for ignore semantics) **`.cursorignore`**.
-
-**Generated mirrors:** under `.llm/exports/<target-id>/` with a marker file (`.gitkeep` or `.export-target`). The sync script is allowlisted in `scripts/llm/allowed-targets.mjs` and registered by directory discovery.
-
-**Incremental `sync`:** overwrites files produced from current `.cursor` content. **Orphan** files (leftover after a skill or rule is deleted or renamed in `.cursor`) remain until you run `sync --full` or the **LLM exports full** workflow, which deletes each target’s generated `skills/`, `instructions/`, and that target’s root instruction file, then regenerates.
-
----
-
-## `github-copilot`
-
-- **Role:** Single mirror for **GitHub Copilot** and **VS Code with the Copilot extension** — one tree, not a separate `vscode` export. The name reflects the on-disk layout and usual mapping to [`.github/`](https://docs.github.com/copilot), not a different product from “Copilot in VS Code.”
-- **Inputs:** `.cursor/skills/**/SKILL.md`, `.cursor/rules/*.mdc`, `.cursorrules`.
-- **Output (under `.llm/exports/github-copilot/`):**
-  - `skills/<name>/SKILL.md` — normalized YAML frontmatter (`name` / `description`) for tool consumption.
-  - `instructions/<rule-stem>.instructions.md` — from each `.mdc` rule; frontmatter remapped to `description` + `applyTo` where applicable.
-  - `copilot-instructions.md` — from `.cursorrules` (wrapped in HTML comment headers).
-- **Path rewrites:** After generation, in-tree references to `.cursor/skills/`, `.cursor/rules/…`, and `.cursor/rules/` are rewritten to point at this export’s `skills/` and `instructions/`.
-- **`.cursorignore`:** Not copied into the export. Tools should respect the repository root [`.cursorignore`](../../../.cursorignore) for Cursor-originated ignore rules; those paths are Cursor-centric and are **non-destructive** for other IDEs. Some teams map this tree into a local `.github` layout; that is **out of tree** in this repo — the canonical export for CI is under [`.llm/exports/`](../../../.llm/exports/); see [`.llm/exports/LLM-EXPORTS.md`](../../../.llm/exports/LLM-EXPORTS.md).
-
----
-
-## `opencode`
-
-- **References:** [OpenCode skills](https://open-code.ai/docs/en/skills) describe project skills under **`.opencode/skills/<skillname>/SKILL.md`** and optional global config. [OpenCode config](https://open-code.ai/docs/en/config) uses `opencode.json` (project, user, organization precedence). The `/init` style flow can produce **`AGENTS.md`** for project context.
-- **This repo’s export:** We emit the **same portable mirror** as `github-copilot` under **`.llm/exports/opencode/`** (skills, instructions, **`opencode-instructions.md`** from `.cursorrules`) so one pipeline serves every target. That keeps CI and `sync --full` simple.
-- **Adoption for native OpenCode layout:** Copy or symlink `skills` → **`.opencode/skills`**, and align instruction files with your `opencode.json` / `AGENTS.md` workflow, or use the editor alignment prompt. This remains a **human or tool-specific** step, like the `github-copilot` → `.github/` mapping.
-- **`.cursorignore`:** Same as other targets; OpenCode has its own tool/indexing ignore options — do not assume `.cursorignore` is read the same as in Cursor; keep root `.cursorignore` for shared human intent and adjust OpenCode config as needed.
-
----
-
-## Future IDEs
-
-Add a row here, add `target-id` to `ALLOWED_TARGET_IDS`, a marker under `.llm/exports/<id>/`, `.gitignore` lines for generated paths, and an adapter in `scripts/llm/lib/` wired in `export-from-cursor.mjs`. Local `sync` requires `LLM_EXPORT_ALLOW_LOCAL=1` (see [README.md](README.md)); CI and GitHub Actions are ungated.
-
----
-
-## Cross-target: `.cursorignore` mapping (conceptual)
-
-| Artifact                   | Role                                                                                                                                                                                            |
-| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Repository `.cursorignore` | Defines what Cursor (and some agents) should not index; remains the **committed** source for those patterns.                                                                                    |
-| Export targets             | We do not emit a second ignore file in v1; documentation above applies. If a future target requires a derived ignore file, add a subsection under that target and teach the adapter explicitly. |
diff --git a/docs/development/llm/GH-EXPORTS-SETUP.md b/docs/development/llm/GH-EXPORTS-SETUP.md
deleted file mode 100644
index 4988970f..00000000
--- a/docs/development/llm/GH-EXPORTS-SETUP.md
+++ /dev/null
@@ -1,50 +0,0 @@
-# GitHub configuration for LLM exports (Podverse and Metaboost)
-
-Use the same steps in **each** repository so behavior stays aligned.
-
-## Labels
-
-**GitHub caps label descriptions at 100 characters** (API 422 if longer). The strings in `scripts/github/setup-all-labels.sh` must stay within that, including the `llm` entry.
-
-Ensure the shared `llm` label exists (used for PRs that touch `.cursor` or guidance):
-
-```bash
-gh auth login
-cd /path/to/podverse   # or metaboost
-./scripts/github/setup-all-labels.sh
-```
-
-Or one-off: `gh label create llm --color 6E5499 --description "AI editor guidance (.cursor / exports)" 2>/dev/null || true`
-
-## Secrets (optional, not used by default)
-
-The export pipeline is **deterministic** and does **not** require API keys. If you later add a disabled `llm-exports-optional-cloud-llm` job, set a secret only after review:
-
-```bash
-gh secret set LLM_EXPORTS_API_KEY --repo owner/repo
-```
-
-## Workflows
-
-- **LLM exports sync** (`llm-exports-sync.yml`) — runs on changes to `.cursor` / `scripts/llm` and via **workflow dispatch**. Incremental `sync` (overwrites; does not remove orphan files under a target). Updates branch `llm` and one rolling PR into `develop`.
-- **LLM exports full** (`llm-exports-full-sync.yml`) — **workflow dispatch only**. Runs `sync --full` to wipe and regenerate each enabled export target (removes stale files). Updates branch `llm-full` and one rolling PR into `develop`. Use for catch-up after renames or when mirrors drift.
-
-List and run workflows:
-
-```bash
-gh workflow list
-gh workflow run "LLM exports sync" --ref develop
-gh workflow run "LLM exports full" --ref develop
-gh run list --workflow "LLM exports sync" --limit 5
-gh run list --workflow "LLM exports full" --limit 5
-```
-
-## Branch protection (optional)
-
-If `develop` uses required checks, add the **LLM exports sync** / **verify** job to the list after the workflow exists on the default branch. **LLM exports full** is dispatch-only and is not a default PR gate. Configure via the GitHub **Settings → Rules → Rulesets** (or **Branches**), or with `gh api` if your org automates policy.
-
-## Related docs
-
-- [README.md](README.md) — source of truth and hand-edit policy
-- [EXPORT-TARGETS.md](EXPORT-TARGETS.md) — per-target input/output and adoption notes
-- [`.llm/exports/LLM-EXPORTS.md`](../../.llm/exports/LLM-EXPORTS.md) — opt-in export targets and `github-copilot` layout
diff --git a/docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md b/docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md
deleted file mode 100644
index 2062008f..00000000
--- a/docs/development/llm/LLM-EDITOR-ALIGNMENT-PROMPT.md
+++ /dev/null
@@ -1,26 +0,0 @@
-# Alignment prompt (non-Cursor LLM / editor)
-
-Copy everything in the fenced block below into your LLM chat **after** opening this repository in your workspace. Run it on first setup and **again** whenever `.cursor` or `.cursorrules` changes on `main` (or when you merge/pull such changes).
-
-```text
-You are helping me align my local AI/editor configuration with this repository.
-
-## Source of truth (read-only in git)
-
-Treat these paths as the canonical project guidance:
-
-- `.cursor/skills/**` (each folder has `SKILL.md`)
-- `.cursor/rules/**` (`.mdc` files)
-- `.cursorrules` at the repository root
-
-Do not ask to commit duplicate “mirror” trees under `.github/` for Copilot or other tools; this repo intentionally only commits `.cursor` and `.cursorrules`.
-
-## Tasks
-
-1. Read the skills, rules, and `.cursorrules` above. Summarize the main conventions in 5–10 bullets.
-2. If my editor or LLM integration uses a **separate project directory** for rules (examples: tool-specific folders under the repo root, or generated instruction files), propose a mapping from the `.cursor` content to that format. If files already exist locally, **update them to match** the current `.cursor` content; add any **missing** files that should exist for parity.
-3. Update the **root `.gitignore`** in this repository: append patterns that ignore any **new local-only** paths you create or that my tool generates so they are never committed. Use comments to group them, e.g. `# Local LLM/editor exports (see docs/development/llm/DOCS-DEVELOPMENT-LLM.md)`. If a pattern is already present, do not duplicate it.
-4. Remind me to re-run this prompt after future pulls that change `.cursor` or `.cursorrules`, or when I see GitHub PRs/issues labeled `llm`.
-
-Do not delete or modify files under `.cursor/` or `.cursorrules` unless I explicitly ask you to change project policy.
-```
diff --git a/docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md b/docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md
new file mode 100644
index 00000000..24834089
--- /dev/null
+++ b/docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md
@@ -0,0 +1,245 @@
+# LLM history workflow (archived reference)
+
+This document preserves the **optional human workflow** for maintaining notes under `.llm/history/`. It is **not** Cursor agent policy. The file is listed in `.cursorignore` so IDE AI features do not load it by default.
+
+When a PR merges to `develop`, `.github/workflows/complete-feature.yml` may archive matching
+`.llm/history/active/<feature-name>/` folders automatically (see [.llm/LLM.md](/.llm/LLM.md)).
+
+---
+
+## Former Cursor rule: History Tracking (Essential)
+
+When modifying **any** files in this workspace, update `.llm/history/active/[feature]/[feature].md` (or the latest part file):
+
+```markdown
+### Session N - YYYY-MM-DD
+#### Prompt (Developer|Agent)
+[Exact verbatim prompt]
+#### Key Decisions
+- Decision 1
+#### Files Created/Modified
+- path/to/file.ts
+```
+
+### 10-Session Limit (Hard Rule)
+
+Each history file is limited to **10 sessions maximum** to prevent context overload.
+
+#### When to Split
+
+When a history file reaches 10 sessions and you need to add session 11:
+
+1. Rename the current file to include `-part-NN` suffix
+2. Create a new part file for continued development
+
+#### File Naming Convention
+
+Each feature has its own directory:
+
+```
+.llm/history/active/
+  simple-feature/
+    simple-feature.md                  # Single file (sessions 1-10)
+  long-feature/
+    long-feature-part-01.md            # Sessions 1-10 (renamed when split)
+    long-feature-part-02.md            # Sessions 11-20
+    long-feature-part-03.md            # Sessions 21-30, current
+```
+
+#### Part File Structure
+
+Each part file should include:
+
+- Same metadata header (Started, Author, Context) for standalone reference
+- Sessions numbered continuously (not reset per part)
+- Only the **latest part** is updated during active development
+
+#### Example Split
+
+Before (file has 10 sessions, need to add 11th):
+
+```
+.llm/history/active/my-feature/
+  my-feature.md
+```
+
+After:
+
+```
+.llm/history/active/my-feature/
+  my-feature-part-01.md  (sessions 1-10, renamed from my-feature.md)
+  my-feature-part-02.md  (sessions 11+, active)
+```
+
+End every file-modifying response with: **LLM History**: Updated `.llm/history/active/[feature]/[file].md` (Session N).
+
+---
+
+## Former `.cursorrules` section: HISTORY TRACKING (Essential)
+
+**Applies to every file-modifying response in this repo** — no exception for path or task size. When in doubt, update history.
+
+Before work: Check/create `.llm/history/active/[feature].md` (or `[feature]/[feature]-part-01.md`)
+
+After changes, update with:
+
+- Session date, user prompt (EXACT text), decisions, files
+
+### Prompt Recording (CRITICAL)
+
+**Always use the user's EXACT, FULL prompt text.** Never summarize or paraphrase.
+
+- Copy the prompt verbatim, preserving original wording
+- Include short confirmations ("yes", "continue") as-is
+- For multi-message exchanges, capture each message
+
+### Prompt Source Labeling (CRITICAL)
+
+**Differentiate prompt sources using labels:**
+
+- `#### Prompt (Developer)` — Manually typed by the user
+- `#### Prompt (Agent)` — System-generated (e.g., clicking "Build" on a plan)
+
+### Real-Time Capture (CRITICAL)
+
+**If a response will modify files, log the prompt FIRST.**
+
+- **Start of response**: Log prompt to `.llm/history/active/[feature].md`
+- **End of response**: Update with files changed and key decisions
+
+Skip logging for pure Q&A or explanations that don't change files.
+
+End file-modifying responses with: **LLM History**: Updated `.llm/history/active/[feature].md`
+
+---
+
+## Former skill: LLM History Tracking
+
+This skill provided guidelines for maintaining LLM development history in the Metaboost repo. The Cursor rule `llm-history-tracking.mdc` was the always-applied requirement.
+
+### Critical Rule: 10-Session Maximum Per File
+
+**Each history file must contain at most 10 sessions.** When session 11 needs to be added, the file must be split.
+
+#### Why This Matters
+
+- Prevents context overload for future LLM sessions
+- Keeps files manageable and searchable
+- Maintains performance when reading history
+
+### File Location Pattern
+
+```
+.llm/history/active/[feature-name]/
+  [feature-name]-part-01.md      # Sessions 1-10 (always start with part-01)
+  [feature-name]-part-02.md      # Sessions 11-20
+  [feature-name]-part-03.md      # Sessions 21-30
+```
+
+**Always use the `-part-01` suffix from the beginning, even for the first file.**
+
+### When to Split
+
+#### Before Adding Session 11
+
+1. Count sessions in current file
+2. If file has 10 sessions and you're about to add session 11:
+   - Create new file with `-part-02` suffix
+   - Add session 11 to the new part file
+
+### Session Numbering
+
+Sessions are numbered **continuously across parts**:
+
+- Part 01: Sessions 1-10
+- Part 02: Sessions 11-20
+- Part 03: Sessions 21-30
+
+**Never reset session numbers when splitting.**
+
+### Session Entry Format
+
+```markdown
+### Session N - YYYY-MM-DD
+
+#### Prompt (Developer)
+
+[Exact verbatim user prompt - never summarize]
+
+#### Key Decisions
+
+- Decision 1
+- Decision 2
+
+#### Files Modified
+
+- path/to/file.ts
+- path/to/another.ts
+```
+
+### Prompt Source Labels
+
+- **`#### Prompt (Developer)`** - Manually typed by user
+- **`#### Prompt (Agent)`** - System-generated (e.g., clicking "Build" on a plan)
+
+### When to Update History
+
+Update history when:
+
+- Modifying TypeScript/JavaScript files
+- Creating or updating plans
+- Making configuration changes
+- Updating documentation
+- Modifying scripts
+
+Don't update for:
+
+- Pure Q&A with no file changes
+- Reading files without modifications
+
+### Required sequence
+
+1. Record the prompt first in the active history file (verbatim text, correct prompt source label).
+2. Make the file changes.
+3. Finalize the same session entry with key decisions and files modified.
+
+### Checking Current Session Count
+
+Before updating history, always:
+
+1. Read the current active history file
+2. Count `### Session` headers
+3. If count = 10, split before adding new session
+4. If count < 10, append to current file
+
+### Example: Counting Sessions
+
+```bash
+grep -c "^### Session" .llm/history/active/feature-name/feature-name-part-01.md
+```
+
+If output is `10`, create a new `-part-02.md` file before adding session 11.
+
+### Response Ending
+
+Always end file-modifying responses with:
+
+```
+**LLM History**: Updated .llm/history/active/[feature]/[file].md (Session N)
+```
+
+### Common Mistakes to Avoid
+
+- **Don't** exceed 10 sessions per file
+- **Don't** reset session numbers when splitting
+- **Don't** summarize or paraphrase user prompts
+- **Don't** forget to split before adding session 11
+- **Don't** create history files without the `-part-01` suffix
+
+### Quick Reference
+
+| Sessions in File | Action                                  |
+| ---------------- | --------------------------------------- |
+| 1-9              | Append to current file                  |
+| 10 (adding 11)   | Split file, then append                 |
+| 11+              | **ERROR** - file should have been split |
diff --git a/docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md b/docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md
index f4f16079..e45a3e4c 100644
--- a/docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md
+++ b/docs/development/release/METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md
@@ -2,8 +2,8 @@
 
 Use this after **Publish (staging)** succeeds on the Metaboost repo. The app repository promotion train is
 **`develop` → `staging` → `main`** (use `sync-develop-to-staging.sh`, then after RTM `sync-staging-to-main.sh`;
-see [PUBLISH.md](../../PUBLISH.md), [STAGING-MAIN-PROMOTION.md](STAGING-MAIN-PROMOTION.md)). Full remote flow:
-[REMOTE-K8S-GITOPS.md](../k8s/REMOTE-K8S-GITOPS.md).
+see [PUBLISH.md](/docs/PUBLISH.md), [STAGING-MAIN-PROMOTION.md](STAGING-MAIN-PROMOTION.md)). Full remote flow:
+[REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md).
 
 ## Glossary (one minute)
 
@@ -33,6 +33,8 @@ release before CI and clusters can render overlays.
 **`ghcr.io/podverse/metaboost/*`** **`newTag`** to the same **`VERSION_TAG`** (including **web-sidecar** and
 **management-web-sidecar**). Do **not** change third-party image pins (e.g. Postgres **`newTag`** under **db**).
 
+**Common overlay:** include **`infra/k8s/base/product-membership`** once (same **`?ref=`** as other bases) so **`metaboost-product-membership-config`** exists in the namespace. **API** and **management-api** overlays list only **`base/api`** or **`base/management-api`** — not **`product-membership`** — so one Argo Application does not duplicate-own the ConfigMap. If **`product-membership`** was only listed under api/management-api, move it to **`common`** (and drop duplicates) when you bump **`?ref=`**.
+
 Then validate from the GitOps repository root using whatever pin contract checks you maintain (for example `kubectl kustomize` on each overlay, or a script such as `scripts/check_metaboost_alpha_version_contract.sh` if your repo ships one).
 
 **Web** and **management-web** overlays use **two** `configMapGenerator` merges each (**`*-config`** + **`*-runtime-config`**); see your GitOps repo’s documentation for **metaboost-alpha** layout when applicable.
@@ -45,10 +47,10 @@ Then validate from the GitOps repository root using whatever pin contract checks
 If env defaults or overlay values changed for this release, update those files directly in your
 GitOps repository, run your GitOps-side validation (for example `kubectl kustomize` checks),
 encrypt/update secrets with SOPS as needed, then commit and push. Skip if this release is images
-only with no env/manifests changes. See [REMOTE-K8S-GITOPS.md](../k8s/REMOTE-K8S-GITOPS.md).
+only with no env/manifests changes. See [REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md).
 
 ## 4. Push and sync
 
 **Dry-run `git push`** first when practical, then push the GitOps branch Argo CD tracks; use **dry-run
 Argo sync** when your CLI supports it, then sync Applications in dependency order (common → db/keyvaldb →
-apis → webs). See [REMOTE-K8S-GITOPS.md](../k8s/REMOTE-K8S-GITOPS.md) Step 11 and **Dry runs first**.
+apis → webs). See [REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md) Step 11 and **Dry runs first**.
diff --git a/docs/development/release/STAGING-MAIN-PROMOTION.md b/docs/development/release/STAGING-MAIN-PROMOTION.md
index 9388f912..745301ff 100644
--- a/docs/development/release/STAGING-MAIN-PROMOTION.md
+++ b/docs/development/release/STAGING-MAIN-PROMOTION.md
@@ -1,12 +1,12 @@
 # Staging and main: image tags and Git promotion (this repo)
 
-This document describes how **Publish (staging)** and **Publish (main)** work in this repository. Workflows: [`.github/workflows/publish-staging.yml`](../../.github/workflows/publish-staging.yml), [`.github/workflows/publish-main.yml`](../../.github/workflows/publish-main.yml). For GitOps pin bumps after staging, see [METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md](METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md) and [REMOTE-K8S-GITOPS.md](../k8s/REMOTE-K8S-GITOPS.md).
+This document describes how **Publish (staging)** and **Publish (main)** work in this repository. Workflows: [`.github/workflows/publish-staging.yml`](/.github/workflows/publish-staging.yml), [`.github/workflows/publish-main.yml`](/.github/workflows/publish-main.yml). For GitOps pin bumps after staging, see [METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md](METABOOST-PUBLISH-GITOPS-BUMP-CHECKLIST.md) and [REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md).
 
 ## Git branch mirrors (develop → staging → main)
 
 - **`develop`:** all product work lands here.
-- **`staging`:** a **fast-forward mirror of `develop`** at the preprod milestone when you run [`sync-develop-to-staging.sh`](../../scripts/publish/sync-develop-to-staging.sh) (or the equivalent PR). It should not accrue its own long-lived feature commits.
-- **`main`:** a **fast-forward mirror of `staging`** when you run [`sync-staging-to-main.sh`](../../scripts/publish/sync-staging-to-main.sh) (or the equivalent PR) after **Publish (staging)** is green. **Do not** advance **`main` directly from `develop`**.
+- **`staging`:** a **fast-forward mirror of `develop`** at the preprod milestone when you run [`sync-develop-to-staging.sh`](/scripts/publish/sync-develop-to-staging.sh) (or the equivalent PR). It should not accrue its own long-lived feature commits.
+- **`main`:** a **fast-forward mirror of `staging`** when you run [`sync-staging-to-main.sh`](/scripts/publish/sync-staging-to-main.sh) (or the equivalent PR) after **Publish (staging)** is green. **Do not** advance **`main` directly from `develop`**.
 
 ## Staging branch: `X.Y.Z-staging.N`
 
diff --git a/docs/development/repo-management/K8S-ALPHA-APP-OF-APPS-REFERENCE-ALIGNMENT-CHECKLIST-06B.md b/docs/development/repo-management/K8S-ALPHA-APP-OF-APPS-REFERENCE-ALIGNMENT-CHECKLIST-06B.md
index df53ccc6..4fb0b8fa 100644
--- a/docs/development/repo-management/K8S-ALPHA-APP-OF-APPS-REFERENCE-ALIGNMENT-CHECKLIST-06B.md
+++ b/docs/development/repo-management/K8S-ALPHA-APP-OF-APPS-REFERENCE-ALIGNMENT-CHECKLIST-06B.md
@@ -23,4 +23,4 @@ Phase: 06b-k8s-alpha-app-of-apps-parity
 - Metaboost alpha child set excludes workloads not present in the Metaboost base model (`workers`, `mq`, `cron`, `management-db`).
 - Metaboost alpha app-of-apps and alpha child overlays pin immutable Git revisions (tag or commit SHA) in committed manifests.
 - Metaboost alpha `ops` overlay composes from in-repo `../../base/ops` because `infra/k8s/base/ops` is not currently published on the remote refs used for Kustomize remote bases.
-- In-repo local k3d Argo applications were removed; cluster validation is remote GitOps ([REMOTE-K8S-GITOPS.md](../k8s/REMOTE-K8S-GITOPS.md)).
+- In-repo local k3d Argo applications were removed; cluster validation is remote GitOps ([REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md)).
diff --git a/docs/development/security/SECURITY-FINDINGS-CLOSURE-MATRIX.md b/docs/development/security/SECURITY-FINDINGS-CLOSURE-MATRIX.md
index c649b316..b214fae9 100644
--- a/docs/development/security/SECURITY-FINDINGS-CLOSURE-MATRIX.md
+++ b/docs/development/security/SECURITY-FINDINGS-CLOSURE-MATRIX.md
@@ -1,21 +1,21 @@
 # Security findings closure matrix (audit plans 01–05)
 
-Maps each ranked finding from [06-FINAL-SECURITY-REVIEW-REPORT.md](../../.llm/plans/completed/metaboost-security-audit/06-FINAL-SECURITY-REVIEW-REPORT.md) to remediation, automated coverage, and residual risk. “Closed” means addressed in code/config with tests or guardrails unless noted.
+Maps each ranked finding from [06-FINAL-SECURITY-REVIEW-REPORT.md](/.llm/plans/completed/metaboost-security-audit/06-FINAL-SECURITY-REVIEW-REPORT.md) to remediation, automated coverage, and residual risk. “Closed” means addressed in code/config with tests or guardrails unless noted.
 
-| ID            | Finding (short)                            | Remediation (where)                                                                                                                                                                                                       | Test / guardrail coverage                                                                                                                                                                                                                                  | Residual risk                                                                                             |
-| ------------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
-| **H1**        | CORS permissive when allowlist missing     | `parseCorsOriginsWithStartupEnforcement` — fail startup when `NODE_ENV` ∉ {development, test} and allowlist missing/empty (`packages/helpers/src/startup/cors-and-cookies.ts`); API/management config use it              | [`cors-and-cookies.test.ts`](../../packages/helpers/src/startup/cors-and-cookies.test.ts); [`cors-path.test.ts`](../../apps/api/src/test/cors-path.test.ts) for Standard Endpoint permissive path                                                          | Misconfigured **`NODE_ENV`** in production could weaken enforcement; deployments must set env correctly   |
-| **H2**        | RSS fetch SSRF                             | Central [`rss-safe-fetch.ts`](../../apps/api/src/lib/rss-safe-fetch.ts): DNS/IP block, redirects, body limits; buckets + sync use `fetchRssFeedXmlWithTimeout`                                                            | [`rss-safe-fetch.test.ts`](../../apps/api/src/test/rss-safe-fetch.test.ts); **`npm run security:check`** RSS wiring script                                                                                                                                 | Legitimate feeds on edge networks may need policy tuning; redirect chains capped                          |
-| **M1**        | Open `returnUrl` sinks                     | Shared helpers [`safeReturnUrl.ts`](../../packages/helpers/src/returnUrl/safeReturnUrl.ts); web/management role flows use `resolveReturnUrlFromQuery` / `safeReturnPathOrFallback`                                        | [`safeReturnUrl.test.ts`](../../packages/helpers/src/returnUrl/safeReturnUrl.test.ts); Playwright role specs from remediation wave                                                                                                                         | New pages must continue to use helpers at every sink                                                      |
-| **M2**        | Standard Endpoint HTTPS + trust-proxy      | `requireHttpsForStandardEndpoints` + [`httpsScheme.ts`](../../apps/api/src/lib/standardEndpoint/httpsScheme.ts); startup rejects unsafe **`STANDARD_ENDPOINT_TRUST_PROXY`** + **`STANDARD_ENDPOINT_REQUIRE_HTTPS=false`** | [`standard-endpoint-https-enforcement.test.ts`](../../apps/api/src/test/standard-endpoint-https-enforcement.test.ts); [`startup-validation-standard-endpoint-policy.test.ts`](../../apps/api/src/test/startup-validation-standard-endpoint-policy.test.ts) | Operational: ingress must terminate TLS and set forwarded headers consistently                            |
-| **M3**        | Tokens in query                            | **Body-only** token acceptance for verify-email / confirm-email-change (`apps/api/src/controllers/authController.ts`, Joi + routes)                                                                                       | [`auth-mailer.test.ts`](../../apps/api/src/test/auth-mailer.test.ts)                                                                                                                                                                                       | Legacy bookmarks with query tokens no longer work                                                         |
-| **M4**        | Auth rate limit gaps                       | **Moderate** limiters on **`POST /auth/refresh`**, **`POST /auth/logout`** (API); management **`refresh`**, **`logout`**, **`change-password`**                                                                           | [`auth-route-rate-limit-wiring.test.ts`](../../apps/api/src/test/auth-route-rate-limit-wiring.test.ts) (API); [`auth-route-rate-limit-wiring.test.ts`](../../apps/management-api/src/test/auth-route-rate-limit-wiring.test.ts) (management)               | Threshold tuning under abuse; optional Valkey store for multi-instance (`*_AUTH_RATE_LIMIT_USE_KEYVALDB`) |
-| **M5**        | Management-web gate on cookie only         | Proxy session restore + **`hasSession`** / invalidate paths aligned with web; stale cookie clears                                                                                                                         | [`auth-stale-cookies-redirect-login.spec.ts`](../../apps/management-web/e2e/auth-stale-cookies-redirect-login.spec.ts)                                                                                                                                     | Edge cases in cookie/session timing                                                                       |
-| **M6**        | Registry/provider trust                    | Hostname allowlists + extras env; startup validation (API + management-api); exchange provider URL checks                                                                                                                 | [`startup-validation-standard-endpoint-policy.test.ts`](../../apps/api/src/test/startup-validation-standard-endpoint-policy.test.ts); management mirror test file                                                                                          | Ops dependency on third-party uptime; mirror hosts require **`*_EXTRA_HOSTS`**                            |
-| **L1**        | JWT iss/aud optional                       | Optional **`API_JWT_*`** / **`MANAGEMENT_API_JWT_*`**; sign/verify use shared claim options                                                                                                                               | [`jwt.claims.test.ts`](../../apps/api/src/lib/auth/jwt.claims.test.ts)                                                                                                                                                                                     | Rolling iss/aud requires coordinated token rotation                                                       |
-| **L2**        | In-memory rate limits                      | Optional Valkey-backed store (`API_AUTH_RATE_LIMIT_USE_KEYVALDB`, `MANAGEMENT_API_AUTH_RATE_LIMIT_USE_KEYVALDB`)                                                                                                          | Covered by implementation + **ENV-REFERENCE**; integration left to staging                                                                                                                                                                                 | Valkey connectivity becomes a prod dependency when enabled                                                |
-| **L3**        | `x-auth-user` spoofing                     | Proxies strip inbound **`x-auth-user`** before session restore; response headers built from stripped request                                                                                                              | Implementation in **`apps/web/src/proxy.ts`**, **`apps/management-web/src/proxy.ts`**                                                                                                                                                                      | Defense in depth only within Next layer; edge auth remains separate                                       |
-| **SQL drift** | Dynamic SQL fragments (`date_trunc`, etc.) | Typed **`timeBucket`** union in [`BucketMessageService`](../../packages/orm/src/services/BucketMessageService.ts); parameterised LIKE `%${escaped}%`                                                                      | **`npm run security:check`** SQL fragment scanner + reviewer checklist                                                                                                                                                                                     | Future edits to dynamic SQL must keep allowlists / types                                                  |
+| ID            | Finding (short)                            | Remediation (where)                                                                                                                                                                                                  | Test / guardrail coverage                                                                                                                                                                                                                        | Residual risk                                                                                             |
+| ------------- | ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------- |
+| **H1**        | CORS permissive when allowlist missing     | `parseCorsOriginsWithStartupEnforcement` — fail startup when `NODE_ENV` ∉ {development, test} and allowlist missing/empty (`packages/helpers/src/startup/cors-and-cookies.ts`); API/management config use it         | [`cors-and-cookies.test.ts`](/packages/helpers/src/startup/cors-and-cookies.test.ts); [`cors-path.test.ts`](/apps/api/src/test/cors-path.test.ts) for Standard Endpoint permissive path                                                          | Misconfigured **`NODE_ENV`** in production could weaken enforcement; deployments must set env correctly   |
+| **H2**        | RSS fetch SSRF                             | Central [`rss-safe-fetch.ts`](/apps/api/src/lib/rss-safe-fetch.ts): DNS/IP block, redirects, body limits; buckets + sync use `fetchRssFeedXmlWithTimeout`                                                            | [`rss-safe-fetch.test.ts`](/apps/api/src/test/rss-safe-fetch.test.ts); **`npm run security:check`** RSS wiring script                                                                                                                            | Legitimate feeds on edge networks may need policy tuning; redirect chains capped                          |
+| **M1**        | Open `returnUrl` sinks                     | Shared helpers [`safeReturnUrl.ts`](/packages/helpers/src/returnUrl/safeReturnUrl.ts); web/management role flows use `resolveReturnUrlFromQuery` / `safeReturnPathOrFallback`                                        | [`safeReturnUrl.test.ts`](/packages/helpers/src/returnUrl/safeReturnUrl.test.ts); Playwright role specs from remediation wave                                                                                                                    | New pages must continue to use helpers at every sink                                                      |
+| **M2**        | Standard Endpoint HTTPS + trust-proxy      | `requireHttpsForStandardEndpoints` + [`httpsScheme.ts`](/apps/api/src/lib/standardEndpoint/httpsScheme.ts); startup rejects unsafe **`STANDARD_ENDPOINT_TRUST_PROXY`** + **`STANDARD_ENDPOINT_REQUIRE_HTTPS=false`** | [`standard-endpoint-https-enforcement.test.ts`](/apps/api/src/test/standard-endpoint-https-enforcement.test.ts); [`startup-validation-standard-endpoint-policy.test.ts`](/apps/api/src/test/startup-validation-standard-endpoint-policy.test.ts) | Operational: ingress must terminate TLS and set forwarded headers consistently                            |
+| **M3**        | Tokens in query                            | **Body-only** token acceptance for verify-email / confirm-email-change (`apps/api/src/controllers/authController.ts`, Joi + routes)                                                                                  | [`auth-mailer.test.ts`](/apps/api/src/test/auth-mailer.test.ts)                                                                                                                                                                                  | Legacy bookmarks with query tokens no longer work                                                         |
+| **M4**        | Auth rate limit gaps                       | **Moderate** limiters on **`POST /auth/refresh`**, **`POST /auth/logout`** (API); management **`refresh`**, **`logout`**, **`change-password`**                                                                      | [`auth-route-rate-limit-wiring.test.ts`](/apps/api/src/test/auth-route-rate-limit-wiring.test.ts) (API); [`auth-route-rate-limit-wiring.test.ts`](/apps/management-api/src/test/auth-route-rate-limit-wiring.test.ts) (management)               | Threshold tuning under abuse; optional Valkey store for multi-instance (`*_AUTH_RATE_LIMIT_USE_KEYVALDB`) |
+| **M5**        | Management-web gate on cookie only         | Proxy session restore + **`hasSession`** / invalidate paths aligned with web; stale cookie clears                                                                                                                    | [`auth-stale-cookies-redirect-login.spec.ts`](/apps/management-web/e2e/auth-stale-cookies-redirect-login.spec.ts)                                                                                                                                | Edge cases in cookie/session timing                                                                       |
+| **M6**        | Registry/provider trust                    | Hostname allowlists + extras env; startup validation (API + management-api); exchange provider URL checks                                                                                                            | [`startup-validation-standard-endpoint-policy.test.ts`](/apps/api/src/test/startup-validation-standard-endpoint-policy.test.ts); management mirror test file                                                                                     | Ops dependency on third-party uptime; mirror hosts require **`*_EXTRA_HOSTS`**                            |
+| **L1**        | JWT iss/aud optional                       | Optional **`API_JWT_*`** / **`MANAGEMENT_API_JWT_*`**; sign/verify use shared claim options                                                                                                                          | [`jwt.claims.test.ts`](/apps/api/src/lib/auth/jwt.claims.test.ts)                                                                                                                                                                                | Rolling iss/aud requires coordinated token rotation                                                       |
+| **L2**        | In-memory rate limits                      | Optional Valkey-backed store (`API_AUTH_RATE_LIMIT_USE_KEYVALDB`, `MANAGEMENT_API_AUTH_RATE_LIMIT_USE_KEYVALDB`)                                                                                                     | Covered by implementation + **ENV-REFERENCE**; integration left to staging                                                                                                                                                                       | Valkey connectivity becomes a prod dependency when enabled                                                |
+| **L3**        | `x-auth-user` spoofing                     | Proxies strip inbound **`x-auth-user`** before session restore; response headers built from stripped request                                                                                                         | Implementation in **`apps/web/src/proxy.ts`**, **`apps/management-web/src/proxy.ts`**                                                                                                                                                            | Defense in depth only within Next layer; edge auth remains separate                                       |
+| **SQL drift** | Dynamic SQL fragments (`date_trunc`, etc.) | Typed **`timeBucket`** union in [`BucketMessageService`](/packages/orm/src/services/BucketMessageService.ts); parameterised LIKE `%${escaped}%`                                                                      | **`npm run security:check`** SQL fragment scanner + reviewer checklist                                                                                                                                                                           | Future edits to dynamic SQL must keep allowlists / types                                                  |
 
 ## Accepted / documented risks
 
@@ -24,4 +24,4 @@ Maps each ranked finding from [06-FINAL-SECURITY-REVIEW-REPORT.md](../../.llm/pl
 ## Handoff
 
 - Contributor checklist: [SECURITY-REVIEW-CHECKLIST.md](SECURITY-REVIEW-CHECKLIST.md).
-- Env catalog: [ENV-REFERENCE.md](../env/ENV-REFERENCE.md).
+- Env catalog: [ENV-REFERENCE.md](/docs/development/env/ENV-REFERENCE.md).
diff --git a/docs/development/security/SECURITY-REVIEW-CHECKLIST.md b/docs/development/security/SECURITY-REVIEW-CHECKLIST.md
index 82533b1d..ee9c44ee 100644
--- a/docs/development/security/SECURITY-REVIEW-CHECKLIST.md
+++ b/docs/development/security/SECURITY-REVIEW-CHECKLIST.md
@@ -1,38 +1,38 @@
 # Security review checklist (contributors & reviewers)
 
-Use this list for PRs that touch auth, HTTP boundaries, SQL, redirects, or outbound fetches. It mirrors the regression-guard section of the consolidated security audit ([06-FINAL-SECURITY-REVIEW-REPORT.md](../../.llm/plans/completed/metaboost-security-audit/06-FINAL-SECURITY-REVIEW-REPORT.md)).
+Use this list for PRs that touch auth, HTTP boundaries, SQL, redirects, or outbound fetches. It mirrors the regression-guard section of the consolidated security audit ([06-FINAL-SECURITY-REVIEW-REPORT.md](/.llm/plans/completed/metaboost-security-audit/06-FINAL-SECURITY-REVIEW-REPORT.md)).
 
 ## Auth, CORS, cookies, tokens
 
-- **CORS allowlists**: In non-local environments (`NODE_ENV` not `development` or `test`), **`API_CORS_ORIGINS`** and **`MANAGEMENT_API_CORS_ORIGINS`** must be non-empty after trim. Behavior is enforced by `parseCorsOriginsWithStartupEnforcement` in `@metaboost/helpers` at config load (see [`packages/helpers/src/startup/cors-and-cookies.ts`](../../packages/helpers/src/startup/cors-and-cookies.ts)).
+- **CORS allowlists**: In non-local environments (`NODE_ENV` not `development` or `test`), **`API_CORS_ORIGINS`** and **`MANAGEMENT_API_CORS_ORIGINS`** must be non-empty after trim. Behavior is enforced by `parseCorsOriginsWithStartupEnforcement` in `@metaboost/helpers` at config load (see [`packages/helpers/src/startup/cors-and-cookies.ts`](/packages/helpers/src/startup/cors-and-cookies.ts)).
 - **Sensitive routes**: Routes under **`{API_VERSION_PATH}/standard/*`** intentionally use permissive CORS for integrators; they must **not** return session secrets or authenticated-user-only data without separate checks.
 - **Tokens in URLs**: Do not accept verification or reset tokens from query strings unless an explicitly approved exception exists; prefer JSON body (see auth controller patterns).
 - **JWT**: Signing and verification must use the same per-service secret (**`AUTH_JWT_SECRET`** in that service’s env / Kubernetes Secret) and preserve expiration handling; middleware must continue validating both `sub` and `id_text` against loaded users.
 
 ## SSRF and outbound trust boundary
 
-- **User-influenced RSS / HTTP URLs**: All RSS XML fetches for user-supplied feed URLs must go through **`fetchRssFeedXmlWithTimeout`** / **`fetchRssFeedText`** from [`apps/api/src/lib/rss-safe-fetch.ts`](../../apps/api/src/lib/rss-safe-fetch.ts) (DNS/IP policy, redirects, body limits). Automated wiring is checked by **`npm run security:check`**.
+- **User-influenced RSS / HTTP URLs**: All RSS XML fetches for user-supplied feed URLs must go through **`fetchRssFeedXmlWithTimeout`** / **`fetchRssFeedText`** from [`apps/api/src/lib/rss-safe-fetch.ts`](/apps/api/src/lib/rss-safe-fetch.ts) (DNS/IP policy, redirects, body limits). Automated wiring is checked by **`npm run security:check`**.
 - **Exchange / registry**: Provider and registry URLs must stay within startup hostname allowlists (see **`ENV-REFERENCE.md`** — `API_EXCHANGE_RATES_EXTRA_HOSTS`, `STANDARD_ENDPOINT_REGISTRY_EXTRA_HOSTS`).
 - **Trust proxy**: **`STANDARD_ENDPOINT_TRUST_PROXY=true`** must not be combined with **`STANDARD_ENDPOINT_REQUIRE_HTTPS=false`** at startup; document ingress guarantees when enabling trust-proxy.
 
 ## Redirect and header trust (web / management-web)
 
 - **`returnUrl` / `cancelUrl`**: Resolve through **`resolveReturnUrlFromQuery`**, **`safeReturnPathOrFallback`**, or **`isSafeRelativeAppPath`** from `@metaboost/helpers` — never pass raw query strings into **`router.push`**, **`redirect()`**, or **`window.location`**.
-- **`x-auth-user`**: In Next proxies, inbound client **`x-auth-user`** must be stripped before internal session restore; trusted values are set only after successful `/auth/me` or refresh handling (see [`apps/web/src/proxy.ts`](../../apps/web/src/proxy.ts), [`apps/management-web/src/proxy.ts`](../../apps/management-web/src/proxy.ts)).
+- **`x-auth-user`**: In Next proxies, inbound client **`x-auth-user`** must be stripped before internal session restore; trusted values are set only after successful `/auth/me` or refresh handling (see [`apps/web/src/proxy.ts`](/apps/web/src/proxy.ts), [`apps/management-web/src/proxy.ts`](/apps/management-web/src/proxy.ts)).
 
 ## SQL and query builders
 
 - **Dynamic SQL fragments**: Avoid interpolating untrusted strings into **`where` / `andWhere` / `orderBy` / `groupBy` / `having`** raw SQL. Prefer parameters (`:name`) and allowlisted literals.
 - **Known controlled interpolation**: If you must embed a bounded enum in SQL (e.g. `date_trunc`), keep the type as a **string union** or explicit allowlist at the API boundary and document the callsite.
-- **Automated drift check**: **`npm run security:check`** runs a fragment scan over ORM/API sources; allowlisted patterns are documented in [`scripts/security/check-sql-dynamic-fragments.mjs`](../../scripts/security/check-sql-dynamic-fragments.mjs).
+- **Automated drift check**: **`npm run security:check`** runs a fragment scan over ORM/API sources; allowlisted patterns are documented in [`scripts/security/check-sql-dynamic-fragments.mjs`](/scripts/security/check-sql-dynamic-fragments.mjs).
 
 ## Rate limiting
 
-- **Auth-adjacent routes**: Login/signup flows use strict limiters; **`POST /auth/refresh`**, **`POST /auth/logout`**, and similar management routes use moderate limiters (see route modules). PRs that add auth routes should attach the appropriate limiter from [`@metaboost/helpers-backend-api`](../../packages/helpers-backend-api/src/rateLimit.ts).
+- **Auth-adjacent routes**: Login/signup flows use strict limiters; **`POST /auth/refresh`**, **`POST /auth/logout`**, and similar management routes use moderate limiters (see route modules). PRs that add auth routes should attach the appropriate limiter from [`@metaboost/helpers-backend-api`](/packages/helpers-backend-api/src/rateLimit.ts).
 
 ## Verification commands
 
-From repo root (after [`docs/CURSOR-NIX-WITH-ENV.md`](../CURSOR-NIX-WITH-ENV.md) if needed):
+From repo root (after [`docs/CURSOR-NIX-WITH-ENV.md`](/docs/CURSOR-NIX-WITH-ENV.md) if needed):
 
 ```bash
 npm run security:check
diff --git a/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md b/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md
new file mode 100644
index 00000000..85611439
--- /dev/null
+++ b/docs/development/tooling/DOCS-DEVELOPMENT-TOOLING-IMPORT-SPECIFIERS.md
@@ -0,0 +1,44 @@
+# Import specifiers — Tier A (NodeNext), Tier B (Next.js src), Tier C (`packages/ui`)
+
+This document describes **intentional** differences in how relative import specifiers are written across the monorepo.
+
+## Tier A — NodeNext `.js` specifiers
+
+**Where:** `packages/**` **except** `packages/ui/**`, plus `apps/api`, `apps/management-api`, `apps/*/sidecar`, `tools/**`, and `scripts/**/*.ts` / `*.mts` (see ESLint config).
+
+**Rule:** Relative imports that resolve to TypeScript modules must use **`.js` in the specifier**, matching what `tsc` emits under `moduleResolution` **NodeNext**. Directory barrels use `./dir/index.js` when the implementation lives in `dir/index.ts` or `index.tsx`.
+
+**Why:** Node executes emitted JavaScript; NodeNext aligns specifier text with runtime resolution.
+
+## Tier C — Shared UI (`packages/ui`)
+
+**Where:** `packages/ui/**` (published `@metaboost/ui`, transpiled by consuming Next apps).
+
+**Rule:** Use **extensionless** relative imports, same style as Tier B. Do **not** suffix relatives with `.js` — bundlers resolve that suffix literally and fail when sources are `.ts`/`.tsx`.
+
+**Why:** Next (Turbopack/webpack) compiles this package from source; literal `.js` specifiers do not map to `.tsx` the way `tsc` NodeNext output does.
+
+## Tier B — Next.js `apps/web/src` and `apps/management-web/src`
+
+**Where:** `apps/web/src/**`, `apps/management-web/src/**`, and the same apps’ Playwright `e2e/**`.
+
+**Rule:** Keep **extensionless** relative imports unless you have verified **`next build`** with Turbopack for your change. Do **not** bulk-codemod Tier B to `.js` specifiers yet.
+
+**Why:** Turbopack’s resolution for `.js` specifiers pointing at `.tsx`/`.ts` sources does not yet match the webpack extension-alias workflow many codebases used. Upstream tracking: [vercel/next.js#82945](https://github.com/vercel/next.js/issues/82945).
+
+This split is **intentional technical debt** until Turbopack documents parity for extension-alias-style behavior.
+
+## Enforcement
+
+ESLint: local plugin **`nodeNextRelativeImports`** / rule **`require-relative-js-extension`** in root `eslint.config.mjs` — **error** on Tier A, **off** on Tier B and **off** on Tier C (`packages/ui`). Implementation: `eslint-rules/require-relative-js-extension.mjs`.
+
+## Convergence checklist
+
+When upstream fixes land and you adopt a compatible Next release, follow:
+
+`.llm/plans/completed/tiered-import-specifiers-node-vs-next/06-future-convergence-todo.md`
+
+## Related
+
+- Rule: `.cursor/rules/import-specifiers-tiered.mdc`
+- Skill: `.cursor/skills/import-specifiers-tiered/SKILL.md`
diff --git a/docs/development/tooling/LOCKFILE-LINUX.md b/docs/development/tooling/LOCKFILE-LINUX.md
index 851ee6f7..8dd7bbd9 100644
--- a/docs/development/tooling/LOCKFILE-LINUX.md
+++ b/docs/development/tooling/LOCKFILE-LINUX.md
@@ -7,7 +7,7 @@ To keep the lockfile correct for CI, generate or refresh it **under Linux**.
 ## When to do it
 
 - **After adding or updating dependencies** (e.g. `npm install <pkg>`, or editing `package.json` by hand). Run the script, then commit the updated `package-lock.json`.
-- **When bumping version** – The [bump-version script](../../scripts/publish/bump-version.sh) runs the Linux lockfile step automatically before committing, so you don’t need to run it yourself for version bumps.
+- **When bumping version** – The [bump-version script](/scripts/publish/bump-version.sh) runs the Linux lockfile step automatically before committing, so you don’t need to run it yourself for version bumps.
 
 ## How
 
@@ -24,5 +24,5 @@ and Docker builds use it.
 
 ## See also
 
-- [AGENTS.md](../../AGENTS.md) – Dependencies and Linux-canonical lockfile note
-- [Quick Start](../QUICK-START.md) – Local setup
+- [AGENTS.md](/AGENTS.md) – Dependencies and Linux-canonical lockfile note
+- [Quick Start](/docs/QUICK-START.md) – Local setup
diff --git a/docs/localization/I18N.md b/docs/localization/I18N.md
index 8b880d79..930642c7 100644
--- a/docs/localization/I18N.md
+++ b/docs/localization/I18N.md
@@ -31,7 +31,7 @@ Non–en-US originals (e.g. `es.json`) must be in the **target language** (e.g.
 ## Key conventions
 
 - **Namespaces:** `auth`, `common`, `dashboard`, `settings`, `errors`, **`ui`** (see below).
-- **UI package:** Components in `@metaboost/ui` that render their own text use the **`ui`** namespace. Each app must include a full **`ui`** object in its `i18n/originals/en-US.json` (and other locales). Required keys are listed in [packages/ui/I18N-KEYS.md](../../packages/ui/I18N-KEYS.md).
+- **UI package:** Components in `@metaboost/ui` that render their own text use the **`ui`** namespace. Each app must include a full **`ui`** object in its `i18n/originals/en-US.json` (and other locales). Required keys are listed in [packages/ui/I18N-KEYS.md](/packages/ui/I18N-KEYS.md).
 
 ## Locale detection
 
diff --git a/docs/operations/CHANGELOG-ARCHIVE/DOCS-OPERATIONS-CHANGELOG-ARCHIVE.md b/docs/operations/CHANGELOG-ARCHIVE/DOCS-OPERATIONS-CHANGELOG-ARCHIVE.md
deleted file mode 100644
index d100d054..00000000
--- a/docs/operations/CHANGELOG-ARCHIVE/DOCS-OPERATIONS-CHANGELOG-ARCHIVE.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Archived release notes (generated)
-
-> Deprecated: release notes now come directly from `docs/development/CHANGELOGS/X.Y.Z.md` files.
-
-This directory is populated by automation after a successful publish (GitHub Actions) from `alpha`, `beta`, or `main`.
-
-Each `RELEASE-*.md` archives [CHANGELOG-UPCOMING.md](../CHANGELOG-UPCOMING.md) as of the build commit, with metadata.
-
-**Do not delete** archive files to “fix” an upcoming line; add a follow-up in [CHANGELOG-UPCOMING.md](../CHANGELOG-UPCOMING.md) on `develop` instead.
diff --git a/docs/operations/CHANGELOG-UPCOMING.md b/docs/operations/CHANGELOG-UPCOMING.md
deleted file mode 100644
index fdec067f..00000000
--- a/docs/operations/CHANGELOG-UPCOMING.md
+++ /dev/null
@@ -1,14 +0,0 @@
-# Changelog (upcoming)
-
-> Deprecated: use `docs/development/CHANGELOGS/X.Y.Z.md` instead. Release workflows now read changelog content from semver-named files.
-
-**Edit on `develop` only.** This file powers GitHub release notes and archive files when a publish runs from `alpha` (prerelease tags `X.Y.Z-staging.N` + float `:staging`), `beta` (`-beta.N` + `:beta`), or `main` (RTM `X.Y.Z` + `:latest`). See [PUBLISH](../PUBLISH.md).
-
-List **most important** user-facing or ops changes first. Keep the list concise, not a git log.
-
-The block between the markers is reset (via a PR to `develop`) after a successful publish. Add static notes **above** the marker block; only the marked block is auto-reset.
-
-<!-- UPCOMING-AUTO-START -->
-
-- <!-- Add concise bullets (most important first) for the next significant changes. -->
-<!-- UPCOMING-AUTO-END -->
diff --git a/docs/repo-management/BRANCH-PROTECTION.md b/docs/repo-management/BRANCH-PROTECTION.md
index 2801697f..b499dfee 100644
--- a/docs/repo-management/BRANCH-PROTECTION.md
+++ b/docs/repo-management/BRANCH-PROTECTION.md
@@ -49,12 +49,25 @@ Expected PR behavior:
 Note: users in configured bypass teams can merge without being blocked by the
 approval requirement step, per the ruleset bypass policy above.
 
+## Required status check steps (`validate`)
+
+The `validate` job in [`.github/workflows/ci.yml`](/.github/workflows/ci.yml) posts the required
+`validate` commit status. When triggered via **`/test`**, it runs:
+
+1. Linear migration validation and linear baseline 0003 verification
+2. DB init sync (`make check_k8s_postgres_init_sync`) and bootstrap init contract check
+3. Runtime `CREATE EXTENSION` guard
+4. `npm ci` (with retry), build packages, lint, build apps, i18n validate, type-check
+5. Ephemeral Postgres/Valkey test DB setup (ports **5632** / **6579**)
+
+Tests are intentionally skipped in this workflow; maintainers run the local test suite before merge.
+
 ## Local Enforcement
 
 In addition to GitHub-hosted enforcement, local hooks can block risky pushes:
 
 - pre-push: block direct pushes to protected branches
-- pre-push: validate branch naming conventions
+- pre-push: validate branch naming conventions (feature/_, fix/_, chore/_, docs/_, hotfix/_, release/_, llm/\_)
 
 See `scripts/git-hooks/` for implementation details.
 
diff --git a/docs/repo-management/DEPENDABOT.md b/docs/repo-management/DEPENDABOT.md
index f5b34caf..db78bc15 100644
--- a/docs/repo-management/DEPENDABOT.md
+++ b/docs/repo-management/DEPENDABOT.md
@@ -6,7 +6,7 @@ The config is scoped to this repo’s structure.
 ## Overview
 
 Dependabot automatically creates pull requests to keep dependencies up-to-date and secure.
-Configuration is in [`.github/dependabot.yml`](../../.github/dependabot.yml).
+Configuration is in [`.github/dependabot.yml`](/.github/dependabot.yml).
 
 ## Update Schedule
 
@@ -43,19 +43,20 @@ odd versions (18.x–23.x, 25.x, 27.x, 29.x) are ignored.
 - `web-sidecar`
 - `management-api`
 - `management-web`
+- `management-web-sidecar`
 
 **Labels**: `dependencies`, `docker`
 
 **Node.js LTS policy (≥ 24 only)**:
 
 - Allowed: even-numbered LTS **24 and above** (24.x, 26.x, 28.x, …)
-- Ignored: pre-24 (18.x–23.x) and odd (non-LTS) versions (25.x, 27.x, 29.x)
+- Ignored: pre-24 (18.x–23.x) and odd (non-LTS) versions (25.x, 27.x, 29.x, …)
 
 > **Why?** Node LTS versions are even-numbered. This repo uses Node 24+ only; Docker
 > image updates are restricted to that policy.
 
-**Ignored versions in config**: `18.x`, `19.x`, `20.x`, `21.x`, `22.x`, `23.x`, `25.x`,
-`27.x`, `29.x`
+**Ignored `@types/node` versions in config**: `18.x`–`23.x`, `25.x`, `26.x`, `27.x`, `28.x`,
+`29.x`, `30.x`, `31.x`, `32.x`
 
 ### 3. GitHub Actions
 
diff --git a/docs/repo-management/GITHUB-LABELS.md b/docs/repo-management/GITHUB-LABELS.md
index d1560114..203c0456 100644
--- a/docs/repo-management/GITHUB-LABELS.md
+++ b/docs/repo-management/GITHUB-LABELS.md
@@ -64,9 +64,21 @@ This document lists all labels in the Metaboost repository for consistent issue
 
 ## Label Usage by Workflow
 
+### Vulnerability Scanner (`.github/workflows/vulnerability-scanner.yml`)
+
+Scheduled and manual `npm audit --omit=dev` scans. When new advisories are found, the workflow may
+open GitHub issues with:
+
+- `security`, `dependencies`
+- `priority:critical`, `priority:high`, `priority:medium`, `priority:low` (by severity)
+
+Allowlist policy for release scripts: [NPM-AUDIT-ALLOWLIST.md](/docs/development/NPM-AUDIT-ALLOWLIST.md).
+
 ### PR Labeler (`.github/workflows/pr-labeler.yml`)
 
 - `apps`, `packages`, `docs`, `infra`, `ci`, `scripts`, `tools` – Applied when changed files match the path prefix
 - `i18n` – Applied when paths contain `/i18n/`
 
-Ensure labels exist before opening PRs by running `./scripts/github/setup-all-labels.sh` (see [scripts/github/SCRIPTS-GITHUB.md](../../scripts/github/SCRIPTS-GITHUB.md)).
+Ensure labels exist before opening PRs by running `./scripts/github/setup-all-labels.sh` (see [scripts/github/SCRIPTS-GITHUB.md](/scripts/github/SCRIPTS-GITHUB.md)). The script creates or updates all labels used by workflows (pr-labeler, vulnerability-scanner, etc.).
+
+When editing workflow YAML, follow [.cursor/rules/github-actions-yaml.mdc](/.cursor/rules/github-actions-yaml.mdc) (double-quoted strings, heredocs for markdown in `run:` blocks).
diff --git a/docs/repo-management/GITHUB-SETUP.md b/docs/repo-management/GITHUB-SETUP.md
index 6b232fc6..1ff5b537 100644
--- a/docs/repo-management/GITHUB-SETUP.md
+++ b/docs/repo-management/GITHUB-SETUP.md
@@ -1,6 +1,6 @@
 # GitHub Repository Setup
 
-One-time configuration steps for this repository. Aligns with the workflows and conventions in [GITFLOW.md](../GITFLOW.md), [BRANCH-PROTECTION.md](BRANCH-PROTECTION.md), and [GITHUB-LABELS.md](GITHUB-LABELS.md).
+One-time configuration steps for this repository. Aligns with the workflows and conventions in [GITFLOW.md](/docs/GITFLOW.md), [BRANCH-PROTECTION.md](BRANCH-PROTECTION.md), and [GITHUB-LABELS.md](GITHUB-LABELS.md).
 
 ## 1. Issue Templates
 
@@ -15,7 +15,7 @@ gh auth login   # once, if not already authenticated
 ./scripts/github/setup-all-labels.sh
 ```
 
-The script is idempotent. If the repo has labels not defined in the script, it will list them and optionally delete them (deleting does not remove labels from existing issues/PRs). See [GITHUB-LABELS.md](GITHUB-LABELS.md) for the full label reference and [scripts/github/SCRIPTS-GITHUB.md](../../scripts/github/SCRIPTS-GITHUB.md) for details.
+The script is idempotent. If the repo has labels not defined in the script, it will list them and optionally delete them (deleting does not remove labels from existing issues/PRs). See [GITHUB-LABELS.md](GITHUB-LABELS.md) for the full label reference and [scripts/github/SCRIPTS-GITHUB.md](/scripts/github/SCRIPTS-GITHUB.md) for details.
 
 ## 3. Default Branch
 
@@ -42,21 +42,37 @@ set; keep a single enforcement source to avoid double-gating drift.
 
 ## 5. Optional: GitHub App
 
-If you use a GitHub App for CI status checks, deployment, or other automation:
+If you use a GitHub App for automation that pushes to **`develop`** (bypassing default
+`GITHUB_TOKEN` restrictions), install it on this repository and add secrets:
 
-- Create the App in the organization (or user) settings
-- Install it on this repository
-- Store App ID and private key (or installation token) in secrets as required by your workflows
+| Secret            | Used by                                                         |
+| ----------------- | --------------------------------------------------------------- |
+| `APP_ID`          | [complete-feature.yml](/.github/workflows/complete-feature.yml) |
+| `APP_PRIVATE_KEY` | [complete-feature.yml](/.github/workflows/complete-feature.yml) |
 
-This is optional; the repository works with the default GitHub Actions permissions without an App.
+[complete-feature.yml](/.github/workflows/complete-feature.yml) runs when a PR merges to **`develop`**
+and archives `.llm/history/active/<feature>/` to `.llm/history/completed/YYYY-MM/` when that folder
+exists. See [DOCS-DEVELOPMENT-LLM.md](/docs/development/llm/DOCS-DEVELOPMENT-LLM.md).
+
+This is optional for day-to-day development; the repository works without an App unless you rely on
+that history automation.
 
 ## 6. Dependency updates (Dependabot)
 
-Dependabot is configured in [`.github/dependabot.yml`](../../.github/dependabot.yml) and opens
+Dependabot is configured in [`.github/dependabot.yml`](/.github/dependabot.yml) and opens
 PRs for npm, Docker, and GitHub Actions updates. Schedule, grouping, and Node LTS policy
 (≥ 24 only) are described in [DEPENDABOT.md](DEPENDABOT.md). Ensure labels `dependencies`
 and `docker` exist (section 2) so Dependabot can apply them.
 
+## 7. Scheduled automation
+
+| Workflow                                                                                      | Schedule / trigger       | Notes                                                                                                                                        |
+| --------------------------------------------------------------------------------------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| [vulnerability-scanner.yml](/.github/workflows/vulnerability-scanner.yml)                     | Twice daily UTC + manual | Fails on moderate+ audit findings; may open labeled security issues. See [NPM-AUDIT-ALLOWLIST.md](/docs/development/NPM-AUDIT-ALLOWLIST.md). |
+| [metaboost-infra-alpha-contracts.yml](/.github/workflows/metaboost-infra-alpha-contracts.yml) | Manual / repo-specific   | GitOps alpha pin contract validation                                                                                                         |
+
+When editing workflows, follow [.cursor/rules/github-actions-yaml.mdc](/.cursor/rules/github-actions-yaml.mdc).
+
 ## Vendor-Specific Note
 
 This setup guide is GitHub-specific. If your fork is hosted on another platform,
diff --git a/docs/testing/E2E-PAGE-TESTING.md b/docs/testing/E2E-PAGE-TESTING.md
index a1ae2f43..3072dcd4 100644
--- a/docs/testing/E2E-PAGE-TESTING.md
+++ b/docs/testing/E2E-PAGE-TESTING.md
@@ -342,7 +342,7 @@ These defaults are intentionally non-overlapping so both repos can run `make tes
 - Ensure dependencies are up with `make test_deps` (or `make e2e_deps`).
 - Then rerun the E2E command; Playwright webServer should use `DB_PORT=5632` and `KEYVALDB_PORT=6579`.
 
-See [docs/development/env/ENV-REFERENCE.md](../development/ENV-REFERENCE.md) and the canonical web/sidecar templates in `infra/config/env-templates/` for `RUNTIME_CONFIG_URL` and `NEXT_PUBLIC_*` defaults.
+See [docs/development/env/ENV-REFERENCE.md](/docs/development/env/ENV-REFERENCE.md) and the canonical web/sidecar templates in `infra/config/env-templates/` for `RUNTIME_CONFIG_URL` and `NEXT_PUBLIC_*` defaults.
 
 ## Where specs live
 
diff --git a/docs/testing/TEST-SETUP.md b/docs/testing/TEST-SETUP.md
index 55ddda9a..2f169570 100644
--- a/docs/testing/TEST-SETUP.md
+++ b/docs/testing/TEST-SETUP.md
@@ -25,7 +25,7 @@ Override test bind ports with `TEST_DB_PORT` / `TEST_KEYVALDB_PORT` in the Makef
 - **Run all:** From repo root: `npm run test` (runs Vitest for `apps/api`, `apps/management-api`, then `metaboost-signing` and `@metaboost/rss-parser`).
 - **Single file:** `./scripts/nix/with-env npx vitest run apps/api/src/test/buckets.test.ts` (or the path to any `*.test.ts`).
 - **Env:** Tests use smart defaults from [apps/api/src/test/setup.ts](apps/api/src/test/setup.ts). Tests that need signup/mailer override env at the top of the file and load app/config in `beforeAll`. No local mailer required for most tests; verification flows use a Vitest mock.
-- **Clean slate:** globalSetup truncates main and management tables once before any test file runs (api: [apps/api/src/test/global-setup.mjs](../../apps/api/src/test/global-setup.mjs); management-api: [apps/management-api/src/test/global-setup.mjs](../../apps/management-api/src/test/global-setup.mjs)).
+- **Clean slate:** globalSetup truncates main and management tables once before any test file runs (api: [apps/api/src/test/global-setup.mjs](/apps/api/src/test/global-setup.mjs); management-api: [apps/management-api/src/test/global-setup.mjs](/apps/management-api/src/test/global-setup.mjs)).
 
 ### Route → test file (API)
 
diff --git a/eslint-rules/require-relative-js-extension.mjs b/eslint-rules/require-relative-js-extension.mjs
new file mode 100644
index 00000000..0d751b50
--- /dev/null
+++ b/eslint-rules/require-relative-js-extension.mjs
@@ -0,0 +1,157 @@
+/**
+ * Tier A (NodeNext): relative imports must use `.js` specifiers matching emitted JS.
+ * Tier B (Next app src): disabled via eslint.config.mjs override.
+ *
+ * Uses filesystem resolution for directory barrels (`./Dir/index.js` vs `./Dir.js`).
+ * Keep aligned with Podverse `eslint-rules/require-relative-js-extension.mjs`.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * @param {string} pathStr
+ * @returns {string}
+ */
+function tsSpecifierToJs(pathStr) {
+  return pathStr.replace(/\.tsx(\?|$)/, '.js$1').replace(/\.ts(\?|$)/, '.js$1');
+}
+
+/**
+ * @param {string} fromFile Absolute path to the file containing the import.
+ * @param {string} specifier Import string literal value.
+ * @returns {string | null} Expected specifier, or null if skipped / unknown.
+ */
+function expectedNodeNextSpecifier(fromFile, specifier) {
+  const qIdx = specifier.indexOf('?');
+  const pathPart = qIdx >= 0 ? specifier.slice(0, qIdx) : specifier;
+  const query = qIdx >= 0 ? specifier.slice(qIdx) : '';
+
+  if (/\.(json|scss|sass|css|svg|png|jpe?g|gif|webp|woff2?|ttf|eot|md)(\?|$)/i.test(specifier)) {
+    return null;
+  }
+  if (/\.mjs(\?|$)/.test(specifier) || /\.cjs(\?|$)/.test(specifier)) {
+    return null;
+  }
+
+  const dir = path.dirname(fromFile);
+
+  if (/\.(ts|tsx)(\?|$)/.test(specifier)) {
+    return tsSpecifierToJs(specifier);
+  }
+
+  const abs = path.resolve(dir, pathPart);
+
+  if (/\.js(\?|$)/.test(specifier)) {
+    const withoutJs = pathPart.replace(/\.js$/, '');
+    const absBase = path.resolve(dir, withoutJs);
+    if (fs.existsSync(`${absBase}.ts`) || fs.existsSync(`${absBase}.tsx`)) {
+      return `${withoutJs}.js${query}`;
+    }
+    if (
+      fs.existsSync(path.join(absBase, 'index.ts')) ||
+      fs.existsSync(path.join(absBase, 'index.tsx'))
+    ) {
+      return `${withoutJs}/index.js${query}`;
+    }
+    return null;
+  }
+
+  if (fs.existsSync(`${abs}.ts`) || fs.existsSync(`${abs}.tsx`)) {
+    return `${pathPart}.js${query}`;
+  }
+  if (fs.existsSync(path.join(abs, 'index.ts')) || fs.existsSync(path.join(abs, 'index.tsx'))) {
+    return `${pathPart}/index.js${query}`;
+  }
+
+  return null;
+}
+
+/** @type {import('eslint').Rule.RuleModule} */
+export default {
+  meta: {
+    type: 'problem',
+    docs: {
+      description:
+        'Require `.js` on relative module specifiers (NodeNext). Asset-only extensions are exempt.',
+    },
+    schema: [],
+    fixable: 'code',
+    messages: {
+      needJs:
+        'Relative import "{{path}}" must use a `.js` specifier (NodeNext). Expected: {{expected}}.',
+      useJsNotTs:
+        'Relative import "{{path}}" must use `.js` in the specifier (NodeNext), not `.ts` or `.tsx`.',
+    },
+  },
+  create(context) {
+    const sourceCode = context.sourceCode ?? context.getSourceCode();
+    const fromFile = path.resolve(context.filename ?? '');
+
+    /**
+     * @param {import('estree').Literal | import('estree').SimpleLiteral | null | undefined} sourceNode
+     * @param {string} fixedPath
+     */
+    function replaceSpecifier(sourceNode, fixedPath) {
+      const rawText = sourceCode.getText(sourceNode);
+      const quote = rawText[0] === "'" ? "'" : '"';
+      return `${quote}${fixedPath}${quote}`;
+    }
+
+    /**
+     * @param {import('estree').Literal | import('estree').SimpleLiteral | null | undefined} sourceNode
+     */
+    function checkLiteral(sourceNode) {
+      if (!sourceNode || sourceNode.type !== 'Literal') {
+        return;
+      }
+      const raw = sourceNode.value;
+      const value = typeof raw === 'string' ? raw : null;
+      if (value === null) {
+        return;
+      }
+      if (!/^\.\.?\//.test(value)) {
+        return;
+      }
+
+      const expected = expectedNodeNextSpecifier(fromFile, value);
+      if (expected === null) {
+        return;
+      }
+      if (expected === value) {
+        return;
+      }
+
+      const messageId = /\.(ts|tsx)(\?|$)/.test(value) ? 'useJsNotTs' : 'needJs';
+
+      context.report({
+        node: sourceNode,
+        messageId,
+        data: { path: value, expected },
+        fix(fixer) {
+          return fixer.replaceText(sourceNode, replaceSpecifier(sourceNode, expected));
+        },
+      });
+    }
+
+    return {
+      ImportDeclaration(node) {
+        checkLiteral(node.source);
+      },
+      ExportNamedDeclaration(node) {
+        if (node.source) {
+          checkLiteral(node.source);
+        }
+      },
+      ExportAllDeclaration(node) {
+        checkLiteral(node.source);
+      },
+      ImportExpression(node) {
+        const src = node.source;
+        if (src && src.type === 'Literal') {
+          checkLiteral(src);
+        }
+      },
+    };
+  },
+};
diff --git a/eslint.config.mjs b/eslint.config.mjs
index c1705e8e..a33616ea 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -8,6 +8,8 @@ import { dirname } from 'path';
 import tseslint from 'typescript-eslint';
 import { fileURLToPath } from 'url';
 
+import requireRelativeJsExtension from './eslint-rules/require-relative-js-extension.mjs';
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
@@ -76,12 +78,6 @@ export default tseslint.config(
       'no-console': 'off',
     },
   },
-  {
-    files: ['scripts/llm/**/*.mjs', 'scripts/llm/**/*.js', 'scripts/llm/**/*.cjs'],
-    rules: {
-      'no-console': ['warn', { allow: ['warn', 'error'] }],
-    },
-  },
   {
     files: ['tools/**/*.js', 'tools/**/*.mjs', 'tools/**/*.cjs'],
     rules: {
@@ -95,6 +91,51 @@ export default tseslint.config(
       'no-empty-pattern': 'off',
     },
   },
+  {
+    files: [
+      'packages/**/*.{ts,tsx}',
+      'apps/api/**/*.{ts,tsx}',
+      'apps/management-api/**/*.{ts,tsx}',
+      'apps/web/sidecar/**/*.{ts,tsx}',
+      'apps/management-web/sidecar/**/*.{ts,tsx}',
+      'tools/**/*.{ts,tsx}',
+      'scripts/**/*.{ts,mts}',
+    ],
+    plugins: {
+      nodeNextRelativeImports: {
+        rules: {
+          'require-relative-js-extension': requireRelativeJsExtension,
+        },
+      },
+    },
+    rules: {
+      'nodeNextRelativeImports/require-relative-js-extension': 'error',
+    },
+  },
+  {
+    files: ['packages/ui/**/*.{ts,tsx}'],
+    rules: {
+      'nodeNextRelativeImports/require-relative-js-extension': 'off',
+    },
+  },
+  {
+    files: [
+      'apps/web/src/**/*.{ts,tsx}',
+      'apps/management-web/src/**/*.{ts,tsx}',
+      'apps/web/e2e/**/*.{ts,tsx}',
+      'apps/management-web/e2e/**/*.{ts,tsx}',
+    ],
+    plugins: {
+      nodeNextRelativeImports: {
+        rules: {
+          'require-relative-js-extension': requireRelativeJsExtension,
+        },
+      },
+    },
+    rules: {
+      'nodeNextRelativeImports/require-relative-js-extension': 'off',
+    },
+  },
   {
     ignores: [
       '**/dist/**',
diff --git a/infra/INFRA.md b/infra/INFRA.md
index def155c7..e5b2d4f1 100644
--- a/infra/INFRA.md
+++ b/infra/INFRA.md
@@ -10,8 +10,8 @@ Includes Docker local infra and Kubernetes **bases** / **alpha** app-of-apps man
 - **config/local/** – Local env files (gitignored); generated by `make local_env_setup` (secrets
   auto-generated; override files in `dev/env-overrides/local/` are optional and not used by
   default). **Required for Docker:** run `make local_env_setup` before `docker compose up`. See
-  [docs/development/env/LOCAL-ENV-OVERRIDES.md](../docs/development/env/LOCAL-ENV-OVERRIDES.md).
-  **All env keys from templates/examples** (defaults and K8s wiring): [docs/development/env/ENV-VARS-REFERENCE.md](../docs/development/env/ENV-VARS-REFERENCE.md).
+  [docs/development/env/LOCAL-ENV-OVERRIDES.md](/docs/development/env/LOCAL-ENV-OVERRIDES.md).
+  **All env keys from templates/examples** (defaults and K8s wiring): [docs/development/env/ENV-VARS-REFERENCE.md](/docs/development/env/ENV-VARS-REFERENCE.md).
 - **database/** – Deprecated legacy location; canonical SQL now lives under `infra/k8s/base/db/source/`.
 - **management-database/** – Deprecated legacy location; canonical management schema now lives under `infra/k8s/base/db/source/0005_management_schema.sql.frag`.
 - **docker/local/** – Dockerfiles and docker-compose for api, web, sidecar, postgres, and valkey.
@@ -22,8 +22,8 @@ Includes Docker local infra and Kubernetes **bases** / **alpha** app-of-apps man
 - **k8s/** – Kubernetes manifests for GitOps consumption:
   - `base/` reusable per-component bases (remote GitOps)
   - `alpha/` in-repo alpha app-of-apps and child overlays
-  - optional root `argocd-project.yaml` (see [k8s/INFRA-K8S.md](k8s/INFRA-K8S.md); environment `Application` CRs usually live in your GitOps repo — [docs/development/k8s/ARGOCD-GITOPS-METABOOST.md](../docs/development/k8s/ARGOCD-GITOPS-METABOOST.md))
-  - see [k8s/INFRA-K8S.md](k8s/INFRA-K8S.md) and [docs/development/k8s/REMOTE-K8S-GITOPS.md](../docs/development/k8s/REMOTE-K8S-GITOPS.md)
+  - optional root `argocd-project.yaml` (see [k8s/INFRA-K8S.md](k8s/INFRA-K8S.md); environment `Application` CRs usually live in your GitOps repo — [docs/development/k8s/ARGOCD-GITOPS-METABOOST.md](/docs/development/k8s/ARGOCD-GITOPS-METABOOST.md))
+  - see [k8s/INFRA-K8S.md](k8s/INFRA-K8S.md) and [docs/development/k8s/REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md)
 
 ## Management database
 
diff --git a/infra/config/env-templates/api.env.example b/infra/config/env-templates/api.env.example
index 8dd89f17..b1956029 100644
--- a/infra/config/env-templates/api.env.example
+++ b/infra/config/env-templates/api.env.example
@@ -19,11 +19,15 @@ DB_APP_READ_USER="metaboost_app_read"
 DB_APP_READ_PASSWORD=
 DB_APP_READ_WRITE_USER="metaboost_app_read_write"
 DB_APP_READ_WRITE_PASSWORD=
-MEMBERSHIP_DEFAULT_TRIAL_MONTHS=
-MEMBERSHIP_DEFAULT_PREMIUM_MONTHS=
+# Membership product bootstrap (main DB): seeds `product_membership_settings` / open `billing_price`
+# windows when missing; at runtime the API reads the database first and uses these only as fallback / seed.
+# MEMBERSHIP_FREE_TRIAL_EXPIRATION: trial length in seconds (default 31 days = 2678400 if unset).
+MEMBERSHIP_FREE_TRIAL_EXPIRATION="2678400"
+MEMBERSHIP_PREMIUM_COST_MONTHLY="3"
+MEMBERSHIP_PREMIUM_COST_ANNUALLY="30"
 API_PORT="4000"
 API_VERSION_PATH="/v1"
-API_RELEASE="X.X.X-staging.N"
+API_RELEASE="X.Y.Z-staging.N"
 API_PUBLIC_BASE_URL="http://localhost:4000"
 API_SERVER_BASE_URL="http://metaboost_local_api:4000"
 WEB_PORT="4002"
@@ -51,3 +55,7 @@ STANDARD_ENDPOINT_REGISTRY_POLL_SECONDS="300"
 STANDARD_ENDPOINT_REGISTRY_TIMEOUT_MS="10000"
 STANDARD_ENDPOINT_REQUIRE_HTTPS="false"
 STANDARD_ENDPOINT_TRUST_PROXY="false"
+WEBPUSH_ENABLED=
+WEBPUSH_VAPID_PUBLIC_KEY=
+WEBPUSH_VAPID_PRIVATE_KEY=
+WEBPUSH_VAPID_SUBJECT=
diff --git a/infra/config/env-templates/management-api.env.example b/infra/config/env-templates/management-api.env.example
index fc60415b..8e8a2e6d 100644
--- a/infra/config/env-templates/management-api.env.example
+++ b/infra/config/env-templates/management-api.env.example
@@ -24,11 +24,15 @@ DB_MANAGEMENT_READ_WRITE_USER="metaboost_management_read_write"
 DB_MANAGEMENT_READ_WRITE_PASSWORD=
 DB_MANAGEMENT_READ_USER="metaboost_management_read"
 DB_MANAGEMENT_READ_PASSWORD=
-MEMBERSHIP_DEFAULT_TRIAL_MONTHS=
-MEMBERSHIP_DEFAULT_PREMIUM_MONTHS=
+# Membership bootstrap (same keys as main API): used only to INSERT missing rows into the main app DB
+# (`product_membership_settings`, `billing_price`). Resolved values for UI/API come from the DB first.
+# MEMBERSHIP_FREE_TRIAL_EXPIRATION: trial length in seconds (empty = default 31 days in helpers).
+MEMBERSHIP_FREE_TRIAL_EXPIRATION="2678400"
+MEMBERSHIP_PREMIUM_COST_MONTHLY="3"
+MEMBERSHIP_PREMIUM_COST_ANNUALLY="30"
 API_PORT="4000"
 MANAGEMENT_API_VERSION_PATH="/v1"
-MANAGEMENT_API_RELEASE="X.X.X-staging.N"
+MANAGEMENT_API_RELEASE="X.Y.Z-staging.N"
 API_PUBLIC_BASE_URL="http://localhost:4000"
 API_SERVER_BASE_URL="http://metaboost_local_api:4000"
 WEB_PORT="4002"
diff --git a/infra/config/env-templates/web-sidecar.env.example b/infra/config/env-templates/web-sidecar.env.example
index 9cb84b3b..bae9393c 100644
--- a/infra/config/env-templates/web-sidecar.env.example
+++ b/infra/config/env-templates/web-sidecar.env.example
@@ -12,3 +12,6 @@ WEB_PORT="4002"
 NEXT_PUBLIC_WEB_BASE_URL="http://localhost:4002"
 WEB_SIDECAR_PORT="4001"
 NEXT_PUBLIC_SESSION_REFRESH_INTERVAL_MS="600000"
+NEXT_PUBLIC_WEBPUSH_ENABLED=
+NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY=
+NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY=
diff --git a/infra/docker/local/INFRA-DOCKER-LOCAL.md b/infra/docker/local/INFRA-DOCKER-LOCAL.md
index cab6b337..4292ae7b 100644
--- a/infra/docker/local/INFRA-DOCKER-LOCAL.md
+++ b/infra/docker/local/INFRA-DOCKER-LOCAL.md
@@ -11,9 +11,11 @@ localhost when run via `npm run dev` (e.g. `npm run dev:web-sidecar`, port 4001;
 
 ## First run
 
+`make local_infra_up` requires **`infra/config/local/db.env`** (same values Docker Compose uses for `POSTGRES_USER` and bootstrap scripts). Generate it with **`make local_env_setup`** before bringing infra up.
+
 1. Prepare env (from repo root): `make local_env_setup` (or use the home-directory flow:
    `make local_env_prepare`, edit `~/.config/metaboost/local-env-overrides/`, `make local_env_link`,
-   `make local_env_setup` — see [docs/development/env/LOCAL-ENV-OVERRIDES.md](../../docs/development/env/LOCAL-ENV-OVERRIDES.md)).
+   `make local_env_setup` — see [docs/development/env/LOCAL-ENV-OVERRIDES.md](/docs/development/env/LOCAL-ENV-OVERRIDES.md)).
 2. From repo root:  
    `docker compose -f infra/docker/local/docker-compose.yml --project-directory . up --build`
 
diff --git a/infra/k8s/INFRA-K8S-BASE.md b/infra/k8s/INFRA-K8S-BASE.md
index 247f8b6d..f57e24e9 100644
--- a/infra/k8s/INFRA-K8S-BASE.md
+++ b/infra/k8s/INFRA-K8S-BASE.md
@@ -3,7 +3,7 @@
 These directories under `infra/k8s/base/` are **shared** workload definitions for Argo CD / Kustomize
 overlays (e.g. your GitOps repo’s `apps/metaboost-alpha/<component>/`). Overlays reference a
 remote module (HTTPS URL with **`//`** before the in-repo path; same form as
-[REMOTE-K8S-GITOPS.md](../../docs/development/k8s/REMOTE-K8S-GITOPS.md) Step 4):
+[REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md) Step 4):
 
 `https://github.com/<org>/metaboost//infra/k8s/base/<component>?ref=<branch-or-tag>`
 
@@ -12,18 +12,19 @@ remote bases.
 
 ## Layout
 
-| Directory              | Workloads / resources                                                                                                                                     |
-| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `base/api/`            | **configMapGenerator** `metaboost-api-config` from `source/api.env`, Service `api`, Deployment `api`                                                      |
-| `base/web/`            | ConfigMaps from `source/web.env` + `source/web-sidecar.env`, Service `web`, Deployment `web` (web + sidecar containers, Podverse-style)                   |
-| `base/management-api/` | **configMapGenerator** `metaboost-management-api-config` from `source/management-api.env`, Service, Deployment                                            |
-| `base/management-web/` | ConfigMaps from `source/management-web.env` + `source/management-web-sidecar.env`, Service `management-web`, Deployment `management-web` (dual container) |
-| `base/db/`             | Service `metaboost-db`, StatefulSet `metaboost-db` (+ generated PVC via `volumeClaimTemplates`)                                                           |
-| `base/keyvaldb/`       | PVC `metaboost-valkey-data`, Service `metaboost-keyvaldb`, Deployment `valkey`                                                                            |
+| Directory                  | Workloads / resources                                                                                                                                                      |
+| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `base/product-membership/` | **configMapGenerator** `metaboost-product-membership-config` from `source/product-membership-settings.env` (composed in **`alpha/common`**, not nested under another base) |
+| `base/api/`                | **configMapGenerator** `metaboost-api-config` from `source/api.env`, Service `api`, Deployment `api`                                                                       |
+| `base/web/`                | ConfigMaps from `source/web.env` + `source/web-sidecar.env`, Service `web`, Deployment `web` (web + sidecar containers, Podverse-style)                                    |
+| `base/management-api/`     | **configMapGenerator** `metaboost-management-api-config` from `source/management-api.env`, Service, Deployment                                                             |
+| `base/management-web/`     | ConfigMaps from `source/management-web.env` + `source/management-web-sidecar.env`, Service `management-web`, Deployment `management-web` (dual container)                  |
+| `base/db/`                 | Service `metaboost-db`, StatefulSet `metaboost-db` (+ generated PVC via `volumeClaimTemplates`)                                                                            |
+| `base/keyvaldb/`           | PVC `metaboost-valkey-data`, Service `metaboost-keyvaldb`, Deployment `valkey`                                                                                             |
 
 **ConfigMap defaults** live under `infra/k8s/base/*/source/*.env` (kustomize **env file** semantics:
 prefer **unquoted** values so generated `ConfigMap.data` does not embed stray quote characters).
-Canonical non-K8s templates remain [`infra/config/env-templates/*.env.example`](../../infra/config/env-templates/api.env.example); keep keys aligned when changing startup requirements.
+Canonical non-K8s templates remain [`infra/config/env-templates/*.env.example`](/infra/config/env-templates/api.env.example); keep keys aligned when changing startup requirements.
 
 **GitOps overlays** should use **`configMapGenerator` with `behavior: merge`** and thin `source/*.env` fragments layered on these bases.
 
@@ -46,7 +47,7 @@ From monorepo root (with kubectl on PATH):
 Or manually:
 
 ```bash
-for d in api web management-api management-web db keyvaldb ops; do
+for d in api web management-api management-web product-membership db keyvaldb ops; do
   kubectl kustomize "infra/k8s/base/$d" --load-restrictor LoadRestrictionsNone >/dev/null \
     && echo "ok base/$d" || echo "FAIL base/$d"
 done
diff --git a/infra/k8s/INFRA-K8S.md b/infra/k8s/INFRA-K8S.md
index d3a2fbd4..0a5bb296 100644
--- a/infra/k8s/INFRA-K8S.md
+++ b/infra/k8s/INFRA-K8S.md
@@ -7,13 +7,14 @@ This directory contains a GitOps-style scaffold for Metaboost:
 
 ## Local development
 
-Day-to-day development uses **Docker Compose** and host-run apps (`make local_infra_up`, `npm run dev:*`). See [docs/QUICKSTART.md](../../docs/QUICKSTART.md) and [infra/INFRA.md](../INFRA.md).
+Day-to-day development uses **Docker Compose** and host-run apps (`make local_infra_up`, `npm run dev:*`). See [docs/QUICK-START.md](/docs/QUICK-START.md) and [infra/INFRA.md](/infra/INFRA.md).
 
-Cluster-shaped validation uses a **remote** cluster and your **GitOps** repository; see [REMOTE-K8S-GITOPS.md](../../docs/development/k8s/REMOTE-K8S-GITOPS.md).
+Cluster-shaped validation uses a **remote** cluster and your **GitOps** repository; see [REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md).
 
 ## Per-component `base/*`
 
-- **`infra/k8s/base/<component>/`** (api, web, db, keyvaldb, …) — Kustomize bases consumed by remote GitOps overlays via `resources:` URLs (see [REMOTE-K8S-GITOPS.md](../../docs/development/k8s/REMOTE-K8S-GITOPS.md)) and referenced by in-repo **`infra/k8s/alpha/<component>/`** kustomizations.
+- **`infra/k8s/base/<component>/`** (api, web, db, keyvaldb, …) — Kustomize bases consumed by remote GitOps overlays via `resources:` URLs (see [REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md)) and referenced by in-repo **`infra/k8s/alpha/<component>/`** kustomizations.
+- Compose shared cross-component bundles (for example **`base/product-membership`**) in the **common** overlay (`alpha/common`, or your GitOps `common` equivalent) so one sync path owns namespace-wide ConfigMaps; workload overlays reference them only via Deployments — not via `../` sibling paths inside `base/<component>/`.
 
 ## Base DB source SQL
 
@@ -35,7 +36,7 @@ For forward-only migration validation and ordering checks, run **`make check_k8s
 
 ## Remote cluster + GitOps
 
-Remote deployment uses **your** GitOps repository (Kustomize overlays, Argo CD `Application` CRs, and encrypted secrets). Argo CD reads the GitOps repository for deployed environments. Canonical Argo **`Application`** CRs for your cluster live in that GitOps repository; see [ARGOCD-GITOPS-METABOOST.md](../../docs/development/k8s/ARGOCD-GITOPS-METABOOST.md) and [REMOTE-K8S-GITOPS.md](../../docs/development/k8s/REMOTE-K8S-GITOPS.md).
+Remote deployment uses **your** GitOps repository (Kustomize overlays, Argo CD `Application` CRs, and encrypted secrets). Argo CD reads the GitOps repository for deployed environments. Canonical Argo **`Application`** CRs for your cluster live in that GitOps repository; see [ARGOCD-GITOPS-METABOOST.md](/docs/development/k8s/ARGOCD-GITOPS-METABOOST.md) and [REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md).
 
 ## Main files
 
@@ -49,5 +50,4 @@ Remote deployment uses **your** GitOps repository (Kustomize overlays, Argo CD `
 ## Revision policy
 
 - Alpha app-of-apps and alpha child Application manifests (`infra/k8s/alpha-application.yaml`, `infra/k8s/alpha/apps/*`) use immutable Git revisions in committed manifests.
-- Alpha child overlays that use remote `resources:` URLs pin immutable Git revisions in committed manifests.
-- Alpha **`ops`** currently composes from in-repo **`../../base/ops`** because **`infra/k8s/base/ops`** is not published on the public remote refs consumed by Kustomize.
+- Alpha child overlays that use remote `resources:` URLs pin immutable Git revisions in committed manifests (including **`alpha/ops`**, which references **`base/ops`** the same way as other components).
diff --git a/infra/k8s/alpha-application.yaml b/infra/k8s/alpha-application.yaml
index ff61a6c7..ea9c72d3 100644
--- a/infra/k8s/alpha-application.yaml
+++ b/infra/k8s/alpha-application.yaml
@@ -9,7 +9,7 @@ spec:
   project: metaboost
   source:
     repoURL: https://github.com/podverse/metaboost.git
-    targetRevision: X.X.X-staging.N
+    targetRevision: X.Y.Z-staging.N
     path: infra/k8s/alpha/apps
     directory:
       recurse: true
diff --git a/infra/k8s/alpha/INFRA-K8S-ALPHA.md b/infra/k8s/alpha/INFRA-K8S-ALPHA.md
index cf79584a..5f0a716b 100644
--- a/infra/k8s/alpha/INFRA-K8S-ALPHA.md
+++ b/infra/k8s/alpha/INFRA-K8S-ALPHA.md
@@ -8,5 +8,7 @@ This directory is the in-repo alpha app-of-apps source.
 
 `ops/kustomization.yaml` references remote `infra/k8s/base/ops?ref=...` (base ops ConfigMaps stay `metaboost-ops-*`).
 
+Committed overlay `kustomization.yaml` files use publish placeholder **`X.Y.Z-staging.N`** on remote `?ref=` URLs (and matching image tags where applicable). Replace that value with the immutable staging tag after **Publish (staging)**. PR CI (`.github/workflows/metaboost-infra-alpha-contracts.yml`) and [`scripts/k8s/kustomize-build-metaboost-alpha-overlays.sh`](../../scripts/k8s/kustomize-build-metaboost-alpha-overlays.sh) substitute the commit SHA when rendering so overlays validate before a publish tag exists.
+
 External GitOps repositories can still consume this model by syncing this repository revision and
 tracking the in-repo alpha root and child app manifests.
diff --git a/infra/k8s/alpha/api/kustomization.yaml b/infra/k8s/alpha/api/kustomization.yaml
index 7de601ee..90a196c4 100644
--- a/infra/k8s/alpha/api/kustomization.yaml
+++ b/infra/k8s/alpha/api/kustomization.yaml
@@ -5,6 +5,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://github.com/podverse/metaboost//infra/k8s/base/api?ref=X.X.X-staging.N
+  - https://github.com/podverse/metaboost//infra/k8s/base/api?ref=X.Y.Z-staging.N
 
 namespace: metaboost-alpha
diff --git a/infra/k8s/alpha/apps/INFRA-K8S-ALPHA-APPS.md b/infra/k8s/alpha/apps/INFRA-K8S-ALPHA-APPS.md
index 5e45bf9f..fb4496e8 100644
--- a/infra/k8s/alpha/apps/INFRA-K8S-ALPHA-APPS.md
+++ b/infra/k8s/alpha/apps/INFRA-K8S-ALPHA-APPS.md
@@ -7,8 +7,13 @@ model.
 - Child app source path: `infra/k8s/alpha/apps`
 
 Each child app points to an in-repo alpha component path (for example
-`infra/k8s/alpha/api`, `infra/k8s/alpha/web`, `infra/k8s/alpha/ops`) and targets the
-`metaboost-alpha` namespace.
+`infra/k8s/alpha/common`, `infra/k8s/alpha/api`, `infra/k8s/alpha/web`, `infra/k8s/alpha/ops`) and
+targets the `metaboost-alpha` namespace.
+
+**`common`** (sync-wave **-3**) composes `base/product-membership` and creates
+`metaboost-product-membership-config`. **`api`** and **`management-api`** child apps depend on that
+ConfigMap via Deployment `envFrom` only — do not add a second product-membership remote base under
+those overlays.
 
 External GitOps repositories can still consume this model by tracking this repository and syncing
 `infra/k8s/alpha-application.yaml` and `infra/k8s/alpha/apps/` from the chosen revision.
diff --git a/infra/k8s/alpha/apps/api.yaml b/infra/k8s/alpha/apps/api.yaml
index fdf3f99b..b77c320f 100644
--- a/infra/k8s/alpha/apps/api.yaml
+++ b/infra/k8s/alpha/apps/api.yaml
@@ -9,7 +9,7 @@ spec:
   project: metaboost
   source:
     repoURL: https://github.com/podverse/metaboost.git
-    targetRevision: X.X.X-staging.N
+    targetRevision: X.Y.Z-staging.N
     path: infra/k8s/alpha/api
   destination:
     server: https://kubernetes.default.svc
diff --git a/infra/k8s/alpha/apps/common.yaml b/infra/k8s/alpha/apps/common.yaml
index b81e02d4..e98a8253 100644
--- a/infra/k8s/alpha/apps/common.yaml
+++ b/infra/k8s/alpha/apps/common.yaml
@@ -9,7 +9,7 @@ spec:
   project: metaboost
   source:
     repoURL: https://github.com/podverse/metaboost.git
-    targetRevision: X.X.X-staging.N
+    targetRevision: X.Y.Z-staging.N
     path: infra/k8s/alpha/common
   destination:
     server: https://kubernetes.default.svc
diff --git a/infra/k8s/alpha/apps/db.yaml b/infra/k8s/alpha/apps/db.yaml
index 0b3b3228..d5e562aa 100644
--- a/infra/k8s/alpha/apps/db.yaml
+++ b/infra/k8s/alpha/apps/db.yaml
@@ -16,7 +16,7 @@ spec:
         - .spec.volumeClaimTemplates[0].kind
   source:
     repoURL: https://github.com/podverse/metaboost.git
-    targetRevision: X.X.X-staging.N
+    targetRevision: X.Y.Z-staging.N
     path: infra/k8s/alpha/db
   destination:
     server: https://kubernetes.default.svc
diff --git a/infra/k8s/alpha/apps/keyvaldb.yaml b/infra/k8s/alpha/apps/keyvaldb.yaml
index cbc73c7b..3ce29ddb 100644
--- a/infra/k8s/alpha/apps/keyvaldb.yaml
+++ b/infra/k8s/alpha/apps/keyvaldb.yaml
@@ -9,7 +9,7 @@ spec:
   project: metaboost
   source:
     repoURL: https://github.com/podverse/metaboost.git
-    targetRevision: X.X.X-staging.N
+    targetRevision: X.Y.Z-staging.N
     path: infra/k8s/alpha/keyvaldb
   destination:
     server: https://kubernetes.default.svc
diff --git a/infra/k8s/alpha/apps/management-api.yaml b/infra/k8s/alpha/apps/management-api.yaml
index 90d53850..20a9f8a0 100644
--- a/infra/k8s/alpha/apps/management-api.yaml
+++ b/infra/k8s/alpha/apps/management-api.yaml
@@ -9,7 +9,7 @@ spec:
   project: metaboost
   source:
     repoURL: https://github.com/podverse/metaboost.git
-    targetRevision: X.X.X-staging.N
+    targetRevision: X.Y.Z-staging.N
     path: infra/k8s/alpha/management-api
   destination:
     server: https://kubernetes.default.svc
diff --git a/infra/k8s/alpha/apps/management-web.yaml b/infra/k8s/alpha/apps/management-web.yaml
index ee794936..fc26e972 100644
--- a/infra/k8s/alpha/apps/management-web.yaml
+++ b/infra/k8s/alpha/apps/management-web.yaml
@@ -9,7 +9,7 @@ spec:
   project: metaboost
   source:
     repoURL: https://github.com/podverse/metaboost.git
-    targetRevision: X.X.X-staging.N
+    targetRevision: X.Y.Z-staging.N
     path: infra/k8s/alpha/management-web
   destination:
     server: https://kubernetes.default.svc
diff --git a/infra/k8s/alpha/apps/ops.yaml b/infra/k8s/alpha/apps/ops.yaml
index 916cf934..984b1cdd 100644
--- a/infra/k8s/alpha/apps/ops.yaml
+++ b/infra/k8s/alpha/apps/ops.yaml
@@ -12,7 +12,7 @@ spec:
   project: metaboost
   source:
     repoURL: https://github.com/podverse/metaboost.git
-    targetRevision: X.X.X-staging.N
+    targetRevision: X.Y.Z-staging.N
     path: infra/k8s/alpha/ops
   destination:
     server: https://kubernetes.default.svc
diff --git a/infra/k8s/alpha/apps/web.yaml b/infra/k8s/alpha/apps/web.yaml
index 82100b9e..1f00c071 100644
--- a/infra/k8s/alpha/apps/web.yaml
+++ b/infra/k8s/alpha/apps/web.yaml
@@ -9,7 +9,7 @@ spec:
   project: metaboost
   source:
     repoURL: https://github.com/podverse/metaboost.git
-    targetRevision: X.X.X-staging.N
+    targetRevision: X.Y.Z-staging.N
     path: infra/k8s/alpha/web
   destination:
     server: https://kubernetes.default.svc
diff --git a/infra/k8s/alpha/common/kustomization.yaml b/infra/k8s/alpha/common/kustomization.yaml
index dca4a518..d33f4d7a 100644
--- a/infra/k8s/alpha/common/kustomization.yaml
+++ b/infra/k8s/alpha/common/kustomization.yaml
@@ -1,5 +1,10 @@
+# Shared metaboost-product-membership-config: compose here so one Argo child app owns it; api and
+# management-api deployments only reference it via envFrom.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
+namespace: metaboost-alpha
+
 resources:
   - namespace.yaml
+  - https://github.com/podverse/metaboost//infra/k8s/base/product-membership?ref=X.Y.Z-staging.N
diff --git a/infra/k8s/alpha/db/kustomization.yaml b/infra/k8s/alpha/db/kustomization.yaml
index 3921f1f2..8e4db807 100644
--- a/infra/k8s/alpha/db/kustomization.yaml
+++ b/infra/k8s/alpha/db/kustomization.yaml
@@ -5,7 +5,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://github.com/podverse/metaboost//infra/k8s/base/db?ref=X.X.X-staging.N
+  - https://github.com/podverse/metaboost//infra/k8s/base/db?ref=X.Y.Z-staging.N
 
 namespace: metaboost-alpha
 
diff --git a/infra/k8s/alpha/keyvaldb/kustomization.yaml b/infra/k8s/alpha/keyvaldb/kustomization.yaml
index b4806f8e..652a5f8f 100644
--- a/infra/k8s/alpha/keyvaldb/kustomization.yaml
+++ b/infra/k8s/alpha/keyvaldb/kustomization.yaml
@@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://github.com/podverse/metaboost//infra/k8s/base/keyvaldb?ref=X.X.X-staging.N
+  - https://github.com/podverse/metaboost//infra/k8s/base/keyvaldb?ref=X.Y.Z-staging.N
 
 namespace: metaboost-alpha
diff --git a/infra/k8s/alpha/management-api/kustomization.yaml b/infra/k8s/alpha/management-api/kustomization.yaml
index 15aec33e..0f5be331 100644
--- a/infra/k8s/alpha/management-api/kustomization.yaml
+++ b/infra/k8s/alpha/management-api/kustomization.yaml
@@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://github.com/podverse/metaboost//infra/k8s/base/management-api?ref=X.X.X-staging.N
+  - https://github.com/podverse/metaboost//infra/k8s/base/management-api?ref=X.Y.Z-staging.N
 
 namespace: metaboost-alpha
diff --git a/infra/k8s/alpha/management-web/kustomization.yaml b/infra/k8s/alpha/management-web/kustomization.yaml
index 8b8ce548..2c20dd92 100644
--- a/infra/k8s/alpha/management-web/kustomization.yaml
+++ b/infra/k8s/alpha/management-web/kustomization.yaml
@@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://github.com/podverse/metaboost//infra/k8s/base/management-web?ref=X.X.X-staging.N
+  - https://github.com/podverse/metaboost//infra/k8s/base/management-web?ref=X.Y.Z-staging.N
 
 namespace: metaboost-alpha
diff --git a/infra/k8s/alpha/ops/kustomization.yaml b/infra/k8s/alpha/ops/kustomization.yaml
index 5c6c5268..b36f32e3 100644
--- a/infra/k8s/alpha/ops/kustomization.yaml
+++ b/infra/k8s/alpha/ops/kustomization.yaml
@@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../base/ops
+  - https://github.com/podverse/metaboost//infra/k8s/base/ops?ref=X.Y.Z-staging.N
 
 namespace: metaboost-alpha
diff --git a/infra/k8s/alpha/web/kustomization.yaml b/infra/k8s/alpha/web/kustomization.yaml
index 2526dcee..e7282404 100644
--- a/infra/k8s/alpha/web/kustomization.yaml
+++ b/infra/k8s/alpha/web/kustomization.yaml
@@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://github.com/podverse/metaboost//infra/k8s/base/web?ref=X.X.X-staging.N
+  - https://github.com/podverse/metaboost//infra/k8s/base/web?ref=X.Y.Z-staging.N
 
 namespace: metaboost-alpha
diff --git a/infra/k8s/base/api/deployment.yaml b/infra/k8s/base/api/deployment.yaml
index 6540049e..8932edb7 100644
--- a/infra/k8s/base/api/deployment.yaml
+++ b/infra/k8s/base/api/deployment.yaml
@@ -71,6 +71,8 @@ spec:
                 name: metaboost-db-secrets
             - secretRef:
                 name: metaboost-keyvaldb-secrets
+            - configMapRef:
+                name: metaboost-product-membership-config
           env:
             - name: DB_HOST
               value: metaboost-db
diff --git a/infra/k8s/base/api/source/api.env b/infra/k8s/base/api/source/api.env
index 08a4d693..022e1879 100644
--- a/infra/k8s/base/api/source/api.env
+++ b/infra/k8s/base/api/source/api.env
@@ -20,12 +20,11 @@ DB_PORT=5432
 DB_APP_NAME=metaboost_app
 DB_APP_READ_USER=metaboost_app_read
 DB_APP_READ_WRITE_USER=metaboost_app_read_write
-MEMBERSHIP_DEFAULT_TRIAL_MONTHS=
-MEMBERSHIP_DEFAULT_PREMIUM_MONTHS=
-API_EXPECTED_MIGRATION_FILENAME=0005_remove_user_trust_tier.sql
+# MEMBERSHIP_FREE_TRIAL_EXPIRATION, MEMBERSHIP_PREMIUM_COST_*: metaboost-product-membership-config
+API_EXPECTED_MIGRATION_FILENAME=0005_billing_domain_events.sql
 API_PORT=4000
 API_VERSION_PATH=/v1
-API_RELEASE=X.X.X-staging.N
+API_RELEASE=X.Y.Z-staging.N
 API_PUBLIC_BASE_URL=http://api:4000
 API_SERVER_BASE_URL=http://api:4000
 WEB_PORT=4002
@@ -52,3 +51,7 @@ STANDARD_ENDPOINT_REGISTRY_POLL_SECONDS=300
 STANDARD_ENDPOINT_REGISTRY_TIMEOUT_MS=10000
 STANDARD_ENDPOINT_REQUIRE_HTTPS=false
 STANDARD_ENDPOINT_TRUST_PROXY=false
+WEBPUSH_ENABLED=
+WEBPUSH_VAPID_PUBLIC_KEY=
+WEBPUSH_VAPID_PRIVATE_KEY=
+WEBPUSH_VAPID_SUBJECT=
diff --git a/infra/k8s/base/db/source/app/0001_app_schema.sql b/infra/k8s/base/db/source/app/0001_app_schema.sql
index ac63feae..4890394d 100644
--- a/infra/k8s/base/db/source/app/0001_app_schema.sql
+++ b/infra/k8s/base/db/source/app/0001_app_schema.sql
@@ -361,6 +361,45 @@ CREATE INDEX idx_bucket_admin_invitation_bucket_id ON bucket_admin_invitation(bu
 CREATE INDEX idx_bucket_admin_invitation_token ON bucket_admin_invitation(token);
 CREATE INDEX idx_bucket_admin_invitation_status ON bucket_admin_invitation(status);
 
+-- Per-user notification preference per bucket (explicit rows only; no bucket-global flag).
+CREATE TABLE bucket_notification_preference (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+    bucket_id UUID NOT NULL REFERENCES bucket(id) ON DELETE CASCADE,
+    enabled BOOLEAN NOT NULL DEFAULT true,
+    created_at server_time_with_default NOT NULL,
+    updated_at server_time_with_default NOT NULL,
+    UNIQUE (user_id, bucket_id)
+);
+
+CREATE TRIGGER set_updated_at_bucket_notification_preference
+    BEFORE UPDATE ON bucket_notification_preference
+    FOR EACH ROW
+    EXECUTE FUNCTION set_updated_at_field();
+
+CREATE INDEX idx_bucket_notification_preference_user_id ON bucket_notification_preference(user_id);
+CREATE INDEX idx_bucket_notification_preference_bucket_id ON bucket_notification_preference(bucket_id);
+
+-- Web Push subscription endpoints (user-owned; keys + locale for dispatch).
+CREATE TABLE user_web_push_subscription (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+    endpoint varchar_url NOT NULL,
+    key_p256dh TEXT NOT NULL,
+    key_auth TEXT NOT NULL,
+    locale varchar_short NULL,
+    created_at server_time_with_default NOT NULL,
+    updated_at server_time_with_default NOT NULL,
+    UNIQUE (endpoint)
+);
+
+CREATE TRIGGER set_updated_at_user_web_push_subscription
+    BEFORE UPDATE ON user_web_push_subscription
+    FOR EACH ROW
+    EXECUTE FUNCTION set_updated_at_field();
+
+CREATE INDEX idx_user_web_push_subscription_user_id ON user_web_push_subscription(user_id);
+
 
 -- Including: linear migration metadata baseline
 CREATE TABLE IF NOT EXISTS linear_migration_history (
diff --git a/infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz b/infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz
index 800f80b2..e83eea73 100644
Binary files a/infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz and b/infra/k8s/base/db/source/bootstrap/0003a_app_linear_baseline.sql.gz differ
diff --git a/infra/k8s/base/db/source/bootstrap/0003b_management_linear_baseline.sql.gz b/infra/k8s/base/db/source/bootstrap/0003b_management_linear_baseline.sql.gz
index 77e2ffba..6dec1680 100644
Binary files a/infra/k8s/base/db/source/bootstrap/0003b_management_linear_baseline.sql.gz and b/infra/k8s/base/db/source/bootstrap/0003b_management_linear_baseline.sql.gz differ
diff --git a/infra/k8s/base/management-api/deployment.yaml b/infra/k8s/base/management-api/deployment.yaml
index bdb6ef56..6656e39a 100644
--- a/infra/k8s/base/management-api/deployment.yaml
+++ b/infra/k8s/base/management-api/deployment.yaml
@@ -68,6 +68,8 @@ spec:
                 name: metaboost-db-secrets
             - secretRef:
                 name: metaboost-keyvaldb-secrets
+            - configMapRef:
+                name: metaboost-product-membership-config
           env:
             - name: DB_HOST
               value: metaboost-db
diff --git a/infra/k8s/base/management-api/source/management-api.env b/infra/k8s/base/management-api/source/management-api.env
index f68a7757..c9ff3246 100644
--- a/infra/k8s/base/management-api/source/management-api.env
+++ b/infra/k8s/base/management-api/source/management-api.env
@@ -11,14 +11,13 @@ DB_PORT=5432
 DB_APP_NAME=metaboost_app
 DB_APP_READ_USER=metaboost_app_read
 DB_APP_READ_WRITE_USER=metaboost_app_read_write
-MEMBERSHIP_DEFAULT_TRIAL_MONTHS=
-MEMBERSHIP_DEFAULT_PREMIUM_MONTHS=
+# MEMBERSHIP_FREE_TRIAL_EXPIRATION, MEMBERSHIP_PREMIUM_COST_*: metaboost-product-membership-config
 DB_MANAGEMENT_NAME=metaboost_management
 DB_MANAGEMENT_READ_WRITE_USER=metaboost_management_read_write
 MANAGEMENT_API_EXPECTED_MIGRATION_FILENAME=0001_management_schema.sql
 API_PORT=4000
 MANAGEMENT_API_VERSION_PATH=/v1
-MANAGEMENT_API_RELEASE=X.X.X-staging.N
+MANAGEMENT_API_RELEASE=X.Y.Z-staging.N
 API_PUBLIC_BASE_URL=http://api:4000
 API_SERVER_BASE_URL=http://api:4000
 WEB_PORT=4002
diff --git a/infra/k8s/base/management-web/source/management-web-sidecar.env b/infra/k8s/base/management-web/source/management-web-sidecar.env
index 4dd91c31..3b10b744 100644
--- a/infra/k8s/base/management-web/source/management-web-sidecar.env
+++ b/infra/k8s/base/management-web/source/management-web-sidecar.env
@@ -7,7 +7,7 @@ MANAGEMENT_API_SERVER_BASE_URL=http://management-api:4100
 READINESS_API_BASE_URL=http://management-api:4100
 READINESS_API_META_PATH=/v1/meta
 READINESS_API_EXPECTED_VERSION_PATH=/v1
-READINESS_API_EXPECTED_RELEASE=X.X.X-staging.N
+READINESS_API_EXPECTED_RELEASE=X.Y.Z-staging.N
 MANAGEMENT_WEB_SIDECAR_PORT=4101
 
 NEXT_PUBLIC_DEFAULT_LOCALE=en-US
@@ -18,3 +18,5 @@ NEXT_PUBLIC_MANAGEMENT_API_VERSION_PATH=/v1
 NEXT_PUBLIC_WEB_BASE_URL=http://web:4002
 NEXT_PUBLIC_MANAGEMENT_API_PUBLIC_BASE_URL=http://management-api:4100
 NEXT_PUBLIC_MANAGEMENT_SESSION_REFRESH_INTERVAL_MS=1800000
+# Resolved trial/pricing: GET {MANAGEMENT_API_VERSION_PATH}/product/membership (keys from
+# product-membership-settings.env; ConfigMap metaboost-product-membership-config is composed in alpha/common).
diff --git a/infra/k8s/base/ops/db-rebootstrap-roles.cronjob.yaml b/infra/k8s/base/ops/db-rebootstrap-roles.cronjob.yaml
new file mode 100644
index 00000000..7c966d8b
--- /dev/null
+++ b/infra/k8s/base/ops/db-rebootstrap-roles.cronjob.yaml
@@ -0,0 +1,50 @@
+# Pattern: Suspended CronJob (Manual Trigger Only)
+# Re-runs full StatefulSet bootstrap logic from `0001_create_app_db_users.sh` +
+# `0002_setup_management_database.sh` over TCP (script: rebootstrap-full-bootstrap.sh).
+# Run after DROP SCHEMA public CASCADE or role/password drift so migrator roles and grants match init.
+# Does not apply 0003 linear baselines — migrate jobs remain the forward path.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: metaboost-db-rebootstrap-roles
+spec:
+  schedule: "0 0 1 1 *"
+  suspend: true
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      ttlSecondsAfterFinished: 300
+      template:
+        metadata:
+          annotations:
+            metaboost.example.org/ops-job: db-rebootstrap-roles
+        spec:
+          restartPolicy: Never
+          enableServiceLinks: false
+          containers:
+            - name: rebootstrap-roles
+              image: postgres:18.3
+              imagePullPolicy: Always
+              command:
+                - bash
+                - /opt/scripts/database/rebootstrap-full-bootstrap.sh
+              envFrom:
+                - secretRef:
+                    name: metaboost-db-secrets
+              env:
+                - name: DB_HOST
+                  value: metaboost-db
+                - name: DB_PORT
+                  value: "5432"
+              volumeMounts:
+                - name: migration-runtime
+                  mountPath: /opt/scripts/database
+                  readOnly: true
+          volumes:
+            - name: migration-runtime
+              configMap:
+                name: metaboost-ops-migration-runtime
+                defaultMode: 0555
diff --git a/infra/k8s/base/ops/db-verify-bootstrap-contract.cronjob.yaml b/infra/k8s/base/ops/db-verify-bootstrap-contract.cronjob.yaml
new file mode 100644
index 00000000..14004d30
--- /dev/null
+++ b/infra/k8s/base/ops/db-verify-bootstrap-contract.cronjob.yaml
@@ -0,0 +1,52 @@
+# Pattern: Suspended CronJob (Manual Trigger Only)
+# Verifies extension/baseline/grant bootstrap contract for app and management databases.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: metaboost-db-verify-bootstrap-contract
+spec:
+  schedule: "0 0 1 1 *"
+  suspend: true
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      ttlSecondsAfterFinished: 300
+      template:
+        metadata:
+          annotations:
+            metaboost.example.org/migration-job: bootstrap-contract
+        spec:
+          restartPolicy: Never
+          enableServiceLinks: false
+          containers:
+            - name: verify-bootstrap-contract
+              image: postgres:18.3
+              imagePullPolicy: Always
+              command:
+                - bash
+                - /opt/scripts/database/verify-bootstrap-contract.sh
+              envFrom:
+                - secretRef:
+                    name: metaboost-db-secrets
+              env:
+                - name: DB_HOST
+                  value: metaboost-db
+                - name: DB_PORT
+                  value: "5432"
+                - name: MIGRATION_BUNDLE_SHA
+                  valueFrom:
+                    configMapKeyRef:
+                      name: metaboost-ops-migration-runtime
+                      key: MIGRATION_BUNDLE_SHA
+              volumeMounts:
+                - name: migration-runtime
+                  mountPath: /opt/scripts/database
+                  readOnly: true
+          volumes:
+            - name: migration-runtime
+              configMap:
+                name: metaboost-ops-migration-runtime
+                defaultMode: 0555
diff --git a/infra/k8s/base/ops/kustomization.yaml b/infra/k8s/base/ops/kustomization.yaml
index 3444ff24..215de996 100644
--- a/infra/k8s/base/ops/kustomization.yaml
+++ b/infra/k8s/base/ops/kustomization.yaml
@@ -4,6 +4,8 @@ kind: Kustomization
 resources:
   - db-migrate-app.cronjob.yaml
   - db-migrate-management.cronjob.yaml
+  - db-verify-bootstrap-contract.cronjob.yaml
+  - db-rebootstrap-roles.cronjob.yaml
   - management-superuser-create.cronjob.yaml
   - management-superuser-update.cronjob.yaml
 
@@ -16,13 +18,15 @@ configMapGenerator:
     files:
       - source/database/runner/run-linear-migrations.sh
       - source/database/runner/run-linear-migrations-k8s.sh
+      - source/database/runner/verify-bootstrap-contract.sh
+      - source/database/runner/rebootstrap-full-bootstrap.sh
   - name: metaboost-ops-app-migrations
     files:
       - source/database/linear-migrations/app/0001_app_schema.sql
-      - source/database/linear-migrations/app/0002_bucket_settings_public_boost_display_minimum.sql
-      - source/database/linear-migrations/app/0003_terms_default_seed.sql
-      - source/database/linear-migrations/app/0004_user_trust_and_entitlement_overrides.sql
-      - source/database/linear-migrations/app/0005_remove_user_trust_tier.sql
+      - source/database/linear-migrations/app/0002_terms_default_seed.sql
+      - source/database/linear-migrations/app/0003_user_trust_and_entitlement_overrides.sql
+      - source/database/linear-migrations/app/0004_billing_catalog_and_trust_renewal.sql
+      - source/database/linear-migrations/app/0005_billing_domain_events.sql
   - name: metaboost-ops-management-migrations
     files:
       - source/database/linear-migrations/management/0001_management_schema.sql
diff --git a/infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql b/infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql
index ac63feae..b96a0d70 100644
--- a/infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql
+++ b/infra/k8s/base/ops/source/database/linear-migrations/app/0001_app_schema.sql
@@ -361,15 +361,41 @@ CREATE INDEX idx_bucket_admin_invitation_bucket_id ON bucket_admin_invitation(bu
 CREATE INDEX idx_bucket_admin_invitation_token ON bucket_admin_invitation(token);
 CREATE INDEX idx_bucket_admin_invitation_status ON bucket_admin_invitation(status);
 
+-- Per-user notification preference per bucket (explicit rows only; no bucket-global flag).
+CREATE TABLE bucket_notification_preference (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+    bucket_id UUID NOT NULL REFERENCES bucket(id) ON DELETE CASCADE,
+    enabled BOOLEAN NOT NULL DEFAULT true,
+    created_at server_time_with_default NOT NULL,
+    updated_at server_time_with_default NOT NULL,
+    UNIQUE (user_id, bucket_id)
+);
+
+CREATE TRIGGER set_updated_at_bucket_notification_preference
+    BEFORE UPDATE ON bucket_notification_preference
+    FOR EACH ROW
+    EXECUTE FUNCTION set_updated_at_field();
+
+CREATE INDEX idx_bucket_notification_preference_user_id ON bucket_notification_preference(user_id);
+CREATE INDEX idx_bucket_notification_preference_bucket_id ON bucket_notification_preference(bucket_id);
 
--- Including: linear migration metadata baseline
-CREATE TABLE IF NOT EXISTS linear_migration_history (
-    id SERIAL PRIMARY KEY,
-    migration_filename VARCHAR(255) NOT NULL UNIQUE,
-    migration_checksum VARCHAR(64) NOT NULL,
-    applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+-- Web Push subscription endpoints (user-owned; keys + locale for dispatch).
+CREATE TABLE user_web_push_subscription (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+    endpoint varchar_url NOT NULL,
+    key_p256dh TEXT NOT NULL,
+    key_auth TEXT NOT NULL,
+    locale varchar_short NULL,
+    created_at server_time_with_default NOT NULL,
+    updated_at server_time_with_default NOT NULL,
+    UNIQUE (endpoint)
 );
 
-CREATE INDEX IF NOT EXISTS idx_linear_migration_history_applied_at
-    ON linear_migration_history(applied_at DESC);
+CREATE TRIGGER set_updated_at_user_web_push_subscription
+    BEFORE UPDATE ON user_web_push_subscription
+    FOR EACH ROW
+    EXECUTE FUNCTION set_updated_at_field();
 
+CREATE INDEX idx_user_web_push_subscription_user_id ON user_web_push_subscription(user_id);
diff --git a/infra/k8s/base/ops/source/database/linear-migrations/app/0002_bucket_settings_public_boost_display_minimum.sql b/infra/k8s/base/ops/source/database/linear-migrations/app/0002_bucket_settings_public_boost_display_minimum.sql
deleted file mode 100644
index fa3d138a..00000000
--- a/infra/k8s/base/ops/source/database/linear-migrations/app/0002_bucket_settings_public_boost_display_minimum.sql
+++ /dev/null
@@ -1,15 +0,0 @@
--- Renames bucket_settings column: former ingest minimum is now an optional public message list
--- display floor only (semantics changed). Safe when 0001 already created public_boost_display_minimum_minor.
-DO $$
-BEGIN
-  IF EXISTS (
-    SELECT 1
-    FROM information_schema.columns
-    WHERE table_schema = 'public'
-      AND table_name = 'bucket_settings'
-      AND column_name = 'minimum_message_amount_minor'
-  ) THEN
-    ALTER TABLE bucket_settings
-      RENAME COLUMN minimum_message_amount_minor TO public_boost_display_minimum_minor;
-  END IF;
-END $$;
diff --git a/infra/k8s/base/ops/source/database/linear-migrations/app/0003_terms_default_seed.sql b/infra/k8s/base/ops/source/database/linear-migrations/app/0002_terms_default_seed.sql
similarity index 80%
rename from infra/k8s/base/ops/source/database/linear-migrations/app/0003_terms_default_seed.sql
rename to infra/k8s/base/ops/source/database/linear-migrations/app/0002_terms_default_seed.sql
index c08799b8..5bfb4dcb 100644
--- a/infra/k8s/base/ops/source/database/linear-migrations/app/0003_terms_default_seed.sql
+++ b/infra/k8s/base/ops/source/database/linear-migrations/app/0002_terms_default_seed.sql
@@ -1,22 +1,22 @@
--- Forward-only: seed default terms when no current/upcoming row exists.
+-- Forward-only: seed default terms for fresh databases.
 -- Must stay aligned with packages/orm/src/defaults/termsDefaultContent.ts and TermsVersionService.assertConfiguredForStartup.
 
-WITH ins AS (
-  INSERT INTO terms_version (version_key, title, content_hash, announcement_starts_at, enforcement_starts_at, status)
-  SELECT
-    'default-bootstrap-2026-01-01',
-    'Agree to Terms of Service',
-    '8a29355eaba9fb246479f5db3f05e0d53739309bb2d093866b77ced9bc2000d2',
-    NULL,
-    TIMESTAMP '2026-01-01 00:00:00',
-    'current'
-  WHERE NOT EXISTS (
-    SELECT 1 FROM terms_version WHERE status IN ('current', 'upcoming')
-  )
-  RETURNING id
-)
+-- Deterministic id keeps linear baseline pg_dump snapshots reproducible across generator runs.
+INSERT INTO terms_version (id, version_key, title, content_hash, announcement_starts_at, enforcement_starts_at, status)
+VALUES (
+  'a0000000-0000-4000-8000-000000000001'::uuid,
+  'default-bootstrap-2026-01-01',
+  'Agree to Terms of Service',
+  '8a29355eaba9fb246479f5db3f05e0d53739309bb2d093866b77ced9bc2000d2',
+  NULL,
+  TIMESTAMP '2026-01-01 00:00:00',
+  'current'
+);
+
 INSERT INTO terms_version_content (terms_version_id, content_text_en_us, content_text_es)
-SELECT ins.id, $terms_en$**Acceptance and eligibility**
+VALUES (
+  'a0000000-0000-4000-8000-000000000001'::uuid,
+  $terms_en$**Acceptance and eligibility**
 You must accept the latest terms to continue. Accepting now keeps your account eligible to receive Metaboost messages.
 **Scope**
 These terms apply to MetaBoost message and related metadata delivery. By using the service, you agree to the terms below.
@@ -29,7 +29,8 @@ A message does not guarantee that a payment was sent, settled, or received. Paym
 **Refunds and disputes**
 If payment is successful but a message is missing, delayed, or not associated correctly, MetaBoost does not issue refunds. Payment disputes must be handled between the message sender, the content creator, and the payment service provider.
 **Availability**
-Message acceptance and retrieval are provided on a best-effort basis. Downtime, network issues, provider outages, or malformed payloads may affect delivery or display.$terms_en$, $terms_es$**Aceptación y elegibilidad**
+Message acceptance and retrieval are provided on a best-effort basis. Downtime, network issues, provider outages, or malformed payloads may affect delivery or display.$terms_en$,
+  $terms_es$**Aceptación y elegibilidad**
 Debes aceptar los términos más recientes para continuar. Si aceptas ahora, tu cuenta sigue siendo apta para recibir mensajes de Metaboost.
 **Alcance**
 Estos términos se aplican a la entrega de mensajes de MetaBoost y metadatos relacionados. Al usar el servicio, aceptas los términos a continuación.
@@ -43,4 +44,4 @@ Un mensaje no garantiza que un pago haya sido enviado, liquidado o recibido. El
 Si el pago se realiza correctamente pero falta un mensaje, se retrasa o no se asocia correctamente, MetaBoost no emite reembolsos. Las disputas de pago deben resolverse entre quien envía el mensaje, el creador de contenido y el proveedor de servicios de pago.
 **Disponibilidad**
 La aceptación y recuperación de mensajes se ofrece sobre una base de mejor esfuerzo. Caídas, problemas de red, interrupciones del proveedor o cargas mal formadas pueden afectar la entrega o visualización.$terms_es$
-FROM ins;
+);
diff --git a/infra/k8s/base/ops/source/database/linear-migrations/app/0004_user_trust_and_entitlement_overrides.sql b/infra/k8s/base/ops/source/database/linear-migrations/app/0003_user_trust_and_entitlement_overrides.sql
similarity index 77%
rename from infra/k8s/base/ops/source/database/linear-migrations/app/0004_user_trust_and_entitlement_overrides.sql
rename to infra/k8s/base/ops/source/database/linear-migrations/app/0003_user_trust_and_entitlement_overrides.sql
index 166822bf..90d44c7f 100644
--- a/infra/k8s/base/ops/source/database/linear-migrations/app/0004_user_trust_and_entitlement_overrides.sql
+++ b/infra/k8s/base/ops/source/database/linear-migrations/app/0003_user_trust_and_entitlement_overrides.sql
@@ -1,17 +1,16 @@
 -- Forward-only: add membership lifecycle and trust foundation.
 -- Schema-only phase; no runtime gating behavior is enabled by this migration.
+-- Greenfield: omit legacy trust_tier_id (removed in earlier chains as a follow-up migration).
 
 CREATE TABLE user_trust_settings (
   user_id UUID PRIMARY KEY REFERENCES "user"(id) ON DELETE CASCADE,
   membership_tier VARCHAR(32) NOT NULL DEFAULT 'trial',
   membership_expires_at TIMESTAMP NULL,
   auto_renew BOOLEAN NOT NULL DEFAULT false,
-  trust_tier_id INTEGER NOT NULL DEFAULT 1,
   created_at server_time_with_default NOT NULL,
   updated_at server_time_with_default NOT NULL,
   CONSTRAINT chk_user_trust_settings_membership_tier
     CHECK (membership_tier IN ('trial', 'premium')),
-  CONSTRAINT chk_user_trust_settings_trust_tier_id CHECK (trust_tier_id IN (1, 2)),
   CONSTRAINT chk_user_trust_settings_membership_expires_after_epoch
     CHECK (membership_expires_at IS NULL OR membership_expires_at > TIMESTAMP '1970-01-01 00:00:00')
 );
@@ -21,8 +20,6 @@ CREATE TRIGGER set_updated_at_user_trust_settings
   FOR EACH ROW
   EXECUTE FUNCTION set_updated_at_field();
 
-INSERT INTO user_trust_settings (user_id, membership_tier, auto_renew, trust_tier_id)
-SELECT u.id, 'trial', false, 1
-FROM "user" AS u
-LEFT JOIN user_trust_settings uts ON uts.user_id = u.id
-WHERE uts.user_id IS NULL;
+INSERT INTO user_trust_settings (user_id, membership_tier, auto_renew)
+SELECT u.id, 'trial', false
+FROM "user" AS u;
diff --git a/infra/k8s/base/ops/source/database/linear-migrations/app/0004_billing_catalog_and_trust_renewal.sql b/infra/k8s/base/ops/source/database/linear-migrations/app/0004_billing_catalog_and_trust_renewal.sql
new file mode 100644
index 00000000..047283ae
--- /dev/null
+++ b/infra/k8s/base/ops/source/database/linear-migrations/app/0004_billing_catalog_and_trust_renewal.sql
@@ -0,0 +1,138 @@
+-- Forward-only: billing product/price catalog, membership trial settings, renewal metadata on trust settings.
+
+CREATE TABLE billing_product (
+    id SERIAL PRIMARY KEY,
+    product_code TEXT NOT NULL UNIQUE,
+    name TEXT NOT NULL,
+    is_active BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at server_time_with_default NOT NULL,
+    updated_at server_time_with_default NOT NULL
+);
+
+CREATE TRIGGER set_updated_at_billing_product
+    BEFORE UPDATE ON billing_product
+    FOR EACH ROW
+    EXECUTE FUNCTION set_updated_at_field();
+
+CREATE TABLE billing_price (
+    id SERIAL PRIMARY KEY,
+    billing_product_id INTEGER NOT NULL REFERENCES billing_product(id) ON DELETE CASCADE,
+    currency_code CHAR(3) NOT NULL,
+    billing_cadence TEXT NOT NULL CHECK (billing_cadence IN ('monthly', 'annual')),
+    amount_cents INTEGER NOT NULL CHECK (amount_cents >= 0),
+    effective_from TIMESTAMP NOT NULL DEFAULT NOW(),
+    effective_to TIMESTAMP,
+    source TEXT NOT NULL DEFAULT 'manual',
+    created_at server_time_with_default NOT NULL,
+    updated_at server_time_with_default NOT NULL,
+    CONSTRAINT billing_price_effective_window_check CHECK (
+      effective_to IS NULL OR effective_to > effective_from
+    ),
+    CONSTRAINT billing_price_unique_window_start UNIQUE (
+      billing_product_id,
+      currency_code,
+      billing_cadence,
+      effective_from
+    )
+);
+
+CREATE TRIGGER set_updated_at_billing_price
+    BEFORE UPDATE ON billing_price
+    FOR EACH ROW
+    EXECUTE FUNCTION set_updated_at_field();
+
+CREATE UNIQUE INDEX uq_billing_price_open_window
+  ON billing_price (billing_product_id, currency_code, billing_cadence)
+  WHERE effective_to IS NULL;
+
+CREATE INDEX idx_billing_price_effective_lookup
+  ON billing_price (billing_product_id, billing_cadence, currency_code, effective_from DESC);
+
+CREATE TABLE billing_price_change_audit (
+    id SERIAL PRIMARY KEY,
+    billing_price_id INTEGER REFERENCES billing_price(id) ON DELETE SET NULL,
+    changed_by_management_user_id UUID,
+    change_reason TEXT,
+    previous_amount_cents INTEGER CHECK (previous_amount_cents IS NULL OR previous_amount_cents >= 0),
+    new_amount_cents INTEGER CHECK (new_amount_cents IS NULL OR new_amount_cents >= 0),
+    previous_effective_from TIMESTAMP,
+    previous_effective_to TIMESTAMP,
+    new_effective_from TIMESTAMP,
+    new_effective_to TIMESTAMP,
+    created_at server_time_with_default NOT NULL
+);
+
+INSERT INTO billing_product (product_code, name, is_active)
+VALUES ('membership_premium', 'Premium Membership', TRUE);
+
+INSERT INTO billing_price (
+  billing_product_id,
+  currency_code,
+  billing_cadence,
+  amount_cents,
+  effective_from,
+  effective_to,
+  source
+)
+SELECT bp.id, 'USD', 'monthly', 300, TIMESTAMP '2000-01-01 00:00:00', NULL, 'seed'
+FROM billing_product bp
+WHERE bp.product_code = 'membership_premium';
+
+INSERT INTO billing_price (
+  billing_product_id,
+  currency_code,
+  billing_cadence,
+  amount_cents,
+  effective_from,
+  effective_to,
+  source
+)
+SELECT bp.id, 'USD', 'annual', 3000, TIMESTAMP '2000-01-01 00:00:00', NULL, 'seed'
+FROM billing_product bp
+WHERE bp.product_code = 'membership_premium';
+
+CREATE TABLE product_membership_settings (
+    id INTEGER PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+    free_trial_expiration_seconds INTEGER NOT NULL CHECK (free_trial_expiration_seconds > 0),
+    created_at server_time_with_default NOT NULL,
+    updated_at server_time_with_default NOT NULL
+);
+
+CREATE TRIGGER set_updated_at_product_membership_settings
+    BEFORE UPDATE ON product_membership_settings
+    FOR EACH ROW
+    EXECUTE FUNCTION set_updated_at_field();
+
+INSERT INTO product_membership_settings (
+  id,
+  free_trial_expiration_seconds,
+  created_at,
+  updated_at
+)
+VALUES (1, 2678400, TIMESTAMP '2000-01-01 00:00:00', TIMESTAMP '2000-01-01 00:00:00');
+
+ALTER TABLE user_trust_settings
+  ADD COLUMN billing_cadence TEXT CHECK (
+    billing_cadence IS NULL OR billing_cadence IN ('monthly', 'annual')
+  ),
+  ADD COLUMN auto_renew_mode TEXT NOT NULL DEFAULT 'off' CHECK (auto_renew_mode IN ('off', 'on')),
+  ADD COLUMN next_renewal_attempt_at TIMESTAMP,
+  ADD COLUMN last_renewal_attempt_at TIMESTAMP,
+  ADD COLUMN last_renewal_status TEXT NOT NULL DEFAULT 'none' CHECK (
+    last_renewal_status IN ('none', 'succeeded', 'failed')
+  ),
+  ADD COLUMN last_extension_idempotency_key VARCHAR(128),
+  ADD COLUMN last_renewal_idempotency_key VARCHAR(128),
+  ADD COLUMN renewal_retry_count INTEGER NOT NULL DEFAULT 0,
+  ADD COLUMN renewal_retry_backoff_until TIMESTAMP;
+
+UPDATE user_trust_settings
+SET auto_renew_mode = CASE WHEN auto_renew THEN 'on' ELSE 'off' END;
+
+CREATE INDEX idx_user_trust_settings_next_renewal_attempt_at
+  ON user_trust_settings(next_renewal_attempt_at)
+  WHERE next_renewal_attempt_at IS NOT NULL;
+
+CREATE INDEX idx_user_trust_settings_renewal_retry_backoff_until
+  ON user_trust_settings(renewal_retry_backoff_until)
+  WHERE renewal_retry_backoff_until IS NOT NULL;
diff --git a/infra/k8s/base/ops/source/database/linear-migrations/app/0005_billing_domain_events.sql b/infra/k8s/base/ops/source/database/linear-migrations/app/0005_billing_domain_events.sql
new file mode 100644
index 00000000..44855a3b
--- /dev/null
+++ b/infra/k8s/base/ops/source/database/linear-migrations/app/0005_billing_domain_events.sql
@@ -0,0 +1,25 @@
+-- Forward-only: append-only billing domain events for orchestration and audit.
+
+CREATE TABLE billing_domain_event (
+    id SERIAL PRIMARY KEY,
+    event_type TEXT NOT NULL CHECK (event_type IN (
+      'payment_settled',
+      'renewal_succeeded',
+      'renewal_failed',
+      'pay_on_demand_extension_requested'
+    )),
+    user_id UUID NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+    idempotency_key VARCHAR(128),
+    payload JSONB NOT NULL DEFAULT '{}'::jsonb,
+    created_at server_time_with_default NOT NULL
+);
+
+CREATE UNIQUE INDEX uq_billing_domain_event_idempotency_key
+  ON billing_domain_event (idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+CREATE INDEX idx_billing_domain_event_user_created
+  ON billing_domain_event (user_id, created_at DESC);
+
+CREATE INDEX idx_billing_domain_event_type_created
+  ON billing_domain_event (event_type, created_at DESC);
diff --git a/infra/k8s/base/ops/source/database/linear-migrations/app/0005_remove_user_trust_tier.sql b/infra/k8s/base/ops/source/database/linear-migrations/app/0005_remove_user_trust_tier.sql
deleted file mode 100644
index d23edc40..00000000
--- a/infra/k8s/base/ops/source/database/linear-migrations/app/0005_remove_user_trust_tier.sql
+++ /dev/null
@@ -1,8 +0,0 @@
--- Forward-only: hard break trust-tier semantics from user_trust_settings.
--- Runtime eligibility is membership-tier + expiry driven; advanced overrides remain separate.
-
-ALTER TABLE user_trust_settings
-DROP CONSTRAINT IF EXISTS chk_user_trust_settings_trust_tier_id;
-
-ALTER TABLE user_trust_settings
-DROP COLUMN IF EXISTS trust_tier_id;
diff --git a/infra/k8s/base/ops/source/database/linear-migrations/management/0001_management_schema.sql b/infra/k8s/base/ops/source/database/linear-migrations/management/0001_management_schema.sql
index cec1b437..7b4f3944 100644
--- a/infra/k8s/base/ops/source/database/linear-migrations/management/0001_management_schema.sql
+++ b/infra/k8s/base/ops/source/database/linear-migrations/management/0001_management_schema.sql
@@ -13,7 +13,7 @@ CREATE DOMAIN server_time_with_default AS TIMESTAMPTZ DEFAULT NOW();
 -- 0001 migration: management_user – super admin singleton + admins (with credentials and bio 1:1)
 
 -- Core management user row (no email/password here; see management_user_credentials)
-CREATE TABLE IF NOT EXISTS management_user (
+CREATE TABLE management_user (
     id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     is_super_admin BOOLEAN NOT NULL DEFAULT false,
     created_at server_time_with_default NOT NULL,
@@ -21,18 +21,18 @@ CREATE TABLE IF NOT EXISTS management_user (
 );
 
 -- At most one row with is_super_admin = true
-CREATE UNIQUE INDEX IF NOT EXISTS idx_one_super_admin ON management_user(is_super_admin) WHERE is_super_admin = true;
+CREATE UNIQUE INDEX idx_one_super_admin ON management_user(is_super_admin) WHERE is_super_admin = true;
 
 -- Credentials: username and password (1:1 with management_user); management-web auth is username-only.
 -- JWT `id_text` matches username; `isValidManagementJwtIdText` enforces 1..USERNAME_MAX_LENGTH (varchar_short = 50).
-CREATE TABLE IF NOT EXISTS management_user_credentials (
+CREATE TABLE management_user_credentials (
     management_user_id UUID PRIMARY KEY REFERENCES management_user(id) ON DELETE CASCADE,
     username varchar_short UNIQUE NOT NULL,
     password_hash varchar_password NOT NULL
 );
 
 -- Bio: display name (1:1 with management_user); unique so admins are distinguishable without ID
-CREATE TABLE IF NOT EXISTS management_user_bio (
+CREATE TABLE management_user_bio (
     management_user_id UUID PRIMARY KEY REFERENCES management_user(id) ON DELETE CASCADE,
     display_name varchar_short NOT NULL UNIQUE
 );
@@ -47,13 +47,14 @@ CREATE TABLE IF NOT EXISTS management_user_bio (
 -- bucket_admins_crud: per-bucket admin/invitation management (list, create, update, delete).
 -- Capabilities such as changing passwords or assigning permissions are implied by
 -- the relevant CRUD bits (e.g. update on users implies password changes).
-CREATE TABLE IF NOT EXISTS admin_permissions (
+CREATE TABLE admin_permissions (
     admin_id UUID PRIMARY KEY REFERENCES management_user(id) ON DELETE CASCADE,
     admins_crud INTEGER NOT NULL DEFAULT 0 CHECK (admins_crud >= 0 AND admins_crud <= 15),
     users_crud INTEGER NOT NULL DEFAULT 0 CHECK (users_crud >= 0 AND users_crud <= 15),
     buckets_crud INTEGER NOT NULL DEFAULT 0 CHECK (buckets_crud >= 0 AND buckets_crud <= 15),
     bucket_messages_crud INTEGER NOT NULL DEFAULT 0 CHECK (bucket_messages_crud >= 0 AND bucket_messages_crud <= 15),
     bucket_admins_crud INTEGER NOT NULL DEFAULT 0 CHECK (bucket_admins_crud >= 0 AND bucket_admins_crud <= 15),
+    billing_prices_crud INTEGER NOT NULL DEFAULT 0 CHECK (billing_prices_crud >= 0 AND billing_prices_crud <= 15),
     event_visibility TEXT NOT NULL DEFAULT 'all_admins' CHECK(event_visibility IN ('own', 'all_admins', 'all'))
 );
 
@@ -63,7 +64,7 @@ CREATE TABLE IF NOT EXISTS admin_permissions (
 
 -- Audit log: every action by super admin or admin
 -- actor_display_name is stored at event time so it survives admin deletion or display name changes.
-CREATE TABLE IF NOT EXISTS management_event (
+CREATE TABLE management_event (
     id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     actor_id TEXT NOT NULL,
     actor_type TEXT NOT NULL CHECK(actor_type IN ('super_admin', 'admin')),
@@ -75,8 +76,8 @@ CREATE TABLE IF NOT EXISTS management_event (
     details TEXT
 );
 
-CREATE INDEX IF NOT EXISTS idx_management_event_actor ON management_event(actor_id);
-CREATE INDEX IF NOT EXISTS idx_management_event_timestamp ON management_event(timestamp);
+CREATE INDEX idx_management_event_actor ON management_event(actor_id);
+CREATE INDEX idx_management_event_timestamp ON management_event(timestamp);
 
 
 -- Including: 0004_management_refresh_token.sql
@@ -108,19 +109,7 @@ CREATE TABLE management_admin_role (
     buckets_crud INTEGER NOT NULL CHECK (buckets_crud >= 0 AND buckets_crud <= 15),
     bucket_messages_crud INTEGER NOT NULL CHECK (bucket_messages_crud >= 0 AND bucket_messages_crud <= 15),
     bucket_admins_crud INTEGER NOT NULL CHECK (bucket_admins_crud >= 0 AND bucket_admins_crud <= 15),
+    billing_prices_crud INTEGER NOT NULL DEFAULT 0 CHECK (billing_prices_crud >= 0 AND billing_prices_crud <= 15),
     event_visibility TEXT NOT NULL CHECK(event_visibility IN ('own', 'all_admins', 'all')),
     created_at server_time_with_default NOT NULL
 );
-
-
--- Including: linear migration metadata baseline
-CREATE TABLE IF NOT EXISTS linear_migration_history (
-    id SERIAL PRIMARY KEY,
-    migration_filename VARCHAR(255) NOT NULL UNIQUE,
-    migration_checksum VARCHAR(64) NOT NULL,
-    applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
-);
-
-CREATE INDEX IF NOT EXISTS idx_linear_migration_history_applied_at
-    ON linear_migration_history(applied_at DESC);
-
diff --git a/infra/k8s/base/ops/source/database/runner/rebootstrap-full-bootstrap.sh b/infra/k8s/base/ops/source/database/runner/rebootstrap-full-bootstrap.sh
new file mode 100755
index 00000000..13011b72
--- /dev/null
+++ b/infra/k8s/base/ops/source/database/runner/rebootstrap-full-bootstrap.sh
@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# Ops-only: mirrors StatefulSet bootstrap `0001_create_app_db_users.sh` +
+# `0002_setup_management_database.sh` over TCP with passwords (PGHOST/PGPASSWORD).
+# Keep aligned when editing:
+#   infra/k8s/base/db/source/bootstrap/0001_create_app_db_users.sh
+#   infra/k8s/base/db/source/bootstrap/0002_setup_management_database.sh
+#
+# Required env: metaboost-db-secrets keys (same as bootstrap shells).
+
+set -euo pipefail
+
+export PGHOST="${DB_HOST:-metaboost-db}"
+export PGPORT="${DB_PORT:-5432}"
+
+: "${DB_APP_OWNER_USER:?Missing DB_APP_OWNER_USER}"
+: "${DB_APP_OWNER_PASSWORD:?Missing DB_APP_OWNER_PASSWORD}"
+: "${DB_APP_NAME:?Missing DB_APP_NAME}"
+: "${DB_APP_MIGRATOR_USER:?Missing DB_APP_MIGRATOR_USER}"
+: "${DB_APP_MIGRATOR_PASSWORD:?Missing DB_APP_MIGRATOR_PASSWORD}"
+: "${DB_APP_READ_WRITE_USER:?Missing DB_APP_READ_WRITE_USER}"
+: "${DB_APP_READ_WRITE_PASSWORD:?Missing DB_APP_READ_WRITE_PASSWORD}"
+: "${DB_APP_READ_USER:?Missing DB_APP_READ_USER}"
+: "${DB_APP_READ_PASSWORD:?Missing DB_APP_READ_PASSWORD}"
+
+: "${DB_MANAGEMENT_NAME:?Missing DB_MANAGEMENT_NAME}"
+: "${DB_MANAGEMENT_OWNER_USER:?Missing DB_MANAGEMENT_OWNER_USER}"
+: "${DB_MANAGEMENT_OWNER_PASSWORD:?Missing DB_MANAGEMENT_OWNER_PASSWORD}"
+: "${DB_MANAGEMENT_MIGRATOR_USER:?Missing DB_MANAGEMENT_MIGRATOR_USER}"
+: "${DB_MANAGEMENT_MIGRATOR_PASSWORD:?Missing DB_MANAGEMENT_MIGRATOR_PASSWORD}"
+: "${DB_MANAGEMENT_READ_WRITE_USER:?Missing DB_MANAGEMENT_READ_WRITE_USER}"
+: "${DB_MANAGEMENT_READ_WRITE_PASSWORD:?Missing DB_MANAGEMENT_READ_WRITE_PASSWORD}"
+: "${DB_MANAGEMENT_READ_USER:?Missing DB_MANAGEMENT_READ_USER}"
+: "${DB_MANAGEMENT_READ_PASSWORD:?Missing DB_MANAGEMENT_READ_PASSWORD}"
+
+echo "rebootstrap-full-bootstrap: Phase A — app DB (${DB_APP_NAME}) same as 0001_create_app_db_users.sh"
+
+export PGPASSWORD="${DB_APP_OWNER_PASSWORD}"
+psql -v ON_ERROR_STOP=1 --username "${DB_APP_OWNER_USER}" --dbname "${DB_APP_NAME}" <<SQL
+DO \$\$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_APP_MIGRATOR_USER}') THEN
+        EXECUTE format('CREATE USER %I WITH PASSWORD %L', '${DB_APP_MIGRATOR_USER}', '${DB_APP_MIGRATOR_PASSWORD}');
+    END IF;
+END
+\$\$;
+
+DO \$\$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_APP_READ_WRITE_USER}') THEN
+        EXECUTE format('CREATE USER %I WITH PASSWORD %L', '${DB_APP_READ_WRITE_USER}', '${DB_APP_READ_WRITE_PASSWORD}');
+    END IF;
+END
+\$\$;
+
+DO \$\$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_APP_READ_USER}') THEN
+        EXECUTE format('CREATE USER %I WITH PASSWORD %L', '${DB_APP_READ_USER}', '${DB_APP_READ_PASSWORD}');
+    END IF;
+END
+\$\$;
+
+DO \$\$
+BEGIN
+    EXECUTE format('ALTER USER %I WITH PASSWORD %L', '${DB_APP_MIGRATOR_USER}', '${DB_APP_MIGRATOR_PASSWORD}');
+    EXECUTE format('ALTER USER %I WITH PASSWORD %L', '${DB_APP_READ_WRITE_USER}', '${DB_APP_READ_WRITE_PASSWORD}');
+    EXECUTE format('ALTER USER %I WITH PASSWORD %L', '${DB_APP_READ_USER}', '${DB_APP_READ_PASSWORD}');
+END
+\$\$;
+
+GRANT CONNECT ON DATABASE ${DB_APP_NAME} TO ${DB_APP_MIGRATOR_USER}, ${DB_APP_READ_WRITE_USER}, ${DB_APP_READ_USER};
+GRANT USAGE, CREATE ON SCHEMA public TO ${DB_APP_MIGRATOR_USER};
+SQL
+
+export PGPASSWORD="${DB_APP_MIGRATOR_PASSWORD}"
+psql -v ON_ERROR_STOP=1 --username "${DB_APP_MIGRATOR_USER}" --dbname "${DB_APP_NAME}" <<SQL
+GRANT USAGE ON SCHEMA public TO ${DB_APP_READ_WRITE_USER}, ${DB_APP_READ_USER};
+
+GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON ALL TABLES IN SCHEMA public TO ${DB_APP_READ_WRITE_USER};
+GRANT SELECT, USAGE, UPDATE ON ALL SEQUENCES IN SCHEMA public TO ${DB_APP_READ_WRITE_USER};
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${DB_APP_READ_USER};
+GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO ${DB_APP_READ_USER};
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON TABLES TO ${DB_APP_READ_WRITE_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, USAGE, UPDATE ON SEQUENCES TO ${DB_APP_READ_WRITE_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${DB_APP_READ_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON SEQUENCES TO ${DB_APP_READ_USER};
+SQL
+
+echo "rebootstrap-full-bootstrap: Phase B — management roles + DB same as 0002_setup_management_database.sh"
+
+export PGPASSWORD="${DB_APP_OWNER_PASSWORD}"
+psql -v ON_ERROR_STOP=1 --username "${DB_APP_OWNER_USER}" --dbname "${DB_APP_NAME}" <<SQL
+DO \$\$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_MANAGEMENT_OWNER_USER}') THEN
+        EXECUTE format('CREATE USER %I WITH PASSWORD %L', '${DB_MANAGEMENT_OWNER_USER}', '${DB_MANAGEMENT_OWNER_PASSWORD}');
+    ELSE
+        EXECUTE format('ALTER USER %I WITH NOCREATEDB NOCREATEROLE PASSWORD %L', '${DB_MANAGEMENT_OWNER_USER}', '${DB_MANAGEMENT_OWNER_PASSWORD}');
+    END IF;
+END
+\$\$;
+
+DO \$\$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_MANAGEMENT_MIGRATOR_USER}') THEN
+        EXECUTE format('CREATE USER %I WITH PASSWORD %L', '${DB_MANAGEMENT_MIGRATOR_USER}', '${DB_MANAGEMENT_MIGRATOR_PASSWORD}');
+    END IF;
+END
+\$\$;
+
+DO \$\$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_MANAGEMENT_READ_WRITE_USER}') THEN
+        EXECUTE format('CREATE USER %I WITH PASSWORD %L', '${DB_MANAGEMENT_READ_WRITE_USER}', '${DB_MANAGEMENT_READ_WRITE_PASSWORD}');
+    END IF;
+END
+\$\$;
+
+DO \$\$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_MANAGEMENT_READ_USER}') THEN
+        EXECUTE format('CREATE USER %I WITH PASSWORD %L', '${DB_MANAGEMENT_READ_USER}', '${DB_MANAGEMENT_READ_PASSWORD}');
+    END IF;
+END
+\$\$;
+SQL
+
+DB_EXISTS="$(psql -v ON_ERROR_STOP=1 -U "${DB_APP_OWNER_USER}" -d "${DB_APP_NAME}" -tAc "SELECT 1 FROM pg_database WHERE datname='${DB_MANAGEMENT_NAME}'")"
+if [[ "${DB_EXISTS}" != "1" ]]; then
+  psql -v ON_ERROR_STOP=1 -U "${DB_APP_OWNER_USER}" -d "${DB_APP_NAME}" -c "CREATE DATABASE ${DB_MANAGEMENT_NAME} OWNER ${DB_MANAGEMENT_OWNER_USER};"
+fi
+
+psql -v ON_ERROR_STOP=1 --username "${DB_APP_OWNER_USER}" --dbname "${DB_APP_NAME}" -c "ALTER USER \"${DB_MANAGEMENT_OWNER_USER}\" WITH PASSWORD '${DB_MANAGEMENT_OWNER_PASSWORD}';"
+psql -v ON_ERROR_STOP=1 --username "${DB_APP_OWNER_USER}" --dbname "${DB_APP_NAME}" -c "ALTER USER \"${DB_MANAGEMENT_MIGRATOR_USER}\" WITH PASSWORD '${DB_MANAGEMENT_MIGRATOR_PASSWORD}';"
+psql -v ON_ERROR_STOP=1 --username "${DB_APP_OWNER_USER}" --dbname "${DB_APP_NAME}" -c "ALTER USER \"${DB_MANAGEMENT_READ_WRITE_USER}\" WITH PASSWORD '${DB_MANAGEMENT_READ_WRITE_PASSWORD}';"
+psql -v ON_ERROR_STOP=1 --username "${DB_APP_OWNER_USER}" --dbname "${DB_APP_NAME}" -c "ALTER USER \"${DB_MANAGEMENT_READ_USER}\" WITH PASSWORD '${DB_MANAGEMENT_READ_PASSWORD}';"
+psql -v ON_ERROR_STOP=1 --username "${DB_APP_OWNER_USER}" --dbname "${DB_APP_NAME}" -c "ALTER DATABASE \"${DB_MANAGEMENT_NAME}\" OWNER TO \"${DB_MANAGEMENT_OWNER_USER}\";"
+
+echo "rebootstrap-full-bootstrap: Phase C — management DB (${DB_MANAGEMENT_NAME}) grants same as end of 0002"
+
+export PGPASSWORD="${DB_MANAGEMENT_OWNER_PASSWORD}"
+psql -v ON_ERROR_STOP=1 --username "${DB_MANAGEMENT_OWNER_USER}" --dbname "${DB_MANAGEMENT_NAME}" <<SQL
+GRANT CONNECT ON DATABASE ${DB_MANAGEMENT_NAME} TO ${DB_MANAGEMENT_MIGRATOR_USER}, ${DB_MANAGEMENT_READ_WRITE_USER}, ${DB_MANAGEMENT_READ_USER};
+GRANT USAGE, CREATE ON SCHEMA public TO ${DB_MANAGEMENT_MIGRATOR_USER};
+SQL
+
+export PGPASSWORD="${DB_MANAGEMENT_MIGRATOR_PASSWORD}"
+psql -v ON_ERROR_STOP=1 --username "${DB_MANAGEMENT_MIGRATOR_USER}" --dbname "${DB_MANAGEMENT_NAME}" <<SQL
+DO \$\$
+BEGIN
+    IF NOT has_schema_privilege('${DB_MANAGEMENT_READ_WRITE_USER}', 'public', 'USAGE') THEN
+        EXECUTE format('GRANT USAGE ON SCHEMA public TO %I', '${DB_MANAGEMENT_READ_WRITE_USER}');
+    END IF;
+
+    IF NOT has_schema_privilege('${DB_MANAGEMENT_READ_USER}', 'public', 'USAGE') THEN
+        EXECUTE format('GRANT USAGE ON SCHEMA public TO %I', '${DB_MANAGEMENT_READ_USER}');
+    END IF;
+END
+\$\$;
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ${DB_MANAGEMENT_READ_WRITE_USER};
+GRANT SELECT, USAGE, UPDATE ON ALL SEQUENCES IN SCHEMA public TO ${DB_MANAGEMENT_READ_WRITE_USER};
+
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${DB_MANAGEMENT_READ_USER};
+GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO ${DB_MANAGEMENT_READ_USER};
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${DB_MANAGEMENT_READ_WRITE_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, USAGE, UPDATE ON SEQUENCES TO ${DB_MANAGEMENT_READ_WRITE_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${DB_MANAGEMENT_READ_USER};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON SEQUENCES TO ${DB_MANAGEMENT_READ_USER};
+SQL
+
+echo "rebootstrap-full-bootstrap: completed successfully."
diff --git a/infra/k8s/base/product-membership/kustomization.yaml b/infra/k8s/base/product-membership/kustomization.yaml
new file mode 100644
index 00000000..3764d1a9
--- /dev/null
+++ b/infra/k8s/base/product-membership/kustomization.yaml
@@ -0,0 +1,11 @@
+# Shared membership / pricing env (api + management-api).
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+configMapGenerator:
+  - name: metaboost-product-membership-config
+    envs:
+      - source/product-membership-settings.env
+
+generatorOptions:
+  disableNameSuffixHash: true
diff --git a/infra/k8s/base/product-membership/source/product-membership-settings.env b/infra/k8s/base/product-membership/source/product-membership-settings.env
new file mode 100644
index 00000000..8c394fb9
--- /dev/null
+++ b/infra/k8s/base/product-membership/source/product-membership-settings.env
@@ -0,0 +1,6 @@
+# Trial length (seconds) and premium pricing (USD). Overlap with source/api.env is intentional;
+# this ConfigMap is mounted last on api and management-api so it wins.
+# Compose base/product-membership in alpha/common (or GitOps common overlay), not per workload app.
+MEMBERSHIP_FREE_TRIAL_EXPIRATION=2678400
+MEMBERSHIP_PREMIUM_COST_MONTHLY=3
+MEMBERSHIP_PREMIUM_COST_ANNUALLY=30
diff --git a/infra/k8s/base/web/source/web-sidecar.env b/infra/k8s/base/web/source/web-sidecar.env
index a826629a..ca0c4b7c 100644
--- a/infra/k8s/base/web/source/web-sidecar.env
+++ b/infra/k8s/base/web/source/web-sidecar.env
@@ -3,7 +3,7 @@ API_SERVER_BASE_URL=http://api:4000
 READINESS_API_BASE_URL=http://api:4000
 READINESS_API_META_PATH=/v1/meta
 READINESS_API_EXPECTED_VERSION_PATH=/v1
-READINESS_API_EXPECTED_RELEASE=X.X.X-staging.N
+READINESS_API_EXPECTED_RELEASE=X.Y.Z-staging.N
 WEB_PORT=4002
 WEB_SIDECAR_PORT=4001
 
@@ -17,3 +17,6 @@ NEXT_PUBLIC_API_VERSION_PATH=/v1
 NEXT_PUBLIC_API_PUBLIC_BASE_URL=http://api:4000
 NEXT_PUBLIC_WEB_BASE_URL=http://web:4002
 NEXT_PUBLIC_SESSION_REFRESH_INTERVAL_MS=600000
+NEXT_PUBLIC_WEBPUSH_ENABLED=
+NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY=
+NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY=
diff --git a/infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md b/infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md
index 5143f079..8545de25 100644
--- a/infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md
+++ b/infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md
@@ -4,7 +4,7 @@ SOPS-encrypted Kubernetes **Secret** manifests for Metaboost GitOps. Run from th
 
 Canonical copies also live under **`metaboost.cc/scripts/secret-generators/`** for GitOps-only workflows; keep them aligned when changing generators here.
 
-**CI:** [`.github/workflows/metaboost-infra-alpha-contracts.yml`](../../../../.github/workflows/metaboost-infra-alpha-contracts.yml) runs pinned **`kustomize build`** on **`infra/k8s/alpha/*`** overlays when **`infra/k8s/**`** changes (no cluster apply). Full SOPS auto-gen + DB + version contracts run in **`metaboost.cc`** — see **`metaboost.cc/scripts/secret-generators/README.md`\*\*.
+**CI:** [`.github/workflows/metaboost-infra-alpha-contracts.yml`](/.github/workflows/metaboost-infra-alpha-contracts.yml) runs pinned **`kustomize build`** on **`infra/k8s/alpha/*`** overlays when **`infra/k8s/**`** changes (no cluster apply). Full SOPS auto-gen + DB + version contracts run in **`metaboost.cc`** — see **`metaboost.cc/scripts/secret-generators/README.md`\*\*.
 
 ## Prerequisites
 
@@ -43,7 +43,7 @@ Use **`--auto-gen`** and **`--output-file`** flags where supported (same pattern
 
 ## Cloudflare (cert-manager DNS01)
 
-Use **`scripts/infra/sops/create_cloudflare_api_token_secret.sh`** (repo root); see [REMOTE-K8S-GITOPS.md](../../../../docs/development/k8s/REMOTE-K8S-GITOPS.md).
+Use **`scripts/infra/sops/create_cloudflare_api_token_secret.sh`** (repo root); see [REMOTE-K8S-GITOPS.md](/docs/development/k8s/REMOTE-K8S-GITOPS.md).
 
 ## Cloudflare Tunnel (cloudflared)
 
diff --git a/makefiles/local/Makefile.local.docker.mk b/makefiles/local/Makefile.local.docker.mk
index a0866877..e3570bb5 100644
--- a/makefiles/local/Makefile.local.docker.mk
+++ b/makefiles/local/Makefile.local.docker.mk
@@ -25,10 +25,12 @@ local_network_create:
 
 # Wait for Postgres to accept connections and app DB roles (read + read_write from canonical
 # source/bootstrap/0001_create_app_db_users.sh) so management DB init can run.
-local_postgres_wait:
+# Sources infra/config/local/db.env (Podverse parity): DB_APP_OWNER_USER for psql; DB_APP_READ_* for role names.
+local_postgres_wait: infra/config/local/db.env
 	@echo "Waiting for Postgres (and app read/read_write users) to be ready..."
-	@for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30; do \
-	  c=$$(docker exec $(LOCAL_PG_CONTAINER) psql -U $(LOCAL_PG_USER) -d postgres -tAc "SELECT COUNT(*) FROM pg_roles WHERE rolname IN ('$(LOCAL_POSTGRES_READ_USER)','$(LOCAL_POSTGRES_READ_WRITE_USER)')" 2>/dev/null || echo 0); \
+	@set -a; . infra/config/local/db.env; set +a; \
+	for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30; do \
+	  c=$$(docker exec $(LOCAL_PG_CONTAINER) psql -U "$$DB_APP_OWNER_USER" -d postgres -tAc "SELECT COUNT(*) FROM pg_roles WHERE rolname IN ('$$DB_APP_READ_USER','$$DB_APP_READ_WRITE_USER')" 2>/dev/null || echo 0); \
 	  [ "$$c" = "2" ] && exit 0; \
 	  sleep 1; \
 	done; \
@@ -36,7 +38,7 @@ local_postgres_wait:
 
 # Postgres + Valkey + pgAdmin only.
 # pgAdmin is available at http://localhost:4050 — no login required; both databases pre-connected.
-local_infra_up: local_network_create
+local_infra_up: local_network_create infra/config/local/db.env
 	docker compose $(COMPOSE_LOCAL_ENV) -f $(COMPOSE_LOCAL) --project-directory . up -d postgres valkey metaboost_local_pgadmin
 	$(MAKE) local_postgres_wait
 	@echo "Next steps:"
@@ -61,6 +63,10 @@ local_db_init: infra/config/local/db.env
 	@set -a; . infra/config/local/db.env; set +a; \
 	DB_HOST="localhost" DB_PORT="5532" DB_MANAGEMENT_MIGRATOR_USER="$$DB_MANAGEMENT_MIGRATOR_USER" DB_MANAGEMENT_MIGRATOR_PASSWORD="$$DB_MANAGEMENT_MIGRATOR_PASSWORD" DB_NAME="$$DB_MANAGEMENT_NAME" \
 	bash scripts/database/run-linear-migrations.sh --database management
+	@echo "Verifying DB bootstrap contract (extensions, baseline tables, grants)..."
+	@set -a; . infra/config/local/db.env; set +a; \
+	DB_HOST="localhost" DB_PORT="5532" \
+	bash scripts/database/verify-bootstrap-contract.sh
 	@echo "Local DB init complete. Next: make local_management_superuser_create"
 
 # Create management superuser using a containerized command on local Docker network.
diff --git a/makefiles/local/Makefile.local.env.mk b/makefiles/local/Makefile.local.env.mk
index 77bccd3b..b8221b61 100644
--- a/makefiles/local/Makefile.local.env.mk
+++ b/makefiles/local/Makefile.local.env.mk
@@ -4,16 +4,9 @@
 .PHONY: env_setup local_env_remove local_db_init local_db_init_management local_reset_env_infra local_nuke_rebuild_run
 .PHONY: local_clean_env_setup_infra_up
 
-# Local Postgres container (from docker-compose) and management DB name for dev
+# Local Postgres container (from docker-compose). Superuser for docker exec psql: DB_APP_OWNER_USER in
+# infra/config/local/db.env (same file Compose uses for POSTGRES_USER — Podverse parity; do not duplicate here).
 LOCAL_PG_CONTAINER ?= metaboost_local_postgres
-LOCAL_PG_USER ?= metaboost_app_admin
-# Must match DB_APP_READ_USER / DB_APP_READ_WRITE_USER in infra/config/local/db.env (roles from source/bootstrap/0001_create_app_db_users.sh).
-LOCAL_POSTGRES_READ_USER ?= metaboost_app_read
-LOCAL_POSTGRES_READ_WRITE_USER ?= metaboost_app_read_write
-# Must match DB_MANAGEMENT_*_USER in infra/config/local/db.env (see scripts/local-env/local-management-db.sh).
-LOCAL_POSTGRES_MANAGEMENT_READ_USER ?= metaboost_management_read
-LOCAL_POSTGRES_MANAGEMENT_READ_WRITE_USER ?= metaboost_management_read_write
-LOCAL_MANAGEMENT_DB_NAME ?= metaboost_management
 
 local_env_prepare:
 	bash scripts/local-env/prepare-local-env-overrides.sh
@@ -107,15 +100,16 @@ local_nuke_rebuild_run:
 
 # Reset management database in local Postgres (metaboost_local_postgres). Run after local_infra_up.
 # This prepares an empty management database and roles; run linear migrations and create/update the superuser as separate steps.
-local_db_init_management:
+local_db_init_management: infra/config/local/db.env
 	@docker ps -q -f name=^/$(LOCAL_PG_CONTAINER)$$ | grep -q . || (echo "Error: Start local Postgres first: make local_infra_up"; exit 1)
-	@echo "Creating management database $(LOCAL_MANAGEMENT_DB_NAME)..."
-	@docker exec $(LOCAL_PG_CONTAINER) psql -U $(LOCAL_PG_USER) -d postgres -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '$(LOCAL_MANAGEMENT_DB_NAME)' AND pid <> pg_backend_pid();" 2>/dev/null || true
-	@docker exec $(LOCAL_PG_CONTAINER) psql -U $(LOCAL_PG_USER) -d postgres -c "DROP DATABASE IF EXISTS $(LOCAL_MANAGEMENT_DB_NAME);"
-	@docker exec $(LOCAL_PG_CONTAINER) psql -U $(LOCAL_PG_USER) -d postgres -c "CREATE DATABASE $(LOCAL_MANAGEMENT_DB_NAME);"
-	@bash $(ROOT)scripts/local-env/local-management-db.sh $(LOCAL_PG_CONTAINER) create-roles
-	@bash $(ROOT)scripts/local-env/local-management-db.sh $(LOCAL_PG_CONTAINER) grants $(LOCAL_MANAGEMENT_DB_NAME)
-	@echo "Management database $(LOCAL_MANAGEMENT_DB_NAME) reset with roles/grants."
-	@echo "Next steps:"
-	@echo "  make local_db_migrate_linear_management"
-	@echo "  make local_management_superuser_create   # temporary Docker runner on $(LOCAL_NETWORK)"
+	@set -a; . infra/config/local/db.env; set +a; \
+	echo "Creating management database $$DB_MANAGEMENT_NAME..."; \
+	docker exec $(LOCAL_PG_CONTAINER) psql -U "$$DB_APP_OWNER_USER" -d postgres -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = '"'"'"$$DB_MANAGEMENT_NAME"'"'"' AND pid <> pg_backend_pid();" 2>/dev/null || true; \
+	docker exec $(LOCAL_PG_CONTAINER) psql -U "$$DB_APP_OWNER_USER" -d postgres -c "DROP DATABASE IF EXISTS $$DB_MANAGEMENT_NAME;"; \
+	docker exec $(LOCAL_PG_CONTAINER) psql -U "$$DB_APP_OWNER_USER" -d postgres -c "CREATE DATABASE $$DB_MANAGEMENT_NAME;"; \
+	bash $(ROOT)scripts/local-env/local-management-db.sh $(LOCAL_PG_CONTAINER) create-roles; \
+	bash $(ROOT)scripts/local-env/local-management-db.sh $(LOCAL_PG_CONTAINER) grants "$$DB_MANAGEMENT_NAME"; \
+	echo "Management database $$DB_MANAGEMENT_NAME reset with roles/grants."; \
+	echo "Next steps:"; \
+	echo "  make local_db_migrate_linear_management"; \
+	echo "  make local_management_superuser_create   # temporary Docker runner on $(LOCAL_NETWORK)"
diff --git a/makefiles/local/Makefile.local.mk b/makefiles/local/Makefile.local.mk
index e957174f..e09754a4 100644
--- a/makefiles/local/Makefile.local.mk
+++ b/makefiles/local/Makefile.local.mk
@@ -22,6 +22,7 @@
 #   db_status_linear_app, db_status_linear_management - Print applied/pending linear migration status
 #   db_validate_linear, db_validate_linear_check_db - Validate linear migration files and optional DB checksum integrity
 #   db_regen_linear_baseline, db_verify_linear_baseline - Regenerate/verify split 0003a/0003b baseline artifacts
+#   db_verify_bootstrap_contract - Verify extensions, linear_migration_history, tables, and role grants
 #   env_setup                  - Alias for local_env_setup (backward compatible)
 #   local_env_remove           - Run local_clean, then remove .env files (prompts for Y); prefer prepare/link/setup flow
 #   local_reset_env_infra      - Run local_env_remove, env_setup, local_infra_up, local_db_init
diff --git a/makefiles/local/Makefile.local.test.mk b/makefiles/local/Makefile.local.test.mk
index 886ec04e..fbdf0b7b 100644
--- a/makefiles/local/Makefile.local.test.mk
+++ b/makefiles/local/Makefile.local.test.mk
@@ -127,6 +127,7 @@ test_db_init: test_postgres_up
 	@docker exec $(TEST_PG_CONTAINER) psql -U $(TEST_PG_USER) -d $(TEST_DB_NAME) -c "GRANT USAGE, CREATE ON SCHEMA public TO $(TEST_APP_MIGRATOR_USER);"
 	@METABOOST_LOCAL_PG_CONTAINER="$(TEST_PG_CONTAINER)" DB_HOST="127.0.0.1" DB_PORT="$(TEST_DB_PORT)" DB_APP_NAME="$(TEST_DB_NAME)" DB_APP_MIGRATOR_USER="$(TEST_APP_MIGRATOR_USER)" DB_APP_MIGRATOR_PASSWORD="$(TEST_APP_MIGRATOR_PASSWORD)" \
 	bash scripts/database/run-linear-migrations.sh --database app
+	@docker exec $(TEST_PG_CONTAINER) psql -U $(TEST_PG_USER) -d $(TEST_DB_NAME) -c "REASSIGN OWNED BY $(TEST_APP_MIGRATOR_USER) TO $(TEST_APP_READ_WRITE_USER);"
 	@docker exec $(TEST_PG_CONTAINER) psql -U $(TEST_PG_USER) -d $(TEST_DB_NAME) -c " \
 		GRANT CONNECT ON DATABASE $(TEST_DB_NAME) TO $(TEST_APP_READ_USER), $(TEST_APP_READ_WRITE_USER); \
 		GRANT USAGE ON SCHEMA public TO $(TEST_APP_READ_USER), $(TEST_APP_READ_WRITE_USER); \
diff --git a/makefiles/local/Makefile.local.validate.mk b/makefiles/local/Makefile.local.validate.mk
index efd36e9b..01ffc5d0 100644
--- a/makefiles/local/Makefile.local.validate.mk
+++ b/makefiles/local/Makefile.local.validate.mk
@@ -3,7 +3,7 @@
 .PHONY: validate validate_docker
 .PHONY: db_run_linear_app db_run_linear_management db_run_linear_dry_app db_run_linear_dry_management
 .PHONY: db_status_linear_app db_status_linear_management db_validate_linear db_validate_linear_check_db
-.PHONY: db_regen_linear_baseline db_verify_linear_baseline
+.PHONY: db_regen_linear_baseline db_verify_linear_baseline db_verify_bootstrap_contract
 
 # Run forward-only linear migrations against local Postgres (app / management).
 db_run_linear_app:
@@ -40,6 +40,11 @@ db_regen_linear_baseline:
 db_verify_linear_baseline:
 	bash scripts/database/verify-linear-baseline.sh
 
+# Verify extensions, linear_migration_history, tables, and role grants (local or cluster credentials).
+db_verify_bootstrap_contract:
+	@echo "Verifying DB bootstrap contract (extensions, baseline tables, grants)..."
+	bash scripts/database/verify-bootstrap-contract.sh
+
 # Pre-push validation: audit, build packages, lint, type-check, env setup, build apps (plan 05).
 # Step 2 builds packages (helpers, orm); step 6 builds apps (api, web, sidecar). Exits non-zero on first failure.
 validate:
diff --git a/makefiles/local/e2e-spec-order-web.txt b/makefiles/local/e2e-spec-order-web.txt
index c44238b0..e343797a 100644
--- a/makefiles/local/e2e-spec-order-web.txt
+++ b/makefiles/local/e2e-spec-order-web.txt
@@ -44,6 +44,7 @@ e2e/buckets-list-url-state-contract.spec.ts
 e2e/bucket-detail-unauthenticated.spec.ts
 e2e/bucket-detail-non-admin.spec.ts
 e2e/bucket-detail-bucket-owner.spec.ts
+e2e/bucket-notifications-webpush-bucket-owner.spec.ts
 e2e/bucket-detail-bucket-admin.spec.ts
 e2e/bucket-detail-url-state-contract.spec.ts
 e2e/bucket-settings-unauthenticated.spec.ts
diff --git a/package-lock.json b/package-lock.json
index df9ef4fd..770e2fb6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,24 +8,11 @@
       "name": "metaboost",
       "version": "0.1.15",
       "workspaces": [
-        "packages/helpers",
-        "packages/helpers-currency",
-        "packages/helpers-backend-api",
-        "packages/helpers-i18n",
-        "packages/helpers-requests",
-        "packages/helpers-valkey",
-        "packages/metaboost-signing",
-        "packages/rss-parser",
-        "packages/orm",
-        "packages/management-orm",
-        "packages/ui",
-        "apps/api",
-        "apps/management-api",
-        "apps/web",
+        "packages/*",
+        "apps/*",
         "apps/web/sidecar",
-        "apps/management-web",
         "apps/management-web/sidecar",
-        "tools/generate-data"
+        "tools/*"
       ],
       "devDependencies": {
         "@eslint/js": "^10.0.1",
@@ -38,7 +25,6 @@
         "eslint-plugin-perfectionist": "^4.6.0",
         "eslint-plugin-storybook": "^10.2.19",
         "globals": "^17.4.0",
-        "lint-staged": "^15.5.0",
         "pg": "^8.20.0",
         "prettier": "^3.4.2",
         "tsx": "^4.19.3",
@@ -61,6 +47,7 @@
         "@metaboost/helpers-valkey": "*",
         "@metaboost/orm": "*",
         "@metaboost/rss-parser": "*",
+        "@types/web-push": "^3.6.4",
         "bcrypt": "^6.0.0",
         "cookie-parser": "^1.4.7",
         "cors": "^2.8.5",
@@ -70,7 +57,8 @@
         "jsonwebtoken": "^9.0.2",
         "nodemailer": "^8.0.7",
         "rate-limit-redis": "^4.3.1",
-        "swagger-ui-express": "^5.0.1"
+        "swagger-ui-express": "^5.0.1",
+        "web-push": "^3.6.7"
       },
       "devDependencies": {
         "@sqltools/formatter": "^1.2.5",
@@ -191,13 +179,15 @@
         "@types/node": "^24.10.12",
         "@types/react": "^19.2.11",
         "@types/react-dom": "^19.2.2",
+        "@vitejs/plugin-react": "^5.1.1",
         "concurrently": "^9.2.1",
         "dotenv": "^16.4.5",
+        "jsdom": "^26.1.0",
         "metaboost-signing": "*",
         "nodemon": "^3.1.10",
         "sass": "^1.98.0",
         "typescript": "^5.9.2",
-        "vitest": "^4.1.4"
+        "vitest": "^4.1.9"
       }
     },
     "apps/web/sidecar": {
@@ -212,20 +202,41 @@
       }
     },
     "node_modules/@adobe/css-tools": {
-      "version": "4.4.4",
-      "resolved": "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.4.4.tgz",
-      "integrity": "sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg==",
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.5.0.tgz",
+      "integrity": "sha512-6OzddxPio9UiWTCemp4N8cYLV2ZN1ncRnV1cVGtve7dhPOtRkleRyx32GQCYSwDYgaHU3USMm84tNsvKzRCa1Q==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@asamuzakjp/css-color": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
+      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/css-calc": "^2.1.3",
+        "@csstools/css-color-parser": "^3.0.9",
+        "@csstools/css-parser-algorithms": "^3.0.4",
+        "@csstools/css-tokenizer": "^3.0.3",
+        "lru-cache": "^10.4.3"
+      }
+    },
+    "node_modules/@asamuzakjp/css-color/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -234,9 +245,9 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.3.tgz",
-      "integrity": "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -244,21 +255,21 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -285,14 +296,14 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz",
+      "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -302,14 +313,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -318,16 +329,6 @@
         "node": ">=6.9.0"
       }
     },
-    "node_modules/@babel/helper-compilation-targets/node_modules/lru-cache": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
-      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^3.0.2"
-      }
-    },
     "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
       "version": "6.3.1",
       "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
@@ -339,9 +340,9 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -349,29 +350,29 @@
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -380,10 +381,20 @@
         "@babel/core": "^7.0.0"
       }
     },
+    "node_modules/@babel/helper-plugin-utils": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
+      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -391,9 +402,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -401,9 +412,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -411,27 +422,27 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz",
-      "integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
+      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "@babel/types": "^7.29.7"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -440,45 +451,76 @@
         "node": ">=6.0.0"
       }
     },
+    "node_modules/@babel/plugin-transform-react-jsx-self": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-self/-/plugin-transform-react-jsx-self-7.29.7.tgz",
+      "integrity": "sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-react-jsx-source": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-source/-/plugin-transform-react-jsx-source-7.29.7.tgz",
+      "integrity": "sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
     "node_modules/@babel/runtime": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.2.tgz",
-      "integrity": "sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
+      "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz",
+      "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -486,19 +528,134 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
+      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@csstools/color-helpers": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
+      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@csstools/css-calc": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
+      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-color-parser": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
+      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/color-helpers": "^5.1.0",
+        "@csstools/css-calc": "^2.1.4"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-parser-algorithms": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
+      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-tokenizer": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
+      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@discoveryjs/json-ext": {
       "version": "0.5.7",
       "resolved": "https://registry.npmjs.org/@discoveryjs/json-ext/-/json-ext-0.5.7.tgz",
@@ -510,9 +667,9 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.9.2.tgz",
+      "integrity": "sha512-UC+ZhH3XtczQYfOlu3lNEkdW/p4dsJ1r/bP7H8+rhao3TTTMO1ATq/4DdIi23XuGoFY+Cz0JmCbdVl0hz9jZcA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -522,9 +679,9 @@
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.9.2.tgz",
+      "integrity": "sha512-3U4+MIWHImeyu1wnmVygh5WlgfYDtyf0k8AbLhMFxOipihf6nrWC4syIm/SwEeec0mNSafiiNnMJwbza/Is6Lw==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -543,9 +700,9 @@
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz",
-      "integrity": "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
       "cpu": [
         "ppc64"
       ],
@@ -560,9 +717,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.7.tgz",
-      "integrity": "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
       "cpu": [
         "arm"
       ],
@@ -577,9 +734,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.7.tgz",
-      "integrity": "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
       "cpu": [
         "arm64"
       ],
@@ -594,9 +751,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.7.tgz",
-      "integrity": "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
       "cpu": [
         "x64"
       ],
@@ -611,9 +768,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.7.tgz",
-      "integrity": "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
       "cpu": [
         "arm64"
       ],
@@ -628,9 +785,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.7.tgz",
-      "integrity": "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
       "cpu": [
         "x64"
       ],
@@ -645,9 +802,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.7.tgz",
-      "integrity": "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
       "cpu": [
         "arm64"
       ],
@@ -662,9 +819,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.7.tgz",
-      "integrity": "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
       "cpu": [
         "x64"
       ],
@@ -679,9 +836,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.7.tgz",
-      "integrity": "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
       "cpu": [
         "arm"
       ],
@@ -696,9 +853,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.7.tgz",
-      "integrity": "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
       "cpu": [
         "arm64"
       ],
@@ -713,9 +870,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.7.tgz",
-      "integrity": "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
       "cpu": [
         "ia32"
       ],
@@ -730,9 +887,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.7.tgz",
-      "integrity": "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
       "cpu": [
         "loong64"
       ],
@@ -747,9 +904,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.7.tgz",
-      "integrity": "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
       "cpu": [
         "mips64el"
       ],
@@ -764,9 +921,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.7.tgz",
-      "integrity": "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
       "cpu": [
         "ppc64"
       ],
@@ -781,9 +938,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.7.tgz",
-      "integrity": "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
       "cpu": [
         "riscv64"
       ],
@@ -798,9 +955,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.7.tgz",
-      "integrity": "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
       "cpu": [
         "s390x"
       ],
@@ -815,9 +972,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.7.tgz",
-      "integrity": "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
       "cpu": [
         "x64"
       ],
@@ -832,9 +989,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.7.tgz",
-      "integrity": "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
       "cpu": [
         "arm64"
       ],
@@ -849,9 +1006,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.7.tgz",
-      "integrity": "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
       "cpu": [
         "x64"
       ],
@@ -866,9 +1023,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.7.tgz",
-      "integrity": "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
       "cpu": [
         "arm64"
       ],
@@ -883,9 +1040,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.7.tgz",
-      "integrity": "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
       "cpu": [
         "x64"
       ],
@@ -900,9 +1057,9 @@
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.7.tgz",
-      "integrity": "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
       "cpu": [
         "arm64"
       ],
@@ -917,9 +1074,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.7.tgz",
-      "integrity": "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
       "cpu": [
         "x64"
       ],
@@ -934,9 +1091,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.7.tgz",
-      "integrity": "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
       "cpu": [
         "arm64"
       ],
@@ -951,9 +1108,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.7.tgz",
-      "integrity": "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
       "cpu": [
         "ia32"
       ],
@@ -968,9 +1125,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.7.tgz",
-      "integrity": "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
       "cpu": [
         "x64"
       ],
@@ -1042,9 +1199,9 @@
       }
     },
     "node_modules/@eslint/config-helpers": {
-      "version": "0.5.5",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.5.tgz",
-      "integrity": "sha512-eIJYKTCECbP/nsKaaruF6LW967mtbQbsw4JTtSVkUQc9MneSkbrgPJAbKl9nWr0ZeowV8BfsarBmPpBzGelA2w==",
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.6.0.tgz",
+      "integrity": "sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1099,9 +1256,9 @@
       }
     },
     "node_modules/@eslint/plugin-kit": {
-      "version": "0.7.1",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.1.tgz",
-      "integrity": "sha512-rZAP3aVgB9ds9KOeUSL+zZ21hPmo8dh6fnIFwRQj5EAZl9gzR7wxYbYXYysAM8CTqGmUGyp2S4kUdV17MnGuWQ==",
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz",
+      "integrity": "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1130,33 +1287,33 @@
       }
     },
     "node_modules/@formatjs/fast-memoize": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@formatjs/fast-memoize/-/fast-memoize-3.1.3.tgz",
-      "integrity": "sha512-Ocd1vPuD68rW6BJDuAOtnnc1GPeVepY5kZXML1psGVFQ+1Q8CfkftT3Tnam+Mxx97Pz08jIEDCotl/GV+Naccg==",
+      "version": "3.1.6",
+      "resolved": "https://registry.npmjs.org/@formatjs/fast-memoize/-/fast-memoize-3.1.6.tgz",
+      "integrity": "sha512-H5aexk1Le7T9TPmscacZ+1pR6CTa2n1wq+HDVGXhH8TzUlQQpeXzZs91dRtmFHrbeNbjPFPfQujUqm7MHgVoXQ==",
       "license": "MIT"
     },
     "node_modules/@formatjs/icu-messageformat-parser": {
-      "version": "3.5.6",
-      "resolved": "https://registry.npmjs.org/@formatjs/icu-messageformat-parser/-/icu-messageformat-parser-3.5.6.tgz",
-      "integrity": "sha512-04ZjRIeQCnR/h32wBP9/S7rkyy1hLAs2fXJcNwc7hseJd//K9TMBqK0ukb4dXqnALKQ9m5ruZeOD2qqEkK9ixg==",
+      "version": "3.5.11",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-messageformat-parser/-/icu-messageformat-parser-3.5.11.tgz",
+      "integrity": "sha512-NVsuNsc2dUVG9+4HBJ/srScxtA/18LqGgwtop/tuN/OIBjVl6QA+0KhfZQddDD9sEh2LeVjLFPGVU3ixa3blcA==",
       "license": "MIT",
       "dependencies": {
-        "@formatjs/icu-skeleton-parser": "2.1.6"
+        "@formatjs/icu-skeleton-parser": "2.1.10"
       }
     },
     "node_modules/@formatjs/icu-skeleton-parser": {
-      "version": "2.1.6",
-      "resolved": "https://registry.npmjs.org/@formatjs/icu-skeleton-parser/-/icu-skeleton-parser-2.1.6.tgz",
-      "integrity": "sha512-9f1VQ2kaaLHK0WPU1OrAmiNKCKJwyoDmwNzQXbUa6XtFBOgHZ4YZURE8sSedHmMr0kvpB75OtplB0hMYkfdwfg==",
+      "version": "2.1.10",
+      "resolved": "https://registry.npmjs.org/@formatjs/icu-skeleton-parser/-/icu-skeleton-parser-2.1.10.tgz",
+      "integrity": "sha512-XuSva+8ZGawk8VnD5VD6UeH8KarQ/Z022zgjHDoHmlNiAewstXuuzXc0Hk5pGFSdG+nNw5bfJKXqj1ZXHn9yUA==",
       "license": "MIT"
     },
     "node_modules/@formatjs/intl-localematcher": {
-      "version": "0.8.5",
-      "resolved": "https://registry.npmjs.org/@formatjs/intl-localematcher/-/intl-localematcher-0.8.5.tgz",
-      "integrity": "sha512-TEW/NR367c3PcQ2AXfkNig9jC740+qbkM0LgKl7UCE7Xtv7C5Uk1mvlu86MjQZBmscUai8HSWjcEETpwaVvJ6A==",
+      "version": "0.8.10",
+      "resolved": "https://registry.npmjs.org/@formatjs/intl-localematcher/-/intl-localematcher-0.8.10.tgz",
+      "integrity": "sha512-P/IC3qws3jH+1fEs+o0RIFgXKRaQlFehjS5W0FPAqdo6hgzawLl+eD0q0JjheQ3XtoOe5n8WSYfX06KQZI/QJA==",
       "license": "MIT",
       "dependencies": {
-        "@formatjs/fast-memoize": "3.1.3"
+        "@formatjs/fast-memoize": "3.1.6"
       }
     },
     "node_modules/@fortawesome/fontawesome-free": {
@@ -1199,9 +1356,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@hapi/tlds": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/@hapi/tlds/-/tlds-1.1.6.tgz",
-      "integrity": "sha512-xdi7A/4NZokvV0ewovme3aUO5kQhW9pQ2YD1hRqZGhhSi5rBv4usHYidVocXSi9eihYsznZxLtAiEYYUL6VBGw==",
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/@hapi/tlds/-/tlds-1.1.7.tgz",
+      "integrity": "sha512-MgNjRwy9Ti92yVAixLmDc8dd1bJIKwO9qlWCfFQRwRmUEDPQHYn4G6hwPFvFGUTzAa0FsS+inMjLin7GnyBRhA==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=14.0.0"
@@ -1797,20 +1954,11 @@
       }
     },
     "node_modules/@ioredis/commands": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/@ioredis/commands/-/commands-1.5.1.tgz",
-      "integrity": "sha512-JH8ZL/ywcJyR9MmJ5BNqZllXNZQqQbnVZOqpPQqE1vHiFgAw4NHbvE0FOduNU8IX9babitBT46571OnPTT0Zcw==",
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@ioredis/commands/-/commands-1.10.0.tgz",
+      "integrity": "sha512-UmeW7z4LfctwoQ5wkhVzgq8tXkreED2xZGpX+Bg+zA+WJFZCT6c062AfCK/Dfk81xZnnwdhJCUMkitihRaoC2Q==",
       "license": "MIT"
     },
-    "node_modules/@isaacs/cliui": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-9.0.0.tgz",
-      "integrity": "sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/@joshwooding/vite-plugin-react-docgen-typescript": {
       "version": "0.7.0",
       "resolved": "https://registry.npmjs.org/@joshwooding/vite-plugin-react-docgen-typescript/-/vite-plugin-react-docgen-typescript-0.7.0.tgz",
@@ -1968,14 +2116,14 @@
       "link": true
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
-      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "version": "1.1.5",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.5.tgz",
+      "integrity": "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@tybys/wasm-util": "^0.10.1"
+        "@tybys/wasm-util": "^0.10.2"
       },
       "funding": {
         "type": "github",
@@ -1987,9 +2135,9 @@
       }
     },
     "node_modules/@next/bundle-analyzer": {
-      "version": "15.5.15",
-      "resolved": "https://registry.npmjs.org/@next/bundle-analyzer/-/bundle-analyzer-15.5.15.tgz",
-      "integrity": "sha512-Y9XFxAGfk7E9Se1WYmmZWhznfWFVugsroZy+gD7qv8vZmHSIlI0izLESz3yRXJ8FPTuDSdIqP1Azw1u88gDx5g==",
+      "version": "15.5.19",
+      "resolved": "https://registry.npmjs.org/@next/bundle-analyzer/-/bundle-analyzer-15.5.19.tgz",
+      "integrity": "sha512-A+hYYxRIo5ykAkw7+pDTQA9dBp+yXmz70/jdTSm87uVP14oHQmV0lC1jXe212O6+v06WB8fwZFEgz1A+uPeHrA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1997,15 +2145,15 @@
       }
     },
     "node_modules/@next/env": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.4.tgz",
-      "integrity": "sha512-dKkkOzOSwFYe5RX6y26fZgkSpVAlIOJKQHIiydQcrWH6y/97+RceSOAdjZ14Qa3zLduVUy0TXcn+EiM6t4rPgw==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/@next/env/-/env-16.2.9.tgz",
+      "integrity": "sha512-ki5VxxXfzD/9TDe13wyeTKIjQTAwBVpnr8KhRDUr8ltMUq1/NBpWNT5tiPoxiGl+PHM4X2ahSOiPk6iAimIzPg==",
       "license": "MIT"
     },
     "node_modules/@next/swc-darwin-arm64": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.4.tgz",
-      "integrity": "sha512-OXTFFox5EKN1Ym08vfrz+OXxmCcEjT4SFMbNRsWZE99dMqt2Kcusl5MqPXcW232RYkMLQTy0hqgAMEsfEd/l2A==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.2.9.tgz",
+      "integrity": "sha512-HkfxNYUCmcct0Xsqib5KxqMSHV4AHJq857BNRchyBDs4YS19aHzVfn1kDuBYKqLLQBjXgnkIsjV2Kd4d2wzYhw==",
       "cpu": [
         "arm64"
       ],
@@ -2019,9 +2167,9 @@
       }
     },
     "node_modules/@next/swc-darwin-x64": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.4.tgz",
-      "integrity": "sha512-XhpVnUfmYWvD3YrXu55XdcAkQtOnvaI6wtQa8fuF5fGoKoxIUZ0kWPtcOfqJEWngFF/lOS9l3+O9CcownhiQxQ==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.2.9.tgz",
+      "integrity": "sha512-7IAtK4MeybpqRV9GRABWEhJ62mOS+rzWOzOTFie4cSEtm12xsoOMJRcECoZx3FHPzFAqN/IJtHqWAFOLfl152w==",
       "cpu": [
         "x64"
       ],
@@ -2035,9 +2183,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.4.tgz",
-      "integrity": "sha512-Mx/tjlNA3G8kg14QvuGAJ4xBwPk1tUHq56JxZ8CXnZwz1Etz714soCEzGQQzVMz4bEnGPowzkV6Xrp6wAkEWOQ==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.2.9.tgz",
+      "integrity": "sha512-hBD75iWpUtkL9SmQmcRhmLomn9jgkPzCEkbOcLgHymPEKzv+6ONy13RRiIEz/iEObjkS2Jlb5gYS2XGoS3X4rw==",
       "cpu": [
         "arm64"
       ],
@@ -2054,9 +2202,9 @@
       }
     },
     "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.4.tgz",
-      "integrity": "sha512-iVMMp14514u7Nup2umQS03nT/bN9HurK8ufylC3FZNykrwjtx7V1A7+4kvhbDSCeonTVqV3Txnv0Lu+m2oDXNg==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.2.9.tgz",
+      "integrity": "sha512-qZTI3pf9SGc/obr8NkQAekBxmp1QK+kVm+VAf3BALLfFAj+1kUhkTxmrWpVos9R/UYIA8AWX2p6cGI5WdwzVUA==",
       "cpu": [
         "arm64"
       ],
@@ -2073,9 +2221,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.4.tgz",
-      "integrity": "sha512-EZOvm1aQWgnI/N/xcWOlnS3RQBk0VtVav5Zo7n4p0A7UKyTDx047k8opDbXgBpHl4CulRqRfbw3QrX2w5UOXMQ==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.2.9.tgz",
+      "integrity": "sha512-xm0HfRNX+UkH4R3c18ynswjj5o5uEj/7iI9p9omdtTSIsRCzQqkGMA+10nzJ4EHnYC3as65IMhbbl5fWRUWHYg==",
       "cpu": [
         "x64"
       ],
@@ -2092,9 +2240,9 @@
       }
     },
     "node_modules/@next/swc-linux-x64-musl": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.4.tgz",
-      "integrity": "sha512-h9FxsngCm9cTBf71AR4fGznDEDx1hS7+kSEiIRjq5kO1oXWm07DxVGZjCvk0SGx7TSjlUqhI8oOyz7NfwAdPoA==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.2.9.tgz",
+      "integrity": "sha512-QumimHkGEG6vM3PfEDWKyKen03NcqLOkeKB1EfcPe7VxzmEiCa4jNnMyBn/US5zcd/VE1CI+O8Ovb3lfjVHfGw==",
       "cpu": [
         "x64"
       ],
@@ -2111,9 +2259,9 @@
       }
     },
     "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.4.tgz",
-      "integrity": "sha512-3NdJV5OXMSOeJYijX+bjaLge3mJBlh4ybydbT4GFoB/2hAojWHtMhl3CYlYoMrjPuodp0nzFVi4Tj2+WaMg+Ow==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.2.9.tgz",
+      "integrity": "sha512-hzQpKZvw8rAwI6A2uQh6SacCSvNAXaIkPNsWwzqqfRiIMiXMfH936skDhz1OO6KpvdKkJrgHHtqQOq5PIXOvdQ==",
       "cpu": [
         "arm64"
       ],
@@ -2127,9 +2275,9 @@
       }
     },
     "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.4.tgz",
-      "integrity": "sha512-kMVGgsqhO5YTYODD9IPGGhA6iprWidQckK3LmPeW08PIFENRmgfb4MjXHO+p//d+ts2rpjvK5gXWzXSMrPl9cw==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.2.9.tgz",
+      "integrity": "sha512-qr2VL3Ce5QrwgO2yh1ujSBawrimjVKX8FGF/cOynmdYKJY0BdHpGVNIRK1tqONB10Vkm25Ub1BD2bkjWs4+96w==",
       "cpu": [
         "x64"
       ],
@@ -2156,9 +2304,9 @@
       }
     },
     "node_modules/@nodable/entities": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
-      "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.2.0.tgz",
+      "integrity": "sha512-9uGyhaQavEUMC8AIddIjau4NsnsXhou+j5sBAGojCM1oxmQpVKTWR/9JxABD6UAv12vpIms55fPZKFQEhG6uBg==",
       "funding": [
         {
           "type": "github",
@@ -2167,139 +2315,834 @@
       ],
       "license": "MIT"
     },
-    "node_modules/@oxc-project/types": {
+    "node_modules/@oxc-parser/binding-android-arm-eabi": {
       "version": "0.127.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.127.0.tgz",
-      "integrity": "sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/Boshen"
-      }
-    },
-    "node_modules/@paralleldrive/cuid2": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/@paralleldrive/cuid2/-/cuid2-2.3.1.tgz",
-      "integrity": "sha512-XO7cAxhnTZl0Yggq6jOgjiOHhbgcO4NqFqwSmQpjK3b6TEE6Uj/jfSk6wzYyemh3+I0sHirKSetjQwn5cZktFw==",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-android-arm-eabi/-/binding-android-arm-eabi-0.127.0.tgz",
+      "integrity": "sha512-0LC7ye4hvqbIKxAzThzvswgHLFu2AURKzYLeSVvLdu2TBOYWQDmHnTqPLeA597BcUCxiLqLsS4CJ5uoI5WYWCQ==",
+      "cpu": [
+        "arm"
+      ],
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@noble/hashes": "^1.1.5"
-      }
-    },
-    "node_modules/@parcel/watcher": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.6.tgz",
-      "integrity": "sha512-tmmZ3lQxAe/k/+rNnXQRawJ4NjxO2hqiOLTHvWchtGZULp4RyFeh6aU4XdOYBFe2KE1oShQTv4AblOs2iOrNnQ==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "dependencies": {
-        "detect-libc": "^2.0.3",
-        "is-glob": "^4.0.3",
-        "node-addon-api": "^7.0.0",
-        "picomatch": "^4.0.3"
-      },
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      },
-      "optionalDependencies": {
-        "@parcel/watcher-android-arm64": "2.5.6",
-        "@parcel/watcher-darwin-arm64": "2.5.6",
-        "@parcel/watcher-darwin-x64": "2.5.6",
-        "@parcel/watcher-freebsd-x64": "2.5.6",
-        "@parcel/watcher-linux-arm-glibc": "2.5.6",
-        "@parcel/watcher-linux-arm-musl": "2.5.6",
-        "@parcel/watcher-linux-arm64-glibc": "2.5.6",
-        "@parcel/watcher-linux-arm64-musl": "2.5.6",
-        "@parcel/watcher-linux-x64-glibc": "2.5.6",
-        "@parcel/watcher-linux-x64-musl": "2.5.6",
-        "@parcel/watcher-win32-arm64": "2.5.6",
-        "@parcel/watcher-win32-ia32": "2.5.6",
-        "@parcel/watcher-win32-x64": "2.5.6"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@parcel/watcher-android-arm64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.6.tgz",
-      "integrity": "sha512-YQxSS34tPF/6ZG7r/Ih9xy+kP/WwediEUsqmtf0cuCV5TPPKw/PQHRhueUo6JdeFJaqV3pyjm0GdYjZotbRt/A==",
+    "node_modules/@oxc-parser/binding-android-arm64": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-android-arm64/-/binding-android-arm64-0.127.0.tgz",
+      "integrity": "sha512-b5jtVTH6AU5CJXHNdj7Jj9IEiR9yVjjnwHzPJhGyHGPdcsZSzBCkS9GBbV33niRMvKthDwQRFRJfI4a+k4PvYg==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "android"
       ],
       "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@parcel/watcher-darwin-arm64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.6.tgz",
-      "integrity": "sha512-Z2ZdrnwyXvvvdtRHLmM4knydIdU9adO3D4n/0cVipF3rRiwP+3/sfzpAwA/qKFL6i1ModaabkU7IbpeMBgiVEA==",
+    "node_modules/@oxc-parser/binding-darwin-arm64": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-darwin-arm64/-/binding-darwin-arm64-0.127.0.tgz",
+      "integrity": "sha512-obCE8B7ISKkJidjlhv9xRGJPOSDG2Yu6PRga9Ruaz35uintHxbp1Ki/Yc71wx4rj3Edrm0a1kzG1TAwit0wFpg==",
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "darwin"
       ],
       "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@parcel/watcher-darwin-x64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.6.tgz",
-      "integrity": "sha512-HgvOf3W9dhithcwOWX9uDZyn1lW9R+7tPZ4sug+NGrGIo4Rk1hAXLEbcH1TQSqxts0NYXXlOWqVpvS1SFS4fRg==",
+    "node_modules/@oxc-parser/binding-darwin-x64": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-darwin-x64/-/binding-darwin-x64-0.127.0.tgz",
+      "integrity": "sha512-JL6Xb5IwPQT8rUzlpsX7E+AgfcdNklXNPFp8pjCQQ5MQOQo5rtEB2ui+3Hgg9Sn7Y9Egj6YOLLiHhLpdAe12Aw==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "darwin"
       ],
       "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@parcel/watcher-freebsd-x64": {
-      "version": "2.5.6",
-      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.6.tgz",
-      "integrity": "sha512-vJVi8yd/qzJxEKHkeemh7w3YAn6RJCtYlE4HPMoVnCpIXEzSrxErBW5SJBgKLbXU3WdIpkjBTeUNtyBVn8TRng==",
+    "node_modules/@oxc-parser/binding-freebsd-x64": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-freebsd-x64/-/binding-freebsd-x64-0.127.0.tgz",
+      "integrity": "sha512-SDQ/3MQFw58fqQz3Z1PhSKFF3JoCF4gmlNjziDm8X02tTahCw0qJbd7FGPDKw1i4VTBZene9JPyC3mHtSvi+wA==",
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "freebsd"
       ],
       "engines": {
-        "node": ">= 10.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-arm-gnueabihf": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.127.0.tgz",
+      "integrity": "sha512-Av+D1MIqzV0YMGPT9we2SIZaMKD7Cxs4CvXSx/yxaWHewZjYEjScpOf5igc8IILASViw4WTnjlwUdI1KzVtDHQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-arm-musleabihf": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.127.0.tgz",
+      "integrity": "sha512-Cs2fdJ8cPpFdeebj6p4dag8A4+56hPvZ0AhQQzlaLswGz1tz7bXt1nETLeorrM9+AMcWFFkqxcXwDGfTVidY8g==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-arm64-gnu": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.127.0.tgz",
+      "integrity": "sha512-qdOfTcT6SY8gsJrrV92uyEUyjqMGPpIB5JZUG6QN5dukYd+7/j0kX6MwK1DgQj39jtUYixxPiaRUiEN1+0CXgQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-arm64-musl": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.127.0.tgz",
+      "integrity": "sha512-EoTCZneNFU/P2qrpEM+RHmQwt+CvDkyGESG6qhr7KaegXLZwePfbrkCDfAk8/rhxbDUVGsZILX+2tqPzFtoFWA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-ppc64-gnu": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.127.0.tgz",
+      "integrity": "sha512-zALjmZYgxFLHjXeudcDF0xFGNydTAtkAeXAr2EuC17ywCyFxcmQra4w0BMde0Yi/re4Bi4iwEoEXtYN7l6eBLQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-riscv64-gnu": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.127.0.tgz",
+      "integrity": "sha512-fPP8M6zQLS7Jz7o9d5ArUSuAuSK3e+WCYVrCpdzeCOejidtZExJ9tjhDrAd3HEPqARBCPmdpqxESPFqy44vkBQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-riscv64-musl": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.127.0.tgz",
+      "integrity": "sha512-7IcC4Ao02oGpfnjt+X/oF4U2mllo2qoSkw5xxiXNKL9MCTsTiAC6616beOuehdxGcnz1bRoPC1RQ2f1GQDdN+g==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-s390x-gnu": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.127.0.tgz",
+      "integrity": "sha512-pbXIhiNFHoqWeqDNLiJ9JkpHz1IM9k4DXa66x+1GTWMG7iLxtkXgE53iiuKSXwmk3zIYmaPVfBvgcAhS583K4Q==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-x64-gnu": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.127.0.tgz",
+      "integrity": "sha512-MYCguB9RvBvlSd6gbuNI7QwiLoCCAlGnlRJFPrzLI6U1/9wkC/WK6LtBAUln55H1Ctqw45PWmqrobKoMhsYQzQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-linux-x64-musl": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-x64-musl/-/binding-linux-x64-musl-0.127.0.tgz",
+      "integrity": "sha512-5eY0B/bxf1xIUxb4NOTvOI3KWtBQfPWYyKAzgcrCt0mDibSZygVpO1Pz8bkeiSZ5Jj9+M09dkggG3H8I5d0Uyg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-openharmony-arm64": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-openharmony-arm64/-/binding-openharmony-arm64-0.127.0.tgz",
+      "integrity": "sha512-Gld0ajrFTUXNtdw20fVBuTQx66FA75nIVg+//pPfR3sXkuABB4mTBhl3r9JNzrJpgW//qiwxf0nWXUWGJSL3UQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-wasm32-wasi": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-wasm32-wasi/-/binding-wasm32-wasi-0.127.0.tgz",
+      "integrity": "sha512-T6KVD7rhLzFlwGRXMnxUFfkCZD8FHnb968wVXW1mXzgRFc5RNXOBY2mPPDZ77x5Ln76ltLMgtPg0cOkU1NSrEQ==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.9.2",
+        "@emnapi/runtime": "1.9.2",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-win32-arm64-msvc": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.127.0.tgz",
+      "integrity": "sha512-Ujvw4X+LD1CCGULcsQcvb4YNVoBGqt+JHgNNzGGaCImELiZLk477ifUH53gIbE7EKd933NdTi25JWEr9K2HwXw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-win32-ia32-msvc": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.127.0.tgz",
+      "integrity": "sha512-0cwxKO7KHQQQfo4Uf4B2SQrhgm+cJaP9OvFFhx52Tkg4bezsacu83GB2/In5bC415Ueeym+kXdnge/57rbSfTw==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-parser/binding-win32-x64-msvc": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.127.0.tgz",
+      "integrity": "sha512-rOrnSQSCbhI2kowr9XxE7m9a8oQXnBHjnS6j95LxxAnEZ0+Fz20WlRXG4ondQb+ejjt2KOsa65sE6++L6kUd+w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@oxc-project/types": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.127.0.tgz",
+      "integrity": "sha512-aIYXQBo4lCbO4z0R3FHeucQHpF46l2LbMdxRvqvuRuW2OxdnSkcng5B8+K12spgLDj93rtN3+J2Vac/TIO+ciQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "node_modules/@oxc-resolver/binding-android-arm-eabi": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm-eabi/-/binding-android-arm-eabi-11.21.3.tgz",
+      "integrity": "sha512-eNU11A2WNizh04v3uyaJCootrHIaS0B9aHYXvAvVnPNk4xYSjMUjHnhQ6dewPN2MRYDskV85d1N0Aw0WNWhcyg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-android-arm64": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-android-arm64/-/binding-android-arm64-11.21.3.tgz",
+      "integrity": "sha512-8Q+ZjTLvn2dIcWsrmhdrEihm7q+ag/k+mkry7Z+t0QbbHaVxXQfvH9AewyVMh/WrpEKhQ3DDgx9fYbqeCpeOEw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-darwin-arm64": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-arm64/-/binding-darwin-arm64-11.21.3.tgz",
+      "integrity": "sha512-wkh0qKZGHXVUDxFw3oA1TXnU2BDYY/r775oJflGeIr8uDPPoN2pk8gijQIzYRT6hoql/lg3+Tx/SaTn9e2/aGg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-darwin-x64": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-darwin-x64/-/binding-darwin-x64-11.21.3.tgz",
+      "integrity": "sha512-HbNc23FAQYbuyDV2vBWMez4u4mrsm5RAkniGZAWqr6lYZ3N4beeqIb776jzwRl8qL2zRhHVXpUj97X0QgogVzg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-freebsd-x64": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-freebsd-x64/-/binding-freebsd-x64-11.21.3.tgz",
+      "integrity": "sha512-K6xNsTUPEUdfrn0+kbMq5nOUB5w1C5pavPQngt4TM2FpN91lP0PBe2srSpamb4d69O7h86oAi/qWX/kZNRSjkw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-arm-gnueabihf": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-11.21.3.tgz",
+      "integrity": "sha512-VcFmOpcpWX1zoEy8M58tR2M9YxM+Z9RuQhqAx5q0CTmrruaP7Gveejg75hzd/5sg5nk9G3aLALEa3hE2FsmmTQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-arm-musleabihf": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-11.21.3.tgz",
+      "integrity": "sha512-quVoxFLBy43hWaQbbDtQNRwAX5vX76mv7n64icAtQcJ3eNgVeblqmkupF/hAneNthdqSlnd1sTjb3aQSaDPaCQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-arm64-gnu": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-11.21.3.tgz",
+      "integrity": "sha512-X0AqNZgcD07Q4V3RDK18/vYOj/HQT/FnmEFGYS2jTWqY7JO13ryE3TEs3eAIgUJhBnNkpEaiXqz3VK8M7qQhWQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-arm64-musl": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-arm64-musl/-/binding-linux-arm64-musl-11.21.3.tgz",
+      "integrity": "sha512-YkaQnaKYdbuaXvRt5Qd0GpbihzVnyfR6z1SpYfIUC6RTu4NF7lDKPjVkYb+jRI2gedVO2rVpN35Y6akG6ud4Lw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-ppc64-gnu": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-11.21.3.tgz",
+      "integrity": "sha512-gB9HwhrPiFqUzDeEq+y/CgAijz1YdI6BnXz5GaH2Pa9cWdutchlkGFAiAuGb/PjVQpiK6NFKzFuztxrweoit7A==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-riscv64-gnu": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-11.21.3.tgz",
+      "integrity": "sha512-zjDWBlYk8QGv0H8dsPUWqkfjYIIjG2TvspGkzXL0eImbgxtZorA/klKeHyolevoT3Kvbi+1iMr9Lhrh7jf54Og==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-riscv64-musl": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-11.21.3.tgz",
+      "integrity": "sha512-4UfsQvacV388y1zpXL7C1x1FNYaV52JtuNRiuzrfQA2z1z6ElVrsidkGsrvQ5EgeSq1Pj7kaKqrgGkvFuxJ/tw==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-s390x-gnu": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-11.21.3.tgz",
+      "integrity": "sha512-b5uH+HKH0MP5mNBYaK75SKsJbw52URqrx2LavYdq6wb0l3ExAG5niYRP9DWUNHdKilpaBVM2bXk9HNWrH3ew7Q==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-x64-gnu": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-gnu/-/binding-linux-x64-gnu-11.21.3.tgz",
+      "integrity": "sha512-PjYlmilBpNRh2ntXNYAK3Am5w/nPfEpnU/96iNx7CI8EzAn12J4JRiec63wHJTH31nLoCNxBg/829pN+3CfG3Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-linux-x64-musl": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-linux-x64-musl/-/binding-linux-x64-musl-11.21.3.tgz",
+      "integrity": "sha512-QTBAb7JuHlZ7JUEyM8UiQi2f7m/L4swBhP2TNpYIDc9Wp/wRw1G/8sl6i13aIzQAXH7LKIm294LeOHd0lQR8zA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-openharmony-arm64": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-openharmony-arm64/-/binding-openharmony-arm64-11.21.3.tgz",
+      "integrity": "sha512-4j1DFwjwv36ec9kds0jU/ucQ5Ha4ERO/H95BxR5JFf0kqUUAJ1kwII7XhTc1vZrkdJkvLGC9Q2MbpObpum8RBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-wasm32-wasi": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-wasm32-wasi/-/binding-wasm32-wasi-11.21.3.tgz",
+      "integrity": "sha512-i8oluoel5kru/j1WNrjmQSiA3GQ7wvIYVR1IwIoZtKogAhya2iub+ZKIeSIkcJOrnzQ18Tzl/F+kL3fYOxZLvA==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.11.0",
+        "@emnapi/runtime": "1.11.0",
+        "@napi-rs/wasm-runtime": "^1.1.5"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@oxc-resolver/binding-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.11.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.0.tgz",
+      "integrity": "sha512-l9Oo58x0HOP5znGzVhYW9U3e5wVuA4LAZU2AGezTmkhO1CgQRFDhDg4nneHsu/t3WniXg9QrG2nIXL/ZS8ln8Q==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@oxc-resolver/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.11.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.0.tgz",
+      "integrity": "sha512-55coeOFKHv1ywEcUXJtWU5f+Jr/W5tZDvZig8DLKSwUN1JpROQ4rk/SNOQiFWmaR/VKF4zuFyW1B8JduOSv6Pg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@oxc-resolver/binding-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
+      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@oxc-resolver/binding-win32-arm64-msvc": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-11.21.3.tgz",
+      "integrity": "sha512-M/8dw8dD6aOs+NlPJax401CZB9I7Aut84isQLgALGGwke4Afvw+/7yYhZb94yXf6t2sPLhQLmSmtSV+2FhsOWg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@oxc-resolver/binding-win32-x64-msvc": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/@oxc-resolver/binding-win32-x64-msvc/-/binding-win32-x64-msvc-11.21.3.tgz",
+      "integrity": "sha512-H7BCt/VnS9hnmMp42eGhZ99izSCRvlnWwy/N71K1/J8QoExwY4262Z8QiEkMDtduRJrztayDxETTckmUuAVL9Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@paralleldrive/cuid2": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@paralleldrive/cuid2/-/cuid2-2.3.1.tgz",
+      "integrity": "sha512-XO7cAxhnTZl0Yggq6jOgjiOHhbgcO4NqFqwSmQpjK3b6TEE6Uj/jfSk6wzYyemh3+I0sHirKSetjQwn5cZktFw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@noble/hashes": "^1.1.5"
+      }
+    },
+    "node_modules/@parcel/watcher": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.5.6.tgz",
+      "integrity": "sha512-tmmZ3lQxAe/k/+rNnXQRawJ4NjxO2hqiOLTHvWchtGZULp4RyFeh6aU4XdOYBFe2KE1oShQTv4AblOs2iOrNnQ==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.3",
+        "is-glob": "^4.0.3",
+        "node-addon-api": "^7.0.0",
+        "picomatch": "^4.0.3"
+      },
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "@parcel/watcher-android-arm64": "2.5.6",
+        "@parcel/watcher-darwin-arm64": "2.5.6",
+        "@parcel/watcher-darwin-x64": "2.5.6",
+        "@parcel/watcher-freebsd-x64": "2.5.6",
+        "@parcel/watcher-linux-arm-glibc": "2.5.6",
+        "@parcel/watcher-linux-arm-musl": "2.5.6",
+        "@parcel/watcher-linux-arm64-glibc": "2.5.6",
+        "@parcel/watcher-linux-arm64-musl": "2.5.6",
+        "@parcel/watcher-linux-x64-glibc": "2.5.6",
+        "@parcel/watcher-linux-x64-musl": "2.5.6",
+        "@parcel/watcher-win32-arm64": "2.5.6",
+        "@parcel/watcher-win32-ia32": "2.5.6",
+        "@parcel/watcher-win32-x64": "2.5.6"
+      }
+    },
+    "node_modules/@parcel/watcher-android-arm64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.5.6.tgz",
+      "integrity": "sha512-YQxSS34tPF/6ZG7r/Ih9xy+kP/WwediEUsqmtf0cuCV5TPPKw/PQHRhueUo6JdeFJaqV3pyjm0GdYjZotbRt/A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-arm64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.5.6.tgz",
+      "integrity": "sha512-Z2ZdrnwyXvvvdtRHLmM4knydIdU9adO3D4n/0cVipF3rRiwP+3/sfzpAwA/qKFL6i1ModaabkU7IbpeMBgiVEA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-x64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.5.6.tgz",
+      "integrity": "sha512-HgvOf3W9dhithcwOWX9uDZyn1lW9R+7tPZ4sug+NGrGIo4Rk1hAXLEbcH1TQSqxts0NYXXlOWqVpvS1SFS4fRg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-freebsd-x64": {
+      "version": "2.5.6",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.5.6.tgz",
+      "integrity": "sha512-vJVi8yd/qzJxEKHkeemh7w3YAn6RJCtYlE4HPMoVnCpIXEzSrxErBW5SJBgKLbXU3WdIpkjBTeUNtyBVn8TRng==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
     "node_modules/@parcel/watcher-linux-arm-glibc": {
@@ -2506,26 +3349,14 @@
       "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
       "license": "MIT"
     },
-    "node_modules/@parcel/watcher/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
     "node_modules/@playwright/test": {
-      "version": "1.59.1",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.59.1.tgz",
-      "integrity": "sha512-PG6q63nQg5c9rIi4/Z5lR5IVF7yU5MqmKaPOe0HSc0O2cX1fPi96sUQu5j7eo4gKCkB2AnNGoWt7y4/Xx3Kcqg==",
+      "version": "1.61.0",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.61.0.tgz",
+      "integrity": "sha512-cKA5B6lpFEMyMGjxF54QihfYpB4FkEGH+qZhtArDEG+wezQAJY8Pq6C7T1SjWz+FFzt3TbyoXBQYk/0292TdJA==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.59.1"
+        "playwright": "1.61.0"
       },
       "bin": {
         "playwright": "cli.js"
@@ -2542,9 +3373,9 @@
       "license": "MIT"
     },
     "node_modules/@reduxjs/toolkit": {
-      "version": "2.11.2",
-      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.11.2.tgz",
-      "integrity": "sha512-Kd6kAHTA6/nUpp8mySPqj3en3dm0tdMIgbttnQ1xFMVpufoj+ADi8pXLBsd4xzTRHQa7t/Jv8W5UnCuW4kuWMQ==",
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@reduxjs/toolkit/-/toolkit-2.12.0.tgz",
+      "integrity": "sha512-KiT+RzZbp6mQET+Mg+h2c97+9j1sNflUxQkIHI7Yuzf6Peu+OYpmkn6nbHWmLLWj+1ZODUJFwGZ7gx3L9R9EOw==",
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.0.0",
@@ -2568,9 +3399,9 @@
       }
     },
     "node_modules/@reduxjs/toolkit/node_modules/immer": {
-      "version": "11.1.4",
-      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.4.tgz",
-      "integrity": "sha512-XREFCPo6ksxVzP4E0ekD5aMdf8WMwmdNaz6vuvxgI40UaEiu6q3p8X52aU6GdyvLY3XXX/8R7JOTXStz/nBbRw==",
+      "version": "11.1.8",
+      "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.8.tgz",
+      "integrity": "sha512-/tbkHMW7y10Lx6i1crLjD4/OhNkRG+Fo7byZHtah0547nIeXYcpIXaUh0IAQY6gO5459qpGGYapcEOHtFXkIuA==",
       "license": "MIT",
       "funding": {
         "type": "opencollective",
@@ -2578,9 +3409,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.17.tgz",
-      "integrity": "sha512-s70pVGhw4zqGeFnXWvAzJDlvxhlRollagdCCKRgOsgUOH3N1l0LIxf83AtGzmb5SiVM4Hjl5HyarMRfdfj3DaQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.3.tgz",
+      "integrity": "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw==",
       "cpu": [
         "arm64"
       ],
@@ -2595,9 +3426,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.17.tgz",
-      "integrity": "sha512-4ksWc9n0mhlZpZ9PMZgTGjeOPRu8MB1Z3Tz0Mo02eWfWCHMW1zN82Qz/pL/rC+yQa+8ZnutMF0JjJe7PjwasYw==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.3.tgz",
+      "integrity": "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA==",
       "cpu": [
         "arm64"
       ],
@@ -2612,9 +3443,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.17.tgz",
-      "integrity": "sha512-SUSDOI6WwUVNcWxd02QEBjLdY1VPHvlEkw6T/8nYG322iYWCTxRb1vzk4E+mWWYehTp7ERibq54LSJGjmouOsw==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.3.tgz",
+      "integrity": "sha512-9YpfeUvSE2RS7wysJ81uOZkXJz7f7Q55H2Gvp3VEw/EsahqDtrphrZ0EwDLK5vvKOzaCrBsjF8JmnMLcUt78Gg==",
       "cpu": [
         "x64"
       ],
@@ -2629,9 +3460,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.17.tgz",
-      "integrity": "sha512-hwnz3nw9dbJ05EDO/PvcjaaewqqDy7Y1rn1UO81l8iIK1GjenME75dl16ajbvSSMfv66WXSRCYKIqfgq2KCfxw==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.3.tgz",
+      "integrity": "sha512-yB1IlAsSNHncV6SCTL27/MVGR5htvQsoGxIv5KMGXALp+Ll1wYsn+x98M9MW7qa+NdSbvrrY7ANI4wLJ0n1e6g==",
       "cpu": [
         "x64"
       ],
@@ -2646,9 +3477,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.17.tgz",
-      "integrity": "sha512-IS+W7epTcwANmFSQFrS1SivEXHtl1JtuQA9wlxrZTcNi6mx+FDOYrakGevvvTwgj2JvWiK8B29/qD9BELZPyXQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.3.tgz",
+      "integrity": "sha512-Yi30IVAAfLUCy2MseFjbB1jAMDl1VMCAas5StnYp8da9+CKvMd2H2cbEjWcw5NPaPqzvYkVIaF1nNUG+b7u/sw==",
       "cpu": [
         "arm"
       ],
@@ -2663,9 +3494,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.17.tgz",
-      "integrity": "sha512-e6usGaHKW5BMNZOymS1UcEYGowQMWcgZ71Z17Sl/h2+ZziNJ1a9n3Zvcz6LdRyIW5572wBCTH/Z+bKuZouGk9Q==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.3.tgz",
+      "integrity": "sha512-jsO7R8To+AdlYgUmN5sHSCZbfhtMBkO0WUx8iORQnPcMMdgr7qM2DQmMwgabs3GhNztdmoKkMKQFHD6DTMCIQw==",
       "cpu": [
         "arm64"
       ],
@@ -2683,9 +3514,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.17.tgz",
-      "integrity": "sha512-b/CgbwAJpmrRLp02RPfhbudf5tZnN9nsPWK82znefso832etkem8H7FSZwxrOI9djcdTP7U6YfNhbRnh7djErg==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.3.tgz",
+      "integrity": "sha512-VWkUHwWriDciit80wleYwKILoR/KMvxh/IdwS/paX+ZgpuRpCrKLUdadJbc0NpBEiyhpYawsJ73j9aCvOH+f7Q==",
       "cpu": [
         "arm64"
       ],
@@ -2703,9 +3534,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.17.tgz",
-      "integrity": "sha512-4EII1iNGRUN5WwGbF/kOh/EIkoDN9HsupgLQoXfY+D1oyJm7/F4t5PYU5n8SWZgG0FEwakyM8pGgwcBYruGTlA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.3.tgz",
+      "integrity": "sha512-5f1laC0SlIR0yDbFCd8acUhvJIag6N3zC5P7oUPN6wX0aOma+uKJ0wBDH5aq7I1PVI2ttTlhJwzwRIBnLiSGEg==",
       "cpu": [
         "ppc64"
       ],
@@ -2723,9 +3554,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.17.tgz",
-      "integrity": "sha512-AH8oq3XqQo4IibpVXvPeLDI5pzkpYn0WiZAfT05kFzoJ6tQNzwRdDYQ45M8I/gslbodRZwW8uxLhbSBbkv96rA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.3.tgz",
+      "integrity": "sha512-Iq4ko0r4XsgbrF/LunNgHtAGLRRVE2kXonAXQ/MV0mC6jQpMOhW1SvtZja2EhC/kd05++bP78dsqBeIQyYJ6Yg==",
       "cpu": [
         "s390x"
       ],
@@ -2743,9 +3574,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.17.tgz",
-      "integrity": "sha512-cLnjV3xfo7KslbU41Z7z8BH/E1y5mzUYzAqih1d1MDaIGZRCMqTijqLv76/P7fyHuvUcfGsIpqCdddbxLLK9rA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.3.tgz",
+      "integrity": "sha512-B8m6tD5+/N5FeNQFbKlLA/2yVq9ycQP1SeedyEYYKWBNR3ZQbkvIUcNnDNM03lO1l5F2roiiFJGgvoLLyZXtSg==",
       "cpu": [
         "x64"
       ],
@@ -2763,9 +3594,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.17.tgz",
-      "integrity": "sha512-0phclDw1spsL7dUB37sIARuis2tAgomCJXAHZlpt8PXZ4Ba0dRP1e+66lsRqrfhISeN9bEGNjQs+T/Fbd7oYGw==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.3.tgz",
+      "integrity": "sha512-pSdpdUJHkuCxun9LE7jvgUB9qsRgaiyNNCX7m/AvHTcq67AiT/Yhoxvw5zPfhrM8k/BfP8ce/hMOpthKDpEUow==",
       "cpu": [
         "x64"
       ],
@@ -2783,9 +3614,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.17.tgz",
-      "integrity": "sha512-0ag/hEgXOwgw4t8QyQvUCxvEg+V0KBcA6YuOx9g0r02MprutRF5dyljgm3EmR02O292UX7UeS6HzWHAl6KgyhA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.3.tgz",
+      "integrity": "sha512-OXXS3RKJgX2uLwM+gYyuH5omcH8fL1LJs96pZGgtetVCahON57+d4SJHzTgZiOjxgGkSnpXpOsWuPDGAKAigEg==",
       "cpu": [
         "arm64"
       ],
@@ -2800,9 +3631,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.17.tgz",
-      "integrity": "sha512-LEXei6vo0E5wTGwpkJ4KoT3OZJRnglwldt5ziLzOlc6qqb55z4tWNq2A+PFqCJuvWWdP53CVhG1Z9NtToDPJrA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.3.tgz",
+      "integrity": "sha512-JTtb8BWFynicNSoPrehsCzBtOKjZ6jhMiPFEmOiuXg1Fl8dn2KHQob+GuPSGR0dryQa1PQJbzjF3dqO/whhjLg==",
       "cpu": [
         "wasm32"
       ],
@@ -2818,10 +3649,33 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.1",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@rolldown/binding-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.17.tgz",
-      "integrity": "sha512-gUmyzBl3SPMa6hrqFUth9sVfcLBlYsbMzBx5PlexMroZStgzGqlZ26pYG89rBb45Mnia+oil6YAIFeEWGWhoZA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.3.tgz",
+      "integrity": "sha512-gEdFFEN70A/jxb2svrWsN3aDL7OUtmvlOy+6fa2jxG8K0wQ1ZbdeLGnidov6Yu5/733dI5ySfzFlQ/cb0bSz1g==",
       "cpu": [
         "arm64"
       ],
@@ -2836,9 +3690,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.17.tgz",
-      "integrity": "sha512-3hkiolcUAvPB9FLb3UZdfjVVNWherN1f/skkGWJP/fgSQhYUZpSIRr0/I8ZK9TkF3F7kxvJAk0+IcKvPHk9qQg==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.3.tgz",
+      "integrity": "sha512-eXB7CHuaQdqmJcc3koCNtNPmT/bj2gc999kUFgBxG8Ac0NdgXc4rkCHhqrgrhN3zddvvvrgzj1e90SuSfmyIXA==",
       "cpu": [
         "x64"
       ],
@@ -2853,16 +3707,16 @@
       }
     },
     "node_modules/@rolldown/pluginutils": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.17.tgz",
-      "integrity": "sha512-n8iosDOt6Ig1UhJ2AYqoIhHWh/isz0xpicHTzpKBeotdVsTEcxsSA/i3EVM7gQAj0rU27OLAxCjzlj15IWY7bg==",
+      "version": "1.0.0-rc.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.3.tgz",
+      "integrity": "sha512-eybk3TjzzzV97Dlj5c+XrBFW57eTNhzod66y9HrBlzJ6NsCrWCp/2kaPS3K9wJmurBC0Tdw4yPjXKZqlznim3Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@rollup/pluginutils": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.3.0.tgz",
-      "integrity": "sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q==",
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.4.0.tgz",
+      "integrity": "sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2882,19 +3736,6 @@
         }
       }
     },
-    "node_modules/@rollup/pluginutils/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
     "node_modules/@scarf/scarf": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/@scarf/scarf/-/scarf-1.4.0.tgz",
@@ -2927,16 +3768,16 @@
       "license": "MIT"
     },
     "node_modules/@storybook/addon-docs": {
-      "version": "10.3.6",
-      "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.3.6.tgz",
-      "integrity": "sha512-TvIdADVPtauxW0LzXIpIv7X6GxwetorhyNh+6+7MHC27XSBCWVxxRUwL63YeLlHTuXsIk0quG3b1xgwVRzWOJA==",
+      "version": "10.4.6",
+      "resolved": "https://registry.npmjs.org/@storybook/addon-docs/-/addon-docs-10.4.6.tgz",
+      "integrity": "sha512-aWAfP5JMiT5a3zBJizwroCRzOCqZwDTJmvsYvwMD3ilIEa/kT1vhf6Xrbk4XIPhDwbh8Hpb/Gfnka1xBYEISWg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@mdx-js/react": "^3.0.0",
-        "@storybook/csf-plugin": "10.3.6",
-        "@storybook/icons": "^2.0.1",
-        "@storybook/react-dom-shim": "10.3.6",
+        "@storybook/csf-plugin": "10.4.6",
+        "@storybook/icons": "^2.0.2",
+        "@storybook/react-dom-shim": "10.4.6",
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "ts-dedent": "^2.0.0"
@@ -2946,17 +3787,23 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
-        "storybook": "^10.3.6"
+        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "storybook": "^10.4.6"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        }
       }
     },
     "node_modules/@storybook/builder-vite": {
-      "version": "10.3.6",
-      "resolved": "https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.3.6.tgz",
-      "integrity": "sha512-gpvR/sE4BcrFtmQZ+Ker7zD23oQzoVeqD9nF6cK6yzY+Q0svJXyX2EPmFG4y+EwygD5/vNzDpP84gGMut8VRwg==",
+      "version": "10.4.6",
+      "resolved": "https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-10.4.6.tgz",
+      "integrity": "sha512-BHBtD81HiXUiDQz/CaFynLtWmm7AFUQn8VnXuHipZ8KlnUANopa4yqdVuy/Gwz8ub254uFI5NMZsW/KlgWNgNg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@storybook/csf-plugin": "10.3.6",
+        "@storybook/csf-plugin": "10.4.6",
         "ts-dedent": "^2.0.0"
       },
       "funding": {
@@ -2964,14 +3811,14 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
-        "storybook": "^10.3.6",
+        "storybook": "^10.4.6",
         "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
     "node_modules/@storybook/csf-plugin": {
-      "version": "10.3.6",
-      "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.3.6.tgz",
-      "integrity": "sha512-9kBf7VRdRqTSIYo+rPtVn5yjYYyK8kP2QhEYx3oiXvfwy4RexmbJnhk/tXa/lNiTqukA1TqaWQ2+5MqF4fu6YQ==",
+      "version": "10.4.6",
+      "resolved": "https://registry.npmjs.org/@storybook/csf-plugin/-/csf-plugin-10.4.6.tgz",
+      "integrity": "sha512-NILLxDqpA/JR/AazGWpsz+4fadJwRU4uhHephGtYpVOWnQA/DkJfKT6zpcJVq8+QA8A2zKMLX3GVKsXIrxjuDA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2984,7 +3831,7 @@
       "peerDependencies": {
         "esbuild": "*",
         "rollup": "*",
-        "storybook": "^10.3.6",
+        "storybook": "^10.4.6",
         "vite": "*",
         "webpack": "*"
       },
@@ -3011,9 +3858,9 @@
       "license": "MIT"
     },
     "node_modules/@storybook/icons": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@storybook/icons/-/icons-2.0.1.tgz",
-      "integrity": "sha512-/smVjw88yK3CKsiuR71vNgWQ9+NuY2L+e8X7IMrFjexjm6ZR8ULrV2DRkTA61aV6ryefslzHEGDInGpnNeIocg==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@storybook/icons/-/icons-2.0.2.tgz",
+      "integrity": "sha512-KZBCpXsshAIjczYNXR/rlxEtCUX/eAbpFNwKi8bcOomrLA4t/SyPz5RF+lVPO2oZBUE4sAkt43mfJUevQDSEEw==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -3022,14 +3869,14 @@
       }
     },
     "node_modules/@storybook/react": {
-      "version": "10.3.6",
-      "resolved": "https://registry.npmjs.org/@storybook/react/-/react-10.3.6.tgz",
-      "integrity": "sha512-oZQZ6xayWe5IdHmFUTL0TL8rX/gpNNh9gWhT2vzW5eeUvlkVG/RBKdsja6Ndrk2s1D9vcnwiI6r6CNXy3IEEmg==",
+      "version": "10.4.6",
+      "resolved": "https://registry.npmjs.org/@storybook/react/-/react-10.4.6.tgz",
+      "integrity": "sha512-9Y7YecrVFe1/01KYjfOLxVqTg2Aq+IO6TEv6sC2U0PfD0AWCSCmQ91QqgBpN/XW4aFFWoiZNinyXMUlU8zxy2w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@storybook/global": "^5.0.0",
-        "@storybook/react-dom-shim": "10.3.6",
+        "@storybook/react-dom-shim": "10.4.6",
         "react-docgen": "^8.0.2",
         "react-docgen-typescript": "^2.2.2"
       },
@@ -3038,21 +3885,29 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
+        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "@types/react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.3.6",
+        "storybook": "^10.4.6",
         "typescript": ">= 4.9.x"
       },
       "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        },
         "typescript": {
           "optional": true
         }
       }
     },
     "node_modules/@storybook/react-dom-shim": {
-      "version": "10.3.6",
-      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.3.6.tgz",
-      "integrity": "sha512-/Tu1gPu+Fw+zOnAGmxRmOD30FX3a04LxcTAKflEtdpmtIMVR5bA3qpjy+f5YhoyDCecbXyKmL1OeIU2FIIZHqQ==",
+      "version": "10.4.6",
+      "resolved": "https://registry.npmjs.org/@storybook/react-dom-shim/-/react-dom-shim-10.4.6.tgz",
+      "integrity": "sha512-iGNmKzrq9vgl2PDrYAnZKI+yvac3Ym+lJXXuQaqlFRS23zA5MNm4EBX+rAG7WulqchoK6NaZ0KQOs2mAgEpTMg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -3060,22 +3915,32 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
+        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "@types/react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.3.6"
+        "storybook": "^10.4.6"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
       }
     },
     "node_modules/@storybook/react-vite": {
-      "version": "10.3.6",
-      "resolved": "https://registry.npmjs.org/@storybook/react-vite/-/react-vite-10.3.6.tgz",
-      "integrity": "sha512-tySQRc+8q7V2NkylQMNJjDV8zXy6tkxb8oDqw/DIhHhI9Xn77MTKVZ8Cihbo5NMm7HYTB6xDKr6wqdSMgdufYQ==",
+      "version": "10.4.6",
+      "resolved": "https://registry.npmjs.org/@storybook/react-vite/-/react-vite-10.4.6.tgz",
+      "integrity": "sha512-0arEQtybqGYXHbXpTot+Wv9YtG+V5Vp43QayXavPKQ20M8mpEzhyCPKd0EhqMGSC1Z1UEt0hm365WUBhI9LfKA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@joshwooding/vite-plugin-react-docgen-typescript": "^0.7.0",
         "@rollup/pluginutils": "^5.0.2",
-        "@storybook/builder-vite": "10.3.6",
-        "@storybook/react": "10.3.6",
+        "@storybook/builder-vite": "10.4.6",
+        "@storybook/react": "10.4.6",
         "empathic": "^2.0.0",
         "magic-string": "^0.30.0",
         "react-docgen": "^8.0.0",
@@ -3089,14 +3954,14 @@
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "storybook": "^10.3.6",
+        "storybook": "^10.4.6",
         "vite": "^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
     "node_modules/@swc/core-darwin-arm64": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.33.tgz",
-      "integrity": "sha512-N+L0uXhuO7FIfzqwgxmzv0zIpV0qEp8wPX3QQs2p4atjMoywup2JTeDlXPw+z9pWJGCae3JjM+tZ6myclI+2gA==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.41.tgz",
+      "integrity": "sha512-kREh6J5paQFvP3i7f/4FbqRNOJREutVFVOkder4GVyCBQ39YmER55cW/y1NNjwrchzFqgYswFn0mMDCqbqKzrw==",
       "cpu": [
         "arm64"
       ],
@@ -3110,9 +3975,9 @@
       }
     },
     "node_modules/@swc/core-darwin-x64": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.33.tgz",
-      "integrity": "sha512-/Il4QHSOhV4FekbsDtkrNmKbsX26oSysvgrRswa/RYOHXAkwXDbB4jaeKq6PsJLSPkzJ2KzQ061gtBnk0vNHfA==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.41.tgz",
+      "integrity": "sha512-N8B56ESFazZAWZyIkecADSPCwlLEinW7QLMEeotCpv4J7VXwfH+OLkmRL8o96UZ+1355fwHxDTS6/wK7yucvkA==",
       "cpu": [
         "x64"
       ],
@@ -3126,9 +3991,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm-gnueabihf": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.33.tgz",
-      "integrity": "sha512-C64hBnBxq4viOPQ8hlx+2lJ23bzZBGnjw7ryALmS+0Q3zHmwO8lw1/DArLENw4Q18/0w5wdEO1k3m1wWNtKGqQ==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.41.tgz",
+      "integrity": "sha512-6XrId2fyle0mS5xxON8rU84mPd2Cq1kDJRj+4BnQKTd7u+2kSA6Ww+JkOP0iTNqOqt9OXhPOEAjBHAuonWcdCg==",
       "cpu": [
         "arm"
       ],
@@ -3142,9 +4007,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm64-gnu": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.33.tgz",
-      "integrity": "sha512-TRJfnJbX3jqpxRDRoieMzRiCBS5jOmXNb3iQXmcgjFEHKLnAgK1RZRU8Cq1MsPqO4jAJp/ld1G4O3fXuxv85uw==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.41.tgz",
+      "integrity": "sha512-ynLIarxlkVnqHn1D0fKOVht6mNU5ks6lrH+MY3kkS+XFaGGgDxFZVjWKJlkYTKm3RCvBTfA8Ng5fLufXheMRKQ==",
       "cpu": [
         "arm64"
       ],
@@ -3161,9 +4026,9 @@
       }
     },
     "node_modules/@swc/core-linux-arm64-musl": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.33.tgz",
-      "integrity": "sha512-il7tYM+CpUNzieQbwAjFT1P8zqAhmGWNAGhQZBnxurXZ0aNn+5nqYFTEUKNZl7QibtT0uQXzTZrNGHCIj6Y1Og==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.41.tgz",
+      "integrity": "sha512-dXu/5vd4gh8symyhRF+4G7gOPkjmb4pONhh7sl+6GSiW0LOKZlfu5kXmyFbTz9smOT7jgr002qY9b1nujjXt2A==",
       "cpu": [
         "arm64"
       ],
@@ -3180,9 +4045,9 @@
       }
     },
     "node_modules/@swc/core-linux-ppc64-gnu": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.33.tgz",
-      "integrity": "sha512-ZtNBwN0Z7CFj9Il0FcPaKdjgP7URyKu/3RfH46vq+0paOBqLj4NYldD6Qo//Duif/7IOtAraUfDOmp0PLAufog==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.41.tgz",
+      "integrity": "sha512-XGO6zVPXoPE0gf/XnI4jBbafNT13AYgoh6ns0JCSdOetI/kqVf0vhpz7NuNgAzZrMVCsmieqjPoTwViDgh4mOQ==",
       "cpu": [
         "ppc64"
       ],
@@ -3199,9 +4064,9 @@
       }
     },
     "node_modules/@swc/core-linux-s390x-gnu": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.33.tgz",
-      "integrity": "sha512-De1IyajoOmhOYYjw/lx66bKlyDpHZTueqwpDrWgf5O7T6d1ODeJJO9/OqMBmrBQc5C+dNnlmIufHsp4QVCWufA==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.41.tgz",
+      "integrity": "sha512-0WUglRwyZtW+iMi7J3iFdrCxreZZIKf4egTwEQfIYRsqFax69A0OrFj+NIoFSE03xBT/IFRrg+S8K6f9Ky+4hA==",
       "cpu": [
         "s390x"
       ],
@@ -3218,9 +4083,9 @@
       }
     },
     "node_modules/@swc/core-linux-x64-gnu": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.33.tgz",
-      "integrity": "sha512-mGTH0YxmUN+x6vRN/I6NOk5X0ogNktkwPnJ94IMvR7QjhRDwL0O8RXEDhyUM0YtwWrryBOqaJQBX4zruxEPRGw==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.41.tgz",
+      "integrity": "sha512-VxkuQK59c0tHm6uJZCUrS3cyA2JhGGfdU6e41SZz0x/JS+4Sm7C1mIc97In14vkZJopEt7yXA2TouCqZDSygEA==",
       "cpu": [
         "x64"
       ],
@@ -3237,9 +4102,9 @@
       }
     },
     "node_modules/@swc/core-linux-x64-musl": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.33.tgz",
-      "integrity": "sha512-hj628ZkSEJf6zMf5VMbYrG2O6QqyTIp2qwY6VlCjvIa9lAEZ5c2lfPblCLVGYubTeLJDxadLB/CxqQYOQABeEQ==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.41.tgz",
+      "integrity": "sha512-/0qXIu1ZxggLuovLb22vFfKHq2AA4n6Whw5UwmVCHk4pkw7KWnPIQpMCEqUMPsNkFJig7PPp/TSYFu8ZEb2rtQ==",
       "cpu": [
         "x64"
       ],
@@ -3256,9 +4121,9 @@
       }
     },
     "node_modules/@swc/core-win32-arm64-msvc": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.33.tgz",
-      "integrity": "sha512-GV2oohtN2/5+KSccl86VULu3aT+LrISC8uzgSq0FRnikpD+Zwc+sBlXmoKQ+Db6jI57ITUOIB8jRkdGMABC29g==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.41.tgz",
+      "integrity": "sha512-Y481sMNZM6rECh9VO4+y26N1lWEDAyxnBZskUf37fl90uHE946VHfmiVQWT0uMFOhyJJFovGTRuF4W82dwewUg==",
       "cpu": [
         "arm64"
       ],
@@ -3272,9 +4137,9 @@
       }
     },
     "node_modules/@swc/core-win32-ia32-msvc": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.33.tgz",
-      "integrity": "sha512-gtyvzSNR8DHKfFEA2uqb8Ld1myqi6uEg2jyeUq3ikn5ytYs7H8RpZYC8mdy4NXr8hfcdJfCLXPlYaqqfBXpoEQ==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.41.tgz",
+      "integrity": "sha512-BAchBD5qeUzy3hiPSLJtaaoSm4blCLyYffOF1bGE4ETcV+OisqjUAwDQMJj++4bTpvMCDzwC+Bj3PmQyBCtscw==",
       "cpu": [
         "ia32"
       ],
@@ -3288,9 +4153,9 @@
       }
     },
     "node_modules/@swc/core-win32-x64-msvc": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.33.tgz",
-      "integrity": "sha512-d6fRqQSkJI+kmMEBWaDQ7TMl8+YjLYbwRUPZQ9DY0ORBJeTzOrG0twvfvlZ2xgw6jA0ScQKgfBm4vHLSLl5Hqg==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.41.tgz",
+      "integrity": "sha512-WOkA+fJ/ViVBQDsSV9JC52NACTe5PhlurA6viASDZGb7HR3KS01ZG7RZ+Bg6SVQFIoq3gSbTsskQVe6EbHFAYw==",
       "cpu": [
         "x64"
       ],
@@ -3319,9 +4184,9 @@
       }
     },
     "node_modules/@swc/types": {
-      "version": "0.1.26",
-      "resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.26.tgz",
-      "integrity": "sha512-lyMwd7WGgG79RS7EERZV3T8wMdmPq3xwyg+1nmAM64kIhx5yl+juO2PYIHb7vTiPgPCj8LYjsNV2T5wiQHUEaw==",
+      "version": "0.1.27",
+      "resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.27.tgz",
+      "integrity": "sha512-K6h3iUlqeM946U4sXFYeahefR1YBbXJvko+hv8WS8/0BNJ4OHiHRywMnQUJCqkR7Y9+hqQ1TvEpiKqUhz7NEFg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@swc/counter": "^0.1.3"
@@ -3375,6 +4240,34 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@testing-library/react": {
+      "version": "16.3.2",
+      "resolved": "https://registry.npmjs.org/@testing-library/react/-/react-16.3.2.tgz",
+      "integrity": "sha512-XU5/SytQM+ykqMnAnvB2umaJNIOsLF3PVv//1Ew4CTcpz0/BRyy/af40qqrt7SjKpDdT1saBMc42CUok5gaw+g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.12.5"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@testing-library/dom": "^10.0.0",
+        "@types/react": "^18.0.0 || ^19.0.0",
+        "@types/react-dom": "^18.0.0 || ^19.0.0",
+        "react": "^18.0.0 || ^19.0.0",
+        "react-dom": "^18.0.0 || ^19.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@testing-library/user-event": {
       "version": "14.6.1",
       "resolved": "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.1.tgz",
@@ -3607,9 +4500,9 @@
       "license": "MIT"
     },
     "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
       "dev": true,
       "license": "MIT"
     },
@@ -3664,9 +4557,9 @@
       }
     },
     "node_modules/@types/mdx": {
-      "version": "2.0.13",
-      "resolved": "https://registry.npmjs.org/@types/mdx/-/mdx-2.0.13.tgz",
-      "integrity": "sha512-+OWZQfAYyio6YkJb3HLxDrvnx6SWWDbC0zVPfBRzUk0/nqoDyf6dNxQi3eArPe8rJ473nobTMQ/8Zk+LxJ+Yuw==",
+      "version": "2.0.14",
+      "resolved": "https://registry.npmjs.org/@types/mdx/-/mdx-2.0.14.tgz",
+      "integrity": "sha512-T48PeuJtvLosNTPVhfnIp3i/n3a4g4Bad7YCq5k64D4u7NwDrAotikQ+5+sjtUvBmxCMlbo3dVL+C2dP0rWHzg==",
       "dev": true,
       "license": "MIT"
     },
@@ -3685,19 +4578,18 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "24.12.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.12.2.tgz",
-      "integrity": "sha512-A1sre26ke7HDIuY/M23nd9gfB+nrmhtYyMINbjI1zHJxYteKR6qSMX56FsmjMcDb3SMcjJg5BiRRgOCC/yBD0g==",
-      "dev": true,
+      "version": "24.13.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.2.tgz",
+      "integrity": "sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==",
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~7.16.0"
+        "undici-types": "~7.18.0"
       }
     },
     "node_modules/@types/nodemailer": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@types/nodemailer/-/nodemailer-8.0.0.tgz",
-      "integrity": "sha512-fyf8jWULsCo0d0BuoQ75i6IeoHs47qcqxWc7yUdUcV0pOZGjUTTOvwdG1PRXUDqN/8A64yQdQdnA2pZgcdi+cA==",
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/@types/nodemailer/-/nodemailer-8.0.1.tgz",
+      "integrity": "sha512-PxpaInm8V1JQDd4j0ds5HfvWQk8JupS1C0Picb96QJsrrRDjBH+DlK7L4ZdNSqNULhiZRQHc40nLVShaGxXAMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3705,9 +4597,9 @@
       }
     },
     "node_modules/@types/qs": {
-      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.15.0.tgz",
-      "integrity": "sha512-JawvT8iBVWpzTrz3EGw9BTQFg3BQNmwERdKE22vlTxawwtbyUSlMppvZYKLZzB5zgACXdXxbD3m1bXaMqP/9ow==",
+      "version": "6.15.1",
+      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==",
       "dev": true,
       "license": "MIT"
     },
@@ -3719,9 +4611,9 @@
       "license": "MIT"
     },
     "node_modules/@types/react": {
-      "version": "19.2.14",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.14.tgz",
-      "integrity": "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==",
+      "version": "19.2.17",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
+      "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -3767,9 +4659,9 @@
       }
     },
     "node_modules/@types/superagent": {
-      "version": "8.1.9",
-      "resolved": "https://registry.npmjs.org/@types/superagent/-/superagent-8.1.9.tgz",
-      "integrity": "sha512-pTVjI73witn+9ILmoJdajHGW2jkSaOzhiFYF1Rd3EQ94kymLqB9PjD9ISg7WaALC7+dCHT0FGe9T2LktLq/3GQ==",
+      "version": "8.1.10",
+      "resolved": "https://registry.npmjs.org/@types/superagent/-/superagent-8.1.10.tgz",
+      "integrity": "sha512-nbt4IWXABhW0jGmmpRzCFNlbmwCTzZ2gTUsNIr+X+ItdqPms+PAJZbWsNzpS2USqXjcoNLQcO6nXo60zcPQiIg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3807,18 +4699,27 @@
       "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
       "license": "MIT"
     },
+    "node_modules/@types/web-push": {
+      "version": "3.6.4",
+      "resolved": "https://registry.npmjs.org/@types/web-push/-/web-push-3.6.4.tgz",
+      "integrity": "sha512-GnJmSr40H3RAnj0s34FNTcJi1hmWFV5KXugE0mYWnYhgTAHLJ/dJKAwDmvPJYMke0RplY2XE9LnM4hqSqKIjhQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.59.1.tgz",
-      "integrity": "sha512-BOziFIfE+6osHO9FoJG4zjoHUcvI7fTNBSpdAwrNH0/TLvzjsk2oo8XSSOT2HhqUyhZPfHv4UOffoJ9oEEQ7Ag==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.61.1.tgz",
+      "integrity": "sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.59.1",
-        "@typescript-eslint/type-utils": "8.59.1",
-        "@typescript-eslint/utils": "8.59.1",
-        "@typescript-eslint/visitor-keys": "8.59.1",
+        "@typescript-eslint/scope-manager": "8.61.1",
+        "@typescript-eslint/type-utils": "8.61.1",
+        "@typescript-eslint/utils": "8.61.1",
+        "@typescript-eslint/visitor-keys": "8.61.1",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
         "ts-api-utils": "^2.5.0"
@@ -3831,7 +4732,7 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.59.1",
+        "@typescript-eslint/parser": "^8.61.1",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
         "typescript": ">=4.8.4 <6.1.0"
       }
@@ -3847,16 +4748,16 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.59.1.tgz",
-      "integrity": "sha512-HDQH9O/47Dxi1ceDhBXdaldtf/WV9yRYMjbjCuNk3qnaTD564qwv61Y7+gTxwxRKzSrgO5uhtw584igXVuuZkA==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.61.1.tgz",
+      "integrity": "sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.59.1",
-        "@typescript-eslint/types": "8.59.1",
-        "@typescript-eslint/typescript-estree": "8.59.1",
-        "@typescript-eslint/visitor-keys": "8.59.1",
+        "@typescript-eslint/scope-manager": "8.61.1",
+        "@typescript-eslint/types": "8.61.1",
+        "@typescript-eslint/typescript-estree": "8.61.1",
+        "@typescript-eslint/visitor-keys": "8.61.1",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -3872,14 +4773,14 @@
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.59.1.tgz",
-      "integrity": "sha512-+MuHQlHiEr00Of/IQbE/MmEoi44znZHbR/Pz7Opq4HryUOlRi+/44dro9Ycy8Fyo+/024IWtw8m4JUMCGTYxDg==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.61.1.tgz",
+      "integrity": "sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.59.1",
-        "@typescript-eslint/types": "^8.59.1",
+        "@typescript-eslint/tsconfig-utils": "^8.61.1",
+        "@typescript-eslint/types": "^8.61.1",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -3894,14 +4795,14 @@
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.59.1.tgz",
-      "integrity": "sha512-LwuHQI4pDOYVKvmH2dkaJo6YZCSgouVgnS/z7yBPKBMvgtBvyLqiLy9Z6b7+m/TRcX1NFYUqZetI5Y+aT4GEfg==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.61.1.tgz",
+      "integrity": "sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.59.1",
-        "@typescript-eslint/visitor-keys": "8.59.1"
+        "@typescript-eslint/types": "8.61.1",
+        "@typescript-eslint/visitor-keys": "8.61.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3912,9 +4813,9 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.59.1.tgz",
-      "integrity": "sha512-/0nEyPbX7gRsk0Uwfe4ALwwgxuA66d/l2mhRDNlAvaj4U3juhUtJNq0DsY8M2AYwwb9rEq2hrC3IcIcEt++iJA==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.61.1.tgz",
+      "integrity": "sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3929,15 +4830,15 @@
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.59.1.tgz",
-      "integrity": "sha512-klWPBR2ciQHS3f++ug/mVnWKPjBUo7icEL3FAO1lhAR1Z1i5NQYZ1EannMSRYcq5qCv5wNALlXr6fksRHyYl7w==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.61.1.tgz",
+      "integrity": "sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.59.1",
-        "@typescript-eslint/typescript-estree": "8.59.1",
-        "@typescript-eslint/utils": "8.59.1",
+        "@typescript-eslint/types": "8.61.1",
+        "@typescript-eslint/typescript-estree": "8.61.1",
+        "@typescript-eslint/utils": "8.61.1",
         "debug": "^4.4.3",
         "ts-api-utils": "^2.5.0"
       },
@@ -3954,9 +4855,9 @@
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.59.1.tgz",
-      "integrity": "sha512-ZDCjgccSdYPw5Bxh+my4Z0lJU96ZDN7jbBzvmEn0FZx3RtU1C7VWl6NbDx94bwY3V5YsgwRzJPOgeY2Q/nLG8A==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.61.1.tgz",
+      "integrity": "sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3968,16 +4869,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.59.1.tgz",
-      "integrity": "sha512-OUd+vJS05sSkOip+BkZ/2NS8RMxrAAJemsC6vU3kmfLyeaJT0TftHkV9mcx2107MmsBVXXexhVu4F0TZXyMl4g==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.61.1.tgz",
+      "integrity": "sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.59.1",
-        "@typescript-eslint/tsconfig-utils": "8.59.1",
-        "@typescript-eslint/types": "8.59.1",
-        "@typescript-eslint/visitor-keys": "8.59.1",
+        "@typescript-eslint/project-service": "8.61.1",
+        "@typescript-eslint/tsconfig-utils": "8.61.1",
+        "@typescript-eslint/types": "8.61.1",
+        "@typescript-eslint/visitor-keys": "8.61.1",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
@@ -3996,16 +4897,16 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.59.1.tgz",
-      "integrity": "sha512-3pIeoXhCeYH9FSCBI8P3iNwJlGuzPlYKkTlen2O9T1DSeeg8UG8jstq6BLk+Mda0qup7mgk4z4XL4OzRaxZ8LA==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.61.1.tgz",
+      "integrity": "sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.59.1",
-        "@typescript-eslint/types": "8.59.1",
-        "@typescript-eslint/typescript-estree": "8.59.1"
+        "@typescript-eslint/scope-manager": "8.61.1",
+        "@typescript-eslint/types": "8.61.1",
+        "@typescript-eslint/typescript-estree": "8.61.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -4020,13 +4921,13 @@
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.59.1.tgz",
-      "integrity": "sha512-LdDNl6C5iJExcM0Yh0PwAIBb9PrSiCsWamF/JyEZawm3kFDnRoaq3LGE4bpyRao/fWeGKKyw7icx0YxrLFC5Cg==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.61.1.tgz",
+      "integrity": "sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.59.1",
+        "@typescript-eslint/types": "8.61.1",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -4037,6 +4938,27 @@
         "url": "https://opencollective.com/typescript-eslint"
       }
     },
+    "node_modules/@vitejs/plugin-react": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-5.2.0.tgz",
+      "integrity": "sha512-YmKkfhOAi3wsB1PhJq5Scj3GXMn3WvtQ/JC0xoopuHoXSdmtdStOpFrYaT1kie2YgFBcIe64ROzMYRjCrYOdYw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.29.0",
+        "@babel/plugin-transform-react-jsx-self": "^7.27.1",
+        "@babel/plugin-transform-react-jsx-source": "^7.27.1",
+        "@rolldown/pluginutils": "1.0.0-rc.3",
+        "@types/babel__core": "^7.20.5",
+        "react-refresh": "^0.18.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "peerDependencies": {
+        "vite": "^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
     "node_modules/@vitest/expect": {
       "version": "3.2.4",
       "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-3.2.4.tgz",
@@ -4055,13 +4977,13 @@
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.5.tgz",
-      "integrity": "sha512-/x2EmFC4mT4NNzqvC3fmesuV97w5FC903KPmey4gsnJiMQ3Be1IlDKVaDaG8iqaLFHqJ2FVEkxZk5VmeLjIItw==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz",
+      "integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.5",
+        "@vitest/spy": "4.1.9",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -4082,9 +5004,9 @@
       }
     },
     "node_modules/@vitest/mocker/node_modules/@vitest/spy": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.5.tgz",
-      "integrity": "sha512-2lNOsh6+R2Idnf1TCZqSwYlKN2E/iDlD8sgU59kYVl+OMDmvldO1VDk39smRfpUNwYpNRVn3w4YfuC7KfbBnkQ==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
+      "integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -4115,13 +5037,13 @@
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.5.tgz",
-      "integrity": "sha512-2D+o7Pr82IEO46YPpoA/YU0neeyr6FTerQb5Ro7BUnBuv6NQtT/kmVnczngiMEBhzgqz2UZYl5gArejsyERDSQ==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz",
+      "integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.5",
+        "@vitest/utils": "4.1.9",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -4129,9 +5051,9 @@
       }
     },
     "node_modules/@vitest/runner/node_modules/@vitest/pretty-format": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.5.tgz",
-      "integrity": "sha512-7I3q6l5qr03dVfMX2wCo9FxwSJbPdwKjy2uu/YPpU3wfHvIL4QHwVRp57OfGrDFeUJ8/8QdfBKIV12FTtLn00g==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
+      "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4142,13 +5064,13 @@
       }
     },
     "node_modules/@vitest/runner/node_modules/@vitest/utils": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.5.tgz",
-      "integrity": "sha512-76wdkrmfXfqGjueGgnb45ITPyUi1ycZ4IHgC2bhPDUfWHklY/q3MdLOAB+TF1e6xfl8NxNY0ZYaPCFNWSsw3Ug==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
+      "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.5",
+        "@vitest/pretty-format": "4.1.9",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -4167,14 +5089,14 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.5.tgz",
-      "integrity": "sha512-zypXEt4KH/XgKGPUz4eC2AvErYx0My5hfL8oDb1HzGFpEk1P62bxSohdyOmvz+d9UJwanI68MKwr2EquOaOgMQ==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz",
+      "integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.5",
-        "@vitest/utils": "4.1.5",
+        "@vitest/pretty-format": "4.1.9",
+        "@vitest/utils": "4.1.9",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -4183,9 +5105,9 @@
       }
     },
     "node_modules/@vitest/snapshot/node_modules/@vitest/pretty-format": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.5.tgz",
-      "integrity": "sha512-7I3q6l5qr03dVfMX2wCo9FxwSJbPdwKjy2uu/YPpU3wfHvIL4QHwVRp57OfGrDFeUJ8/8QdfBKIV12FTtLn00g==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
+      "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4196,13 +5118,13 @@
       }
     },
     "node_modules/@vitest/snapshot/node_modules/@vitest/utils": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.5.tgz",
-      "integrity": "sha512-76wdkrmfXfqGjueGgnb45ITPyUi1ycZ4IHgC2bhPDUfWHklY/q3MdLOAB+TF1e6xfl8NxNY0ZYaPCFNWSsw3Ug==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
+      "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.5",
+        "@vitest/pretty-format": "4.1.9",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -4269,9 +5191,9 @@
       }
     },
     "node_modules/acorn": {
-      "version": "8.16.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
-      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
+      "version": "8.17.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.17.0.tgz",
+      "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -4304,6 +5226,15 @@
         "node": ">=0.4.0"
       }
     },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/ajv": {
       "version": "6.15.0",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
@@ -4321,22 +5252,6 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/ansi-escapes": {
-      "version": "7.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-7.3.0.tgz",
-      "integrity": "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "environment": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
@@ -4362,9 +5277,9 @@
       }
     },
     "node_modules/ansis": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/ansis/-/ansis-4.2.0.tgz",
-      "integrity": "sha512-HqZ5rWlFjGiV0tDm3UxxgNRqsOTniqoKZu0pIAfh7TZQMGuZK+hH0drySty0si0QXj1ieop4+SkSfPZBPPkHig==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/ansis/-/ansis-4.3.1.tgz",
+      "integrity": "sha512-BJ8/l4R5LRE7hW9WdSuGYrLSHi2ynxeFpDFbH0K/CgNeY/tyhk+vO6TYxXC5r5CpUhNVX310xzPsN/H9lCdfOA==",
       "license": "ISC",
       "engines": {
         "node": ">=14"
@@ -4384,6 +5299,31 @@
         "node": ">= 8"
       }
     },
+    "node_modules/anymatch/node_modules/picomatch": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/anynum": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/anynum/-/anynum-1.0.1.tgz",
+      "integrity": "sha512-N6//FLET/tXYNM/F6ABca1oH6fWB+KlTt909Le28WMDBk8oaT4vY17DCrwg2MvmuqUKt3Ni4N5dGJ/EoBgcO6A==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/app-root-path": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/app-root-path/-/app-root-path-3.1.0.tgz",
@@ -4410,6 +5350,18 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/asn1.js": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/asn1.js/-/asn1.js-5.4.1.tgz",
+      "integrity": "sha512-+I//4cYPccV8LdmBLiX8CYvf9Sp3vQsrqu2QNXRcrbiWvcx/UdlFiqUJJzxRQxgsZmvhXhn4cSKeSmoFjVdupA==",
+      "license": "MIT",
+      "dependencies": {
+        "bn.js": "^4.0.0",
+        "inherits": "^2.0.1",
+        "minimalistic-assert": "^1.0.0",
+        "safer-buffer": "^2.1.0"
+      }
+    },
     "node_modules/assertion-error": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
@@ -4459,15 +5411,16 @@
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
       "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": "18 || 20 || >=22"
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.27",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.27.tgz",
-      "integrity": "sha512-zEs/ufmZoUd7WftKpKyXaT6RFxpQ5Qm9xytKRHvJfxFV9DFJkZph9RvJ1LcOUi0Z1ZVijMte65JbILeV+8QQEA==",
+      "version": "2.10.38",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.38.tgz",
+      "integrity": "sha512-31/02mVB4yuQU6adKk5SlY6m+mxDwUq5KZkyYgnLrrKl7TEm1+3PyDtDBz2kOv/wxZz41GHsvV1A/u6RmiyBvw==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -4503,22 +5456,41 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/bn.js": {
+      "version": "4.12.3",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.3.tgz",
+      "integrity": "sha512-fGTi3gxV/23FTYdAoUtLYp6qySe2KE3teyZitipKNRuVYcBkoP/bB3guXN/XVKUe9mxCHXnc9C4ocyz8OmgN0g==",
+      "license": "MIT"
+    },
     "node_modules/body-parser": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
-      "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
+      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "debug": "^4.4.3",
-        "http-errors": "^2.0.0",
-        "iconv-lite": "^0.7.0",
+        "http-errors": "^2.0.1",
+        "iconv-lite": "^0.7.2",
         "on-finished": "^2.4.1",
-        "qs": "^6.14.1",
-        "raw-body": "^3.0.1",
-        "type-is": "^2.0.1"
+        "qs": "^6.15.2",
+        "raw-body": "^3.0.2",
+        "type-is": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=18"
       },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/body-parser/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
       "engines": {
         "node": ">=18"
       },
@@ -4528,9 +5500,10 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -4665,9 +5638,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001791",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001791.tgz",
-      "integrity": "sha512-yk0l/YSrOnFZk3UROpDLQD9+kC1l4meK/wed583AXrzoarMGJcbRi2Q4RaUYbKxYAsZ8sWmaSa/DsLmdBeI1vQ==",
+      "version": "1.0.30001799",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
+      "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==",
       "funding": [
         {
           "type": "opencollective",
@@ -4779,39 +5752,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/cli-cursor": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-5.0.0.tgz",
-      "integrity": "sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "restore-cursor": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/cli-truncate": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-4.0.0.tgz",
-      "integrity": "sha512-nPdaFdQ0h/GEigbPClz11D0v/ZJEwxmeVZGeMo3Z5StPtUTkA9o1lD6QwoirYiSDzbcwn2XcjwmCp68W1IS4TA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "slice-ansi": "^5.0.0",
-        "string-width": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/client-only": {
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
@@ -4832,64 +5772,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/cliui/node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "license": "MIT"
-    },
-    "node_modules/cliui/node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cliui/node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cliui/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cliui/node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
     "node_modules/clsx": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
@@ -4900,9 +5782,9 @@
       }
     },
     "node_modules/cluster-key-slot": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/cluster-key-slot/-/cluster-key-slot-1.1.2.tgz",
-      "integrity": "sha512-RMr0FhtfXemyinomL4hrWcYJxmX6deFdCxpJzhDttxgO1+bcCnkk+9drydLVDmAMG7NE6aN/fl4F7ucU/90gAA==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cluster-key-slot/-/cluster-key-slot-1.1.1.tgz",
+      "integrity": "sha512-rwHwUfXL40Chm1r08yrhU3qpUvdVlgkKNeyeGPOxnW8/SyVDvgRaed/Uz54AqWNaTCAThlj6QAs3TZcKI0xDEw==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=0.10.0"
@@ -4926,13 +5808,6 @@
       "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "license": "MIT"
     },
-    "node_modules/colorette": {
-      "version": "2.0.20",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
-      "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/combined-stream": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
@@ -4947,13 +5822,13 @@
       }
     },
     "node_modules/commander": {
-      "version": "13.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-13.1.0.tgz",
-      "integrity": "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==",
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz",
+      "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">= 10"
       }
     },
     "node_modules/component-emitter": {
@@ -4967,15 +5842,15 @@
       }
     },
     "node_modules/concurrently": {
-      "version": "9.2.1",
-      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-9.2.1.tgz",
-      "integrity": "sha512-fsfrO0MxV64Znoy8/l1vVIjjHa29SZyyqPgQBwhiDcaW8wJc2W3XWVOGx4M3oJBnv/zdUZIIp1gDeS98GzP8Ng==",
+      "version": "9.2.3",
+      "resolved": "https://registry.npmjs.org/concurrently/-/concurrently-9.2.3.tgz",
+      "integrity": "sha512-ihjs0E2SxvDgq/MK418hX6YycQgKhsqxpbZuZbHo0yKfqDWdymWMjWYIpCIzqDDLLKClHlXev8whW/8WXmJ0BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "chalk": "4.1.2",
         "rxjs": "7.8.2",
-        "shell-quote": "1.8.3",
+        "shell-quote": "1.8.4",
         "supports-color": "8.1.1",
         "tree-kill": "1.2.2",
         "yargs": "17.7.2"
@@ -5076,6 +5951,7 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -5091,7 +5967,21 @@
       "resolved": "https://registry.npmjs.org/css.escape/-/css.escape-1.5.1.tgz",
       "integrity": "sha512-YUifsXXuknHlUsmlgyY0PKzgPOr7/FjCePfHNt0jxm83wHZi44VDMQ7/fGNkjY3/jV1MC+1CmZbaHzugyeRtpg==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT"
+    },
+    "node_modules/cssstyle": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-4.6.0.tgz",
+      "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/css-color": "^3.2.0",
+        "rrweb-cssom": "^0.8.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/csstype": {
       "version": "3.2.3",
@@ -5221,10 +6111,24 @@
         "node": ">=12"
       }
     },
+    "node_modules/data-urls": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-5.0.0.tgz",
+      "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/dayjs": {
-      "version": "1.11.20",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.20.tgz",
-      "integrity": "sha512-YbwwqR/uYpeoP4pu043q+LTDLFBLApUP6VxRihdfNTqu4ubqMlGDLd6ErXhEgsyvY0K6nCs7nggYumAN+9uEuQ==",
+      "version": "1.11.21",
+      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz",
+      "integrity": "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==",
       "license": "MIT"
     },
     "node_modules/debounce": {
@@ -5251,6 +6155,13 @@
         }
       }
     },
+    "node_modules/decimal.js": {
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
+      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/decimal.js-light": {
       "version": "2.5.1",
       "resolved": "https://registry.npmjs.org/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
@@ -5476,23 +6387,22 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.349",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.349.tgz",
-      "integrity": "sha512-QsWVGyRuY07Aqb234QytTfwd5d9AJlfNIQ5wIOl1L+PZDzI9d9+Fn0FRale/QYlFxt/bUnB0/nLd1jFPGxGK1A==",
+      "version": "1.5.376",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.376.tgz",
+      "integrity": "sha512-cUVA7/RvbFTEuw/i3obUwDTRIXojaxkResf+ibByPFxjc6XK3VNtcQXV0NSbAlJ0FMjcJGgftVVB4Qo184EXvA==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/emoji-regex": {
-      "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.6.0.tgz",
-      "integrity": "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==",
-      "dev": true,
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "license": "MIT"
     },
     "node_modules/empathic": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.0.0.tgz",
-      "integrity": "sha512-i6UzDscO/XfAcNYD75CfICkmfLedpyPDdozrLMmQc5ORaQcdMoc21OnlEylMIqI7U8eniKrPMxxtj8k0vhmJhA==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.0.1.tgz",
+      "integrity": "sha512-YGRs8knHhKHVShLkFET/rWAU8kmHbOV5LwN938RHI0pljAJ1Gf6SzXsSmRaEzcXTtOOmVqJ5+WtQPL5uigY50Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5508,17 +6418,17 @@
         "node": ">= 0.8"
       }
     },
-    "node_modules/environment": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/environment/-/environment-1.1.0.tgz",
-      "integrity": "sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q==",
+    "node_modules/entities": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
       "dev": true,
-      "license": "MIT",
+      "license": "BSD-2-Clause",
       "engines": {
-        "node": ">=18"
+        "node": ">=0.12"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "url": "https://github.com/fb55/entities?sponsor=1"
       }
     },
     "node_modules/es-define-property": {
@@ -5547,9 +6457,9 @@
       "license": "MIT"
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -5575,9 +6485,9 @@
       }
     },
     "node_modules/es-toolkit": {
-      "version": "1.46.1",
-      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.46.1.tgz",
-      "integrity": "sha512-5eNtXOs3tbfxXOj04tjjseeWkRWaoCjdEI+96DgwzZoe6c9juL49pXlzAFTI72aWC9Y8p7168g6XIKjh7k6pyQ==",
+      "version": "1.48.1",
+      "resolved": "https://registry.npmjs.org/es-toolkit/-/es-toolkit-1.48.1.tgz",
+      "integrity": "sha512-wfnXlwd5I75eXRtdD2vuEs50xHHESECDsGD7yiQnfFVNoa5522NwXEbmgo98LfiukSQHs+mBM7/YG3qKJB9/mQ==",
       "license": "MIT",
       "workspaces": [
         "docs",
@@ -5585,9 +6495,9 @@
       ]
     },
     "node_modules/esbuild": {
-      "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.7.tgz",
-      "integrity": "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -5598,32 +6508,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.27.7",
-        "@esbuild/android-arm": "0.27.7",
-        "@esbuild/android-arm64": "0.27.7",
-        "@esbuild/android-x64": "0.27.7",
-        "@esbuild/darwin-arm64": "0.27.7",
-        "@esbuild/darwin-x64": "0.27.7",
-        "@esbuild/freebsd-arm64": "0.27.7",
-        "@esbuild/freebsd-x64": "0.27.7",
-        "@esbuild/linux-arm": "0.27.7",
-        "@esbuild/linux-arm64": "0.27.7",
-        "@esbuild/linux-ia32": "0.27.7",
-        "@esbuild/linux-loong64": "0.27.7",
-        "@esbuild/linux-mips64el": "0.27.7",
-        "@esbuild/linux-ppc64": "0.27.7",
-        "@esbuild/linux-riscv64": "0.27.7",
-        "@esbuild/linux-s390x": "0.27.7",
-        "@esbuild/linux-x64": "0.27.7",
-        "@esbuild/netbsd-arm64": "0.27.7",
-        "@esbuild/netbsd-x64": "0.27.7",
-        "@esbuild/openbsd-arm64": "0.27.7",
-        "@esbuild/openbsd-x64": "0.27.7",
-        "@esbuild/openharmony-arm64": "0.27.7",
-        "@esbuild/sunos-x64": "0.27.7",
-        "@esbuild/win32-arm64": "0.27.7",
-        "@esbuild/win32-ia32": "0.27.7",
-        "@esbuild/win32-x64": "0.27.7"
+        "@esbuild/aix-ppc64": "0.28.1",
+        "@esbuild/android-arm": "0.28.1",
+        "@esbuild/android-arm64": "0.28.1",
+        "@esbuild/android-x64": "0.28.1",
+        "@esbuild/darwin-arm64": "0.28.1",
+        "@esbuild/darwin-x64": "0.28.1",
+        "@esbuild/freebsd-arm64": "0.28.1",
+        "@esbuild/freebsd-x64": "0.28.1",
+        "@esbuild/linux-arm": "0.28.1",
+        "@esbuild/linux-arm64": "0.28.1",
+        "@esbuild/linux-ia32": "0.28.1",
+        "@esbuild/linux-loong64": "0.28.1",
+        "@esbuild/linux-mips64el": "0.28.1",
+        "@esbuild/linux-ppc64": "0.28.1",
+        "@esbuild/linux-riscv64": "0.28.1",
+        "@esbuild/linux-s390x": "0.28.1",
+        "@esbuild/linux-x64": "0.28.1",
+        "@esbuild/netbsd-arm64": "0.28.1",
+        "@esbuild/netbsd-x64": "0.28.1",
+        "@esbuild/openbsd-arm64": "0.28.1",
+        "@esbuild/openbsd-x64": "0.28.1",
+        "@esbuild/openharmony-arm64": "0.28.1",
+        "@esbuild/sunos-x64": "0.28.1",
+        "@esbuild/win32-arm64": "0.28.1",
+        "@esbuild/win32-ia32": "0.28.1",
+        "@esbuild/win32-x64": "0.28.1"
       }
     },
     "node_modules/escalade": {
@@ -5655,18 +6565,21 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.3.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.3.0.tgz",
-      "integrity": "sha512-XbEXaRva5cF0ZQB8w6MluHA0kZZfV2DuCMJ3ozyEOHLwDpZX2Lmm/7Pp0xdJmI0GL1W05VH5VwIFHEm1Vcw2gw==",
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.5.0.tgz",
+      "integrity": "sha512-1y+7C+vi12bUK1IpZeaV3gsH9fHLBmPvYmPx42pvT/E9yG0IC8g3PUZZgp0+JLJl7ZDK0flc2gc+Aw9dpCvIsQ==",
       "dev": true,
       "license": "MIT",
+      "workspaces": [
+        "packages/*"
+      ],
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.2",
         "@eslint/config-array": "^0.23.5",
-        "@eslint/config-helpers": "^0.5.5",
+        "@eslint/config-helpers": "^0.6.0",
         "@eslint/core": "^1.2.1",
-        "@eslint/plugin-kit": "^0.7.1",
+        "@eslint/plugin-kit": "^0.7.2",
         "@humanfs/node": "^0.16.6",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@humanwhocodes/retry": "^0.4.2",
@@ -5745,9 +6658,9 @@
       }
     },
     "node_modules/eslint-plugin-storybook": {
-      "version": "10.3.6",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-storybook/-/eslint-plugin-storybook-10.3.6.tgz",
-      "integrity": "sha512-8udrL+Rmp5LFaZvgRe4J226X1MYls25bWCyHuzR5X8s2qbFTryX+wKC+o/0Ato4A1AvwnDg8OOMPc6yWJ9JpcA==",
+      "version": "10.4.6",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-storybook/-/eslint-plugin-storybook-10.4.6.tgz",
+      "integrity": "sha512-CfGSXn6zFspeYTU8R7v797MOmJFj8xc6MWf/oGuRwbKeMoSwnliR+OlXSjMZYM1D6gfmwiuH1VX58LSHdn+ZPg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5755,7 +6668,7 @@
       },
       "peerDependencies": {
         "eslint": ">=8",
-        "storybook": "^10.3.6"
+        "storybook": "^10.4.6"
       }
     },
     "node_modules/eslint-scope": {
@@ -5890,30 +6803,6 @@
       "integrity": "sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==",
       "license": "MIT"
     },
-    "node_modules/execa": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-8.0.1.tgz",
-      "integrity": "sha512-VyhnebXciFV2DESc+p6B+y0LjSm0krU4OgJN44qFAhBY0TJ+1V61tYD2+wHusZ6F9n5K+vl8k0sTy7PEfV4qpg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cross-spawn": "^7.0.3",
-        "get-stream": "^8.0.1",
-        "human-signals": "^5.0.0",
-        "is-stream": "^3.0.0",
-        "merge-stream": "^2.0.0",
-        "npm-run-path": "^5.1.0",
-        "onetime": "^6.0.0",
-        "signal-exit": "^4.1.0",
-        "strip-final-newline": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=16.17"
-      },
-      "funding": {
-        "url": "https://github.com/sindresorhus/execa?sponsor=1"
-      }
-    },
     "node_modules/expect-type": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
@@ -5968,12 +6857,12 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "8.4.1",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.4.1.tgz",
-      "integrity": "sha512-NGVYwQSAyEQgzxX1iCM978PP9AdO/hW93gMcF6ZwQCm+rFvLsBH6w4xcXWTcliS8La5EPRN3p9wzItqBwJrfNw==",
+      "version": "8.5.2",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.2.tgz",
+      "integrity": "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==",
       "license": "MIT",
       "dependencies": {
-        "ip-address": "10.1.0"
+        "ip-address": "^10.2.0"
       },
       "engines": {
         "node": ">= 16"
@@ -5985,15 +6874,6 @@
         "express": ">= 4.11"
       }
     },
-    "node_modules/express-rate-limit/node_modules/ip-address": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
     "node_modules/express/node_modules/cookie-signature": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
@@ -6032,9 +6912,9 @@
       "license": "MIT"
     },
     "node_modules/fast-xml-builder": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.7.tgz",
-      "integrity": "sha512-Yh7/7rQuMXICNr0oMYDR2yHP6oUvmQsTToFeOWj/kIDhAwQ+c4Ol/lbcwOmEM5OHYQmh6S6EQSQ1sljCKP36bQ==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
+      "integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
       "funding": [
         {
           "type": "github",
@@ -6043,13 +6923,14 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "path-expression-matcher": "^1.1.3"
+        "path-expression-matcher": "^1.5.0",
+        "xml-naming": "^0.1.0"
       }
     },
     "node_modules/fast-xml-parser": {
-      "version": "5.7.2",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.2.tgz",
-      "integrity": "sha512-P7oW7tLbYnhOLQk/Gv7cZgzgMPP/XN03K02/Jy6Y/NHzyIAIpxuZIM/YqAkfiXFPxA2CTm7NtCijK9EDu09u2w==",
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.9.3.tgz",
+      "integrity": "sha512-brCNCeScma/kqa54J4PIDriSSSLssRkuYaUCpvHJulGc3HGI/xxKUCTDcYkAdqJsyb//ydpbxecjC3hB9+tb/g==",
       "funding": [
         {
           "type": "github",
@@ -6058,15 +6939,35 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "@nodable/entities": "^2.1.0",
-        "fast-xml-builder": "^1.1.5",
+        "@nodable/entities": "^2.2.0",
+        "fast-xml-builder": "^1.2.0",
+        "is-unsafe": "^1.0.1",
         "path-expression-matcher": "^1.5.0",
-        "strnum": "^2.2.3"
+        "strnum": "^2.4.1",
+        "xml-naming": "^0.1.0"
       },
       "bin": {
         "fxparser": "src/cli/cli.js"
       }
     },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/file-entry-cache": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
@@ -6167,34 +7068,18 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/foreground-child": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
-      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
-      "license": "ISC",
-      "dependencies": {
-        "cross-spawn": "^7.0.6",
-        "signal-exit": "^4.0.1"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -6302,19 +7187,6 @@
         "node": "6.* || 8.* || >= 10.*"
       }
     },
-    "node_modules/get-east-asian-width": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.5.0.tgz",
-      "integrity": "sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/get-intrinsic": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
@@ -6352,51 +7224,19 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/get-stream": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-8.0.1.tgz",
-      "integrity": "sha512-VaUJspBffn/LMCJVoMvSAdmscJyS1auj5Zulnn5UoYcY531UWmdwhRWkcGKnGU93m5HSXP9LP2usOryrBtQowA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/get-tsconfig": {
-      "version": "4.14.0",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.0.tgz",
-      "integrity": "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "resolve-pkg-maps": "^1.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
-      }
-    },
     "node_modules/glob": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-11.1.0.tgz",
-      "integrity": "sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "foreground-child": "^3.3.1",
-        "jackspeak": "^4.1.1",
-        "minimatch": "^10.1.1",
-        "minipass": "^7.1.2",
-        "package-json-from-dist": "^1.0.0",
-        "path-scurry": "^2.0.0"
-      },
-      "bin": {
-        "glob": "dist/esm/bin.mjs"
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -6506,9 +7346,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz",
-      "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -6517,6 +7357,19 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/html-encoding-sniffer": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-4.0.0.tgz",
+      "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-encoding": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/html-escaper": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
@@ -6524,6 +7377,15 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/http_ece": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/http_ece/-/http_ece-1.2.0.tgz",
+      "integrity": "sha512-JrF8SSLVmcvc5NducxgyOrKXe3EsyHMgBFgSaIUGmArKe+rwr0uphRkRXvwiom3I+fpIfoItveHrfudL8/rxuA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      }
+    },
     "node_modules/http-errors": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
@@ -6544,14 +7406,31 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/human-signals": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-5.0.0.tgz",
-      "integrity": "sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ==",
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
       "engines": {
-        "node": ">=16.17.0"
+        "node": ">= 14"
       }
     },
     "node_modules/iconv-lite": {
@@ -6571,9 +7450,9 @@
       }
     },
     "node_modules/icu-minify": {
-      "version": "4.11.0",
-      "resolved": "https://registry.npmjs.org/icu-minify/-/icu-minify-4.11.0.tgz",
-      "integrity": "sha512-XRvblCwLqWXio5ZLcmDqXvJv7alSACK6UjXuuMOdQWB//d25AQX6xlVlI1FEbc3Q6iPLXXo6HaVLn8LcAFhn1Q==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/icu-minify/-/icu-minify-4.13.0.tgz",
+      "integrity": "sha512-SIFMeUHZJjzS5RvIGvybKvWoHjDm9cGVEs2EpJ8PmywOdJLWyblPm7TdPLLoUtkJtwQD7iGhl2WMptZ+N0on+w==",
       "funding": [
         {
           "type": "individual",
@@ -6613,9 +7492,9 @@
       }
     },
     "node_modules/immutable": {
-      "version": "5.1.5",
-      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.5.tgz",
-      "integrity": "sha512-t7xcm2siw+hlUM68I+UEOK+z84RzmN59as9DZ7P1l0994DKUWV7UXBMQZVxaoMSRQ+PBZbHCOoBt7a2wxOMt+A==",
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/immutable/-/immutable-5.1.6.tgz",
+      "integrity": "sha512-q1swsS8K7L8usSHuOqF2TAoCCkonYz0SG38wLAggaa4Wml70zixIvt2ql4coQ2C2B3hTjltJry4r6bULwgAXLQ==",
       "devOptional": true,
       "license": "MIT"
     },
@@ -6655,30 +7534,28 @@
       }
     },
     "node_modules/intl-messageformat": {
-      "version": "11.2.3",
-      "resolved": "https://registry.npmjs.org/intl-messageformat/-/intl-messageformat-11.2.3.tgz",
-      "integrity": "sha512-kZthTU+3WLcoWoRg5j6LOkN1TeUBtmkX0OIwSAbcHVIfQAEbGVdmANM8u6GL3eUDOqLwheYoXMUshAh1UdeXlQ==",
+      "version": "11.2.8",
+      "resolved": "https://registry.npmjs.org/intl-messageformat/-/intl-messageformat-11.2.8.tgz",
+      "integrity": "sha512-l323RCl3qJDVQ8U9j74ut/hVMdg3VPsOHpVMDvFfz9qiq4dPO5ooVYFNVUzzrpgG39a+RLzcXyJb8VFgIU+tUA==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@formatjs/fast-memoize": "3.1.3",
-        "@formatjs/icu-messageformat-parser": "3.5.6"
+        "@formatjs/fast-memoize": "3.1.6",
+        "@formatjs/icu-messageformat-parser": "3.5.11"
       }
     },
     "node_modules/ioredis": {
-      "version": "5.10.1",
-      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.10.1.tgz",
-      "integrity": "sha512-HuEDBTI70aYdx1v6U97SbNx9F1+svQKBDo30o0b9fw055LMepzpOOd0Ccg9Q6tbqmBSJaMuY0fB7yw9/vjBYCA==",
+      "version": "5.11.1",
+      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.11.1.tgz",
+      "integrity": "sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==",
       "license": "MIT",
       "dependencies": {
-        "@ioredis/commands": "1.5.1",
-        "cluster-key-slot": "^1.1.0",
-        "debug": "^4.3.4",
-        "denque": "^2.1.0",
-        "lodash.defaults": "^4.2.0",
-        "lodash.isarguments": "^3.1.0",
-        "redis-errors": "^1.2.0",
-        "redis-parser": "^3.0.0",
-        "standard-as-callback": "^2.1.0"
+        "@ioredis/commands": "1.10.0",
+        "cluster-key-slot": "1.1.1",
+        "debug": "4.4.3",
+        "denque": "2.1.0",
+        "redis-errors": "1.2.0",
+        "redis-parser": "3.0.0",
+        "standard-as-callback": "2.1.0"
       },
       "engines": {
         "node": ">=12.22.0"
@@ -6732,13 +7609,13 @@
       }
     },
     "node_modules/is-core-module": {
-      "version": "2.16.1",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
-      "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
+      "version": "2.16.2",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.2.tgz",
+      "integrity": "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "hasown": "^2.0.2"
+        "hasown": "^2.0.3"
       },
       "engines": {
         "node": ">= 0.4"
@@ -6773,16 +7650,12 @@
       }
     },
     "node_modules/is-fullwidth-code-point": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-4.0.0.tgz",
-      "integrity": "sha512-O4L094N2/dZ7xqVdrXhh9r1KODPJpFms8B5sGdJLPy664AgvXsreZUyCQQNItZRDlYug4xStLjNp/sz3HvBowQ==",
-      "dev": true,
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
       "license": "MIT",
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=8"
       }
     },
     "node_modules/is-glob": {
@@ -6836,25 +7709,19 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/is-promise": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
       "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
       "license": "MIT"
     },
-    "node_modules/is-stream": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-3.0.0.tgz",
-      "integrity": "sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/is-typed-array": {
       "version": "1.1.15",
       "resolved": "https://registry.npmjs.org/is-typed-array/-/is-typed-array-1.1.15.tgz",
@@ -6870,6 +7737,18 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-unsafe": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-1.0.1.tgz",
+      "integrity": "sha512-CLK2+VdgERgD96EYm5lUQssZYlRg2tkZnbsxZoacmSiRxiFJ4Nk4SzjCl+Ur+v3kXIY9dTIdb3IH22y1mZ56LA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/is-wsl": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-3.1.1.tgz",
@@ -6896,27 +7775,13 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
       "license": "ISC"
     },
-    "node_modules/jackspeak": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-4.2.3.tgz",
-      "integrity": "sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/cliui": "^9.0.0"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/joi": {
-      "version": "18.1.2",
-      "resolved": "https://registry.npmjs.org/joi/-/joi-18.1.2.tgz",
-      "integrity": "sha512-rF5MAmps5esSlhCA+N1b6IYHDw9j/btzGaqfgie522jS02Ju/HXBxamlXVlKEHAxoMKQL77HWI8jlqWsFuekZA==",
+      "version": "18.2.3",
+      "resolved": "https://registry.npmjs.org/joi/-/joi-18.2.3.tgz",
+      "integrity": "sha512-N5A3KTWQpPWT4ExxxPlUx7WmykGXRzhNidWhV41d6Abu9YfI2NyWCJuxdPnslJCPWtbRpSVOWSnSS6GakLM/Rg==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@hapi/address": "^5.1.1",
@@ -6947,6 +7812,46 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/jsdom": {
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-26.1.0.tgz",
+      "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cssstyle": "^4.2.1",
+        "data-urls": "^5.0.0",
+        "decimal.js": "^10.5.0",
+        "html-encoding-sniffer": "^4.0.0",
+        "http-proxy-agent": "^7.0.2",
+        "https-proxy-agent": "^7.0.6",
+        "is-potential-custom-element-name": "^1.0.1",
+        "nwsapi": "^2.2.16",
+        "parse5": "^7.2.1",
+        "rrweb-cssom": "^0.8.0",
+        "saxes": "^6.0.0",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^5.1.1",
+        "w3c-xmlserializer": "^5.0.0",
+        "webidl-conversions": "^7.0.0",
+        "whatwg-encoding": "^3.1.1",
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.1.1",
+        "ws": "^8.18.0",
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/jsesc": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
@@ -7334,78 +8239,6 @@
         "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/lilconfig": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.3.tgz",
-      "integrity": "sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/antonk52"
-      }
-    },
-    "node_modules/lint-staged": {
-      "version": "15.5.2",
-      "resolved": "https://registry.npmjs.org/lint-staged/-/lint-staged-15.5.2.tgz",
-      "integrity": "sha512-YUSOLq9VeRNAo/CTaVmhGDKG+LBtA8KF1X4K5+ykMSwWST1vDxJRB2kv2COgLb1fvpCo+A/y9A0G0znNVmdx4w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "chalk": "^5.4.1",
-        "commander": "^13.1.0",
-        "debug": "^4.4.0",
-        "execa": "^8.0.1",
-        "lilconfig": "^3.1.3",
-        "listr2": "^8.2.5",
-        "micromatch": "^4.0.8",
-        "pidtree": "^0.6.0",
-        "string-argv": "^0.3.2",
-        "yaml": "^2.7.0"
-      },
-      "bin": {
-        "lint-staged": "bin/lint-staged.js"
-      },
-      "engines": {
-        "node": ">=18.12.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/lint-staged"
-      }
-    },
-    "node_modules/lint-staged/node_modules/chalk": {
-      "version": "5.6.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
-      "integrity": "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^12.17.0 || ^14.13 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/listr2": {
-      "version": "8.3.3",
-      "resolved": "https://registry.npmjs.org/listr2/-/listr2-8.3.3.tgz",
-      "integrity": "sha512-LWzX2KsqcB1wqQ4AHgYb4RsDXauQiqhjLk+6hjbaeHG4zpjjVAB6wC/gz6X0l+Du1cN3pUB5ZlrvTbhGSNnUQQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cli-truncate": "^4.0.0",
-        "colorette": "^2.0.20",
-        "eventemitter3": "^5.0.1",
-        "log-update": "^6.1.0",
-        "rfdc": "^1.4.1",
-        "wrap-ansi": "^9.0.0"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
     "node_modules/locate-path": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
@@ -7422,22 +8255,10 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/lodash.defaults": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/lodash.defaults/-/lodash.defaults-4.2.0.tgz",
-      "integrity": "sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ==",
-      "license": "MIT"
-    },
     "node_modules/lodash.includes": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/lodash.includes/-/lodash.includes-4.3.0.tgz",
-      "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
-      "license": "MIT"
-    },
-    "node_modules/lodash.isarguments": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/lodash.isarguments/-/lodash.isarguments-3.1.0.tgz",
-      "integrity": "sha512-chi4NHZlZqZD18a0imDHnZPrDeBbTtVN7GXMwuGdRH9qotxAjYs3aVLKc7zNOG9eddR5Ksd8rvFEBc9SsggPpg==",
+      "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
       "license": "MIT"
     },
     "node_modules/lodash.isboolean": {
@@ -7476,72 +8297,6 @@
       "integrity": "sha512-Sb487aTOCr9drQVL8pIxOzVhafOjZN9UU54hiN8PU3uAiSV7lx1yYNpbNmex2PK6dSJoNTSJUUswT651yww3Mg==",
       "license": "MIT"
     },
-    "node_modules/log-update": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/log-update/-/log-update-6.1.0.tgz",
-      "integrity": "sha512-9ie8ItPR6tjY5uYJh8K/Zrv/RMZ5VOlOWvtZdEHYSTFKZfIBPQa9tOAEeAWhd+AnIneLJ22w5fjOYtoutpWq5w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-escapes": "^7.0.0",
-        "cli-cursor": "^5.0.0",
-        "slice-ansi": "^7.1.0",
-        "strip-ansi": "^7.1.0",
-        "wrap-ansi": "^9.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/log-update/node_modules/ansi-styles": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/log-update/node_modules/is-fullwidth-code-point": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-5.1.0.tgz",
-      "integrity": "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "get-east-asian-width": "^1.3.1"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/log-update/node_modules/slice-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-7.1.2.tgz",
-      "integrity": "sha512-iOBWFgUX7caIZiuutICxVgX1SdxwAVFFKwt1EvMYYec/NWO5meOJ6K5uQxhrYBdQJne4KxiqZc+KptFOWFSI9w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.2.1",
-        "is-fullwidth-code-point": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/slice-ansi?sponsor=1"
-      }
-    },
     "node_modules/loupe": {
       "version": "3.2.1",
       "resolved": "https://registry.npmjs.org/loupe/-/loupe-3.2.1.tgz",
@@ -7550,12 +8305,13 @@
       "license": "MIT"
     },
     "node_modules/lru-cache": {
-      "version": "11.3.5",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.3.5.tgz",
-      "integrity": "sha512-NxVFwLAnrd9i7KUBxC4DrUhmgjzOs+1Qm50D3oF1/oL+r1NpZ4gA7xvG0/zJ8evR7zIKn4vLf7qTNduWFtCrRw==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": "20 || >=22"
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
+      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^3.0.2"
       }
     },
     "node_modules/lz-string": {
@@ -7609,13 +8365,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/merge-stream": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/metaboost-signing": {
       "resolved": "packages/metaboost-signing",
       "link": true
@@ -7630,20 +8379,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/micromatch": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
-      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "braces": "^3.0.3",
-        "picomatch": "^2.3.1"
-      },
-      "engines": {
-        "node": ">=8.6"
-      }
-    },
     "node_modules/mime": {
       "version": "2.6.0",
       "resolved": "https://registry.npmjs.org/mime/-/mime-2.6.0.tgz",
@@ -7682,32 +8417,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/mimic-fn": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-4.0.0.tgz",
-      "integrity": "sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/mimic-function": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/mimic-function/-/mimic-function-5.0.1.tgz",
-      "integrity": "sha512-VP79XUPxV2CigYP3jWwAUFSku2aKqBH7uTAapFWCBqutsbmDo96KY5o8uh6U+/YSIn5OxJnXp73beVkpqMIGhA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/min-indent": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/min-indent/-/min-indent-1.0.1.tgz",
@@ -7718,10 +8427,17 @@
         "node": ">=4"
       }
     },
+    "node_modules/minimalistic-assert": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
+      "integrity": "sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==",
+      "license": "ISC"
+    },
     "node_modules/minimatch": {
       "version": "10.2.5",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
       "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "brace-expansion": "^5.0.5"
@@ -7737,7 +8453,6 @@
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
       "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "dev": true,
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -7769,9 +8484,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.15",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
+      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
       "funding": [
         {
           "type": "github",
@@ -7813,12 +8528,12 @@
       }
     },
     "node_modules/next": {
-      "version": "16.2.4",
-      "resolved": "https://registry.npmjs.org/next/-/next-16.2.4.tgz",
-      "integrity": "sha512-kPvz56wF5frc+FxlHI5qnklCzbq53HTwORaWBGdT0vNoKh1Aya9XC8aPauH4NJxqtzbWsS5mAbctm4cr+EkQ2Q==",
+      "version": "16.2.9",
+      "resolved": "https://registry.npmjs.org/next/-/next-16.2.9.tgz",
+      "integrity": "sha512-MEOJiq/UvuezAdqVSceHbqDgZt1kDw2tpGVOlsdIoJsQdbN2JY2hpVG4xnXGkbdJUOEWhnRfiu/O4Hpc9Juwww==",
       "license": "MIT",
       "dependencies": {
-        "@next/env": "16.2.4",
+        "@next/env": "16.2.9",
         "@swc/helpers": "0.5.15",
         "baseline-browser-mapping": "^2.9.19",
         "caniuse-lite": "^1.0.30001579",
@@ -7832,14 +8547,14 @@
         "node": ">=20.9.0"
       },
       "optionalDependencies": {
-        "@next/swc-darwin-arm64": "16.2.4",
-        "@next/swc-darwin-x64": "16.2.4",
-        "@next/swc-linux-arm64-gnu": "16.2.4",
-        "@next/swc-linux-arm64-musl": "16.2.4",
-        "@next/swc-linux-x64-gnu": "16.2.4",
-        "@next/swc-linux-x64-musl": "16.2.4",
-        "@next/swc-win32-arm64-msvc": "16.2.4",
-        "@next/swc-win32-x64-msvc": "16.2.4",
+        "@next/swc-darwin-arm64": "16.2.9",
+        "@next/swc-darwin-x64": "16.2.9",
+        "@next/swc-linux-arm64-gnu": "16.2.9",
+        "@next/swc-linux-arm64-musl": "16.2.9",
+        "@next/swc-linux-x64-gnu": "16.2.9",
+        "@next/swc-linux-x64-musl": "16.2.9",
+        "@next/swc-win32-arm64-msvc": "16.2.9",
+        "@next/swc-win32-x64-msvc": "16.2.9",
         "sharp": "^0.34.5"
       },
       "peerDependencies": {
@@ -7866,9 +8581,9 @@
       }
     },
     "node_modules/next-intl": {
-      "version": "4.11.0",
-      "resolved": "https://registry.npmjs.org/next-intl/-/next-intl-4.11.0.tgz",
-      "integrity": "sha512-Chp8rgEVUYOX/bCtYy+PXH6lDX3X+GPT9sR9HScHroL283em/4urP9btfdHEMEHJJXdq2W/5wDaDDtWONPdNSA==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/next-intl/-/next-intl-4.13.0.tgz",
+      "integrity": "sha512-OvNq2v5XLx4EkQOsAhVE9g+6zdb83XHusADCXXtIW4LILYnjEVaeINdr1lkVWKSjzwNUiMSlH5N4K0OQTRiv6A==",
       "funding": [
         {
           "type": "individual",
@@ -7880,11 +8595,11 @@
         "@formatjs/intl-localematcher": "^0.8.1",
         "@parcel/watcher": "^2.4.1",
         "@swc/core": "^1.15.2",
-        "icu-minify": "^4.11.0",
+        "icu-minify": "^4.13.0",
         "negotiator": "^1.0.0",
-        "next-intl-swc-plugin-extractor": "^4.11.0",
+        "next-intl-swc-plugin-extractor": "^4.13.0",
         "po-parser": "^2.1.1",
-        "use-intl": "^4.11.0"
+        "use-intl": "^4.13.0"
       },
       "peerDependencies": {
         "next": "^12.0.0 || ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0",
@@ -7897,15 +8612,15 @@
       }
     },
     "node_modules/next-intl-swc-plugin-extractor": {
-      "version": "4.11.0",
-      "resolved": "https://registry.npmjs.org/next-intl-swc-plugin-extractor/-/next-intl-swc-plugin-extractor-4.11.0.tgz",
-      "integrity": "sha512-WUGBSxGNd8eQ0rAsJHFmRw2H7+SZAXQIY/HAnYM57JaUsj5D2vx4KOz4zFtXlyKDtsw9awHfgWVvBae2/RDF9A==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/next-intl-swc-plugin-extractor/-/next-intl-swc-plugin-extractor-4.13.0.tgz",
+      "integrity": "sha512-6S/fJI0KXvLCL8nhBo9P8eGaJPzmwJBTCzX0NaUIj0VyU8U89d//T+vjMLdNIXl5MlLaYH7B9MbAjb8Mvu+tqQ==",
       "license": "MIT"
     },
     "node_modules/next-intl/node_modules/@swc/core": {
-      "version": "1.15.33",
-      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.33.tgz",
-      "integrity": "sha512-jOlwnFV2xhuuZeAUILGFULeR6vDPfijEJ57evfocwznQldLU3w2cZ9bSDryY9ip+AsM3r1NJKzf47V2NXebkeQ==",
+      "version": "1.15.41",
+      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.41.tgz",
+      "integrity": "sha512-03nQq/082QRJJiOvp3FGbgxTGyyxMxohPTjhk/W9bD2J0tk4ukITI7goOhOO2WbaHn/lsPmo/zf8+DIXhwpgYQ==",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -7920,18 +8635,18 @@
         "url": "https://opencollective.com/swc"
       },
       "optionalDependencies": {
-        "@swc/core-darwin-arm64": "1.15.33",
-        "@swc/core-darwin-x64": "1.15.33",
-        "@swc/core-linux-arm-gnueabihf": "1.15.33",
-        "@swc/core-linux-arm64-gnu": "1.15.33",
-        "@swc/core-linux-arm64-musl": "1.15.33",
-        "@swc/core-linux-ppc64-gnu": "1.15.33",
-        "@swc/core-linux-s390x-gnu": "1.15.33",
-        "@swc/core-linux-x64-gnu": "1.15.33",
-        "@swc/core-linux-x64-musl": "1.15.33",
-        "@swc/core-win32-arm64-msvc": "1.15.33",
-        "@swc/core-win32-ia32-msvc": "1.15.33",
-        "@swc/core-win32-x64-msvc": "1.15.33"
+        "@swc/core-darwin-arm64": "1.15.41",
+        "@swc/core-darwin-x64": "1.15.41",
+        "@swc/core-linux-arm-gnueabihf": "1.15.41",
+        "@swc/core-linux-arm64-gnu": "1.15.41",
+        "@swc/core-linux-arm64-musl": "1.15.41",
+        "@swc/core-linux-ppc64-gnu": "1.15.41",
+        "@swc/core-linux-s390x-gnu": "1.15.41",
+        "@swc/core-linux-x64-gnu": "1.15.41",
+        "@swc/core-linux-x64-musl": "1.15.41",
+        "@swc/core-win32-arm64-msvc": "1.15.41",
+        "@swc/core-win32-ia32-msvc": "1.15.41",
+        "@swc/core-win32-x64-msvc": "1.15.41"
       },
       "peerDependencies": {
         "@swc/helpers": ">=0.5.17"
@@ -7943,9 +8658,9 @@
       }
     },
     "node_modules/next-intl/node_modules/@swc/helpers": {
-      "version": "0.5.21",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.21.tgz",
-      "integrity": "sha512-jI/VAmtdjB/RnI8GTnokyX7Ug8c+g+ffD6QRLa6XQewtnGyukKkKSk3wLTM3b5cjt1jNh9x0jfVlagdN2gDKQg==",
+      "version": "0.5.23",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
       "extraneous": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -7953,9 +8668,9 @@
       }
     },
     "node_modules/node-addon-api": {
-      "version": "8.7.0",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.7.0.tgz",
-      "integrity": "sha512-9MdFxmkKaOYVTV+XVRG8ArDwwQ77XIgIPyKASB1k3JPq3M8fGQQQE3YpMOrKm6g//Ktx8ivZr8xo1Qmtqub+GA==",
+      "version": "8.8.0",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.8.0.tgz",
+      "integrity": "sha512-c5Ko1fZJIJmzhFIkhRN76WTq+fC6tWnGy9CXA0fA+XygsWZmEwG8vmbkNqxMyoaa0Tin4djul49NzdVcJJcjeA==",
       "license": "MIT",
       "engines": {
         "node": "^18 || ^20 || >= 21"
@@ -7973,16 +8688,19 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.38",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.38.tgz",
-      "integrity": "sha512-3qT/88Y3FbH/Kx4szpQQ4HzUbVrHPKTLVpVocKiLfoYvw9XSGOX2FmD2d6DrXbVYyAQTF2HeF6My8jmzx7/CRw==",
+      "version": "2.0.48",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.48.tgz",
+      "integrity": "sha512-1uz8041X6LoI6ZSdZacM9lVY28vuzDlSKitnpbSNK0RfKoIJkX29NBPVEFXhnuSuEOA9Ww0xnPJ+ILWbGAv8DA==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/nodemailer": {
-      "version": "8.0.7",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.7.tgz",
-      "integrity": "sha512-pkjE4mkBzQjdJT4/UmlKl3pX0rC9fZmjh7c6C9o7lv66Ac6w9WCnzPzhbPNxwZAzlF4mdq4CSWB5+FbK6FWCow==",
+      "version": "8.0.11",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.11.tgz",
+      "integrity": "sha512-nrO/pDAUKl+wXX+lx16tDLbnm0fW6sK/x8mgohaCpg+CdCEl482bD4tCuAZk2DyliruiNTIZxRCoWkDqJEnAiA==",
       "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"
@@ -8050,34 +8768,12 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/npm-run-path": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-5.3.0.tgz",
-      "integrity": "sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "path-key": "^4.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/npm-run-path/node_modules/path-key": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-4.0.0.tgz",
-      "integrity": "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==",
+    "node_modules/nwsapi": {
+      "version": "2.2.24",
+      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.24.tgz",
+      "integrity": "sha512-7YRhZ3jS45LwmSCT4b2sVFHt/WuovaktDU07QrtOBY2PXskss5a9jfmR9jptyumwXST+rFjrmppMY1KT/yn35A==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
+      "license": "MIT"
     },
     "node_modules/object-assign": {
       "version": "4.1.1",
@@ -8101,15 +8797,18 @@
       }
     },
     "node_modules/obug": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
-      "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz",
+      "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/sxzz",
         "https://opencollective.com/debug"
       ],
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
     },
     "node_modules/on-finished": {
       "version": "2.4.1",
@@ -8132,22 +8831,6 @@
         "wrappy": "1"
       }
     },
-    "node_modules/onetime": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-6.0.0.tgz",
-      "integrity": "sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "mimic-fn": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/open": {
       "version": "10.2.0",
       "resolved": "https://registry.npmjs.org/open/-/open-10.2.0.tgz",
@@ -8195,6 +8878,75 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/oxc-parser": {
+      "version": "0.127.0",
+      "resolved": "https://registry.npmjs.org/oxc-parser/-/oxc-parser-0.127.0.tgz",
+      "integrity": "sha512-bkgD4qHlN7WxLdX8bLXdaU54TtQtAIg/ZBAfm0aje/mo3MRDo3P0hZSgr4U7O3xfX+fQmR5AP04JS/TGcZLcFA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "^0.127.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      },
+      "optionalDependencies": {
+        "@oxc-parser/binding-android-arm-eabi": "0.127.0",
+        "@oxc-parser/binding-android-arm64": "0.127.0",
+        "@oxc-parser/binding-darwin-arm64": "0.127.0",
+        "@oxc-parser/binding-darwin-x64": "0.127.0",
+        "@oxc-parser/binding-freebsd-x64": "0.127.0",
+        "@oxc-parser/binding-linux-arm-gnueabihf": "0.127.0",
+        "@oxc-parser/binding-linux-arm-musleabihf": "0.127.0",
+        "@oxc-parser/binding-linux-arm64-gnu": "0.127.0",
+        "@oxc-parser/binding-linux-arm64-musl": "0.127.0",
+        "@oxc-parser/binding-linux-ppc64-gnu": "0.127.0",
+        "@oxc-parser/binding-linux-riscv64-gnu": "0.127.0",
+        "@oxc-parser/binding-linux-riscv64-musl": "0.127.0",
+        "@oxc-parser/binding-linux-s390x-gnu": "0.127.0",
+        "@oxc-parser/binding-linux-x64-gnu": "0.127.0",
+        "@oxc-parser/binding-linux-x64-musl": "0.127.0",
+        "@oxc-parser/binding-openharmony-arm64": "0.127.0",
+        "@oxc-parser/binding-wasm32-wasi": "0.127.0",
+        "@oxc-parser/binding-win32-arm64-msvc": "0.127.0",
+        "@oxc-parser/binding-win32-ia32-msvc": "0.127.0",
+        "@oxc-parser/binding-win32-x64-msvc": "0.127.0"
+      }
+    },
+    "node_modules/oxc-resolver": {
+      "version": "11.21.3",
+      "resolved": "https://registry.npmjs.org/oxc-resolver/-/oxc-resolver-11.21.3.tgz",
+      "integrity": "sha512-2Mx3fKQz7+xgrBONjsxOgCGtMHOn38/HxMzW1I5efwXB5a4lRN0Vp40gYUJFBWJslcrvwoofTrqoTnLbwTd3pA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      },
+      "optionalDependencies": {
+        "@oxc-resolver/binding-android-arm-eabi": "11.21.3",
+        "@oxc-resolver/binding-android-arm64": "11.21.3",
+        "@oxc-resolver/binding-darwin-arm64": "11.21.3",
+        "@oxc-resolver/binding-darwin-x64": "11.21.3",
+        "@oxc-resolver/binding-freebsd-x64": "11.21.3",
+        "@oxc-resolver/binding-linux-arm-gnueabihf": "11.21.3",
+        "@oxc-resolver/binding-linux-arm-musleabihf": "11.21.3",
+        "@oxc-resolver/binding-linux-arm64-gnu": "11.21.3",
+        "@oxc-resolver/binding-linux-arm64-musl": "11.21.3",
+        "@oxc-resolver/binding-linux-ppc64-gnu": "11.21.3",
+        "@oxc-resolver/binding-linux-riscv64-gnu": "11.21.3",
+        "@oxc-resolver/binding-linux-riscv64-musl": "11.21.3",
+        "@oxc-resolver/binding-linux-s390x-gnu": "11.21.3",
+        "@oxc-resolver/binding-linux-x64-gnu": "11.21.3",
+        "@oxc-resolver/binding-linux-x64-musl": "11.21.3",
+        "@oxc-resolver/binding-openharmony-arm64": "11.21.3",
+        "@oxc-resolver/binding-wasm32-wasi": "11.21.3",
+        "@oxc-resolver/binding-win32-arm64-msvc": "11.21.3",
+        "@oxc-resolver/binding-win32-x64-msvc": "11.21.3"
+      }
+    },
     "node_modules/p-limit": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
@@ -8227,11 +8979,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/package-json-from-dist": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-      "license": "BlueOak-1.0.0"
+    "node_modules/parse5": {
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+      "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
     },
     "node_modules/parseurl": {
       "version": "1.3.3",
@@ -8253,9 +9012,9 @@
       }
     },
     "node_modules/path-expression-matcher": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
-      "integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.6.0.tgz",
+      "integrity": "sha512-e5y7RCLHKjemsgQ4eqGJtPyr10ILz25HO7flzxhTV8bgvd5yHx98DGtCAtbVW9f2TqnYI/gEVZd+vz7snrdPTw==",
       "funding": [
         {
           "type": "github",
@@ -8271,6 +9030,7 @@
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8287,6 +9047,7 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
       "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "lru-cache": "^11.0.0",
@@ -8299,6 +9060,16 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/path-scurry/node_modules/lru-cache": {
+      "version": "11.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
+      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
     "node_modules/path-to-regexp": {
       "version": "8.4.2",
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
@@ -8327,14 +9098,14 @@
       }
     },
     "node_modules/pg": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/pg/-/pg-8.20.0.tgz",
-      "integrity": "sha512-ldhMxz2r8fl/6QkXnBD3CR9/xg694oT6DZQ2s6c/RI28OjtSOpxnPrUCGOBJ46RCUxcWdx3p6kw/xnDHjKvaRA==",
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/pg/-/pg-8.22.0.tgz",
+      "integrity": "sha512-8wih1vVIBMxoUM2oB4soJsD9tDnDpLv4OXBJ+EJzFsvycD+lfyIreC2gGHq78f8jbLLt+bvlPTFdFZfJkOuzAA==",
       "license": "MIT",
       "dependencies": {
-        "pg-connection-string": "^2.12.0",
-        "pg-pool": "^3.13.0",
-        "pg-protocol": "^1.13.0",
+        "pg-connection-string": "^2.14.0",
+        "pg-pool": "^3.14.0",
+        "pg-protocol": "^1.15.0",
         "pg-types": "2.2.0",
         "pgpass": "1.0.5"
       },
@@ -8342,7 +9113,7 @@
         "node": ">= 16.0.0"
       },
       "optionalDependencies": {
-        "pg-cloudflare": "^1.3.0"
+        "pg-cloudflare": "^1.4.0"
       },
       "peerDependencies": {
         "pg-native": ">=3.0.1"
@@ -8354,16 +9125,16 @@
       }
     },
     "node_modules/pg-cloudflare": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.3.0.tgz",
-      "integrity": "sha512-6lswVVSztmHiRtD6I8hw4qP/nDm1EJbKMRhf3HCYaqud7frGysPv7FYJ5noZQdhQtN2xJnimfMtvQq21pdbzyQ==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.4.0.tgz",
+      "integrity": "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/pg-connection-string": {
-      "version": "2.12.0",
-      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.12.0.tgz",
-      "integrity": "sha512-U7qg+bpswf3Cs5xLzRqbXbQl85ng0mfSV/J0nnA31MCLgvEaAo7CIhmeyrmJpOr7o+zm0rXK+hNnT5l9RHkCkQ==",
+      "version": "2.14.0",
+      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.14.0.tgz",
+      "integrity": "sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==",
       "license": "MIT"
     },
     "node_modules/pg-int8": {
@@ -8376,18 +9147,18 @@
       }
     },
     "node_modules/pg-pool": {
-      "version": "3.13.0",
-      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.13.0.tgz",
-      "integrity": "sha512-gB+R+Xud1gLFuRD/QgOIgGOBE2KCQPaPwkzBBGC9oG69pHTkhQeIuejVIk3/cnDyX39av2AxomQiyPT13WKHQA==",
+      "version": "3.14.0",
+      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.14.0.tgz",
+      "integrity": "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==",
       "license": "MIT",
       "peerDependencies": {
         "pg": ">=8.0"
       }
     },
     "node_modules/pg-protocol": {
-      "version": "1.13.0",
-      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.13.0.tgz",
-      "integrity": "sha512-zzdvXfS6v89r6v7OcFCHfHlyG/wvry1ALxZo4LqgUoy7W9xhBDMaqOuMiF3qEV45VqsN6rdlcehHrfDtlCPc8w==",
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.15.0.tgz",
+      "integrity": "sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ==",
       "license": "MIT"
     },
     "node_modules/pg-types": {
@@ -8422,39 +9193,25 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
-      "dev": true,
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "license": "MIT",
       "engines": {
-        "node": ">=8.6"
+        "node": ">=12"
       },
       "funding": {
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/pidtree": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/pidtree/-/pidtree-0.6.0.tgz",
-      "integrity": "sha512-eG2dWTVw5bzqGRztnHExczNxt5VGsE6OwTeCG3fdUf9KBsZzO3R5OIIIzWR+iZA0NtZ+RDVdaoE2dK1cn6jH4g==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "pidtree": "bin/pidtree.js"
-      },
-      "engines": {
-        "node": ">=0.10"
-      }
-    },
     "node_modules/playwright": {
-      "version": "1.59.1",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.59.1.tgz",
-      "integrity": "sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw==",
+      "version": "1.61.0",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.61.0.tgz",
+      "integrity": "sha512-Z+7BeeqQPRRzklHsVFP4KTGIyMxKUmfeRA4WisM6G3/XW6nwGeX6fX9qYaDa+CiUqpOkb2f6X3nar05R3kSuJQ==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.59.1"
+        "playwright-core": "1.61.0"
       },
       "bin": {
         "playwright": "cli.js"
@@ -8467,9 +9224,9 @@
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.59.1",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.59.1.tgz",
-      "integrity": "sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg==",
+      "version": "1.61.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.61.0.tgz",
+      "integrity": "sha512-caX7TrY3Ml6egyDX0WUcTHDxodl/b51y5wJOdCEA36QviK/s2g081hvmGs8eaE3DWb6NYZQ6BjO/QkNRPenoPA==",
       "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
@@ -8509,9 +9266,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.13",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.13.tgz",
-      "integrity": "sha512-qif0+jGGZoLWdHey3UFHHWP0H7Gbmsk8T5VEqyYFbWqPr1XqvLGBbk/sl8V5exGmcYJklJOhOQq1pV9IcsiFag==",
+      "version": "8.5.15",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
       "funding": [
         {
           "type": "opencollective",
@@ -8528,7 +9285,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.12",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -8586,9 +9343,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.8.3",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.3.tgz",
-      "integrity": "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==",
+      "version": "3.8.4",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.4.tgz",
+      "integrity": "sha512-N2MylSdi48+5N/6S5j+maeHbUSIzzZ5uOcX5Hm4QpV8Dkb1HFjfAKTKX6yNPJQD9AhcT3ifHNB66tWTTJDi11Q==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -8662,9 +9419,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.1",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.1.tgz",
-      "integrity": "sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==",
+      "version": "6.15.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
+      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "side-channel": "^1.1.0"
@@ -8713,9 +9470,9 @@
       }
     },
     "node_modules/react": {
-      "version": "19.2.5",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.5.tgz",
-      "integrity": "sha512-llUJLzz1zTUBrskt2pwZgLq59AemifIftw4aB7JxOqf1HY2FDaGDxgwpAPVzHU1kdWabH7FauP4i1oEeer2WCA==",
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
+      "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -8767,15 +9524,15 @@
       }
     },
     "node_modules/react-dom": {
-      "version": "19.2.5",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.5.tgz",
-      "integrity": "sha512-J5bAZz+DXMMwW/wV3xzKke59Af6CHY7G4uYLN1OvBcKEsWOs4pQExj86BBKamxl/Ik5bx9whOrvBlSDfWzgSag==",
+      "version": "19.2.7",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
+      "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
       "license": "MIT",
       "dependencies": {
         "scheduler": "^0.27.0"
       },
       "peerDependencies": {
-        "react": "^19.2.5"
+        "react": "^19.2.7"
       }
     },
     "node_modules/react-is": {
@@ -8786,9 +9543,9 @@
       "peer": true
     },
     "node_modules/react-redux": {
-      "version": "9.2.0",
-      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.2.0.tgz",
-      "integrity": "sha512-ROY9fvHhwOD9ySfrF0wmvu//bKCQ6AeZZq1nJNtbDC+kk5DuSuNX/n6YWYF/SYy7bSba4D4FSz8DJeKY/S/r+g==",
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.3.0.tgz",
+      "integrity": "sha512-KQopgqFo/p/fgmAs5qz6p5RWaNAzq40WAu7fJIXnQpYxFPbJYtsJPWvGeF2rOBaY/kEuV77AVsX8TsQzKm+A/g==",
       "license": "MIT",
       "dependencies": {
         "@types/use-sync-external-store": "^0.0.6",
@@ -8808,6 +9565,16 @@
         }
       }
     },
+    "node_modules/react-refresh": {
+      "version": "0.18.0",
+      "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.18.0.tgz",
+      "integrity": "sha512-QgT5//D3jfjJb6Gsjxv0Slpj23ip+HtOpnNgnb2S5zU3CB26G/IDPGoy4RJB42wzFE46DRsstbW6tKHoKbhAxw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/readdirp": {
       "version": "3.6.0",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
@@ -8821,6 +9588,19 @@
         "node": ">=8.10.0"
       }
     },
+    "node_modules/readdirp/node_modules/picomatch": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/recast": {
       "version": "0.23.11",
       "resolved": "https://registry.npmjs.org/recast/-/recast-0.23.11.tgz",
@@ -8939,87 +9719,37 @@
       "integrity": "sha512-K/BG6eIky/SBpzfHZv/dd+9JBFiS4SWV7FIujVyJRux6e45+73RaUHXLmIR1f7WOMaQ0U1km6qwklRQxpJJY0w==",
       "license": "MIT"
     },
-    "node_modules/resolve": {
-      "version": "1.22.12",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
-      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "is-core-module": "^2.16.1",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/resolve-pkg-maps": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
-      "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
-      }
-    },
-    "node_modules/restore-cursor": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-5.1.0.tgz",
-      "integrity": "sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "onetime": "^7.0.0",
-        "signal-exit": "^4.1.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/restore-cursor/node_modules/onetime": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz",
-      "integrity": "sha512-VXJjc87FScF88uafS3JllDgvAm+c/Slfz06lorj2uAY34rlUu0Nt+v8wreiImcrgAjjIHp1rXpTDlLOGw29WwQ==",
+    "node_modules/resolve": {
+      "version": "1.22.12",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
+      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "mimic-function": "^5.0.0"
+        "es-errors": "^1.3.0",
+        "is-core-module": "^2.16.1",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      },
+      "bin": {
+        "resolve": "bin/resolve"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.4"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/rfdc": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/rfdc/-/rfdc-1.4.1.tgz",
-      "integrity": "sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/rolldown": {
-      "version": "1.0.0-rc.17",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.17.tgz",
-      "integrity": "sha512-ZrT53oAKrtA4+YtBWPQbtPOxIbVDbxT0orcYERKd63VJTF13zPcgXTvD4843L8pcsI7M6MErt8QtON6lrB9tyA==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.3.tgz",
+      "integrity": "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.127.0",
-        "@rolldown/pluginutils": "1.0.0-rc.17"
+        "@oxc-project/types": "=0.133.0",
+        "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
         "rolldown": "bin/cli.mjs"
@@ -9028,23 +9758,40 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.0-rc.17",
-        "@rolldown/binding-darwin-arm64": "1.0.0-rc.17",
-        "@rolldown/binding-darwin-x64": "1.0.0-rc.17",
-        "@rolldown/binding-freebsd-x64": "1.0.0-rc.17",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.17",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.17",
-        "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.17",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.17",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.17",
-        "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.17",
-        "@rolldown/binding-linux-x64-musl": "1.0.0-rc.17",
-        "@rolldown/binding-openharmony-arm64": "1.0.0-rc.17",
-        "@rolldown/binding-wasm32-wasi": "1.0.0-rc.17",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.17",
-        "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.17"
+        "@rolldown/binding-android-arm64": "1.0.3",
+        "@rolldown/binding-darwin-arm64": "1.0.3",
+        "@rolldown/binding-darwin-x64": "1.0.3",
+        "@rolldown/binding-freebsd-x64": "1.0.3",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.0.3",
+        "@rolldown/binding-linux-arm64-gnu": "1.0.3",
+        "@rolldown/binding-linux-arm64-musl": "1.0.3",
+        "@rolldown/binding-linux-ppc64-gnu": "1.0.3",
+        "@rolldown/binding-linux-s390x-gnu": "1.0.3",
+        "@rolldown/binding-linux-x64-gnu": "1.0.3",
+        "@rolldown/binding-linux-x64-musl": "1.0.3",
+        "@rolldown/binding-openharmony-arm64": "1.0.3",
+        "@rolldown/binding-wasm32-wasi": "1.0.3",
+        "@rolldown/binding-win32-arm64-msvc": "1.0.3",
+        "@rolldown/binding-win32-x64-msvc": "1.0.3"
+      }
+    },
+    "node_modules/rolldown/node_modules/@oxc-project/types": {
+      "version": "0.133.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.133.0.tgz",
+      "integrity": "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
       }
     },
+    "node_modules/rolldown/node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/router": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
@@ -9061,6 +9808,13 @@
         "node": ">= 18"
       }
     },
+    "node_modules/rrweb-cssom": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
+      "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/run-applescript": {
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/run-applescript/-/run-applescript-7.1.0.tgz",
@@ -9111,13 +9865,13 @@
       "license": "MIT"
     },
     "node_modules/sass": {
-      "version": "1.99.0",
-      "resolved": "https://registry.npmjs.org/sass/-/sass-1.99.0.tgz",
-      "integrity": "sha512-kgW13M54DUB7IsIRM5LvJkNlpH+WhMpooUcaWGFARkF1Tc82v9mIWkCbCYf+MBvpIUBSeSOTilpZjEPr2VYE6Q==",
+      "version": "1.101.0",
+      "resolved": "https://registry.npmjs.org/sass/-/sass-1.101.0.tgz",
+      "integrity": "sha512-OL3GoQyoUdDt843DpVmDO6y2k1sc5IhUDSpu8XucEI+35neq5QivZ1iuegnpraEVTJXlQGK1gl27zKcTLEPbQw==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "chokidar": "^4.0.0",
+        "chokidar": "^5.0.0",
         "immutable": "^5.1.5",
         "source-map-js": ">=0.6.2 <2.0.0"
       },
@@ -9125,42 +9879,55 @@
         "sass": "sass.js"
       },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=20.19.0"
       },
       "optionalDependencies": {
         "@parcel/watcher": "^2.4.1"
       }
     },
     "node_modules/sass/node_modules/chokidar": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
-      "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz",
+      "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "readdirp": "^4.0.1"
+        "readdirp": "^5.0.0"
       },
       "engines": {
-        "node": ">= 14.16.0"
+        "node": ">= 20.19.0"
       },
       "funding": {
         "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/sass/node_modules/readdirp": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
-      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.0.0.tgz",
+      "integrity": "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 14.18.0"
+        "node": ">= 20.19.0"
       },
       "funding": {
         "type": "individual",
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/saxes": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
+      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=v12.22.7"
+      }
+    },
     "node_modules/scheduler": {
       "version": "0.27.0",
       "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
@@ -9168,9 +9935,9 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -9322,6 +10089,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -9334,15 +10102,16 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
       }
     },
     "node_modules/shell-quote": {
-      "version": "1.8.3",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
-      "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==",
+      "version": "1.8.4",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
+      "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9353,14 +10122,14 @@
       }
     },
     "node_modules/side-channel": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3",
-        "side-channel-list": "^1.0.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
         "side-channel-map": "^1.0.1",
         "side-channel-weakmap": "^1.0.2"
       },
@@ -9431,18 +10200,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/signal-exit": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/simple-update-notifier": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/simple-update-notifier/-/simple-update-notifier-2.0.0.tgz",
@@ -9471,36 +10228,6 @@
         "node": ">= 10"
       }
     },
-    "node_modules/slice-ansi": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-5.0.0.tgz",
-      "integrity": "sha512-FC+lgizVPfie0kkhqUScwRu1O/lF6NOgJmlCgK+/LYxDCTk8sGelYaHDhFcDN+Sn3Cv+3VSa4Byeo+IMCzpMgQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.0.0",
-        "is-fullwidth-code-point": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/slice-ansi?sponsor=1"
-      }
-    },
-    "node_modules/slice-ansi/node_modules/ansi-styles": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
     "node_modules/source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -9575,21 +10302,23 @@
       "license": "MIT"
     },
     "node_modules/storybook": {
-      "version": "10.3.6",
-      "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.3.6.tgz",
-      "integrity": "sha512-vbSz7g/1rGMC1uAULqMZjALkIuLu2QABqfhRYhyr/11kzyesi+vAmwyJLukZP1FfecxGOgMwOh6GS0YsGpHAvQ==",
+      "version": "10.4.6",
+      "resolved": "https://registry.npmjs.org/storybook/-/storybook-10.4.6.tgz",
+      "integrity": "sha512-6wkA6LxfDSSilloITsrFOJfsnw0mDUP2h8Ls+lRt8oRsudtz2RWFhLv+Toiwg6NW7hUpdTDc2hzR7DztJid6+A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@storybook/global": "^5.0.0",
-        "@storybook/icons": "^2.0.1",
+        "@storybook/icons": "^2.0.2",
         "@testing-library/jest-dom": "^6.9.1",
         "@testing-library/user-event": "^14.6.1",
         "@vitest/expect": "3.2.4",
         "@vitest/spy": "3.2.4",
         "@webcontainer/env": "^1.1.1",
-        "esbuild": "^0.18.0 || ^0.19.0 || ^0.20.0 || ^0.21.0 || ^0.22.0 || ^0.23.0 || ^0.24.0 || ^0.25.0 || ^0.26.0 || ^0.27.0",
+        "esbuild": "^0.18.0 || ^0.19.0 || ^0.20.0 || ^0.21.0 || ^0.22.0 || ^0.23.0 || ^0.24.0 || ^0.25.0 || ^0.26.0 || ^0.27.0 || ^0.28.0",
         "open": "^10.2.0",
+        "oxc-parser": "^0.127.0",
+        "oxc-resolver": "^11.19.1",
         "recast": "^0.23.5",
         "semver": "^7.7.3",
         "use-sync-external-store": "^1.5.0",
@@ -9603,10 +10332,14 @@
         "url": "https://opencollective.com/storybook"
       },
       "peerDependencies": {
+        "@types/react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
         "prettier": "^2 || ^3",
         "vite-plus": "^0.1.15"
       },
       "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
         "prettier": {
           "optional": true
         },
@@ -9615,61 +10348,30 @@
         }
       }
     },
-    "node_modules/string-argv": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/string-argv/-/string-argv-0.3.2.tgz",
-      "integrity": "sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.6.19"
-      }
-    },
     "node_modules/string-width": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
-      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
-      "dev": true,
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
       "license": "MIT",
       "dependencies": {
-        "emoji-regex": "^10.3.0",
-        "get-east-asian-width": "^1.0.0",
-        "strip-ansi": "^7.1.0"
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
       },
       "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=8"
       }
     },
     "node_modules/strip-ansi": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
-      "dev": true,
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "license": "MIT",
       "dependencies": {
-        "ansi-regex": "^6.2.2"
-      },
-      "engines": {
-        "node": ">=12"
+        "ansi-regex": "^5.0.1"
       },
-      "funding": {
-        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
-      }
-    },
-    "node_modules/strip-ansi/node_modules/ansi-regex": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
-      "dev": true,
-      "license": "MIT",
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+        "node": ">=8"
       }
     },
     "node_modules/strip-bom": {
@@ -9682,19 +10384,6 @@
         "node": ">=4"
       }
     },
-    "node_modules/strip-final-newline": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-3.0.0.tgz",
-      "integrity": "sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/strip-indent": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/strip-indent/-/strip-indent-3.0.0.tgz",
@@ -9709,16 +10398,19 @@
       }
     },
     "node_modules/strnum": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.3.tgz",
-      "integrity": "sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==",
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.4.1.tgz",
+      "integrity": "sha512-M9eUSMT2dCB2cTNPG7UYj6KuK7RJR2SN2+yCV/fTW3xzTCS6EaGZ5pSMgDIjB7r8zSfTGk+dvvn9rTjpVS9Mwg==",
       "funding": [
         {
           "type": "github",
           "url": "https://github.com/sponsors/NaturalIntelligence"
         }
       ],
-      "license": "MIT"
+      "license": "MIT",
+      "dependencies": {
+        "anynum": "^1.0.1"
+      }
     },
     "node_modules/styled-jsx": {
       "version": "5.1.6",
@@ -9819,9 +10511,9 @@
       }
     },
     "node_modules/swagger-ui-dist": {
-      "version": "5.32.5",
-      "resolved": "https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-5.32.5.tgz",
-      "integrity": "sha512-7/FQfWe9A4qoyYFdAwy0chD0uDYidDp/ZT9VQ9LZlgD4AnnHJk8/+ytAA1HkJYOPySmK6helPDdJQMlcumt7HA==",
+      "version": "5.32.6",
+      "resolved": "https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-5.32.6.tgz",
+      "integrity": "sha512-75ttZNaYCLoFPnozPZcTUU6mS3wKT8l7WLjU5zJSHFeJa23i5vtnze6IiCl4jDMPeQTXVXIgovq4M11NNfQvSA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@scarf/scarf": "=1.4.0"
@@ -9842,6 +10534,13 @@
         "express": ">=4.0.0 || >=5.0.0-beta"
       }
     },
+    "node_modules/symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/tiny-invariant": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
@@ -9856,9 +10555,9 @@
       "license": "MIT"
     },
     "node_modules/tinyexec": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.1.2.tgz",
-      "integrity": "sha512-dAqSqE/RabpBKI8+h26GfLq6Vb3JVXs30XYQjdMjaj/c2tS8IYYMbIzP599KtRj7c57/wYApb3QjgRgXmrCukA==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
+      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9866,9 +10565,9 @@
       }
     },
     "node_modules/tinyglobby": {
-      "version": "0.2.16",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.16.tgz",
-      "integrity": "sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==",
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9882,37 +10581,6 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
-    "node_modules/tinyglobby/node_modules/fdir": {
-      "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.0.0"
-      },
-      "peerDependencies": {
-        "picomatch": "^3 || ^4"
-      },
-      "peerDependenciesMeta": {
-        "picomatch": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/tinyglobby/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
     "node_modules/tinyrainbow": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-2.0.0.tgz",
@@ -9933,6 +10601,26 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/tldts": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.86.tgz",
+      "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tldts-core": "^6.1.86"
+      },
+      "bin": {
+        "tldts": "bin/cli.js"
+      }
+    },
+    "node_modules/tldts-core": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
+      "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/to-buffer": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/to-buffer/-/to-buffer-1.2.2.tgz",
@@ -9989,6 +10677,32 @@
         "nodetouch": "bin/nodetouch.js"
       }
     },
+    "node_modules/tough-cookie": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-5.1.2.tgz",
+      "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tldts": "^6.1.32"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
+      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tree-kill": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/tree-kill/-/tree-kill-1.2.2.tgz",
@@ -10013,9 +10727,9 @@
       }
     },
     "node_modules/ts-dedent": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/ts-dedent/-/ts-dedent-2.2.0.tgz",
-      "integrity": "sha512-q5W7tVM71e2xjHZTlgfTDoPF/SmqKG5hddq9SzR49CH2hayqRKJtQ4mtRlSxKaJlR/+9rEM+mnBHf7I2/BQcpQ==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/ts-dedent/-/ts-dedent-2.3.0.tgz",
+      "integrity": "sha512-JfJeIHke7y2egdGGgRAvpCwYFUsHlM2gPcrVOxFkznt/4uzQ7HFmvE63iFHVLBJNDuyDOQgijDK/tXH/f6Msjg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10044,14 +10758,13 @@
       "license": "0BSD"
     },
     "node_modules/tsx": {
-      "version": "4.21.0",
-      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.21.0.tgz",
-      "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
+      "version": "4.22.4",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.22.4.tgz",
+      "integrity": "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "esbuild": "~0.27.0",
-        "get-tsconfig": "^4.7.5"
+        "esbuild": "~0.28.0"
       },
       "bin": {
         "tsx": "dist/cli.mjs"
@@ -10077,17 +10790,34 @@
       }
     },
     "node_modules/type-is": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
-      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "license": "MIT",
       "dependencies": {
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "media-typer": "^1.1.0",
         "mime-types": "^3.0.0"
       },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/type-is/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/typed-array-buffer": {
@@ -10119,16 +10849,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.59.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.59.1.tgz",
-      "integrity": "sha512-xqDcFVBmlrltH64lklOVp1wYxgJr6LVdg3NamBgH2OOQDLFdTKfIZXF5PfghrnXQKXZGTQs8tr1vL7fJvq8CTQ==",
+      "version": "8.61.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.61.1.tgz",
+      "integrity": "sha512-V7PayAfJokV3pEHgN7/v03D1SpujhRfQtYLbLIiBfDDncdg4PAiRBfoS4cnCANK4jmAPncczi59QO3afiXUlNw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.59.1",
-        "@typescript-eslint/parser": "8.59.1",
-        "@typescript-eslint/typescript-estree": "8.59.1",
-        "@typescript-eslint/utils": "8.59.1"
+        "@typescript-eslint/eslint-plugin": "8.61.1",
+        "@typescript-eslint/parser": "8.61.1",
+        "@typescript-eslint/typescript-estree": "8.61.1",
+        "@typescript-eslint/utils": "8.61.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -10150,10 +10880,9 @@
       "license": "MIT"
     },
     "node_modules/undici-types": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "dev": true,
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "license": "MIT"
     },
     "node_modules/unpipe": {
@@ -10181,19 +10910,6 @@
         "node": ">=18.12.0"
       }
     },
-    "node_modules/unplugin/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
     "node_modules/update-browserslist-db": {
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
@@ -10236,9 +10952,9 @@
       }
     },
     "node_modules/use-intl": {
-      "version": "4.11.0",
-      "resolved": "https://registry.npmjs.org/use-intl/-/use-intl-4.11.0.tgz",
-      "integrity": "sha512-7ILhTLuo3fnSKhoTGDk5X9591pjtWr6qB4inrlvGkN9OEyKhoiG73GZFoLSs68wz3BsSGtoWa62iWvrYEYU+iA==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/use-intl/-/use-intl-4.13.0.tgz",
+      "integrity": "sha512-fAFDrWaASxlhXOipcOyb5VDD+YONqj6+8O8EcG/J7RBoOUF3A8YahRWLN+mBxYMrlMQB8N6Voqk5X+YC+HSL0A==",
       "funding": [
         {
           "type": "individual",
@@ -10249,7 +10965,7 @@
       "dependencies": {
         "@formatjs/fast-memoize": "^3.1.0",
         "@schummar/icu-type-parser": "1.21.5",
-        "icu-minify": "^4.11.0",
+        "icu-minify": "^4.13.0",
         "intl-messageformat": "^11.1.0"
       },
       "peerDependencies": {
@@ -10266,9 +10982,9 @@
       }
     },
     "node_modules/uuid": {
-      "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.0.tgz",
-      "integrity": "sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==",
+      "version": "14.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz",
+      "integrity": "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
@@ -10310,17 +11026,17 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.0.10",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.10.tgz",
-      "integrity": "sha512-rZuUu9j6J5uotLDs+cAA4O5H4K1SfPliUlQwqa6YEwSrWDZzP4rhm00oJR5snMewjxF5V/K3D4kctsUTsIU9Mw==",
+      "version": "8.0.16",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.16.tgz",
+      "integrity": "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
-        "postcss": "^8.5.10",
-        "rolldown": "1.0.0-rc.17",
-        "tinyglobby": "^0.2.16"
+        "postcss": "^8.5.15",
+        "rolldown": "1.0.3",
+        "tinyglobby": "^0.2.17"
       },
       "bin": {
         "vite": "bin/vite.js"
@@ -10336,7 +11052,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.1.0",
+        "@vitejs/devtools": "^0.1.18",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
@@ -10387,33 +11103,20 @@
         }
       }
     },
-    "node_modules/vite/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
     "node_modules/vitest": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.5.tgz",
-      "integrity": "sha512-9Xx1v3/ih3m9hN+SbfkUyy0JAs72ap3r7joc87XL6jwF0jGg6mFBvQ1SrwaX+h8BlkX6Hz9shdd1uo6AF+ZGpg==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
+      "integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.5",
-        "@vitest/mocker": "4.1.5",
-        "@vitest/pretty-format": "4.1.5",
-        "@vitest/runner": "4.1.5",
-        "@vitest/snapshot": "4.1.5",
-        "@vitest/spy": "4.1.5",
-        "@vitest/utils": "4.1.5",
+        "@vitest/expect": "4.1.9",
+        "@vitest/mocker": "4.1.9",
+        "@vitest/pretty-format": "4.1.9",
+        "@vitest/runner": "4.1.9",
+        "@vitest/snapshot": "4.1.9",
+        "@vitest/spy": "4.1.9",
+        "@vitest/utils": "4.1.9",
         "es-module-lexer": "^2.0.0",
         "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
@@ -10441,12 +11144,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.5",
-        "@vitest/browser-preview": "4.1.5",
-        "@vitest/browser-webdriverio": "4.1.5",
-        "@vitest/coverage-istanbul": "4.1.5",
-        "@vitest/coverage-v8": "4.1.5",
-        "@vitest/ui": "4.1.5",
+        "@vitest/browser-playwright": "4.1.9",
+        "@vitest/browser-preview": "4.1.9",
+        "@vitest/browser-webdriverio": "4.1.9",
+        "@vitest/coverage-istanbul": "4.1.9",
+        "@vitest/coverage-v8": "4.1.9",
+        "@vitest/ui": "4.1.9",
         "happy-dom": "*",
         "jsdom": "*",
         "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -10491,16 +11194,16 @@
       }
     },
     "node_modules/vitest/node_modules/@vitest/expect": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.5.tgz",
-      "integrity": "sha512-PWBaRY5JoKuRnHlUHfpV/KohFylaDZTupcXN1H9vYryNLOnitSw60Mw9IAE2r67NbwwzBw/Cc/8q9BK3kIX8Kw==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
+      "integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.5",
-        "@vitest/utils": "4.1.5",
+        "@vitest/spy": "4.1.9",
+        "@vitest/utils": "4.1.9",
         "chai": "^6.2.2",
         "tinyrainbow": "^3.1.0"
       },
@@ -10509,9 +11212,9 @@
       }
     },
     "node_modules/vitest/node_modules/@vitest/pretty-format": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.5.tgz",
-      "integrity": "sha512-7I3q6l5qr03dVfMX2wCo9FxwSJbPdwKjy2uu/YPpU3wfHvIL4QHwVRp57OfGrDFeUJ8/8QdfBKIV12FTtLn00g==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
+      "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10522,9 +11225,9 @@
       }
     },
     "node_modules/vitest/node_modules/@vitest/spy": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.5.tgz",
-      "integrity": "sha512-2lNOsh6+R2Idnf1TCZqSwYlKN2E/iDlD8sgU59kYVl+OMDmvldO1VDk39smRfpUNwYpNRVn3w4YfuC7KfbBnkQ==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
+      "integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -10532,13 +11235,13 @@
       }
     },
     "node_modules/vitest/node_modules/@vitest/utils": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.5.tgz",
-      "integrity": "sha512-76wdkrmfXfqGjueGgnb45ITPyUi1ycZ4IHgC2bhPDUfWHklY/q3MdLOAB+TF1e6xfl8NxNY0ZYaPCFNWSsw3Ug==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
+      "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.5",
+        "@vitest/pretty-format": "4.1.9",
         "convert-source-map": "^2.0.0",
         "tinyrainbow": "^3.1.0"
       },
@@ -10546,27 +11249,14 @@
         "url": "https://opencollective.com/vitest"
       }
     },
-    "node_modules/vitest/node_modules/chai": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
-      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/vitest/node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+    "node_modules/vitest/node_modules/chai": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
+        "node": ">=18"
       }
     },
     "node_modules/vitest/node_modules/tinyrainbow": {
@@ -10579,6 +11269,48 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/w3c-xmlserializer": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
+      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/web-push": {
+      "version": "3.6.7",
+      "resolved": "https://registry.npmjs.org/web-push/-/web-push-3.6.7.tgz",
+      "integrity": "sha512-OpiIUe8cuGjrj3mMBFWY+e4MMIkW3SVT+7vEIjvD9kejGUypv8GPDf84JdPWskK8zMRIJ6xYGm+Kxr8YkPyA0A==",
+      "license": "MPL-2.0",
+      "dependencies": {
+        "asn1.js": "^5.3.0",
+        "http_ece": "1.2.0",
+        "https-proxy-agent": "^7.0.0",
+        "jws": "^4.0.0",
+        "minimist": "^1.2.5"
+      },
+      "bin": {
+        "web-push": "src/cli.js"
+      },
+      "engines": {
+        "node": ">= 16"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/webpack-bundle-analyzer": {
       "version": "4.10.1",
       "resolved": "https://registry.npmjs.org/webpack-bundle-analyzer/-/webpack-bundle-analyzer-4.10.1.tgz",
@@ -10607,20 +11339,10 @@
         "node": ">= 10.13.0"
       }
     },
-    "node_modules/webpack-bundle-analyzer/node_modules/commander": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz",
-      "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10"
-      }
-    },
     "node_modules/webpack-bundle-analyzer/node_modules/ws": {
-      "version": "7.5.10",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.10.tgz",
-      "integrity": "sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==",
+      "version": "7.5.11",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.11.tgz",
+      "integrity": "sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10646,10 +11368,62 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/whatwg-encoding": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
+      "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
+      "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "0.6.3"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-encoding/node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
+      "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-url": {
+      "version": "14.2.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
+      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tr46": "^5.1.0",
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -10662,13 +11436,13 @@
       }
     },
     "node_modules/which-typed-array": {
-      "version": "1.1.20",
-      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.20.tgz",
-      "integrity": "sha512-LYfpUkmqwl0h9A2HL09Mms427Q1RZWuOHsukfVcKRq9q95iQxdw0ix1JQrqbcDR9PH1QDwf5Qo8OZb5lksZ8Xg==",
+      "version": "1.1.22",
+      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.22.tgz",
+      "integrity": "sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==",
       "license": "MIT",
       "dependencies": {
         "available-typed-arrays": "^1.0.7",
-        "call-bind": "^1.0.8",
+        "call-bind": "^1.0.9",
         "call-bound": "^1.0.4",
         "for-each": "^0.3.5",
         "get-proto": "^1.0.1",
@@ -10710,36 +11484,22 @@
       }
     },
     "node_modules/wrap-ansi": {
-      "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-9.0.2.tgz",
-      "integrity": "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==",
-      "dev": true,
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
       "license": "MIT",
       "dependencies": {
-        "ansi-styles": "^6.2.1",
-        "string-width": "^7.0.0",
-        "strip-ansi": "^7.1.0"
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=10"
       },
       "funding": {
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
       }
     },
-    "node_modules/wrap-ansi/node_modules/ansi-styles": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
@@ -10747,9 +11507,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",
-      "integrity": "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10784,6 +11544,38 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/xml-name-validator": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
+      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/xml-naming": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz",
+      "integrity": "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/xtend": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
@@ -10809,22 +11601,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/yaml": {
-      "version": "2.8.4",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.4.tgz",
-      "integrity": "sha512-ml/JPOj9fOQK8RNnWojA67GbZ0ApXAUlN2UQclwv2eVgTgn7O9gg9o7paZWKMp4g0H3nTLtS9LVzhkpOFIKzog==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "yaml": "bin.mjs"
-      },
-      "engines": {
-        "node": ">= 14.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/eemeli"
-      }
-    },
     "node_modules/yargs": {
       "version": "17.7.2",
       "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
@@ -10852,47 +11628,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/yargs/node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "license": "MIT"
-    },
-    "node_modules/yargs/node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
@@ -10963,7 +11698,8 @@
       },
       "devDependencies": {
         "@types/node": "^24.10.12",
-        "typescript": "^5.9.2"
+        "typescript": "^5.9.2",
+        "vitest": "^4.1.4"
       }
     },
     "packages/helpers-valkey": {
@@ -11011,6 +11747,66 @@
         "typescript": "^5.9.2"
       }
     },
+    "packages/management-orm/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "license": "MIT"
+    },
+    "packages/management-orm/node_modules/brace-expansion": {
+      "version": "2.1.1",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "packages/management-orm/node_modules/glob": {
+      "version": "10.5.0",
+      "license": "ISC",
+      "dependencies": {
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^3.1.2",
+        "minimatch": "^9.0.4",
+        "minipass": "^7.1.2",
+        "package-json-from-dist": "^1.0.0",
+        "path-scurry": "^1.11.1"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "packages/management-orm/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "license": "ISC"
+    },
+    "packages/management-orm/node_modules/minimatch": {
+      "version": "9.0.9",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "packages/management-orm/node_modules/path-scurry": {
+      "version": "1.11.1",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "packages/management-orm/node_modules/typeorm": {
       "version": "0.3.28",
       "license": "MIT",
@@ -11145,7 +11941,68 @@
         "@types/node": "^24.10.12",
         "app-root-path": "^3.1.0",
         "sql-highlight": "^6.1.0",
-        "typescript": "^5.9.2"
+        "typescript": "^5.9.2",
+        "vitest": "^4.1.4"
+      }
+    },
+    "packages/orm/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "license": "MIT"
+    },
+    "packages/orm/node_modules/brace-expansion": {
+      "version": "2.1.1",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "packages/orm/node_modules/glob": {
+      "version": "10.5.0",
+      "license": "ISC",
+      "dependencies": {
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^3.1.2",
+        "minimatch": "^9.0.4",
+        "minipass": "^7.1.2",
+        "package-json-from-dist": "^1.0.0",
+        "path-scurry": "^1.11.1"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "packages/orm/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "license": "ISC"
+    },
+    "packages/orm/node_modules/minimatch": {
+      "version": "9.0.9",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "packages/orm/node_modules/path-scurry": {
+      "version": "1.11.1",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
     "packages/orm/node_modules/typeorm": {
@@ -11271,14 +12128,18 @@
         "@storybook/addon-docs": "^10.2.14",
         "@storybook/react": "^10.2.14",
         "@storybook/react-vite": "^10.2.14",
+        "@testing-library/react": "^16.3.0",
         "@types/react": "^19.2.11",
+        "@vitejs/plugin-react": "^5.1.1",
         "eslint-plugin-storybook": "10.2.19",
+        "jsdom": "^26.1.0",
         "next": "^16.2.4",
         "next-intl": "^4.11.0",
         "react-dom": "^19.2.5",
         "sass": "^1.98.0",
         "storybook": "^10.2.14",
-        "typescript": "^5.9.2"
+        "typescript": "^5.9.2",
+        "vitest": "^4.1.9"
       },
       "peerDependencies": {
         "next": "^16.2.4",
diff --git a/package.json b/package.json
index bc450129..9a91d751 100644
--- a/package.json
+++ b/package.json
@@ -7,30 +7,15 @@
     "node": ">=24.0.0"
   },
   "overrides": {
-    "glob": "^11.0.0",
     "postcss": "^8.5.10",
-    "punycode": "^2.3.1",
     "uuid": "^14.0.0"
   },
   "workspaces": [
-    "packages/helpers",
-    "packages/helpers-currency",
-    "packages/helpers-backend-api",
-    "packages/helpers-i18n",
-    "packages/helpers-requests",
-    "packages/helpers-valkey",
-    "packages/metaboost-signing",
-    "packages/rss-parser",
-    "packages/orm",
-    "packages/management-orm",
-    "packages/ui",
-    "apps/api",
-    "apps/management-api",
-    "apps/web",
+    "packages/*",
+    "apps/*",
     "apps/web/sidecar",
-    "apps/management-web",
     "apps/management-web/sidecar",
-    "tools/generate-data"
+    "tools/*"
   ],
   "devDependencies": {
     "bcrypt": "^6.0.0",
@@ -44,23 +29,14 @@
     "eslint-plugin-perfectionist": "^4.6.0",
     "eslint-plugin-storybook": "^10.2.19",
     "globals": "^17.4.0",
-    "lint-staged": "^15.5.0",
     "prettier": "^3.4.2",
     "tsx": "^4.19.3",
     "typescript": "^5.9.2",
     "typescript-eslint": "^8.57.1"
   },
-  "lint-staged": {
-    "*.{ts,tsx,js,mjs,cjs,json,md,yml,yaml,scss,css}": "prettier --write"
-  },
   "scripts": {
     "prepare": "bash scripts/git-hooks/install-hooks.sh",
     "start-feature": "bash scripts/start-feature.sh",
-    "llm:exports:sync": "node scripts/llm/export-from-cursor.mjs sync",
-    "llm:exports:sync:full": "node scripts/llm/export-from-cursor.mjs sync --full",
-    "llm:exports:check": "node scripts/llm/export-from-cursor.mjs check",
-    "llm:exports:restore": "git restore .llm/exports",
-    "llm:vendors": "node scripts/llm/vendor-selector.mjs",
     "build": "npm run build --workspaces --if-present",
     "build:analyze:web": "ANALYZE=true npm run build -w @metaboost/web",
     "build:packages": "npm run build -w @metaboost/helpers -w @metaboost/helpers-currency -w @metaboost/helpers-backend-api -w @metaboost/helpers-requests -w @metaboost/helpers-valkey -w metaboost-signing -w @metaboost/rss-parser -w @metaboost/orm -w @metaboost/management-orm -w @metaboost/helpers-i18n",
@@ -82,11 +58,12 @@
     "db:status:linear:k8s:management": "bash scripts/database/print-linear-migrations-status-k8s.sh --database management",
     "db:validate:linear": "bash scripts/database/validate-linear-migrations.sh",
     "db:validate:linear:db": "bash scripts/database/validate-linear-migrations.sh --check-db",
+    "billing:process-due-renewals": "node scripts/api/process-due-renewals.mjs",
     "management:superuser:create": "node scripts/management-api/create-super-admin.mjs",
     "management:superuser:update": "node scripts/management-api/update-super-admin.mjs",
     "management:superuser:create:k8s": "bash scripts/management-api/run-superuser-k8s-job.sh create",
     "management:superuser:update:k8s": "bash scripts/management-api/run-superuser-k8s-job.sh update",
-    "test:unit": "npm run test -w @metaboost/helpers && npm run test -w @metaboost/helpers-currency && npm run test -w @metaboost/helpers-valkey && npm run test -w metaboost-signing && npm run test -w @metaboost/rss-parser",
+    "test:unit": "node scripts/ci/run-workspaces.mjs --script test --all --exclude apps/api --exclude apps/management-api",
     "test:e2e:api": "node scripts/check-test-requirements.mjs && npm run test -w apps/api && npm run test -w apps/management-api",
     "test:e2e:web": "make e2e_test_playwright",
     "test:e2e:web:reports": "make e2e_test_report",
diff --git a/packages/helpers-requests/package.json b/packages/helpers-requests/package.json
index 16bdd84a..0c3b8fca 100644
--- a/packages/helpers-requests/package.json
+++ b/packages/helpers-requests/package.json
@@ -14,10 +14,12 @@
     "lint": "eslint ./src --max-warnings 0",
     "lint:fix": "eslint ./src --fix",
     "type-check": "tsc --noEmit",
-    "clean": "rm -rf dist"
+    "clean": "rm -rf dist",
+    "test": "vitest run"
   },
   "devDependencies": {
     "@types/node": "^24.10.12",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.2",
+    "vitest": "^4.1.4"
   }
 }
diff --git a/packages/helpers-requests/src/index.ts b/packages/helpers-requests/src/index.ts
index 9441c9a4..29428b47 100644
--- a/packages/helpers-requests/src/index.ts
+++ b/packages/helpers-requests/src/index.ts
@@ -45,7 +45,13 @@ export type {
   VerifyEmailBody,
   WithOptionalToken,
 } from './types/index.js';
-export { request, type ApiError, type ApiResponse, type RequestOptions } from './request.js';
+export {
+  request,
+  cookieHeaderToHeaders,
+  type ApiError,
+  type ApiResponse,
+  type RequestOptions,
+} from './request.js';
 export { getRateLimitRetrySeconds } from './rateLimitClient.js';
 export { createSessionRefreshLoop, hydrateSession } from './session-lifecycle.js';
 export type {
@@ -55,15 +61,30 @@ export type {
   SessionAuthApi,
   SessionAuthResponse,
 } from './session-lifecycle.js';
+export type {
+  UpsertWebPushSubscriptionBody,
+  UpdateWebPushSubscriptionBody,
+  WebPushSubscriptionDto,
+  WebPushSubscriptionKeys,
+} from './web/auth.js';
 export * as webAuth from './web/auth.js';
 export * as webBuckets from './web/buckets.js';
 export * as webExchangeRates from './web/exchangeRates.js';
-export type { ListChildBucketsQuery, ListTopLevelBucketsQuery } from './web/buckets.js';
+export * as webProduct from './web/product.js';
+export type {
+  BucketNotificationPreferencePatchResponse,
+  BucketNotificationPreferenceResponse,
+  ListChildBucketsQuery,
+  ListTopLevelBucketsQuery,
+  UpdateBucketNotificationPreferenceBody,
+} from './web/buckets.js';
 export * as managementWebAuth from './management-web/auth.js';
 export * as managementWebAdmins from './management-web/admins.js';
 export * as managementWebAdminRoles from './management-web/adminRoles.js';
 export * as managementWebEvents from './management-web/events.js';
 export * as managementWebUsers from './management-web/users.js';
+export * as managementWebProductMembership from './management-web/productMembership.js';
+export * as managementWebBillingPrices from './management-web/billingPrices.js';
 export * as managementWebApps from './management-web/apps.js';
 export * as managementWebBuckets from './management-web/buckets.js';
 export * as managementWebBucketMessages from './management-web/bucketMessages.js';
@@ -102,6 +123,10 @@ export type {
   PredefinedBucketRoleItem,
   UpdateBucketRoleBody,
 } from './management-web/bucketRoles.js';
+export type {
+  BillingPriceAuditEntryDto,
+  BillingPriceWindowDto,
+} from './management-web/billingPrices.js';
 export type {
   CreateTermsVersionBody as CreateManagementTermsVersionBody,
   ManagementTermsVersion,
diff --git a/packages/helpers-requests/src/management-web/adminRoles.ts b/packages/helpers-requests/src/management-web/adminRoles.ts
index b2c73753..02fa2cb6 100644
--- a/packages/helpers-requests/src/management-web/adminRoles.ts
+++ b/packages/helpers-requests/src/management-web/adminRoles.ts
@@ -11,6 +11,7 @@ export type PredefinedManagementAdminRoleItem = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: EventVisibility;
   isPredefined: true;
   createdAt: null;
@@ -24,6 +25,7 @@ export type CustomManagementAdminRoleItem = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: EventVisibility;
   isPredefined: false;
   createdAt: string;
@@ -40,6 +42,7 @@ export type CreateManagementAdminRoleBody = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: EventVisibility;
 };
 
@@ -50,6 +53,7 @@ export type UpdateManagementAdminRoleBody = {
   bucketsCrud?: number;
   bucketMessagesCrud?: number;
   bucketAdminsCrud?: number;
+  billingPricesCrud?: number;
   eventVisibility?: EventVisibility;
 };
 
diff --git a/packages/helpers-requests/src/management-web/billingPrices.ts b/packages/helpers-requests/src/management-web/billingPrices.ts
new file mode 100644
index 00000000..b48706d5
--- /dev/null
+++ b/packages/helpers-requests/src/management-web/billingPrices.ts
@@ -0,0 +1,102 @@
+import type { ApiResponse } from '../request.js';
+
+import { request } from '../request.js';
+
+export type BillingPriceWindowStatus = 'active' | 'scheduled' | 'historical';
+
+export type BillingPriceWindowDto = {
+  id: number;
+  billingProductId: number;
+  productCode: string;
+  currencyCode: string;
+  billingCadence: 'monthly' | 'annual';
+  amountCents: number;
+  effectiveFrom: string;
+  effectiveTo: string | null;
+  source: string;
+  status: BillingPriceWindowStatus;
+};
+
+export type BillingPriceAuditEntryDto = {
+  id: number;
+  billingPriceId: number | null;
+  changedByManagementUserId: string | null;
+  changeReason: string | null;
+  previousAmountCents: number | null;
+  newAmountCents: number | null;
+  previousEffectiveFrom: string | null;
+  previousEffectiveTo: string | null;
+  newEffectiveFrom: string | null;
+  newEffectiveTo: string | null;
+  createdAt: string;
+  currencyCode: string | null;
+  billingCadence: 'monthly' | 'annual' | null;
+  productCode: string | null;
+};
+
+export type BillingPriceWindowsPayload = {
+  data: {
+    windows: BillingPriceWindowDto[];
+    defaultCurrency: string;
+  };
+};
+
+export type BillingPriceAuditPayload = {
+  data: {
+    entries: BillingPriceAuditEntryDto[];
+  };
+};
+
+export async function listBillingPriceWindows(
+  baseUrl: string,
+  token?: string | null
+): Promise<ApiResponse<BillingPriceWindowsPayload>> {
+  return request<BillingPriceWindowsPayload>(baseUrl, '/billing-prices/windows', {
+    token: token ?? undefined,
+  });
+}
+
+export async function listBillingPriceAudit(
+  baseUrl: string,
+  options?: { token?: string | null; limit?: number }
+): Promise<ApiResponse<BillingPriceAuditPayload>> {
+  const limit = options?.limit;
+  const path =
+    limit !== undefined && limit > 0
+      ? `/billing-prices/audit?limit=${encodeURIComponent(String(limit))}`
+      : '/billing-prices/audit';
+  return request<BillingPriceAuditPayload>(baseUrl, path, {
+    token: options?.token ?? undefined,
+  });
+}
+
+export async function scheduleBillingPriceChange(
+  baseUrl: string,
+  body: {
+    currencyCode: string;
+    billingCadence: 'monthly' | 'annual';
+    amountCents: number;
+    effectiveFrom: string;
+    changeReason?: string | null;
+  },
+  token?: string | null
+): Promise<ApiResponse<{ data: { newPriceId: number } }>> {
+  return request<{ data: { newPriceId: number } }>(baseUrl, '/billing-prices', {
+    method: 'POST',
+    body: JSON.stringify(body),
+    token: token ?? undefined,
+  });
+}
+
+export async function deprecateBillingPrice(
+  baseUrl: string,
+  priceId: number,
+  body: { changeReason?: string | null },
+  token?: string | null
+): Promise<ApiResponse<unknown>> {
+  return request<unknown>(baseUrl, `/billing-prices/${priceId}/deprecate`, {
+    method: 'POST',
+    body: JSON.stringify(body),
+    token: token ?? undefined,
+  });
+}
diff --git a/packages/helpers-requests/src/management-web/productMembership.ts b/packages/helpers-requests/src/management-web/productMembership.ts
new file mode 100644
index 00000000..0abac94a
--- /dev/null
+++ b/packages/helpers-requests/src/management-web/productMembership.ts
@@ -0,0 +1,18 @@
+import type { ApiResponse } from '../request.js';
+import type { ResolvedProductMembership } from '@metaboost/helpers';
+
+import { request } from '../request.js';
+
+export type ResolvedProductMembershipResponse = {
+  data: ResolvedProductMembership;
+};
+
+/** Requires `billingPrices` read permission (super admin bypasses); uses cookie auth when token omitted. */
+export async function getResolvedProductMembership(
+  baseUrl: string,
+  token?: string | null
+): Promise<ApiResponse<ResolvedProductMembershipResponse>> {
+  return request<ResolvedProductMembershipResponse>(baseUrl, '/product/membership', {
+    token: token ?? undefined,
+  });
+}
diff --git a/packages/helpers-requests/src/request.cookieHeaderToHeaders.test.ts b/packages/helpers-requests/src/request.cookieHeaderToHeaders.test.ts
new file mode 100644
index 00000000..26270e88
--- /dev/null
+++ b/packages/helpers-requests/src/request.cookieHeaderToHeaders.test.ts
@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest';
+
+import { cookieHeaderToHeaders } from './request.js';
+
+describe('cookieHeaderToHeaders', () => {
+  it('returns empty spread object for undefined', () => {
+    expect(cookieHeaderToHeaders(undefined)).toEqual({});
+  });
+
+  it('returns empty spread object for empty string', () => {
+    expect(cookieHeaderToHeaders('')).toEqual({});
+  });
+
+  it('returns Cookie header object for non-empty string', () => {
+    expect(cookieHeaderToHeaders('k=v')).toEqual({ headers: { Cookie: 'k=v' } });
+  });
+});
diff --git a/packages/helpers-requests/src/request.ts b/packages/helpers-requests/src/request.ts
index bf8b8026..c24967fa 100644
--- a/packages/helpers-requests/src/request.ts
+++ b/packages/helpers-requests/src/request.ts
@@ -21,6 +21,14 @@ export type RequestOptions = RequestInit & {
   locale?: string;
 };
 
+export function cookieHeaderToHeaders(
+  cookieHeader: string | undefined
+): { headers: { Cookie: string } } | object {
+  return cookieHeader !== undefined && cookieHeader !== ''
+    ? { headers: { Cookie: cookieHeader } }
+    : {};
+}
+
 export async function request<T = unknown>(
   baseUrl: string,
   path: string,
diff --git a/packages/helpers-requests/src/types/billing-read-model-types.ts b/packages/helpers-requests/src/types/billing-read-model-types.ts
new file mode 100644
index 00000000..0d2cff0f
--- /dev/null
+++ b/packages/helpers-requests/src/types/billing-read-model-types.ts
@@ -0,0 +1,6 @@
+export type {
+  AuthenticatedBillingMembershipReadModelData,
+  BillingRenewalLastStatus,
+  PublicProductMembershipReadModelData,
+  BILLING_LIST_PRICE_CURRENCY_CODE,
+} from '@metaboost/helpers';
diff --git a/packages/helpers-requests/src/types/index.ts b/packages/helpers-requests/src/types/index.ts
index e63043bf..83ea95d9 100644
--- a/packages/helpers-requests/src/types/index.ts
+++ b/packages/helpers-requests/src/types/index.ts
@@ -34,6 +34,12 @@ export type {
   UpdateTermsVersionBody,
 } from './management-terms-types.js';
 export type { BearerToken, WithOptionalToken } from './request-types.js';
+export type {
+  AuthenticatedBillingMembershipReadModelData,
+  BillingRenewalLastStatus,
+  BILLING_LIST_PRICE_CURRENCY_CODE,
+  PublicProductMembershipReadModelData,
+} from './billing-read-model-types.js';
 export type { MbrssV1ActionValue } from '@metaboost/helpers';
 export type {
   Bucket,
diff --git a/packages/helpers-requests/src/types/management-admin-types.ts b/packages/helpers-requests/src/types/management-admin-types.ts
index 4458329b..9307582f 100644
--- a/packages/helpers-requests/src/types/management-admin-types.ts
+++ b/packages/helpers-requests/src/types/management-admin-types.ts
@@ -19,6 +19,7 @@ export interface PublicManagementUser {
     bucketsCrud: number;
     bucketMessagesCrud: number;
     bucketAdminsCrud: number;
+    billingPricesCrud: number;
     eventVisibility: EventVisibility;
   } | null;
 }
@@ -44,6 +45,7 @@ export interface CreateAdminBody {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: EventVisibility;
 }
 
@@ -58,5 +60,6 @@ export interface UpdateAdminBody {
   bucketsCrud?: number;
   bucketMessagesCrud?: number;
   bucketAdminsCrud?: number;
+  billingPricesCrud?: number;
   eventVisibility?: EventVisibility;
 }
diff --git a/packages/helpers-requests/src/types/management-user-types.ts b/packages/helpers-requests/src/types/management-user-types.ts
index 68558e10..01e84962 100644
--- a/packages/helpers-requests/src/types/management-user-types.ts
+++ b/packages/helpers-requests/src/types/management-user-types.ts
@@ -1,3 +1,5 @@
+import type { PremiumBillingCadence } from '@metaboost/helpers';
+
 /** Main-app user as returned by GET /users and GET /users/:id (safe, no credentials). */
 export interface PublicMainAppUser {
   id: string;
@@ -29,6 +31,8 @@ export interface CreateUserBody {
   membershipTier?: 'trial' | 'premium';
   membershipExpiresAt?: string | null;
   autoRenew?: boolean;
+  /** When membership is premium and expiry omitted: monthly ⇒ +1 month, annual ⇒ +12 months from now. */
+  premiumBillingCadence?: PremiumBillingCadence;
 }
 
 /** Validated body for PATCH /users/:id. At least one field present. */
diff --git a/packages/helpers-requests/src/web/auth.ts b/packages/helpers-requests/src/web/auth.ts
index 277b5b78..ff7d282a 100644
--- a/packages/helpers-requests/src/web/auth.ts
+++ b/packages/helpers-requests/src/web/auth.ts
@@ -131,6 +131,92 @@ export async function deleteMe(baseUrl: string, options?: { token?: string | nul
   });
 }
 
+export type WebPushSubscriptionDto = {
+  id: string;
+  endpoint: string;
+  locale: string | null;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type WebPushSubscriptionKeys = {
+  p256dh: string;
+  auth: string;
+};
+
+export type UpsertWebPushSubscriptionBody = {
+  endpoint: string;
+  keys: WebPushSubscriptionKeys;
+  locale?: string | null;
+};
+
+export type UpdateWebPushSubscriptionBody = {
+  endpoint?: string;
+  keys?: WebPushSubscriptionKeys;
+  locale?: string | null;
+};
+
+/** GET /auth/web-push-subscriptions (authenticated). */
+export async function reqListWebPushSubscriptions(
+  baseUrl: string,
+  options?: { token?: string | null }
+): Promise<ApiResponse<{ subscriptions: WebPushSubscriptionDto[] }>> {
+  return request<{ subscriptions: WebPushSubscriptionDto[] }>(
+    baseUrl,
+    '/auth/web-push-subscriptions',
+    {
+      token: options?.token ?? undefined,
+    }
+  );
+}
+
+/** POST /auth/web-push-subscriptions — upsert subscription by endpoint. */
+export async function reqUpsertWebPushSubscription(
+  baseUrl: string,
+  body: UpsertWebPushSubscriptionBody,
+  options?: { token?: string | null }
+): Promise<ApiResponse<{ subscription: WebPushSubscriptionDto }>> {
+  return request<{ subscription: WebPushSubscriptionDto }>(
+    baseUrl,
+    '/auth/web-push-subscriptions',
+    {
+      method: 'POST',
+      body: JSON.stringify(body),
+      token: options?.token ?? undefined,
+    }
+  );
+}
+
+/** PATCH /auth/web-push-subscriptions/:subscriptionId */
+export async function reqUpdateWebPushSubscription(
+  baseUrl: string,
+  subscriptionId: string,
+  body: UpdateWebPushSubscriptionBody,
+  options?: { token?: string | null }
+): Promise<ApiResponse<{ subscription: WebPushSubscriptionDto }>> {
+  return request<{ subscription: WebPushSubscriptionDto }>(
+    baseUrl,
+    `/auth/web-push-subscriptions/${subscriptionId}`,
+    {
+      method: 'PATCH',
+      body: JSON.stringify(body),
+      token: options?.token ?? undefined,
+    }
+  );
+}
+
+/** DELETE /auth/web-push-subscriptions/:subscriptionId */
+export async function reqDeleteWebPushSubscription(
+  baseUrl: string,
+  subscriptionId: string,
+  options?: { token?: string | null }
+): Promise<ApiResponse<void>> {
+  return request<void>(baseUrl, `/auth/web-push-subscriptions/${subscriptionId}`, {
+    method: 'DELETE',
+    token: options?.token ?? undefined,
+  });
+}
+
 export type UsernameAvailableData = { available: boolean };
 
 /** Call GET /auth/username-available?username=... to check availability. Optional token for auth (own username then considered available). */
diff --git a/packages/helpers-requests/src/web/buckets.ts b/packages/helpers-requests/src/web/buckets.ts
index 356f6b3b..a3ef94ae 100644
--- a/packages/helpers-requests/src/web/buckets.ts
+++ b/packages/helpers-requests/src/web/buckets.ts
@@ -20,7 +20,7 @@ import type {
 
 import { isAscDescSortOrder } from '@metaboost/helpers';
 
-import { request } from '../request.js';
+import { cookieHeaderToHeaders, request } from '../request.js';
 
 const SERVER_OPTIONS = { cache: 'no-store' as RequestCache } as const;
 
@@ -47,6 +47,62 @@ export type UpdateBucketBody = {
  * GET /buckets/:id (authenticated). Use for server-side fetch with cookie.
  * API returns { bucket }.
  */
+export type BucketNotificationPreferenceResponse = {
+  bucketId: string;
+  enabled: boolean;
+  hasExplicitPreference: boolean;
+};
+
+export type BucketNotificationPreferencePatchResponse = {
+  bucketId: string;
+  enabled: boolean;
+  applyToDescendants: boolean;
+};
+
+export type UpdateBucketNotificationPreferenceBody = {
+  enabled: boolean;
+  applyToDescendants?: boolean;
+};
+
+/**
+ * GET /buckets/:bucketId/notification-preference (authenticated).
+ */
+export async function reqFetchBucketNotificationPreference(
+  baseUrl: string,
+  bucketId: string,
+  cookieHeader?: string
+): Promise<ApiResponse<BucketNotificationPreferenceResponse>> {
+  return request<BucketNotificationPreferenceResponse>(
+    baseUrl,
+    `/buckets/${bucketId}/notification-preference`,
+    {
+      ...cookieHeaderToHeaders(cookieHeader),
+      ...SERVER_OPTIONS,
+    }
+  );
+}
+
+/**
+ * PATCH /buckets/:bucketId/notification-preference (authenticated).
+ */
+export async function reqPatchBucketNotificationPreference(
+  baseUrl: string,
+  bucketId: string,
+  body: UpdateBucketNotificationPreferenceBody,
+  cookieHeader?: string
+): Promise<ApiResponse<BucketNotificationPreferencePatchResponse>> {
+  return request<BucketNotificationPreferencePatchResponse>(
+    baseUrl,
+    `/buckets/${bucketId}/notification-preference`,
+    {
+      method: 'PATCH',
+      body: JSON.stringify(body),
+      ...cookieHeaderToHeaders(cookieHeader),
+      ...SERVER_OPTIONS,
+    }
+  );
+}
+
 export async function reqFetchBucket(
   baseUrl: string,
   bucketId: string,
@@ -85,9 +141,7 @@ export async function reqFetchBucketsList(
   const qs = params.toString();
   const path = qs !== '' ? `/buckets?${qs}` : '/buckets';
   return request<{ buckets: Bucket[] }>(baseUrl, path, {
-    ...(cookieHeader !== undefined && cookieHeader !== ''
-      ? { headers: { Cookie: cookieHeader } }
-      : {}),
+    ...cookieHeaderToHeaders(cookieHeader),
     ...SERVER_OPTIONS,
   });
 }
@@ -120,9 +174,7 @@ export async function reqFetchChildBuckets(
   const qs = params.toString();
   const path = qs !== '' ? `/buckets/${bucketId}/buckets?${qs}` : `/buckets/${bucketId}/buckets`;
   return request<{ buckets: Bucket[] }>(baseUrl, path, {
-    ...(cookieHeader !== undefined && cookieHeader !== ''
-      ? { headers: { Cookie: cookieHeader } }
-      : {}),
+    ...cookieHeaderToHeaders(cookieHeader),
     ...SERVER_OPTIONS,
   });
 }
@@ -138,9 +190,7 @@ export async function reqPostCreateBucket(
   return request<{ bucket: Bucket }>(baseUrl, '/buckets', {
     method: 'POST',
     body: JSON.stringify(body),
-    ...(cookieHeader !== undefined && cookieHeader !== ''
-      ? { headers: { Cookie: cookieHeader } }
-      : {}),
+    ...cookieHeaderToHeaders(cookieHeader),
     ...SERVER_OPTIONS,
   });
 }
@@ -157,9 +207,7 @@ export async function reqPostCreateChildBucket(
   return request<{ bucket: Bucket }>(baseUrl, `/buckets/${bucketId}/buckets`, {
     method: 'POST',
     body: JSON.stringify(body),
-    ...(cookieHeader !== undefined && cookieHeader !== ''
-      ? { headers: { Cookie: cookieHeader } }
-      : {}),
+    ...cookieHeaderToHeaders(cookieHeader),
     ...SERVER_OPTIONS,
   });
 }
@@ -173,9 +221,7 @@ export async function reqPatchUpdateBucket(
   return request<{ bucket: Bucket }>(baseUrl, `/buckets/${bucketId}`, {
     method: 'PATCH',
     body: JSON.stringify(body),
-    ...(cookieHeader !== undefined && cookieHeader !== ''
-      ? { headers: { Cookie: cookieHeader } }
-      : {}),
+    ...cookieHeaderToHeaders(cookieHeader),
     ...SERVER_OPTIONS,
   });
 }
@@ -218,9 +264,7 @@ export async function reqFetchDashboardBucketSummary(
   query?: BucketSummaryQuery
 ): Promise<ApiResponse<BucketSummaryData>> {
   return request<BucketSummaryData>(baseUrl, buildBucketSummaryPath('/buckets/summary', query), {
-    ...(cookieHeader !== undefined && cookieHeader !== ''
-      ? { headers: { Cookie: cookieHeader } }
-      : {}),
+    ...cookieHeaderToHeaders(cookieHeader),
     ...SERVER_OPTIONS,
   });
 }
@@ -235,9 +279,7 @@ export async function reqFetchBucketSummary(
     baseUrl,
     buildBucketSummaryPath(`/buckets/${bucketId}/summary`, query),
     {
-      ...(cookieHeader !== undefined && cookieHeader !== ''
-        ? { headers: { Cookie: cookieHeader } }
-        : {}),
+      ...cookieHeaderToHeaders(cookieHeader),
       ...SERVER_OPTIONS,
     }
   );
@@ -437,9 +479,7 @@ export async function reqPostVerifyRssChannel(
 ): Promise<ApiResponse<VerifyRssChannelResponse>> {
   return request<VerifyRssChannelResponse>(baseUrl, `/buckets/${bucketId}/rss/verify`, {
     method: 'POST',
-    ...(cookieHeader !== undefined && cookieHeader !== ''
-      ? { headers: { Cookie: cookieHeader } }
-      : {}),
+    ...cookieHeaderToHeaders(cookieHeader),
     ...SERVER_OPTIONS,
   });
 }
@@ -532,13 +572,11 @@ export async function reqDeleteBucket(
   bucketId: string,
   cookieHeader?: string
 ): Promise<ApiResponse<void>> {
-  const options: { method: string; headers?: { Cookie: string }; cache?: RequestCache } = {
+  const options = {
     method: 'DELETE',
+    ...cookieHeaderToHeaders(cookieHeader),
     ...SERVER_OPTIONS,
   };
-  if (cookieHeader !== undefined && cookieHeader !== '') {
-    options.headers = { Cookie: cookieHeader };
-  }
   const res = await request<void>(baseUrl, `/buckets/${bucketId}`, options);
   return res;
 }
diff --git a/packages/helpers-requests/src/web/product.ts b/packages/helpers-requests/src/web/product.ts
new file mode 100644
index 00000000..02f5b4a2
--- /dev/null
+++ b/packages/helpers-requests/src/web/product.ts
@@ -0,0 +1,34 @@
+import type { ApiResponse } from '../request.js';
+import type {
+  AuthenticatedBillingMembershipReadModelData,
+  PublicProductMembershipReadModelData,
+} from '../types/billing-read-model-types.js';
+
+import { request } from '../request.js';
+
+export type PublicProductMembershipPayload = {
+  data: PublicProductMembershipReadModelData;
+};
+
+export type AuthenticatedBillingMembershipPayload = {
+  data: AuthenticatedBillingMembershipReadModelData;
+};
+
+/** GET /product/membership — public resolved pricing/trial and signup visibility (no auth). */
+export async function getPublicProductMembership(
+  baseUrl: string
+): Promise<ApiResponse<PublicProductMembershipPayload>> {
+  return request<PublicProductMembershipPayload>(baseUrl, '/product/membership');
+}
+
+/** GET /auth/billing/membership-summary — session cookie or Bearer token. */
+export async function getBillingMembershipSummary(
+  baseUrl: string,
+  token?: string | null
+): Promise<ApiResponse<AuthenticatedBillingMembershipPayload>> {
+  return request<AuthenticatedBillingMembershipPayload>(
+    baseUrl,
+    '/auth/billing/membership-summary',
+    { token: token ?? undefined }
+  );
+}
diff --git a/packages/helpers-requests/vitest.config.ts b/packages/helpers-requests/vitest.config.ts
new file mode 100644
index 00000000..7eeb3f85
--- /dev/null
+++ b/packages/helpers-requests/vitest.config.ts
@@ -0,0 +1,8 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    include: ['src/**/*.test.ts'],
+  },
+});
diff --git a/packages/helpers/package.json b/packages/helpers/package.json
index 2d919f15..4d5e30d5 100644
--- a/packages/helpers/package.json
+++ b/packages/helpers/package.json
@@ -5,6 +5,13 @@
   "private": true,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
   "scripts": {
     "build": "tsc",
     "build:watch": "tsc --watch --preserveWatchOutput",
diff --git a/packages/helpers/src/index.ts b/packages/helpers/src/index.ts
index 1e748ec1..9f6794f7 100644
--- a/packages/helpers/src/index.ts
+++ b/packages/helpers/src/index.ts
@@ -171,6 +171,42 @@ export { isFinitePositive } from './number/isFinitePositive.js';
 export { isNonNegativeInteger } from './number/isNonNegativeInteger.js';
 export { compareStringsEmptyLastLexicographic } from './sort/compareStringsEmptyLastLexicographic.js';
 export { MembershipTier, MEMBERSHIP_TIER_VALUES } from './trust/constants.js';
+export {
+  DEFAULT_FREE_TRIAL_EXPIRATION,
+  PRODUCT_MEMBERSHIP_DEFAULTS_FROM_ENV_FALLBACK,
+  resolveProductMembershipDefaultsFromEnv,
+  type ProductMembershipDefaultsFromEnv,
+} from './membership/productMembershipDefaultsFromEnv.js';
+export type { PremiumBillingCadence } from './membership/premiumBillingCadence.js';
+export type {
+  BillingCadence,
+  BillingProductCode,
+  MembershipPeriodExtensionReason,
+} from './membership/billingDomain.js';
+export { BILLING_PRODUCT_CODE_MEMBERSHIP_PREMIUM } from './membership/billingDomain.js';
+export {
+  BILLING_DOMAIN_EVENT_TYPES,
+  type BillingDomainEventType,
+} from './membership/billingDomainEvents.js';
+export type {
+  BillingRenewalAttemptResult,
+  BillingRenewalProviderAdapter,
+} from './membership/billingRenewalAdapter.js';
+export { createStubBillingRenewalProviderAdapter } from './membership/billingRenewalAdapter.js';
+export type { ResolvedProductMembership } from './membership/resolvedProductMembership.js';
+export {
+  BILLING_LIST_PRICE_CURRENCY_CODE,
+  type AuthenticatedBillingMembershipReadModelData,
+  type BillingRenewalLastStatus,
+  type PublicProductMembershipReadModelData,
+} from './membership/billingReadModelTypes.js';
+export {
+  extendMembershipPeriodByCadence,
+  extendMembershipPeriodByMonths,
+  membershipExtensionBaseDate,
+  monthsForPremiumCadence,
+  resolveInitialMembershipExpiresAt,
+} from './membership/membershipPeriodPolicy.js';
 export type { AccountEntitlementCapability } from './trust/accountEntitlementCapability.js';
 export { ACCOUNT_ENTITLEMENT_CAPABILITY } from './trust/accountEntitlementCapability.js';
 export { membershipTierFromStoredValue } from './trust/membershipTierFromStoredValue.js';
diff --git a/packages/helpers/src/managementAdminRoles/constants.ts b/packages/helpers/src/managementAdminRoles/constants.ts
index ae77855f..3b095572 100644
--- a/packages/helpers/src/managementAdminRoles/constants.ts
+++ b/packages/helpers/src/managementAdminRoles/constants.ts
@@ -18,6 +18,7 @@ export type PredefinedManagementAdminRole = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: EventVisibility;
 };
 
@@ -30,6 +31,7 @@ export const PREDEFINED_MANAGEMENT_ADMIN_ROLES: PredefinedManagementAdminRole[]
     bucketsCrud: 15,
     bucketMessagesCrud: 15,
     bucketAdminsCrud: 15,
+    billingPricesCrud: 15,
     eventVisibility: 'all',
   },
   {
@@ -40,6 +42,7 @@ export const PREDEFINED_MANAGEMENT_ADMIN_ROLES: PredefinedManagementAdminRole[]
     bucketsCrud: 2,
     bucketMessagesCrud: 2,
     bucketAdminsCrud: 2,
+    billingPricesCrud: 2,
     eventVisibility: 'all_admins',
   },
   {
@@ -50,6 +53,7 @@ export const PREDEFINED_MANAGEMENT_ADMIN_ROLES: PredefinedManagementAdminRole[]
     bucketsCrud: 15,
     bucketMessagesCrud: 15,
     bucketAdminsCrud: 15,
+    billingPricesCrud: 15,
     eventVisibility: 'all_admins',
   },
   {
@@ -60,6 +64,7 @@ export const PREDEFINED_MANAGEMENT_ADMIN_ROLES: PredefinedManagementAdminRole[]
     bucketsCrud: 15,
     bucketMessagesCrud: 15,
     bucketAdminsCrud: 15,
+    billingPricesCrud: 0,
     eventVisibility: 'all_admins',
   },
   {
@@ -70,6 +75,7 @@ export const PREDEFINED_MANAGEMENT_ADMIN_ROLES: PredefinedManagementAdminRole[]
     bucketsCrud: 2,
     bucketMessagesCrud: 2,
     bucketAdminsCrud: 2,
+    billingPricesCrud: 0,
     eventVisibility: 'all_admins',
   },
 ];
diff --git a/packages/helpers/src/membership/billingDomain.ts b/packages/helpers/src/membership/billingDomain.ts
new file mode 100644
index 00000000..b8d1df0b
--- /dev/null
+++ b/packages/helpers/src/membership/billingDomain.ts
@@ -0,0 +1,20 @@
+import type { PremiumBillingCadence } from './premiumBillingCadence.js';
+
+/**
+ * Vendor-agnostic cadence label for premium membership period math.
+ * Alias of {@link PremiumBillingCadence} for billing catalog alignment.
+ */
+export type BillingCadence = PremiumBillingCadence;
+
+export const BILLING_PRODUCT_CODE_MEMBERSHIP_PREMIUM = 'membership_premium' as const;
+
+export type BillingProductCode = typeof BILLING_PRODUCT_CODE_MEMBERSHIP_PREMIUM;
+
+/** Reasons for membership period mutations (orchestration and audit contracts). */
+export type MembershipPeriodExtensionReason =
+  | 'initial_default'
+  | 'tier_change_default'
+  | 'payment_settled'
+  | 'pay_on_demand_extension'
+  | 'renewal_success'
+  | 'admin_adjustment';
diff --git a/packages/helpers/src/membership/billingDomainEvents.ts b/packages/helpers/src/membership/billingDomainEvents.ts
new file mode 100644
index 00000000..2c59847e
--- /dev/null
+++ b/packages/helpers/src/membership/billingDomainEvents.ts
@@ -0,0 +1,12 @@
+/**
+ * Normalized billing domain event labels stored in `billing_domain_event.event_type`.
+ */
+export const BILLING_DOMAIN_EVENT_TYPES = {
+  PAYMENT_SETTLED: 'payment_settled',
+  RENEWAL_SUCCEEDED: 'renewal_succeeded',
+  RENEWAL_FAILED: 'renewal_failed',
+  PAY_ON_DEMAND_EXTENSION_REQUESTED: 'pay_on_demand_extension_requested',
+} as const;
+
+export type BillingDomainEventType =
+  (typeof BILLING_DOMAIN_EVENT_TYPES)[keyof typeof BILLING_DOMAIN_EVENT_TYPES];
diff --git a/packages/helpers/src/membership/billingReadModelTypes.ts b/packages/helpers/src/membership/billingReadModelTypes.ts
new file mode 100644
index 00000000..8975688a
--- /dev/null
+++ b/packages/helpers/src/membership/billingReadModelTypes.ts
@@ -0,0 +1,46 @@
+import type { ResolvedProductMembership } from './resolvedProductMembership.js';
+
+/**
+ * ISO 4217 currency code for list-priced premium tiers returned by public billing read models.
+ * Catalog rows currently store USD; clients must not assume user-settled currency for upgrades.
+ */
+export const BILLING_LIST_PRICE_CURRENCY_CODE = 'USD' as const;
+
+/**
+ * Public (unauthenticated) product/membership read model for marketing and signup flows.
+ * Resolved DB-first on the server; env seeds gaps only. Same numeric fields as
+ * `ResolvedProductMembership`, flattened under `data` (Podverse parity).
+ */
+export type PublicProductMembershipReadModelData = ResolvedProductMembership & {
+  listPriceCurrencyCode: typeof BILLING_LIST_PRICE_CURRENCY_CODE;
+  /**
+   * Mirrors account signup mode: when false, anonymous clients must not treat premium list prices
+   * as actionable for self-serve signup (admin provisioning only).
+   */
+  selfServePublicSignupOpen: boolean;
+};
+
+export type BillingRenewalLastStatus = 'none' | 'succeeded' | 'failed';
+
+/**
+ * Authenticated user billing snapshot plus resolved catalog pricing (no PII).
+ */
+export type AuthenticatedBillingMembershipReadModelData = {
+  listPriceCurrencyCode: typeof BILLING_LIST_PRICE_CURRENCY_CODE;
+  membership: {
+    tier: string;
+    /** ISO 8601 UTC instant; null when unset. */
+    expiresAtIso: string | null;
+    premiumBillingCadence: 'monthly' | 'annual' | null;
+    autoRenewMode: 'off' | 'on';
+  };
+  renewal: {
+    lastStatus: BillingRenewalLastStatus;
+    /** ISO 8601 UTC instant; null when never attempted. */
+    lastAttemptAtIso: string | null;
+    /** ISO 8601 UTC instant; null when no retry scheduled. */
+    nextAttemptAtIso: string | null;
+    retryCount: number;
+  };
+  catalog: ResolvedProductMembership;
+};
diff --git a/packages/helpers/src/membership/billingRenewalAdapter.ts b/packages/helpers/src/membership/billingRenewalAdapter.ts
new file mode 100644
index 00000000..62e0fd43
--- /dev/null
+++ b/packages/helpers/src/membership/billingRenewalAdapter.ts
@@ -0,0 +1,25 @@
+import type { BillingCadence } from './billingDomain.js';
+
+export type BillingRenewalAttemptResult =
+  | { status: 'succeeded'; providerAttemptId?: string }
+  | { status: 'failed'; providerAttemptId?: string; retryAfterSeconds?: number };
+
+/**
+ * Provider-agnostic renewal boundary (Stripe, internal ledger, etc.).
+ * Implementations must treat `idempotencyKey` as a dedupe key for charge attempts.
+ */
+export interface BillingRenewalProviderAdapter {
+  attemptRenewal(params: {
+    userId: string;
+    cadence: BillingCadence;
+    idempotencyKey: string;
+  }): Promise<BillingRenewalAttemptResult>;
+}
+
+export function createStubBillingRenewalProviderAdapter(): BillingRenewalProviderAdapter {
+  return {
+    async attemptRenewal() {
+      return { status: 'succeeded', providerAttemptId: 'stub' };
+    },
+  };
+}
diff --git a/packages/helpers/src/membership/membershipPeriodPolicy.test.ts b/packages/helpers/src/membership/membershipPeriodPolicy.test.ts
new file mode 100644
index 00000000..d471ef2a
--- /dev/null
+++ b/packages/helpers/src/membership/membershipPeriodPolicy.test.ts
@@ -0,0 +1,130 @@
+import { describe, expect, it } from 'vitest';
+
+import { MembershipTier } from '../trust/constants.js';
+import {
+  extendMembershipPeriodByCadence,
+  extendMembershipPeriodByMonths,
+  membershipExtensionBaseDate,
+  monthsForPremiumCadence,
+  resolveInitialMembershipExpiresAt,
+} from './membershipPeriodPolicy.js';
+
+describe('membershipPeriodPolicy', () => {
+  describe('monthsForPremiumCadence', () => {
+    it('maps monthly and annual', () => {
+      expect(monthsForPremiumCadence('monthly')).toBe(1);
+      expect(monthsForPremiumCadence('annual')).toBe(12);
+    });
+  });
+
+  describe('membershipExtensionBaseDate', () => {
+    it('uses now when expiry is null', () => {
+      const now = new Date(2026, 4, 5, 12, 0, 0);
+      expect(membershipExtensionBaseDate(null, now).getTime()).toBe(now.getTime());
+    });
+
+    it('uses now when expiry is in the past', () => {
+      const now = new Date(2026, 4, 5, 12, 0, 0);
+      const past = new Date(2025, 0, 1);
+      expect(membershipExtensionBaseDate(past, now).getTime()).toBe(now.getTime());
+    });
+
+    it('uses existing expiry when still active', () => {
+      const now = new Date(2026, 4, 5, 12, 0, 0);
+      const future = new Date(2027, 0, 1);
+      expect(membershipExtensionBaseDate(future, now).getTime()).toBe(future.getTime());
+    });
+  });
+
+  describe('extendMembershipPeriodByCadence', () => {
+    it('stacks monthly from active expiry', () => {
+      const now = new Date(2026, 4, 5, 12, 0, 0);
+      const expiry = new Date(2026, 5, 10);
+      const next = extendMembershipPeriodByCadence({
+        membershipExpiresAt: expiry,
+        cadence: 'monthly',
+        now,
+      });
+      expect(next.getFullYear()).toBe(2026);
+      expect(next.getMonth()).toBe(6);
+      expect(next.getDate()).toBe(10);
+    });
+
+    it('Jan 31 + 1 month clamps to Feb end (leap year)', () => {
+      const now = new Date(2024, 0, 15);
+      const jan31 = new Date(2024, 0, 31);
+      const next = extendMembershipPeriodByCadence({
+        membershipExpiresAt: jan31,
+        cadence: 'monthly',
+        now,
+      });
+      expect(next.getFullYear()).toBe(2024);
+      expect(next.getMonth()).toBe(1);
+      expect(next.getDate()).toBe(29);
+    });
+
+    it('Mar 31 + 1 month clamps to Apr 30', () => {
+      const now = new Date(2026, 2, 15);
+      const mar31 = new Date(2026, 2, 31);
+      const next = extendMembershipPeriodByCadence({
+        membershipExpiresAt: mar31,
+        cadence: 'monthly',
+        now,
+      });
+      expect(next.getFullYear()).toBe(2026);
+      expect(next.getMonth()).toBe(3);
+      expect(next.getDate()).toBe(30);
+    });
+  });
+
+  describe('extendMembershipPeriodByMonths', () => {
+    it('adds arbitrary months from extension base', () => {
+      const now = new Date(2026, 4, 5);
+      const next = extendMembershipPeriodByMonths({
+        membershipExpiresAt: null,
+        monthsToAdd: 3,
+        now,
+      });
+      expect(next.getFullYear()).toBe(2026);
+      expect(next.getMonth()).toBe(7);
+      expect(next.getDate()).toBe(5);
+    });
+  });
+
+  describe('resolveInitialMembershipExpiresAt', () => {
+    it('premium monthly adds one calendar month from now', () => {
+      const now = new Date(2026, 0, 15, 10, 0, 0);
+      const d = resolveInitialMembershipExpiresAt({
+        membershipTier: MembershipTier.Premium,
+        premiumBillingCadence: 'monthly',
+        trialExpirationSeconds: 86400,
+        now,
+      });
+      expect(d.getFullYear()).toBe(2026);
+      expect(d.getMonth()).toBe(1);
+      expect(d.getDate()).toBe(15);
+    });
+
+    it('premium defaults to annual cadence when omitted', () => {
+      const now = new Date(2026, 0, 15);
+      const d = resolveInitialMembershipExpiresAt({
+        membershipTier: MembershipTier.Premium,
+        trialExpirationSeconds: 1,
+        now,
+      });
+      expect(d.getFullYear()).toBe(2027);
+      expect(d.getMonth()).toBe(0);
+      expect(d.getDate()).toBe(15);
+    });
+
+    it('trial adds seconds', () => {
+      const now = new Date(2026, 4, 5, 12, 0, 0);
+      const d = resolveInitialMembershipExpiresAt({
+        membershipTier: MembershipTier.Trial,
+        trialExpirationSeconds: 3600,
+        now,
+      });
+      expect(d.getTime()).toBe(now.getTime() + 3600 * 1000);
+    });
+  });
+});
diff --git a/packages/helpers/src/membership/membershipPeriodPolicy.ts b/packages/helpers/src/membership/membershipPeriodPolicy.ts
new file mode 100644
index 00000000..51f880c8
--- /dev/null
+++ b/packages/helpers/src/membership/membershipPeriodPolicy.ts
@@ -0,0 +1,65 @@
+import type { BillingCadence } from './billingDomain.js';
+import type { PremiumBillingCadence } from './premiumBillingCadence.js';
+
+import { addMonths } from '../time/addMonths.js';
+import { MembershipTier } from '../trust/constants.js';
+
+/**
+ * Whole months to add for a premium cadence (calendar-month clamp via {@link addMonths}).
+ */
+export function monthsForPremiumCadence(cadence: BillingCadence): number {
+  return cadence === 'monthly' ? 1 : 12;
+}
+
+/**
+ * Base instant for stacking the next period: extend from current expiry while active,
+ * otherwise from `now` when expired or unset.
+ */
+export function membershipExtensionBaseDate(
+  membershipExpiresAt: Date | null | undefined,
+  now: Date
+): Date {
+  if (membershipExpiresAt === null || membershipExpiresAt === undefined) {
+    return now;
+  }
+  return membershipExpiresAt.getTime() > now.getTime() ? membershipExpiresAt : now;
+}
+
+export function extendMembershipPeriodByCadence(params: {
+  membershipExpiresAt: Date | null | undefined;
+  cadence: BillingCadence;
+  now?: Date;
+}): Date {
+  const now = params.now ?? new Date();
+  const base = membershipExtensionBaseDate(params.membershipExpiresAt, now);
+  return addMonths(base, monthsForPremiumCadence(params.cadence));
+}
+
+export function extendMembershipPeriodByMonths(params: {
+  membershipExpiresAt: Date | null | undefined;
+  monthsToAdd: number;
+  now?: Date;
+}): Date {
+  const now = params.now ?? new Date();
+  const base = membershipExtensionBaseDate(params.membershipExpiresAt, now);
+  return addMonths(base, params.monthsToAdd);
+}
+
+/**
+ * Default expiry for a newly created trust settings row when the caller does not pass an explicit
+ * `membershipExpiresAt`. Trial: `now + trialExpirationSeconds`. Premium: `now` plus cadence months
+ * (defaults to annual when cadence is omitted).
+ */
+export function resolveInitialMembershipExpiresAt(params: {
+  membershipTier: MembershipTier;
+  premiumBillingCadence?: PremiumBillingCadence;
+  trialExpirationSeconds: number;
+  now?: Date;
+}): Date {
+  const now = params.now ?? new Date();
+  if (params.membershipTier === MembershipTier.Premium) {
+    const cadence = params.premiumBillingCadence ?? 'annual';
+    return addMonths(now, monthsForPremiumCadence(cadence));
+  }
+  return new Date(now.getTime() + params.trialExpirationSeconds * 1000);
+}
diff --git a/packages/helpers/src/membership/premiumBillingCadence.ts b/packages/helpers/src/membership/premiumBillingCadence.ts
new file mode 100644
index 00000000..5c59248f
--- /dev/null
+++ b/packages/helpers/src/membership/premiumBillingCadence.ts
@@ -0,0 +1,4 @@
+/**
+ * Billing period for premium membership when deriving default expiry from cadence (monthly vs annual).
+ */
+export type PremiumBillingCadence = 'monthly' | 'annual';
diff --git a/packages/helpers/src/membership/productMembershipDefaultsFromEnv.ts b/packages/helpers/src/membership/productMembershipDefaultsFromEnv.ts
new file mode 100644
index 00000000..dbd94b6e
--- /dev/null
+++ b/packages/helpers/src/membership/productMembershipDefaultsFromEnv.ts
@@ -0,0 +1,66 @@
+/**
+ * Env-only fallbacks for membership product defaults (same keys as API/management-api startup validation).
+ * Lenient parsing: invalid optional env falls back to defaults (safe for HTTP handlers).
+ *
+ * Runtime resolution is DB-first: `BillingPriceCatalogService.resolveProductMembership` and
+ * `ProductMembershipSettingsService` read `product_membership_settings` and active premium prices;
+ * these env values apply when inserting missing rows only (`ON CONFLICT DO NOTHING` / gap-fill pricing).
+ */
+
+/** Default trial duration when `MEMBERSHIP_FREE_TRIAL_EXPIRATION` is unset (seconds; see env-expiration-naming skill). */
+export const DEFAULT_FREE_TRIAL_EXPIRATION = 31 * 24 * 60 * 60;
+
+export type ProductMembershipDefaultsFromEnv = {
+  freeTrialExpirationSeconds: number;
+  premiumMembershipCostMonthly: number;
+  premiumMembershipCostAnnually: number;
+};
+
+/** Defaults when env vars are unset; shared by `resolveProductMembershipDefaultsFromEnv` and browser fallbacks. */
+export const PRODUCT_MEMBERSHIP_DEFAULTS_FROM_ENV_FALLBACK: ProductMembershipDefaultsFromEnv = {
+  freeTrialExpirationSeconds: DEFAULT_FREE_TRIAL_EXPIRATION,
+  premiumMembershipCostMonthly: 3,
+  premiumMembershipCostAnnually: 30,
+};
+
+function parseNonNegativeNumberEnv(name: string, fallback: number): number {
+  const raw = process.env[name];
+  if (raw === undefined || raw === '') {
+    return fallback;
+  }
+  const n = Number(String(raw).trim());
+  if (!Number.isFinite(n) || n < 0) {
+    return fallback;
+  }
+  return n;
+}
+
+function parsePositiveIntegerTrialExpiration(name: string, fallbackExpiration: number): number {
+  const raw = process.env[name];
+  if (raw === undefined || raw === null || String(raw).trim() === '') {
+    return fallbackExpiration;
+  }
+  const n = Number(String(raw).trim());
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
+    return fallbackExpiration;
+  }
+  return n;
+}
+
+/** Non-secret product defaults for admin UIs and optional main-app mirrors. */
+export function resolveProductMembershipDefaultsFromEnv(): ProductMembershipDefaultsFromEnv {
+  return {
+    freeTrialExpirationSeconds: parsePositiveIntegerTrialExpiration(
+      'MEMBERSHIP_FREE_TRIAL_EXPIRATION',
+      PRODUCT_MEMBERSHIP_DEFAULTS_FROM_ENV_FALLBACK.freeTrialExpirationSeconds
+    ),
+    premiumMembershipCostMonthly: parseNonNegativeNumberEnv(
+      'MEMBERSHIP_PREMIUM_COST_MONTHLY',
+      PRODUCT_MEMBERSHIP_DEFAULTS_FROM_ENV_FALLBACK.premiumMembershipCostMonthly
+    ),
+    premiumMembershipCostAnnually: parseNonNegativeNumberEnv(
+      'MEMBERSHIP_PREMIUM_COST_ANNUALLY',
+      PRODUCT_MEMBERSHIP_DEFAULTS_FROM_ENV_FALLBACK.premiumMembershipCostAnnually
+    ),
+  };
+}
diff --git a/packages/helpers/src/membership/resolvedProductMembership.ts b/packages/helpers/src/membership/resolvedProductMembership.ts
new file mode 100644
index 00000000..1a259335
--- /dev/null
+++ b/packages/helpers/src/membership/resolvedProductMembership.ts
@@ -0,0 +1,7 @@
+import type { ProductMembershipDefaultsFromEnv } from './productMembershipDefaultsFromEnv.js';
+
+/**
+ * Resolved premium membership marketing values (trial length and USD prices), merged from DB
+ * catalog and env bootstrap.
+ */
+export type ResolvedProductMembership = ProductMembershipDefaultsFromEnv;
diff --git a/packages/helpers/src/time/addMonths.test.ts b/packages/helpers/src/time/addMonths.test.ts
index 88e377d1..2232e557 100644
--- a/packages/helpers/src/time/addMonths.test.ts
+++ b/packages/helpers/src/time/addMonths.test.ts
@@ -10,4 +10,20 @@ describe('addMonths', () => {
     expect(next.getMonth()).toBe(3);
     expect(next.getDate()).toBe(15);
   });
+
+  it('clamps Jan 31 to last day of February in a leap year', () => {
+    const start = new Date(2024, 0, 31);
+    const next = addMonths(start, 1);
+    expect(next.getFullYear()).toBe(2024);
+    expect(next.getMonth()).toBe(1);
+    expect(next.getDate()).toBe(29);
+  });
+
+  it('clamps Mar 31 to Apr 30', () => {
+    const start = new Date(2026, 2, 31);
+    const next = addMonths(start, 1);
+    expect(next.getFullYear()).toBe(2026);
+    expect(next.getMonth()).toBe(3);
+    expect(next.getDate()).toBe(30);
+  });
 });
diff --git a/packages/helpers/src/time/addMonths.ts b/packages/helpers/src/time/addMonths.ts
index 51a3facd..c77b04ff 100644
--- a/packages/helpers/src/time/addMonths.ts
+++ b/packages/helpers/src/time/addMonths.ts
@@ -1,8 +1,22 @@
 /**
- * Calendar-month addition (native `Date#setMonth` semantics, including end-of-month rollover).
+ * Calendar-month addition with day clamping to the last valid day of the target month
+ * (e.g. Jan 31 + 1 month → Feb 29 in a leap year, Feb 28 otherwise).
  */
 export function addMonths(baseDate: Date, months: number): Date {
-  const date = new Date(baseDate);
-  date.setMonth(date.getMonth() + months);
-  return date;
+  const year = baseDate.getFullYear();
+  const month = baseDate.getMonth();
+  const day = baseDate.getDate();
+  const hours = baseDate.getHours();
+  const minutes = baseDate.getMinutes();
+  const seconds = baseDate.getSeconds();
+  const milliseconds = baseDate.getMilliseconds();
+
+  const targetMonthIndex = month + months;
+  const targetYear = year + Math.floor(targetMonthIndex / 12);
+  const normalizedMonth = ((targetMonthIndex % 12) + 12) % 12;
+
+  const lastDayInTargetMonth = new Date(targetYear, normalizedMonth + 1, 0).getDate();
+  const clampedDay = Math.min(day, lastDayInTargetMonth);
+
+  return new Date(targetYear, normalizedMonth, clampedDay, hours, minutes, seconds, milliseconds);
 }
diff --git a/packages/helpers/src/time/toDateTimeLocalValue.test.ts b/packages/helpers/src/time/toDateTimeLocalValue.test.ts
new file mode 100644
index 00000000..be3404d7
--- /dev/null
+++ b/packages/helpers/src/time/toDateTimeLocalValue.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+
+import { toDateTimeLocalValue } from './toDateTimeLocalValue.js';
+
+describe('toDateTimeLocalValue', () => {
+  it('returns empty string for null and undefined', () => {
+    expect(toDateTimeLocalValue(null)).toBe('');
+    expect(toDateTimeLocalValue(undefined)).toBe('');
+  });
+
+  it('returns empty string for invalid date input', () => {
+    expect(toDateTimeLocalValue('not-a-date')).toBe('');
+  });
+
+  it('formats a local-constructed Date using local calendar fields', () => {
+    const d = new Date(2020, 6, 8, 9, 7);
+    expect(toDateTimeLocalValue(d)).toBe('2020-07-08T09:07');
+  });
+
+  it('formats numeric timestamps', () => {
+    const d = new Date(2021, 0, 2, 3, 4);
+    expect(toDateTimeLocalValue(d.getTime())).toBe('2021-01-02T03:04');
+  });
+
+  it('matches formatting from Date from the same parseable string', () => {
+    const s = '2020-06-15T14:30:00';
+    expect(toDateTimeLocalValue(s)).toBe(toDateTimeLocalValue(new Date(s)));
+  });
+});
diff --git a/packages/helpers/src/time/toDateTimeLocalValue.ts b/packages/helpers/src/time/toDateTimeLocalValue.ts
index f03f1f49..ba4746dd 100644
--- a/packages/helpers/src/time/toDateTimeLocalValue.ts
+++ b/packages/helpers/src/time/toDateTimeLocalValue.ts
@@ -1,12 +1,17 @@
-export function toDateTimeLocalValue(value: string | Date | null | undefined): string {
+/**
+ * Format a value for `<input type="datetime-local">` using the environment's
+ * local calendar fields (not UTC). Matches Podverse `toDatetimeLocalInputValue`.
+ */
+export function toDateTimeLocalValue(value: Date | number | string | null | undefined): string {
   if (value === null || value === undefined) {
     return '';
   }
 
-  const parsed = value instanceof Date ? value : new Date(value);
-  if (Number.isNaN(parsed.getTime())) {
+  const d = value instanceof Date ? value : new Date(value);
+  if (Number.isNaN(d.getTime())) {
     return '';
   }
 
-  return parsed.toISOString().slice(0, 16);
+  const pad = (n: number) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}T${pad(d.getHours())}:${pad(d.getMinutes())}`;
 }
diff --git a/packages/management-orm/src/entities/AdminPermissions.ts b/packages/management-orm/src/entities/AdminPermissions.ts
index c508a39d..c2363397 100644
--- a/packages/management-orm/src/entities/AdminPermissions.ts
+++ b/packages/management-orm/src/entities/AdminPermissions.ts
@@ -33,6 +33,9 @@ export class AdminPermissions {
   @Column({ name: 'bucket_admins_crud', type: 'integer', default: 0 })
   bucketAdminsCrud!: number;
 
+  @Column({ name: 'billing_prices_crud', type: 'integer', default: 0 })
+  billingPricesCrud!: number;
+
   @Column({ name: 'event_visibility', type: 'text', default: 'all_admins' })
   eventVisibility!: EventVisibility;
 
diff --git a/packages/management-orm/src/entities/ManagementAdminRole.ts b/packages/management-orm/src/entities/ManagementAdminRole.ts
index 605d86ce..ddafe0d8 100644
--- a/packages/management-orm/src/entities/ManagementAdminRole.ts
+++ b/packages/management-orm/src/entities/ManagementAdminRole.ts
@@ -25,6 +25,9 @@ export class ManagementAdminRole {
   @Column({ name: 'bucket_admins_crud', type: 'integer' })
   bucketAdminsCrud!: number;
 
+  @Column({ name: 'billing_prices_crud', type: 'integer' })
+  billingPricesCrud!: number;
+
   @Column({ name: 'event_visibility', type: 'text' })
   eventVisibility!: EventVisibility;
 
diff --git a/packages/management-orm/src/services/ManagementAdminRoleService.ts b/packages/management-orm/src/services/ManagementAdminRoleService.ts
index d10ef6d1..008fc5d9 100644
--- a/packages/management-orm/src/services/ManagementAdminRoleService.ts
+++ b/packages/management-orm/src/services/ManagementAdminRoleService.ts
@@ -10,6 +10,7 @@ export type CreateManagementAdminRoleData = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: EventVisibility;
 };
 
@@ -20,6 +21,7 @@ export type UpdateManagementAdminRoleData = {
   bucketsCrud?: number;
   bucketMessagesCrud?: number;
   bucketAdminsCrud?: number;
+  billingPricesCrud?: number;
   eventVisibility?: EventVisibility;
 };
 
diff --git a/packages/management-orm/src/services/ManagementUserService.ts b/packages/management-orm/src/services/ManagementUserService.ts
index fcecec47..cce11f5e 100644
--- a/packages/management-orm/src/services/ManagementUserService.ts
+++ b/packages/management-orm/src/services/ManagementUserService.ts
@@ -19,6 +19,7 @@ export type CreateAdminData = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
   eventVisibility: EventVisibility;
 };
 
@@ -31,6 +32,7 @@ export type UpdateAdminData = {
   bucketsCrud?: number;
   bucketMessagesCrud?: number;
   bucketAdminsCrud?: number;
+  billingPricesCrud?: number;
   eventVisibility?: EventVisibility;
 };
 
@@ -201,6 +203,7 @@ export class ManagementUserService {
         bucketsCrud: data.bucketsCrud,
         bucketMessagesCrud: data.bucketMessagesCrud,
         bucketAdminsCrud: data.bucketAdminsCrud,
+        billingPricesCrud: data.billingPricesCrud,
         eventVisibility: data.eventVisibility,
       });
       await permRepo.save(perm);
@@ -250,6 +253,7 @@ export class ManagementUserService {
           bucketsCrud?: number;
           bucketMessagesCrud?: number;
           bucketAdminsCrud?: number;
+          billingPricesCrud?: number;
           eventVisibility?: EventVisibility;
         } = {};
         if (data.adminsCrud !== undefined) updates.adminsCrud = data.adminsCrud;
@@ -258,6 +262,8 @@ export class ManagementUserService {
         if (data.bucketMessagesCrud !== undefined)
           updates.bucketMessagesCrud = data.bucketMessagesCrud;
         if (data.bucketAdminsCrud !== undefined) updates.bucketAdminsCrud = data.bucketAdminsCrud;
+        if (data.billingPricesCrud !== undefined)
+          updates.billingPricesCrud = data.billingPricesCrud;
         if (data.eventVisibility !== undefined) updates.eventVisibility = data.eventVisibility;
         if (Object.keys(updates).length > 0) {
           await permRepo.update({ adminId: id }, updates);
diff --git a/packages/metaboost-signing/CHANGELOG.md b/packages/metaboost-signing/CHANGELOG.md
deleted file mode 100644
index 9ff806f5..00000000
--- a/packages/metaboost-signing/CHANGELOG.md
+++ /dev/null
@@ -1,32 +0,0 @@
-# Changelog
-
-All notable changes to **metaboost-signing** are documented here. This project follows [Semantic Versioning](https://semver.org/) for the **public API** exported from the package entry point (`metaboost-signing`).
-
-## [0.2.1] - 2026-04-17
-
-### Changed
-
-- **npm package name** is **`metaboost-signing`** (unscoped). Import from `'metaboost-signing'`. Supersedes the short-lived **`@podverse/metaboost-signing`** naming in **0.2.0** (never required for consumers of the public API).
-
-## [0.2.0] - 2026-04-17
-
-### Changed
-
-- **npm package name** was **`@podverse/metaboost-signing`** (scoped). Superseded by **0.2.1** unscoped **`metaboost-signing`**.
-
-## [0.1.9] - 2026-04-17
-
-### Changed
-
-- npm package name **`metaboost-signing-helpers` → `metaboost-signing`** (shorter). Monorepo path **`packages/metaboost-signing`**. Git release tags **`metaboost-signing-vX.Y.Z`**. Error message prefix **`metaboost-signing:`**.
-
-## [0.1.8] - 2026-04-16
-
-### Added
-
-- Initial public distribution metadata, release workflow, and consumer-facing distribution documentation.
-- v1 exports: `hashRequestBody`, `createAssertionClaims`, `signAppAssertion`, `buildSignedRequestHeaders`, `APP_ASSERTION_MAX_TTL_SECONDS`.
-
-### Changed
-
-- Package license is **MIT** (see `LICENSE` in the package root on npm).
diff --git a/packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md b/packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md
index 08a404ca..5eaa9b87 100644
--- a/packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md
+++ b/packages/metaboost-signing/PACKAGES-METABOOST-SIGNING.md
@@ -1,6 +1,6 @@
 # metaboost-signing
 
-Framework-agnostic helpers for minting **AppAssertion** JWTs for `POST /v1/standard/*` on Metaboost, per [docs/api/STANDARD-ENDPOINT-APP-SIGNING.md](../../docs/api/STANDARD-ENDPOINT-APP-SIGNING.md).
+Framework-agnostic helpers for minting **AppAssertion** JWTs for `POST /v1/standard/*` on Metaboost, per [docs/api/STANDARD-ENDPOINT-APP-SIGNING.md](/docs/api/STANDARD-ENDPOINT-APP-SIGNING.md).
 
 ## Install
 
@@ -8,7 +8,7 @@ Framework-agnostic helpers for minting **AppAssertion** JWTs for `POST /v1/stand
 npm install metaboost-signing
 ```
 
-Published to the **public npm registry** (`https://registry.npmjs.org`). Distribution, versioning, and release workflow: [docs/api/METABOOST-SIGNING-DISTRIBUTION.md](../../docs/api/METABOOST-SIGNING-DISTRIBUTION.md).
+Published to the **public npm registry** (`https://registry.npmjs.org`). Distribution, versioning, and release workflow: [docs/api/METABOOST-SIGNING-DISTRIBUTION.md](/docs/api/METABOOST-SIGNING-DISTRIBUTION.md).
 
 **Node.js:** `>= 24.0.0` (see `engines` in `package.json`).
 
@@ -33,7 +33,7 @@ Constants: `APP_ASSERTION_MAX_TTL_SECONDS` (300).
 
 ## More examples
 
-Backend-focused patterns (wrapper, `fetch`, retries, fixtures): [docs/api/STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md](../../docs/api/STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md).
+Backend-focused patterns (wrapper, `fetch`, retries, fixtures): [docs/api/STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md](/docs/api/STANDARD-ENDPOINT-CONSUMER-EXAMPLES.md).
 
 ## Usage
 
@@ -69,9 +69,9 @@ const headers = buildSignedRequestHeaders({ jwt });
 
 From repository root: `npm run build -w metaboost-signing`, `npm run test -w metaboost-signing`.
 
-## Changelog
+## Version history
 
-See [CHANGELOG.md](./CHANGELOG.md).
+See [GitHub releases](https://github.com/podverse/metaboost/releases) and tags matching `metaboost-signing-v*`.
 
 ## License
 
diff --git a/packages/metaboost-signing/package.json b/packages/metaboost-signing/package.json
index 37a4373f..dd3a5bd3 100644
--- a/packages/metaboost-signing/package.json
+++ b/packages/metaboost-signing/package.json
@@ -16,7 +16,6 @@
   "files": [
     "dist",
     "README.md",
-    "CHANGELOG.md",
     "LICENSE"
   ],
   "publishConfig": {
diff --git a/packages/orm/package.json b/packages/orm/package.json
index f6b74e51..db93b9a6 100644
--- a/packages/orm/package.json
+++ b/packages/orm/package.json
@@ -11,6 +11,7 @@
     "lint": "eslint ./src --max-warnings 0",
     "lint:fix": "eslint ./src --fix",
     "type-check": "tsc --noEmit",
+    "test": "vitest run",
     "clean": "rm -rf dist"
   },
   "dependencies": {
@@ -29,6 +30,7 @@
     "@types/node": "^24.10.12",
     "app-root-path": "^3.1.0",
     "sql-highlight": "^6.1.0",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.2",
+    "vitest": "^4.1.4"
   }
 }
diff --git a/packages/orm/src/data-source.ts b/packages/orm/src/data-source.ts
index 2bbe7054..1e333146 100644
--- a/packages/orm/src/data-source.ts
+++ b/packages/orm/src/data-source.ts
@@ -7,6 +7,9 @@ import type { DataSourceOptions } from 'typeorm';
  */
 import { DataSource } from 'typeorm';
 
+import { BillingDomainEvent } from './entities/BillingDomainEvent.js';
+import { BillingPrice } from './entities/BillingPrice.js';
+import { BillingProduct } from './entities/BillingProduct.js';
 import { Bucket } from './entities/Bucket.js';
 import { BucketAdmin } from './entities/BucketAdmin.js';
 import { BucketAdminInvitation } from './entities/BucketAdminInvitation.js';
@@ -15,11 +18,13 @@ import { BucketBlockedSender } from './entities/BucketBlockedSender.js';
 import { BucketMessage } from './entities/BucketMessage.js';
 import { BucketMessageAppMeta } from './entities/BucketMessageAppMeta.js';
 import { BucketMessageValue } from './entities/BucketMessageValue.js';
+import { BucketNotificationPreference } from './entities/BucketNotificationPreference.js';
 import { BucketRole } from './entities/BucketRole.js';
 import { BucketRSSChannelInfo } from './entities/BucketRSSChannelInfo.js';
 import { BucketRSSItemInfo } from './entities/BucketRSSItemInfo.js';
 import { BucketSettings } from './entities/BucketSettings.js';
 import { GlobalBlockedApp } from './entities/GlobalBlockedApp.js';
+import { ProductMembershipSettings } from './entities/ProductMembershipSettings.js';
 import { RefreshToken } from './entities/RefreshToken.js';
 import { TermsVersion, TermsVersionContent } from './entities/TermsVersion.js';
 import { User } from './entities/User.js';
@@ -27,6 +32,7 @@ import { UserBio } from './entities/UserBio.js';
 import { UserCredentials } from './entities/UserCredentials.js';
 import { UserTermsAcceptance } from './entities/UserTermsAcceptance.js';
 import { UserTrustSettings } from './entities/UserTrustSettings.js';
+import { UserWebPushSubscription } from './entities/UserWebPushSubscription.js';
 import { VerificationToken } from './entities/VerificationToken.js';
 
 const ENTITIES = [
@@ -34,6 +40,10 @@ const ENTITIES = [
   UserCredentials,
   UserBio,
   UserTrustSettings,
+  BillingProduct,
+  BillingPrice,
+  BillingDomainEvent,
+  ProductMembershipSettings,
   TermsVersion,
   TermsVersionContent,
   UserTermsAcceptance,
@@ -48,10 +58,12 @@ const ENTITIES = [
   BucketMessage,
   BucketMessageAppMeta,
   BucketMessageValue,
+  BucketNotificationPreference,
   GlobalBlockedApp,
   BucketRSSChannelInfo,
   BucketRSSItemInfo,
   BucketRole,
+  UserWebPushSubscription,
 ];
 
 function getReadOptions(): DataSourceOptions {
diff --git a/packages/orm/src/entities/BillingDomainEvent.ts b/packages/orm/src/entities/BillingDomainEvent.ts
new file mode 100644
index 00000000..21997d1f
--- /dev/null
+++ b/packages/orm/src/entities/BillingDomainEvent.ts
@@ -0,0 +1,24 @@
+import type { BillingDomainEventType } from '@metaboost/helpers';
+
+import { Column, CreateDateColumn, Entity, PrimaryGeneratedColumn } from 'typeorm';
+
+@Entity('billing_domain_event')
+export class BillingDomainEvent {
+  @PrimaryGeneratedColumn()
+  id!: number;
+
+  @Column({ name: 'event_type', type: 'varchar', length: 48 })
+  eventType!: BillingDomainEventType;
+
+  @Column({ name: 'user_id', type: 'uuid' })
+  userId!: string;
+
+  @Column({ name: 'idempotency_key', type: 'varchar', length: 128, nullable: true })
+  idempotencyKey!: string | null;
+
+  @Column({ type: 'jsonb' })
+  payload!: Record<string, unknown>;
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
+  createdAt!: Date;
+}
diff --git a/packages/orm/src/entities/BillingPrice.ts b/packages/orm/src/entities/BillingPrice.ts
new file mode 100644
index 00000000..58ec8784
--- /dev/null
+++ b/packages/orm/src/entities/BillingPrice.ts
@@ -0,0 +1,48 @@
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  JoinColumn,
+  ManyToOne,
+  PrimaryGeneratedColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+
+import { BillingProduct } from './BillingProduct.js';
+
+@Entity('billing_price')
+export class BillingPrice {
+  @PrimaryGeneratedColumn()
+  id!: number;
+
+  @Column({ name: 'billing_product_id', type: 'integer' })
+  billingProductId!: number;
+
+  @ManyToOne(() => BillingProduct, { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'billing_product_id' })
+  billingProduct!: BillingProduct;
+
+  @Column({ name: 'currency_code', type: 'char', length: 3 })
+  currencyCode!: string;
+
+  @Column({ name: 'billing_cadence', type: 'varchar', length: 16 })
+  billingCadence!: 'monthly' | 'annual';
+
+  @Column({ name: 'amount_cents', type: 'integer' })
+  amountCents!: number;
+
+  @Column({ name: 'effective_from', type: 'timestamp' })
+  effectiveFrom!: Date;
+
+  @Column({ name: 'effective_to', type: 'timestamp', nullable: true })
+  effectiveTo!: Date | null;
+
+  @Column({ type: 'varchar', length: 32, default: 'manual' })
+  source!: string;
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
+  createdAt!: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
+  updatedAt!: Date;
+}
diff --git a/packages/orm/src/entities/BillingProduct.ts b/packages/orm/src/entities/BillingProduct.ts
new file mode 100644
index 00000000..1bc28595
--- /dev/null
+++ b/packages/orm/src/entities/BillingProduct.ts
@@ -0,0 +1,28 @@
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  PrimaryGeneratedColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+
+@Entity('billing_product')
+export class BillingProduct {
+  @PrimaryGeneratedColumn()
+  id!: number;
+
+  @Column({ name: 'product_code', type: 'text', unique: true })
+  productCode!: string;
+
+  @Column({ type: 'text' })
+  name!: string;
+
+  @Column({ name: 'is_active', type: 'boolean', default: true })
+  isActive!: boolean;
+
+  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
+  createdAt!: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
+  updatedAt!: Date;
+}
diff --git a/packages/orm/src/entities/BucketNotificationPreference.ts b/packages/orm/src/entities/BucketNotificationPreference.ts
new file mode 100644
index 00000000..3189c9e4
--- /dev/null
+++ b/packages/orm/src/entities/BucketNotificationPreference.ts
@@ -0,0 +1,41 @@
+import type { Bucket } from './Bucket.js';
+import type { User } from './User.js';
+
+import {
+  Entity,
+  PrimaryGeneratedColumn,
+  Column,
+  ManyToOne,
+  JoinColumn,
+  CreateDateColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+
+@Entity('bucket_notification_preference')
+export class BucketNotificationPreference {
+  @PrimaryGeneratedColumn('uuid')
+  id!: string;
+
+  @Column({ name: 'user_id' })
+  userId!: string;
+
+  @Column({ name: 'bucket_id' })
+  bucketId!: string;
+
+  @Column({ type: 'boolean', default: true })
+  enabled!: boolean;
+
+  @CreateDateColumn({ name: 'created_at' })
+  createdAt!: Date;
+
+  @UpdateDateColumn({ name: 'updated_at' })
+  updatedAt!: Date;
+
+  @ManyToOne('User', { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'user_id' })
+  user!: User;
+
+  @ManyToOne('Bucket', { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'bucket_id' })
+  bucket!: Bucket;
+}
diff --git a/packages/orm/src/entities/ProductMembershipSettings.ts b/packages/orm/src/entities/ProductMembershipSettings.ts
new file mode 100644
index 00000000..856be3eb
--- /dev/null
+++ b/packages/orm/src/entities/ProductMembershipSettings.ts
@@ -0,0 +1,16 @@
+import { Column, Entity, PrimaryColumn, UpdateDateColumn } from 'typeorm';
+
+@Entity('product_membership_settings')
+export class ProductMembershipSettings {
+  @PrimaryColumn({ type: 'integer', default: 1 })
+  id!: number;
+
+  @Column({ name: 'free_trial_expiration_seconds', type: 'integer' })
+  freeTrialExpirationSeconds!: number;
+
+  @Column({ name: 'created_at', type: 'timestamptz' })
+  createdAt!: Date;
+
+  @UpdateDateColumn({ name: 'updated_at', type: 'timestamptz' })
+  updatedAt!: Date;
+}
diff --git a/packages/orm/src/entities/UserTrustSettings.ts b/packages/orm/src/entities/UserTrustSettings.ts
index 43fe1c07..e80ceb90 100644
--- a/packages/orm/src/entities/UserTrustSettings.ts
+++ b/packages/orm/src/entities/UserTrustSettings.ts
@@ -16,6 +16,33 @@ export class UserTrustSettings {
   @Column({ name: 'auto_renew', type: 'boolean', default: false })
   autoRenew!: boolean;
 
+  @Column({ name: 'billing_cadence', type: 'varchar', length: 16, nullable: true })
+  billingCadence!: string | null;
+
+  @Column({ name: 'auto_renew_mode', type: 'varchar', length: 16, default: 'off' })
+  autoRenewMode!: 'off' | 'on';
+
+  @Column({ name: 'next_renewal_attempt_at', type: 'timestamp', nullable: true })
+  nextRenewalAttemptAt!: Date | null;
+
+  @Column({ name: 'last_renewal_attempt_at', type: 'timestamp', nullable: true })
+  lastRenewalAttemptAt!: Date | null;
+
+  @Column({ name: 'last_renewal_status', type: 'varchar', length: 16, default: 'none' })
+  lastRenewalStatus!: string;
+
+  @Column({ name: 'last_extension_idempotency_key', type: 'varchar', length: 128, nullable: true })
+  lastExtensionIdempotencyKey!: string | null;
+
+  @Column({ name: 'last_renewal_idempotency_key', type: 'varchar', length: 128, nullable: true })
+  lastRenewalIdempotencyKey!: string | null;
+
+  @Column({ name: 'renewal_retry_count', type: 'integer', default: 0 })
+  renewalRetryCount!: number;
+
+  @Column({ name: 'renewal_retry_backoff_until', type: 'timestamp', nullable: true })
+  renewalRetryBackoffUntil!: Date | null;
+
   @Column({ name: 'created_at', type: 'timestamp' })
   createdAt!: Date;
 
diff --git a/packages/orm/src/entities/UserWebPushSubscription.ts b/packages/orm/src/entities/UserWebPushSubscription.ts
new file mode 100644
index 00000000..99500b2c
--- /dev/null
+++ b/packages/orm/src/entities/UserWebPushSubscription.ts
@@ -0,0 +1,44 @@
+import type { User } from './User.js';
+
+import {
+  Entity,
+  PrimaryGeneratedColumn,
+  Column,
+  ManyToOne,
+  JoinColumn,
+  CreateDateColumn,
+  UpdateDateColumn,
+} from 'typeorm';
+
+import { SHORT_TEXT_MAX_LENGTH } from '@metaboost/helpers';
+
+@Entity('user_web_push_subscription')
+export class UserWebPushSubscription {
+  @PrimaryGeneratedColumn('uuid')
+  id!: string;
+
+  @Column({ name: 'user_id' })
+  userId!: string;
+
+  @Column({ type: 'varchar', length: 2048 })
+  endpoint!: string;
+
+  @Column({ name: 'key_p256dh', type: 'text' })
+  keyP256dh!: string;
+
+  @Column({ name: 'key_auth', type: 'text' })
+  keyAuth!: string;
+
+  @Column({ type: 'varchar', length: SHORT_TEXT_MAX_LENGTH, nullable: true })
+  locale!: string | null;
+
+  @CreateDateColumn({ name: 'created_at' })
+  createdAt!: Date;
+
+  @UpdateDateColumn({ name: 'updated_at' })
+  updatedAt!: Date;
+
+  @ManyToOne('User', { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'user_id' })
+  user!: User;
+}
diff --git a/packages/orm/src/index.ts b/packages/orm/src/index.ts
index 8146b396..29102bbe 100644
--- a/packages/orm/src/index.ts
+++ b/packages/orm/src/index.ts
@@ -26,7 +26,16 @@ export { BucketMessageValue } from './entities/BucketMessageValue.js';
 export { BucketRSSChannelInfo } from './entities/BucketRSSChannelInfo.js';
 export { BucketRSSItemInfo } from './entities/BucketRSSItemInfo.js';
 export { BucketRole } from './entities/BucketRole.js';
+export { BucketNotificationPreference } from './entities/BucketNotificationPreference.js';
+export { UserWebPushSubscription } from './entities/UserWebPushSubscription.js';
 export type { UserWithRelations } from './types/UserWithRelations.js';
+export type { PremiumBillingCadence } from '@metaboost/helpers';
+export type { ResolvedProductMembership } from '@metaboost/helpers';
+export { BillingPriceCatalogService } from './services/billingPriceCatalog.js';
+export { ProductMembershipSettingsService } from './services/productMembershipSettings.js';
+export { BillingProduct } from './entities/BillingProduct.js';
+export { BillingPrice } from './entities/BillingPrice.js';
+export { ProductMembershipSettings } from './entities/ProductMembershipSettings.js';
 export { UserService } from './services/UserService.js';
 export { TermsVersionService } from './services/TermsVersionService.js';
 export {
@@ -37,6 +46,7 @@ export {
   type TermsDefaultLocalizedContent,
 } from './defaults/termsDefaultContent.js';
 export { computeTermsContentHash } from './termsContentHash.js';
+export { getPgErrorCode, isPgUniqueViolation } from './lib/pgError.js';
 export {
   UserTermsAcceptanceService,
   type UserTermsAcceptanceStatus,
@@ -57,3 +67,22 @@ export { BucketMessageService } from './services/BucketMessageService.js';
 export { BucketRSSChannelInfoService } from './services/BucketRSSChannelInfoService.js';
 export { BucketRSSItemInfoService } from './services/BucketRSSItemInfoService.js';
 export { BucketRoleService } from './services/BucketRoleService.js';
+export { BucketNotificationPreferenceService } from './services/BucketNotificationPreferenceService.js';
+export { UserWebPushSubscriptionService } from './services/UserWebPushSubscriptionService.js';
+export { BillingDomainEvent } from './entities/BillingDomainEvent.js';
+export { BillingDomainEventLogService } from './services/billingDomainEventLog.js';
+export { MembershipPeriodExtensionService } from './services/membershipPeriodExtension.js';
+export {
+  BillingRenewalOrchestratorService,
+  type ProcessDueRenewalsSummary,
+} from './services/billingRenewalOrchestrator.js';
+export {
+  BillingPriceGovernanceService,
+  BILLING_PRICE_GOVERNANCE_DEFAULT_CURRENCY,
+} from './services/billingPriceGovernance.js';
+export type {
+  ActiveBillingPriceRow,
+  BillingPriceChangeAuditRow,
+  BillingPriceWindowRow,
+  BillingPriceWindowStatus,
+} from './services/billingPriceGovernance.js';
diff --git a/packages/orm/src/lib/defaultMembershipExpiresAt.ts b/packages/orm/src/lib/defaultMembershipExpiresAt.ts
new file mode 100644
index 00000000..462fc819
--- /dev/null
+++ b/packages/orm/src/lib/defaultMembershipExpiresAt.ts
@@ -0,0 +1,23 @@
+import type { MembershipTier } from '@metaboost/helpers';
+
+import { resolveInitialMembershipExpiresAt, type PremiumBillingCadence } from '@metaboost/helpers';
+
+import { readFreeTrialExpirationSeconds } from './freeTrialExpirationSeconds.js';
+
+export type { PremiumBillingCadence };
+
+/**
+ * Default membership expiry when the caller does not pass an explicit `membershipExpiresAt`.
+ * Trial: now + MEMBERSHIP_FREE_TRIAL_EXPIRATION (seconds).
+ * Premium: +1 month (monthly cadence) or +12 months (annual cadence); defaults to annual when unspecified.
+ */
+export function resolveDefaultMembershipExpiresAt(options: {
+  membershipTier: MembershipTier;
+  premiumBillingCadence?: PremiumBillingCadence;
+}): Date {
+  return resolveInitialMembershipExpiresAt({
+    membershipTier: options.membershipTier,
+    premiumBillingCadence: options.premiumBillingCadence,
+    trialExpirationSeconds: readFreeTrialExpirationSeconds(),
+  });
+}
diff --git a/packages/orm/src/lib/freeTrialExpirationSeconds.ts b/packages/orm/src/lib/freeTrialExpirationSeconds.ts
new file mode 100644
index 00000000..1189825d
--- /dev/null
+++ b/packages/orm/src/lib/freeTrialExpirationSeconds.ts
@@ -0,0 +1,25 @@
+import { DEFAULT_FREE_TRIAL_EXPIRATION } from '@metaboost/helpers';
+
+/**
+ * `MEMBERSHIP_FREE_TRIAL_EXPIRATION` is an optional non-negative integer — **seconds**.
+ * Unset uses the same default as `@metaboost/helpers` {@link DEFAULT_FREE_TRIAL_EXPIRATION}.
+ */
+function parseOptionalPositiveExpirationSeconds(name: string, defaultSeconds: number): number {
+  const raw = process.env[name];
+  if (raw === undefined || raw === null || String(raw).trim() === '') {
+    return defaultSeconds;
+  }
+  const n = Number(String(raw).trim());
+  if (!Number.isFinite(n) || !Number.isInteger(n) || n <= 0) {
+    throw new TypeError(`${name} must be a positive integer (seconds), received: ${String(raw)}`);
+  }
+  return n;
+}
+
+/** Trial-tier default membership window duration from env `MEMBERSHIP_FREE_TRIAL_EXPIRATION` (seconds). */
+export function readFreeTrialExpirationSeconds(): number {
+  return parseOptionalPositiveExpirationSeconds(
+    'MEMBERSHIP_FREE_TRIAL_EXPIRATION',
+    DEFAULT_FREE_TRIAL_EXPIRATION
+  );
+}
diff --git a/packages/orm/src/lib/membershipDefaultMonths.ts b/packages/orm/src/lib/membershipDefaultMonths.ts
deleted file mode 100644
index bb17636b..00000000
--- a/packages/orm/src/lib/membershipDefaultMonths.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-const MIN_MONTHS = 1;
-const MAX_MONTHS = 120;
-
-const DEFAULT_TRIAL_MONTHS = 3;
-const DEFAULT_PREMIUM_MONTHS = 12;
-
-function parseMembershipMonthsEnv(name: string, fallback: number): number {
-  const raw = process.env[name];
-  if (raw === undefined || raw === '') {
-    return fallback;
-  }
-  const n = Number.parseInt(raw, 10);
-  if (!Number.isFinite(n) || n < MIN_MONTHS || n > MAX_MONTHS) {
-    throw new Error(
-      `${name} must be an integer from ${String(MIN_MONTHS)} to ${String(MAX_MONTHS)}, received: ${String(raw)}`
-    );
-  }
-  return n;
-}
-
-/** Months added for default trial-tier expiry (`MEMBERSHIP_DEFAULT_TRIAL_MONTHS`, default 3). */
-export function membershipDefaultTrialMonths(): number {
-  return parseMembershipMonthsEnv('MEMBERSHIP_DEFAULT_TRIAL_MONTHS', DEFAULT_TRIAL_MONTHS);
-}
-
-/** Months added for default premium-tier expiry (`MEMBERSHIP_DEFAULT_PREMIUM_MONTHS`, default 12). */
-export function membershipDefaultPremiumMonths(): number {
-  return parseMembershipMonthsEnv('MEMBERSHIP_DEFAULT_PREMIUM_MONTHS', DEFAULT_PREMIUM_MONTHS);
-}
diff --git a/packages/orm/src/lib/pgError.test.ts b/packages/orm/src/lib/pgError.test.ts
new file mode 100644
index 00000000..3d69b676
--- /dev/null
+++ b/packages/orm/src/lib/pgError.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest';
+
+import { getPgErrorCode, isPgUniqueViolation } from './pgError.js';
+
+describe('getPgErrorCode', () => {
+  it('returns undefined for null, undefined, and non-objects', () => {
+    expect(getPgErrorCode(null)).toBeUndefined();
+    expect(getPgErrorCode(undefined)).toBeUndefined();
+    expect(getPgErrorCode('23505')).toBeUndefined();
+    expect(getPgErrorCode(1)).toBeUndefined();
+  });
+
+  it('returns undefined when code is missing or not a string', () => {
+    expect(getPgErrorCode({})).toBeUndefined();
+    expect(getPgErrorCode({ code: 23505 })).toBeUndefined();
+  });
+
+  it('returns string codes when present', () => {
+    expect(getPgErrorCode({ code: '23505' })).toBe('23505');
+    expect(getPgErrorCode({ code: '23503' })).toBe('23503');
+  });
+});
+
+describe('isPgUniqueViolation', () => {
+  it('is true only when code is the unique_violation string', () => {
+    expect(isPgUniqueViolation({ code: '23505' })).toBe(true);
+    expect(isPgUniqueViolation({ code: '23503' })).toBe(false);
+    expect(isPgUniqueViolation({ code: 23505 })).toBe(false);
+    expect(isPgUniqueViolation(null)).toBe(false);
+    expect(isPgUniqueViolation(undefined)).toBe(false);
+  });
+});
diff --git a/packages/orm/src/lib/pgError.ts b/packages/orm/src/lib/pgError.ts
new file mode 100644
index 00000000..f75ee91f
--- /dev/null
+++ b/packages/orm/src/lib/pgError.ts
@@ -0,0 +1,15 @@
+/**
+ * Postgres / node-pg errors expose `code` as a string (e.g. `23505` unique violation).
+ * Single narrowing assertion for driver error shape; prefer `isPgUniqueViolation` at call sites.
+ */
+export function getPgErrorCode(err: unknown): string | undefined {
+  if (err === null || typeof err !== 'object' || !('code' in err)) {
+    return undefined;
+  }
+  const code = (err as { code: unknown }).code;
+  return typeof code === 'string' ? code : undefined;
+}
+
+export function isPgUniqueViolation(err: unknown): boolean {
+  return getPgErrorCode(err) === '23505';
+}
diff --git a/packages/orm/src/services/BucketNotificationPreferenceService.ts b/packages/orm/src/services/BucketNotificationPreferenceService.ts
new file mode 100644
index 00000000..1f274aa9
--- /dev/null
+++ b/packages/orm/src/services/BucketNotificationPreferenceService.ts
@@ -0,0 +1,126 @@
+import { appDataSourceRead, appDataSourceReadWrite } from '../data-source.js';
+import { BucketNotificationPreference } from '../entities/BucketNotificationPreference.js';
+
+function mapBucketNotificationPreferenceRow(raw: unknown): BucketNotificationPreference {
+  if (typeof raw !== 'object' || raw === null) {
+    throw new Error('BucketNotificationPreferenceService: invalid RETURNING row shape');
+  }
+  const id = Reflect.get(raw, 'id');
+  const userId = Reflect.get(raw, 'userId');
+  const bucketId = Reflect.get(raw, 'bucketId');
+  const enabled = Reflect.get(raw, 'enabled');
+  const createdAt = Reflect.get(raw, 'createdAt');
+  const updatedAt = Reflect.get(raw, 'updatedAt');
+  if (typeof id !== 'string') {
+    throw new Error('BucketNotificationPreferenceService: invalid id');
+  }
+  if (typeof userId !== 'string') {
+    throw new Error('BucketNotificationPreferenceService: invalid userId');
+  }
+  if (typeof bucketId !== 'string') {
+    throw new Error('BucketNotificationPreferenceService: invalid bucketId');
+  }
+  if (typeof enabled !== 'boolean') {
+    throw new Error('BucketNotificationPreferenceService: invalid enabled');
+  }
+  if (!(createdAt instanceof Date)) {
+    throw new Error('BucketNotificationPreferenceService: invalid createdAt');
+  }
+  if (!(updatedAt instanceof Date)) {
+    throw new Error('BucketNotificationPreferenceService: invalid updatedAt');
+  }
+  const entity = new BucketNotificationPreference();
+  entity.id = id;
+  entity.userId = userId;
+  entity.bucketId = bucketId;
+  entity.enabled = enabled;
+  entity.createdAt = createdAt;
+  entity.updatedAt = updatedAt;
+  return entity;
+}
+
+export class BucketNotificationPreferenceService {
+  static async findByUserAndBucket(
+    userId: string,
+    bucketId: string
+  ): Promise<BucketNotificationPreference | null> {
+    const repo = appDataSourceRead.getRepository(BucketNotificationPreference);
+    return repo.findOne({ where: { userId, bucketId } });
+  }
+
+  static async upsert(
+    userId: string,
+    bucketId: string,
+    enabled: boolean
+  ): Promise<BucketNotificationPreference> {
+    // Single round-trip; bypasses TypeORM repository hooks (none are defined on this entity).
+    const rows: unknown[] = await appDataSourceReadWrite.query(
+      `
+        INSERT INTO bucket_notification_preference (user_id, bucket_id, enabled)
+        VALUES ($1::uuid, $2::uuid, $3::boolean)
+        ON CONFLICT (user_id, bucket_id) DO UPDATE SET
+          enabled = EXCLUDED.enabled,
+          updated_at = NOW()
+        RETURNING
+          id,
+          user_id AS "userId",
+          bucket_id AS "bucketId",
+          enabled,
+          created_at AS "createdAt",
+          updated_at AS "updatedAt"
+      `,
+      [userId, bucketId, enabled]
+    );
+    const first = rows[0];
+    if (first === undefined) {
+      throw new Error('BucketNotificationPreferenceService.upsert: row missing after upsert');
+    }
+    return mapBucketNotificationPreferenceRow(first);
+  }
+
+  /**
+   * One SQL round-trip for many buckets (see BucketService.applyGeneralSettingsToDescendants).
+   */
+  static async upsertManyForUser(
+    userId: string,
+    bucketIds: string[],
+    enabled: boolean
+  ): Promise<void> {
+    if (bucketIds.length === 0) {
+      return;
+    }
+    await appDataSourceReadWrite.query(
+      `
+        INSERT INTO bucket_notification_preference
+          (user_id, bucket_id, enabled, created_at, updated_at)
+        SELECT $1::uuid, id, $2::boolean, NOW(), NOW()
+          FROM bucket
+         WHERE id = ANY($3::uuid[])
+        ON CONFLICT (user_id, bucket_id)
+           DO UPDATE SET enabled = EXCLUDED.enabled, updated_at = NOW();
+      `,
+      [userId, enabled, bucketIds]
+    );
+  }
+
+  static async listByUser(userId: string): Promise<BucketNotificationPreference[]> {
+    const repo = appDataSourceRead.getRepository(BucketNotificationPreference);
+    return repo.find({
+      where: { userId },
+      order: { createdAt: 'ASC' },
+    });
+  }
+
+  static async listByBucket(bucketId: string): Promise<BucketNotificationPreference[]> {
+    const repo = appDataSourceRead.getRepository(BucketNotificationPreference);
+    return repo.find({
+      where: { bucketId },
+      order: { createdAt: 'ASC' },
+    });
+  }
+
+  static async delete(userId: string, bucketId: string): Promise<void> {
+    const repo = appDataSourceReadWrite.getRepository(BucketNotificationPreference);
+    await repo.delete({ userId, bucketId });
+  }
+}
diff --git a/packages/orm/src/services/BucketService.ts b/packages/orm/src/services/BucketService.ts
index 7651c3d8..10aa9953 100644
--- a/packages/orm/src/services/BucketService.ts
+++ b/packages/orm/src/services/BucketService.ts
@@ -14,6 +14,7 @@ import {
 import { appDataSourceRead, appDataSourceReadWrite } from '../data-source.js';
 import { Bucket } from '../entities/Bucket.js';
 import { BucketSettings } from '../entities/BucketSettings.js';
+import { isPgUniqueViolation } from '../lib/pgError.js';
 
 export class BucketService {
   static readonly DEFAULT_PREFERRED_CURRENCY = 'USD';
@@ -402,14 +403,20 @@ export class BucketService {
           preferredCurrency: inheritedPreferredCurrency,
           publicBoostDisplayMinimumMinor: inheritedPublicBoostDisplayMinimumMinor,
         });
+        if (parentBucketId !== null) {
+          await appDataSourceReadWrite.query(
+            `
+              INSERT INTO bucket_notification_preference (user_id, bucket_id, enabled, created_at, updated_at)
+              SELECT user_id, $1::uuid, enabled, NOW(), NOW()
+              FROM bucket_notification_preference
+              WHERE bucket_id = $2::uuid
+            `,
+            [saved.id, parentBucketId]
+          );
+        }
         return saved;
       } catch (err) {
-        const isUniqueViolation =
-          err !== null &&
-          typeof err === 'object' &&
-          'code' in err &&
-          (err as { code: string }).code === '23505';
-        if (!isUniqueViolation || attempt === maxRetries - 1) {
+        if (!isPgUniqueViolation(err) || attempt === maxRetries - 1) {
           throw err;
         }
       }
diff --git a/packages/orm/src/services/UserService.ts b/packages/orm/src/services/UserService.ts
index df70ae11..30097e33 100644
--- a/packages/orm/src/services/UserService.ts
+++ b/packages/orm/src/services/UserService.ts
@@ -1,17 +1,18 @@
 import type { UserWithRelations } from '../types/UserWithRelations.js';
 
-import { addMonths, generateRandomIdText, MembershipTier } from '@metaboost/helpers';
+import {
+  generateRandomIdText,
+  MembershipTier,
+  membershipTierFromStoredValue,
+  type PremiumBillingCadence,
+} from '@metaboost/helpers';
 
 import { appDataSourceRead, appDataSourceReadWrite } from '../data-source.js';
 import { User } from '../entities/User.js';
 import { UserBio } from '../entities/UserBio.js';
 import { UserCredentials } from '../entities/UserCredentials.js';
 import { UserTrustSettings } from '../entities/UserTrustSettings.js';
-import {
-  membershipDefaultPremiumMonths,
-  membershipDefaultTrialMonths,
-} from '../lib/membershipDefaultMonths.js';
-
+import { resolveDefaultMembershipExpiresAt } from '../lib/defaultMembershipExpiresAt.js';
 const USER_RELATIONS = ['credentials', 'bio', 'trustSettings'] as const;
 
 export class UserService {
@@ -69,6 +70,8 @@ export class UserService {
     membershipTier?: MembershipTier;
     membershipExpiresAt?: Date | null;
     autoRenew?: boolean;
+    /** When tier is Premium and `membershipExpiresAt` is omitted: monthly +1 month, else +12 months. */
+    premiumBillingCadence?: PremiumBillingCadence;
   }): Promise<UserWithRelations> {
     const hasEmail = data.email !== undefined && data.email !== null && data.email !== '';
     const hasUsername =
@@ -109,15 +112,17 @@ export class UserService {
         await bioRepo.save(bio);
 
         const membershipTier = data.membershipTier ?? MembershipTier.Trial;
-        const defaultMembershipExpiresAt =
-          membershipTier === MembershipTier.Premium
-            ? addMonths(new Date(), membershipDefaultPremiumMonths())
-            : addMonths(new Date(), membershipDefaultTrialMonths());
+        const defaultMembershipExpiresAt = resolveDefaultMembershipExpiresAt({
+          membershipTier,
+          premiumBillingCadence: data.premiumBillingCadence,
+        });
+        const autoRenewVal = data.autoRenew ?? membershipTier === MembershipTier.Premium;
         const trustSettings = trustSettingsRepo.create({
           userId: savedUser.id,
           membershipTier,
           membershipExpiresAt: data.membershipExpiresAt ?? defaultMembershipExpiresAt,
-          autoRenew: data.autoRenew ?? membershipTier === MembershipTier.Premium,
+          autoRenew: autoRenewVal,
+          autoRenewMode: autoRenewVal ? 'on' : 'off',
         });
         await trustSettingsRepo.save(trustSettings);
 
@@ -188,20 +193,29 @@ export class UserService {
     membershipTier?: MembershipTier;
     membershipExpiresAt?: Date | null;
     autoRenew?: boolean;
+    premiumBillingCadence?: PremiumBillingCadence;
   }): Promise<void> {
     const repo = appDataSourceReadWrite.getRepository(UserTrustSettings);
     const existing = await repo.findOne({ where: { userId: data.userId } });
 
-    const nextMembershipTier =
-      data.membershipTier ?? existing?.membershipTier ?? MembershipTier.Trial;
+    const prevTier =
+      membershipTierFromStoredValue(existing?.membershipTier) ?? MembershipTier.Trial;
+    const nextMembershipTier = data.membershipTier ?? prevTier;
     const membershipTierChanged =
-      existing !== null &&
-      data.membershipTier !== undefined &&
-      data.membershipTier !== existing.membershipTier;
-    const defaultExpiry =
-      nextMembershipTier === MembershipTier.Premium
-        ? addMonths(new Date(), membershipDefaultPremiumMonths())
-        : addMonths(new Date(), membershipDefaultTrialMonths());
+      data.membershipTier !== undefined && data.membershipTier !== prevTier;
+    const defaultExpiry = resolveDefaultMembershipExpiresAt({
+      membershipTier: nextMembershipTier,
+      premiumBillingCadence: data.premiumBillingCadence,
+    });
+
+    const resolvedAutoRenew =
+      data.autoRenew !== undefined
+        ? data.autoRenew
+        : membershipTierChanged || existing === null
+          ? nextMembershipTier === MembershipTier.Premium
+          : existing.autoRenew;
+
+    const autoRenewMode: 'off' | 'on' = resolvedAutoRenew ? 'on' : 'off';
 
     const payload = {
       membershipTier: nextMembershipTier,
@@ -211,12 +225,8 @@ export class UserService {
           : membershipTierChanged || existing?.membershipExpiresAt === null || existing === null
             ? defaultExpiry
             : existing.membershipExpiresAt,
-      autoRenew:
-        data.autoRenew !== undefined
-          ? data.autoRenew
-          : membershipTierChanged || existing === null
-            ? nextMembershipTier === MembershipTier.Premium
-            : existing.autoRenew,
+      autoRenew: resolvedAutoRenew,
+      autoRenewMode,
     };
 
     if (existing === null) {
diff --git a/packages/orm/src/services/UserWebPushSubscriptionService.ts b/packages/orm/src/services/UserWebPushSubscriptionService.ts
new file mode 100644
index 00000000..eb9ee0a2
--- /dev/null
+++ b/packages/orm/src/services/UserWebPushSubscriptionService.ts
@@ -0,0 +1,156 @@
+import { In } from 'typeorm';
+
+import { appDataSourceRead, appDataSourceReadWrite } from '../data-source.js';
+import { UserWebPushSubscription } from '../entities/UserWebPushSubscription.js';
+
+function mapUserWebPushSubscriptionRow(raw: unknown): UserWebPushSubscription {
+  if (typeof raw !== 'object' || raw === null) {
+    throw new Error('UserWebPushSubscriptionService: invalid RETURNING row shape');
+  }
+  const id = Reflect.get(raw, 'id');
+  const userId = Reflect.get(raw, 'userId');
+  const endpoint = Reflect.get(raw, 'endpoint');
+  const keyP256dh = Reflect.get(raw, 'keyP256dh');
+  const keyAuth = Reflect.get(raw, 'keyAuth');
+  const locale = Reflect.get(raw, 'locale');
+  const createdAt = Reflect.get(raw, 'createdAt');
+  const updatedAt = Reflect.get(raw, 'updatedAt');
+  if (typeof id !== 'string') {
+    throw new Error('UserWebPushSubscriptionService: invalid id');
+  }
+  if (typeof userId !== 'string') {
+    throw new Error('UserWebPushSubscriptionService: invalid userId');
+  }
+  if (typeof endpoint !== 'string') {
+    throw new Error('UserWebPushSubscriptionService: invalid endpoint');
+  }
+  if (typeof keyP256dh !== 'string') {
+    throw new Error('UserWebPushSubscriptionService: invalid keyP256dh');
+  }
+  if (typeof keyAuth !== 'string') {
+    throw new Error('UserWebPushSubscriptionService: invalid keyAuth');
+  }
+  if (locale !== null && typeof locale !== 'string') {
+    throw new Error('UserWebPushSubscriptionService: invalid locale');
+  }
+  if (!(createdAt instanceof Date)) {
+    throw new Error('UserWebPushSubscriptionService: invalid createdAt');
+  }
+  if (!(updatedAt instanceof Date)) {
+    throw new Error('UserWebPushSubscriptionService: invalid updatedAt');
+  }
+  const entity = new UserWebPushSubscription();
+  entity.id = id;
+  entity.userId = userId;
+  entity.endpoint = endpoint;
+  entity.keyP256dh = keyP256dh;
+  entity.keyAuth = keyAuth;
+  entity.locale = locale;
+  entity.createdAt = createdAt;
+  entity.updatedAt = updatedAt;
+  return entity;
+}
+
+export class UserWebPushSubscriptionService {
+  static async upsert(data: {
+    userId: string;
+    endpoint: string;
+    keyP256dh: string;
+    keyAuth: string;
+    locale?: string | null;
+  }): Promise<UserWebPushSubscription> {
+    // Single round-trip; bypasses TypeORM repository hooks (none are defined on this entity).
+    const rows: unknown[] = await appDataSourceReadWrite.query(
+      `
+        INSERT INTO user_web_push_subscription (user_id, endpoint, key_p256dh, key_auth, locale)
+        VALUES ($1::uuid, $2::text, $3::text, $4::text, $5)
+        ON CONFLICT (endpoint) DO UPDATE SET
+          user_id = EXCLUDED.user_id,
+          key_p256dh = EXCLUDED.key_p256dh,
+          key_auth = EXCLUDED.key_auth,
+          locale = EXCLUDED.locale,
+          updated_at = NOW()
+        RETURNING
+          id,
+          user_id AS "userId",
+          endpoint,
+          key_p256dh AS "keyP256dh",
+          key_auth AS "keyAuth",
+          locale,
+          created_at AS "createdAt",
+          updated_at AS "updatedAt"
+      `,
+      [data.userId, data.endpoint, data.keyP256dh, data.keyAuth, data.locale ?? null]
+    );
+    const first = rows[0];
+    if (first === undefined) {
+      throw new Error('UserWebPushSubscriptionService.upsert: row missing after upsert');
+    }
+    return mapUserWebPushSubscriptionRow(first);
+  }
+
+  static async findByIdForUser(
+    id: string,
+    userId: string
+  ): Promise<UserWebPushSubscription | null> {
+    const repo = appDataSourceRead.getRepository(UserWebPushSubscription);
+    return repo.findOne({ where: { id, userId } });
+  }
+
+  static async updateForUser(
+    id: string,
+    userId: string,
+    data: {
+      endpoint?: string;
+      keyP256dh?: string;
+      keyAuth?: string;
+      locale?: string | null;
+    }
+  ): Promise<UserWebPushSubscription | null> {
+    const repo = appDataSourceReadWrite.getRepository(UserWebPushSubscription);
+    const existing = await repo.findOne({ where: { id, userId } });
+    if (existing === null) {
+      return null;
+    }
+    if (data.endpoint !== undefined) {
+      existing.endpoint = data.endpoint;
+    }
+    if (data.keyP256dh !== undefined) {
+      existing.keyP256dh = data.keyP256dh;
+    }
+    if (data.keyAuth !== undefined) {
+      existing.keyAuth = data.keyAuth;
+    }
+    if (data.locale !== undefined) {
+      existing.locale = data.locale;
+    }
+    return repo.save(existing);
+  }
+
+  static async listByUser(userId: string): Promise<UserWebPushSubscription[]> {
+    const repo = appDataSourceRead.getRepository(UserWebPushSubscription);
+    return repo.find({
+      where: { userId },
+      order: { createdAt: 'ASC' },
+    });
+  }
+
+  /** Single round-trip for dispatch; ordered by user then subscription age for stable grouping. */
+  static async listByUserIds(userIds: string[]): Promise<UserWebPushSubscription[]> {
+    if (userIds.length === 0) {
+      return [];
+    }
+    const repo = appDataSourceRead.getRepository(UserWebPushSubscription);
+    return repo.find({
+      where: { userId: In(userIds) },
+      order: { userId: 'ASC', createdAt: 'ASC' },
+    });
+  }
+
+  static async delete(id: string, userId: string): Promise<boolean> {
+    const repo = appDataSourceReadWrite.getRepository(UserWebPushSubscription);
+    const result = await repo.delete({ id, userId });
+    const affected = result.affected;
+    return affected !== undefined && affected !== null && affected > 0;
+  }
+}
diff --git a/packages/orm/src/services/billingDomainEventLog.ts b/packages/orm/src/services/billingDomainEventLog.ts
new file mode 100644
index 00000000..3833b4c6
--- /dev/null
+++ b/packages/orm/src/services/billingDomainEventLog.ts
@@ -0,0 +1,46 @@
+import type { BillingDomainEventType } from '@metaboost/helpers';
+import type { EntityManager } from 'typeorm';
+
+import { appDataSourceReadWrite } from '../data-source.js';
+import { BillingDomainEvent } from '../entities/BillingDomainEvent.js';
+
+function isUniqueViolation(error: unknown): boolean {
+  return (
+    error !== null &&
+    typeof error === 'object' &&
+    'code' in error &&
+    (error as { code: string }).code === '23505'
+  );
+}
+
+export class BillingDomainEventLogService {
+  async append(params: {
+    eventType: BillingDomainEventType;
+    userId: string;
+    idempotencyKey?: string | null;
+    payload?: Record<string, unknown>;
+    manager?: EntityManager;
+  }): Promise<void> {
+    const manager = params.manager ?? appDataSourceReadWrite.manager;
+    const repo = manager.getRepository(BillingDomainEvent);
+    try {
+      await repo.save(
+        repo.create({
+          eventType: params.eventType,
+          userId: params.userId,
+          idempotencyKey: params.idempotencyKey ?? null,
+          payload: params.payload ?? {},
+        })
+      );
+    } catch (error) {
+      if (
+        isUniqueViolation(error) &&
+        params.idempotencyKey !== null &&
+        params.idempotencyKey !== undefined
+      ) {
+        return;
+      }
+      throw error;
+    }
+  }
+}
diff --git a/packages/orm/src/services/billingPriceCatalog.ts b/packages/orm/src/services/billingPriceCatalog.ts
new file mode 100644
index 00000000..e3ffe984
--- /dev/null
+++ b/packages/orm/src/services/billingPriceCatalog.ts
@@ -0,0 +1,164 @@
+import type { DataSource } from 'typeorm';
+
+import {
+  BILLING_PRODUCT_CODE_MEMBERSHIP_PREMIUM,
+  resolveProductMembershipDefaultsFromEnv,
+  type ResolvedProductMembership,
+} from '@metaboost/helpers';
+
+import { appDataSourceRead, appDataSourceReadWrite } from '../data-source.js';
+import { ProductMembershipSettingsService } from './productMembershipSettings.js';
+
+type ActivePricingRow = {
+  billing_cadence: 'monthly' | 'annual';
+  amount_cents: number;
+};
+
+const PREMIUM_PRODUCT_CODE = BILLING_PRODUCT_CODE_MEMBERSHIP_PREMIUM;
+const USD_CURRENCY_CODE = 'USD';
+
+export class BillingPriceCatalogService {
+  private dataSourceRead: DataSource;
+  private dataSourceReadWrite: DataSource;
+
+  constructor(params?: { dataSourceRead?: DataSource; dataSourceReadWrite?: DataSource }) {
+    this.dataSourceRead = params?.dataSourceRead ?? appDataSourceRead;
+    this.dataSourceReadWrite = params?.dataSourceReadWrite ?? appDataSourceReadWrite;
+  }
+
+  private async getActivePremiumPricingRows(now: Date): Promise<ActivePricingRow[]> {
+    const rows = await this.dataSourceRead.query(
+      `
+      SELECT DISTINCT ON (p.billing_cadence)
+        p.billing_cadence,
+        p.amount_cents
+      FROM billing_price p
+      INNER JOIN billing_product bp
+        ON bp.id = p.billing_product_id
+      WHERE bp.product_code = $1
+        AND bp.is_active = TRUE
+        AND p.currency_code = $2
+        AND p.effective_from <= $3
+        AND (p.effective_to IS NULL OR p.effective_to > $3)
+      ORDER BY p.billing_cadence, p.effective_from DESC
+      `,
+      [PREMIUM_PRODUCT_CODE, USD_CURRENCY_CODE, now]
+    );
+
+    return rows as ActivePricingRow[];
+  }
+
+  async ensureProductMembershipTrialSeededFromEnv(now = new Date()): Promise<void> {
+    await ProductMembershipSettingsService.ensureSingletonSeededFromEnv(now);
+  }
+
+  async ensurePremiumPricingSeededFromEnv(now = new Date()): Promise<void> {
+    const envDefaults = resolveProductMembershipDefaultsFromEnv();
+    const monthlyAmountCents = Math.round(envDefaults.premiumMembershipCostMonthly * 100);
+    const annualAmountCents = Math.round(envDefaults.premiumMembershipCostAnnually * 100);
+
+    await this.dataSourceReadWrite.transaction(async (transactionalEntityManager) => {
+      await transactionalEntityManager.query(
+        `
+        INSERT INTO billing_product (product_code, name, is_active)
+        SELECT $1, $2, TRUE
+        WHERE NOT EXISTS (
+          SELECT 1
+          FROM billing_product
+          WHERE product_code = $1
+        )
+        `,
+        [PREMIUM_PRODUCT_CODE, 'Premium Membership']
+      );
+
+      const rows = (await transactionalEntityManager.query(
+        `
+        SELECT DISTINCT ON (p.billing_cadence)
+          p.billing_cadence,
+          p.amount_cents
+        FROM billing_price p
+        INNER JOIN billing_product bp
+          ON bp.id = p.billing_product_id
+        WHERE bp.product_code = $1
+          AND bp.is_active = TRUE
+          AND p.currency_code = $2
+          AND p.effective_from <= $3
+          AND (p.effective_to IS NULL OR p.effective_to > $3)
+        ORDER BY p.billing_cadence, p.effective_from DESC
+        `,
+        [PREMIUM_PRODUCT_CODE, USD_CURRENCY_CODE, now]
+      )) as ActivePricingRow[];
+
+      const hasMonthly = rows.some((row) => row.billing_cadence === 'monthly');
+      const hasAnnual = rows.some((row) => row.billing_cadence === 'annual');
+
+      if (!hasMonthly) {
+        await transactionalEntityManager.query(
+          `
+          INSERT INTO billing_price (
+            billing_product_id,
+            currency_code,
+            billing_cadence,
+            amount_cents,
+            effective_from,
+            effective_to,
+            source
+          )
+          SELECT id, $1, $2, $3, $4, NULL, 'env_bootstrap'
+          FROM billing_product
+          WHERE product_code = $5
+          `,
+          [USD_CURRENCY_CODE, 'monthly', monthlyAmountCents, now, PREMIUM_PRODUCT_CODE]
+        );
+      }
+
+      if (!hasAnnual) {
+        await transactionalEntityManager.query(
+          `
+          INSERT INTO billing_price (
+            billing_product_id,
+            currency_code,
+            billing_cadence,
+            amount_cents,
+            effective_from,
+            effective_to,
+            source
+          )
+          SELECT id, $1, $2, $3, $4, NULL, 'env_bootstrap'
+          FROM billing_product
+          WHERE product_code = $5
+          `,
+          [USD_CURRENCY_CODE, 'annual', annualAmountCents, now, PREMIUM_PRODUCT_CODE]
+        );
+      }
+    });
+  }
+
+  async resolveProductMembership(now = new Date()): Promise<ResolvedProductMembership> {
+    const envDefaults = resolveProductMembershipDefaultsFromEnv();
+
+    await this.ensurePremiumPricingSeededFromEnv(now);
+    await this.ensureProductMembershipTrialSeededFromEnv(now);
+
+    const rows = await this.getActivePremiumPricingRows(now);
+    const settingsRow = await ProductMembershipSettingsService.findSingleton();
+    const monthlyRow = rows.find((row) => row.billing_cadence === 'monthly');
+    const annualRow = rows.find((row) => row.billing_cadence === 'annual');
+
+    return {
+      ...envDefaults,
+      freeTrialExpirationSeconds:
+        settingsRow !== null
+          ? settingsRow.freeTrialExpirationSeconds
+          : envDefaults.freeTrialExpirationSeconds,
+      premiumMembershipCostMonthly:
+        monthlyRow !== undefined
+          ? Number((monthlyRow.amount_cents / 100).toFixed(2))
+          : envDefaults.premiumMembershipCostMonthly,
+      premiumMembershipCostAnnually:
+        annualRow !== undefined
+          ? Number((annualRow.amount_cents / 100).toFixed(2))
+          : envDefaults.premiumMembershipCostAnnually,
+    };
+  }
+}
diff --git a/packages/orm/src/services/billingPriceGovernance.ts b/packages/orm/src/services/billingPriceGovernance.ts
new file mode 100644
index 00000000..c86e668a
--- /dev/null
+++ b/packages/orm/src/services/billingPriceGovernance.ts
@@ -0,0 +1,342 @@
+import type { DataSource } from 'typeorm';
+
+import { BILLING_PRODUCT_CODE_MEMBERSHIP_PREMIUM } from '@metaboost/helpers';
+
+import { appDataSourceRead, appDataSourceReadWrite } from '../data-source.js';
+
+const USD = 'USD';
+
+type OpenPriceRow = {
+  id: number;
+  amount_cents: number;
+  effective_from: Date;
+  effective_to: Date | null;
+};
+
+export type ActiveBillingPriceRow = {
+  id: number;
+  billingProductId: number;
+  productCode: string;
+  currencyCode: string;
+  billingCadence: 'monthly' | 'annual';
+  amountCents: number;
+  effectiveFrom: Date;
+  effectiveTo: Date | null;
+  source: string;
+};
+
+export type BillingPriceWindowStatus = 'active' | 'scheduled' | 'historical';
+
+export type BillingPriceWindowRow = ActiveBillingPriceRow & {
+  status: BillingPriceWindowStatus;
+};
+
+export type BillingPriceChangeAuditRow = {
+  id: number;
+  billingPriceId: number | null;
+  changedByManagementUserId: string | null;
+  changeReason: string | null;
+  previousAmountCents: number | null;
+  newAmountCents: number | null;
+  previousEffectiveFrom: Date | null;
+  previousEffectiveTo: Date | null;
+  newEffectiveFrom: Date | null;
+  newEffectiveTo: Date | null;
+  createdAt: Date;
+  currencyCode: string | null;
+  billingCadence: 'monthly' | 'annual' | null;
+  productCode: string | null;
+};
+
+function classifyPriceWindow(
+  effectiveFrom: Date,
+  effectiveTo: Date | null,
+  now: Date
+): BillingPriceWindowStatus {
+  if (effectiveFrom.getTime() > now.getTime()) {
+    return 'scheduled';
+  }
+  if (effectiveTo !== null && effectiveTo.getTime() <= now.getTime()) {
+    return 'historical';
+  }
+  return 'active';
+}
+
+/**
+ * Management-only catalog mutations with `billing_price_change_audit` rows.
+ */
+export class BillingPriceGovernanceService {
+  private readonly read: DataSource;
+  private readonly readWrite: DataSource;
+
+  constructor(params?: { dataSourceRead?: DataSource; dataSourceReadWrite?: DataSource }) {
+    this.read = params?.dataSourceRead ?? appDataSourceRead;
+    this.readWrite = params?.dataSourceReadWrite ?? appDataSourceReadWrite;
+  }
+
+  async listActivePrices(now = new Date()): Promise<ActiveBillingPriceRow[]> {
+    const rows = (await this.read.query(
+      `
+      SELECT
+        p.id,
+        p.billing_product_id AS "billingProductId",
+        bp.product_code AS "productCode",
+        p.currency_code AS "currencyCode",
+        p.billing_cadence AS "billingCadence",
+        p.amount_cents AS "amountCents",
+        p.effective_from AS "effectiveFrom",
+        p.effective_to AS "effectiveTo",
+        p.source
+      FROM billing_price p
+      INNER JOIN billing_product bp ON bp.id = p.billing_product_id
+      WHERE bp.is_active = TRUE
+        AND bp.product_code = $2
+        AND p.effective_from <= $1
+        AND (p.effective_to IS NULL OR p.effective_to > $1)
+      ORDER BY bp.product_code, p.currency_code, p.billing_cadence, p.effective_from DESC
+      `,
+      [now, BILLING_PRODUCT_CODE_MEMBERSHIP_PREMIUM]
+    )) as ActiveBillingPriceRow[];
+    return rows;
+  }
+
+  /**
+   * All premium membership price windows with lifecycle status relative to `now`
+   * (active, scheduled future windows, closed historical rows).
+   */
+  async listPriceWindows(now = new Date()): Promise<BillingPriceWindowRow[]> {
+    const rows = (await this.read.query(
+      `
+      SELECT
+        p.id,
+        p.billing_product_id AS "billingProductId",
+        bp.product_code AS "productCode",
+        p.currency_code AS "currencyCode",
+        p.billing_cadence AS "billingCadence",
+        p.amount_cents AS "amountCents",
+        p.effective_from AS "effectiveFrom",
+        p.effective_to AS "effectiveTo",
+        p.source
+      FROM billing_price p
+      INNER JOIN billing_product bp ON bp.id = p.billing_product_id
+      WHERE bp.product_code = $1
+      ORDER BY p.currency_code, p.billing_cadence, p.effective_from DESC
+      `,
+      [BILLING_PRODUCT_CODE_MEMBERSHIP_PREMIUM]
+    )) as ActiveBillingPriceRow[];
+
+    return rows.map((row) => ({
+      ...row,
+      status: classifyPriceWindow(row.effectiveFrom, row.effectiveTo, now),
+    }));
+  }
+
+  /** Recent price governance audit rows (newest first). */
+  async listPriceChangeAudit(limit: number): Promise<BillingPriceChangeAuditRow[]> {
+    const capped = Number.isFinite(limit) && limit > 0 ? Math.min(Math.floor(limit), 200) : 100;
+    const rows = (await this.read.query(
+      `
+      SELECT
+        a.id,
+        a.billing_price_id AS "billingPriceId",
+        a.changed_by_management_user_id AS "changedByManagementUserId",
+        a.change_reason AS "changeReason",
+        a.previous_amount_cents AS "previousAmountCents",
+        a.new_amount_cents AS "newAmountCents",
+        a.previous_effective_from AS "previousEffectiveFrom",
+        a.previous_effective_to AS "previousEffectiveTo",
+        a.new_effective_from AS "newEffectiveFrom",
+        a.new_effective_to AS "newEffectiveTo",
+        a.created_at AS "createdAt",
+        p.currency_code AS "currencyCode",
+        p.billing_cadence AS "billingCadence",
+        bp.product_code AS "productCode"
+      FROM billing_price_change_audit a
+      LEFT JOIN billing_price p ON p.id = a.billing_price_id
+      LEFT JOIN billing_product bp ON bp.id = p.billing_product_id
+      ORDER BY a.created_at DESC
+      LIMIT $1
+      `,
+      [capped]
+    )) as BillingPriceChangeAuditRow[];
+    return rows;
+  }
+
+  async schedulePriceChange(params: {
+    currencyCode: string;
+    billingCadence: 'monthly' | 'annual';
+    amountCents: number;
+    effectiveFrom: Date;
+    changeReason?: string | null;
+    changedByManagementUserId: string | null;
+    source?: string;
+  }): Promise<{ newPriceId: number }> {
+    const source = params.source ?? 'manual';
+    const productCode = BILLING_PRODUCT_CODE_MEMBERSHIP_PREMIUM;
+
+    return this.readWrite.transaction(async (manager) => {
+      const productRows = (await manager.query(
+        `SELECT id FROM billing_product WHERE product_code = $1`,
+        [productCode]
+      )) as Array<{ id: number }>;
+      const productRow = productRows[0];
+      if (productRow === undefined) {
+        throw new Error('BillingPriceGovernanceService.schedulePriceChange: product missing');
+      }
+      const billingProductId = productRow.id;
+
+      const openRows = (await manager.query(
+        `
+        SELECT id, amount_cents, effective_from, effective_to
+        FROM billing_price
+        WHERE billing_product_id = $1
+          AND currency_code = $2
+          AND billing_cadence = $3
+          AND effective_to IS NULL
+        `,
+        [billingProductId, params.currencyCode, params.billingCadence]
+      )) as OpenPriceRow[];
+
+      const prevOpen = openRows[0];
+      const effectiveFrom = params.effectiveFrom;
+
+      if (prevOpen !== undefined) {
+        await manager.query(
+          `UPDATE billing_price SET effective_to = $1, updated_at = NOW() WHERE id = $2`,
+          [effectiveFrom, prevOpen.id]
+        );
+      }
+
+      const inserted = (await manager.query(
+        `
+        INSERT INTO billing_price (
+          billing_product_id,
+          currency_code,
+          billing_cadence,
+          amount_cents,
+          effective_from,
+          effective_to,
+          source
+        )
+        VALUES ($1, $2, $3, $4, $5, NULL, $6)
+        RETURNING id
+        `,
+        [
+          billingProductId,
+          params.currencyCode,
+          params.billingCadence,
+          params.amountCents,
+          effectiveFrom,
+          source,
+        ]
+      )) as Array<{ id: number }>;
+
+      const newId = inserted[0]?.id;
+      if (newId === undefined) {
+        throw new Error('BillingPriceGovernanceService.schedulePriceChange: insert failed');
+      }
+
+      await manager.query(
+        `
+        INSERT INTO billing_price_change_audit (
+          billing_price_id,
+          changed_by_management_user_id,
+          change_reason,
+          previous_amount_cents,
+          new_amount_cents,
+          previous_effective_from,
+          previous_effective_to,
+          new_effective_from,
+          new_effective_to
+        )
+        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+        `,
+        [
+          newId,
+          params.changedByManagementUserId,
+          params.changeReason ?? null,
+          prevOpen?.amount_cents ?? null,
+          params.amountCents,
+          prevOpen?.effective_from ?? null,
+          prevOpen?.effective_to ?? null,
+          effectiveFrom,
+          null,
+        ]
+      );
+
+      return { newPriceId: newId };
+    });
+  }
+
+  async deprecatePrice(params: {
+    priceId: number;
+    changeReason?: string | null;
+    changedByManagementUserId: string | null;
+    now?: Date;
+  }): Promise<void> {
+    const now = params.now ?? new Date();
+
+    await this.readWrite.transaction(async (manager) => {
+      const rows = (await manager.query(
+        `
+        SELECT
+          p.id,
+          p.amount_cents,
+          p.effective_from,
+          p.effective_to
+        FROM billing_price p
+        WHERE p.id = $1
+        `,
+        [params.priceId]
+      )) as Array<{
+        id: number;
+        amount_cents: number;
+        effective_from: Date;
+        effective_to: Date | null;
+      }>;
+
+      const row = rows[0];
+      if (row === undefined) {
+        throw new Error('BillingPriceGovernanceService.deprecatePrice: price not found');
+      }
+      if (row.effective_to !== null && row.effective_to <= now) {
+        return;
+      }
+
+      await manager.query(
+        `UPDATE billing_price SET effective_to = $1, updated_at = NOW() WHERE id = $2`,
+        [now, params.priceId]
+      );
+
+      await manager.query(
+        `
+        INSERT INTO billing_price_change_audit (
+          billing_price_id,
+          changed_by_management_user_id,
+          change_reason,
+          previous_amount_cents,
+          new_amount_cents,
+          previous_effective_from,
+          previous_effective_to,
+          new_effective_from,
+          new_effective_to
+        )
+        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+        `,
+        [
+          params.priceId,
+          params.changedByManagementUserId,
+          params.changeReason ?? null,
+          row.amount_cents,
+          null,
+          row.effective_from,
+          row.effective_to,
+          row.effective_from,
+          now,
+        ]
+      );
+    });
+  }
+}
+
+export const BILLING_PRICE_GOVERNANCE_DEFAULT_CURRENCY = USD;
diff --git a/packages/orm/src/services/billingRenewalOrchestrator.ts b/packages/orm/src/services/billingRenewalOrchestrator.ts
new file mode 100644
index 00000000..1b36e67a
--- /dev/null
+++ b/packages/orm/src/services/billingRenewalOrchestrator.ts
@@ -0,0 +1,216 @@
+import type { BillingCadence } from '@metaboost/helpers';
+import type { EntityManager } from 'typeorm';
+
+import {
+  BILLING_DOMAIN_EVENT_TYPES,
+  MembershipTier,
+  createStubBillingRenewalProviderAdapter,
+  type BillingRenewalProviderAdapter,
+} from '@metaboost/helpers';
+
+import { appDataSourceReadWrite } from '../data-source.js';
+import { UserTrustSettings } from '../entities/UserTrustSettings.js';
+import { BillingDomainEventLogService } from './billingDomainEventLog.js';
+import { MembershipPeriodExtensionService } from './membershipPeriodExtension.js';
+
+const RENEWAL_BACKOFF_SECONDS = [3600, 14_400, 43_200, 86_400] as const;
+
+function parseCadence(raw: string | null): BillingCadence | null {
+  if (raw === 'monthly' || raw === 'annual') {
+    return raw;
+  }
+  return null;
+}
+
+function renewalIdempotencyKey(userId: string, membershipExpiresAt: Date): string {
+  return `renewal:${userId}:${membershipExpiresAt.toISOString()}`;
+}
+
+export type ProcessDueRenewalsSummary = {
+  scanned: number;
+  attempted: number;
+  succeeded: number;
+  failed: number;
+  skipped: number;
+};
+
+/**
+ * Scans premium accounts nearing expiry and attempts renewal via {@link BillingRenewalProviderAdapter}.
+ */
+export class BillingRenewalOrchestratorService {
+  private readonly adapter: BillingRenewalProviderAdapter;
+
+  constructor(adapter?: BillingRenewalProviderAdapter) {
+    this.adapter = adapter ?? createStubBillingRenewalProviderAdapter();
+  }
+
+  async processDueRenewals(params: {
+    now?: Date;
+    lookaheadHours?: number;
+  }): Promise<ProcessDueRenewalsSummary> {
+    const now = params.now ?? new Date();
+    const lookaheadHours = params.lookaheadHours ?? 24;
+    const lookaheadMs = lookaheadHours * 60 * 60 * 1000;
+    const horizon = new Date(now.getTime() + lookaheadMs);
+
+    const rows = (await appDataSourceReadWrite.query(
+      `
+      SELECT
+        user_id AS "userId",
+        membership_expires_at AS "membershipExpiresAt",
+        billing_cadence AS "billingCadence",
+        last_renewal_idempotency_key AS "lastRenewalIdempotencyKey",
+        last_renewal_status AS "lastRenewalStatus",
+        renewal_retry_count AS "renewalRetryCount"
+      FROM user_trust_settings
+      WHERE membership_tier = $1
+        AND auto_renew_mode = $2
+        AND billing_cadence IS NOT NULL
+        AND membership_expires_at IS NOT NULL
+        AND membership_expires_at > $3
+        AND membership_expires_at <= $4
+        AND (renewal_retry_backoff_until IS NULL OR renewal_retry_backoff_until <= $3)
+        AND (next_renewal_attempt_at IS NULL OR next_renewal_attempt_at <= $3)
+      `,
+      [MembershipTier.Premium, 'on', now, horizon]
+    )) as Array<{
+      userId: string;
+      membershipExpiresAt: Date;
+      billingCadence: string;
+      lastRenewalIdempotencyKey: string | null;
+      lastRenewalStatus: string;
+      renewalRetryCount: number;
+    }>;
+
+    const summary: ProcessDueRenewalsSummary = {
+      scanned: rows.length,
+      attempted: 0,
+      succeeded: 0,
+      failed: 0,
+      skipped: 0,
+    };
+
+    const eventLog = new BillingDomainEventLogService();
+
+    for (const row of rows) {
+      const cadence = parseCadence(row.billingCadence);
+      if (cadence === null) {
+        summary.skipped += 1;
+        continue;
+      }
+
+      const key = renewalIdempotencyKey(row.userId, row.membershipExpiresAt);
+      if (row.lastRenewalIdempotencyKey === key && row.lastRenewalStatus === 'succeeded') {
+        summary.skipped += 1;
+        continue;
+      }
+
+      summary.attempted += 1;
+
+      let attemptResult;
+      try {
+        attemptResult = await this.adapter.attemptRenewal({
+          userId: row.userId,
+          cadence,
+          idempotencyKey: key,
+        });
+      } catch {
+        await appDataSourceReadWrite.transaction(async (manager) => {
+          await this.applyRenewalFailure({
+            manager,
+            userId: row.userId,
+            now,
+            idempotencyKey: key,
+            retryCount: row.renewalRetryCount,
+            retryAfterSeconds: 3600,
+          });
+          await eventLog.append({
+            eventType: BILLING_DOMAIN_EVENT_TYPES.RENEWAL_FAILED,
+            userId: row.userId,
+            idempotencyKey: `${key}:adapter_error`,
+            payload: { stage: 'adapter_throw' },
+            manager,
+          });
+        });
+        summary.failed += 1;
+        continue;
+      }
+
+      if (attemptResult.status === 'succeeded') {
+        await appDataSourceReadWrite.transaction(async (manager) => {
+          await MembershipPeriodExtensionService.extendPremiumByCadence({
+            userId: row.userId,
+            cadence,
+            idempotencyKey: key,
+            reason: 'renewal_success',
+            now,
+            manager,
+          });
+          await manager.getRepository(UserTrustSettings).update(
+            { userId: row.userId },
+            {
+              lastRenewalAttemptAt: now,
+              lastRenewalStatus: 'succeeded',
+              lastRenewalIdempotencyKey: key,
+              renewalRetryCount: 0,
+              nextRenewalAttemptAt: null,
+              renewalRetryBackoffUntil: null,
+            }
+          );
+        });
+        summary.succeeded += 1;
+      } else {
+        const fallbackBackoff =
+          RENEWAL_BACKOFF_SECONDS[
+            Math.min(row.renewalRetryCount, RENEWAL_BACKOFF_SECONDS.length - 1)
+          ] ?? 3600;
+        const retryAfterSeconds = attemptResult.retryAfterSeconds ?? fallbackBackoff;
+        await appDataSourceReadWrite.transaction(async (manager) => {
+          await this.applyRenewalFailure({
+            manager,
+            userId: row.userId,
+            now,
+            idempotencyKey: key,
+            retryCount: row.renewalRetryCount,
+            retryAfterSeconds,
+          });
+          await eventLog.append({
+            eventType: BILLING_DOMAIN_EVENT_TYPES.RENEWAL_FAILED,
+            userId: row.userId,
+            idempotencyKey: `${key}:failed`,
+            payload: {
+              providerAttemptId: attemptResult.providerAttemptId ?? null,
+            },
+            manager,
+          });
+        });
+        summary.failed += 1;
+      }
+    }
+
+    return summary;
+  }
+
+  private async applyRenewalFailure(params: {
+    manager: EntityManager;
+    userId: string;
+    now: Date;
+    idempotencyKey: string;
+    retryCount: number;
+    retryAfterSeconds: number;
+  }): Promise<void> {
+    const nextAttempt = new Date(params.now.getTime() + params.retryAfterSeconds * 1000);
+    const repo = params.manager.getRepository(UserTrustSettings);
+    await repo.update(
+      { userId: params.userId },
+      {
+        lastRenewalAttemptAt: params.now,
+        lastRenewalStatus: 'failed',
+        lastRenewalIdempotencyKey: params.idempotencyKey,
+        renewalRetryCount: params.retryCount + 1,
+        nextRenewalAttemptAt: nextAttempt,
+        renewalRetryBackoffUntil: nextAttempt,
+      }
+    );
+  }
+}
diff --git a/packages/orm/src/services/membershipPeriodExtension.ts b/packages/orm/src/services/membershipPeriodExtension.ts
new file mode 100644
index 00000000..69b9281c
--- /dev/null
+++ b/packages/orm/src/services/membershipPeriodExtension.ts
@@ -0,0 +1,107 @@
+import type { EntityManager } from 'typeorm';
+
+import {
+  BILLING_DOMAIN_EVENT_TYPES,
+  MembershipTier,
+  extendMembershipPeriodByCadence,
+  type BillingCadence,
+  type MembershipPeriodExtensionReason,
+} from '@metaboost/helpers';
+
+import { appDataSourceReadWrite } from '../data-source.js';
+import { UserTrustSettings } from '../entities/UserTrustSettings.js';
+import { BillingDomainEventLogService } from './billingDomainEventLog.js';
+
+function eventTypeForExtensionReason(
+  reason: MembershipPeriodExtensionReason
+): (typeof BILLING_DOMAIN_EVENT_TYPES)[keyof typeof BILLING_DOMAIN_EVENT_TYPES] | null {
+  if (reason === 'renewal_success') {
+    return BILLING_DOMAIN_EVENT_TYPES.RENEWAL_SUCCEEDED;
+  }
+  if (reason === 'payment_settled' || reason === 'pay_on_demand_extension') {
+    return BILLING_DOMAIN_EVENT_TYPES.PAYMENT_SETTLED;
+  }
+  return null;
+}
+
+export class MembershipPeriodExtensionService {
+  /**
+   * Extends premium membership expiry using {@link extendMembershipPeriodByCadence} and records
+   * idempotency on trust settings. Delegates all calendar math to helpers.
+   */
+  static async extendPremiumByCadence(params: {
+    userId: string;
+    cadence: BillingCadence;
+    idempotencyKey: string;
+    reason: MembershipPeriodExtensionReason;
+    now?: Date;
+    manager?: EntityManager;
+  }): Promise<{ applied: boolean; membershipExpiresAt: Date | null }> {
+    const now = params.now ?? new Date();
+    const run = async (
+      manager: EntityManager
+    ): Promise<{
+      applied: boolean;
+      membershipExpiresAt: Date | null;
+    }> => {
+      const repo = manager.getRepository(UserTrustSettings);
+      const trust = await repo.findOne({ where: { userId: params.userId } });
+      if (trust === null) {
+        throw new Error(
+          'MembershipPeriodExtensionService.extendPremiumByCadence: trust settings missing'
+        );
+      }
+      if (trust.membershipTier !== MembershipTier.Premium) {
+        throw new Error(
+          'MembershipPeriodExtensionService.extendPremiumByCadence: user is not premium'
+        );
+      }
+      if (trust.lastExtensionIdempotencyKey === params.idempotencyKey) {
+        return { applied: false, membershipExpiresAt: trust.membershipExpiresAt };
+      }
+      const newExpiry = extendMembershipPeriodByCadence({
+        membershipExpiresAt: trust.membershipExpiresAt,
+        cadence: params.cadence,
+        now,
+      });
+      trust.membershipExpiresAt = newExpiry;
+      trust.billingCadence = params.cadence;
+      trust.lastExtensionIdempotencyKey = params.idempotencyKey;
+      await repo.save(trust);
+
+      const eventType = eventTypeForExtensionReason(params.reason);
+      if (eventType !== null) {
+        const log = new BillingDomainEventLogService();
+        await log.append({
+          eventType,
+          userId: params.userId,
+          idempotencyKey: params.idempotencyKey,
+          payload: { reason: params.reason },
+          manager,
+        });
+      }
+
+      return { applied: true, membershipExpiresAt: newExpiry };
+    };
+
+    if (params.manager !== undefined) {
+      return run(params.manager);
+    }
+    return appDataSourceReadWrite.transaction(run);
+  }
+
+  static async logPayOnDemandExtensionRequested(params: {
+    userId: string;
+    idempotencyKey: string;
+    manager?: EntityManager;
+  }): Promise<void> {
+    const log = new BillingDomainEventLogService();
+    await log.append({
+      eventType: BILLING_DOMAIN_EVENT_TYPES.PAY_ON_DEMAND_EXTENSION_REQUESTED,
+      userId: params.userId,
+      idempotencyKey: params.idempotencyKey,
+      payload: {},
+      manager: params.manager,
+    });
+  }
+}
diff --git a/packages/orm/src/services/productMembershipSettings.ts b/packages/orm/src/services/productMembershipSettings.ts
new file mode 100644
index 00000000..f75170a0
--- /dev/null
+++ b/packages/orm/src/services/productMembershipSettings.ts
@@ -0,0 +1,36 @@
+import { resolveProductMembershipDefaultsFromEnv } from '@metaboost/helpers';
+
+import { appDataSourceRead, appDataSourceReadWrite } from '../data-source.js';
+import { ProductMembershipSettings } from '../entities/ProductMembershipSettings.js';
+
+/**
+ * Canonical one-row settings (`id = 1`) for premium membership product defaults.
+ * Env is used only to bootstrap an empty row; existing DB values are never overwritten.
+ */
+export class ProductMembershipSettingsService {
+  static async findSingleton(): Promise<ProductMembershipSettings | null> {
+    return appDataSourceRead.getRepository(ProductMembershipSettings).findOne({
+      where: { id: 1 },
+    });
+  }
+
+  /**
+   * Insert row 1 from env when missing (`ON CONFLICT DO NOTHING`). Does not update existing rows.
+   */
+  static async ensureSingletonSeededFromEnv(now = new Date()): Promise<void> {
+    const envDefaults = resolveProductMembershipDefaultsFromEnv();
+    await appDataSourceReadWrite.query(
+      `
+      INSERT INTO product_membership_settings (
+        id,
+        free_trial_expiration_seconds,
+        created_at,
+        updated_at
+      )
+      VALUES (1, $1, $2, $2)
+      ON CONFLICT (id) DO NOTHING
+      `,
+      [envDefaults.freeTrialExpirationSeconds, now]
+    );
+  }
+}
diff --git a/packages/orm/tsconfig.json b/packages/orm/tsconfig.json
index 7ef26552..b78b99fe 100644
--- a/packages/orm/tsconfig.json
+++ b/packages/orm/tsconfig.json
@@ -8,5 +8,5 @@
     "emitDecoratorMetadata": true
   },
   "include": ["./src/**/*.ts"],
-  "exclude": ["node_modules", "dist"]
+  "exclude": ["node_modules", "dist", "**/*.test.ts"]
 }
diff --git a/packages/orm/vitest.config.ts b/packages/orm/vitest.config.ts
new file mode 100644
index 00000000..4e4b11f4
--- /dev/null
+++ b/packages/orm/vitest.config.ts
@@ -0,0 +1,10 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    globals: false,
+    include: ['src/**/*.test.ts'],
+    pool: 'forks',
+  },
+});
diff --git a/packages/ui/.storybook/preview.tsx b/packages/ui/.storybook/preview.tsx
index a1070ebd..af129732 100644
--- a/packages/ui/.storybook/preview.tsx
+++ b/packages/ui/.storybook/preview.tsx
@@ -2,7 +2,7 @@ import type { Preview } from '@storybook/react-vite';
 
 import React from 'react';
 
-import { ThemeProvider } from '../src/contexts/ThemeContext';
+import { ThemeProvider } from '../src/contexts/ThemeContext/index';
 import { THEMES, type Theme } from '../src/lib/settingsCookie';
 
 import '@fortawesome/fontawesome-free/css/all.min.css';
diff --git a/packages/ui/package.json b/packages/ui/package.json
index 4f7af7ee..f9a6e68d 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -20,6 +20,7 @@
     "lint": "eslint ./src --max-warnings 0",
     "lint:fix": "eslint ./src --fix",
     "type-check": "tsc --noEmit",
+    "test": "vitest run",
     "storybook": "storybook dev -p 6006 --no-open",
     "build-storybook": "storybook build"
   },
@@ -37,13 +38,17 @@
     "@storybook/addon-docs": "^10.2.14",
     "@storybook/react": "^10.2.14",
     "@storybook/react-vite": "^10.2.14",
+    "@testing-library/react": "^16.3.0",
     "@types/react": "^19.2.11",
+    "@vitejs/plugin-react": "^5.1.1",
     "eslint-plugin-storybook": "10.2.19",
+    "jsdom": "^26.1.0",
     "next": "^16.2.4",
     "next-intl": "^4.11.0",
     "react-dom": "^19.2.5",
     "sass": "^1.98.0",
     "storybook": "^10.2.14",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.2",
+    "vitest": "^4.1.9"
   }
 }
diff --git a/packages/ui/src/components/bucket/BucketDetailContent/BucketDetailContent.tsx b/packages/ui/src/components/bucket/BucketDetailContent/BucketDetailContent.tsx
index e4ba7be8..0fa68641 100644
--- a/packages/ui/src/components/bucket/BucketDetailContent/BucketDetailContent.tsx
+++ b/packages/ui/src/components/bucket/BucketDetailContent/BucketDetailContent.tsx
@@ -1,7 +1,7 @@
 'use client';
 
 import type { DataDetailItem } from '../../layout/DataDetail/DataDetail';
-import type { TableWithSortColumn } from '../../table/TableWithSort';
+import type { TableWithSortColumn } from '../../table/TableWithSort/index';
 import type { ReactNode } from 'react';
 
 import { useCallback, useMemo } from 'react';
@@ -18,7 +18,7 @@ import { Stack } from '../../layout/Stack/Stack';
 import { Link } from '../../navigation/Link/Link';
 import { BUCKET_DETAIL_BUCKETS_LIST_KEY } from '../../table/sortPrefsCookie';
 import { Table } from '../../table/Table/Table';
-import { TableWithSort } from '../../table/TableWithSort';
+import { TableWithSort } from '../../table/TableWithSort/index';
 
 import styles from './BucketDetailContent.module.scss';
 
diff --git a/packages/ui/src/components/bucket/BucketMessagesBreadcrumbs/BucketMessagesBreadcrumbs.tsx b/packages/ui/src/components/bucket/BucketMessagesBreadcrumbs/BucketMessagesBreadcrumbs.tsx
index 5080188c..821f3cd7 100644
--- a/packages/ui/src/components/bucket/BucketMessagesBreadcrumbs/BucketMessagesBreadcrumbs.tsx
+++ b/packages/ui/src/components/bucket/BucketMessagesBreadcrumbs/BucketMessagesBreadcrumbs.tsx
@@ -5,6 +5,8 @@ import type { BreadcrumbItem } from '@metaboost/ui';
 import { Breadcrumbs, Link } from '@metaboost/ui';
 
 export type BucketMessagesBreadcrumbsProps = {
+  /** Optional segments before ancestry (e.g. Dashboard). */
+  leadingItems?: BreadcrumbItem[];
   /** Optional parent buckets in hierarchy order (root first). When set, shown before the current bucket. */
   ancestorItems?: BreadcrumbItem[];
   bucketName: string;
@@ -31,6 +33,7 @@ function LinkAdapter({
 }
 
 export function BucketMessagesBreadcrumbs({
+  leadingItems = [],
   ancestorItems = [],
   bucketName,
   bucketDetailHref,
@@ -38,6 +41,7 @@ export function BucketMessagesBreadcrumbs({
   messagesAriaLabel,
 }: BucketMessagesBreadcrumbsProps) {
   const items: BreadcrumbItem[] = [
+    ...leadingItems,
     ...ancestorItems,
     { label: bucketName, href: bucketDetailHref },
     { label: currentPageLabel, href: undefined },
diff --git a/packages/ui/src/components/bucket/BucketMessagesPageContent/BucketMessagesPageContent.tsx b/packages/ui/src/components/bucket/BucketMessagesPageContent/BucketMessagesPageContent.tsx
index 24f1e10b..142f6e0c 100644
--- a/packages/ui/src/components/bucket/BucketMessagesPageContent/BucketMessagesPageContent.tsx
+++ b/packages/ui/src/components/bucket/BucketMessagesPageContent/BucketMessagesPageContent.tsx
@@ -1,17 +1,19 @@
 'use client';
 
-import type { BreadcrumbItem } from '../../navigation/Breadcrumbs';
-import type { BucketMessageListItem } from '../BucketMessageList';
+import type { BreadcrumbItem } from '../../navigation/Breadcrumbs/index';
+import type { BucketMessageListItem } from '../BucketMessageList/index';
 
-import { ContentPageLayout } from '../../layout/ContentPageLayout';
-import { BucketMessageList } from '../BucketMessageList';
-import { BucketMessagesBreadcrumbs } from '../BucketMessagesBreadcrumbs';
+import { ContentPageLayout } from '../../layout/ContentPageLayout/index';
+import { BucketMessageList } from '../BucketMessageList/index';
+import { BucketMessagesBreadcrumbs } from '../BucketMessagesBreadcrumbs/index';
 
 /**
  * Shared bucket messages page content for web and management-web.
  * Renders breadcrumbs + title + message list only. No "Add message" — that is only on the public bucket page.
  */
 export type BucketMessagesPageContentProps = {
+  /** Optional segments before ancestry in breadcrumbs (e.g. Dashboard). */
+  leadingBreadcrumbItems?: BreadcrumbItem[];
   /** Optional parent buckets in hierarchy order (root first) for breadcrumbs. */
   ancestorItems?: BreadcrumbItem[];
   bucketName: string;
@@ -25,6 +27,7 @@ export type BucketMessagesPageContentProps = {
 };
 
 export function BucketMessagesPageContent({
+  leadingBreadcrumbItems = [],
   ancestorItems = [],
   bucketName,
   bucketDetailHref,
@@ -39,6 +42,7 @@ export function BucketMessagesPageContent({
     <ContentPageLayout
       breadcrumbs={
         <BucketMessagesBreadcrumbs
+          leadingItems={leadingBreadcrumbItems}
           ancestorItems={ancestorItems}
           bucketName={bucketName}
           bucketDetailHref={bucketDetailHref}
diff --git a/packages/ui/src/components/bucket/BucketSettingsBreadcrumbs/BucketSettingsBreadcrumbs.tsx b/packages/ui/src/components/bucket/BucketSettingsBreadcrumbs/BucketSettingsBreadcrumbs.tsx
index 01a6932f..68e6bd03 100644
--- a/packages/ui/src/components/bucket/BucketSettingsBreadcrumbs/BucketSettingsBreadcrumbs.tsx
+++ b/packages/ui/src/components/bucket/BucketSettingsBreadcrumbs/BucketSettingsBreadcrumbs.tsx
@@ -5,6 +5,8 @@ import type { BreadcrumbItem } from '@metaboost/ui';
 import { Breadcrumbs, Link } from '@metaboost/ui';
 
 export type BucketSettingsBreadcrumbsProps = {
+  /** Optional segments before ancestry (e.g. Dashboard). */
+  leadingItems?: BreadcrumbItem[];
   /** Optional parent buckets in hierarchy order (root first). When set, shown before the current bucket. */
   ancestorItems?: BreadcrumbItem[];
   bucketName: string;
@@ -45,6 +47,7 @@ function LinkAdapter({
  * When isEditAdminPage and adminsHref/adminsLabel provided: bucket → Settings → Admins.
  */
 export function BucketSettingsBreadcrumbs({
+  leadingItems = [],
   ancestorItems = [],
   bucketName,
   bucketDetailHref,
@@ -60,6 +63,7 @@ export function BucketSettingsBreadcrumbs({
   rolesLabel,
 }: BucketSettingsBreadcrumbsProps) {
   const items: BreadcrumbItem[] = [
+    ...leadingItems,
     ...ancestorItems,
     { label: bucketName, href: bucketDetailHref },
     { label: settingsLabel, href: settingsHref },
diff --git a/packages/ui/src/components/bucket/MessageCard/MessageCard.tsx b/packages/ui/src/components/bucket/MessageCard/MessageCard.tsx
index a312e989..6f36052d 100644
--- a/packages/ui/src/components/bucket/MessageCard/MessageCard.tsx
+++ b/packages/ui/src/components/bucket/MessageCard/MessageCard.tsx
@@ -3,7 +3,7 @@
 import { useTranslations } from 'next-intl';
 
 import { Card } from '../../layout/Card/Card';
-import { CaretMenuDropdown, type DropdownItem } from '../../navigation/Dropdown';
+import { CaretMenuDropdown, type DropdownItem } from '../../navigation/Dropdown/index';
 import { Link } from '../../navigation/Link/Link';
 
 import styles from './MessageCard.module.scss';
diff --git a/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.module.scss b/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.module.scss
new file mode 100644
index 00000000..7af75ba8
--- /dev/null
+++ b/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.module.scss
@@ -0,0 +1,29 @@
+@use '../../../styles/variables' as *;
+
+.root {
+  width: 100%;
+}
+
+.devDetails {
+  margin-top: $space-4;
+  text-align: left;
+}
+
+.devSummary {
+  cursor: pointer;
+}
+
+.devPre {
+  margin: 0;
+  overflow-x: auto;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+
+.actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: $gap-button-row;
+  justify-content: center;
+  margin-top: $space-6;
+}
diff --git a/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.stories.tsx b/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.stories.tsx
new file mode 100644
index 00000000..17337330
--- /dev/null
+++ b/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.stories.tsx
@@ -0,0 +1,59 @@
+import type { Meta, StoryObj } from '@storybook/react-vite';
+
+import { AppErrorBoundary } from './AppErrorBoundary';
+
+const strings = {
+  boundaryTitle: 'Something went wrong',
+  boundaryMessage: 'An unexpected error occurred.',
+  detailsDevelopmentOnly: 'Error details (development only)',
+  tryAgain: 'Try again',
+  reloadPage: 'Reload page',
+  returnToHomePage: 'Return to home',
+};
+
+const meta: Meta<typeof AppErrorBoundary> = {
+  component: AppErrorBoundary,
+  tags: ['autodocs'],
+  args: {
+    error: Object.assign(new Error('Example boundary error'), {
+      stack: 'Error: Example boundary error\n    at Story.render',
+      digest: 'story-digest',
+    }),
+    reset: () => {},
+    onReload: () => {},
+    onGoHome: () => {},
+    strings,
+  },
+};
+
+export default meta;
+
+type Story = StoryObj<typeof AppErrorBoundary>;
+
+export const Default: Story = {};
+
+/** When `NODE_ENV` is `development`, the collapsible error dump is visible (Storybook dev server). */
+export const DevelopmentDetailsVisible: Story = {
+  parameters: {
+    docs: {
+      description: {
+        story:
+          'With NODE_ENV=development (default in Storybook), the `<details>` block is rendered.',
+      },
+    },
+  },
+};
+
+/** Strings prop supplies every label — matches runtime fallback when next-intl is unavailable. */
+export const StringsFallbackOnly: Story = {
+  args: {
+    strings: {
+      boundaryTitle: 'Fallback title',
+      boundaryMessage: 'Fallback message body.',
+      detailsDevelopmentOnly: 'Dev-only summary',
+      tryAgain: 'Retry',
+      reloadPage: 'Reload',
+      returnToHomePage: 'Home',
+    },
+  },
+};
diff --git a/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.test.tsx b/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.test.tsx
new file mode 100644
index 00000000..bccca14d
--- /dev/null
+++ b/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.test.tsx
@@ -0,0 +1,75 @@
+import { fireEvent, render, screen } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+
+import { AppErrorBoundary } from './AppErrorBoundary';
+
+const strings = {
+  boundaryTitle: 'Title',
+  boundaryMessage: 'Message',
+  detailsDevelopmentOnly: 'Dev details',
+  tryAgain: 'Try again',
+  reloadPage: 'Reload page',
+  returnToHomePage: 'Home',
+};
+
+describe('AppErrorBoundary', () => {
+  it('invokes reset, onReload, and onGoHome when the action buttons are clicked', () => {
+    const reset = vi.fn();
+    const onReload = vi.fn();
+    const onGoHome = vi.fn();
+
+    render(
+      <AppErrorBoundary
+        error={new Error('unit')}
+        reset={reset}
+        onReload={onReload}
+        onGoHome={onGoHome}
+        strings={strings}
+      />
+    );
+
+    fireEvent.click(screen.getByRole('button', { name: strings.tryAgain }));
+    fireEvent.click(screen.getByRole('button', { name: strings.reloadPage }));
+    fireEvent.click(screen.getByRole('button', { name: strings.returnToHomePage }));
+
+    expect(reset).toHaveBeenCalledTimes(1);
+    expect(onReload).toHaveBeenCalledTimes(1);
+    expect(onGoHome).toHaveBeenCalledTimes(1);
+  });
+
+  it('omits the development details block when NODE_ENV is production', () => {
+    vi.stubEnv('NODE_ENV', 'production');
+
+    render(
+      <AppErrorBoundary
+        error={new Error('prod')}
+        reset={() => {}}
+        onReload={() => {}}
+        onGoHome={() => {}}
+        strings={strings}
+      />
+    );
+
+    expect(screen.queryByText(strings.detailsDevelopmentOnly)).toBeNull();
+
+    vi.unstubAllEnvs();
+  });
+
+  it('shows the development details summary when NODE_ENV is development', () => {
+    vi.stubEnv('NODE_ENV', 'development');
+
+    render(
+      <AppErrorBoundary
+        error={new Error('dev')}
+        reset={() => {}}
+        onReload={() => {}}
+        onGoHome={() => {}}
+        strings={strings}
+      />
+    );
+
+    expect(screen.getByText(strings.detailsDevelopmentOnly)).toBeTruthy();
+
+    vi.unstubAllEnvs();
+  });
+});
diff --git a/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.tsx b/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.tsx
new file mode 100644
index 00000000..cea178a5
--- /dev/null
+++ b/packages/ui/src/components/feedback/AppErrorBoundary/AppErrorBoundary.tsx
@@ -0,0 +1,65 @@
+'use client';
+
+import { Button } from '../../form/Button/Button';
+import { CenterInViewport } from '../../layout/CenterInViewport/CenterInViewport';
+import { Text } from '../../layout/Text/Text';
+
+import styles from './AppErrorBoundary.module.scss';
+
+export type AppErrorBoundaryStrings = {
+  boundaryTitle: string;
+  boundaryMessage: string;
+  detailsDevelopmentOnly: string;
+  tryAgain: string;
+  reloadPage: string;
+  returnToHomePage: string;
+};
+
+export type AppErrorBoundaryProps = {
+  error: Error & { digest?: string };
+  reset: () => void;
+  onReload: () => void;
+  onGoHome: () => void;
+  strings: AppErrorBoundaryStrings;
+};
+
+export function AppErrorBoundary({
+  error,
+  reset,
+  onReload,
+  onGoHome,
+  strings,
+}: AppErrorBoundaryProps) {
+  return (
+    <CenterInViewport
+      title={strings.boundaryTitle}
+      contentMaxWidth="readable"
+      contentTextAlign="center"
+    >
+      <div className={styles.root} data-testid="error-page">
+        <Text>{strings.boundaryMessage}</Text>
+        {process.env.NODE_ENV === 'development' && (
+          <details className={styles.devDetails}>
+            <summary className={styles.devSummary}>{strings.detailsDevelopmentOnly}</summary>
+            <pre className={styles.devPre}>
+              {error.toString()}
+              {error.stack !== undefined && error.stack !== '' ? `\n\n${error.stack}` : ''}
+              {error.digest !== undefined ? `\n\nDigest: ${error.digest}` : ''}
+            </pre>
+          </details>
+        )}
+        <div className={styles.actions}>
+          <Button onClick={reset} variant="primary">
+            {strings.tryAgain}
+          </Button>
+          <Button onClick={onReload} variant="secondary">
+            {strings.reloadPage}
+          </Button>
+          <Button onClick={onGoHome} variant="link">
+            {strings.returnToHomePage}
+          </Button>
+        </div>
+      </div>
+    </CenterInViewport>
+  );
+}
diff --git a/packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.module.scss b/packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.module.scss
new file mode 100644
index 00000000..7af75ba8
--- /dev/null
+++ b/packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.module.scss
@@ -0,0 +1,29 @@
+@use '../../../styles/variables' as *;
+
+.root {
+  width: 100%;
+}
+
+.devDetails {
+  margin-top: $space-4;
+  text-align: left;
+}
+
+.devSummary {
+  cursor: pointer;
+}
+
+.devPre {
+  margin: 0;
+  overflow-x: auto;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+
+.actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: $gap-button-row;
+  justify-content: center;
+  margin-top: $space-6;
+}
diff --git a/packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.stories.tsx b/packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.stories.tsx
new file mode 100644
index 00000000..d2ee26ed
--- /dev/null
+++ b/packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.stories.tsx
@@ -0,0 +1,52 @@
+import type { Meta, StoryObj } from '@storybook/react-vite';
+
+import { GlobalErrorBoundary } from './GlobalErrorBoundary';
+
+const defaultStrings: Record<string, string> = {
+  global_title: 'Application error',
+  global_message: 'A critical error occurred. Please refresh the page.',
+  details_development_only: 'Error details (development only)',
+  try_again: 'Try again',
+  reload_page: 'Reload page',
+};
+
+const meta: Meta<typeof GlobalErrorBoundary> = {
+  component: GlobalErrorBoundary,
+  tags: ['autodocs'],
+  parameters: {
+    layout: 'fullscreen',
+  },
+  args: {
+    settingsCookieName: 'web-settings',
+    defaultStrings,
+    loadStrings: async () => ({}),
+    error: Object.assign(new Error('Global story error'), {
+      stack: 'Error: Global story error\n    at Story.render',
+    }),
+    reset: () => {},
+  },
+};
+
+export default meta;
+
+type Story = StoryObj<typeof GlobalErrorBoundary>;
+
+/** Full `<html><body>` shell with theme wrapper — invalid DOM nesting warnings in the Storybook canvas are expected. */
+export const Default: Story = {};
+
+export const LoadedStringsOverride: Story = {
+  args: {
+    loadStrings: async () => ({
+      global_title: 'Loaded title override',
+      global_message: 'Loaded message override.',
+    }),
+  },
+};
+
+export const AllFallbackStrings: Story = {
+  args: {
+    loadStrings: async () => {
+      throw new Error('simulated load failure');
+    },
+  },
+};
diff --git a/packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.tsx b/packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.tsx
new file mode 100644
index 00000000..54da1274
--- /dev/null
+++ b/packages/ui/src/components/feedback/GlobalErrorBoundary/GlobalErrorBoundary.tsx
@@ -0,0 +1,87 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+
+import { ThemeWrapper } from '../../../contexts/ThemeContext/index';
+import { Button } from '../../form/Button/Button';
+import { CenterInViewport } from '../../layout/CenterInViewport/CenterInViewport';
+import { Text } from '../../layout/Text/Text';
+
+import styles from './GlobalErrorBoundary.module.scss';
+
+export type GlobalErrorBoundaryProps = {
+  settingsCookieName: string;
+  /** Merged over `defaultStrings` after async load (typically `errors` from locale JSON). */
+  loadStrings: () => Promise<Record<string, string>>;
+  defaultStrings: Record<string, string>;
+  error: Error & { digest?: string };
+  reset: () => void;
+  onReload?: () => void;
+};
+
+export function GlobalErrorBoundary({
+  settingsCookieName,
+  loadStrings,
+  defaultStrings,
+  error,
+  reset,
+  onReload,
+}: GlobalErrorBoundaryProps) {
+  const [tr, setTr] = useState<Record<string, string>>(defaultStrings);
+
+  useEffect(() => {
+    loadStrings()
+      .then((next) => setTr({ ...defaultStrings, ...next }))
+      .catch(() => {
+        setTr(defaultStrings);
+      });
+  }, [defaultStrings, loadStrings]);
+
+  const t = (key: string): string => {
+    return tr[key] ?? key;
+  };
+
+  const handleReload = () => {
+    if (onReload !== undefined) {
+      onReload();
+      return;
+    }
+    window.location.reload();
+  };
+
+  return (
+    <html lang="en">
+      <body>
+        <ThemeWrapper settingsCookieName={settingsCookieName}>
+          <CenterInViewport
+            title={t('global_title')}
+            contentMaxWidth="readable"
+            contentTextAlign="center"
+          >
+            <div className={styles.root} data-testid="global-error-page">
+              <Text>{t('global_message')}</Text>
+              {process.env.NODE_ENV === 'development' && (
+                <details className={styles.devDetails}>
+                  <summary className={styles.devSummary}>{t('details_development_only')}</summary>
+                  <pre className={styles.devPre}>
+                    {error.toString()}
+                    {error.stack !== undefined && error.stack !== '' ? `\n\n${error.stack}` : ''}
+                    {error.digest !== undefined ? `\n\nDigest: ${error.digest}` : ''}
+                  </pre>
+                </details>
+              )}
+              <div className={styles.actions}>
+                <Button onClick={reset} variant="primary">
+                  {t('try_again')}
+                </Button>
+                <Button onClick={handleReload} variant="secondary">
+                  {t('reload_page')}
+                </Button>
+              </div>
+            </div>
+          </CenterInViewport>
+        </ThemeWrapper>
+      </body>
+    </html>
+  );
+}
diff --git a/packages/ui/src/components/form/AuthForms/ForgotPasswordForm/ForgotPasswordForm.tsx b/packages/ui/src/components/form/AuthForms/ForgotPasswordForm/ForgotPasswordForm.tsx
index b1e83313..75d59202 100644
--- a/packages/ui/src/components/form/AuthForms/ForgotPasswordForm/ForgotPasswordForm.tsx
+++ b/packages/ui/src/components/form/AuthForms/ForgotPasswordForm/ForgotPasswordForm.tsx
@@ -1,14 +1,14 @@
 'use client';
 
-import type { FormLinkComponent } from '../../Form';
+import type { FormLinkComponent } from '../../Form/index';
 
 import { useTranslations } from 'next-intl';
 
-import { SectionWithHeading } from '../../../layout/SectionWithHeading';
-import { Text } from '../../../layout/Text';
-import { Button } from '../../Button';
-import { Form, FormLinks } from '../../Form';
-import { Input } from '../../Input';
+import { SectionWithHeading } from '../../../layout/SectionWithHeading/index';
+import { Text } from '../../../layout/Text/index';
+import { Button } from '../../Button/index';
+import { Form, FormLinks } from '../../Form/index';
+import { Input } from '../../Input/index';
 
 export type ForgotPasswordFormProps = {
   email: string;
diff --git a/packages/ui/src/components/form/AuthForms/LoginForm/LoginForm.tsx b/packages/ui/src/components/form/AuthForms/LoginForm/LoginForm.tsx
index 259f4b80..ef2c9c49 100644
--- a/packages/ui/src/components/form/AuthForms/LoginForm/LoginForm.tsx
+++ b/packages/ui/src/components/form/AuthForms/LoginForm/LoginForm.tsx
@@ -1,12 +1,12 @@
 'use client';
 
-import type { FormLinkComponent } from '../../Form';
+import type { FormLinkComponent } from '../../Form/index';
 
 import { useTranslations } from 'next-intl';
 
-import { Button } from '../../Button';
-import { Form, FormLinks } from '../../Form';
-import { Input } from '../../Input';
+import { Button } from '../../Button/index';
+import { Form, FormLinks } from '../../Form/index';
+import { Input } from '../../Input/index';
 
 /** Web: one field for email or username. Management-web: username only. */
 export type LoginIdentifierType = 'emailOrUsername' | 'usernameOnly';
diff --git a/packages/ui/src/components/form/AuthForms/ResetPasswordForm/ResetPasswordForm.tsx b/packages/ui/src/components/form/AuthForms/ResetPasswordForm/ResetPasswordForm.tsx
index 00d2e4f5..0bb5d3e2 100644
--- a/packages/ui/src/components/form/AuthForms/ResetPasswordForm/ResetPasswordForm.tsx
+++ b/packages/ui/src/components/form/AuthForms/ResetPasswordForm/ResetPasswordForm.tsx
@@ -1,15 +1,15 @@
 'use client';
 
-import type { FormLinkComponent } from '../../Form';
+import type { FormLinkComponent } from '../../Form/index';
 
 import { useTranslations } from 'next-intl';
 
 import { isPasswordValid } from '@metaboost/helpers';
 
-import { Button } from '../../Button';
-import { Form, FormLinks } from '../../Form';
-import { Input } from '../../Input';
-import { PasswordStrengthMeter } from '../../PasswordStrengthMeter';
+import { Button } from '../../Button/index';
+import { Form, FormLinks } from '../../Form/index';
+import { Input } from '../../Input/index';
+import { PasswordStrengthMeter } from '../../PasswordStrengthMeter/index';
 
 export type ResetPasswordFormProps = {
   token: string;
diff --git a/packages/ui/src/components/form/AuthForms/SignupForm/SignupForm.tsx b/packages/ui/src/components/form/AuthForms/SignupForm/SignupForm.tsx
index 17e2799c..d84c6bce 100644
--- a/packages/ui/src/components/form/AuthForms/SignupForm/SignupForm.tsx
+++ b/packages/ui/src/components/form/AuthForms/SignupForm/SignupForm.tsx
@@ -1,15 +1,15 @@
 'use client';
 
-import type { FormLinkComponent } from '../../Form';
+import type { FormLinkComponent } from '../../Form/index';
 
 import { useTranslations } from 'next-intl';
 
 import { isPasswordValid } from '@metaboost/helpers';
 
-import { Button } from '../../Button';
-import { Form, FormLinks } from '../../Form';
-import { Input } from '../../Input';
-import { PasswordStrengthMeter } from '../../PasswordStrengthMeter';
+import { Button } from '../../Button/index';
+import { Form, FormLinks } from '../../Form/index';
+import { Input } from '../../Input/index';
+import { PasswordStrengthMeter } from '../../PasswordStrengthMeter/index';
 
 export type SignupFormProps = {
   email: string;
diff --git a/packages/ui/src/components/form/AuthForms/index.ts b/packages/ui/src/components/form/AuthForms/index.ts
index c84f1e85..159ace5e 100644
--- a/packages/ui/src/components/form/AuthForms/index.ts
+++ b/packages/ui/src/components/form/AuthForms/index.ts
@@ -1,8 +1,8 @@
-export { ForgotPasswordForm } from './ForgotPasswordForm';
-export type { ForgotPasswordFormProps } from './ForgotPasswordForm';
-export { LoginForm } from './LoginForm';
-export type { LoginFormProps, LoginIdentifierType } from './LoginForm';
-export { ResetPasswordForm } from './ResetPasswordForm';
-export type { ResetPasswordFormProps } from './ResetPasswordForm';
-export { SignupForm } from './SignupForm';
-export type { SignupFormProps } from './SignupForm';
+export { ForgotPasswordForm } from './ForgotPasswordForm/index';
+export type { ForgotPasswordFormProps } from './ForgotPasswordForm/index';
+export { LoginForm } from './LoginForm/index';
+export type { LoginFormProps, LoginIdentifierType } from './LoginForm/index';
+export { ResetPasswordForm } from './ResetPasswordForm/index';
+export type { ResetPasswordFormProps } from './ResetPasswordForm/index';
+export { SignupForm } from './SignupForm/index';
+export type { SignupFormProps } from './SignupForm/index';
diff --git a/packages/ui/src/components/form/ButtonLink/ButtonLink.tsx b/packages/ui/src/components/form/ButtonLink/ButtonLink.tsx
index fc2ce5ce..02e3fa43 100644
--- a/packages/ui/src/components/form/ButtonLink/ButtonLink.tsx
+++ b/packages/ui/src/components/form/ButtonLink/ButtonLink.tsx
@@ -1,6 +1,6 @@
 'use client';
 
-import type { LinkProps } from '../../navigation/Link';
+import type { LinkProps } from '../../navigation/Link/index';
 import type { ButtonVariant } from '../Button/Button';
 
 import NextLink from 'next/link';
diff --git a/packages/ui/src/components/form/CopyButton/CopyButton.tsx b/packages/ui/src/components/form/CopyButton/CopyButton.tsx
index bbdcb5e8..0f58ff1a 100644
--- a/packages/ui/src/components/form/CopyButton/CopyButton.tsx
+++ b/packages/ui/src/components/form/CopyButton/CopyButton.tsx
@@ -2,7 +2,7 @@
 
 import { useLayoutEffect, useRef, useState } from 'react';
 
-import { Button, type ButtonVariant } from '../Button';
+import { Button, type ButtonVariant } from '../Button/index';
 
 import styles from './CopyButton.module.scss';
 
diff --git a/packages/ui/src/components/form/CrudButtons/CrudButtons.tsx b/packages/ui/src/components/form/CrudButtons/CrudButtons.tsx
index c801e547..994ab5e5 100644
--- a/packages/ui/src/components/form/CrudButtons/CrudButtons.tsx
+++ b/packages/ui/src/components/form/CrudButtons/CrudButtons.tsx
@@ -1,7 +1,7 @@
 'use client';
 
-import { Button } from '../Button';
-import { ButtonLink } from '../ButtonLink';
+import { Button } from '../Button/index';
+import { ButtonLink } from '../ButtonLink/index';
 
 import styles from './CrudButtons.module.scss';
 
diff --git a/packages/ui/src/components/form/Form/Form/Form.tsx b/packages/ui/src/components/form/Form/Form/Form.tsx
index d5a32439..b0b74229 100644
--- a/packages/ui/src/components/form/Form/Form/Form.tsx
+++ b/packages/ui/src/components/form/Form/Form/Form.tsx
@@ -1,6 +1,6 @@
-import { SectionWithHeading } from '../../../layout/SectionWithHeading';
-import { Stack } from '../../../layout/Stack';
-import { SubmitError } from '../SubmitError';
+import { SectionWithHeading } from '../../../layout/SectionWithHeading/index';
+import { Stack } from '../../../layout/Stack/index';
+import { SubmitError } from '../SubmitError/index';
 
 import styles from './Form.module.scss';
 
diff --git a/packages/ui/src/components/form/Form/FormLinks/FormLinks.stories.tsx b/packages/ui/src/components/form/Form/FormLinks/FormLinks.stories.tsx
index a4d7c172..fbc22a3d 100644
--- a/packages/ui/src/components/form/Form/FormLinks/FormLinks.stories.tsx
+++ b/packages/ui/src/components/form/Form/FormLinks/FormLinks.stories.tsx
@@ -1,6 +1,6 @@
 import type { Meta, StoryObj } from '@storybook/react-vite';
 
-import { Link } from '../../../navigation/Link';
+import { Link } from '../../../navigation/Link/index';
 import { FormLinks } from './FormLinks';
 
 const meta: Meta<typeof FormLinks> = {
diff --git a/packages/ui/src/components/form/Form/FormLinks/FormLinks.tsx b/packages/ui/src/components/form/Form/FormLinks/FormLinks.tsx
index fff81fbc..ed65eb54 100644
--- a/packages/ui/src/components/form/Form/FormLinks/FormLinks.tsx
+++ b/packages/ui/src/components/form/Form/FormLinks/FormLinks.tsx
@@ -4,7 +4,7 @@ import type { FormLinkComponent } from '../types';
 
 import { useTranslations } from 'next-intl';
 
-import { Link } from '../../../navigation/Link';
+import { Link } from '../../../navigation/Link/index';
 
 import styles from '../Form/Form.module.scss';
 
diff --git a/packages/ui/src/components/form/Form/index.ts b/packages/ui/src/components/form/Form/index.ts
index 2fbe4435..86b7b6a5 100644
--- a/packages/ui/src/components/form/Form/index.ts
+++ b/packages/ui/src/components/form/Form/index.ts
@@ -1,7 +1,7 @@
-export { Form } from './Form';
-export type { FormProps } from './Form';
-export { FormLinks } from './FormLinks';
-export type { FormLinkItem, FormLinksProps } from './FormLinks';
-export { SubmitError } from './SubmitError';
-export type { SubmitErrorProps } from './SubmitError';
+export { Form } from './Form/index';
+export type { FormProps } from './Form/index';
+export { FormLinks } from './FormLinks/index';
+export type { FormLinkItem, FormLinksProps } from './FormLinks/index';
+export { SubmitError } from './SubmitError/index';
+export type { SubmitErrorProps } from './SubmitError/index';
 export type { FormLinkComponent, FormLinkComponentProps } from './types';
diff --git a/packages/ui/src/components/form/FormActions/FormActions.module.scss b/packages/ui/src/components/form/FormActions/FormActions.module.scss
index 85f8fe66..f0b87d5a 100644
--- a/packages/ui/src/components/form/FormActions/FormActions.module.scss
+++ b/packages/ui/src/components/form/FormActions/FormActions.module.scss
@@ -2,5 +2,6 @@
 
 .actions {
   display: flex;
+  justify-content: flex-end;
   gap: $gap-button-row;
 }
diff --git a/packages/ui/src/components/form/FormContainer/FormContainer.tsx b/packages/ui/src/components/form/FormContainer/FormContainer.tsx
index c830c9c6..d959864a 100644
--- a/packages/ui/src/components/form/FormContainer/FormContainer.tsx
+++ b/packages/ui/src/components/form/FormContainer/FormContainer.tsx
@@ -1,4 +1,4 @@
-import { Stack } from '../../layout/Stack';
+import { Stack } from '../../layout/Stack/index';
 
 import styles from './FormContainer.module.scss';
 
diff --git a/packages/ui/src/components/layout/BucketDetailPageLayout/BucketDetailPageLayout.tsx b/packages/ui/src/components/layout/BucketDetailPageLayout/BucketDetailPageLayout.tsx
index ad3bdb79..f88037a0 100644
--- a/packages/ui/src/components/layout/BucketDetailPageLayout/BucketDetailPageLayout.tsx
+++ b/packages/ui/src/components/layout/BucketDetailPageLayout/BucketDetailPageLayout.tsx
@@ -1,6 +1,6 @@
 import type { ReactNode } from 'react';
 
-import { ContentPageLayout } from '../ContentPageLayout';
+import { ContentPageLayout } from '../ContentPageLayout/index';
 
 export type BucketDetailPageLayoutProps = {
   /** Optional breadcrumbs rendered above the content. */
diff --git a/packages/ui/src/components/layout/CodeSnippetBox/CodeSnippetBox.tsx b/packages/ui/src/components/layout/CodeSnippetBox/CodeSnippetBox.tsx
index 76475a3d..bf49b613 100644
--- a/packages/ui/src/components/layout/CodeSnippetBox/CodeSnippetBox.tsx
+++ b/packages/ui/src/components/layout/CodeSnippetBox/CodeSnippetBox.tsx
@@ -4,9 +4,9 @@ import type { ReactNode } from 'react';
 
 import { useState } from 'react';
 
-import { CopyButton } from '../../form/CopyButton';
-import { Row } from '../Row';
-import { Text } from '../Text';
+import { CopyButton } from '../../form/CopyButton/index';
+import { Row } from '../Row/index';
+import { Text } from '../Text/index';
 
 import styles from './CodeSnippetBox.module.scss';
 
diff --git a/packages/ui/src/components/layout/Container/Container.tsx b/packages/ui/src/components/layout/Container/Container.tsx
index cec8eb0a..952abb01 100644
--- a/packages/ui/src/components/layout/Container/Container.tsx
+++ b/packages/ui/src/components/layout/Container/Container.tsx
@@ -1,6 +1,6 @@
 import type { HTMLAttributes } from 'react';
 
-import { Stack } from '../Stack';
+import { Stack } from '../Stack/index';
 
 import styles from './Container.module.scss';
 
diff --git a/packages/ui/src/components/layout/ContentPageLayout/ContentPageLayout.tsx b/packages/ui/src/components/layout/ContentPageLayout/ContentPageLayout.tsx
index 83c4234e..d0fd9cdd 100644
--- a/packages/ui/src/components/layout/ContentPageLayout/ContentPageLayout.tsx
+++ b/packages/ui/src/components/layout/ContentPageLayout/ContentPageLayout.tsx
@@ -1,9 +1,9 @@
 import type { ReactNode } from 'react';
 
-import { Container } from '../Container';
-import { PageHeader } from '../PageHeader';
-import { Stack } from '../Stack';
-import { Text } from '../Text';
+import { Container } from '../Container/index';
+import { PageHeader } from '../PageHeader/index';
+import { Stack } from '../Stack/index';
+import { Text } from '../Text/index';
 
 export type ContentPageLayoutProps = {
   /** Page title (e.g. "Profile", "Settings"). Rendered as an h1 via PageHeader. Omit to hide the header (e.g. when the page renders its own). */
diff --git a/packages/ui/src/components/layout/CopyLinkBox/CopyLinkBox.tsx b/packages/ui/src/components/layout/CopyLinkBox/CopyLinkBox.tsx
index 57f7563f..baff6290 100644
--- a/packages/ui/src/components/layout/CopyLinkBox/CopyLinkBox.tsx
+++ b/packages/ui/src/components/layout/CopyLinkBox/CopyLinkBox.tsx
@@ -2,8 +2,8 @@
 
 import type { ReactNode } from 'react';
 
-import { CopyButton } from '../../form/CopyButton';
-import { Text } from '../Text';
+import { CopyButton } from '../../form/CopyButton/index';
+import { Text } from '../Text/index';
 
 import styles from './CopyLinkBox.module.scss';
 
diff --git a/packages/ui/src/components/layout/DataDetail/DataDetail.tsx b/packages/ui/src/components/layout/DataDetail/DataDetail.tsx
index ac77fc4c..328918a6 100644
--- a/packages/ui/src/components/layout/DataDetail/DataDetail.tsx
+++ b/packages/ui/src/components/layout/DataDetail/DataDetail.tsx
@@ -1,6 +1,6 @@
 import type { ReactNode } from 'react';
 
-import { Text } from '../Text';
+import { Text } from '../Text/index';
 
 import styles from './DataDetail.module.scss';
 
diff --git a/packages/ui/src/components/layout/FilterTablePageLayout/FilterTablePageLayout.tsx b/packages/ui/src/components/layout/FilterTablePageLayout/FilterTablePageLayout.tsx
index 82148c6d..e786766f 100644
--- a/packages/ui/src/components/layout/FilterTablePageLayout/FilterTablePageLayout.tsx
+++ b/packages/ui/src/components/layout/FilterTablePageLayout/FilterTablePageLayout.tsx
@@ -1,12 +1,15 @@
 import type { ReactNode } from 'react';
 
-import { Container } from '../Container';
-import { PageHeader } from '../PageHeader';
-import { Text } from '../Text';
+import { Container } from '../Container/index';
+import { PageHeader } from '../PageHeader/index';
+import { Stack } from '../Stack/index';
+import { Text } from '../Text/index';
 
 export type FilterTablePageLayoutProps = {
   /** Page title (e.g. "Buckets", "Users"). Rendered as an h1 via PageHeader. */
   title: ReactNode;
+  /** Optional breadcrumbs rendered above the page title. */
+  breadcrumbs?: ReactNode;
   /** Optional error message shown above children when present. */
   error?: string | null;
   /** Variant for the error message. Default "muted". */
@@ -21,19 +24,23 @@ export type FilterTablePageLayoutProps = {
  */
 export function FilterTablePageLayout({
   title,
+  breadcrumbs,
   error,
   errorVariant = 'muted',
   children,
 }: FilterTablePageLayoutProps) {
   return (
     <Container>
-      <PageHeader title={title} />
-      {error !== undefined && error !== null && error !== '' && (
-        <Text variant={errorVariant} role="alert">
-          {error}
-        </Text>
-      )}
-      {children}
+      <Stack>
+        {breadcrumbs}
+        <PageHeader title={title} />
+        {error !== undefined && error !== null && error !== '' && (
+          <Text variant={errorVariant} role="alert">
+            {error}
+          </Text>
+        )}
+        {children}
+      </Stack>
     </Container>
   );
 }
diff --git a/packages/ui/src/components/layout/SectionWithHeading/SectionWithHeading.tsx b/packages/ui/src/components/layout/SectionWithHeading/SectionWithHeading.tsx
index f615c5b3..552e5b28 100644
--- a/packages/ui/src/components/layout/SectionWithHeading/SectionWithHeading.tsx
+++ b/packages/ui/src/components/layout/SectionWithHeading/SectionWithHeading.tsx
@@ -1,6 +1,6 @@
 import type { ReactNode } from 'react';
 
-import { Stack } from '../Stack';
+import { Stack } from '../Stack/index';
 
 import styles from './SectionWithHeading.module.scss';
 
diff --git a/packages/ui/src/components/modal/ConfirmDeleteModal/ConfirmDeleteModal.tsx b/packages/ui/src/components/modal/ConfirmDeleteModal/ConfirmDeleteModal.tsx
index 5ad6ac15..b8da170f 100644
--- a/packages/ui/src/components/modal/ConfirmDeleteModal/ConfirmDeleteModal.tsx
+++ b/packages/ui/src/components/modal/ConfirmDeleteModal/ConfirmDeleteModal.tsx
@@ -2,8 +2,8 @@
 
 import { useTranslations } from 'next-intl';
 
-import { Button } from '../../form/Button';
-import { Modal } from '../Modal';
+import { Button } from '../../form/Button/index';
+import { Modal } from '../Modal/index';
 import { ModalDialogContent } from '../Modal/ModalDialogContent';
 
 export type ConfirmDeleteModalProps = {
diff --git a/packages/ui/src/components/modal/Modal/Modal.stories.tsx b/packages/ui/src/components/modal/Modal/Modal.stories.tsx
index 66b59b73..9f538681 100644
--- a/packages/ui/src/components/modal/Modal/Modal.stories.tsx
+++ b/packages/ui/src/components/modal/Modal/Modal.stories.tsx
@@ -1,7 +1,7 @@
 import type { Meta, StoryObj } from '@storybook/react-vite';
 
-import { LoadingSpinner } from '../../feedback/LoadingSpinner';
-import { Button } from '../../form/Button';
+import { LoadingSpinner } from '../../feedback/LoadingSpinner/index';
+import { Button } from '../../form/Button/index';
 import { Text } from '../../layout/Text/Text';
 import { Modal } from './Modal';
 import { ModalDialogContent } from './ModalDialogContent';
diff --git a/packages/ui/src/components/modal/Modal/NavigationLoadingOverlay.tsx b/packages/ui/src/components/modal/Modal/NavigationLoadingOverlay.tsx
index 2a6fd90e..39892ae2 100644
--- a/packages/ui/src/components/modal/Modal/NavigationLoadingOverlay.tsx
+++ b/packages/ui/src/components/modal/Modal/NavigationLoadingOverlay.tsx
@@ -1,6 +1,6 @@
 'use client';
 
-import { LoadingSpinner } from '../../feedback/LoadingSpinner';
+import { LoadingSpinner } from '../../feedback/LoadingSpinner/index';
 import { Modal } from './Modal';
 
 /**
diff --git a/packages/ui/src/components/navigation/Dropdown/Dropdown.tsx b/packages/ui/src/components/navigation/Dropdown/Dropdown.tsx
index 4f2a1148..8ee4666a 100644
--- a/packages/ui/src/components/navigation/Dropdown/Dropdown.tsx
+++ b/packages/ui/src/components/navigation/Dropdown/Dropdown.tsx
@@ -9,7 +9,7 @@ import {
   type ReactNode,
 } from 'react';
 
-import { Link } from '../Link';
+import { Link } from '../Link/index';
 
 import styles from './Dropdown.module.scss';
 
diff --git a/packages/ui/src/components/navigation/NavBar/NavBar.tsx b/packages/ui/src/components/navigation/NavBar/NavBar.tsx
index df5633d1..4c522940 100644
--- a/packages/ui/src/components/navigation/NavBar/NavBar.tsx
+++ b/packages/ui/src/components/navigation/NavBar/NavBar.tsx
@@ -2,8 +2,8 @@
 
 import { useTranslations } from 'next-intl';
 
-import { Dropdown } from '../Dropdown';
-import { Link } from '../Link';
+import { Dropdown } from '../Dropdown/index';
+import { Link } from '../Link/index';
 
 import styles from './NavBar.module.scss';
 
diff --git a/packages/ui/src/components/navigation/ThemeSelector/ThemeSelector.stories.tsx b/packages/ui/src/components/navigation/ThemeSelector/ThemeSelector.stories.tsx
index 95e65571..b4bb2255 100644
--- a/packages/ui/src/components/navigation/ThemeSelector/ThemeSelector.stories.tsx
+++ b/packages/ui/src/components/navigation/ThemeSelector/ThemeSelector.stories.tsx
@@ -1,6 +1,6 @@
 import type { Meta, StoryObj } from '@storybook/react-vite';
 
-import { ThemeProvider } from '../../../contexts/ThemeContext';
+import { ThemeProvider } from '../../../contexts/ThemeContext/index';
 import { ThemeSelector } from './ThemeSelector';
 
 const meta: Meta<typeof ThemeSelector> = {
diff --git a/packages/ui/src/components/navigation/ThemeSelector/ThemeSelector.tsx b/packages/ui/src/components/navigation/ThemeSelector/ThemeSelector.tsx
index 517148f3..38a790b6 100644
--- a/packages/ui/src/components/navigation/ThemeSelector/ThemeSelector.tsx
+++ b/packages/ui/src/components/navigation/ThemeSelector/ThemeSelector.tsx
@@ -2,9 +2,9 @@
 
 import { useTranslations } from 'next-intl';
 
-import { useTheme } from '../../../contexts/ThemeContext';
+import { useTheme } from '../../../contexts/ThemeContext/index';
 import { THEMES, type Theme } from '../../../lib/settingsCookie';
-import { Select } from '../../form/Select';
+import { Select } from '../../form/Select/index';
 
 function isTheme(value: string): value is Theme {
   return THEMES.includes(value as Theme);
diff --git a/packages/ui/src/components/table/ResourceTableWithFilter/ResourceTableWithFilter.tsx b/packages/ui/src/components/table/ResourceTableWithFilter/ResourceTableWithFilter.tsx
index b971abf7..9218777a 100644
--- a/packages/ui/src/components/table/ResourceTableWithFilter/ResourceTableWithFilter.tsx
+++ b/packages/ui/src/components/table/ResourceTableWithFilter/ResourceTableWithFilter.tsx
@@ -7,15 +7,15 @@ import { useCallback, useMemo } from 'react';
 import { useCookieModeListRefresh } from '../../../hooks/useCookieModeListRefresh';
 import { useDeleteModal } from '../../../hooks/useDeleteModal';
 import { useTableFilterState } from '../../../hooks/useTableFilterState';
-import { ButtonLink } from '../../form/ButtonLink';
-import { CrudButtons } from '../../form/CrudButtons';
-import { Text } from '../../layout/Text';
+import { ButtonLink } from '../../form/ButtonLink/index';
+import { CrudButtons } from '../../form/CrudButtons/index';
+import { Text } from '../../layout/Text/index';
 import { ConfirmDeleteModal } from '../../modal/ConfirmDeleteModal/ConfirmDeleteModal';
-import { Link } from '../../navigation/Link';
-import { Pagination } from '../../navigation/Pagination';
+import { Link } from '../../navigation/Link/index';
+import { Pagination } from '../../navigation/Pagination/index';
 import { setSortPrefInCookie } from '../sortPrefsCookie';
-import { Table } from '../Table';
-import { TableFilterBar, type TableFilterBarColumn } from '../TableFilterBar';
+import { Table } from '../Table/index';
+import { TableFilterBar, type TableFilterBarColumn } from '../TableFilterBar/index';
 import { mergeTableListStateInCookie } from '../tableListStateCookie';
 
 import styles from './ResourceTableWithFilter.module.scss';
diff --git a/packages/ui/src/components/table/TableFilterBar/TableFilterBar.tsx b/packages/ui/src/components/table/TableFilterBar/TableFilterBar.tsx
index 153722e3..1b46d910 100644
--- a/packages/ui/src/components/table/TableFilterBar/TableFilterBar.tsx
+++ b/packages/ui/src/components/table/TableFilterBar/TableFilterBar.tsx
@@ -3,7 +3,7 @@
 import { useTranslations } from 'next-intl';
 import { useCallback, useEffect, useRef, useState, type KeyboardEvent } from 'react';
 
-import { Input } from '../../form/Input';
+import { Input } from '../../form/Input/index';
 
 import styles from './TableFilterBar.module.scss';
 
diff --git a/packages/ui/src/components/table/TableWithFilter/TableWithFilter.tsx b/packages/ui/src/components/table/TableWithFilter/TableWithFilter.tsx
index 8682eba6..7f59732b 100644
--- a/packages/ui/src/components/table/TableWithFilter/TableWithFilter.tsx
+++ b/packages/ui/src/components/table/TableWithFilter/TableWithFilter.tsx
@@ -7,10 +7,10 @@ import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { SEARCH_DEBOUNCE_MS } from '@metaboost/helpers';
 
 import { useCookieModeListRefresh } from '../../../hooks/useCookieModeListRefresh';
-import { Pagination } from '../../navigation/Pagination';
+import { Pagination } from '../../navigation/Pagination/index';
 import { setSortPrefInCookie } from '../sortPrefsCookie';
-import { Table } from '../Table';
-import { TableFilterBar, type TableFilterBarColumn } from '../TableFilterBar';
+import { Table } from '../Table/index';
+import { TableFilterBar, type TableFilterBarColumn } from '../TableFilterBar/index';
 import { mergeTableListStateInCookie } from '../tableListStateCookie';
 
 import styles from './TableWithFilter.module.scss';
diff --git a/packages/ui/src/index.ts b/packages/ui/src/index.ts
index e3a93742..3a141b14 100644
--- a/packages/ui/src/index.ts
+++ b/packages/ui/src/index.ts
@@ -1,7 +1,7 @@
 // Shared UI components and exports. Styles live under src/styles/ and are
 // consumed via package exports (@metaboost/ui/styles, etc.).
 
-export { Form, FormLinks, SubmitError } from './components/form/Form';
+export { Form, FormLinks, SubmitError } from './components/form/Form/index';
 export type {
   FormLinkComponent,
   FormLinkComponentProps,
@@ -9,153 +9,159 @@ export type {
   FormLinksProps,
   FormProps,
   SubmitErrorProps,
-} from './components/form/Form';
-export { FormContainer } from './components/form/FormContainer';
-export type { FormContainerProps } from './components/form/FormContainer';
+} from './components/form/Form/index';
+export { FormContainer } from './components/form/FormContainer/index';
+export type { FormContainerProps } from './components/form/FormContainer/index';
 export {
   ForgotPasswordForm,
   LoginForm,
   ResetPasswordForm,
   SignupForm,
-} from './components/form/AuthForms';
+} from './components/form/AuthForms/index';
 export type {
   ForgotPasswordFormProps,
   LoginFormProps,
   ResetPasswordFormProps,
   SignupFormProps,
-} from './components/form/AuthForms';
-export { NavBar } from './components/navigation/NavBar';
+} from './components/form/AuthForms/index';
+export { NavBar } from './components/navigation/NavBar/index';
 export type {
   NavBarLinkComponentProps,
   NavBarProps,
   NavBarUser,
-} from './components/navigation/NavBar';
-export { AppTypeTitle } from './components/navigation/AppTypeTitle';
-export { BackToButton } from './components/navigation/BackToButton';
-export type { BackToButtonProps } from './components/navigation/BackToButton';
-export { Breadcrumbs } from './components/navigation/Breadcrumbs';
+} from './components/navigation/NavBar/index';
+export { AppTypeTitle } from './components/navigation/AppTypeTitle/index';
+export { BackToButton } from './components/navigation/BackToButton/index';
+export type { BackToButtonProps } from './components/navigation/BackToButton/index';
+export { Breadcrumbs } from './components/navigation/Breadcrumbs/index';
 export type {
   BreadcrumbItem,
   BreadcrumbsLinkComponentProps,
   BreadcrumbsProps,
-} from './components/navigation/Breadcrumbs';
-export { Link } from './components/navigation/Link';
-export type { LinkProps } from './components/navigation/Link';
-export { NavCardGrid } from './components/navigation/NavCardGrid';
-export type { NavCard, NavCardGridProps } from './components/navigation/NavCardGrid';
-export type { DropdownLinkComponentProps } from './components/navigation/Dropdown';
-export { AppView } from './components/layout/AppView';
-export type { AppViewProps } from './components/layout/AppView';
-export { Main } from './components/layout/Main';
-export type { MainProps } from './components/layout/Main';
-export { Button } from './components/form/Button';
-export type { ButtonProps, ButtonVariant } from './components/form/Button';
-export { CopyButton } from './components/form/CopyButton';
-export type { CopyButtonProps } from './components/form/CopyButton';
-export { ButtonLink } from './components/form/ButtonLink';
-export type { ButtonLinkProps } from './components/form/ButtonLink';
-export { CrudButtons } from './components/form/CrudButtons';
-export type { CrudButtonsProps } from './components/form/CrudButtons';
-export { Card } from './components/layout/Card';
-export type { CardProps } from './components/layout/Card';
-export { CenterInViewport } from './components/layout/CenterInViewport';
-export type { CenterInViewportProps } from './components/layout/CenterInViewport';
-export { Container } from './components/layout/Container';
-export type { ContainerProps } from './components/layout/Container';
-export { DataDetail } from './components/layout/DataDetail';
-export type { DataDetailItem, DataDetailProps } from './components/layout/DataDetail';
-export { CopyLinkBox } from './components/layout/CopyLinkBox';
-export type { CopyLinkBoxProps } from './components/layout/CopyLinkBox';
-export { CodeSnippetBox } from './components/layout/CodeSnippetBox';
-export type { CodeSnippetBoxProps } from './components/layout/CodeSnippetBox';
-export { Divider } from './components/layout/Divider';
-export type { DividerProps } from './components/layout/Divider';
-export { PageHeader } from './components/layout/PageHeader';
-export type { PageHeaderProps } from './components/layout/PageHeader';
-export { FilterTablePageLayout } from './components/layout/FilterTablePageLayout';
-export type { FilterTablePageLayoutProps } from './components/layout/FilterTablePageLayout';
-export { ContentPageLayout } from './components/layout/ContentPageLayout';
-export type { ContentPageLayoutProps } from './components/layout/ContentPageLayout';
-export { BucketDetailPageLayout } from './components/layout/BucketDetailPageLayout';
-export type { BucketDetailPageLayoutProps } from './components/layout/BucketDetailPageLayout';
-export { CaretMenuDropdown } from './components/navigation/Dropdown';
-export type { CaretMenuDropdownProps } from './components/navigation/Dropdown';
-export { Dropdown } from './components/navigation/Dropdown';
-export type { DropdownProps, DropdownItem } from './components/navigation/Dropdown';
-export { DropdownMenuCheckboxRow } from './components/navigation/Dropdown';
-export type { DropdownMenuCheckboxRowProps } from './components/navigation/Dropdown';
-export { SelectMenuDropdown } from './components/navigation/Dropdown';
-export type { SelectMenuDropdownProps, SelectMenuOption } from './components/navigation/Dropdown';
-export { Input } from './components/form/Input';
-export type { InputProps } from './components/form/Input';
-export { Textarea } from './components/form/Textarea';
-export type { TextareaProps } from './components/form/Textarea';
-export { Select } from './components/form/Select';
-export type { SelectOption, SelectProps } from './components/form/Select';
-export { OptionTileSelector } from './components/form/OptionTileSelector';
+} from './components/navigation/Breadcrumbs/index';
+export { Link } from './components/navigation/Link/index';
+export type { LinkProps } from './components/navigation/Link/index';
+export { NavCardGrid } from './components/navigation/NavCardGrid/index';
+export type { NavCard, NavCardGridProps } from './components/navigation/NavCardGrid/index';
+export type { DropdownLinkComponentProps } from './components/navigation/Dropdown/index';
+export { AppView } from './components/layout/AppView/index';
+export type { AppViewProps } from './components/layout/AppView/index';
+export { Main } from './components/layout/Main/index';
+export type { MainProps } from './components/layout/Main/index';
+export { Button } from './components/form/Button/index';
+export type { ButtonProps, ButtonVariant } from './components/form/Button/index';
+export { CopyButton } from './components/form/CopyButton/index';
+export type { CopyButtonProps } from './components/form/CopyButton/index';
+export { ButtonLink } from './components/form/ButtonLink/index';
+export type { ButtonLinkProps } from './components/form/ButtonLink/index';
+export { CrudButtons } from './components/form/CrudButtons/index';
+export type { CrudButtonsProps } from './components/form/CrudButtons/index';
+export { Card } from './components/layout/Card/index';
+export type { CardProps } from './components/layout/Card/index';
+export { CenterInViewport } from './components/layout/CenterInViewport/index';
+export type { CenterInViewportProps } from './components/layout/CenterInViewport/index';
+export { Container } from './components/layout/Container/index';
+export type { ContainerProps } from './components/layout/Container/index';
+export { DataDetail } from './components/layout/DataDetail/index';
+export type { DataDetailItem, DataDetailProps } from './components/layout/DataDetail/index';
+export { CopyLinkBox } from './components/layout/CopyLinkBox/index';
+export type { CopyLinkBoxProps } from './components/layout/CopyLinkBox/index';
+export { CodeSnippetBox } from './components/layout/CodeSnippetBox/index';
+export type { CodeSnippetBoxProps } from './components/layout/CodeSnippetBox/index';
+export { Divider } from './components/layout/Divider/index';
+export type { DividerProps } from './components/layout/Divider/index';
+export { PageHeader } from './components/layout/PageHeader/index';
+export type { PageHeaderProps } from './components/layout/PageHeader/index';
+export { FilterTablePageLayout } from './components/layout/FilterTablePageLayout/index';
+export type { FilterTablePageLayoutProps } from './components/layout/FilterTablePageLayout/index';
+export { ContentPageLayout } from './components/layout/ContentPageLayout/index';
+export type { ContentPageLayoutProps } from './components/layout/ContentPageLayout/index';
+export { BucketDetailPageLayout } from './components/layout/BucketDetailPageLayout/index';
+export type { BucketDetailPageLayoutProps } from './components/layout/BucketDetailPageLayout/index';
+export { CaretMenuDropdown } from './components/navigation/Dropdown/index';
+export type { CaretMenuDropdownProps } from './components/navigation/Dropdown/index';
+export { Dropdown } from './components/navigation/Dropdown/index';
+export type { DropdownProps, DropdownItem } from './components/navigation/Dropdown/index';
+export { DropdownMenuCheckboxRow } from './components/navigation/Dropdown/index';
+export type { DropdownMenuCheckboxRowProps } from './components/navigation/Dropdown/index';
+export { SelectMenuDropdown } from './components/navigation/Dropdown/index';
+export type {
+  SelectMenuDropdownProps,
+  SelectMenuOption,
+} from './components/navigation/Dropdown/index';
+export { Input } from './components/form/Input/index';
+export type { InputProps } from './components/form/Input/index';
+export { Textarea } from './components/form/Textarea/index';
+export type { TextareaProps } from './components/form/Textarea/index';
+export { Select } from './components/form/Select/index';
+export type { SelectOption, SelectProps } from './components/form/Select/index';
+export { OptionTileSelector } from './components/form/OptionTileSelector/index';
 export type {
   OptionTileSelectorOption,
   OptionTileSelectorProps,
-} from './components/form/OptionTileSelector';
-export { PasswordStrengthMeter } from './components/form/PasswordStrengthMeter';
-export type { PasswordStrengthMeterProps } from './components/form/PasswordStrengthMeter';
-export { List } from './components/layout/List';
-export type { ListProps } from './components/layout/List';
-export { UnorderedList } from './components/layout/UnorderedList';
-export type { UnorderedListProps } from './components/layout/UnorderedList';
-export { Row } from './components/layout/Row';
-export type { RowProps } from './components/layout/Row';
-export { Stack } from './components/layout/Stack';
-export type { StackProps } from './components/layout/Stack';
-export { SectionWithHeading } from './components/layout/SectionWithHeading';
-export type { SectionWithHeadingProps } from './components/layout/SectionWithHeading';
-export { BucketDetailContent } from './components/bucket/BucketDetailContent';
+} from './components/form/OptionTileSelector/index';
+export { PasswordStrengthMeter } from './components/form/PasswordStrengthMeter/index';
+export type { PasswordStrengthMeterProps } from './components/form/PasswordStrengthMeter/index';
+export { List } from './components/layout/List/index';
+export type { ListProps } from './components/layout/List/index';
+export { UnorderedList } from './components/layout/UnorderedList/index';
+export type { UnorderedListProps } from './components/layout/UnorderedList/index';
+export { Row } from './components/layout/Row/index';
+export type { RowProps } from './components/layout/Row/index';
+export { Stack } from './components/layout/Stack/index';
+export type { StackProps } from './components/layout/Stack/index';
+export { SectionWithHeading } from './components/layout/SectionWithHeading/index';
+export type { SectionWithHeadingProps } from './components/layout/SectionWithHeading/index';
+export { BucketDetailContent } from './components/bucket/BucketDetailContent/index';
 export type {
   BucketDetailContentProps,
   BucketDetailBucket,
-} from './components/bucket/BucketDetailContent';
-export { BucketMessageList } from './components/bucket/BucketMessageList';
+} from './components/bucket/BucketDetailContent/index';
+export { BucketMessageList } from './components/bucket/BucketMessageList/index';
 export type {
   BucketMessageListItem,
   BucketMessageListProps,
-} from './components/bucket/BucketMessageList';
-export { MessageCard } from './components/bucket/MessageCard';
-export type { MessageCardProps } from './components/bucket/MessageCard';
-export { BucketMessagesBreadcrumbs } from './components/bucket/BucketMessagesBreadcrumbs';
-export type { BucketMessagesBreadcrumbsProps } from './components/bucket/BucketMessagesBreadcrumbs';
-export { BucketMessagesPageContent } from './components/bucket/BucketMessagesPageContent';
-export type { BucketMessagesPageContentProps } from './components/bucket/BucketMessagesPageContent';
-export { BucketSummary } from './components/bucket/BucketSummary';
-export { DEFAULT_BUCKET_SUMMARY_RANGE_OPTIONS } from './components/bucket/BucketSummary';
+} from './components/bucket/BucketMessageList/index';
+export { MessageCard } from './components/bucket/MessageCard/index';
+export type { MessageCardProps } from './components/bucket/MessageCard/index';
+export { BucketMessagesBreadcrumbs } from './components/bucket/BucketMessagesBreadcrumbs/index';
+export type { BucketMessagesBreadcrumbsProps } from './components/bucket/BucketMessagesBreadcrumbs/index';
+export { BucketMessagesPageContent } from './components/bucket/BucketMessagesPageContent/index';
+export type { BucketMessagesPageContentProps } from './components/bucket/BucketMessagesPageContent/index';
+export { BucketSummary } from './components/bucket/BucketSummary/index';
+export { DEFAULT_BUCKET_SUMMARY_RANGE_OPTIONS } from './components/bucket/BucketSummary/index';
 export type {
   BucketSummaryChartPoint,
   BucketSummaryLabels,
   BucketSummaryProps,
   BucketSummaryRangePreset,
   BucketSummaryView,
-} from './components/bucket/BucketSummary';
-export { BucketSettingsBreadcrumbs } from './components/bucket/BucketSettingsBreadcrumbs';
-export type { BucketSettingsBreadcrumbsProps } from './components/bucket/BucketSettingsBreadcrumbs';
-export { BucketSettingsLayoutClient } from './components/bucket/BucketSettingsLayoutClient';
-export type { BucketSettingsLayoutClientProps } from './components/bucket/BucketSettingsLayoutClient';
-export { BucketSettingsTabs } from './components/bucket/BucketSettingsTabs';
-export type { BucketSettingsTabsProps } from './components/bucket/BucketSettingsTabs';
-export { CREATE_NEW_ROLE_VALUE, BucketAdminsView } from './components/bucket/BucketAdminsView';
+} from './components/bucket/BucketSummary/index';
+export { BucketSettingsBreadcrumbs } from './components/bucket/BucketSettingsBreadcrumbs/index';
+export type { BucketSettingsBreadcrumbsProps } from './components/bucket/BucketSettingsBreadcrumbs/index';
+export { BucketSettingsLayoutClient } from './components/bucket/BucketSettingsLayoutClient/index';
+export type { BucketSettingsLayoutClientProps } from './components/bucket/BucketSettingsLayoutClient/index';
+export { BucketSettingsTabs } from './components/bucket/BucketSettingsTabs/index';
+export type { BucketSettingsTabsProps } from './components/bucket/BucketSettingsTabs/index';
+export {
+  CREATE_NEW_ROLE_VALUE,
+  BucketAdminsView,
+} from './components/bucket/BucketAdminsView/index';
 export type {
   BucketAdminInvitationRow,
   BucketAdminRoleOption,
   BucketAdminRow,
   BucketAdminsViewLabels,
   BucketAdminsViewProps,
-} from './components/bucket/BucketAdminsView';
-export { EditBucketAdminForm } from './components/bucket/EditBucketAdminForm';
+} from './components/bucket/BucketAdminsView/index';
+export { EditBucketAdminForm } from './components/bucket/EditBucketAdminForm/index';
 export type {
   EditBucketAdminFormLabels,
   EditBucketAdminFormPayload,
   EditBucketAdminFormProps,
-} from './components/bucket/EditBucketAdminForm';
-export { Text } from './components/layout/Text';
-export type { TextProps, TextSize, TextVariant } from './components/layout/Text';
+} from './components/bucket/EditBucketAdminForm/index';
+export { Text } from './components/layout/Text/index';
+export type { TextProps, TextSize, TextVariant } from './components/layout/Text/index';
 export {
   getLocaleFromSettingsCookieValue,
   getSettingsFromCookieValue,
@@ -168,31 +174,46 @@ export type { SetSettingsCookieOptions } from './lib/settingsCookieClient';
 export { useAuthValidation } from './hooks/useAuthValidation';
 export type { AuthValidationTranslations } from './lib/validation';
 export { validateEmailWithT, validatePasswordWithT } from './lib/validation';
-export { ThemeProvider, ThemeWrapper, useTheme } from './contexts/ThemeContext';
-export type { ThemeContextValue, ThemeWrapperProps } from './contexts/ThemeContext';
-export { ThemeSelector } from './components/navigation/ThemeSelector';
-export { Tabs } from './components/navigation/Tabs';
-export type { TabItem, TabsLinkComponentProps, TabsProps } from './components/navigation/Tabs';
-export { LoadingSpinner } from './components/feedback/LoadingSpinner';
-export type { LoadingSpinnerProps } from './components/feedback/LoadingSpinner';
-export { Tooltip } from './components/feedback/Tooltip';
-export type { TooltipProps } from './components/feedback/Tooltip';
-export { InfoIcon } from './components/feedback/InfoIcon';
-export type { InfoIconProps } from './components/feedback/InfoIcon';
+export { ThemeProvider, ThemeWrapper, useTheme } from './contexts/ThemeContext/index';
+export type { ThemeContextValue, ThemeWrapperProps } from './contexts/ThemeContext/index';
+export { ThemeSelector } from './components/navigation/ThemeSelector/index';
+export { Tabs } from './components/navigation/Tabs/index';
+export type {
+  TabItem,
+  TabsLinkComponentProps,
+  TabsProps,
+} from './components/navigation/Tabs/index';
+export { LoadingSpinner } from './components/feedback/LoadingSpinner/index';
+export type { LoadingSpinnerProps } from './components/feedback/LoadingSpinner/index';
+export { Tooltip } from './components/feedback/Tooltip/index';
+export type { TooltipProps } from './components/feedback/Tooltip/index';
+export { InfoIcon } from './components/feedback/InfoIcon/index';
+export type { InfoIconProps } from './components/feedback/InfoIcon/index';
+export { AppErrorBoundary } from './components/feedback/AppErrorBoundary/AppErrorBoundary';
+export type {
+  AppErrorBoundaryProps,
+  AppErrorBoundaryStrings,
+} from './components/feedback/AppErrorBoundary/AppErrorBoundary';
+export { GlobalErrorBoundary } from './components/feedback/GlobalErrorBoundary/GlobalErrorBoundary';
+export type { GlobalErrorBoundaryProps } from './components/feedback/GlobalErrorBoundary/GlobalErrorBoundary';
+export {
+  extractErrorsStringsFromMessagesDefault,
+  filterErrorStrings,
+} from './lib/errorBoundaryStrings';
 export {
   Modal,
   ModalDialogContent,
   NavigationLoadingOverlay,
   RateLimitModal,
-} from './components/modal/Modal';
+} from './components/modal/Modal/index';
 export type {
   ModalDialogContentProps,
   ModalProps,
   RateLimitModalProps,
-} from './components/modal/Modal';
+} from './components/modal/Modal/index';
 export { ConfirmDeleteModal } from './components/modal/ConfirmDeleteModal/ConfirmDeleteModal';
 export type { ConfirmDeleteModalProps } from './components/modal/ConfirmDeleteModal/ConfirmDeleteModal';
-export { Table } from './components/table/Table';
+export { Table } from './components/table/Table/index';
 export type {
   TableProps,
   TableScrollContainerProps,
@@ -201,9 +222,12 @@ export type {
   TableRowProps,
   TableHeaderCellProps,
   TableCellProps,
-} from './components/table/Table';
-export { TableWithSort } from './components/table/TableWithSort';
-export type { TableWithSortColumn, TableWithSortProps } from './components/table/TableWithSort';
+} from './components/table/Table/index';
+export { TableWithSort } from './components/table/TableWithSort/index';
+export type {
+  TableWithSortColumn,
+  TableWithSortProps,
+} from './components/table/TableWithSort/index';
 export {
   BUCKET_DETAIL_MESSAGES_KEY,
   BUCKET_DETAIL_BUCKETS_LIST_KEY,
@@ -228,10 +252,13 @@ export {
   getTableListStateEntryFromCookieValue,
   mergeTableListStateInCookie,
 } from './components/table/tableListStateCookie';
-export { TableFilterBar } from './components/table/TableFilterBar';
-export type { TableFilterBarColumn, TableFilterBarProps } from './components/table/TableFilterBar';
-export { TableWithFilter } from './components/table/TableWithFilter';
-export type { TableWithFilterProps } from './components/table/TableWithFilter';
+export { TableFilterBar } from './components/table/TableFilterBar/index';
+export type {
+  TableFilterBarColumn,
+  TableFilterBarProps,
+} from './components/table/TableFilterBar/index';
+export { TableWithFilter } from './components/table/TableWithFilter/index';
+export type { TableWithFilterProps } from './components/table/TableWithFilter/index';
 export { ResourceTableWithFilter } from './components/table/ResourceTableWithFilter/ResourceTableWithFilter';
 export type {
   FilterableTableRow,
@@ -242,8 +269,8 @@ export { useDeleteModal } from './hooks/useDeleteModal';
 export type { DeleteTarget, UseDeleteModalOptions } from './hooks/useDeleteModal';
 export { useTableFilterState } from './hooks/useTableFilterState';
 export type { UseTableFilterStateOptions } from './hooks/useTableFilterState';
-export { Pagination, GoToPageModal } from './components/navigation/Pagination';
-export type { PaginationProps, GoToPageModalProps } from './components/navigation/Pagination';
+export { Pagination, GoToPageModal } from './components/navigation/Pagination/index';
+export type { PaginationProps, GoToPageModalProps } from './components/navigation/Pagination/index';
 export { NavigationProvider, useNavigationContext } from './contexts/NavigationContext';
 export {
   BucketDetailTabNavContext,
@@ -253,11 +280,11 @@ export type { BucketDetailTabNavContextValue } from './context/BucketDetailTabNa
 export { useAsyncPageLoading } from './hooks/useAsyncPageLoading';
 export { useStripSearchParamsIfPresent } from './hooks/useStripSearchParamsIfPresent';
 export { useCookieModeListRefresh } from './hooks/useCookieModeListRefresh';
-export { CheckboxField } from './components/form/CheckboxField';
-export type { CheckboxFieldProps } from './components/form/CheckboxField';
-export { CrudCheckboxes } from './components/form/CrudCheckboxes';
-export type { CrudCheckboxesProps, CrudFlags } from './components/form/CrudCheckboxes';
-export { FormActions } from './components/form/FormActions';
-export type { FormActionsProps } from './components/form/FormActions';
-export { FormSection } from './components/form/FormSection';
-export type { FormSectionProps } from './components/form/FormSection';
+export { CheckboxField } from './components/form/CheckboxField/index';
+export type { CheckboxFieldProps } from './components/form/CheckboxField/index';
+export { CrudCheckboxes } from './components/form/CrudCheckboxes/index';
+export type { CrudCheckboxesProps, CrudFlags } from './components/form/CrudCheckboxes/index';
+export { FormActions } from './components/form/FormActions/index';
+export type { FormActionsProps } from './components/form/FormActions/index';
+export { FormSection } from './components/form/FormSection/index';
+export type { FormSectionProps } from './components/form/FormSection/index';
diff --git a/packages/ui/src/lib/errorBoundaryStrings.ts b/packages/ui/src/lib/errorBoundaryStrings.ts
new file mode 100644
index 00000000..a41f830b
--- /dev/null
+++ b/packages/ui/src/lib/errorBoundaryStrings.ts
@@ -0,0 +1,32 @@
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Keeps only string-valued entries from an optional object (e.g. `errors` from i18n JSON).
+ */
+export function filterErrorStrings(
+  obj: Record<string, unknown> | undefined
+): Record<string, string> {
+  const result: Record<string, string> = {};
+  for (const [key, value] of Object.entries(obj || {})) {
+    if (typeof value === 'string') {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+
+/**
+ * Reads `messages.errors` from a loaded next-intl-style module default export.
+ */
+export function extractErrorsStringsFromMessagesDefault(messages: unknown): Record<string, string> {
+  if (!isPlainRecord(messages)) {
+    return {};
+  }
+  const errorsUnknown: unknown = messages.errors;
+  if (!isPlainRecord(errorsUnknown)) {
+    return {};
+  }
+  return filterErrorStrings(errorsUnknown);
+}
diff --git a/packages/ui/vitest.config.ts b/packages/ui/vitest.config.ts
new file mode 100644
index 00000000..4b9f6b66
--- /dev/null
+++ b/packages/ui/vitest.config.ts
@@ -0,0 +1,10 @@
+import react from '@vitejs/plugin-react';
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  plugins: [react()],
+  test: {
+    environment: 'jsdom',
+    include: ['src/**/*.test.ts', 'src/**/*.test.tsx'],
+  },
+});
diff --git a/scripts/api/process-due-renewals.mjs b/scripts/api/process-due-renewals.mjs
new file mode 100644
index 00000000..470165ab
--- /dev/null
+++ b/scripts/api/process-due-renewals.mjs
@@ -0,0 +1,31 @@
+/**
+ * Runs near-expiry renewal orchestration against the configured app database.
+ * Loads env from apps/api/.env and infra/config/local/db.env (override).
+ *
+ * Usage (from repo root, after `npm run build:packages` and `npm run build -w @metaboost/orm`):
+ *   node scripts/api/process-due-renewals.mjs
+ */
+import dotenv from 'dotenv';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(__dirname, '..', '..');
+
+dotenv.config({ path: path.join(repoRoot, 'apps', 'api', '.env') });
+dotenv.config({ path: path.join(repoRoot, 'infra', 'config', 'local', 'db.env'), override: true });
+
+const { appDataSourceReadWrite, BillingRenewalOrchestratorService } =
+  await import('@metaboost/orm');
+
+await appDataSourceReadWrite.initialize();
+try {
+  const orchestrator = new BillingRenewalOrchestratorService();
+  const summary = await orchestrator.processDueRenewals({
+    now: new Date(),
+    lookaheadHours: 24,
+  });
+  console.log(JSON.stringify(summary));
+} finally {
+  await appDataSourceReadWrite.destroy();
+}
diff --git a/scripts/ci/run-workspaces.mjs b/scripts/ci/run-workspaces.mjs
new file mode 100644
index 00000000..0b251a73
--- /dev/null
+++ b/scripts/ci/run-workspaces.mjs
@@ -0,0 +1,228 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const args = process.argv.slice(2);
+
+const getArgValue = (flag) => {
+  const index = args.indexOf(flag);
+  if (index === -1) return null;
+  return args[index + 1] ?? null;
+};
+
+const scriptName = getArgValue('--script');
+if (!scriptName) {
+  console.error('Missing required --script <name> argument.');
+  process.exit(1);
+}
+
+const hasAll = args.includes('--all');
+const workspacesFlagIndex = args.indexOf('--workspaces');
+
+// Parse --exclude flags (repeatable): e.g. --exclude apps/api --exclude apps/management-api
+const excludedPaths = [];
+for (let i = 0; i < args.length; i += 1) {
+  if (args[i] === '--exclude' && args[i + 1] && !args[i + 1].startsWith('--')) {
+    excludedPaths.push(args[i + 1]);
+    i += 1;
+  }
+}
+
+const readWorkspacePatterns = () => {
+  const packageJsonPath = path.resolve(process.cwd(), 'package.json');
+  const raw = fs.readFileSync(packageJsonPath, 'utf8');
+  const pkg = JSON.parse(raw);
+  if (Array.isArray(pkg.workspaces)) {
+    return pkg.workspaces;
+  }
+  if (pkg.workspaces && Array.isArray(pkg.workspaces.packages)) {
+    return pkg.workspaces.packages;
+  }
+  return [];
+};
+
+const readWorkspacePackage = (workspacePath) => {
+  const packageJsonPath = path.join(workspacePath, 'package.json');
+  if (!fs.existsSync(packageJsonPath)) {
+    return null;
+  }
+  const raw = fs.readFileSync(packageJsonPath, 'utf8');
+  const pkg = JSON.parse(raw);
+  return {
+    name: pkg.name ?? workspacePath,
+    id: workspacePath,
+  };
+};
+
+const expandWorkspacePattern = (pattern, repoRoot) => {
+  const parts = pattern.split('/');
+
+  const expandFrom = (currentPath, partIndex) => {
+    if (partIndex >= parts.length) {
+      const workspace = readWorkspacePackage(currentPath);
+      return workspace ? [workspace] : [];
+    }
+
+    const part = parts[partIndex];
+    if (part === '*') {
+      if (!fs.existsSync(currentPath)) {
+        return [];
+      }
+      const matches = [];
+      for (const entry of fs.readdirSync(currentPath, { withFileTypes: true })) {
+        if (!entry.isDirectory()) {
+          continue;
+        }
+        matches.push(...expandFrom(path.join(currentPath, entry.name), partIndex + 1));
+      }
+      return matches;
+    }
+
+    return expandFrom(path.join(currentPath, part), partIndex + 1);
+  };
+
+  return expandFrom(repoRoot, 0);
+};
+
+/** Resolve workspaces from root package.json `workspaces` entries (explicit paths and globs). */
+const resolveWorkspacesFromManifest = (patterns) => {
+  const repoRoot = process.cwd();
+  const seen = new Set();
+  const resolved = [];
+
+  for (const pattern of patterns) {
+    for (const workspace of expandWorkspacePattern(pattern, repoRoot)) {
+      const key = path.resolve(workspace.id);
+      if (seen.has(key)) {
+        continue;
+      }
+      seen.add(key);
+      resolved.push(workspace);
+    }
+  }
+
+  return resolved;
+};
+
+const resolveAllWorkspaces = () => {
+  return resolveWorkspacesFromManifest(readWorkspacePatterns());
+};
+
+const resolveExplicitWorkspaces = () => {
+  if (workspacesFlagIndex === -1) return [];
+  const workspaceArgs = [];
+  for (let i = workspacesFlagIndex + 1; i < args.length; i += 1) {
+    const value = args[i];
+    if (value.startsWith('--')) break;
+    workspaceArgs.push(value);
+  }
+  return workspaceArgs.map((workspace) => ({ name: workspace, id: workspace }));
+};
+
+const workspaces = hasAll ? resolveAllWorkspaces() : resolveExplicitWorkspaces();
+
+// Filter out excluded workspaces (normalize to repo-relative paths)
+const filteredWorkspaces =
+  excludedPaths.length > 0
+    ? workspaces.filter((ws) => {
+        const relPath = path.relative(process.cwd(), ws.id);
+        return !excludedPaths.includes(relPath);
+      })
+    : workspaces;
+
+if (filteredWorkspaces.length === 0) {
+  console.error('No workspaces resolved. Use --all or --workspaces <list>.');
+  process.exit(1);
+}
+
+const createLineCollector = (maxLines) => {
+  let buffer = '';
+  const lines = [];
+
+  const addChunk = (chunk) => {
+    buffer += chunk;
+    const split = buffer.split('\n');
+    buffer = split.pop() ?? '';
+    for (const line of split) {
+      lines.push(line);
+      if (lines.length > maxLines) lines.shift();
+    }
+  };
+
+  const flush = () => {
+    if (buffer) {
+      lines.push(buffer);
+      if (lines.length > maxLines) lines.shift();
+      buffer = '';
+    }
+  };
+
+  return { addChunk, flush, lines };
+};
+
+const failures = [];
+
+for (const workspace of filteredWorkspaces) {
+  const collector = createLineCollector(80);
+
+  /** When stdout is piped (stdio pipe), Vitest/tinyrainbow disable ANSI; FORCE_COLOR restores colors in the parent terminal. */
+  const spawnEnv = { ...process.env };
+  if (
+    scriptName === 'test' &&
+    process.stdout.isTTY &&
+    spawnEnv.FORCE_COLOR === undefined &&
+    spawnEnv.NO_COLOR === undefined &&
+    spawnEnv.NODE_DISABLE_COLORS === undefined
+  ) {
+    spawnEnv.FORCE_COLOR = '1';
+  }
+
+  const child = spawn('npm', ['run', scriptName, '--if-present', '-w', workspace.id], {
+    stdio: ['inherit', 'pipe', 'pipe'],
+    env: spawnEnv,
+  });
+
+  child.stdout.on('data', (chunk) => {
+    process.stdout.write(chunk);
+    collector.addChunk(chunk.toString());
+  });
+
+  child.stderr.on('data', (chunk) => {
+    process.stderr.write(chunk);
+    collector.addChunk(chunk.toString());
+  });
+
+  const exitCode = await new Promise((resolve) => {
+    child.on('close', resolve);
+  });
+
+  collector.flush();
+
+  if (exitCode !== 0) {
+    failures.push({
+      workspace: workspace.name,
+      exitCode,
+      tail: collector.lines,
+    });
+  }
+}
+
+const summaryTitle =
+  scriptName === 'test'
+    ? 'Test Summary'
+    : scriptName === 'build' || scriptName === 'build:prod'
+      ? 'Build Summary'
+      : `${scriptName} summary`;
+
+if (failures.length > 0) {
+  console.error(`\n=== ${summaryTitle} ===`);
+  for (const failure of failures) {
+    console.error(`\n- ${failure.workspace} (exit ${failure.exitCode})`);
+    for (const line of failure.tail) {
+      console.error(line);
+    }
+  }
+  process.exit(1);
+}
+
+console.log(`\nAll workspace "${scriptName}" runs completed successfully.`);
diff --git a/scripts/development/generate-webpush-vapid-keys.sh b/scripts/development/generate-webpush-vapid-keys.sh
new file mode 100755
index 00000000..a7d638b2
--- /dev/null
+++ b/scripts/development/generate-webpush-vapid-keys.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Print a new VAPID key pair for Web Push. Copy the public and private values into
+# WEBPUSH_VAPID_PUBLIC_KEY / WEBPUSH_VAPID_PRIVATE_KEY (and the same public key into
+# NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY on the web sidecar / runtime config).
+# See docs/development/env/WEB-PUSH-LOCAL.md
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+exec ./scripts/nix/with-env npm run webpush:generate-vapid-keys -w @metaboost/api
diff --git a/scripts/development/normalize-markdown-links.mjs b/scripts/development/normalize-markdown-links.mjs
new file mode 100644
index 00000000..c29ea464
--- /dev/null
+++ b/scripts/development/normalize-markdown-links.mjs
@@ -0,0 +1,310 @@
+#!/usr/bin/env node
+/**
+ * Rewrite markdown link hrefs that start with ../ to repo-root paths (leading /).
+ * Skips .llm/history/. Dry-run by default; pass --write to apply.
+ *
+ * Run from repository root:
+ *   node scripts/development/normalize-markdown-links.mjs
+ *   node scripts/development/normalize-markdown-links.mjs --write
+ */
+
+import fs from 'fs';
+import path from 'path';
+
+const repoRoot = process.cwd();
+const write = process.argv.includes('--write');
+const verifyOnly = process.argv.includes('--verify');
+
+const IGNORE_DIRS = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  '.next',
+  'coverage',
+  '.artifacts',
+  'i18n',
+]);
+
+/** Match parent-relative hrefs; allow one level of parentheses in paths (e.g. Next route segments). */
+const LINK_HREF_RE = /\]\((\.\.\/(?:[^()]|\([^()]*\))+)\)/g;
+const FENCED_BLOCK_RE = /(```[\s\S]*?```)/g;
+
+function isHistoryPath(relPath) {
+  const normalized = relPath.split(path.sep).join('/');
+  return normalized.startsWith('.llm/history/') || normalized === '.llm/history';
+}
+
+function shouldProcessFile(absPath) {
+  const rel = path.relative(repoRoot, absPath);
+  if (!rel.endsWith('.md') && !rel.endsWith('.mdc')) {
+    return false;
+  }
+  return !isHistoryPath(rel);
+}
+
+function shouldEnterDir(absPath) {
+  const rel = path.relative(repoRoot, absPath);
+  if (rel === '') {
+    return true;
+  }
+  return !isHistoryPath(rel);
+}
+
+function pathExists(absPath) {
+  return fs.existsSync(absPath);
+}
+
+function relToRepoHref(relPath) {
+  const normalized = relPath.split(path.sep).join('/');
+  return `/${normalized}`;
+}
+
+function candidateRepoHrefs(resolvedAbs) {
+  const rel = path.relative(repoRoot, resolvedAbs).split(path.sep).join('/');
+  const candidates = [rel];
+
+  if (rel.includes('.cursor/.cursor/')) {
+    candidates.push(rel.replaceAll('.cursor/.cursor/', '.cursor/'));
+  }
+
+  if (rel.startsWith('.cursor/')) {
+    candidates.push(rel.slice('.cursor/'.length));
+  }
+
+  if (rel.startsWith('.llm/')) {
+    const tail = rel.slice('.llm/'.length);
+    if (
+      !tail.startsWith('plans/') &&
+      !tail.startsWith('history/') &&
+      !tail.startsWith('exports/')
+    ) {
+      candidates.push(tail);
+    }
+  }
+
+  if (rel.startsWith('apps/tools/')) {
+    candidates.push(rel.slice('apps/'.length));
+  }
+
+  if (rel.startsWith('docs/.llm/')) {
+    candidates.push(rel.slice('docs/'.length));
+  }
+
+  if (rel === 'docs/development/QUICKSTART.md') {
+    candidates.push('docs/QUICKSTART.md');
+  }
+
+  if (rel === 'docs/GITHUB-LABELS.md') {
+    candidates.push('docs/repo-management/GITHUB-LABELS.md');
+  }
+
+  if (rel === 'docs/CONTRIBUTING.md') {
+    candidates.push('docs/development/CONTRIBUTING.md');
+  }
+
+  if (rel === 'docs/development/ENV-REFERENCE.md') {
+    candidates.push('docs/development/env/ENV-REFERENCE.md');
+  }
+
+  if (rel === 'docs/QUICKSTART.md' || rel === 'docs/development/QUICK-START.md') {
+    candidates.push('docs/QUICK-START.md');
+  }
+
+  if (rel === 'docs/development/CURSOR-NIX-WITH-ENV.md') {
+    candidates.push('docs/CURSOR-NIX-WITH-ENV.md');
+  }
+
+  if (rel === '.github/workflows/publish-alpha.yml') {
+    candidates.push('.github/workflows/publish-staging.yml');
+  }
+
+  if (rel === 'infra/k8s/alpha/common/source/extensions.env') {
+    candidates.push('infra/k8s/base/common/source/extensions/extensions.env');
+  }
+
+  if (rel === 'docs/AGENTS.md') {
+    candidates.push('AGENTS.md');
+  }
+
+  if (rel === '.cursor/infra/k8s/scripts/README.md') {
+    candidates.push('infra/k8s/scripts/secret-generators/INFRA-K8S-SCRIPTS-SECRET-GENERATORS.md');
+  }
+
+  if (rel === '.cursor/infra/k8s/README.md') {
+    candidates.push('infra/k8s/INFRA-K8S.md');
+  }
+
+  if (rel === '.cursor/skills/.cursor/rules/infra-k8s.mdc') {
+    candidates.push('.cursor/rules/infra-k8s.mdc');
+  }
+
+  if (rel === '.cursor/skills/02-api-data-fetching.md') {
+    candidates.push('.cursor/skills/web/02-api-data-fetching.md');
+  }
+
+  if (rel === '.cursor/skills/nix-terminal-wrapper/SKILL.md') {
+    candidates.push('.cursor/rules/nix-terminal-wrapper.mdc');
+  }
+
+  if (rel.startsWith('docs/scripts/')) {
+    candidates.push(rel.slice('docs/'.length));
+  }
+
+  if (rel.startsWith('docs/.github/')) {
+    candidates.push(rel.slice('docs/'.length));
+  }
+
+  if (rel.startsWith('docs/tools/')) {
+    candidates.push(rel.slice('docs/'.length));
+  }
+
+  if (rel.startsWith('infra/docs/')) {
+    candidates.push(rel.slice('infra/'.length));
+  }
+
+  if (rel.startsWith('docs/.cursor/')) {
+    candidates.push(rel.slice('docs/'.length));
+  }
+
+  if (rel.startsWith('docs/packages/') || rel.startsWith('docs/apps/')) {
+    candidates.push(rel.slice('docs/'.length));
+  }
+
+  if (rel.startsWith('.llm/plans/completed/completed/')) {
+    candidates.push(rel.replace('completed/completed/', 'completed/'));
+  }
+
+  return candidates;
+}
+
+function resolveToRepoHref(href, fileDir, _filePath) {
+  const hashIndex = href.indexOf('#');
+  const pathPart = hashIndex === -1 ? href : href.slice(0, hashIndex);
+  const fragment = hashIndex === -1 ? '' : href.slice(hashIndex);
+
+  const resolved = path.normalize(path.join(fileDir, pathPart));
+  const relFromRepo = path.relative(repoRoot, resolved);
+
+  if (relFromRepo.startsWith('..')) {
+    return { skip: true, reason: 'outside-repo' };
+  }
+
+  for (const candidate of candidateRepoHrefs(resolved)) {
+    const absCandidate = path.join(repoRoot, candidate);
+    if (pathExists(absCandidate)) {
+      return { href: relToRepoHref(candidate) + fragment, skip: false };
+    }
+  }
+
+  return { skip: true, reason: 'missing-target', resolved: relFromRepo.split(path.sep).join('/') };
+}
+
+function replaceParentRelativeLinks(segment, fileDir, filePath, stats) {
+  return segment.replace(LINK_HREF_RE, (match, href) => {
+    const result = resolveToRepoHref(href, fileDir, filePath);
+    if (result.skip) {
+      stats.skipped.push({
+        file: path.relative(repoRoot, filePath),
+        href,
+        reason: result.reason,
+        resolved: result.resolved,
+      });
+      return match;
+    }
+    if (result.href === href) {
+      return match;
+    }
+    stats.changeCount += 1;
+    return `](${result.href})`;
+  });
+}
+
+function processContent(content, fileDir, filePath) {
+  const stats = { changeCount: 0, missing: [], skipped: [] };
+  const parts = content.split(FENCED_BLOCK_RE);
+  const updated = parts
+    .map((part) => {
+      if (part.startsWith('```')) {
+        return part;
+      }
+      return replaceParentRelativeLinks(part, fileDir, filePath, stats);
+    })
+    .join('');
+
+  return { updated, changeCount: stats.changeCount, skipped: stats.skipped };
+}
+
+function walk(dir, files = []) {
+  for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+    const abs = path.join(dir, ent.name);
+    if (ent.isDirectory()) {
+      if (IGNORE_DIRS.has(ent.name)) {
+        continue;
+      }
+      if (!shouldEnterDir(abs)) {
+        continue;
+      }
+      walk(abs, files);
+    } else if (shouldProcessFile(abs)) {
+      files.push(abs);
+    }
+  }
+  return files;
+}
+
+function main() {
+  const files = walk(repoRoot);
+  let totalChanges = 0;
+  let filesChanged = 0;
+  const allSkipped = [];
+
+  for (const filePath of files) {
+    const content = fs.readFileSync(filePath, 'utf8');
+    const fileDir = path.dirname(filePath);
+    const { updated, changeCount, skipped } = processContent(content, fileDir, filePath);
+
+    if (skipped.length > 0) {
+      allSkipped.push(...skipped);
+    }
+
+    if (changeCount === 0) {
+      continue;
+    }
+
+    totalChanges += changeCount;
+    filesChanged += 1;
+
+    if (write) {
+      fs.writeFileSync(filePath, updated, 'utf8');
+    } else if (!verifyOnly) {
+      console.log(`${path.relative(repoRoot, filePath)}: ${changeCount} link(s)`);
+    }
+  }
+
+  if (verifyOnly) {
+    console.log(
+      `Verify OK: ${totalChanges} link(s) in ${filesChanged} file(s) would normalize; ${allSkipped.length} skipped.`
+    );
+    if (allSkipped.length > 0) {
+      console.log('Skipped (left unchanged):');
+      for (const s of allSkipped.slice(0, 20)) {
+        console.log(`  ${s.file}: ${s.href} (${s.reason}${s.resolved ? `: ${s.resolved}` : ''})`);
+      }
+      if (allSkipped.length > 20) {
+        console.log(`  ... and ${allSkipped.length - 20} more`);
+      }
+    }
+    return;
+  }
+
+  const mode = write ? 'Wrote' : 'Would update';
+  console.log(`${mode} ${totalChanges} link(s) across ${filesChanged} file(s).`);
+  if (allSkipped.length > 0) {
+    console.log(`Skipped ${allSkipped.length} link(s) (missing target or outside repo).`);
+  }
+  if (!write) {
+    console.log('Pass --write to apply changes.');
+  }
+}
+
+main();
diff --git a/scripts/development/update-lockfile-linux.sh b/scripts/development/update-lockfile-linux.sh
old mode 100644
new mode 100755
diff --git a/scripts/env-overrides/home-override-env-files.inc.sh b/scripts/env-overrides/home-override-env-files.inc.sh
index 1fe8348d..c90f8498 100644
--- a/scripts/env-overrides/home-override-env-files.inc.sh
+++ b/scripts/env-overrides/home-override-env-files.inc.sh
@@ -1,5 +1,5 @@
 # Shared list of home override .env basenames used by local link flow.
-# info, auth, locale, mailer, user_agent -> user-agent.env
+# info, auth, locale, mailer, notifications, user_agent -> user-agent.env
 # When adding a new override file, add the matching .env basename here and update
 # scripts/env-overrides/write-home-override-stubs.rb mappings.
 # Sourced by link-local-env-overrides.sh (prepare uses write-home-override-stubs.rb for the list).
@@ -9,5 +9,6 @@ METABOOST_HOME_OVERRIDE_ENV_FILES=(
   auth.env
   locale.env
   mailer.env
+  notifications.env
   user-agent.env
 )
diff --git a/scripts/env-overrides/write-home-override-stubs.rb b/scripts/env-overrides/write-home-override-stubs.rb
index dbb0545b..3be1aaae 100644
--- a/scripts/env-overrides/write-home-override-stubs.rb
+++ b/scripts/env-overrides/write-home-override-stubs.rb
@@ -28,6 +28,12 @@
     'MAILER_PASSWORD' => 'apps/api/.env.example',
     'MAILER_FROM' => 'apps/api/.env.example'
   },
+  'notifications.env' => {
+    'WEBPUSH_ENABLED' => 'apps/api/.env.example',
+    'WEBPUSH_VAPID_PUBLIC_KEY' => 'apps/api/.env.example',
+    'WEBPUSH_VAPID_PRIVATE_KEY' => 'apps/api/.env.example',
+    'WEBPUSH_VAPID_SUBJECT' => 'apps/api/.env.example'
+  },
   'user-agent.env' => {
     'API_USER_AGENT' => 'apps/api/.env.example',
     'MANAGEMENT_API_USER_AGENT' => 'apps/management-api/.env.example'
diff --git a/scripts/git-hooks/install-hooks.sh b/scripts/git-hooks/install-hooks.sh
old mode 100644
new mode 100755
index 5da737b2..ead0b7d8
--- a/scripts/git-hooks/install-hooks.sh
+++ b/scripts/git-hooks/install-hooks.sh
@@ -1,20 +1,33 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-HOOKS_DIR="$REPO_ROOT/.git/hooks"
+
+# Skip silently when there is no usable git context (e.g. Docker mounts of a
+# worktree without the linked .git dir, tarball installs, some CI sandboxes).
+# Hooks are a developer convenience and must never block `npm ci`.
+if ! HOOKS_DIR="$(git -C "$REPO_ROOT" rev-parse --git-path hooks 2>/dev/null)"; then
+  echo "Skipping git hooks install: no usable git working tree at $REPO_ROOT."
+  exit 0
+fi
+
+# `git rev-parse --git-path` may return a relative path; normalize to absolute.
+case "$HOOKS_DIR" in
+  /*) ;;
+  *) HOOKS_DIR="$REPO_ROOT/$HOOKS_DIR" ;;
+esac
 
 echo "Installing git hooks..."
 mkdir -p "$HOOKS_DIR"
 
-
 git -C "$REPO_ROOT" config commit.template .gitmessage
 
-cp "$SCRIPT_DIR/pre-commit" "$HOOKS_DIR/pre-commit"
-chmod +x "$HOOKS_DIR/pre-commit"
+# Pre-commit formatting was removed; drop any legacy hook so commits are not blocked.
+rm -f "$HOOKS_DIR/pre-commit"
 
 cp "$SCRIPT_DIR/pre-push" "$HOOKS_DIR/pre-push"
 chmod +x "$HOOKS_DIR/pre-push"
 
-echo "✓ Git hooks installed (pre-commit, pre-push)"
+echo "✓ Git hooks installed (pre-push)"
 echo "✓ Commit message template set (.gitmessage)"
diff --git a/scripts/git-hooks/pre-commit b/scripts/git-hooks/pre-commit
deleted file mode 100644
index 5063187d..00000000
--- a/scripts/git-hooks/pre-commit
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/bin/bash
-
-# Metaboost Pre-Commit Hook - Format staged files with Prettier
-# Runs lint-staged (prettier --write on staged files).
-# Works with: Node on PATH (nvm, nix develop, global), NixOS (nix develop), nvm-only.
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-GUARD_EXPORTS="$REPO_ROOT/scripts/llm/guard-exports-prompt.sh"
-
-if [[ -f "$GUARD_EXPORTS" ]]; then
-  bash "$GUARD_EXPORTS" || exit 1
-fi
-
-LINT_STAGED="$REPO_ROOT/node_modules/.bin/lint-staged"
-
-if [[ ! -x "$LINT_STAGED" ]]; then
-  echo "pre-commit: lint-staged not found (run npm install)."
-  exit 1
-fi
-
-if command -v node >/dev/null 2>&1; then
-  exec "$LINT_STAGED"
-fi
-
-if command -v nix >/dev/null 2>&1; then
-  (cd "$REPO_ROOT" && nix develop --command bash -c 'exec ./node_modules/.bin/lint-staged')
-  exit $?
-fi
-
-NVM_DIR="${NVM_DIR:-$HOME/.nvm}"
-if [[ -s "$NVM_DIR/nvm.sh" ]]; then
-  (cd "$REPO_ROOT" && source "$NVM_DIR/nvm.sh" && (nvm use 2>/dev/null || true) && exec ./node_modules/.bin/lint-staged)
-  exit $?
-fi
-
-echo "pre-commit: node not on PATH and nix/nvm not available. Run commit from a terminal with Node (nix develop, nvm, or PATH)."
-exit 1
diff --git a/scripts/git-hooks/pre-push b/scripts/git-hooks/pre-push
old mode 100644
new mode 100755
index 0ee8a00b..d50d78bb
--- a/scripts/git-hooks/pre-push
+++ b/scripts/git-hooks/pre-push
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Metaboost Pre-Push Hook - Branch Naming Enforcement
 # Outputs to stderr so messages appear in GUI error dialogs
@@ -26,7 +26,7 @@ if [[ "$BRANCH" =~ $PROTECTED ]]; then
 fi
 
 # Valid branch patterns
-VALID_PATTERN="^(feature|fix|chore|docs|hotfix|release)/.*$"
+VALID_PATTERN="^(feature|fix|chore|docs|hotfix|release|llm)/.*$"
 
 if [[ "$BRANCH" =~ $VALID_PATTERN ]]; then
   echo -e "${GREEN}✓ Branch name valid: $BRANCH${NC}" >&2
@@ -43,6 +43,8 @@ echo -e "${YELLOW}║
 echo -e "${YELLOW}║  Expected patterns:                                        ║${NC}" >&2
 echo -e "${YELLOW}║    feature/description   fix/description                   ║${NC}" >&2
 echo -e "${YELLOW}║    chore/description     docs/description                  ║${NC}" >&2
+echo -e "${YELLOW}║    hotfix/description    release/description                 ║${NC}" >&2
+echo -e "${YELLOW}║    llm/description       (LLM-only; see DOCS-DEVELOPMENT-LLM) ║${NC}" >&2
 echo -e "${YELLOW}╚════════════════════════════════════════════════════════════╝${NC}" >&2
 echo "" >&2
 
diff --git a/scripts/github/SCRIPTS-GITHUB.md b/scripts/github/SCRIPTS-GITHUB.md
index 45c4863e..07423707 100644
--- a/scripts/github/SCRIPTS-GITHUB.md
+++ b/scripts/github/SCRIPTS-GITHUB.md
@@ -13,7 +13,18 @@ Labels include: GitHub defaults (bug, enhancement, etc.), area labels (apps, pac
 
 If the repo has labels not defined in the script, the script lists them and asks whether to delete them. Deleting does not remove labels from existing issues or PRs (those keep the label); it only removes the label from the list available for new issues and PRs.
 
-Full label reference (name, color, description, usage): [docs/repo-management/GITHUB-LABELS.md](../../docs/repo-management/GITHUB-LABELS.md).
+Full label reference (name, color, description, usage): [docs/repo-management/GITHUB-LABELS.md](/docs/repo-management/GITHUB-LABELS.md).
+
+## Vulnerability scanner
+
+[`.github/workflows/vulnerability-scanner.yml`](/.github/workflows/vulnerability-scanner.yml) creates
+issues with `security`, `dependencies`, and `priority:*` labels when npm audit reports new
+advisories. Ensure those labels exist (`setup-all-labels.sh`) before the first scheduled run.
+
+## Workflow YAML
+
+When editing files under `.github/workflows/`, follow
+[.cursor/rules/github-actions-yaml.mdc](/.cursor/rules/github-actions-yaml.mdc).
 
 ## PR labeler
 
diff --git a/scripts/github/setup-all-labels.sh b/scripts/github/setup-all-labels.sh
index 969ba4c1..33e6e3de 100755
--- a/scripts/github/setup-all-labels.sh
+++ b/scripts/github/setup-all-labels.sh
@@ -48,6 +48,9 @@ fi
 echo "Repository: $REPO"
 echo ""
 
+# gh label list defaults to 30; repos with extra labels need a higher limit for lookups.
+LABEL_LIST_LIMIT=40
+
 # Format: "name|color|description"
 LABELS=(
   "bug|990000|Something isn't working"
@@ -67,12 +70,13 @@ LABELS=(
   "docs|fef2c0|Changes to docs/"
   "infra|d93f0b|Changes to infra/"
   "ci|fbca04|Changes to .github/"
+  "llm|6e5499|Changes to .cursor skills, rules, or .cursorrules—non-Cursor: re-run LLM alignment on pull"
   "scripts|5319e7|Changes to scripts/"
   "tools|e99695|Changes to tools/"
   "i18n|c5def5|Changes to internationalization / translation files"
   # description max 100 characters (GitHub API)
-  "llm|6e5499|Changes to .cursor skills, rules, or .cursorrules—non-Cursor: re-run LLM alignment on pull"
   "blocked|990099|Work is blocked by another issue"
+  "published: awaiting verification|2da44e|Published to production; awaiting operator verification"
   "security|550000|Security vulnerabilities"
   "dependencies|0366d6|Dependency updates and security issues"
   "docker|384d54|Docker image and container updates"
@@ -93,7 +97,7 @@ ERRORS=0
 for label_def in "${LABELS[@]}"; do
   IFS='|' read -r name color description <<< "$label_def"
 
-  EXISTING=$(gh label list --json name,color,description --jq ".[] | select(.name == \"$name\")" 2>/dev/null || echo "")
+  EXISTING=$(gh label list --limit "$LABEL_LIST_LIMIT" --json name,color,description --jq ".[] | select(.name == \"$name\")" 2>/dev/null || echo "")
 
   if [ -n "$EXISTING" ]; then
     EXISTING_COLOR=$(echo "$EXISTING" | jq -r '.color')
@@ -114,7 +118,7 @@ for label_def in "${LABELS[@]}"; do
       EXISTS=$((EXISTS + 1))
     fi
   else
-    if gh label create "$name" --color "$color" --description "$description"; then
+    if gh label create "$name" --color "$color" --description "$description" --force; then
       echo "  ✅ $name (created)"
       CREATED=$((CREATED + 1))
     else
@@ -154,7 +158,7 @@ for label_def in "${LABELS[@]}"; do
   DEFINED_NAMES+=("$name")
 done
 
-REPO_LABELS=$(gh label list --json name --jq '.[].name' 2>/dev/null || echo "")
+REPO_LABELS=$(gh label list --limit "$LABEL_LIST_LIMIT" --json name --jq '.[].name' 2>/dev/null || echo "")
 EXTRA_LABELS=()
 while IFS= read -r name; do
   [ -z "$name" ] && continue
diff --git a/scripts/k8s/kustomize-build-metaboost-alpha-overlays.sh b/scripts/k8s/kustomize-build-metaboost-alpha-overlays.sh
new file mode 100755
index 00000000..c55fd556
--- /dev/null
+++ b/scripts/k8s/kustomize-build-metaboost-alpha-overlays.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Renders every infra/k8s/alpha/<component> overlay (no cluster apply).
+# Committed kustomizations pin remote bases with publish placeholder X.Y.Z-staging.N;
+# this script substitutes KUSTOMIZE_REF (commit SHA or staging tag) before kustomize build.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+PUBLISH_REF_PLACEHOLDER='X.Y.Z-staging.N'
+KUSTOMIZE_REF="${KUSTOMIZE_REF:-${1:-${GITHUB_SHA:-}}}"
+if [ -z "$KUSTOMIZE_REF" ]; then
+  KUSTOMIZE_REF="$(git rev-parse HEAD)"
+fi
+
+run_kustomize_build() {
+  local dir="$1"
+  if command -v kustomize >/dev/null 2>&1; then
+    kustomize build --load-restrictor LoadRestrictionsNone "$dir"
+  else
+    kubectl kustomize "$dir" --load-restrictor LoadRestrictionsNone
+  fi
+}
+
+FAIL=0
+for overlay in infra/k8s/alpha/*/; do
+  if [ ! -f "${overlay}kustomization.yaml" ]; then
+    continue
+  fi
+  overlay_name="${overlay%/}"
+  tmp="$(mktemp -d)"
+  cp -R "${overlay}"* "$tmp/"
+  sed "s/${PUBLISH_REF_PLACEHOLDER}/${KUSTOMIZE_REF}/g" "$tmp/kustomization.yaml" >"$tmp/kustomization.yaml.sub"
+  mv "$tmp/kustomization.yaml.sub" "$tmp/kustomization.yaml"
+  echo "=== kustomize build $overlay_name (ref=$KUSTOMIZE_REF) ==="
+  if run_kustomize_build "$tmp" >/dev/null; then
+    echo "ok $overlay_name"
+  else
+    echo "FAIL $overlay_name" >&2
+    FAIL=1
+  fi
+  rm -rf "$tmp"
+done
+exit "$FAIL"
diff --git a/scripts/k8s/kustomize-build-metaboost-bases.sh b/scripts/k8s/kustomize-build-metaboost-bases.sh
index 3b9bfdbd..06a70f06 100755
--- a/scripts/k8s/kustomize-build-metaboost-bases.sh
+++ b/scripts/k8s/kustomize-build-metaboost-bases.sh
@@ -6,7 +6,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 cd "$ROOT"
 
 FAIL=0
-for d in api web management-api management-web db keyvaldb ops; do
+for d in api web management-api management-web product-membership db keyvaldb ops; do
   if kubectl kustomize "infra/k8s/base/$d" --load-restrictor LoadRestrictionsNone >/dev/null; then
     echo "ok infra/k8s/base/$d"
   else
diff --git a/scripts/llm/allowed-targets.mjs b/scripts/llm/allowed-targets.mjs
deleted file mode 100644
index 9ad2ee42..00000000
--- a/scripts/llm/allowed-targets.mjs
+++ /dev/null
@@ -1,21 +0,0 @@
-/**
- * Registries of allowed export target ids. Only these may appear under .llm/exports/<id>/.
- * Add a new id here and implement the adapter in export-from-cursor.mjs when supporting a new editor.
- * When adding an id, add matching commented-out local-path hints at the bottom of `.gitignore`.
- *
- * Naming: prefer that each id’s export tree matches that editor’s documented on-disk layout. The
- * `github-copilot` target is an exception — consumer path is the repo `.github/` directory; see
- * `.llm/exports/LLM-EXPORTS.md` (Naming convention).
- */
-export const MAX_EXPORT_TARGETS = 10;
-
-// Keep in sync with `.gitignore` `/.llm/exports/<id>/…` comment blocks and adapter wiring in `export-from-cursor.mjs`.
-export const ALLOWED_TARGET_IDS = new Set(['github-copilot', 'opencode']);
-
-export function assertTargetIdAllowed(id) {
-  if (!ALLOWED_TARGET_IDS.has(id)) {
-    throw new Error(
-      `Unknown export target "${id}". Add it to scripts/llm/allowed-targets.mjs and implement an adapter.`
-    );
-  }
-}
diff --git a/scripts/llm/export-from-cursor.mjs b/scripts/llm/export-from-cursor.mjs
deleted file mode 100644
index 5b500429..00000000
--- a/scripts/llm/export-from-cursor.mjs
+++ /dev/null
@@ -1,138 +0,0 @@
-/**
- * Deterministic export from .cursor + .cursorrules to .llm/exports/<target-id>/.
- * Usage: node scripts/llm/export-from-cursor.mjs [sync|check] [--full]
- *   sync  — write exports (default) when CI or LLM_EXPORT_ALLOW_LOCAL=1; otherwise no-op
- *   check — in CI, sync then exit 1 if .llm/exports (after git add -f) differs from HEAD; otherwise no-op
- *           (use locally or in ad-hoc scripts; the llm-exports-sync workflow no longer runs check on PRs)
- */
-import { execSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { assertTargetIdAllowed, MAX_EXPORT_TARGETS } from './allowed-targets.mjs';
-import { exportGithubCopilot } from './lib/copilot-adapter.mjs';
-import { exportOpencode } from './lib/opencode-adapter.mjs';
-import { resolveActiveVendorIds } from './vendor-config.mjs';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const repoRoot = path.resolve(__dirname, '../..');
-
-function isCi() {
-  return process.env.CI === 'true' || process.env.CI === '1';
-}
-
-/**
- * Local runs do not write unless explicitly allowed (pipeline / scripts/llm development only).
- * GitHub Actions and other environments that set CI run ungated.
- */
-function mayWriteExports() {
-  if (isCi()) {
-    return true;
-  }
-  return process.env.LLM_EXPORT_ALLOW_LOCAL === '1';
-}
-
-function discoverRegisteredTargets() {
-  const exportsRoot = path.join(repoRoot, '.llm', 'exports');
-  if (!fs.existsSync(exportsRoot)) {
-    return [];
-  }
-  const names = [];
-  for (const entry of fs.readdirSync(exportsRoot, { withFileTypes: true })) {
-    if (!entry.isDirectory()) {
-      continue;
-    }
-    if (entry.name.startsWith('.')) {
-      continue;
-    }
-    if (entry.name === '.state') {
-      continue;
-    }
-    const base = path.join(exportsRoot, entry.name);
-    const hasMarker =
-      fs.existsSync(path.join(base, '.gitkeep')) ||
-      fs.existsSync(path.join(base, '.export-target'));
-    if (!hasMarker) {
-      console.warn(
-        `Skipping .llm/exports/${entry.name}: add .gitkeep or .export-target to opt in.`
-      );
-      continue;
-    }
-    names.push(entry.name);
-  }
-  return names.sort();
-}
-
-function runAdapters(registered, { full = false } = {}) {
-  for (const id of registered) {
-    assertTargetIdAllowed(id);
-  }
-
-  for (const id of registered) {
-    const rel = path.join('.llm', 'exports', id);
-    const targetRoot = path.join(repoRoot, rel);
-    const exportPathPosix = rel.split(path.sep).join('/');
-
-    if (id === 'github-copilot') {
-      exportGithubCopilot(repoRoot, targetRoot, exportPathPosix, { full });
-    } else if (id === 'opencode') {
-      exportOpencode(repoRoot, targetRoot, exportPathPosix, { full });
-    }
-  }
-}
-
-function main() {
-  const argv = process.argv.slice(2);
-  const full = argv.includes('--full');
-  const args = argv.filter((a) => a !== '--full');
-  const cmd = args[0] || 'sync';
-
-  if (cmd !== 'sync' && cmd !== 'check') {
-    console.error('Usage: node scripts/llm/export-from-cursor.mjs [sync|check] [--full]');
-    process.exit(1);
-  }
-
-  const discovered = discoverRegisteredTargets();
-  if (discovered.length > MAX_EXPORT_TARGETS) {
-    throw new Error(
-      `Too many export targets (${discovered.length}). Max is ${MAX_EXPORT_TARGETS}. Remove a directory under .llm/exports/ or change MAX_EXPORT_TARGETS in a dedicated review.`
-    );
-  }
-
-  if (discovered.length > 0) {
-    const activeVendorIds = resolveActiveVendorIds(repoRoot);
-    console.warn(
-      `llm-exports: targets ${discovered.join(', ')} | vendors ${activeVendorIds.join(', ')}`
-    );
-
-    if (cmd === 'check' && !isCi()) {
-      console.warn(
-        'llm-exports: check skipped (CI not set). In CI this diffs .llm/exports after sync; see llm-exports-sync workflow.'
-      );
-    } else if (!mayWriteExports()) {
-      console.warn(
-        'llm-exports: export writes are disabled outside CI. Set LLM_EXPORT_ALLOW_LOCAL=1 to run sync locally (scripts/llm/ development only). See docs/development/llm/DOCS-DEVELOPMENT-LLM.md.'
-      );
-    } else {
-      runAdapters(discovered, { full });
-    }
-  } else {
-    console.warn('No registered export targets under .llm/exports/ (add <id>/.gitkeep).');
-  }
-
-  if (cmd === 'check' && isCi() && mayWriteExports() && discovered.length > 0) {
-    execSync('git add -A -f -- .llm/exports', { cwd: repoRoot, stdio: 'inherit' });
-    try {
-      execSync('git diff --quiet --exit-code HEAD', { cwd: repoRoot, stdio: 'pipe' });
-    } catch {
-      console.error(
-        'llm:exports:check: .llm/exports (including ignored paths) does not match the current commit. Merge or rebase the latest llm automation PR, or re-run on a clean tree; see docs/development/llm/.'
-      );
-      process.exit(1);
-    }
-  }
-}
-
-main();
diff --git a/scripts/llm/guard-exports-prompt.sh b/scripts/llm/guard-exports-prompt.sh
deleted file mode 100644
index b8350cd3..00000000
--- a/scripts/llm/guard-exports-prompt.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# Do not hand-commit machine-generated .llm/exports (see .llm/exports/README). Pushes to
-# develop trigger llm-exports-sync; published exports go through branch llm and its PR to
-# develop. Allow README, target .gitkeep, and .state only, unless bypass is set.
-# Does not run the full sync (keeps pre-commit fast).
-
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$REPO_ROOT" || exit 0
-
-if [[ -n "$ALLOW_DERIVED_EXPORT_EDIT" ]]; then
-  exit 0
-fi
-
-staged=$(git diff --cached --name-only 2>/dev/null || true)
-if ! echo "$staged" | grep -qE '^\.llm/exports/'; then
-  exit 0
-fi
-
-forbidden=0
-while IFS= read -r p; do
-  [[ -z "$p" ]] && continue
-  if [[ "$p" == .llm/exports/LLM-EXPORTS.md ]]; then
-    continue
-  fi
-  if [[ "$p" == .llm/exports/.state/* || "$p" == .llm/exports/.state/.gitkeep ]]; then
-    continue
-  fi
-  if [[ "$p" =~ ^\.llm/exports/[^/]+/\.gitkeep$ ]]; then
-    continue
-  fi
-  forbidden=1
-  echo "$p" >&2
-done < <(echo "$staged" | grep -E '^\.llm/exports/' || true)
-
-if [[ "$forbidden" -eq 0 ]]; then
-  exit 0
-fi
-
-cat << 'EOF' >&2
-llm-exports: You are trying to commit paths under .llm/exports that are machine exports (or not allowlisted for manual commit).
-
-Policy: .cursor/ and .cursorrules are the source of truth. The llm-exports-sync workflow runs npm run llm:exports:sync on the runner, updates branch llm, and opens/updates a PR to develop. Do not hand-commit skills/, instructions/, or copilot-instructions.md. See .llm/exports/LLM-EXPORTS.md and docs/development/llm/
-
-To bypass (rare, emergencies only): ALLOW_DERIVED_EXPORT_EDIT=1 git commit ...
-EOF
-exit 1
diff --git a/scripts/llm/lib/copilot-adapter.mjs b/scripts/llm/lib/copilot-adapter.mjs
deleted file mode 100644
index 47931bf6..00000000
--- a/scripts/llm/lib/copilot-adapter.mjs
+++ /dev/null
@@ -1,20 +0,0 @@
-import { exportCursorToGithubStyleMirror } from './github-style-adapter.mjs';
-
-/**
- * GitHub Copilot–style tree under .llm/exports/github-copilot:
- *   skills, instructions, copilot-instructions.md
- */
-
-/**
- * @param {string} repoRoot
- * @param {string} targetRoot
- * @param {string} exportPathPosix
- * @param {{ full?: boolean }} [options]
- */
-export function exportGithubCopilot(repoRoot, targetRoot, exportPathPosix, options = {}) {
-  exportCursorToGithubStyleMirror(repoRoot, targetRoot, exportPathPosix, {
-    full: options.full,
-    mainInstructionsFile: 'copilot-instructions.md',
-    adapterLabel: 'github-copilot',
-  });
-}
diff --git a/scripts/llm/lib/github-style-adapter.mjs b/scripts/llm/lib/github-style-adapter.mjs
deleted file mode 100644
index d763b383..00000000
--- a/scripts/llm/lib/github-style-adapter.mjs
+++ /dev/null
@@ -1,344 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-
-/**
- * Shared "GitHub-style" mirror: skills/, rules→instructions, root instructions file from .cursorrules.
- * Used by github-copilot and opencode export targets (portable tree under .llm/exports/<id>/).
- */
-
-function ensureDir(dirPath) {
-  fs.mkdirSync(dirPath, { recursive: true });
-}
-
-function parseFrontmatter(content) {
-  const match = content.match(/^---\n([\s\S]*?)\n---\n?/);
-  if (!match) {
-    return { frontmatter: '', body: content };
-  }
-
-  return { frontmatter: match[1], body: content.slice(match[0].length) };
-}
-
-function copyDirRecursive(src, dst) {
-  ensureDir(dst);
-
-  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
-    const sourcePath = path.join(src, entry.name);
-    const destPath = path.join(dst, entry.name);
-
-    if (entry.isDirectory()) {
-      copyDirRecursive(sourcePath, destPath);
-      continue;
-    }
-
-    if (entry.isFile()) {
-      fs.copyFileSync(sourcePath, destPath);
-    }
-  }
-}
-
-function quoteYaml(value) {
-  return `"${String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
-}
-
-function normalizeSkill(skillPath, folderName) {
-  const content = fs.readFileSync(skillPath, 'utf8');
-  const parsed = parseFrontmatter(content);
-
-  if (!parsed.frontmatter) {
-    const generated = [
-      '---',
-      `name: ${folderName}`,
-      `description: ${quoteYaml(`Converted from .cursor/skills/${folderName}/SKILL.md`)}`,
-      '---',
-      '',
-      parsed.body,
-    ].join('\n');
-    fs.writeFileSync(skillPath, generated, 'utf8');
-    return;
-  }
-
-  const lines = parsed.frontmatter.split('\n');
-  const out = [];
-  let sawName = false;
-  let sawDescription = false;
-
-  for (const line of lines) {
-    const trimmed = line.trim();
-    if (trimmed.startsWith('name:')) {
-      out.push(`name: ${folderName}`);
-      sawName = true;
-      continue;
-    }
-
-    if (trimmed.startsWith('description:')) {
-      sawDescription = true;
-    }
-
-    out.push(line);
-  }
-
-  if (!sawName) {
-    out.unshift(`name: ${folderName}`);
-  }
-
-  if (!sawDescription) {
-    out.splice(
-      1,
-      0,
-      `description: ${quoteYaml(`Converted from .cursor/skills/${folderName}/SKILL.md`)}`
-    );
-  }
-
-  const rewritten = ['---', ...out, '---', '', parsed.body].join('\n');
-  fs.writeFileSync(skillPath, rewritten, 'utf8');
-}
-
-function parseRuleFrontmatter(frontmatter) {
-  const lines = frontmatter.split('\n');
-  let description = '';
-  let alwaysApply;
-  let globs;
-
-  for (let i = 0; i < lines.length; i += 1) {
-    const current = lines[i].trim();
-
-    if (current.startsWith('description:')) {
-      description = current
-        .slice('description:'.length)
-        .trim()
-        .replace(/^['"]|['"]$/g, '');
-      continue;
-    }
-
-    if (current.startsWith('alwaysApply:')) {
-      const raw = current.slice('alwaysApply:'.length).trim().toLowerCase();
-      if (raw === 'true') {
-        alwaysApply = true;
-      } else if (raw === 'false') {
-        alwaysApply = false;
-      }
-      continue;
-    }
-
-    if (!current.startsWith('globs:')) {
-      continue;
-    }
-
-    const rest = current.slice('globs:'.length).trim();
-    if (rest === '[]') {
-      globs = [];
-      continue;
-    }
-
-    if (rest.length > 0) {
-      globs = [rest.replace(/^['"]|['"]$/g, '')];
-      continue;
-    }
-
-    const values = [];
-    let j = i + 1;
-
-    while (j < lines.length) {
-      const next = lines[j].trim();
-      if (next.length === 0) {
-        j += 1;
-        continue;
-      }
-
-      if (next.startsWith('- ')) {
-        values.push(
-          next
-            .slice(2)
-            .trim()
-            .replace(/^['"]|['"]$/g, '')
-        );
-        j += 1;
-        continue;
-      }
-
-      break;
-    }
-
-    globs = values;
-  }
-
-  return { description, alwaysApply, globs };
-}
-
-function convertRuleFile(srcFile, dstFile) {
-  const source = fs.readFileSync(srcFile, 'utf8');
-  const parsed = parseFrontmatter(source);
-  const ruleData = parseRuleFrontmatter(parsed.frontmatter || '');
-
-  const out = ['---'];
-  out.push(
-    `description: ${quoteYaml(ruleData.description || `Converted from ${path.basename(srcFile)}`)}`
-  );
-
-  const hasGlobs = Array.isArray(ruleData.globs) && ruleData.globs.length > 0;
-  if (hasGlobs) {
-    if (ruleData.globs.length === 1) {
-      out.push(`applyTo: ${quoteYaml(ruleData.globs[0])}`);
-    } else {
-      out.push('applyTo:');
-      for (const glob of ruleData.globs) {
-        out.push(`  - ${quoteYaml(glob)}`);
-      }
-    }
-  } else if (ruleData.alwaysApply === true) {
-    out.push('applyTo: "**"');
-  }
-
-  out.push('---');
-  out.push('');
-
-  ensureDir(path.dirname(dstFile));
-  fs.writeFileSync(dstFile, out.join('\n') + parsed.body, 'utf8');
-}
-
-function walkMarkdownFiles(dirPath, out = []) {
-  if (!fs.existsSync(dirPath)) {
-    return out;
-  }
-  for (const entry of fs.readdirSync(dirPath, { withFileTypes: true })) {
-    const fullPath = path.join(dirPath, entry.name);
-    if (entry.isDirectory()) {
-      walkMarkdownFiles(fullPath, out);
-      continue;
-    }
-    if (entry.isFile() && /\.(md|mdc)$/i.test(entry.name)) {
-      out.push(fullPath);
-    }
-  }
-  return out;
-}
-
-/**
- * @param {string} targetRoot - absolute path to export dir
- * @param {string} exportPathPosix - relative path from repo root, e.g. .llm/exports/github-copilot
- */
-function rewriteCursorRefsToExportRoot(targetRoot, exportPathPosix) {
-  const basePosix = exportPathPosix.replace(/\/$/, '');
-  const files = walkMarkdownFiles(targetRoot);
-  let changed = 0;
-
-  for (const filePath of files) {
-    const original = fs.readFileSync(filePath, 'utf8');
-    const updated = original
-      .replace(/\.cursor\/skills\//g, `${basePosix}/skills/`)
-      .replace(
-        /\.cursor\/rules\/([a-zA-Z0-9._-]+)\.mdc/g,
-        (_m, p1) => `${basePosix}/instructions/${p1}.instructions.md`
-      )
-      .replace(/\.cursor\/rules\//g, `${basePosix}/instructions/`);
-    if (updated !== original) {
-      fs.writeFileSync(filePath, updated, 'utf8');
-      changed += 1;
-    }
-  }
-  if (changed > 0) {
-    console.warn(`  Rewrote .cursor path references in ${changed} file(s) under ${basePosix}/`);
-  }
-}
-
-/**
- * @param {string} targetRoot
- * @param {string} mainInstructionsFile - basename only, e.g. copilot-instructions.md
- */
-function wipeGeneratedExport(targetRoot, mainInstructionsFile) {
-  const skills = path.join(targetRoot, 'skills');
-  const instructions = path.join(targetRoot, 'instructions');
-  const main = path.join(targetRoot, mainInstructionsFile);
-  if (fs.existsSync(skills)) {
-    fs.rmSync(skills, { recursive: true, force: true });
-  }
-  if (fs.existsSync(instructions)) {
-    fs.rmSync(instructions, { recursive: true, force: true });
-  }
-  if (fs.existsSync(main)) {
-    fs.unlinkSync(main);
-  }
-}
-
-/**
- * @param {string} repoRoot
- * @param {string} targetRoot
- * @param {string} exportPathPosix
- * @param {object} opts
- * @param {boolean} [opts.full]
- * @param {string} opts.mainInstructionsFile - e.g. copilot-instructions.md, opencode-instructions.md
- * @param {string} opts.adapterLabel - for log line
- */
-export function exportCursorToGithubStyleMirror(
-  repoRoot,
-  targetRoot,
-  exportPathPosix,
-  { full = false, mainInstructionsFile, adapterLabel }
-) {
-  if (full) {
-    wipeGeneratedExport(targetRoot, mainInstructionsFile);
-  }
-
-  const cursorDir = path.join(repoRoot, '.cursor');
-  const skillsSrc = path.join(cursorDir, 'skills');
-  const rulesSrc = path.join(cursorDir, 'rules');
-
-  const skillsDst = path.join(targetRoot, 'skills');
-  const instructionsDst = path.join(targetRoot, 'instructions');
-
-  ensureDir(skillsDst);
-  ensureDir(instructionsDst);
-
-  let skillCount = 0;
-  if (fs.existsSync(skillsSrc)) {
-    for (const entry of fs.readdirSync(skillsSrc, { withFileTypes: true })) {
-      if (!entry.isDirectory()) {
-        continue;
-      }
-
-      const src = path.join(skillsSrc, entry.name);
-      const dst = path.join(skillsDst, entry.name);
-      copyDirRecursive(src, dst);
-
-      const skillFile = path.join(dst, 'SKILL.md');
-      if (fs.existsSync(skillFile)) {
-        normalizeSkill(skillFile, entry.name);
-      }
-
-      skillCount += 1;
-    }
-  }
-
-  let ruleCount = 0;
-  if (fs.existsSync(rulesSrc)) {
-    for (const entry of fs.readdirSync(rulesSrc, { withFileTypes: true })) {
-      if (!entry.isFile() || !entry.name.endsWith('.mdc')) {
-        continue;
-      }
-
-      const src = path.join(rulesSrc, entry.name);
-      const dst = path.join(instructionsDst, entry.name.replace(/\.mdc$/, '.instructions.md'));
-      convertRuleFile(src, dst);
-      ruleCount += 1;
-    }
-  }
-
-  const cursorRules = path.join(repoRoot, '.cursorrules');
-  if (fs.existsSync(cursorRules)) {
-    const source = fs.readFileSync(cursorRules, 'utf8');
-    const converted = [
-      '<!-- Generated from .cursorrules — do not edit this file. Source: .cursorrules -->',
-      '<!-- Re-run: npm run llm:exports:sync (see docs/development/llm/) -->',
-      '',
-      source,
-    ].join('\n');
-    fs.writeFileSync(path.join(targetRoot, mainInstructionsFile), converted, 'utf8');
-  }
-
-  rewriteCursorRefsToExportRoot(targetRoot, exportPathPosix);
-
-  console.warn(
-    `  ${adapterLabel}: ${skillCount} skills, ${ruleCount} instruction files → ${path.relative(repoRoot, targetRoot)}`
-  );
-}
diff --git a/scripts/llm/lib/opencode-adapter.mjs b/scripts/llm/lib/opencode-adapter.mjs
deleted file mode 100644
index bfa12dde..00000000
--- a/scripts/llm/lib/opencode-adapter.mjs
+++ /dev/null
@@ -1,20 +0,0 @@
-import { exportCursorToGithubStyleMirror } from './github-style-adapter.mjs';
-
-/**
- * Portable mirror for OpenCode-oriented workflows (same on-disk shape as github-copilot).
- * OpenCode’s native project layout uses `.opencode/skills/…`; this export is a stable repo mirror — see EXPORT-TARGETS.md.
- */
-
-/**
- * @param {string} repoRoot
- * @param {string} targetRoot
- * @param {string} exportPathPosix
- * @param {{ full?: boolean }} [options]
- */
-export function exportOpencode(repoRoot, targetRoot, exportPathPosix, options = {}) {
-  exportCursorToGithubStyleMirror(repoRoot, targetRoot, exportPathPosix, {
-    full: options.full,
-    mainInstructionsFile: 'opencode-instructions.md',
-    adapterLabel: 'opencode',
-  });
-}
diff --git a/scripts/llm/vendor-config.mjs b/scripts/llm/vendor-config.mjs
deleted file mode 100644
index ba023823..00000000
--- a/scripts/llm/vendor-config.mjs
+++ /dev/null
@@ -1,66 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-
-/**
- * Local `llm:vendors` “which editors matter” (plus required `cursor`).
- * Export **target** ids for generated trees are separate — see `allowed-targets.mjs`
- * (e.g. `github-copilot` is a Copilot export layout, not a “vendor” here).
- */
-export const SUPPORTED_VENDOR_IDS = ['cursor', 'vscode', 'opencode'];
-export const REQUIRED_VENDOR_ID = 'cursor';
-export const STATE_RELATIVE_PATH = path.join('.llm', 'local', 'vendors.json');
-
-function uniq(ids) {
-  return [...new Set(ids)];
-}
-
-export function normalizeVendorIds(ids) {
-  const filtered = uniq(
-    (ids || []).filter((id) => typeof id === 'string' && SUPPORTED_VENDOR_IDS.includes(id))
-  );
-  if (!filtered.includes(REQUIRED_VENDOR_ID)) {
-    filtered.unshift(REQUIRED_VENDOR_ID);
-  }
-  return filtered;
-}
-
-export function getStatePath(repoRoot) {
-  return path.join(repoRoot, STATE_RELATIVE_PATH);
-}
-
-export function readLocalVendorState(repoRoot) {
-  const statePath = getStatePath(repoRoot);
-  if (!fs.existsSync(statePath)) {
-    return null;
-  }
-
-  try {
-    const parsed = JSON.parse(fs.readFileSync(statePath, 'utf8'));
-    return normalizeVendorIds(parsed.activeVendors || []);
-  } catch {
-    return null;
-  }
-}
-
-export function writeLocalVendorState(repoRoot, activeVendors) {
-  const statePath = getStatePath(repoRoot);
-  fs.mkdirSync(path.dirname(statePath), { recursive: true });
-
-  const payload = {
-    version: 1,
-    activeVendors: normalizeVendorIds(activeVendors),
-    lastUpdatedAt: new Date().toISOString(),
-  };
-
-  fs.writeFileSync(statePath, `${JSON.stringify(payload, null, 2)}\n`, 'utf8');
-  return statePath;
-}
-
-export function resolveActiveVendorIds(repoRoot) {
-  const local = readLocalVendorState(repoRoot);
-  if (local && local.length > 0) {
-    return local;
-  }
-
-  return normalizeVendorIds([REQUIRED_VENDOR_ID]);
-}
diff --git a/scripts/llm/vendor-selector.mjs b/scripts/llm/vendor-selector.mjs
deleted file mode 100644
index 7a8b10a4..00000000
--- a/scripts/llm/vendor-selector.mjs
+++ /dev/null
@@ -1,124 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import readline from 'node:readline/promises';
-import { fileURLToPath } from 'node:url';
-
-import {
-  normalizeVendorIds,
-  readLocalVendorState,
-  REQUIRED_VENDOR_ID,
-  resolveActiveVendorIds,
-  SUPPORTED_VENDOR_IDS,
-  writeLocalVendorState,
-} from './vendor-config.mjs';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const repoRoot = path.resolve(__dirname, '../..');
-
-function out(message = '') {
-  process.stdout.write(`${message}\n`);
-}
-
-function printMenu(active) {
-  const activeSet = new Set(active);
-  out('\nLLM vendors (local-only selection):');
-  SUPPORTED_VENDOR_IDS.forEach((vendorId, index) => {
-    const enabled = activeSet.has(vendorId);
-    const lock = vendorId === REQUIRED_VENDOR_ID ? ' (required)' : '';
-    out(`${index + 1}. [${enabled ? 'x' : ' '}] ${vendorId}${lock}`);
-  });
-  out('\nType a number (or comma-separated numbers) to toggle.');
-  out('Type "s" to save, "q" to quit without changes.');
-}
-
-function parseSetArg(argv) {
-  const idx = argv.indexOf('--set');
-  if (idx === -1) {
-    return null;
-  }
-  const raw = argv[idx + 1] || '';
-  const list = raw
-    .split(',')
-    .map((v) => v.trim())
-    .filter(Boolean);
-  return normalizeVendorIds(list);
-}
-
-function toggleByIndex(active, index) {
-  if (index < 0 || index >= SUPPORTED_VENDOR_IDS.length) {
-    return active;
-  }
-
-  const target = SUPPORTED_VENDOR_IDS[index];
-  if (target === REQUIRED_VENDOR_ID) {
-    return normalizeVendorIds(active);
-  }
-
-  const set = new Set(active);
-  if (set.has(target)) {
-    set.delete(target);
-  } else {
-    set.add(target);
-  }
-  return normalizeVendorIds([...set]);
-}
-
-async function runInteractive() {
-  let active = readLocalVendorState(repoRoot) || resolveActiveVendorIds(repoRoot);
-
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-
-  while (true) {
-    printMenu(active);
-    const answer = (await rl.question('selection> ')).trim().toLowerCase();
-
-    if (answer === 'q') {
-      out('No changes saved.');
-      rl.close();
-      return;
-    }
-
-    if (answer === 's' || answer === '') {
-      const statePath = writeLocalVendorState(repoRoot, active);
-      out(`Saved active vendors to ${path.relative(repoRoot, statePath)}`);
-      rl.close();
-      return;
-    }
-
-    const parts = answer
-      .split(',')
-      .map((v) => Number.parseInt(v.trim(), 10))
-      .filter((n) => Number.isFinite(n));
-
-    if (parts.length === 0) {
-      out('Invalid selection.');
-      continue;
-    }
-
-    let next = active;
-    for (const n of parts) {
-      next = toggleByIndex(next, n - 1);
-    }
-    active = next;
-  }
-}
-
-async function main() {
-  const setArg = parseSetArg(process.argv.slice(2));
-  if (setArg) {
-    const statePath = writeLocalVendorState(repoRoot, setArg);
-    out(`Saved active vendors to ${path.relative(repoRoot, statePath)}`);
-    return;
-  }
-
-  await runInteractive();
-}
-
-main().catch((error) => {
-  console.error(error);
-  process.exit(1);
-});
diff --git a/scripts/local-env/setup.sh b/scripts/local-env/setup.sh
index c21d5f5e..842ee503 100755
--- a/scripts/local-env/setup.sh
+++ b/scripts/local-env/setup.sh
@@ -334,6 +334,33 @@ if [ -n "$_locale_np_supported" ]; then
   upsert_var "$MANAGEMENT_WEB_SIDECAR_APP_ENV" "NEXT_PUBLIC_SUPPORTED_LOCALES" "$_locale_np_supported"
 fi
 
+# From notifications.env: Web Push / VAPID (optional). Existing non-empty values are preserved by apply_override semantics.
+apply_override "WEBPUSH_ENABLED" "$API_APP_ENV" "$API_INFRA_ENV"
+apply_override "WEBPUSH_VAPID_PUBLIC_KEY" "$API_APP_ENV" "$API_INFRA_ENV"
+apply_override "WEBPUSH_VAPID_PRIVATE_KEY" "$API_APP_ENV" "$API_INFRA_ENV"
+apply_override "WEBPUSH_VAPID_SUBJECT" "$API_APP_ENV" "$API_INFRA_ENV"
+apply_override "API_WEB_PUSH_VAPID_PUBLIC_KEY" "$API_APP_ENV" "$API_INFRA_ENV"
+apply_override "API_WEB_PUSH_VAPID_PRIVATE_KEY" "$API_APP_ENV" "$API_INFRA_ENV"
+apply_override "API_WEB_PUSH_VAPID_CONTACT" "$API_APP_ENV" "$API_INFRA_ENV"
+_wp_np_pub="${NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY:-${WEBPUSH_VAPID_PUBLIC_KEY:-${API_WEB_PUSH_VAPID_PUBLIC_KEY:-${NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY:-}}}}"
+_wp_np_enabled="${NEXT_PUBLIC_WEBPUSH_ENABLED:-${WEBPUSH_ENABLED:-}}"
+if [ -n "$_wp_np_pub" ]; then
+  upsert_var "$WEB_APP_ENV" "NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY" "$_wp_np_pub"
+  upsert_var "$WEB_INFRA_ENV" "NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY" "$_wp_np_pub"
+  upsert_var "$WEB_SIDECAR_INFRA_ENV" "NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY" "$_wp_np_pub"
+  upsert_var "$WEB_SIDECAR_APP_ENV" "NEXT_PUBLIC_WEBPUSH_VAPID_PUBLIC_KEY" "$_wp_np_pub"
+  upsert_var "$WEB_APP_ENV" "NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY" "$_wp_np_pub"
+  upsert_var "$WEB_INFRA_ENV" "NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY" "$_wp_np_pub"
+  upsert_var "$WEB_SIDECAR_INFRA_ENV" "NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY" "$_wp_np_pub"
+  upsert_var "$WEB_SIDECAR_APP_ENV" "NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY" "$_wp_np_pub"
+fi
+if [ -n "$_wp_np_enabled" ]; then
+  upsert_var "$WEB_APP_ENV" "NEXT_PUBLIC_WEBPUSH_ENABLED" "$_wp_np_enabled"
+  upsert_var "$WEB_INFRA_ENV" "NEXT_PUBLIC_WEBPUSH_ENABLED" "$_wp_np_enabled"
+  upsert_var "$WEB_SIDECAR_INFRA_ENV" "NEXT_PUBLIC_WEBPUSH_ENABLED" "$_wp_np_enabled"
+  upsert_var "$WEB_SIDECAR_APP_ENV" "NEXT_PUBLIC_WEBPUSH_ENABLED" "$_wp_np_enabled"
+fi
+
 echo "Applied local env values from generated defaults and overrides."
 
 # Sidecar env: two independent outputs seeded from canonical templates/examples.
diff --git a/scripts/publish/bump-version.sh b/scripts/publish/bump-version.sh
index 8f3cc330..d8389258 100755
--- a/scripts/publish/bump-version.sh
+++ b/scripts/publish/bump-version.sh
@@ -18,8 +18,9 @@ cd "$REPO_ROOT"
 
 echo -e "${YELLOW}Running security audit (moderate and above; low permitted)...${NC}"
 
-# Call shared audit gate utility
-# See docs/development/NPM-AUDIT-ALLOWLIST.md for rationale on any allowlisted advisories
+# Call shared audit gate utility (strict: no allowlisted IDs).
+# See docs/development/NPM-AUDIT-ALLOWLIST.md — Podverse allowlists 1117015 for nested next/postcss;
+# Metaboost uses strict mode until an advisory is documented here.
 if ! "$SCRIPT_DIR/../lib/check-audit-gate.sh" "" "release"; then
   echo -e "${RED}Error: npm audit found disallowed moderate or higher vulnerabilities. Fix them before bumping version.${NC}"
   exit 1
@@ -42,23 +43,6 @@ if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
   exit 1
 fi
 
-CHANGELOG_DIR="$REPO_ROOT/docs/development/CHANGELOGS"
-CHANGELOG_FILE="$CHANGELOG_DIR/$VERSION.md"
-
-mkdir -p "$CHANGELOG_DIR"
-if [[ ! -f "$CHANGELOG_FILE" ]]; then
-  cat > "$CHANGELOG_FILE" << EOF
-# Changelog $VERSION
-
-_Update this file continuously during development for version $VERSION._
-
-## Highlights
-
-- Add notable changes for this version.
-EOF
-  echo -e "${GREEN}Created changelog file:${NC} $CHANGELOG_FILE"
-fi
-
 CURRENT_BRANCH=$(git branch --show-current)
 echo -e "${YELLOW}Bumping version to $VERSION on branch '$CURRENT_BRANCH'...${NC}"
 
@@ -108,7 +92,6 @@ for ws in $WORKSPACES; do
     git add "$ws/package-lock.json"
   fi
 done
-git add "$CHANGELOG_FILE"
 
 git commit --no-verify -m "chore: bump version to $VERSION"
 echo -e "${YELLOW}Pushing to origin/$CURRENT_BRANCH...${NC}"
diff --git a/scripts/start-feature.sh b/scripts/start-feature.sh
index d1d974f2..fd851c90 100755
--- a/scripts/start-feature.sh
+++ b/scripts/start-feature.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # Metaboost Start Feature Script
-# Creates a properly named branch with aligned LLM history file
+# Creates a properly named git branch (optional LLM history scaffold disabled; see docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md)
 
 CYAN='\033[0;36m'
 GREEN='\033[0;32m'
@@ -14,13 +14,17 @@ echo ""
 
 # 1. Feature type
 echo -e "${CYAN}Select feature type:${NC}"
-select TYPE in feature fix chore docs hotfix release; do
+select TYPE in feature fix chore docs hotfix release llm; do
   [[ -n "$TYPE" ]] && break
 done
 
 # 2. Short name
 echo ""
-read -p "Short name (kebab-case, e.g., add-podcast-chapters): " NAME
+if [[ "$TYPE" == "llm" ]]; then
+  read -p "Short name (kebab-case, e.g., abcmemory-vocabulary): " NAME
+else
+  read -p "Short name (kebab-case, e.g., add-podcast-chapters): " NAME
+fi
 
 # Validate kebab-case
 if [[ ! "$NAME" =~ ^[a-z][a-z0-9-]*$ ]]; then
@@ -84,67 +88,15 @@ fi
 
 git checkout -b "$BRANCH"
 
-# 6. Create history directory and file
-# Note: Always use -part-01 suffix to support the 10-session limit rule
-# (see .cursor/rules/llm-history-tracking.mdc)
-HISTORY_DIR=".llm/history/active/$NAME"
-HISTORY_FILE="$HISTORY_DIR/$NAME-part-01.md"
-DATE=$(date +%Y-%m-%d)
-AUTHOR=$(git config user.name || echo "Unknown")
-
-# Create feature-specific directory
-mkdir -p "$HISTORY_DIR"
-
-cat > "$HISTORY_FILE" << EOF
-# Feature: $NAME (Part 1)
-
-> **Note**: This LLM history file is optional. If you're not using LLM assistance for development, you can delete this file and the containing directory. The history tracking system helps document LLM-assisted decisions but is not required for contributing.
-> 
-> **10-Session Limit**: Each part file is limited to 10 sessions. When adding Session 11, create \`$NAME-part-02.md\`.
-
-## Metadata
-- Started: $DATE
-- Completed: In Progress
-- Author: $AUTHOR
-- LLM(s): Cursor, Claude, etc.
-- GitHub Issues: ${ISSUE_URLS:-None}
-- Branch: $BRANCH
-- Origin: $ORIGIN
-- Is Fork: $IS_FORK
-
-## Context
-
-[What problem does this solve? What's the goal?]
-
-## Sessions
-
-### Session 1 - $DATE
-
-#### Prompt (Developer)
-[First prompt will go here]
-
-#### Key Decisions
-- [Decision and rationale]
-
-#### Files Changed
-- [List of files]
-
----
-
-## Related Resources
-
-- [Link to PR]
-- [Link to related issues]
-EOF
+# Optional LLM history scaffold disabled (previously wrote .llm/history/active/$NAME/$NAME-part-01.md).
+# See docs/development/llm/LLM-HISTORY-WORKFLOW-ARCHIVE.md if you maintain notes manually.
 
 echo ""
 echo -e "${GREEN}════════════════════════════════════════════════════════════${NC}"
 echo -e "${GREEN}✓ Branch created: $BRANCH${NC}"
-echo -e "${GREEN}✓ History file created: $HISTORY_FILE${NC}"
 echo -e "${GREEN}════════════════════════════════════════════════════════════${NC}"
 echo ""
 echo -e "${CYAN}Next steps:${NC}"
-echo "  1. Edit $HISTORY_FILE to add Context"
-echo "  2. Start working with your LLM"
-echo "  3. Push and open a PR when done (history is auto-completed on merge)"
+echo "  1. Start working on your branch"
+echo "  2. Push and open a PR when done"
 echo ""
diff --git a/tools/generate-data/src/management/seed.ts b/tools/generate-data/src/management/seed.ts
index da5d53f5..b4db43bc 100644
--- a/tools/generate-data/src/management/seed.ts
+++ b/tools/generate-data/src/management/seed.ts
@@ -113,6 +113,7 @@ function personaPermissions(persona: AdminPersona): CrudMatrix {
       bucketsCrud: 15,
       bucketMessagesCrud: 15,
       bucketAdminsCrud: 15,
+      billingPricesCrud: 15,
     };
   }
   if (persona === 'read-only') {
@@ -122,6 +123,7 @@ function personaPermissions(persona: AdminPersona): CrudMatrix {
       bucketsCrud: 2,
       bucketMessagesCrud: 2,
       bucketAdminsCrud: 2,
+      billingPricesCrud: 2,
     };
   }
   if (persona === 'bucket-focused') {
@@ -131,6 +133,7 @@ function personaPermissions(persona: AdminPersona): CrudMatrix {
       bucketsCrud: 15,
       bucketMessagesCrud: 15,
       bucketAdminsCrud: 7,
+      billingPricesCrud: 0,
     };
   }
   if (persona === 'bucket-admin-management-only') {
@@ -140,6 +143,7 @@ function personaPermissions(persona: AdminPersona): CrudMatrix {
       bucketsCrud: 2,
       bucketMessagesCrud: 2,
       bucketAdminsCrud: 15,
+      billingPricesCrud: 0,
     };
   }
   return {
@@ -148,6 +152,7 @@ function personaPermissions(persona: AdminPersona): CrudMatrix {
     bucketsCrud: 2,
     bucketMessagesCrud: 2,
     bucketAdminsCrud: 0,
+    billingPricesCrud: 0,
   };
 }
 
@@ -306,6 +311,7 @@ export async function seedManagement(options: SeedRuntimeOptions): Promise<void>
     assertCrudMask('bucketsCrud', permissions.bucketsCrud);
     assertCrudMask('bucketMessagesCrud', permissions.bucketMessagesCrud);
     assertCrudMask('bucketAdminsCrud', permissions.bucketAdminsCrud);
+    assertCrudMask('billingPricesCrud', permissions.billingPricesCrud);
 
     await managementDataSource.transaction(async (manager) => {
       await manager.query('SET CONSTRAINTS ALL DEFERRED');
@@ -341,6 +347,7 @@ export async function seedManagement(options: SeedRuntimeOptions): Promise<void>
           bucketsCrud: permissions.bucketsCrud,
           bucketMessagesCrud: permissions.bucketMessagesCrud,
           bucketAdminsCrud: permissions.bucketAdminsCrud,
+          billingPricesCrud: permissions.billingPricesCrud,
           eventVisibility: persona === 'event-limited' ? 'own' : randomEventVisibility(),
         })
       );
@@ -358,6 +365,7 @@ export async function seedManagement(options: SeedRuntimeOptions): Promise<void>
         bucketsCrud: faker.helpers.arrayElement([2, 3, 6, 7, 15]),
         bucketMessagesCrud: faker.helpers.arrayElement([2, 3, 6, 7, 15]),
         bucketAdminsCrud: faker.helpers.arrayElement([2, 3, 6, 7, 15]),
+        billingPricesCrud: faker.helpers.arrayElement([2, 3, 6, 7, 15]),
         eventVisibility: randomEventVisibility(),
       })
     );
diff --git a/tools/generate-data/src/types.ts b/tools/generate-data/src/types.ts
index 30dcc09f..684429a8 100644
--- a/tools/generate-data/src/types.ts
+++ b/tools/generate-data/src/types.ts
@@ -18,6 +18,7 @@ export type CrudMatrix = {
   bucketsCrud: number;
   bucketMessagesCrud: number;
   bucketAdminsCrud: number;
+  billingPricesCrud: number;
 };
 
 export type MainProfileCardinality = {
diff --git a/tools/web/seed-e2e.mjs b/tools/web/seed-e2e.mjs
index f5ea1054..34ac2138 100644
--- a/tools/web/seed-e2e.mjs
+++ b/tools/web/seed-e2e.mjs
@@ -41,6 +41,8 @@ const E2E_USER8_ID_TEXT = 'e2eusr000008';
 const E2E_USER9_ID_TEXT = 'e2eusr000009';
 const E2E_BUCKET1_ID_TEXT = 'e2ebkt000001';
 const E2E_BUCKET2_ID_TEXT = 'e2ebkt000002';
+const E2E_BUCKET3_ID = '22222222-2222-4222-a222-222222222333';
+const E2E_BUCKET3_ID_TEXT = 'e2ebkt000003';
 const E2E_EMAIL = 'e2e-bucket-owner@example.com';
 const E2E_EMAIL2 = 'e2e-bucket-admin@example.com';
 const E2E_EMAIL3 = 'e2e-admin-without-permission@example.com';
@@ -55,6 +57,8 @@ const CURRENT_TERMS_ENFORCEMENT_AT = '2026-01-01T00:00:00.000Z';
 const LEGACY_TERMS_ENFORCEMENT_AT = '2025-01-01T00:00:00.000Z';
 /** Intentionally overdue for lazy rollover tests: upcoming should auto-promote on auth reads. */
 const UPCOMING_TERMS_ENFORCEMENT_AT = '2026-01-02T00:00:00.000Z';
+/** Active membership for seeded personas; requireAuth rejects null membership_expires_at. */
+const E2E_MEMBERSHIP_EXPIRES_AT = '2099-12-31T23:59:59.000Z';
 /** Raw token for set-password E2E; must match apps/web/e2e/helpers/setPasswordToken.ts */
 const E2E_SET_PASSWORD_TOKEN_RAW = 'e2e1' + '0'.repeat(28);
 /** Raw token for verify-email E2E; must match apps/web/e2e/helpers/verifyEmailToken.ts */
@@ -206,6 +210,20 @@ async function main() {
       E2E_USER9_ID,
       E2E_DISPLAY_NAME9,
     ]);
+    await client.query(
+      `INSERT INTO user_trust_settings (
+         user_id,
+         membership_tier,
+         membership_expires_at,
+         auto_renew,
+         created_at,
+         updated_at
+       )
+       SELECT id, 'premium', $1::timestamp, false, NOW(), NOW()
+       FROM "user"
+       WHERE id_text LIKE 'e2eusr%'`,
+      [E2E_MEMBERSHIP_EXPIRES_AT]
+    );
     await client.query('TRUNCATE terms_version RESTART IDENTITY CASCADE;');
     const termsVersionRows = await client.query(
       `INSERT INTO terms_version (
@@ -299,6 +317,11 @@ async function main() {
        VALUES ($1, $2, 'E2E Bucket Two', false, NULL, $3, NOW(), NOW())`,
       [E2E_BUCKET2_ID, E2E_USER_ID, E2E_BUCKET2_ID_TEXT]
     );
+    await client.query(
+      `INSERT INTO bucket (id, owner_id, name, type, is_public, parent_bucket_id, id_text, created_at, updated_at)
+       VALUES ($1, $2, 'E2E Bucket One Child', 'mb-mid', true, $3, $4, NOW(), NOW())`,
+      [E2E_BUCKET3_ID, E2E_USER_ID, E2E_BUCKET1_ID, E2E_BUCKET3_ID_TEXT]
+    );
     await client.query(
       `INSERT INTO bucket_admin (bucket_id, user_id, bucket_crud, bucket_messages_crud, bucket_admins_crud, created_at)
        VALUES ($1, $2, $3, 2, 2, NOW())`,
@@ -346,7 +369,7 @@ async function main() {
       [E2E_USER_ID, confirmEmailChangeTokenHash, confirmEmailChangeExpiresAt, emailChangePayload]
     );
     console.log(
-      'E2E web seed done: 9 users (owner, admin-with-permission, admin-without-permission, non-admin, invite, terms-accept, terms-delete, settings-delete, terms-upcoming-ux), seeded terms versions (legacy/current/upcoming) and acceptance states, 2 buckets, 3 bucket admins, set_password, email_verify, and email_change tokens.'
+      'E2E web seed done: 9 users (owner, admin-with-permission, admin-without-permission, non-admin, invite, terms-accept, terms-delete, settings-delete, terms-upcoming-ux) with active premium membership through 2099, seeded terms versions (legacy/current/upcoming) and acceptance states, 3 buckets (including one mb-mid child under Bucket One), 3 bucket admins, set_password, email_verify, and email_change tokens.'
     );
   } finally {
     await client.end();