diff --git a/.github/config/.files.yaml b/.github/config/.files.yaml
index e6e4f08230..b5cc0527b0 100644
--- a/.github/config/.files.yaml
+++ b/.github/config/.files.yaml
@@ -1,7 +1,7 @@
-# CI routing infra. Editing the top-level router (build.yml) or this filter
-# config re-runs every area's jobs, so every job-gating filter below includes
-# *ci. That makes a change to how jobs are dispatched actually exercise those
-# jobs (self-testing), instead of a router edit only matching the project filter.
+# CI routing infrastructure. Changes to the top-level router (build.yml) or
+# this filter configuration rerun every area's jobs. Every job-gating filter
+# therefore includes *ci, so routing changes exercise the jobs they affect
+# instead of matching only the project filter.
 ci: &ci
   - .github/workflows/build.yml
   - .github/config/.files.yaml
@@ -24,9 +24,9 @@ openapi: &openapi
 docker-base: &docker-base
   - docker/base/Dockerfile
 
-# Dockerfiles only (base + embedded + unoserver). Gates the slow multi-arch
-# (arm64) leg of the PR docker test build: arm64 is only rebuilt when a
-# Dockerfile itself changes, not on every code PR.
+# Dockerfiles only (base, embedded, and unoserver). The slow multi-architecture
+# (arm64) leg of the PR Docker test build runs only when a Dockerfile changes,
+# rather than for every code PR.
 dockerfiles: &dockerfiles
   - docker/**/Dockerfile*
 
@@ -68,7 +68,6 @@ project: &project
 frontend: &frontend
   - *ci
   - frontend/**
-  - .github/workflows/testdriver.yml
   - testing/**
   - docker/**
   - scripts/translations/*.py
@@ -88,8 +87,8 @@ frontend: &frontend
   - .github/workflows/e2e-stubbed.yml
   - .github/workflows/e2e-live.yml
 
-# Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
-# job on changes to any of these.
+# Files that affect the Tauri desktop bundle. Changes to any of these files
+# trigger the multi-OS Tauri build job.
 tauri: &tauri
   - *ci
   - frontend/editor/src-tauri/**
@@ -102,9 +101,9 @@ tauri: &tauri
   - Taskfile.yml
   - .taskfiles/desktop.yml
 
-# Files that affect the AI engine (Python tool models, fixers, tests). Gate
-# the engine validation job on changes to engine sources or to the Java
-# tool surfaces it generates models from.
+# Files that affect the AI engine, including its Python tool models, fixers,
+# and tests. The engine validation job also runs when the Java tool surfaces
+# used to generate those models change.
 engine: &engine
   - *ci
   - engine/**
@@ -114,10 +113,10 @@ engine: &engine
   - .taskfiles/engine.yml
 
 # Files that can make the committed generated API models (frontend tool API
-# types + engine tool models) go stale: the Java tool surfaces they derive from,
-# the generators, the generated files themselves (to catch a hand-edit), and the
-# tasks that drive generation. Deliberately excludes the broad frontend/docker/
-# testing globs, so a CSS-only PR does not boot the backend to rebuild the spec.
+# types and engine tool models) stale: their Java sources, generators,
+# generated outputs (to catch hand edits), and generation tasks. Broad
+# frontend, Docker, and testing globs are intentionally excluded, so a CSS-only
+# PR does not start the backend to rebuild the specification.
 generated-models: &generated-models
   - *ci
   - *openapi
@@ -141,8 +140,8 @@ licenses-backend: &licenses-backend
   - ".github/workflows/frontend-backend-licenses-update.yml"
   - *build
 
-# Files that can affect premium / enterprise behaviour. Gate the enterprise
-# Playwright job on changes to any of these on PRs.
+# Files that can affect premium or enterprise behaviour. Changes to any of
+# these files trigger the enterprise Playwright job for pull requests.
 proprietary: &proprietary
   - *ci
   - app/proprietary/**
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 21a47ac6c0..92de1d9503 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,6 +11,8 @@ updates:
       - "/app/common"
       - "/app/core"
       - "/app/proprietary"
+      - "/app/saas"
+      - "/buildSrc"
     schedule:
       interval: "weekly"
     cooldown:
diff --git a/.github/workflows/PR-Auto-Deploy-V2.yml b/.github/workflows/PR-Auto-Deploy-V2.yml
index 50be9fe4cf..4375b1b8b0 100644
--- a/.github/workflows/PR-Auto-Deploy-V2.yml
+++ b/.github/workflows/PR-Auto-Deploy-V2.yml
@@ -26,6 +26,10 @@ jobs:
   check-pr:
     if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    # Only reads the PR via pulls.get with the default GITHUB_TOKEN.
+    permissions:
+      contents: read
+      pull-requests: read
     outputs:
       should_deploy: ${{ steps.decide.outputs.should_deploy }}
       is_fork: ${{ steps.resolve.outputs.is_fork }}
@@ -35,7 +39,7 @@ jobs:
       pr_ref: ${{ steps.resolve.outputs.ref }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -97,6 +101,7 @@ jobs:
           echo "allow_fork=${allow_fork:-false}" >> $GITHUB_OUTPUT
 
   deploy-v2-pr:
+    environment: pr-preview
     needs: check-pr
     runs-on: ubuntu-latest
     if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
@@ -107,6 +112,7 @@ jobs:
     permissions:
       contents: read
       issues: write
+      packages: write
       pull-requests: write
     env:
       # Single source of truth for whether this preview embeds the admin portal:
@@ -115,7 +121,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -125,20 +131,11 @@ jobs:
           repository: ${{ github.repository }}
           ref: main
 
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - name: Add deployment started comment
         id: deployment-started
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ needs.check-pr.outputs.pr_number }};
@@ -180,7 +177,8 @@ jobs:
         with:
           repository: ${{ needs.check-pr.outputs.pr_repository }}
           ref: ${{ needs.check-pr.outputs.pr_ref }}
-          token: ${{ secrets.GITHUB_TOKEN }}
+          # untrusted tree is built below - never leave credentials in .git/config
+          persist-credentials: false
           fetch-depth: 0 # Fetch full history for commit hash detection
 
       - name: Set up Docker Buildx
@@ -192,11 +190,16 @@ jobs:
           VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
           echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Login to Docker Hub
+      - name: Login to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Convert repository owner to lowercase
+        id: repoowner
+        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
 
       - name: Get commit hash for app
         id: commit-hash
@@ -220,7 +223,7 @@ jobs:
       - name: Check if image exists
         id: check-image
         run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
+          if docker manifest inspect ${IMAGE_BASE}:v2-${{ steps.commit-hash.outputs.app_short }} >/dev/null 2>&1; then
             echo "exists=true" >> $GITHUB_OUTPUT
             echo "Image already exists, skipping build"
           else
@@ -228,6 +231,8 @@ jobs:
             echo "Image needs to be built"
           fi
 
+        env:
+          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
       - name: Build and push V2 image
         if: steps.check-image.outputs.exists == 'false'
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -237,7 +242,7 @@ jobs:
           push: true
           cache-from: type=gha,scope=stirling-pdf-latest
           cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
+          tags: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:v2-${{ steps.commit-hash.outputs.app_short }}
           build-args: |
             VERSION_TAG=v2-alpha
             BUILD_PORTAL=${{ env.BUILD_PORTAL }}
@@ -246,9 +251,11 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${NEW_VPS_SSH_KEY}" > ../private.key
           sudo chmod 600 ../private.key
 
+        env:
+          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
       - name: Deploy V2 to VPS
         id: deploy
         run: |
@@ -261,7 +268,7 @@ jobs:
           services:
             stirling-pdf-v2:
               container_name: stirling-pdf-v2-pr-${{ needs.check-pr.outputs.pr_number }}
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
+              image: ${IMAGE_BASE}:v2-${{ steps.commit-hash.outputs.app_short }}
               ports:
                 - "${V2_PORT}:8080"
               volumes:
@@ -273,8 +280,8 @@ jobs:
                 DISABLE_ADDITIONAL_FEATURES: "false"
                 STIRLING_BILLING_ACCOUNT_LINK_ENABLED: "true"
                 SECURITY_ENABLELOGIN: "true"
-                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
-                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
+                SECURITY_INITIALLOGIN_USERNAME: "${TEST_LOGIN_USERNAME}"
+                SECURITY_INITIALLOGIN_PASSWORD: "${TEST_LOGIN_PASSWORD}"
                 SYSTEM_DEFAULTLOCALE: en-US
                 UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                 UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
@@ -288,9 +295,9 @@ jobs:
           EOF
 
           # Deploy to VPS
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose-v2.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${NEW_VPS_USERNAME}@${NEW_VPS_HOST}:/tmp/docker-compose-v2.yml
 
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << ENDSSH
             # Create V2 PR-specific directories
             mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}
 
@@ -315,12 +322,19 @@ jobs:
           # Set port for output
           echo "v2_port=${V2_PORT}" >> $GITHUB_OUTPUT
 
+        env:
+          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
+          TEST_LOGIN_USERNAME: ${{ secrets.TEST_LOGIN_USERNAME }}
+          TEST_LOGIN_PASSWORD: ${{ secrets.TEST_LOGIN_PASSWORD }}
+          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
+          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
+
       # ---- Storybook preview (only when this PR touches stories/.storybook) ----
       # Runs inside the same approved-contributor-gated deploy job, so it deploys
       # under the exact same access rules as the app preview.
       - name: Detect Storybook changes
         id: sb-changes
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           list-files: json
           filters: |
@@ -379,8 +393,9 @@ jobs:
         env:
           SB_URL: ${{ steps.storybook.outputs.url }}
           SB_FILES: ${{ steps.sb-changes.outputs.storybook_files }}
+          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ needs.check-pr.outputs.pr_number }};
@@ -401,7 +416,7 @@ jobs:
               }
             }
 
-            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${v2Port}`;
+            const deploymentUrl = `http://${process.env.NEW_VPS_HOST}:${v2Port}`;
 
             // Only mention the portal when this image actually embeds it.
             // Use the direct IP URL - the SSL hostname isn't supported yet.
@@ -447,6 +462,10 @@ jobs:
             });
 
   cleanup-v2-deployment:
+    # Tearing a preview down is not a deployment - no deployment object.
+    environment:
+      name: pr-preview
+      deployment: false
     if: github.event.action == 'closed'
     runs-on: ubuntu-latest
     permissions:
@@ -456,26 +475,17 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - name: Clean up V2 deployment comments
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const { owner, repo } = context.repo;
             const prNumber = ${{ github.event.pull_request.number }};
@@ -504,12 +514,14 @@ jobs:
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${NEW_VPS_SSH_KEY}" > ../private.key
           sudo chmod 600 ../private.key
 
+        env:
+          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
       - name: Cleanup V2 deployment
         run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << 'ENDSSH'
             if [ -d "/stirling/V2-PR-${{ github.event.pull_request.number }}" ]; then
               echo "Found V2 PR directory, proceeding with cleanup..."
 
@@ -542,6 +554,9 @@ jobs:
             # Only remove PR-specific containers and directories
           ENDSSH
 
+        env:
+          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
+          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
       - name: Cleanup temporary files
         if: always()
         run: |
diff --git a/.github/workflows/PR-Demo-Comment-with-react.yml b/.github/workflows/PR-Demo-Comment-with-react.yml
index 0c4bfda91a..410aa82dc9 100644
--- a/.github/workflows/PR-Demo-Comment-with-react.yml
+++ b/.github/workflows/PR-Demo-Comment-with-react.yml
@@ -37,7 +37,8 @@ jobs:
   check-comment:
     runs-on: ubuntu-latest
     permissions:
-      issues: write
+      contents: read # actions/checkout
+      issues: write # add reaction to the triggering issue comment
     if: |
       vars.CI_PROFILE != 'lite' && (
         github.event_name == 'workflow_dispatch' ||
@@ -69,22 +70,13 @@ jobs:
       enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout PR
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - name: Get PR data
         id: get-pr
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -155,7 +147,7 @@ jobs:
         id: add-eyes-reaction
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             console.log(`Adding eyes reaction to comment ID: ${context.payload.comment.id}`);
             try {
@@ -174,35 +166,38 @@ jobs:
             }
 
   deploy-pr:
+    environment: pr-preview
     needs: check-comment
     runs-on: ubuntu-latest
     permissions:
-      issues: write
+      contents: read # actions/checkout, incl. the PR merge ref
+      issues: write # reactions, 'pr-deployed' label, deployment URL comment
       pull-requests: write
+      packages: write # push PR image to ghcr.io
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout PR
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - name: Checkout PR
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: refs/pull/${{ needs.check-comment.outputs.pr_number }}/merge
-          token: ${{ steps.setup-bot.outputs.token }}
+          # untrusted tree gets built below - never leave credentials in .git/config
+          persist-credentials: false
+
+      - name: Cache Gradle
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-deploy-pr-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
 
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -210,17 +205,6 @@ jobs:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Run Gradle Command
@@ -240,11 +224,16 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
-      - name: Login to Docker Hub
+      - name: Login to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Convert repository owner to lowercase
+        id: repoowner
+        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
 
       - name: Build and push PR-specific image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -254,7 +243,7 @@ jobs:
           push: true
           cache-from: type=gha,scope=stirling-pdf-latest
           cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
+          tags: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:pr-${{ needs.check-comment.outputs.pr_number }}
           build-args: |
             VERSION_TAG=alpha
             PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
@@ -269,15 +258,17 @@ jobs:
           push: true
           cache-from: type=gha,scope=stirling-pdf-engine
           cache-to: type=gha,mode=max,scope=stirling-pdf-engine
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
+          tags: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
           platforms: linux/amd64
 
       - name: Set up SSH
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${NEW_VPS_SSH_KEY}" > ../private.key
           sudo chmod 600 ../private.key
 
+        env:
+          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
       - name: Deploy to VPS
         id: deploy
         run: |
@@ -295,11 +286,11 @@ jobs:
           # Set pro/enterprise settings (enterprise implies pro)
           if [ "${{ needs.check-comment.outputs.enable_enterprise }}" == "true" ]; then
             PREMIUM_ENABLED="true"
-            PREMIUM_KEY="${{ secrets.ENTERPRISE_KEY }}"
+            PREMIUM_KEY="${ENTERPRISE_KEY}"
             PREMIUM_PROFEATURES_AUDIT_ENABLED="true"
           elif [ "${{ needs.check-comment.outputs.enable_pro }}" == "true" ]; then
             PREMIUM_ENABLED="true"
-            PREMIUM_KEY="${{ secrets.PREMIUM_KEY }}"
+            PREMIUM_KEY="${PRO_KEY}"
             PREMIUM_PROFEATURES_AUDIT_ENABLED="true"
           else
             PREMIUM_ENABLED="false"
@@ -309,7 +300,6 @@ jobs:
 
           ENABLE_PROTOTYPES="${{ needs.check-comment.outputs.enable_prototypes }}"
           PR_NUMBER="${{ needs.check-comment.outputs.pr_number }}"
-          DOCKER_USER="${{ secrets.DOCKER_HUB_USERNAME }}"
 
           # Build engine env vars for backend (only set when prototypes enabled)
           if [ "$ENABLE_PROTOTYPES" == "true" ]; then
@@ -319,9 +309,9 @@ jobs:
             ENGINE_SERVICE="
             stirling-pdf-engine:
               container_name: stirling-pdf-engine-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:engine-pr-${PR_NUMBER}
+              image: ${IMAGE_BASE}:engine-pr-${PR_NUMBER}
               environment:
-                ANTHROPIC_API_KEY: \"${{ secrets.ANTHROPIC_API_KEY }}\"
+                ANTHROPIC_API_KEY: \"${ANTHROPIC_API_KEY}\"
               networks:
                 - pr-network
               restart: on-failure:5"
@@ -344,7 +334,7 @@ jobs:
           services:
             stirling-pdf:
               container_name: stirling-pdf-pr-${PR_NUMBER}
-              image: ${DOCKER_USER}/test:pr-${PR_NUMBER}
+              image: ${IMAGE_BASE}:pr-${PR_NUMBER}
               ports:
                 - "${PR_NUMBER}:8080"
               volumes:
@@ -368,9 +358,9 @@ jobs:
           EOF
 
           # Then copy the file and execute commands
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
+          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${NEW_VPS_USERNAME}@${NEW_VPS_HOST}:/tmp/docker-compose.yml
 
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << ENDSSH
             # Create PR-specific directories
             mkdir -p /stirling/PR-${PR_NUMBER}/{data,config,logs}
 
@@ -386,11 +376,19 @@ jobs:
           # Set output for use in PR comment
           echo "security_status=${SECURITY_STATUS}" >> $GITHUB_ENV
 
+        env:
+          ENTERPRISE_KEY: ${{ secrets.ENTERPRISE_KEY }}
+          # named PRO_KEY, not PREMIUM_KEY, so the shell var it feeds is not self-referential
+          PRO_KEY: ${{ secrets.PREMIUM_KEY }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          IMAGE_BASE: ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test
+          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
+          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
       - name: Add success reaction to comment
         if: success() && github.event_name == 'issue_comment'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             console.log(`Adding rocket reaction to comment ID: ${{ needs.check-comment.outputs.comment_id }}`);
             try {
@@ -425,7 +423,7 @@ jobs:
         if: failure() && github.event_name == 'issue_comment'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             console.log(`Adding -1 reaction to comment ID: ${{ needs.check-comment.outputs.comment_id }}`);
             try {
@@ -444,15 +442,17 @@ jobs:
       - name: Post deployment URL to PR
         if: success()
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const { GITHUB_REPOSITORY } = process.env;
             const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
             const prNumber = ${{ needs.check-comment.outputs.pr_number }};
             const securityStatus = process.env.security_status || "Security Disabled";
 
-            const deploymentUrl = `http://${{ secrets.NEW_VPS_HOST }}:${prNumber}`;
+            const deploymentUrl = `http://${process.env.NEW_VPS_HOST}:${prNumber}`;
             const commentBody = `## 🚀 PR Test Deployment\n\n` +
                               `Your PR has been deployed for testing!\n\n` +
                               `🔗 **Test URL:** [${deploymentUrl}](${deploymentUrl})\n` +
@@ -477,26 +477,22 @@ jobs:
   handle-label-commands:
     if: ${{ github.event.issue.pull_request != null }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # actions/checkout, reads repo_devs.json and labels.yml
+      issues: write # add/remove labels, delete the command comment
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Check out the repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - name: Apply label commands
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const fs = require('fs');
             const path = require('path');
diff --git a/.github/workflows/PR-Demo-cleanup.yml b/.github/workflows/PR-Demo-cleanup.yml
index 146f5c7f78..098f8d7803 100644
--- a/.github/workflows/PR-Demo-cleanup.yml
+++ b/.github/workflows/PR-Demo-cleanup.yml
@@ -7,41 +7,33 @@ on:
 permissions:
   contents: read
 
-env:
-  SERVER_IP: ${{ secrets.NEW_VPS_IP }} # Add this to your GitHub secrets
-  CLEANUP_PERFORMED: "false" # Add flag to track if cleanup occurred
-
 jobs:
   cleanup:
+    # Tearing a preview down is not a deployment - no deployment object.
+    environment:
+      name: pr-preview
+      deployment: false
     if: github.event.action == 'closed'
     runs-on: ubuntu-latest
     permissions:
+      contents: read # actions/checkout
       pull-requests: write
-      issues: write
+      issues: write # list/remove labels, list/delete comments
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout PR
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - name: Remove 'pr-deployed' label if present
         id: remove-label-comment
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const prNumber = ${{ github.event.pull_request.number }};
             const owner = context.repo.owner;
@@ -100,14 +92,22 @@ jobs:
         if: steps.remove-label-comment.outputs.present == 'true'
         run: |
           mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
+          echo "${NEW_VPS_SSH_KEY}" > ../private.key
           sudo chmod 600 ../private.key
+        env:
+          NEW_VPS_SSH_KEY: ${{ secrets.NEW_VPS_SSH_KEY }}
+
+      - name: Convert repository owner to lowercase
+        id: repoowner
+        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT
 
       - name: Cleanup PR deployment
         if: steps.remove-label-comment.outputs.present == 'true'
         id: cleanup
+        # ENDSSH heredoc is quoted, so its body is sent literally: secrets inside it
+        # must stay as GitHub expressions, a shell var would be empty on the remote host.
         run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << 'ENDSSH'
+          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${NEW_VPS_USERNAME}@${NEW_VPS_HOST} << 'ENDSSH'
             if [ -d "/stirling/PR-${{ github.event.pull_request.number }}" ]; then
               echo "Found PR directory, proceeding with cleanup..."
 
@@ -122,8 +122,8 @@ jobs:
               rm -rf /stirling/PR-${{ github.event.pull_request.number }}
 
               # Remove the Docker images
-              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ github.event.pull_request.number }} || true
-              docker rmi --no-prune ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ github.event.pull_request.number }} || true
+              docker rmi --no-prune ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:pr-${{ github.event.pull_request.number }} || true
+              docker rmi --no-prune ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-test:engine-pr-${{ github.event.pull_request.number }} || true
 
               echo "PERFORMED_CLEANUP"
             else
@@ -131,6 +131,9 @@ jobs:
               echo "NO_CLEANUP_NEEDED"
             fi
           ENDSSH
+        env:
+          NEW_VPS_USERNAME: ${{ secrets.NEW_VPS_USERNAME }}
+          NEW_VPS_HOST: ${{ secrets.NEW_VPS_HOST }}
 
       - name: Cleanup temporary files
         if: always()
diff --git a/.github/workflows/_runner-pick.yml b/.github/workflows/_runner-pick.yml
index 0b3f76a8cd..d65831c5df 100644
--- a/.github/workflows/_runner-pick.yml
+++ b/.github/workflows/_runner-pick.yml
@@ -38,7 +38,7 @@ jobs:
       is_fork: ${{ steps.decide.outputs.is_fork }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/ai-engine.yml b/.github/workflows/ai-engine.yml
index 056dc35ca3..015934030f 100644
--- a/.github/workflows/ai-engine.yml
+++ b/.github/workflows/ai-engine.yml
@@ -20,7 +20,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/ai_pr_title_review.yml b/.github/workflows/ai_pr_title_review.yml
deleted file mode 100644
index 563e94c9b3..0000000000
--- a/.github/workflows/ai_pr_title_review.yml
+++ /dev/null
@@ -1,228 +0,0 @@
-name: AI - PR Title Review
-
-on:
-  pull_request:
-    types: [opened, edited]
-    branches: [main]
-
-permissions: # required for secure-repo hardening
-  contents: read
-
-jobs:
-  ai-title-review:
-    permissions:
-      contents: read
-      pull-requests: write
-      models: read
-
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-
-      - name: Configure Git to suppress detached HEAD warning
-        run: git config --global advice.detachedHead false
-
-      - name: Setup GitHub App Bot
-        if: github.actor != 'dependabot[bot]'
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        continue-on-error: true
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Check if actor is repo developer
-        id: actor
-        run: |
-          if [[ "${{ github.actor }}" == *"[bot]" ]]; then
-            echo "PR opened by a bot – skipping AI title review."
-            echo "is_repo_dev=false" >> $GITHUB_OUTPUT
-            exit 0
-          fi
-          if [ ! -f .github/config/repo_devs.json ]; then
-            echo "Error: .github/config/repo_devs.json not found" >&2
-            exit 1
-          fi
-          # Validate JSON and extract repo_devs
-          REPO_DEVS=$(jq -r '.repo_devs[]' .github/config/repo_devs.json 2>/dev/null || { echo "Error: Invalid JSON in repo_devs.json" >&2; exit 1; })
-          # Convert developer list into Bash array
-          mapfile -t DEVS_ARRAY <<< "$REPO_DEVS"
-          if [[ " ${DEVS_ARRAY[*]} " == *" ${{ github.actor }} "* ]]; then
-            echo "is_repo_dev=true" >> $GITHUB_OUTPUT
-          else
-            echo "is_repo_dev=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Get PR diff
-        if: steps.actor.outputs.is_repo_dev == 'true'
-        id: get_diff
-        run: |
-          git fetch origin ${{ github.base_ref }}
-          git diff origin/${{ github.base_ref }}...HEAD | head -n 10000 | grep -vP '[\x00-\x08\x0B\x0C\x0E-\x1F\x7F\x{202E}\x{200B}]' > pr.diff
-          echo "diff<<EOF" >> $GITHUB_OUTPUT
-          cat pr.diff >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-
-      - name: Check and sanitize PR title
-        if: steps.actor.outputs.is_repo_dev == 'true'
-        id: sanitize_pr_title
-        env:
-          PR_TITLE_RAW: ${{ github.event.pull_request.title }}
-        run: |
-          # Sanitize PR title: max 72 characters, only printable characters
-          PR_TITLE=$(echo "$PR_TITLE_RAW" | tr -d '\n\r' | head -c 72 | sed 's/[^[:print:]]//g')
-          if [[ ${#PR_TITLE} -lt 5 ]]; then
-            echo "PR title is too short. Must be at least 5 characters." >&2
-          fi
-          echo "pr_title=$PR_TITLE" >> $GITHUB_OUTPUT
-
-      - name: AI PR Title Analysis
-        if: steps.actor.outputs.is_repo_dev == 'true'
-        id: ai-title-analysis
-        uses: actions/ai-inference@a7805884c80886efc241e94a5351df715968a0ad # v2.1.1
-        with:
-          model: openai/gpt-4o
-          system-prompt-file: ".github/config/system-prompt.txt"
-          prompt: |
-            Based on the following input data:
-
-            {
-              "diff": "${{ steps.get_diff.outputs.diff }}",
-              "pr_title": "${{ steps.sanitize_pr_title.outputs.pr_title }}"
-            }
-
-            Respond ONLY with valid JSON in the format:
-            {
-              "improved_rating": <0-10>,
-              "improved_ai_title_rating": <0-10>,
-              "improved_title": "<ai generated title>"
-            }
-
-      - name: Validate and set SCRIPT_OUTPUT
-        if: steps.actor.outputs.is_repo_dev == 'true'
-        run: |
-          cat <<EOF > ai_response.json
-          ${{ steps.ai-title-analysis.outputs.response }}
-          EOF
-
-          # Validate JSON structure
-          jq -e '
-            (keys | sort) == ["improved_ai_title_rating", "improved_rating", "improved_title"] and
-            (.improved_rating | type == "number" and . >= 0 and . <= 10) and
-            (.improved_ai_title_rating | type == "number" and . >= 0 and . <= 10) and
-            (.improved_title | type == "string")
-          ' ai_response.json
-          if [ $? -ne 0 ]; then
-            echo "Invalid AI response format" >&2
-            cat ai_response.json >&2
-            exit 1
-          fi
-          # Parse JSON fields
-          IMPROVED_RATING=$(jq -r '.improved_rating' ai_response.json)
-          IMPROVED_TITLE=$(jq -r '.improved_title' ai_response.json)
-          # Limit comment length to 1000 characters
-          COMMENT=$(cat <<EOF
-          ## 🤖 AI PR Title Suggestion
-
-          **PR-Title Rating**: $IMPROVED_RATING/10
-
-          ### ⬇️ Suggested Title (copy & paste):
-
-          \`\`\`
-          $IMPROVED_TITLE
-          \`\`\`
-
-          ---
-          *Generated by GitHub Models AI*
-          EOF
-          )
-          echo "$COMMENT" > /tmp/ai-title-comment.md
-          # Log input and output to the GitHub Step Summary
-          echo "### 🤖 AI PR Title Analysis" >> $GITHUB_STEP_SUMMARY
-          echo "### Input PR Title" >> $GITHUB_STEP_SUMMARY
-          echo '```bash' >> $GITHUB_STEP_SUMMARY
-          echo "${{ steps.sanitize_pr_title.outputs.pr_title }}" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          echo '### AI Response (raw JSON)' >> $GITHUB_STEP_SUMMARY
-          echo '```json' >> $GITHUB_STEP_SUMMARY
-          cat ai_response.json >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-
-      - name: Post comment on PR if needed
-        if: steps.actor.outputs.is_repo_dev == 'true'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        continue-on-error: true
-        with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
-          script: |
-            const fs = require('fs');
-            const body = fs.readFileSync('/tmp/ai-title-comment.md', 'utf8');
-            const { GITHUB_REPOSITORY } = process.env;
-            const [owner, repo] = GITHUB_REPOSITORY.split('/');
-            const issue_number = context.issue.number;
-
-            const ratingMatch = body.match(/\*\*PR-Title Rating\*\*: (\d+)\/10/);
-            const rating = ratingMatch ? parseInt(ratingMatch[1], 10) : null;
-
-            const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
-            const comments = await github.rest.issues.listComments({ owner, repo, issue_number });
-
-            const existing = comments.data.find(c =>
-              c.user?.login === expectedActor &&
-              c.body.includes("## 🤖 AI PR Title Suggestion")
-            );
-
-            if (rating === null) {
-              console.log("No rating found in AI response – skipping.");
-              return;
-            }
-
-            if (rating <= 5) {
-              if (existing) {
-                await github.rest.issues.updateComment({
-                  owner, repo,
-                  comment_id: existing.id,
-                  body
-                });
-                console.log("Updated existing suggestion comment.");
-              } else {
-                await github.rest.issues.createComment({
-                  owner, repo, issue_number,
-                  body
-                });
-                console.log("Created new suggestion comment.");
-              }
-            } else {
-              const praise = `## 🤖 AI PR Title Suggestion\n\nGreat job! The current PR title is clear and well-structured.\n\n✅ No suggestions needed.\n\n---\n*Generated by GitHub Models AI*`;
-
-              if (existing) {
-                await github.rest.issues.updateComment({
-                  owner, repo,
-                  comment_id: existing.id,
-                  body: praise
-                });
-                console.log("Replaced suggestion with praise.");
-              } else {
-                console.log("Rating > 5 and no existing comment – skipping comment.");
-              }
-            }
-
-      - name: is not repo dev
-        if: steps.actor.outputs.is_repo_dev != 'true'
-        run: |
-          exit 0 # Skip the AI title review for non-repo developers
-
-      - name: Clean up
-        if: always()
-        run: |
-          rm -f pr.diff ai_response.json /tmp/ai-title-comment.md
-          echo "Cleaned up temporary files."
-        continue-on-error: true # Ensure cleanup runs even if previous steps fail
diff --git a/.github/workflows/aur-publish.yml b/.github/workflows/aur-publish.yml
index f5af23da07..af0dc85aa6 100644
--- a/.github/workflows/aur-publish.yml
+++ b/.github/workflows/aur-publish.yml
@@ -26,7 +26,7 @@ jobs:
       jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -66,11 +66,12 @@ jobs:
           echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
 
   publish-aur:
+    environment: package-publish
     needs: get-release-info
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/auto-labelerV2.yml b/.github/workflows/auto-labelerV2.yml
index 6039c0e7df..8e6d974f3c 100644
--- a/.github/workflows/auto-labelerV2.yml
+++ b/.github/workflows/auto-labelerV2.yml
@@ -13,26 +13,21 @@ jobs:
   labeler:
     runs-on: ubuntu-latest
     permissions:
-      pull-requests: write
+      contents: read # checkout + labeler fetching its config from the repo
+      pull-requests: write # read changed files, apply labels to the PR
+      issues: write # labels are applied through the issues API
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - uses: srvaroa/labeler@bf262763a8a8e191f5847873aecc0f29df84f957 # v1.14.0
         with:
           config_path: .github/labeler-config-srvaroa.yml
           use_local_config: false
           fail_on_error: true
         env:
-          GITHUB_TOKEN: "${{ steps.setup-bot.outputs.token }}"
+          GITHUB_TOKEN: "${{ github.token }}"
diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index 4c87d93e40..596be96e8c 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -20,6 +20,9 @@ permissions:
 
 jobs:
   build:
+    environment:
+      name: ci-unsigned
+      deployment: false
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -28,29 +31,26 @@ jobs:
         flavor: [core, proprietary, saas]
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Restore cache Gradle User Home
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK ${{ matrix.jdk-version }}
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: ${{ matrix.jdk-version }}
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-${{ matrix.jdk-version }}-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Check Java formatting (Spotless)
@@ -155,7 +155,7 @@ jobs:
           STIRLING_FLAVOR: ${{ matrix.flavor }}
           # Configure the Gradle daemon explicitly; GRADLE_OPTS alone only
           # configures the Gradle client JVM.
-          GRADLE_OPTS: '-Dorg.gradle.jvmargs=-Xmx4g -XX:+UseG1GC'
+          GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx4g -XX:+UseG1GC"
 
       - name: Check Test Reports Exist
         if: always()
diff --git a/.github/workflows/build-enterprise.yml b/.github/workflows/build-enterprise.yml
index dfcef8153e..194d86d9da 100644
--- a/.github/workflows/build-enterprise.yml
+++ b/.github/workflows/build-enterprise.yml
@@ -15,6 +15,11 @@ name: Enterprise E2E (Playwright)
 
 on:
   workflow_call:
+    inputs:
+      use_shared_cache:
+        required: false
+        type: boolean
+        default: false
   push:
     branches: ["main"]
   schedule:
@@ -37,6 +42,9 @@ jobs:
     uses: ./.github/workflows/_runner-pick.yml
 
   playwright-e2e-enterprise:
+    environment:
+      name: ci-unsigned
+      deployment: false
     needs: pick
     # Skip on fork PRs / untrusted authors: they have no PREMIUM_KEY_ENTERPRISE,
     # so the suite can't boot premium and would fail. See the header comment.
@@ -50,26 +58,36 @@ jobs:
       SYSTEM_ENABLEANALYTICS: "false"
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+
+      - name: Restore cache Gradle User Home
+        if: inputs.use_shared_cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Cache Gradle User Home
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
+      - name: Restore cache Gradle
+        if: inputs.use_shared_cache == false
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
+          key: gradle-playwright-e2e-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
@@ -309,6 +327,9 @@ jobs:
   # Multi-node regression: builds + seeds the clustered stack (testing/compose/docker-compose-multinode.yml)
   # and runs behave features/multinode. Licence-gated, so it runs after the Playwright job (not in parallel).
   multinode-e2e:
+    environment:
+      name: ci-unsigned
+      deployment: false
     needs: [pick, playwright-e2e-enterprise]
     # Nightly cron + manual dispatch only (heavy build), fork-gated for the licence secret.
     if: >-
@@ -324,7 +345,7 @@ jobs:
       MN_COMPOSE: docker-compose-multinode.yml
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 87d414b462..1feaff2560 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -48,53 +48,75 @@ jobs:
       proprietary: ${{ steps.changes.outputs.proprietary }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for file changes
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: changes
         with:
           filters: .github/config/.files.yaml
 
   gradle-cache-prime:
+    environment:
+      name: ci-unsigned
+      deployment: false
     name: Prime shared Gradle cache
     needs: [files-changed]
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+
+      - name: Calculate Gradle cache key
+        id: gradle-cache-key
+        shell: bash
+        run: |
+          echo "key=gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Gradle (lookup-only)
+        id: cache-gradle-restore
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
+          key: ${{ steps.gradle-cache-key.outputs.key }}
+          lookup-only: true
+
+      - name: Set up JDK 25
+        if: steps.cache-gradle-restore.outputs.cache-hit != 'true'
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
       - name: Resolve backend dependencies
-        run: ./gradlew :stirling-pdf:classes -PnoSpotless --no-daemon
+        if: steps.cache-gradle-restore.outputs.cache-hit != 'true'
+        run: ./gradlew :stirling-pdf:classes --no-daemon
         env:
           STIRLING_FLAVOR: saas
           MAVEN_USER: ${{ secrets.MAVEN_USER }}
           MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
 
+      - name: Save cache Gradle User Home
+        if: steps.cache-gradle-restore.outputs.cache-hit != 'true'
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ steps.gradle-cache-key.outputs.key }}
+
   build:
     needs: [files-changed, gradle-cache-prime]
     permissions:
@@ -134,9 +156,10 @@ jobs:
     uses: ./.github/workflows/frontend-validation.yml
     secrets: inherit
 
-  # Advisory: deliberately NOT in all-checks-passed. It reports on the stories a
-  # branch touches so a regression is visible in review, but a browser scan is
-  # too new here to block merges on. Promote it once its pass/fail proves stable.
+  # Required (in all-checks-passed). Scans the stories a branch touches in both
+  # light and dark; an axe violation in either theme blocks the merge. The
+  # whole-suite sweep (nightly.yml) still covers stories a change affects without
+  # touching them directly.
   frontend-a11y:
     if: needs.files-changed.outputs.frontend == 'true'
     needs: [files-changed]
@@ -168,6 +191,8 @@ jobs:
       contents: read
     uses: ./.github/workflows/build-enterprise.yml
     secrets: inherit
+    with:
+      use_shared_cache: true
 
   check-licence:
     if: needs.files-changed.outputs.build == 'true'
@@ -191,7 +216,14 @@ jobs:
 
   test-build-docker-images:
     if: github.event_name == 'pull_request' && needs.files-changed.outputs.project == 'true'
-    needs: [files-changed, build, check-generateOpenApiDocs, check-licence, gradle-cache-prime]
+    needs:
+      [
+        files-changed,
+        build,
+        check-generateOpenApiDocs,
+        check-licence,
+        gradle-cache-prime,
+      ]
     permissions:
       contents: read
       packages: read
@@ -203,7 +235,7 @@ jobs:
 
   tauri-build:
     if: needs.files-changed.outputs.tauri == 'true'
-    needs: [files-changed]
+    needs: [files-changed, gradle-cache-prime]
     permissions:
       contents: read
       pull-requests: write
@@ -217,6 +249,7 @@ jobs:
     with:
       platform: windows-macos
       sign: true
+      use_shared_cache: true
 
   ai-engine:
     if: needs.files-changed.outputs.engine == 'true'
@@ -240,6 +273,8 @@ jobs:
       pull-requests: write
     uses: ./.github/workflows/check-generated-models.yml
     secrets: inherit
+    with:
+      use_shared_cache: true
 
   pre-commit:
     needs: [files-changed]
@@ -290,6 +325,7 @@ jobs:
       - db-migration-test
       - check-generateOpenApiDocs
       - frontend-validation
+      - frontend-a11y
       - playwright-e2e
       - playwright-e2e-live
       - playwright-e2e-enterprise
@@ -304,7 +340,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -316,6 +352,7 @@ jobs:
             db-migration-test=${{ needs.db-migration-test.result }}
             check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
             frontend-validation=${{ needs.frontend-validation.result }}
+            frontend-a11y=${{ needs.frontend-a11y.result }}
             playwright-e2e=${{ needs.playwright-e2e.result }}
             playwright-e2e-live=${{ needs.playwright-e2e-live.result }}
             playwright-e2e-enterprise=${{ needs.playwright-e2e-enterprise.result }}
diff --git a/.github/workflows/check-generated-models.yml b/.github/workflows/check-generated-models.yml
index cebf98496a..fafffcc241 100644
--- a/.github/workflows/check-generated-models.yml
+++ b/.github/workflows/check-generated-models.yml
@@ -9,6 +9,11 @@ name: Check generated models
 # post-merge safety net.
 on:
   workflow_call:
+    inputs:
+      use_shared_cache:
+        required: false
+        type: boolean
+        default: false
   push:
     branches: [main]
 
@@ -23,7 +28,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -39,22 +44,29 @@ jobs:
             engine/uv.lock
           cache-suffix: generated-models
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+      - name: Restore cache Gradle User Home
+        if: inputs.use_shared_cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          java-version: "25"
-          distribution: "temurin"
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
 
-      - name: Cache Gradle User Home
+      - name: Restore cache Gradle
+        if: inputs.use_shared_cache == false
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
+          key: gradle-generated-models-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
 
       - name: Set up Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
diff --git a/.github/workflows/check-licence.yml b/.github/workflows/check-licence.yml
index af94d09316..4e04a83656 100644
--- a/.github/workflows/check-licence.yml
+++ b/.github/workflows/check-licence.yml
@@ -10,33 +10,33 @@ permissions:
 
 jobs:
   check-licence:
+    environment:
+      name: ci-unsigned
+      deployment: false
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Restore cache Gradle User Home
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Check licenses for compatibility
diff --git a/.github/workflows/check-openapi.yml b/.github/workflows/check-openapi.yml
index 19a047ff01..bc9b302857 100644
--- a/.github/workflows/check-openapi.yml
+++ b/.github/workflows/check-openapi.yml
@@ -11,33 +11,33 @@ permissions:
 
 jobs:
   check-generate-openapi-docs:
+    environment:
+      name: ci-unsigned
+      deployment: false
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Restore cache Gradle User Home
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Generate OpenAPI documentation
diff --git a/.github/workflows/check_toml.yml b/.github/workflows/check_toml.yml
index d134c80a9b..1681546e71 100644
--- a/.github/workflows/check_toml.yml
+++ b/.github/workflows/check_toml.yml
@@ -23,29 +23,23 @@ jobs:
     if: github.event_name == 'pull_request_target'
     runs-on: ubuntu-latest
     permissions:
+      contents: read # Checkout, and read translation files via the contents API
       issues: write # Allow posting comments on issues/PRs
       pull-requests: write # Allow writing to pull requests
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout main branch first
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Setup GitHub App Bot
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - name: Get PR data
         id: get-pr-data
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const prNumber = context.payload.pull_request.number;
             const repoOwner = context.payload.repository.owner.login;
@@ -66,17 +60,18 @@ jobs:
       - name: Fetch PR changed files
         id: fetch-pr-changes
         env:
-          GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ steps.get-pr-data.outputs.pr_number }}
         run: |
           echo "Fetching PR changed files..."
           echo "Getting list of changed files from PR..."
           # Check if PR number exists
-          if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then
+          if [ -z "${PR_NUMBER}" ]; then
             echo "Error: PR number is empty"
             exit 1
           fi
           # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          gh pr view "${PR_NUMBER}" --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
           # Check if any files were found
           if [ ! -s changed_files.txt ]; then
             echo "No TOML translation files changed in this PR"
@@ -88,32 +83,36 @@ jobs:
       - name: Determine reference file
         id: determine-file
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          # Untrusted, fork-controlled values are passed via env, never interpolated into the script
+          PR_NUMBER: ${{ steps.get-pr-data.outputs.pr_number }}
+          REPO_OWNER: ${{ steps.get-pr-data.outputs.repo_owner }}
+          REPO_NAME: ${{ steps.get-pr-data.outputs.repo_name }}
+          PR_REPO_OWNER: ${{ github.event.pull_request.head.repo.owner.login }}
+          PR_REPO_NAME: ${{ github.event.pull_request.head.repo.name }}
+          PR_BRANCH: ${{ steps.get-pr-data.outputs.branch }}
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const fs = require("fs");
             const path = require("path");
 
-            const prNumber = ${{ steps.get-pr-data.outputs.pr_number }};
-            const repoOwner = "${{ steps.get-pr-data.outputs.repo_owner }}";
-            const repoName = "${{ steps.get-pr-data.outputs.repo_name }}";
-
-            const prRepoOwner = "${{ github.event.pull_request.head.repo.owner.login }}";
-            const prRepoName = "${{ github.event.pull_request.head.repo.name }}";
-            const branch = "${{ steps.get-pr-data.outputs.branch }}";
-
-            console.log(`Determining reference file for PR #${prNumber}`);
-
-            // Validate inputs
+            // Validate inputs before any use
             const validateInput = (input, regex, name) => {
-              if (!regex.test(input)) {
+              if (typeof input !== "string" || !regex.test(input)) {
                 throw new Error(`Invalid ${name}: ${input}`);
               }
+              return input;
             };
 
-            validateInput(repoOwner, /^[a-zA-Z0-9_-]+$/, "repository owner");
-            validateInput(repoName, /^[a-zA-Z0-9._-]+$/, "repository name");
-            validateInput(branch, /^[a-zA-Z0-9._/-]+$/, "branch name");
+            const repoOwner = validateInput(process.env.REPO_OWNER, /^[a-zA-Z0-9_-]+$/, "repository owner");
+            const repoName = validateInput(process.env.REPO_NAME, /^[a-zA-Z0-9._-]+$/, "repository name");
+            const prRepoOwner = validateInput(process.env.PR_REPO_OWNER, /^[a-zA-Z0-9_-]+$/, "PR repository owner");
+            const prRepoName = validateInput(process.env.PR_REPO_NAME, /^[a-zA-Z0-9._-]+$/, "PR repository name");
+            const branch = validateInput(process.env.PR_BRANCH, /^[a-zA-Z0-9._/-]+$/, "branch name");
+            const prNumber = Number(validateInput(process.env.PR_NUMBER, /^[0-9]+$/, "PR number"));
+
+            console.log(`Determining reference file for PR #${prNumber}`);
 
             // Get the list of changed files in the PR
             const { data: files } = await github.rest.pulls.listFiles({
@@ -126,7 +125,7 @@ jobs:
             const changedFiles = files
               .filter(file =>
                 file.status !== "removed" &&
-                /^frontend\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
+                /^frontend\/editor\/public\/locales\/[a-zA-Z-]+\/translation\.toml$/.test(file.filename)
               )
               .map(file => file.filename);
 
@@ -209,10 +208,12 @@ jobs:
 
       - name: Run Python script to check files
         id: run-check
+        env:
+          PR_ACTOR: ${{ github.event.pull_request.user.login }}
         run: |
           echo "Running Python script to check TOML files..."
           uv run --project engine --locked --group tools python .github/scripts/check_language_toml.py \
-            --actor ${{ github.event.pull_request.user.login }} \
+            --actor "${PR_ACTOR}" \
             --reference-file "${REFERENCE_FILE}" \
             --branch "pr-branch" \
             --files "${FILES_LIST[@]}" > result.txt
@@ -245,7 +246,7 @@ jobs:
         if: env.SCRIPT_OUTPUT != ''
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const { GITHUB_REPOSITORY, SCRIPT_OUTPUT } = process.env;
             const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/');
@@ -261,7 +262,7 @@ jobs:
             const comment = comments.data.find(c => c.body.includes("## 🌐 TOML Translation Verification Summary"));
 
             // Only update or create comments by the action user
-            const expectedActor = "${{ steps.setup-bot.outputs.app-slug }}[bot]";
+            const expectedActor = "github-actions[bot]";
 
             if (comment && comment.user.login === expectedActor) {
               // Update existing comment
diff --git a/.github/workflows/coverage-aggregate.yml b/.github/workflows/coverage-aggregate.yml
index 69b5f90e2d..61ef8793c4 100644
--- a/.github/workflows/coverage-aggregate.yml
+++ b/.github/workflows/coverage-aggregate.yml
@@ -34,29 +34,26 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Restore cache Gradle User Home
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Install uv
         uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
         with:
diff --git a/.github/workflows/db-migration-test.yml b/.github/workflows/db-migration-test.yml
index 0c9500795a..785073944e 100644
--- a/.github/workflows/db-migration-test.yml
+++ b/.github/workflows/db-migration-test.yml
@@ -13,34 +13,34 @@ permissions:
 
 jobs:
   migration-test:
+    environment:
+      name: ci-unsigned
+      deployment: false
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Restore cache Gradle User Home
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: 25
           distribution: temurin
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       # Keep the normal formatting path here so this smoke test exercises the
       # same Gradle configuration as the backend build.
       - name: Build Stirling-PDF JAR
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 07f1f8ce1a..b27596ddfb 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/deploy-on-v2-commit.yml b/.github/workflows/deploy-on-v2-commit.yml
deleted file mode 100644
index c98ec8641c..0000000000
--- a/.github/workflows/deploy-on-v2-commit.yml
+++ /dev/null
@@ -1,189 +0,0 @@
-name: Auto V2 Deploy on Push
-
-on:
-  push:
-    branches:
-      - V2
-      - deploy-on-v2-commit
-
-permissions:
-  contents: read
-
-jobs:
-  deploy-v2-on-push:
-    runs-on: ubuntu-latest
-    concurrency:
-      group: deploy-v2-push-V2
-      cancel-in-progress: true
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - name: Get commit hashes for frontend and backend
-        id: commit-hashes
-        run: |
-          # Get last commit that touched the frontend folder, docker/frontend, or docker/compose
-          FRONTEND_HASH=$(git log -1 --format="%H" -- frontend/ docker/frontend/ docker/compose/ 2>/dev/null || echo "")
-          if [ -z "$FRONTEND_HASH" ]; then
-            FRONTEND_HASH="no-frontend-changes"
-          fi
-
-          # Get last commit that touched backend code, docker/backend, or docker/compose
-          BACKEND_HASH=$(git log -1 --format="%H" -- app/ docker/backend/ docker/compose/ 2>/dev/null || echo "")
-          if [ -z "$BACKEND_HASH" ]; then
-            BACKEND_HASH="no-backend-changes"
-          fi
-
-          echo "Frontend hash: $FRONTEND_HASH"
-          echo "Backend hash: $BACKEND_HASH"
-
-          echo "frontend_hash=$FRONTEND_HASH" >> $GITHUB_OUTPUT
-          echo "backend_hash=$BACKEND_HASH" >> $GITHUB_OUTPUT
-
-          # Short hashes for tags
-          if [ "$FRONTEND_HASH" = "no-frontend-changes" ]; then
-            echo "frontend_short=no-frontend" >> $GITHUB_OUTPUT
-          else
-            echo "frontend_short=${FRONTEND_HASH:0:8}" >> $GITHUB_OUTPUT
-          fi
-
-          if [ "$BACKEND_HASH" = "no-backend-changes" ]; then
-            echo "backend_short=no-backend" >> $GITHUB_OUTPUT
-          else
-            echo "backend_short=${BACKEND_HASH:0:8}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check if frontend image exists
-        id: check-frontend
-        run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }} >/dev/null 2>&1; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Frontend image already exists, skipping build"
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-            echo "Frontend image needs to be built"
-          fi
-
-      - name: Check if backend image exists
-        id: check-backend
-        run: |
-          if docker manifest inspect ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }} >/dev/null 2>&1; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-            echo "Backend image already exists, skipping build"
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-            echo "Backend image needs to be built"
-          fi
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Build and push frontend image
-        if: steps.check-frontend.outputs.exists == 'false'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          file: ./docker/frontend/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-v2-frontend
-          cache-to: type=gha,mode=max,scope=stirling-v2-frontend
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push backend image
-        if: steps.check-backend.outputs.exists == 'false'
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          file: ./docker/backend/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-v2-backend
-          cache-to: type=gha,mode=max,scope=stirling-v2-backend
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
-          chmod 600 ../private.key
-
-      - name: Deploy to VPS on port 3000
-        run: |
-          export UNIQUE_NAME=docker-compose-v2-$GITHUB_RUN_ID.yml
-
-          cat > $UNIQUE_NAME << EOF
-          version: '3.3'
-          services:
-            backend:
-              container_name: stirling-v2-backend
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
-              ports:
-                - "13000:8080"
-              volumes:
-                - /stirling/V2/data:/usr/share/tessdata:rw
-                - /stirling/V2/config:/configs:rw
-                - /stirling/V2/logs:/logs:rw
-              environment:
-                DISABLE_ADDITIONAL_FEATURES: "true"
-                SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
-                UI_APPNAME: "Stirling-PDF V2"
-                UI_HOMEDESCRIPTION: "V2 Frontend/Backend Split"
-                UI_APPNAMENAVBAR: "V2 Deployment"
-                SYSTEM_MAXFILESIZE: "100"
-                METRICS_ENABLED: "true"
-                SYSTEM_GOOGLEVISIBILITY: "false"
-                SWAGGER_SERVER_URL: "https://demo.stirlingpdf.cloud"
-                baseUrl: "https://demo.stirlingpdf.cloud"
-              restart: on-failure:5
-
-            frontend:
-              container_name: stirling-v2-frontend
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-              ports:
-                - "3000:80"
-              environment:
-                VITE_API_BASE_URL: "http://${{ secrets.NEW_VPS_HOST }}:13000"
-              depends_on:
-                - backend
-              restart: on-failure:5
-          EOF
-
-          # Copy to remote with unique name
-          scp -i ../private.key -o StrictHostKeyChecking=no $UNIQUE_NAME ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/$UNIQUE_NAME
-
-          # SSH and rename/move atomically to avoid interference
-          ssh -i ../private.key -o StrictHostKeyChecking=no ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
-            mkdir -p /stirling/V2/{data,config,logs}
-            mv /tmp/$UNIQUE_NAME /stirling/V2/docker-compose.yml
-            cd /stirling/V2
-            docker-compose down || true
-            docker-compose pull
-            docker-compose up -d
-            docker system prune -af --volumes || true
-            docker image prune -af --filter "until=336h" --filter "label!=keep=true" || true
-          ENDSSH
-
-      - name: Cleanup temporary files
-        if: always()
-        run: |
-          rm -f ../private.key
diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml
index 861bb2ca66..439d4240b2 100644
--- a/.github/workflows/docker-compose-tests.yml
+++ b/.github/workflows/docker-compose-tests.yml
@@ -17,6 +17,9 @@ permissions:
 
 jobs:
   docker-compose-tests:
+    environment:
+      name: ci-unsigned
+      deployment: false
     runs-on: ubuntu-latest
     permissions:
       actions: write
@@ -25,30 +28,27 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Restore cache Gradle User Home
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       # When the PR changes the base image, test.sh builds it locally
       # (stirling-pdf-base:local) into the daemon image store. A buildx
       # container builder can't see that store, so skip it here and let
diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index 9a9a0829b7..844d26a3d1 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -11,48 +11,33 @@ permissions:
 
 jobs:
   playwright-e2e-live:
+    environment:
+      name: ci-unsigned
+      deployment: false
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Restore cache Gradle User Home
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-      # Gradle does not retry 429s, and a cold cache resolving the buildscript
-      # classpath is exactly where Maven Central rate-limits us. Retry it here,
-      # where a failure is cheap, instead of inside the backgrounded bootRun.
-      - name: Prime Gradle dependencies
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: |
-          for attempt in 1 2 3; do
-            if ./gradlew --quiet -PnoSpotless :stirling-pdf:classes; then
-              exit 0
-            fi
-            echo "::warning::Gradle dependency resolution failed (attempt $attempt of 3)"
-            sleep $((attempt * 30))
-          done
-          echo "::error::Gradle could not resolve dependencies after 3 attempts"
-          exit 1
+
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
diff --git a/.github/workflows/e2e-stubbed.yml b/.github/workflows/e2e-stubbed.yml
index df3c5fa82a..d02005936c 100644
--- a/.github/workflows/e2e-stubbed.yml
+++ b/.github/workflows/e2e-stubbed.yml
@@ -27,7 +27,7 @@ jobs:
             project: stubbed-webkit
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
diff --git a/.github/workflows/frontend-a11y.yml b/.github/workflows/frontend-a11y.yml
index e9f259f2ab..8f97120d96 100644
--- a/.github/workflows/frontend-a11y.yml
+++ b/.github/workflows/frontend-a11y.yml
@@ -3,17 +3,12 @@ name: Frontend a11y regression gate
 # Reusable workflow called from build.yml when frontend sources change.
 #
 # Scans the stories this branch touches in real Chromium and runs axe against
-# each. Existing violations are grandfathered in .storybook/a11y-baseline.json;
-# the check fails on a NEW violation — a story breaking a rule it wasn't already
-# breaking — or on a story that fails to render at all.
+# each; the check fails on any axe violation, or on a story that fails to render
+# at all.
 #
 # Only changed stories, because a full sweep is ~30 minutes: far too slow to sit
 # in front of every merge. The whole suite is scanned nightly instead
 # (nightly.yml), which catches anything a branch didn't touch.
-#
-# Advisory for now: this is not in build.yml's all-checks-passed list, so a
-# failure reports without blocking. Promote it once a few weeks of runs show the
-# pass/fail is stable.
 on:
   workflow_call:
 
@@ -26,7 +21,7 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
diff --git a/.github/workflows/frontend-backend-licenses-update.yml b/.github/workflows/frontend-backend-licenses-update.yml
index 23999d038a..9aef2316d2 100644
--- a/.github/workflows/frontend-backend-licenses-update.yml
+++ b/.github/workflows/frontend-backend-licenses-update.yml
@@ -28,7 +28,7 @@ jobs:
       licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -36,12 +36,16 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check for file changes
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: changes
         with:
           filters: .github/config/.files.yaml
 
   generate-frontend-license-report:
+    # ci-bot, not bot-identity: this job runs on PRs too, and bot-identity is main-only.
+    environment:
+      name: ci-bot
+      deployment: false
     if: needs.files-changed.outputs.licenses-frontend == 'true'
     name: Generate Frontend License Report
     needs: files-changed
@@ -52,7 +56,7 @@ jobs:
       repository-projects: write # Required for enabling automerge
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -316,6 +320,10 @@ jobs:
           GH_TOKEN: ${{ steps.setup-bot.outputs.token }}
 
   generate-backend-license-report:
+    # ci-bot, not bot-identity: this job runs on PRs too, and bot-identity is main-only.
+    environment:
+      name: ci-bot
+      deployment: false
     if: needs.files-changed.outputs.licenses-backend == 'true'
     needs: files-changed
     name: Generate Backend License Report
@@ -326,7 +334,7 @@ jobs:
       repository-projects: write # Required for enabling automerge
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -344,22 +352,19 @@ jobs:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
-      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
+      - name: Cache Gradle
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.gradle/caches
             ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
+          key: gradle-license-report-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
diff --git a/.github/workflows/frontend-validation.yml b/.github/workflows/frontend-validation.yml
index 7e2602c311..133d940b28 100644
--- a/.github/workflows/frontend-validation.yml
+++ b/.github/workflows/frontend-validation.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
       - name: Checkout repository
diff --git a/.github/workflows/manage-label.yml b/.github/workflows/manage-label.yml
index 571479b030..1a8bdd112d 100644
--- a/.github/workflows/manage-label.yml
+++ b/.github/workflows/manage-label.yml
@@ -15,7 +15,7 @@ jobs:
       issues: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml
index 10c0542c8c..0ac94ffe68 100644
--- a/.github/workflows/multiOSReleases.yml
+++ b/.github/workflows/multiOSReleases.yml
@@ -38,6 +38,9 @@ permissions:
 
 jobs:
   determine-matrix:
+    environment:
+      name: ci-unsigned
+      deployment: false
     if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
@@ -45,29 +48,26 @@ jobs:
       version: ${{ steps.versionNumber.outputs.versionNumber }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Cache Gradle
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-tauri-releases-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Get version number
@@ -93,7 +93,7 @@ jobs:
           ALL="$WINDOWS,$WINDOWS_ARM64,$MACOS,$LINUX"
 
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            case "${{ github.event.inputs.platform }}" in
+            case "${INPUT_PLATFORM}" in
               "windows")
                 echo "matrix={\"include\":[$WINDOWS,$WINDOWS_ARM64]}" >> $GITHUB_OUTPUT
                 ;;
@@ -115,7 +115,12 @@ jobs:
             echo "matrix={\"include\":[$ALL]}" >> $GITHUB_OUTPUT
           fi
 
+        env:
+          INPUT_PLATFORM: ${{ github.event.inputs.platform }}
   build-jars:
+    environment:
+      name: ci-unsigned
+      deployment: false
     needs: determine-matrix
     runs-on: ubuntu-latest
     strategy:
@@ -135,29 +140,26 @@ jobs:
             file_suffix: "-server"
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Cache Gradle
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-tauri-releases-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Setup Node.js
         if: matrix.variant.build_frontend == true
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -194,6 +196,7 @@ jobs:
           retention-days: 1
 
   build:
+    environment: release-signing
     needs: determine-matrix
     strategy:
       fail-fast: false
@@ -201,11 +204,10 @@ jobs:
     runs-on: ${{ matrix.platform }}
     env:
       SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
       RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
           allowed-endpoints: >
@@ -234,6 +236,14 @@ jobs:
           toolchain: stable
           targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
+      - name: Cache Gradle
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-tauri-releases-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       # x86_64 JDK is set up first so the aarch64 step below can leave its
       # JAVA_HOME as the active one. The macOS universal JRE build needs
       # jmods from both arches; the x64 path is captured into the env
@@ -257,17 +267,6 @@ jobs:
           java-version: "25"
           distribution: ${{ matrix.platform == 'windows-11-arm' && 'microsoft' || 'temurin' }}
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
 
@@ -292,7 +291,7 @@ jobs:
       # DigiCert KeyLocker Setup (Cloud HSM)
       - name: Setup DigiCert KeyLocker
         id: digicert-setup
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
         uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
         env:
           SM_API_KEY: ${{ secrets.SM_API_KEY }}
@@ -302,22 +301,22 @@ jobs:
           SM_HOST: ${{ secrets.SM_HOST }}
 
       - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
         shell: pwsh
         run: |
           Write-Host "Setting up DigiCert KeyLocker environment..."
 
           # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certBytes = [Convert]::FromBase64String("$env:SM_CLIENT_CERT_FILE_B64")
           $certPath = "D:\Certificate_pkcs12.p12"
           [IO.File]::WriteAllBytes($certPath, $certBytes)
 
           # Set environment variables
           echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+          echo "SM_HOST=$env:SM_HOST" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=$env:SM_API_KEY" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=$env:SM_CLIENT_CERT_PASSWORD" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=$env:SM_KEYPAIR_ALIAS" >> $env:GITHUB_ENV
 
           # Get PKCS11 config path from DigiCert action
           $pkcs11Config = $env:PKCS11_CONFIG
@@ -335,40 +334,14 @@ jobs:
             }
           }
 
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY == '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
         env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
       - name: Import Apple Developer Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -389,7 +362,7 @@ jobs:
           rm certificate.p12
 
       - name: Verify Certificate
-        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: matrix.platform == 'macos-15' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
         run: |
           echo "Verifying Apple Developer Certificate..."
           KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -405,7 +378,7 @@ jobs:
       # Without this, signCommand failures are opaque (Tauri captures but drops
       # smctl's stderr) - running these loudly surfaces auth/env/keypair issues.
       - name: Preflight smctl
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
         shell: pwsh
         env:
           KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
@@ -436,7 +409,7 @@ jobs:
       # smctl reads SM_HOST, SM_API_KEY, SM_CLIENT_CERT_FILE, SM_CLIENT_CERT_PASSWORD
       # from env (set by prior DigiCert setup step). No --config-file needed.
       - name: Configure Windows code signing
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
         shell: bash
         env:
           KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
@@ -457,7 +430,7 @@ jobs:
           sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
 
       - name: Import release GPG signing key (Linux)
-        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
         run: |
           echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
           gpg --list-secret-keys --keyid-format=long
@@ -489,8 +462,8 @@ jobs:
           #   APPIMAGETOOL_SIGN_PASSPHRASE  appimagetool uses this to unlock the GPG key non-interactively
           #   SIGN_KEY                      appimagetool picks the key matching this fingerprint
           # Without SIGN=1, the other two are ignored and the AppImage is built unsigned even if a key is present.
-          # Mirror the Windows/macOS gate: only sign on a real release/dispatch+sign or V2-master, when secret is present.
-          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')) && '1' || '0' }}
+          # Mirror the Windows/macOS gate: only sign on a real release/dispatch+sign or the release branch, when secret is present.
+          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')) && '1' || '0' }}
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
           SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -516,7 +489,7 @@ jobs:
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          GPG_SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')) && '1' || '0' }}
+          GPG_SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')) && '1' || '0' }}
           SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
           APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
         run: |
@@ -555,7 +528,7 @@ jobs:
           echo "Stripped bundled libwayland from $(basename "$AI")"
 
       - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
+        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release')
         env:
           RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
         run: |
@@ -570,7 +543,7 @@ jobs:
       # artifact. Tauri signs a COPY when bundling into the MSI and leaves the raw
       # cargo output unsigned, so checking it produces false negatives.
       - name: Verify Windows Code Signature
-        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        if: ${{ startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/release') }}
         timeout-minutes: 15
         shell: pwsh
         run: |
@@ -731,7 +704,7 @@ jobs:
       contents: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -902,11 +875,11 @@ jobs:
       # workflow_dispatch path requires platform=='all' so a single-platform
       # dispatch can't overwrite an existing release's full latest.json with a
       # partial one (action-gh-release defaults overwrite_files:true).
-      # release / V2-master always build the full matrix so no extra guard needed.
+      # release event / release branch always build the full matrix so no extra guard needed.
       # fail_on_unmatched_files makes a missing latest.json or installer fail loudly
       # instead of silently shipping a broken auto-update.
       - name: Upload binaries to Release
-        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
+        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/release'
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: v${{ needs.determine-matrix.outputs.version }}
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ba4054f190..65c25b7b66 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -4,6 +4,11 @@ on:
   schedule:
     - cron: "0 2 * * *" # 2 AM UTC every night
   workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/nightly.yml
+      - testing/cucumber/**
+      - docker/embedded/compose/test_cicd.yml
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -18,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -59,13 +64,17 @@ jobs:
   # the story itself — a shared component, a theme token — still surfaces within
   # a day.
   a11y-all-stories:
-    name: a11y (every story, light + dark)
+    name: a11y (every story)
+    strategy:
+      fail-fast: false
+      matrix:
+        theme: [light, dark]
     runs-on: ubuntu-latest
-    # Two full sweeps (one per theme), each ~30 minutes of browser time.
-    timeout-minutes: 120
+    # One full sweep (~30 minutes of browser time).
+    timeout-minutes: 60
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -82,14 +91,14 @@ jobs:
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
 
-      - name: a11y gate (every story, light + dark)
-        run: task frontend:storybook:a11y
+      - name: a11y gate (every story, ${{ matrix.theme }})
+        run: task frontend:storybook:a11y:${{ matrix.theme }}
 
       - name: Upload scan reports
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: a11y-scan-nightly-${{ github.run_id }}
+          name: a11y-scan-nightly-${{ matrix.theme }}-${{ github.run_id }}
           path: frontend/.a11y-scan/
           retention-days: 14
           if-no-files-found: ignore
@@ -99,8 +108,13 @@ jobs:
 
   # Builds all desktop platforms on a schedule so the Rust dependency cache is
   # written on main, where PR and merge-queue tauri builds can restore it.
+  #
+  # The only job here still pinned to schedule/main: it primes a cache rather than
+  # testing anything, and Actions scopes a cache written on a PR branch to that PR
+  # alone, so a PR run costs three platform builds and produces nothing reusable.
   warm-tauri-cache:
     name: Warm Tauri Rust cache
+    if: github.event_name == 'schedule' || github.ref == 'refs/heads/main'
     permissions:
       contents: read
       pull-requests: write
@@ -109,3 +123,75 @@ jobs:
       platform: all
       sign: false
     secrets: inherit
+
+  # Runs the @nightly tag (conversion scenarios) plus a 10-shard concurrency run
+  # of every other feature.
+  cucumber-nightly:
+    environment:
+      name: ci-unsigned
+      deployment: false
+    name: Cucumber (nightly scenarios + full concurrency)
+    runs-on: ubuntu-latest
+    # Fork pull requests get no MAVEN_* secrets, so the image build cannot work.
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: read
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: "25"
+          distribution: "temurin"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: |
+            engine/pyproject.toml
+            engine/uv.lock
+
+      - name: Install Task
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+
+      - name: Start the fat image with login and storage enabled
+        run: docker compose -f docker/embedded/compose/test_cicd.yml up -d --build
+        env:
+          MAVEN_USER: ${{ secrets.MAVEN_USER }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
+
+      - name: Wait for the server
+        # Throwaway key from test_cicd.yml; out of the header literal for gitleaks.
+        env:
+          TEST_API_KEY: "123456789"
+        run: |
+          curl --retry 90 --retry-delay 3 --retry-connrefused --retry-all-errors \
+            -sf -H "X-API-KEY: $TEST_API_KEY" http://localhost:8080/api/v1/info/status
+
+      # Heavy LibreOffice/Calibre/Ghostscript conversions, excluded from the PR run.
+      # Both tasks install the behave deps themselves, so there is no separate uv sync step.
+      - name: Run @nightly scenarios
+        run: task cucumber:nightly
+
+      # Genuinely different payloads contending on one backend.
+      - name: Sharded concurrency validation
+        run: task cucumber:parallel SHARDS=10
+
+      - name: Container logs on failure
+        if: failure()
+        run: docker compose -f docker/embedded/compose/test_cicd.yml logs --tail 400
+
+      - name: Tear down
+        if: always()
+        run: docker compose -f docker/embedded/compose/test_cicd.yml down -v
diff --git a/.github/workflows/package-managers.yml b/.github/workflows/package-managers.yml
index e88c5e400e..777c8d6ed4 100644
--- a/.github/workflows/package-managers.yml
+++ b/.github/workflows/package-managers.yml
@@ -28,7 +28,7 @@ jobs:
       jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -73,13 +73,14 @@ jobs:
           echo "jar_sha256=$JAR_SHA" >> "$GITHUB_OUTPUT"
 
   update-homebrew-and-scoop:
+    environment: package-publish
     needs: get-release-info
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/pr-conflict-labeler.yml b/.github/workflows/pr-conflict-labeler.yml
index a44d4f7b28..c642b6cf3d 100644
--- a/.github/workflows/pr-conflict-labeler.yml
+++ b/.github/workflows/pr-conflict-labeler.yml
@@ -27,29 +27,22 @@ jobs:
     name: Label conflicted PRs
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      issues: write
-      pull-requests: read
+      contents: read # actions/checkout
+      issues: write # get/create the repo-level conflict label
+      pull-requests: write # pulls.get/list plus add/remove the label on PRs
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - name: Check out the repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up stirling-bot token
-        id: setup-bot
-        uses: ./.github/actions/setup-bot
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
       - name: Apply conflict label
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ steps.setup-bot.outputs.token }}
+          github-token: ${{ github.token }}
           script: |
             const conflictLabel = process.env.CONFLICT_LABEL;
             const owner = context.repo.owner;
diff --git a/.github/workflows/pre_commit.yml b/.github/workflows/pre_commit.yml
index 18c4782927..db67ccefe6 100644
--- a/.github/workflows/pre_commit.yml
+++ b/.github/workflows/pre_commit.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -34,7 +34,7 @@ jobs:
           cache-suffix: pre-commit
 
       - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
 
       - name: Run pre-commit checks
         run: task pre-commit
diff --git a/.github/workflows/push-docker-base.yml b/.github/workflows/push-docker-base.yml
index 167b71531e..97c227f23c 100644
--- a/.github/workflows/push-docker-base.yml
+++ b/.github/workflows/push-docker-base.yml
@@ -17,6 +17,9 @@ permissions:
 
 jobs:
   push-base:
+    # Own environment: docker-publish is branch-locked to release/main,
+    # which excludes the baseDockerImage/accessIssueFix branches this runs on.
+    environment: docker-base-publish
     if: ${{ vars.CI_PROFILE != 'lite' && github.actor == 'Frooodle' }}
     runs-on: ubuntu-24.04-8core
     permissions:
@@ -32,9 +35,11 @@ jobs:
 
       - name: Set version
         id: version
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
         run: |
           if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            VERSION="${{ github.event.inputs.version }}"
+            VERSION="${INPUT_VERSION}"
           elif [ "${{ github.ref_name }}" == "accessIssueFix" ]; then
             VERSION="1.0.3"
           else
@@ -43,7 +48,7 @@ jobs:
           echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml
index 7f10d99b27..ea379cf7c6 100644
--- a/.github/workflows/push-docker.yml
+++ b/.github/workflows/push-docker.yml
@@ -20,10 +20,8 @@ on:
         default: false
   push:
     branches:
-      - master
+      - release
       - main
-      - V2-master
-      - testMain
 
 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -42,6 +40,7 @@ permissions:
 
 jobs:
   push:
+    environment: docker-publish
     if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-24.04-8core
     permissions:
@@ -53,29 +52,26 @@ jobs:
       RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Cache Gradle
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-push-docker-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
@@ -91,13 +87,13 @@ jobs:
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
 
       - name: Install cosign
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        if: github.ref == 'refs/heads/release'
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: "v2.4.1"
 
       - name: Install cosign
-        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
+        if: github.ref == 'refs/heads/release'
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: "v2.4.1"
@@ -133,8 +129,8 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/release' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/release' }}
 
       - name: Build and push Unified Dockerfile (latest variant)
         id: build-push-latest
@@ -158,7 +154,7 @@ jobs:
           sbom: true
 
       - name: Sign regular images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-latest.outputs.digest != ''
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/release') && steps.build-push-latest.outputs.digest != ''
         env:
           DIGEST: ${{ steps.build-push-latest.outputs.digest }}
           TAGS: ${{ steps.meta.outputs.tags }}
@@ -182,8 +178,8 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-fat,enable=${{ github.ref == 'refs/heads/release' }}
+            type=raw,value=latest-fat,enable=${{ github.ref == 'refs/heads/release' }}
 
       - name: Build and push Unified Dockerfile (fat variant)
         id: build-push-fat
@@ -204,7 +200,7 @@ jobs:
           sbom: true
 
       - name: Sign fat images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-fat.outputs.digest != ''
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/release') && steps.build-push-fat.outputs.digest != ''
         env:
           DIGEST: ${{ steps.build-push-fat.outputs.digest }}
           TAGS: ${{ steps.meta-fat.outputs.tags }}
@@ -226,8 +222,8 @@ jobs:
             ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf
             ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf
           tags: |
-            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
+            type=raw,value=${{ steps.versionNumber.outputs.versionNumber }}-ultra-lite,enable=${{ github.ref == 'refs/heads/release' }}
+            type=raw,value=latest-ultra-lite,enable=${{ github.ref == 'refs/heads/release' }}
 
       - name: Build and push Unified Dockerfile (ultra-lite variant)
         id: build-push-lite
@@ -248,7 +244,7 @@ jobs:
           sbom: true
 
       - name: Sign ultra-lite images
-        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master') && steps.build-push-lite.outputs.digest != ''
+        if: env.RUN_MAIN_APP == 'true' && (github.ref == 'refs/heads/release') && steps.build-push-lite.outputs.digest != ''
         env:
           DIGEST: ${{ steps.build-push-lite.outputs.digest }}
           TAGS: ${{ steps.meta-lite.outputs.tags }}
@@ -260,7 +256,7 @@ jobs:
           done
 
       # Standalone unoserver image — versioned independently via
-      # docker/unoserver/VERSION. master/V2-master: publish <version>+latest
+      # docker/unoserver/VERSION. release: publish <version>+latest
       # only when the version is new. main/testMain: republish :alpha only
       # when the source hash differs from the published image's annotation.
       - name: Read unoserver image version
@@ -319,7 +315,7 @@ jobs:
           fi
 
           case "$EFFECTIVE_REF" in
-            refs/heads/master|refs/heads/V2-master)
+            refs/heads/release)
               if [ "${FORCE_REBUILD}" = "true" ]; then
                 echo "force_unoserver_rebuild=true — building stable regardless"
                 mode="stable"
diff --git a/.github/workflows/rollback-latest.yml b/.github/workflows/rollback-latest.yml
index 27141eff31..3e49f727c6 100644
--- a/.github/workflows/rollback-latest.yml
+++ b/.github/workflows/rollback-latest.yml
@@ -13,12 +13,13 @@ permissions:
 
 jobs:
   rollback:
+    environment: docker-publish
     runs-on: ubuntu-latest
     permissions:
       packages: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 2eab52b1d4..f0129277de 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -75,6 +75,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index ab9078831a..af255de3cf 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml
index ead800f73f..1bfc94be5b 100644
--- a/.github/workflows/swagger.yml
+++ b/.github/workflows/swagger.yml
@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
   push:
     branches:
-      - master
+      - release
 
 # cancel in-progress jobs if a new job is triggered
 # This is useful to avoid running multiple builds for the same branch if a new commit is pushed
@@ -23,33 +23,33 @@ permissions:
 
 jobs:
   push:
+    # package-publish holds SWAGGERHUB_API_KEY. It requires reviewer approval and
+    # is limited to main / release / v* tags, so every push to release waits on one.
+    environment: package-publish
     if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Cache Gradle
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-swagger-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Generate Swagger documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs
 
diff --git a/.github/workflows/sync-portal-docs.yml b/.github/workflows/sync-portal-docs.yml
index 0b27858d5f..636cd5f2e1 100644
--- a/.github/workflows/sync-portal-docs.yml
+++ b/.github/workflows/sync-portal-docs.yml
@@ -24,6 +24,7 @@ permissions:
 
 jobs:
   sync:
+    environment: bot-identity
     name: Sync docs manifest
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -32,7 +33,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/sync_files_v2.yml b/.github/workflows/sync_files_v2.yml
index 1888c08ca7..124c992c71 100644
--- a/.github/workflows/sync_files_v2.yml
+++ b/.github/workflows/sync_files_v2.yml
@@ -33,10 +33,11 @@ permissions:
 
 jobs:
   sync-files:
+    environment: bot-identity
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -65,7 +66,7 @@ jobs:
           uv sync --project engine --locked --group tools
 
       - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
 
       - name: Sync translation TOML files
         run: |
diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index d90c5f7c68..0a82647690 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -26,6 +26,10 @@ on:
         required: false
         type: boolean
         default: false
+      use_shared_cache:
+        required: false
+        type: boolean
+        default: false
   workflow_dispatch:
     inputs:
       platform:
@@ -57,13 +61,18 @@ permissions:
 
 jobs:
   determine-matrix:
+    # Only probes APPLE_CERTIFICATE for presence, so it stays on the unrestricted
+    # signing environment - release-signing would block every PR run.
+    environment:
+      name: ci-signing
+      deployment: false
     if: ${{ vars.CI_PROFILE != 'lite' }}
     runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -103,6 +112,12 @@ jobs:
           echo "matrix={\"include\":[$JOINED]}" >> $GITHUB_OUTPUT
 
   build:
+    # Windows/GPG signing only runs on main (see the per-step gates below), so only
+    # that path needs the reviewer-gated release-signing environment. Everything else
+    # (PRs, merge queue, nightly) signs macOS only and uses ci-signing, which has no
+    # approval or branch restriction.
+    environment:
+      name: ${{ (inputs.sign && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))) && 'release-signing' || 'ci-signing' }}
     needs: determine-matrix
     strategy:
       fail-fast: false
@@ -110,7 +125,6 @@ jobs:
     runs-on: ${{ matrix.platform }}
     env:
       SM_API_KEY: ${{ secrets.SM_API_KEY }}
-      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
       RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
       # Per-platform sign gate. macOS signs on any run with the cert available,
@@ -120,7 +134,7 @@ jobs:
       SIGN_BUNDLE: ${{ inputs.sign && (matrix.platform == 'macos-15' && secrets.APPLE_CERTIFICATE != '' || github.ref == 'refs/heads/main') }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -150,7 +164,7 @@ jobs:
       # only recompiles the app crate. Written on main; PRs and the merge queue
       # restore from it.
       - name: Cache Rust build
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           workspaces: frontend/editor/src-tauri
           # Stable key shared across workflows so the nightly warmer.
@@ -160,6 +174,24 @@ jobs:
           # Save the dependency cache even if a later step fails
           cache-on-failure: true
 
+      - name: Restore cache Gradle User Home
+        if: inputs.use_shared_cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
+      - name: Restore cache Gradle
+        if: inputs.use_shared_cache == false
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-tauri-build-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up x86_64 JDK 25 (macOS universal JRE)
         if: matrix.platform == 'macos-15'
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
@@ -179,17 +211,6 @@ jobs:
           java-version: "25"
           distribution: ${{ matrix.platform == 'windows-11-arm' && 'microsoft' || 'temurin' }}
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Setup Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
 
@@ -227,20 +248,26 @@ jobs:
       - name: Setup DigiCert KeyLocker Certificate
         if: ${{ inputs.sign && startsWith(matrix.platform, 'windows') && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
         shell: pwsh
+        env:
+          SM_CLIENT_CERT_FILE_B64: ${{ secrets.SM_CLIENT_CERT_FILE_B64 }}
+          SM_HOST: ${{ secrets.SM_HOST }}
+          SM_API_KEY: ${{ secrets.SM_API_KEY }}
+          SM_CLIENT_CERT_PASSWORD: ${{ secrets.SM_CLIENT_CERT_PASSWORD }}
+          SM_KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
         run: |
           Write-Host "Setting up DigiCert KeyLocker environment..."
 
           # Decode client certificate
-          $certBytes = [Convert]::FromBase64String("${{ secrets.SM_CLIENT_CERT_FILE_B64 }}")
+          $certBytes = [Convert]::FromBase64String("$env:SM_CLIENT_CERT_FILE_B64")
           $certPath = "D:\Certificate_pkcs12.p12"
           [IO.File]::WriteAllBytes($certPath, $certBytes)
 
           # Set environment variables
           echo "SM_CLIENT_CERT_FILE=D:\Certificate_pkcs12.p12" >> $env:GITHUB_ENV
-          echo "SM_HOST=${{ secrets.SM_HOST }}" >> $env:GITHUB_ENV
-          echo "SM_API_KEY=${{ secrets.SM_API_KEY }}" >> $env:GITHUB_ENV
-          echo "SM_CLIENT_CERT_PASSWORD=${{ secrets.SM_CLIENT_CERT_PASSWORD }}" >> $env:GITHUB_ENV
-          echo "SM_KEYPAIR_ALIAS=${{ secrets.SM_KEYPAIR_ALIAS }}" >> $env:GITHUB_ENV
+          echo "SM_HOST=$env:SM_HOST" >> $env:GITHUB_ENV
+          echo "SM_API_KEY=$env:SM_API_KEY" >> $env:GITHUB_ENV
+          echo "SM_CLIENT_CERT_PASSWORD=$env:SM_CLIENT_CERT_PASSWORD" >> $env:GITHUB_ENV
+          echo "SM_KEYPAIR_ALIAS=$env:SM_KEYPAIR_ALIAS" >> $env:GITHUB_ENV
 
           # Get PKCS11 config path from DigiCert action
           $pkcs11Config = $env:PKCS11_CONFIG
@@ -258,38 +285,6 @@ jobs:
             }
           }
 
-      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
-      - name: Import Windows Code Signing Certificate
-        if: ${{ inputs.sign && startsWith(matrix.platform, 'windows') && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-        shell: powershell
-        run: |
-          if ($env:WINDOWS_CERTIFICATE) {
-            Write-Host "Importing Windows Code Signing Certificate..."
-
-            # Decode base64 certificate and save to file
-            $certBytes = [Convert]::FromBase64String($env:WINDOWS_CERTIFICATE)
-            $certPath = Join-Path $env:RUNNER_TEMP "certificate.pfx"
-            [IO.File]::WriteAllBytes($certPath, $certBytes)
-
-            # Import certificate to CurrentUser\My store
-            $cert = Import-PfxCertificate -FilePath $certPath -CertStoreLocation Cert:\CurrentUser\My -Password (ConvertTo-SecureString -String $env:WINDOWS_CERTIFICATE_PASSWORD -AsPlainText -Force)
-
-            # Extract and set thumbprint as environment variable
-            $thumbprint = $cert.Thumbprint
-            Write-Host "Certificate imported with thumbprint: $thumbprint"
-            echo "WINDOWS_CERTIFICATE_THUMBPRINT=$thumbprint" >> $env:GITHUB_ENV
-
-            # Clean up certificate file
-            Remove-Item $certPath
-
-            Write-Host "Windows certificate import completed."
-          } else {
-            Write-Host "⚠️ WINDOWS_CERTIFICATE secret not set - building unsigned binary"
-          }
-
       - name: Import Apple Developer Certificate
         if: env.SIGN_BUNDLE == 'true' && matrix.platform == 'macos-15'
         env:
@@ -697,7 +692,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -789,7 +784,7 @@ jobs:
     if: always()
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/test-build-docker.yml b/.github/workflows/test-build-docker.yml
index 0d546381d8..37cb7cb546 100644
--- a/.github/workflows/test-build-docker.yml
+++ b/.github/workflows/test-build-docker.yml
@@ -37,6 +37,9 @@ jobs:
   # spring-security=true matrix entry if `task backend:build` and
   # `task backend:build:ci` produce equivalent JARs (verify before wiring).
   test-build-docker-images:
+    environment:
+      name: ci-unsigned
+      deployment: false
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -53,7 +56,7 @@ jobs:
             cache-scope: stirling-pdf-fat
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
@@ -78,23 +81,20 @@ jobs:
           docker system prune -af || true
           echo "Disk space after cleanup:" && df -h
 
+      - name: Restore cache Gradle User Home
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-v1-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'buildSrc/**', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
+
       - name: Set up JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: "25"
           distribution: "temurin"
 
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
       - name: Build application
@@ -191,7 +191,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/testdriver.yml b/.github/workflows/testdriver.yml
deleted file mode 100644
index 458abacd25..0000000000
--- a/.github/workflows/testdriver.yml
+++ /dev/null
@@ -1,213 +0,0 @@
-name: UI test with TestDriverAI
-
-on:
-  push:
-    branches: ["master", "UITest", "testdriver"]
-
-# cancel in-progress jobs if a new job is triggered
-# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
-# or a pull request is updated.
-# It helps to save resources and time by ensuring that only the latest commit is built and tested
-# This is particularly useful for long-running jobs that may take a while to complete.
-# The `group` is set to a combination of the workflow name, event name, and branch name.
-# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
-# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  deploy:
-    if: ${{ vars.CI_PROFILE != 'lite' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle User Home
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties', 'gradle/libs.versions.toml', 'settings.gradle', 'build.gradle', 'app/**/build.gradle', 'gradle/**/*.gradle') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-${{ runner.arch }}-jdk-25-
-            gradle-${{ runner.os }}-${{ runner.arch }}-
-
-      - name: Build with Gradle
-        run: ./gradlew build
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          DISABLE_ADDITIONAL_FEATURES: true
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-
-      - name: Get version number
-        id: versionNumber
-        run: |
-          VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
-          echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_API }}
-
-      - name: Build and push test image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          cache-from: type=gha,scope=stirling-pdf-latest
-          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64
-
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
-          sudo chmod 600 ../private.key
-
-      - name: Deploy to VPS
-        run: |
-          cat > docker-compose.yml << EOF
-          version: '3.3'
-          services:
-            stirling-pdf:
-              container_name: stirling-pdf-test-${{ github.sha }}
-              image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
-              ports:
-                - "1337:8080"
-              volumes:
-                - /stirling/test-${{ github.sha }}/data:/usr/share/tessdata:rw
-                - /stirling/test-${{ github.sha }}/config:/configs:rw
-                - /stirling/test-${{ github.sha }}/logs:/logs:rw
-              environment:
-                DISABLE_ADDITIONAL_FEATURES: "true"
-                SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
-                UI_APPNAME: "Stirling-PDF Test"
-                UI_HOMEDESCRIPTION: "Test Deployment"
-                UI_APPNAMENAVBAR: "Test"
-                SYSTEM_MAXFILESIZE: "100"
-                METRICS_ENABLED: "true"
-                SYSTEM_GOOGLEVISIBILITY: "false"
-                SYSTEM_ENABLEANALYTICS: "false"
-              restart: on-failure:5
-          EOF
-
-          scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
-
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
-            mkdir -p /stirling/test-${{ github.sha }}/{data,config,logs}
-            mv /tmp/docker-compose.yml /stirling/test-${{ github.sha }}/docker-compose.yml
-            cd /stirling/test-${{ github.sha }}
-            docker-compose pull
-            docker-compose up -d
-          EOF
-
-  files-changed:
-    if: always()
-    name: detect what files changed
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    outputs:
-      frontend: ${{ steps.changes.outputs.frontend }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Check for file changes
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
-        id: changes
-        with:
-          filters: ".github/config/.files.yaml"
-
-  test:
-    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [deploy, files-changed]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          cache: "npm"
-          cache-dependency-path: frontend/package-lock.json
-
-      - name: Run TestDriver.ai
-        uses: testdriverai/action@f0d0f45fdd684db628baa843fe9313f3ca3a8aa8 #1.1.3
-        with:
-          key: ${{secrets.TESTDRIVER_API_KEY}}
-          prerun: |
-            choco install go-task -y
-            task frontend:build
-            cd frontend
-            npm install dashcam-chrome --save
-            Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
-            Start-Sleep -Seconds 20
-          prompt: |
-            1. /run testing/testdriver/test.yml
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          FORCE_COLOR: "3"
-
-  cleanup:
-    needs: [deploy, test]
-    runs-on: ubuntu-latest
-    if: always()
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Set up SSH
-        run: |
-          mkdir -p ~/.ssh/
-          echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
-          sudo chmod 600 ../private.key
-
-      - name: Cleanup deployment
-        if: always()
-        run: |
-          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
-            cd /stirling/test-${{ github.sha }}
-            docker-compose down
-            cd /stirling
-            rm -rf test-${{ github.sha }}
-          EOF
-        continue-on-error: true # Ensure cleanup runs even if previous steps fail
diff --git a/.gitignore b/.gitignore
index a064973a3b..4b34350f67 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,7 @@ watchedFolders/
 # also matches this frontend source component dir; keep the source tracked.
 !frontend/editor/src/proprietary/components/watchedFolders/
 clientWebUI/
+policy-webhook-spool/
 # Scratch dir used by local fixture-regeneration runs (see
 # app/proprietary/src/test/resources/db-migration-fixtures/README.md).
 # Holds downloaded JARs and disposable workdirs. Never committed.
@@ -38,6 +39,7 @@ exampleYmlFiles/stirling/
 /testing/file_snapshots
 /testing/cucumber/junit/
 /testing/cucumber/report.html
+/testing/cucumber/.parallel/
 /testing/.failed_tests
 /.test-state/
 SwaggerDoc.json
diff --git a/.gitleaksignore b/.gitleaksignore
index 12d98aebeb..c3917e985f 100644
--- a/.gitleaksignore
+++ b/.gitleaksignore
@@ -27,3 +27,8 @@ app/core/src/main/java/stirling/software/SPDF/pdf/signature/CreateSignatureBase.
 # Supabase publishable key (public by design, RLS-protected) used as a CI fallback
 # default in the tauri-build workflow when the GitHub secret is unset - not a real secret.
 .github/workflows/tauri-build.yml:generic-api-key:402
+
+# Staging Supabase publishable key (public by design). Ignored here rather than with an
+# inline gitleaks:allow because a trailing comment in a .properties file is part of the
+# value, so the pragma would end up inside the key.
+app/saas/src/main/resources/application-staging.properties:generic-api-key:16
diff --git a/.taskfiles/backend.yml b/.taskfiles/backend.yml
index 63773f61fc..08a12b9535 100644
--- a/.taskfiles/backend.yml
+++ b/.taskfiles/backend.yml
@@ -57,16 +57,57 @@ tasks:
       - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
         platforms: [linux, darwin]
 
+  # SaaS backend. dev:saas -> the PR's preview branch, staging:saas -> shared v3,
+  # PROFILES=none -> production against your own SAAS_DB_*. Production has no named
+  # task on purpose. Use `none`, not an empty value: Go template `default` treats ""
+  # as absent and would resolve back to dev.
+
   dev:saas:
-    desc: "Start backend in SaaS flavor against Supabase"
-    # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`.
+    desc: "Start SaaS backend against the current PR's Supabase preview branch"
+    dotenv: ['app/.env.saas.local', 'app/.env.saas']
+    vars:
+      PROFILES: '{{.PROFILES | default "dev"}}'
+    cmds:
+      # Don't move this check into a `sh:` var: dotenv is visible in cmds but not
+      # during var evaluation, so the test would always see an empty value.
+      - cmd: |
+          if [ "{{.PROFILES}}" = "dev" ] && [ -z "${SAAS_DEV_PROJECT_REF:-}" ]; then
+            echo ">> SAAS_DEV_PROJECT_REF is not set."
+            echo ">> Testing a SaaS PR? Put its ref, DB password and publishable key in app/.env.saas.local."
+            echo ">> Wanted the shared v3 project? Use 'task backend:staging:saas' instead."
+            exit 1
+          fi
+      - task: _run:saas
+        vars:
+          PORT: '{{.PORT}}'
+          PROFILES: '{{.PROFILES}}'
+          AIENGINE_URL: '{{.AIENGINE_URL}}'
+          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
+          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
+
+  staging:saas:
+    desc: "Start SaaS backend against the shared v3 staging project"
+    cmds:
+      - task: _run:saas
+        vars:
+          PORT: '{{.PORT}}'
+          PROFILES: staging
+          AIENGINE_URL: '{{.AIENGINE_URL}}'
+          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
+          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
+
+  _run:saas:
+    internal: true
     dotenv: ['app/.env.saas.local', 'app/.env.saas']
     ignore_error: true
     vars:
       PORT: '{{.PORT | default "8080"}}'
-      # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
       PROFILES: '{{.PROFILES | default "dev"}}'
+      # Built here rather than inline in the cmds below: the Windows line is an
+      # unquoted YAML scalar wrapping a cmd.exe string, so a nested {{if ne .X
+      # "none"}} needs escaped quotes that reach the Go template as literal
+      # backslashes and fail with `unexpected "\" in operand`.
+      PROFILE_ARGS: '{{if ne .PROFILES "none"}}--spring.profiles.include={{.PROFILES}}{{end}}'
       AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
       AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
       AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
@@ -77,9 +118,11 @@ tasks:
       AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
       AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
     cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
+      # PROFILE_ARGS is empty when PROFILES=none, i.e. the bare `saas` profile
+      # against SAAS_DB_* (production).
+      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILE_ARGS}}--args=\"{{.PROFILE_ARGS}}\"{{end}}"
         platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILES}}--args='--spring.profiles.include={{.PROFILES}}'{{end}}
+      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILE_ARGS}}--args='{{.PROFILE_ARGS}}'{{end}}
         platforms: [linux, darwin]
 
   build:
diff --git a/.taskfiles/cucumber.yml b/.taskfiles/cucumber.yml
new file mode 100644
index 0000000000..cb630abf85
--- /dev/null
+++ b/.taskfiles/cucumber.yml
@@ -0,0 +1,44 @@
+version: '3'
+
+tasks:
+  install:
+    desc: "Sync the Python environment with the cucumber test dependencies"
+    run: once
+    # Deliberately no sources/status fingerprint: the engine venv is shared, so it can
+    # already exist while synced to a different dependency group. uv no-ops when correct.
+    cmds:
+      - uv sync --project ../../engine --locked --group cucumber
+
+  run:
+    desc: "Run the cucumber suite against a running server (BASE_URL, default localhost:8080)"
+    deps: [install]
+    cmds:
+      - uv run --project ../../engine --locked --group cucumber python -m behave --no-capture -f plain {{.CLI_ARGS}}
+
+  nightly:
+    desc: "Run the @nightly cucumber scenarios, excluded from the default run"
+    summary: |
+      Heavy LibreOffice/Calibre/Ghostscript conversions. behave.ini excludes @nightly,
+      so this opts back in explicitly.
+
+      Pass extra behave flags via -- :
+        task cucumber:nightly -- --tags=@convert
+    deps: [install]
+    cmds:
+      - uv run --project ../../engine --locked --group cucumber python -m behave --tags=@nightly --no-capture -f plain {{.CLI_ARGS}}
+
+  parallel:
+    desc: "Run the cucumber suite as concurrent shards against one server (SHARDS, default 10)"
+    summary: |
+      Splits the feature files across SHARDS concurrent behave processes hitting a single
+      backend, to shake out cross-request interference. Auth-coupled features are pinned
+      to one shard because they change the admin password mid-scenario.
+
+        task cucumber:parallel
+        task cucumber:parallel SHARDS=4
+        BASE_URL=http://localhost:8081 task cucumber:parallel
+    deps: [install]
+    vars:
+      SHARDS: '{{.SHARDS | default "10"}}'
+    cmds:
+      - bash run-parallel.sh {{.SHARDS}} {{if .CLI_ARGS}}-- {{.CLI_ARGS}}{{end}}
diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index 19a3f6caf5..f5325c9ed7 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -5,6 +5,14 @@ version: '3'
 # mode flag) or use `--project editor/...` for tsc — so the editor lives
 # under frontend/editor/ without each task needing a cd.
 
+vars:
+  # Dev-only browser-tab label so concurrent worktrees are distinguishable. Only
+  # the worktree folder basename (e.g. "wt1") is exposed — never the full path,
+  # hostname, or user. Dropped from production builds.
+  DEV_LABEL:
+    sh: >-
+      {{if eq OS "windows"}}powershell -NoProfile -Command '$root = git rev-parse --show-toplevel 2>$null; if (-not $root) { $root = (Get-Location).Path }; Split-Path -Leaf $root'{{else}}basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"{{end}}
+
 tasks:
   install:
     desc: "Install dependencies"
@@ -80,16 +88,52 @@ tasks:
       OPEN: '{{.OPEN | default ""}}'
     env:
       BACKEND_URL: '{{.BACKEND_URL}}'
-      # Dev-only browser-tab label so concurrent worktrees are distinguishable.
-      # Only the worktree folder basename (e.g. "wt1") is exposed — never the
-      # full path, hostname, or user. Consumed at dev-serve time by vite.config
-      # and dropped from production builds.
-      STIRLING_DEV_LABEL:
-        sh: >-
-          {{if eq OS "windows"}}powershell -NoProfile -Command '$root = git rev-parse --show-toplevel 2>$null; if (-not $root) { $root = (Get-Location).Path }; Split-Path -Leaf $root'{{else}}basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"{{end}}
+      STIRLING_DEV_LABEL: '{{.DEV_LABEL}}'
     cmds:
       - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
 
+  # Separate from dev:_run rather than a flag on it: Task sets an `env:` key even
+  # when its value resolves to empty, and Vite treats an empty process.env VITE_* as
+  # authoritative over the committed editor/.env, so folding these in blanks Supabase
+  # config for the core, proprietary and desktop dev servers.
+  dev:_run:saas:
+    internal: true
+    ignore_error: true
+    # The backend's own env files, so both halves target one project. Paths are
+    # relative to this taskfile's dir, `frontend`.
+    dotenv: ['../app/.env.saas.local', '../app/.env.saas']
+    vars:
+      PORT: '{{.PORT | default "5173"}}'
+      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
+      OPEN: '{{.OPEN | default ""}}'
+      SAAS_ENV: '{{.SAAS_ENV | default "dev"}}'
+    env:
+      BACKEND_URL: '{{.BACKEND_URL}}'
+      STIRLING_DEV_LABEL: '{{.DEV_LABEL}}'
+      SAAS_ENV: '{{.SAAS_ENV}}'
+      # A real process.env VITE_* beats a committed .env in Vite (loadEnv applies
+      # process.env last), which is what lets this override editor/.env.
+      #
+      # These must stay `sh:`, not Go templates: dotenv values are visible to Task's
+      # embedded shell but not to templates, where {{.SAAS_DEV_PROJECT_REF}} is
+      # always empty.
+      VITE_SUPABASE_URL:
+        sh: |
+          case "${SAAS_ENV:-dev}" in
+            staging) ref="${SAAS_STAGING_PROJECT_REF:?set it in app/.env.saas.local}" ;;
+            *)       ref="${SAAS_DEV_PROJECT_REF:?set it in app/.env.saas.local, or run task staging:saas}" ;;
+          esac
+          echo "https://${ref}.supabase.co"
+      VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY:
+        sh: |
+          case "${SAAS_ENV:-dev}" in
+            staging) echo "${SAAS_STAGING_PUBLISHABLE_KEY:?set it in app/.env.saas.local}" ;;
+            *)       echo "${SAAS_DEV_PUBLISHABLE_KEY:?set it in app/.env.saas.local}" ;;
+          esac
+    cmds:
+      - 'echo ">> frontend Supabase target: $VITE_SUPABASE_URL"'
+      - npx vite editor --mode saas --port {{.PORT}}{{if .OPEN}} --open{{end}}
+
   dev:
     desc: "Start frontend dev server"
     cmds:
@@ -111,13 +155,23 @@ tasks:
         vars: { MODE: proprietary, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
 
   dev:saas:
-    desc: "Start frontend dev server in SaaS mode"
+    desc: "Start frontend dev server in SaaS mode (SAAS_ENV=dev|staging|prod)"
     deps:
       - task: prepare
         vars: { MODE: saas }
+    vars:
+      SAAS_ENV: '{{.SAAS_ENV | default "dev"}}'
+      # prod routes to the plain runner, which sets no VITE_SUPABASE_* and so leaves
+      # the committed editor/.env alone.
+      RUNNER: '{{if eq .SAAS_ENV "prod"}}dev:_run{{else}}dev:_run:saas{{end}}'
     cmds:
-      - task: dev:_run
-        vars: { MODE: saas, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }
+      - task: '{{.RUNNER}}'
+        vars:
+          MODE: saas
+          PORT: '{{.PORT}}'
+          BACKEND_URL: '{{.BACKEND_URL}}'
+          OPEN: '{{.OPEN}}'
+          SAAS_ENV: '{{.SAAS_ENV}}'
 
   dev:desktop:
     desc: "Start frontend dev server in desktop mode"
@@ -210,15 +264,26 @@ tasks:
       #   task frontend:storybook:test -- Button
       - npx vitest run --config .storybook/vitest.config.ts {{.CLI_ARGS}}
 
-  storybook:a11y:
-    desc: "a11y regression gate over every story, light and dark: fail only on NEW axe violations"
+  storybook:a11y:light:
+    desc: "a11y gate over every story in light mode"
     deps: [prepare, storybook:browser]
     cmds:
-      - node .storybook/a11y-scan.mjs
+      - node .storybook/a11y-scan.mjs {{.CLI_ARGS}}
       - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
-      - SCAN_THEME=dark node .storybook/a11y-scan.mjs
+
+  storybook:a11y:dark:
+    desc: "a11y gate over every story in dark mode"
+    deps: [prepare, storybook:browser]
+    cmds:
+      - SCAN_THEME=dark node .storybook/a11y-scan.mjs {{.CLI_ARGS}}
       - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --baseline .storybook/a11y-baseline.dark.json
 
+  storybook:a11y:
+    desc: "a11y gate over every story, light and dark"
+    cmds:
+      - task: storybook:a11y:light
+      - task: storybook:a11y:dark
+
   storybook:a11y:changed:
     desc: "a11y gate over the stories this branch affects (default base origin/main)"
     summary: |
@@ -233,7 +298,6 @@ tasks:
 
       Pass a base ref through CLI_ARGS, e.g.
         task frontend:storybook:a11y:changed -- origin/release
-    deps: [prepare, storybook:browser]
     vars:
       BASE: '{{.CLI_ARGS | default "origin/main"}}'
       CHANGED:
@@ -244,10 +308,10 @@ tasks:
             echo "a11y: no story files affected vs {{.BASE}} — nothing to check"
             exit 0
           fi
-          node .storybook/a11y-scan.mjs {{.CHANGED}}
-          node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
-          SCAN_THEME=dark node .storybook/a11y-scan.mjs {{.CHANGED}}
-          node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --baseline .storybook/a11y-baseline.dark.json
+          rc=0
+          task frontend:storybook:a11y:light -- {{.CHANGED}} || rc=1
+          task frontend:storybook:a11y:dark -- {{.CHANGED}} || rc=1
+          exit $rc
 
   storybook:a11y:record:
     desc: "Re-record both a11y baselines (run after intentionally fixing/adding violations)"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9092d5cd72..65fc4bc262 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,6 +2,13 @@
 
 Thank you for your interest in contributing to Stirling-PDF! There are many ways to contribute other than writing code. For example, reporting bugs, creating suggestions, and adding or modifying translations.
 
+## License
+
+By contributing to this project, you agree that your contributions will be licensed under the project [license](LICENSE), which follows an open-core model. 
+The codebase is a mix of MIT and source-available code, so your contribution is licensed according to the directory it is committed to.
+
+PRs are welcome in any directory by any user, just be aware of which license applies to the code you change.
+
 ## Issue Guidelines
 
 Issues can be used to report bugs, request features, or ask questions. If you have a question, you could also ask us in our [Discord](https://discord.gg/FJUSXUSYec).
@@ -63,7 +70,3 @@ For technical guides, setup instructions, and development resources:
 For configuration and usage guides, see:
 - [Database Guide](DATABASE.md) - Database setup and configuration
 - [OCR Guide](HowToUseOCR.md) - OCR setup and configuration
-
-## License
-
-By contributing to this project, you agree that your contributions will be licensed under the [MIT License](LICENSE).
diff --git a/Taskfile.yml b/Taskfile.yml
index 304a031ac0..92dcdcc742 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -25,6 +25,9 @@ includes:
   e2e:
     taskfile: .taskfiles/e2e.yml
     dir: .
+  cucumber:
+    taskfile: .taskfiles/cucumber.yml
+    dir: testing/cucumber
   pre-commit:
     taskfile: .taskfiles/pre-commit.yml
     dir: .
@@ -96,11 +99,22 @@ tasks:
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
           OPEN: "true"
 
+  # Set SAAS_DEV_PROJECT_REF in app/.env.saas.local to pick the PR.
   dev:saas:
-    desc: "Start SaaS backend + frontend concurrently on free ports"
+    desc: "Start SaaS backend + frontend + engine against the current PR's preview branch"
     cmds:
       - task: dev:_all
-        vars: { FRONTEND: saas, BACKEND: saas }
+        vars: { FRONTEND: saas, BACKEND: saas, SAAS_ENV: dev }
+
+  staging:saas:
+    desc: "Start SaaS backend + frontend + engine against the shared v3 staging project"
+    cmds:
+      - task: dev:_all
+        vars:
+          FRONTEND: saas
+          BACKEND: saas
+          BACKEND_TASK: backend:staging:saas
+          SAAS_ENV: staging
 
   dev:all:
     desc: "Start backend + frontend + engine concurrently on free ports"
@@ -112,6 +126,9 @@ tasks:
     vars:
       FRONTEND: '{{.FRONTEND | default "proprietary"}}'
       BACKEND: '{{.BACKEND | default "proprietary"}}'
+      BACKEND_TASK: '{{.BACKEND_TASK | default (printf "backend:dev:%s" .BACKEND)}}'
+      # Only meaningful to the saas frontend; every other flavor ignores it.
+      SAAS_ENV: '{{.SAAS_ENV | default ""}}'
       PORTS:
         sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
       BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
@@ -121,7 +138,7 @@ tasks:
       - task: engine:dev
         vars:
           PORT: '{{.ENGINE_PORT}}'
-      - task: 'backend:dev:{{.BACKEND}}'
+      - task: '{{.BACKEND_TASK}}'
         vars:
           PORT: '{{.BACKEND_PORT}}'
           AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
@@ -131,6 +148,7 @@ tasks:
           PORT: '{{.FRONTEND_PORT}}'
           BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
           OPEN: "true"
+          SAAS_ENV: '{{.SAAS_ENV}}'
 
   # ============================================================
   # Build
diff --git a/WINDOWS_SIGNING.md b/WINDOWS_SIGNING.md
index 58ffd6e657..95cbbd24e2 100644
--- a/WINDOWS_SIGNING.md
+++ b/WINDOWS_SIGNING.md
@@ -4,6 +4,11 @@ This guide explains how to set up Windows code signing for Stirling-PDF desktop
 
 ## Overview
 
+Releases are signed with **DigiCert KeyLocker**, a cloud HSM: the private key never
+leaves DigiCert, and the runner signs through a PKCS#11 provider. The older approach
+of uploading a base64 `.pfx` to a repository secret has been removed from the
+workflows - the sections below describe KeyLocker, which is what actually runs.
+
 Windows code signing is essential for:
 - Preventing Windows SmartScreen warnings
 - Building trust with users
@@ -49,29 +54,19 @@ openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certifica
 
 ### Required Secrets
 
-Navigate to your GitHub repository → Settings → Secrets and variables → Actions
+Navigate to your GitHub repository → Settings → Environments → `release-signing`.
 
-Add the following secrets:
+These live in the `release-signing` environment, not at repository scope. That
+environment requires reviewer approval and is limited to `main`, `release`,
+`hotfix/*` and `v*` tags. All five come from the DigiCert ONE console.
 
-#### 1. `WINDOWS_CERTIFICATE`
-- **Description**: Base64-encoded .pfx certificate file
-- **How to create**:
-
-**On macOS/Linux:**
-```bash
-base64 -i certificate.pfx | pbcopy  # Copies to clipboard
-```
-
-**On Windows (PowerShell):**
-```powershell
-[Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx")) | Set-Clipboard
-```
-
-Paste the entire base64 string into the GitHub secret.
-
-#### 2. `WINDOWS_CERTIFICATE_PASSWORD`
-- **Description**: Password for the .pfx certificate
-- **Value**: The password you set when creating/exporting the .pfx file
+| Secret | Description |
+| --- | --- |
+| `SM_API_KEY` | KeyLocker API key. Also acts as the on/off switch: signing steps are gated on it being non-empty. |
+| `SM_CLIENT_CERT_FILE_B64` | Base64-encoded PKCS#12 client authentication certificate. |
+| `SM_CLIENT_CERT_PASSWORD` | Password for that client certificate. |
+| `SM_KEYPAIR_ALIAS` | Alias of the signing keypair to use. |
+| `SM_HOST` | DigiCert ONE host, e.g. `https://clientauth.one.digicert.com`. |
 
 ### Optional Secrets for Tauri Updater
 
@@ -110,23 +105,23 @@ The Windows signing configuration is already set up:
 
 ### 2. GitHub Workflow (.github/workflows/tauri-build.yml)
 
-The workflow includes three Windows signing steps:
+The workflow includes four Windows signing steps, all gated on `SM_API_KEY` being
+set and the ref being the release branch:
 
-1. **Import Certificate**: Decodes and imports the .pfx certificate into Windows certificate store
-2. **Build Tauri App**: Builds and signs the application using the imported certificate
-3. **Verify Signature**: Validates that both .exe and .msi files are properly signed
+1. **Setup DigiCert KeyLocker**: Installs the DigiCert signing tools via `digicert/ssm-code-signing`
+2. **Setup DigiCert KeyLocker Certificate**: Writes the client cert and exports the PKCS#11 config
+3. **Configure Windows code signing / Build Tauri app**: Signs through the PKCS#11 provider
+4. **Verify Windows Code Signature**: Validates that the .exe and .msi are properly signed
 
 ## Testing the Setup
 
 ### 1. Local Testing (Windows Only)
 
-Before pushing to GitHub, test locally:
+KeyLocker is CI-only. To check signing locally, install your own certificate into
+the Windows store and point Tauri at it; the build no longer reads any certificate
+from an environment variable.
 
 ```powershell
-# Set environment variables
-$env:WINDOWS_CERTIFICATE = [Convert]::ToBase64String([IO.File]::ReadAllBytes("certificate.pfx"))
-$env:WINDOWS_CERTIFICATE_PASSWORD = "your-certificate-password"
-
 # Build the application
 cd frontend
 npm run tauri build
@@ -191,9 +186,10 @@ Look for:
 - Consider EV certificate for immediate reputation
 
 ### Certificate Not Found During Build
-- Verify `WINDOWS_CERTIFICATE` secret is set
-- Check base64 encoding is correct (no extra whitespace)
-- Ensure password is correct
+- Verify `SM_API_KEY` is present in the `release-signing` environment. If it is empty
+  the signing steps skip silently and the build succeeds unsigned.
+- Check `SM_CLIENT_CERT_FILE_B64` base64 encoding is correct (no extra whitespace)
+- Ensure `SM_CLIENT_CERT_PASSWORD` and `SM_KEYPAIR_ALIAS` match the DigiCert keypair
 
 ## Security Best Practices
 
@@ -220,11 +216,10 @@ Look for:
 ## Certificate Lifecycle
 
 ### Before Expiration
-1. Obtain new certificate from CA (typically annual renewal)
-2. Convert to .pfx format if needed
-3. Update `WINDOWS_CERTIFICATE` secret with new base64-encoded certificate
-4. Update `WINDOWS_CERTIFICATE_PASSWORD` if password changed
-5. Test build to verify new certificate works
+1. Renew the certificate in the DigiCert ONE console (typically annual)
+2. If the keypair alias changed, update `SM_KEYPAIR_ALIAS` in the `release-signing` environment
+3. If the client authentication certificate was reissued, update `SM_CLIENT_CERT_FILE_B64` and `SM_CLIENT_CERT_PASSWORD`
+4. Test build to verify the new certificate works
 
 ### Expired Certificates
 - Signed binaries remain valid (timestamp proves signing time)
diff --git a/app/.env.saas b/app/.env.saas
index fb5feec559..25eefb84c5 100644
--- a/app/.env.saas
+++ b/app/.env.saas
@@ -1,15 +1,16 @@
-###############################################################################
-# Stirling-PDF SaaS environment defaults.
+# Stirling-PDF SaaS environment defaults. Committed, non-secret. Real values for secrets go in
+# .env.saas.local, which is loaded first and wins. Do not commit that file.
 #
-# This file is committed and provides non-secret defaults loaded by
-# `task backend:dev:saas`. Put real values for secrets (passwords, project
-# refs, edge function secrets) in `.env.saas.local` - any variable set there
-# takes precedence over what's defined here.
+# Three environments, each deriving its Supabase URLs, JWT issuer and JWKS from one project ref:
 #
-# DO NOT commit `.env.saas.local`. Only `.env.saas` is checked in.
-###############################################################################
+#   prod     PROFILES=none       SAAS_DB_*          the live project
+#   staging  PROFILES=staging    SAAS_STAGING_*     pinned to v3, always there
+#   dev      PROFILES=dev        SAAS_DEV_*         follows a SaaS PR's preview branch
+#
+# dev is the default for `task backend:dev:saas`. Use staging for somewhere stable; use dev when
+# testing an open SaaS PR, since its preview branch is the only place those migrations are applied.
 
-# ---------- Supabase project ----------
+# ---------- Supabase project (prod / no-profile) ----------
 # Project reference (the subdomain part of <ref>.supabase.co). Required.
 # Set in .env.saas.local.
 SAAS_DB_PROJECT_REF=
@@ -17,18 +18,35 @@ SAAS_DB_PROJECT_REF=
 # Edge function secret used by billing/license rollup calls. Set in .env.saas.local.
 SUPABASE_EDGE_FUNCTION_SECRET=
 
-# ---------- Database (saas profile) ----------
-# Direct JDBC URL to the Supabase Postgres. Required when running the plain
-# `saas` profile (i.e. without `--spring.profiles.include=dev`).
+# ---------- Database (no profile) ----------
+# Direct JDBC URL to the Supabase Postgres. Required when running without
+# `--spring.profiles.include=...`.
 # Example: jdbc:postgresql://db.<project-ref>.supabase.co:5432/postgres
 SAAS_DB_URL=
 SAAS_DB_USERNAME=postgres
 SAAS_DB_PASSWORD=
 
-# ---------- Database (dev profile overrides) ----------
-# Used when `--spring.profiles.include=dev` is active. The dev profile
-# defaults the URL/username to the shared dev Supabase project, but the
-# password must still be provided in .env.saas.local.
-SAAS_DEV_DB_URL=
+# ---------- staging profile ----------
+# The shared long-lived v3 project. application-staging.properties defaults the ref,
+# URL, database host and meter endpoint, so staging needs only the password, in
+# .env.saas.local. Set SAAS_STAGING_PROJECT_REF to repoint it; everything derives.
+#
+# The ref and publishable key are duplicated here because the task derives the
+# frontend's VITE_SUPABASE_* from them and a shell cannot read a Spring default.
+# Neither is secret: the ref is a public subdomain, the key ships in the bundle.
+SAAS_STAGING_PROJECT_REF=qacaivhsjtftfwtgjvva
+SAAS_STAGING_PUBLISHABLE_KEY=sb_publishable_nIM8y-9ARPE7EzQwAQHKMg_40fCN6kY # gitleaks:allow
+SAAS_STAGING_DB_USERNAME=postgres
+SAAS_STAGING_DB_PASSWORD=
+
+# ---------- dev profile ----------
+# The SaaS PR's Supabase preview branch. Take the ref from that PR's "Supabase
+# Preview" check; the profile derives URL, JWT issuer, JWKS, meter endpoint and
+# database host from it, so this one value follows a different PR.
+#
+# A preview branch has its own password and keys; the parent project's will not
+# authenticate. Both go in .env.saas.local, along with the ref.
+SAAS_DEV_PROJECT_REF=
+SAAS_DEV_PUBLISHABLE_KEY=
 SAAS_DEV_DB_USERNAME=postgres
 SAAS_DEV_DB_PASSWORD=
diff --git a/app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java b/app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java
index adfad7704b..96293e9c3f 100644
--- a/app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java
+++ b/app/common/src/main/java/stirling/software/common/aop/AutoJobAspect.java
@@ -2,7 +2,9 @@ package stirling.software.common.aop;
 
 import java.io.IOException;
 import java.time.Duration;
+import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
@@ -273,6 +275,7 @@ public class AutoJobAspect {
 
                         // Store the fileId for later reference
                         pdfFile.setFileId(fileId);
+                        recordPendingInputFile(fileId);
 
                         // Replace the original MultipartFile with our persistent copy
                         MultipartFile persistentFile = fileStorage.retrieveFile(fileId);
@@ -290,6 +293,29 @@ public class AutoJobAspect {
         return originalArgs;
     }
 
+    /**
+     * Queue an input copy for attribution to the job. The job id does not exist yet at this point,
+     * so {@link JobExecutorService} drains this list once it mints one.
+     */
+    @SuppressWarnings("unchecked")
+    private void recordPendingInputFile(String fileId) {
+        try {
+            Object existing = request.getAttribute(JobExecutorService.PENDING_INPUT_FILE_IDS_ATTR);
+            List<String> ids;
+            if (existing instanceof List<?> list) {
+                ids = (List<String>) list;
+            } else {
+                ids = new ArrayList<>();
+                request.setAttribute(JobExecutorService.PENDING_INPUT_FILE_IDS_ATTR, ids);
+            }
+            ids.add(fileId);
+        } catch (RuntimeException ex) {
+            // Without a bound request the copy cannot be attributed; the periodic sweep is the
+            // only backstop, so make the miss visible rather than silently leaking the file.
+            log.warn("Could not record input copy {} for cleanup: {}", fileId, ex.getMessage());
+        }
+    }
+
     private String getJobIdFromContext() {
         try {
             return (String) request.getAttribute("jobId");
diff --git a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
index a8bc2812b7..216e0c1e66 100644
--- a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
+++ b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
@@ -1316,7 +1316,7 @@ public class ApplicationProperties {
     public static class Ui {
         private String appNameNavbar;
         private List<String> languages;
-        private String logoStyle = "classic"; // Options: "classic" (default) or "modern"
+        private String logoStyle = "modern"; // Options: "modern" (default) or "classic"
         private boolean defaultHideUnavailableTools = false;
         private boolean defaultHideUnavailableConversions = false;
         private HideDisabledTools hideDisabledTools = new HideDisabledTools();
@@ -1327,10 +1327,10 @@ public class ApplicationProperties {
 
         public String getLogoStyle() {
             // Validate and return either "modern" or "classic"
-            if ("modern".equalsIgnoreCase(logoStyle)) {
-                return "modern";
+            if ("classic".equalsIgnoreCase(logoStyle)) {
+                return "classic";
             }
-            return "classic"; // default
+            return "modern"; // default
         }
 
         @Data
diff --git a/app/common/src/main/java/stirling/software/common/model/job/JobResult.java b/app/common/src/main/java/stirling/software/common/model/job/JobResult.java
index aa43431a15..b3f1f31472 100644
--- a/app/common/src/main/java/stirling/software/common/model/job/JobResult.java
+++ b/app/common/src/main/java/stirling/software/common/model/job/JobResult.java
@@ -52,6 +52,13 @@ public class JobResult {
     /** Key/value metadata that survives the write-through into the shared job store. */
     private final Map<String, String> metadata = new ConcurrentHashMap<>();
 
+    /**
+     * File ids of the persistent input copies made for this job. An async submit copies the upload
+     * into FileStorage so the job can still read it after the request returns; without tracking
+     * them here nothing would ever delete those copies.
+     */
+    @JsonIgnore private final List<String> inputFileIds = new CopyOnWriteArrayList<>();
+
     /**
      * Create a new JobResult with the given job ID
      *
@@ -167,6 +174,22 @@ public class JobResult {
         return Collections.unmodifiableList(notes);
     }
 
+    /** Record a persistent input copy so job cleanup deletes it alongside the results. */
+    public void addInputFileId(String fileId) {
+        if (fileId != null && !fileId.isBlank() && !inputFileIds.contains(fileId)) {
+            this.inputFileIds.add(fileId);
+        }
+    }
+
+    /**
+     * File ids of this job's persistent input copies.
+     *
+     * @return An unmodifiable view of the input file ids
+     */
+    public List<String> getInputFileIds() {
+        return Collections.unmodifiableList(inputFileIds);
+    }
+
     /** Attach a metadata value, e.g. a policy id so cluster peers can identify a policy run. */
     public void putMetadata(String key, String value) {
         if (key != null && value != null) {
diff --git a/app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java b/app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java
index 178052ebf6..9a7caefc7d 100644
--- a/app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java
+++ b/app/common/src/main/java/stirling/software/common/service/CustomPDFDocumentFactory.java
@@ -729,4 +729,32 @@ public class CustomPDFDocumentFactory {
         p.toFile().deleteOnExit();
         return p;
     }
+
+    /** A custom RandomAccessRead implementation that deletes the file when closed */
+    private static class DeletingRandomAccessFile extends RandomAccessReadBufferedFile {
+        private final Path tempFilePath;
+
+        public DeletingRandomAccessFile(File file) throws IOException {
+            super(file);
+            this.tempFilePath = file.toPath();
+        }
+
+        @Override
+        public void close() throws IOException {
+            try {
+                super.close();
+            } finally {
+                try {
+                    boolean deleted = Files.deleteIfExists(tempFilePath);
+                    if (deleted) {
+                        log.info("Successfully deleted temp file: {}", tempFilePath);
+                    } else {
+                        log.warn("Failed to delete temp file (may not exist): {}", tempFilePath);
+                    }
+                } catch (IOException e) {
+                    log.error("Error deleting temp file: {}", tempFilePath, e);
+                }
+            }
+        }
+    }
 }
diff --git a/app/common/src/main/java/stirling/software/common/service/FileStorage.java b/app/common/src/main/java/stirling/software/common/service/FileStorage.java
index c5c1ddb5db..700a6e5a65 100644
--- a/app/common/src/main/java/stirling/software/common/service/FileStorage.java
+++ b/app/common/src/main/java/stirling/software/common/service/FileStorage.java
@@ -179,6 +179,21 @@ public class FileStorage {
         return fileStore.delete(fileId);
     }
 
+    /**
+     * Delete a stored file without the per-file ownership check.
+     *
+     * <p>Job cleanup authorises at the job level and then deletes that job's own files, so the
+     * deleter is legitimately not their owner - an admin sweeping every user's jobs, or the
+     * unauthenticated scheduled task. Routing those through {@link #deleteFile(String)} makes the
+     * ownership check throw and silently orphans the files on disk.
+     *
+     * <p>Only ever pass file ids read back off a job that the caller has already been authorised
+     * for; never a caller-supplied id.
+     */
+    public boolean deleteFileAsSystem(String fileId) {
+        return fileStore.delete(fileId);
+    }
+
     public boolean fileExists(String fileId) {
         enforceOwnership(fileId);
         return fileStore.exists(fileId);
diff --git a/app/common/src/main/java/stirling/software/common/service/JobExecutorService.java b/app/common/src/main/java/stirling/software/common/service/JobExecutorService.java
index f283f65763..eca4413350 100644
--- a/app/common/src/main/java/stirling/software/common/service/JobExecutorService.java
+++ b/app/common/src/main/java/stirling/software/common/service/JobExecutorService.java
@@ -1,6 +1,7 @@
 package stirling.software.common.service;
 
 import java.io.IOException;
+import java.util.List;
 import java.util.Map;
 import java.util.UUID;
 import java.util.concurrent.CompletableFuture;
@@ -33,6 +34,14 @@ import stirling.software.common.util.RegexPatternUtils;
 @Slf4j
 public class JobExecutorService {
 
+    /**
+     * Request attribute holding the FileStorage ids of persistent input copies made for the job
+     * about to be created. Populated before the job id exists (the aspect copies the upload while
+     * processing arguments), drained onto the JobResult as soon as the task is created so cleanup
+     * can delete them.
+     */
+    public static final String PENDING_INPUT_FILE_IDS_ATTR = "autoJobPendingInputFileIds";
+
     private final TaskManager taskManager;
     private final FileStorage fileStorage;
     private final HttpServletRequest request;
@@ -133,6 +142,7 @@ public class JobExecutorService {
                     resourceWeight);
 
             taskManager.createTask(jobId);
+            registerPendingInputFiles(jobId);
 
             final String capturedJobIdForQueue = jobId;
             Supplier<Object> wrappedWork =
@@ -163,6 +173,7 @@ public class JobExecutorService {
             return ResponseEntity.ok().body(new JobResponse<>(true, jobId, null));
         } else if (async) {
             taskManager.createTask(jobId);
+            registerPendingInputFiles(jobId);
 
             final String capturedJobId = jobId;
 
@@ -484,4 +495,30 @@ public class JobExecutorService {
         }
         return baseJobId;
     }
+
+    /**
+     * Hand the input copies made while processing arguments to the freshly created job, so job
+     * cleanup deletes them. Drains the attribute so a retry cannot attribute the same ids twice.
+     */
+    @SuppressWarnings("unchecked")
+    private void registerPendingInputFiles(String jobId) {
+        if (request == null) {
+            return;
+        }
+        Object pending;
+        try {
+            pending = request.getAttribute(PENDING_INPUT_FILE_IDS_ATTR);
+            request.removeAttribute(PENDING_INPUT_FILE_IDS_ATTR);
+        } catch (RuntimeException ex) {
+            // No request bound to this thread (e.g. an internally dispatched job).
+            log.debug("Could not read pending input file ids: {}", ex.getMessage());
+            return;
+        }
+        if (!(pending instanceof List<?> ids)) {
+            return;
+        }
+        for (String fileId : (List<String>) ids) {
+            taskManager.registerInputFile(jobId, fileId);
+        }
+    }
 }
diff --git a/app/common/src/main/java/stirling/software/common/service/TaskManager.java b/app/common/src/main/java/stirling/software/common/service/TaskManager.java
index f504b39395..0d0f8c23aa 100644
--- a/app/common/src/main/java/stirling/software/common/service/TaskManager.java
+++ b/app/common/src/main/java/stirling/software/common/service/TaskManager.java
@@ -17,6 +17,7 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
+import java.util.function.Predicate;
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
@@ -234,6 +235,24 @@ public class TaskManager {
         return false;
     }
 
+    /**
+     * Record a persistent input copy against a job so cleanup deletes it with the results.
+     *
+     * @param jobId The job ID
+     * @param fileId The FileStorage id of the input copy
+     * @return true if the job exists and the id was recorded
+     */
+    public boolean registerInputFile(String jobId, String fileId) {
+        JobResult jobResult = jobResults.get(jobId);
+        if (jobResult == null) {
+            log.warn("Attempted to register an input file against non-existent job ID: {}", jobId);
+            return false;
+        }
+        jobResult.addInputFileId(fileId);
+        log.debug("Registered input file {} for job {}", fileId, jobId);
+        return true;
+    }
+
     /** Attach metadata to a job and write it through to the shared store for cluster peers. */
     public boolean putMetadata(String jobId, String key, String value) {
         JobResult jobResult = jobResults.get(jobId);
@@ -329,25 +348,59 @@ public class TaskManager {
         return jobResults.computeIfAbsent(jobId, JobResult::createNew);
     }
 
+    /**
+     * What a cleanup pass removed. Returned by the on-demand cleanup so callers can assert on it.
+     */
+    public record CleanupSummary(int jobsRemoved, int filesDeleted, int jobsRetained) {}
+
     /** Clean up old completed job results. No-op in cluster mode; the backplane TTL owns expiry. */
-    public void cleanupOldJobs() {
+    public CleanupSummary cleanupOldJobs() {
         if (clusterBackplane != null && !clusterBackplane.shouldRunLocalCleanup()) {
-            return;
+            return new CleanupSummary(0, 0, jobResults.size());
         }
+        return cleanupJobs(false, jobId -> true);
+    }
+
+    /**
+     * Force-expire this node's finished jobs now, ignoring the age threshold. Jobs still running
+     * are left alone - deleting their files mid-flight would break them - and are reported as
+     * retained.
+     *
+     * <p>Unlike {@link #cleanupOldJobs()} this always runs locally: it is an explicit request to
+     * release this node's storage, not the scheduled sweep the backplane TTL owns.
+     *
+     * @param jobIdFilter Only jobs whose id passes this predicate are considered, so a caller can
+     *     restrict the sweep to jobs the requester is allowed to touch
+     * @return What was removed
+     */
+    public CleanupSummary cleanupFinishedJobsNow(Predicate<String> jobIdFilter) {
+        return cleanupJobs(true, jobIdFilter);
+    }
+
+    private CleanupSummary cleanupJobs(boolean force, Predicate<String> filter) {
         LocalDateTime expiryThreshold =
                 LocalDateTime.now().minus(jobResultExpiryMinutes, ChronoUnit.MINUTES);
         LocalDateTime pendingExpiryThreshold =
                 LocalDateTime.now().minus(pendingJobExpiryMinutes, ChronoUnit.MINUTES);
         int removedCount = 0;
+        int filesDeleted = 0;
+        int retainedCount = 0;
 
         try {
             for (Map.Entry<String, JobResult> entry : jobResults.entrySet()) {
                 JobResult result = entry.getValue();
 
+                if (!filter.test(entry.getKey())) {
+                    retainedCount++;
+                    continue;
+                }
+
                 boolean expiredCompletedJob =
                         result.isComplete()
-                                && result.getCompletedAt() != null
-                                && result.getCompletedAt().isBefore(expiryThreshold);
+                                && (force
+                                        || (result.getCompletedAt() != null
+                                                && result.getCompletedAt()
+                                                        .isBefore(expiryThreshold)));
                 boolean abandonedPendingJob =
                         !result.isComplete()
                                 && result.getCreatedAt() != null
@@ -360,7 +413,7 @@ public class TaskManager {
 
                     // Clean up file results
                     if (expiredCompletedJob) {
-                        cleanupJobFiles(result, entry.getKey());
+                        filesDeleted += cleanupJobFiles(result, entry.getKey());
                     }
 
                     // Remove the job result
@@ -369,15 +422,22 @@ public class TaskManager {
                         jobStore.delete(entry.getKey());
                     }
                     removedCount++;
+                } else {
+                    retainedCount++;
                 }
             }
 
             if (removedCount > 0) {
-                log.info("Cleaned up {} expired job results", removedCount);
+                log.info(
+                        "Cleaned up {} {} job results ({} files deleted)",
+                        removedCount,
+                        force ? "finished" : "expired",
+                        filesDeleted);
             }
         } catch (Exception e) {
             log.error("Error during job cleanup: {}", e.getMessage(), e);
         }
+        return new CleanupSummary(removedCount, filesDeleted, retainedCount);
     }
 
     /** Mirror the in-memory {@code JobResult} into the cluster-visible {@link JobStore}. */
@@ -525,22 +585,43 @@ public class TaskManager {
         }
     }
 
-    /** Clean up files associated with a job result */
-    private void cleanupJobFiles(JobResult result, String jobId) {
+    /**
+     * Clean up files associated with a job result: both the results and the persistent input copy
+     * an async submit made of the upload.
+     *
+     * @return The number of files actually deleted
+     */
+    private int cleanupJobFiles(JobResult result, String jobId) {
+        int deleted = 0;
         // Clean up all result files
         if (result.hasFiles()) {
             for (ResultFile resultFile : result.getAllResultFiles()) {
-                try {
-                    fileStorage.deleteFile(resultFile.getFileId());
-                } catch (Exception e) {
-                    log.warn(
-                            "Failed to delete file {} for job {}: {}",
-                            resultFile.getFileId(),
-                            jobId,
-                            e.getMessage());
+                if (deleteJobFile(resultFile.getFileId(), jobId)) {
+                    deleted++;
                 }
             }
         }
+        for (String inputFileId : result.getInputFileIds()) {
+            if (deleteJobFile(inputFileId, jobId)) {
+                deleted++;
+            }
+        }
+        return deleted;
+    }
+
+    /**
+     * Deletes as the system, not as the caller: an admin sweeping another user's jobs, or the
+     * scheduled task running with no security context, is not the file's owner, and the
+     * ownership-checked delete would throw and leave the file orphaned on disk. The job itself is
+     * already authorised by the time we get here, and these ids come off that job, not the request.
+     */
+    private boolean deleteJobFile(String fileId, String jobId) {
+        try {
+            return fileStorage.deleteFileAsSystem(fileId);
+        } catch (Exception e) {
+            log.warn("Failed to delete file {} for job {}: {}", fileId, jobId, e.getMessage());
+            return false;
+        }
     }
 
     /** Find the ResultFile metadata for a given file ID by searching through all job results */
diff --git a/app/common/src/main/java/stirling/software/common/util/GeneralUtils.java b/app/common/src/main/java/stirling/software/common/util/GeneralUtils.java
index 52f79f733a..1d7320ca84 100644
--- a/app/common/src/main/java/stirling/software/common/util/GeneralUtils.java
+++ b/app/common/src/main/java/stirling/software/common/util/GeneralUtils.java
@@ -12,6 +12,7 @@ import java.nio.file.*;
 import java.nio.file.attribute.BasicFileAttributes;
 import java.security.MessageDigest;
 import java.util.*;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -54,6 +55,10 @@ public class GeneralUtils {
 
     private final String DEFAULT_WEBUI_CONFIGS_DIR = "defaultWebUIConfigs";
     private final String PYTHON_SCRIPTS_DIR = "python";
+
+    // Extracted once per run. Rewriting a script while another request is exec-ing it
+    // races wherever rename is not atomic, such as 9p or NFS bind mounts.
+    private final Map<String, Path> EXTRACTED_SCRIPTS = new ConcurrentHashMap<>();
     private final RegexPatternUtils patternCache = RegexPatternUtils.getInstance();
     // Valid size units used for convertSizeToBytes validation and parsing
     private final Set<String> VALID_SIZE_UNITS = Set.of("B", "KB", "MB", "GB", "TB");
@@ -1025,17 +1030,30 @@ public class GeneralUtils {
         }
 
         Path scriptsDir = Path.of(InstallationPathConfig.getScriptsPath(), PYTHON_SCRIPTS_DIR);
-        Files.createDirectories(scriptsDir);
-
         Path target = scriptsDir.resolve(scriptName);
-        ClassPathResource res =
-                new ClassPathResource("static/" + PYTHON_SCRIPTS_DIR + "/" + scriptName);
-        if (!res.exists()) {
-            log.error("Resource not found: {}", res.getPath());
-            throw new IOException("Resource not found: " + res.getPath());
+
+        Path cached = EXTRACTED_SCRIPTS.get(scriptName);
+        if (cached != null && Files.isRegularFile(cached)) {
+            return cached;
+        }
+
+        synchronized (EXTRACTED_SCRIPTS) {
+            cached = EXTRACTED_SCRIPTS.get(scriptName);
+            if (cached != null && Files.isRegularFile(cached)) {
+                return cached;
+            }
+
+            Files.createDirectories(scriptsDir);
+            ClassPathResource res =
+                    new ClassPathResource("static/" + PYTHON_SCRIPTS_DIR + "/" + scriptName);
+            if (!res.exists()) {
+                log.error("Resource not found: {}", res.getPath());
+                throw new IOException("Resource not found: " + res.getPath());
+            }
+            copyResourceToFile(res, target);
+            EXTRACTED_SCRIPTS.put(scriptName, target);
+            return target;
         }
-        copyResourceToFile(res, target);
-        return target;
     }
 
     /*
diff --git a/app/common/src/test/java/stirling/software/common/service/FileStorageOwnershipTest.java b/app/common/src/test/java/stirling/software/common/service/FileStorageOwnershipTest.java
index 861efa8509..9bf78b6af3 100644
--- a/app/common/src/test/java/stirling/software/common/service/FileStorageOwnershipTest.java
+++ b/app/common/src/test/java/stirling/software/common/service/FileStorageOwnershipTest.java
@@ -2,6 +2,7 @@ package stirling.software.common.service;
 
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
@@ -65,6 +66,24 @@ class FileStorageOwnershipTest {
         assertThrows(SecurityException.class, () -> fs.deleteFile(id));
     }
 
+    @Test
+    void systemDeleteOfAnotherUsersFile_allowed_soJobCleanupDoesNotOrphanIt(@TempDir Path tempDir)
+            throws IOException {
+        // An admin sweeping every user's finished jobs is not the owner of their files. The
+        // ownership-checked delete throws there, which used to drop the job record and leave the
+        // files stranded on disk with nothing left able to reference them.
+        AtomicReference<String> user = new AtomicReference<>("alice");
+        FileStorage fs = newStorageWithCurrentUser(tempDir, user);
+        String id = fs.storeBytes("alice's file".getBytes(), "x.bin");
+        user.set("admin");
+
+        assertThrows(SecurityException.class, () -> fs.deleteFile(id));
+        assertTrue(fs.deleteFileAsSystem(id), "System delete must not be blocked by ownership");
+
+        user.set("alice");
+        assertThrows(IOException.class, () -> fs.retrieveBytes(id), "File should really be gone");
+    }
+
     @Test
     void anonymousRetrieveOfOwnedFile_allowed_noCurrentUserMeansNoCompare(@TempDir Path tempDir)
             throws IOException {
diff --git a/app/common/src/test/java/stirling/software/common/service/TaskManagerCleanupTest.java b/app/common/src/test/java/stirling/software/common/service/TaskManagerCleanupTest.java
new file mode 100644
index 0000000000..050004dc1f
--- /dev/null
+++ b/app/common/src/test/java/stirling/software/common/service/TaskManagerCleanupTest.java
@@ -0,0 +1,263 @@
+package stirling.software.common.service;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.*;
+
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.springframework.http.MediaType;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import stirling.software.common.cluster.ClusterBackplane;
+import stirling.software.common.cluster.JobStore;
+import stirling.software.common.model.job.JobResult;
+import stirling.software.common.model.job.ResultFile;
+
+/**
+ * Covers the on-demand cleanup path and the input-copy tracking that makes it complete. An async
+ * submit persists a copy of the upload as well as its results; before both were tracked, only the
+ * results were ever deleted and the input copy stayed on disk indefinitely.
+ */
+class TaskManagerCleanupTest {
+
+    @Mock private FileStorage fileStorage;
+    @Mock private JobStore jobStore;
+    @Mock private ClusterBackplane clusterBackplane;
+
+    @InjectMocks private TaskManager taskManager;
+
+    private AutoCloseable closeable;
+
+    @BeforeEach
+    void setUp() {
+        closeable = MockitoAnnotations.openMocks(this);
+        lenient().when(clusterBackplane.localNodeId()).thenReturn("test-node");
+        lenient().when(clusterBackplane.shouldRunLocalCleanup()).thenReturn(true);
+        lenient().when(fileStorage.deleteFileAsSystem(anyString())).thenReturn(true);
+        ReflectionTestUtils.setField(taskManager, "jobResultExpiryMinutes", 30);
+        ReflectionTestUtils.setField(taskManager, "pendingJobExpiryMinutes", 1440);
+    }
+
+    @AfterEach
+    void tearDown() throws Exception {
+        closeable.close();
+    }
+
+    @SuppressWarnings("unchecked")
+    private Map<String, JobResult> jobResults() {
+        return (Map<String, JobResult>) ReflectionTestUtils.getField(taskManager, "jobResults");
+    }
+
+    /** Complete a job with a single result file, as an async file-producing job would. */
+    private void completeWithFile(String jobId, String fileId) {
+        taskManager.setFileResult(jobId, fileId, "out.pdf", MediaType.APPLICATION_PDF_VALUE);
+        taskManager.setComplete(jobId);
+    }
+
+    @Test
+    void forcedCleanupRemovesFinishedJobsRegardlessOfAge() {
+        String jobId = "fresh-job";
+        taskManager.createTask(jobId);
+        completeWithFile(jobId, "result-file");
+
+        // The scheduled sweep leaves it alone: it completed well inside the retention window.
+        taskManager.cleanupOldJobs();
+        assertTrue(jobResults().containsKey(jobId), "Scheduled cleanup should respect the expiry");
+
+        TaskManager.CleanupSummary summary = taskManager.cleanupFinishedJobsNow(id -> true);
+
+        assertEquals(1, summary.jobsRemoved());
+        assertEquals(1, summary.filesDeleted());
+        assertEquals(0, summary.jobsRetained());
+        assertFalse(jobResults().containsKey(jobId));
+        verify(fileStorage).deleteFileAsSystem("result-file");
+        verify(jobStore).delete(jobId);
+    }
+
+    @Test
+    void forcedCleanupDeletesThePersistedInputCopy() {
+        String jobId = "job-with-input";
+        taskManager.createTask(jobId);
+        assertTrue(taskManager.registerInputFile(jobId, "input-file"));
+        completeWithFile(jobId, "result-file");
+
+        TaskManager.CleanupSummary summary = taskManager.cleanupFinishedJobsNow(id -> true);
+
+        assertEquals(1, summary.jobsRemoved());
+        assertEquals(2, summary.filesDeleted(), "Both the result and the input copy must go");
+        verify(fileStorage).deleteFileAsSystem("result-file");
+        verify(fileStorage).deleteFileAsSystem("input-file");
+    }
+
+    @Test
+    void scheduledCleanupAlsoDeletesThePersistedInputCopy() {
+        String jobId = "expired-job";
+        taskManager.createTask(jobId);
+        taskManager.registerInputFile(jobId, "input-file");
+        completeWithFile(jobId, "result-file");
+
+        JobResult result = taskManager.getJobResult(jobId);
+        ReflectionTestUtils.setField(result, "completedAt", LocalDateTime.now().minusHours(1));
+
+        taskManager.cleanupOldJobs();
+
+        assertFalse(jobResults().containsKey(jobId));
+        verify(fileStorage).deleteFileAsSystem("result-file");
+        verify(fileStorage).deleteFileAsSystem("input-file");
+    }
+
+    @Test
+    void forcedCleanupLeavesRunningJobsAlone() {
+        String running = "running-job";
+        taskManager.createTask(running);
+        taskManager.registerInputFile(running, "in-flight-input");
+
+        TaskManager.CleanupSummary summary = taskManager.cleanupFinishedJobsNow(id -> true);
+
+        assertEquals(0, summary.jobsRemoved());
+        assertEquals(0, summary.filesDeleted());
+        assertEquals(1, summary.jobsRetained());
+        assertTrue(jobResults().containsKey(running));
+        // Deleting a running job's input mid-flight would break it.
+        verify(fileStorage, never()).deleteFileAsSystem(anyString());
+    }
+
+    @Test
+    void forcedCleanupSkipsJobsTheFilterRejects() {
+        taskManager.createTask("alice:job");
+        completeWithFile("alice:job", "alice-file");
+        taskManager.createTask("bob:job");
+        completeWithFile("bob:job", "bob-file");
+
+        TaskManager.CleanupSummary summary =
+                taskManager.cleanupFinishedJobsNow(id -> id.startsWith("alice:"));
+
+        assertEquals(1, summary.jobsRemoved());
+        assertEquals(1, summary.jobsRetained());
+        assertFalse(jobResults().containsKey("alice:job"));
+        assertTrue(jobResults().containsKey("bob:job"), "Another user's job must survive");
+        verify(fileStorage).deleteFileAsSystem("alice-file");
+        verify(fileStorage, never()).deleteFileAsSystem("bob-file");
+    }
+
+    @Test
+    void forcedCleanupIsIdempotent() {
+        String jobId = "job-to-clean";
+        taskManager.createTask(jobId);
+        taskManager.registerInputFile(jobId, "input-file");
+        completeWithFile(jobId, "result-file");
+
+        taskManager.cleanupFinishedJobsNow(id -> true);
+        TaskManager.CleanupSummary second = taskManager.cleanupFinishedJobsNow(id -> true);
+
+        assertEquals(0, second.jobsRemoved());
+        assertEquals(0, second.filesDeleted());
+    }
+
+    @Test
+    void forcedCleanupRunsEvenWhenTheBackplaneOwnsScheduledExpiry() {
+        // The scheduled sweep defers to the backplane TTL in cluster mode, but an explicit
+        // request to release this node's storage still has to do something.
+        when(clusterBackplane.shouldRunLocalCleanup()).thenReturn(false);
+        String jobId = "clustered-job";
+        taskManager.createTask(jobId);
+        completeWithFile(jobId, "result-file");
+
+        taskManager.cleanupOldJobs();
+        assertTrue(jobResults().containsKey(jobId));
+
+        TaskManager.CleanupSummary summary = taskManager.cleanupFinishedJobsNow(id -> true);
+
+        assertEquals(1, summary.jobsRemoved());
+        assertFalse(jobResults().containsKey(jobId));
+    }
+
+    @Test
+    void cleanupCountsOnlyFilesThatWereActuallyDeleted() {
+        // A file already gone (a retry deleted it, say) must not be counted as freed.
+        String jobId = "partially-cleaned";
+        taskManager.createTask(jobId);
+        taskManager.registerInputFile(jobId, "already-gone");
+        completeWithFile(jobId, "result-file");
+        when(fileStorage.deleteFileAsSystem("already-gone")).thenReturn(false);
+
+        TaskManager.CleanupSummary summary = taskManager.cleanupFinishedJobsNow(id -> true);
+
+        assertEquals(1, summary.filesDeleted());
+    }
+
+    @Test
+    void cleanupSurvivesAFileStorageFailure() {
+        String jobId = "job-with-unhappy-storage";
+        taskManager.createTask(jobId);
+        taskManager.registerInputFile(jobId, "input-file");
+        completeWithFile(jobId, "result-file");
+        when(fileStorage.deleteFileAsSystem("result-file"))
+                .thenThrow(new RuntimeException("disk on fire"));
+
+        TaskManager.CleanupSummary summary = taskManager.cleanupFinishedJobsNow(id -> true);
+
+        // The job is still released and the remaining file still deleted.
+        assertEquals(1, summary.jobsRemoved());
+        assertEquals(1, summary.filesDeleted());
+        assertFalse(jobResults().containsKey(jobId));
+        verify(fileStorage).deleteFileAsSystem("input-file");
+    }
+
+    @Test
+    void registerInputFileRejectsAnUnknownJob() {
+        assertFalse(taskManager.registerInputFile("no-such-job", "input-file"));
+    }
+
+    @Test
+    void registerInputFileIgnoresDuplicatesAndBlanks() {
+        String jobId = "dedupe-job";
+        taskManager.createTask(jobId);
+        taskManager.registerInputFile(jobId, "input-file");
+        taskManager.registerInputFile(jobId, "input-file");
+        taskManager.registerInputFile(jobId, "  ");
+        taskManager.registerInputFile(jobId, null);
+
+        List<String> inputFileIds = taskManager.getJobResult(jobId).getInputFileIds();
+
+        assertEquals(List.of("input-file"), inputFileIds);
+    }
+
+    @Test
+    void multiFileResultsAndTheInputCopyAreAllDeleted() {
+        String jobId = "split-job";
+        taskManager.createTask(jobId);
+        taskManager.registerInputFile(jobId, "input-file");
+        JobResult result = taskManager.getJobResult(jobId);
+        result.completeWithFiles(
+                List.of(
+                        ResultFile.builder()
+                                .fileId("page-1")
+                                .fileName("1.pdf")
+                                .contentType(MediaType.APPLICATION_PDF_VALUE)
+                                .fileSize(10L)
+                                .build(),
+                        ResultFile.builder()
+                                .fileId("page-2")
+                                .fileName("2.pdf")
+                                .contentType(MediaType.APPLICATION_PDF_VALUE)
+                                .fileSize(10L)
+                                .build()));
+
+        TaskManager.CleanupSummary summary = taskManager.cleanupFinishedJobsNow(id -> true);
+
+        assertEquals(3, summary.filesDeleted());
+        verify(fileStorage).deleteFileAsSystem("page-1");
+        verify(fileStorage).deleteFileAsSystem("page-2");
+        verify(fileStorage).deleteFileAsSystem("input-file");
+    }
+}
diff --git a/app/common/src/test/java/stirling/software/common/service/TaskManagerMoreTest.java b/app/common/src/test/java/stirling/software/common/service/TaskManagerMoreTest.java
index 0a02039ab3..1871e31a3f 100644
--- a/app/common/src/test/java/stirling/software/common/service/TaskManagerMoreTest.java
+++ b/app/common/src/test/java/stirling/software/common/service/TaskManagerMoreTest.java
@@ -290,7 +290,8 @@ class TaskManagerMoreTest {
             ReflectionTestUtils.setField(job, "complete", true);
             ReflectionTestUtils.setField(job, "completedAt", LocalDateTime.now().minusHours(2));
 
-            when(fileStorage.deleteFile("doomed")).thenThrow(new RuntimeException("locked"));
+            when(fileStorage.deleteFileAsSystem("doomed"))
+                    .thenThrow(new RuntimeException("locked"));
 
             // Must not propagate; the job is still removed afterwards.
             taskManager.cleanupOldJobs();
diff --git a/app/common/src/test/java/stirling/software/common/service/TaskManagerTest.java b/app/common/src/test/java/stirling/software/common/service/TaskManagerTest.java
index 9d880d3451..cb423d977c 100644
--- a/app/common/src/test/java/stirling/software/common/service/TaskManagerTest.java
+++ b/app/common/src/test/java/stirling/software/common/service/TaskManagerTest.java
@@ -258,7 +258,7 @@ class TaskManagerTest {
                         .build();
         ReflectionTestUtils.setField(oldJob, "resultFiles", java.util.List.of(resultFile));
 
-        when(fileStorage.deleteFile("file-id")).thenReturn(true);
+        when(fileStorage.deleteFileAsSystem("file-id")).thenReturn(true);
 
         // Obtain access to the private jobResults map
         Map<String, JobResult> jobResultsMap =
@@ -281,7 +281,7 @@ class TaskManagerTest {
         assertFalse(jobResultsMap.containsKey(oldJobId));
         assertTrue(jobResultsMap.containsKey(recentJobId));
         assertTrue(jobResultsMap.containsKey(activeJobId));
-        verify(fileStorage).deleteFile("file-id");
+        verify(fileStorage).deleteFileAsSystem("file-id");
     }
 
     @Test
@@ -308,7 +308,7 @@ class TaskManagerTest {
         // Assert: nothing was removed locally, and no jobStore.delete was issued.
         assertTrue(jobResultsMap.containsKey(oldJobId));
         verify(jobStore, never()).delete(anyString());
-        verify(fileStorage, never()).deleteFile(anyString());
+        verify(fileStorage, never()).deleteFileAsSystem(anyString());
     }
 
     @Test
diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/security/RedactController.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/security/RedactController.java
index c280264838..7a186235cd 100644
--- a/app/core/src/main/java/stirling/software/SPDF/controller/api/security/RedactController.java
+++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/security/RedactController.java
@@ -1,9 +1,14 @@
 package stirling.software.SPDF.controller.api.security;
 
+import java.awt.Color;
 import java.io.IOException;
+import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.regex.Pattern;
+import java.util.regex.PatternSyntaxException;
+import java.util.stream.Collectors;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPageTree;
@@ -43,6 +48,10 @@ import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 import stirling.software.common.util.propertyeditor.JsonListPropertyEditor;
 import stirling.software.common.util.propertyeditor.JsonObjectPropertyEditor;
+import stirling.software.jpdfium.PdfDocument;
+import stirling.software.jpdfium.redact.PdfRedactor;
+import stirling.software.jpdfium.redact.RedactOptions;
+import stirling.software.jpdfium.redact.RedactResult;
 
 import tools.jackson.core.type.TypeReference;
 
@@ -140,134 +149,138 @@ public class RedactController {
                             + " patterns. Users can provide text patterns to redact, with options for regex"
                             + " and whole word matching.")
     public ResponseEntity<Resource> redactPdf(@ModelAttribute RedactPdfRequest request) {
-        String rawListOfText = request.getListOfText();
-        boolean useRegex = Boolean.TRUE.equals(request.getUseRegex());
-        boolean wholeWordSearchBool = Boolean.TRUE.equals(request.getWholeWordSearch());
+        if (request.getFileInput() == null || request.getFileInput().isEmpty()) {
+            log.error("File input is null or empty");
+            throw ExceptionUtils.createFileNullOrEmptyException();
+        }
 
+        String rawListOfText = request.getListOfText();
         if (rawListOfText == null || rawListOfText.trim().isEmpty()) {
             throw ExceptionUtils.createIllegalArgumentException(
                     "error.redaction.no.patterns", "No text patterns provided for redaction");
         }
 
-        String[] listOfText = rawListOfText.split("\n");
-        if (listOfText.length == 1 && listOfText[0].trim().isEmpty()) {
+        List<String> terms =
+                Arrays.stream(rawListOfText.split("\n"))
+                        .map(String::trim)
+                        .filter(s -> !s.isEmpty() && s.length() <= 4096)
+                        .collect(Collectors.toList());
+
+        if (terms.isEmpty()) {
             throw ExceptionUtils.createIllegalArgumentException(
                     "error.redaction.no.patterns", "No text patterns provided for redaction");
         }
 
-        PDDocument document = null;
-        PDDocument fallbackDocument = null;
+        boolean useRegex = Boolean.TRUE.equals(request.getUseRegex());
+        boolean wholeWordSearchBool = Boolean.TRUE.equals(request.getWholeWordSearch());
 
-        try {
-            if (request.getFileInput() == null) {
-                log.error("File input is null");
-                throw ExceptionUtils.createFileNullOrEmptyException();
+        if (useRegex) {
+            for (String term : terms) {
+                try {
+                    Pattern.compile(term);
+                } catch (PatternSyntaxException e) {
+                    throw ExceptionUtils.createIllegalArgumentException(
+                            "error.redaction.no.patterns", "Invalid regex pattern: " + term);
+                }
             }
+        }
 
-            document = pdfDocumentFactory.load(request.getFileInput());
+        String filename =
+                removeFileExtension(
+                                Objects.requireNonNull(
+                                        Filenames.toSimpleFileName(
+                                                request.getFileInput().getOriginalFilename())))
+                        + "_redacted.pdf";
 
+        Color redactColor = ManualRedactionService.decodeOrDefault(request.getRedactColor());
+        int boxColorInt = redactColor.getRGB();
+
+        try (PDDocument document = pdfDocumentFactory.load(request.getFileInput())) {
             if (document == null) {
                 log.error("Failed to load PDF document");
                 throw ExceptionUtils.createPdfCorruptedException(
                         "during redaction", new IOException("Failed to load PDF document"));
             }
 
-            Map<Integer, List<PDFText>> allFoundTextsByPage =
-                    textRedactionService.findTextToRedact(
-                            document, listOfText, useRegex, wholeWordSearchBool);
+            try (TempFile tempInput = tempFileManager.createManagedTempFile(".pdf")) {
+                try {
+                    request.getFileInput().transferTo(tempInput.getFile());
+                } catch (Exception e) {
+                    document.save(tempInput.getFile());
+                }
 
-            int totalMatches = allFoundTextsByPage.values().stream().mapToInt(List::size).sum();
-            log.info(
-                    "Redaction scan: {} occurrences across {} pages (patterns={}, regex={}, wholeWord={})",
-                    totalMatches,
-                    allFoundTextsByPage.size(),
-                    listOfText.length,
-                    useRegex,
-                    wholeWordSearchBool);
+                RedactOptions options =
+                        RedactOptions.builder()
+                                .addWords(terms)
+                                .useRegex(useRegex)
+                                .wholeWord(wholeWordSearchBool)
+                                .boxColor(boxColorInt)
+                                .padding(request.getCustomPadding())
+                                .removeContent(true)
+                                .convertToImage(Boolean.TRUE.equals(request.getConvertPDFToImage()))
+                                .normalizeFonts(false)
+                                .fixToUnicode(false)
+                                .glyphAware(true)
+                                .redactMetadata(true)
+                                .build();
 
-            String filename =
-                    removeFileExtension(
-                                    Objects.requireNonNull(
-                                            Filenames.toSimpleFileName(
-                                                    request.getFileInput().getOriginalFilename())))
-                            + "_redacted.pdf";
+                TempFile tempOutput = tempFileManager.createManagedTempFile(".pdf");
+                try {
+                    try (PdfDocument checkDoc = PdfDocument.open(tempInput.getFile().toPath())) {
+                        if (checkDoc.pageCount() <= 0) {
+                            throw new IOException("Invalid or empty PDF document");
+                        }
+                    }
 
-            if (allFoundTextsByPage.isEmpty()) {
-                log.info("No text found matching redaction patterns");
-                return WebResponseUtils.pdfDocToWebResponse(document, filename, tempFileManager);
+                    log.debug(
+                            "Calling JPDFium PdfRedactor.redact in RedactController (terms={})",
+                            terms);
+                    RedactResult result = PdfRedactor.redact(tempInput.getFile().toPath(), options);
+                    log.debug(
+                            "JPDFium auto-redact complete (matches={})",
+                            result != null ? result.totalMatches() : -1);
+                    if (result == null) {
+                        throw new IOException("JPDFium auto-redact returned null result");
+                    }
+                    try {
+                        result.save(tempOutput.getFile().toPath());
+                        log.info(
+                                "JPDFium auto-redact: {} matches processed into {}",
+                                result.totalMatches(),
+                                filename);
+                        return WebResponseUtils.pdfFileToWebResponse(tempOutput, filename);
+                    } finally {
+                        if (result.document() != null) {
+                            result.document().close();
+                        }
+                    }
+                } catch (Exception e) {
+                    tempOutput.close();
+                    log.warn(
+                            "JPDFium native redaction fell back to manual redaction service: {}",
+                            e.getMessage());
+                    Map<Integer, List<PDFText>> foundTexts =
+                            textRedactionService.findTextToRedact(
+                                    document,
+                                    terms.toArray(new String[0]),
+                                    useRegex,
+                                    wholeWordSearchBool);
+                    TempFile finalized =
+                            manualRedactionService.finalizeRedaction(
+                                    document,
+                                    foundTexts,
+                                    request.getRedactColor(),
+                                    request.getCustomPadding(),
+                                    request.getConvertPDFToImage(),
+                                    false);
+                    return WebResponseUtils.pdfFileToWebResponse(finalized, filename);
+                }
             }
-
-            boolean fallbackToBoxOnlyMode;
-            try {
-                fallbackToBoxOnlyMode =
-                        textRedactionService.performTextReplacement(
-                                document,
-                                allFoundTextsByPage,
-                                listOfText,
-                                useRegex,
-                                wholeWordSearchBool);
-            } catch (Exception e) {
-                log.warn(
-                        "Text replacement redaction failed, falling back to box-only mode: {}",
-                        e.getMessage());
-                fallbackToBoxOnlyMode = true;
-            }
-
-            if (fallbackToBoxOnlyMode) {
-                log.warn(
-                        "Font compatibility issues detected. Using box-only redaction mode for better reliability.");
-
-                fallbackDocument = pdfDocumentFactory.load(request.getFileInput());
-
-                allFoundTextsByPage =
-                        textRedactionService.findTextToRedact(
-                                fallbackDocument, listOfText, useRegex, wholeWordSearchBool);
-
-                TempFile finalized =
-                        manualRedactionService.finalizeRedaction(
-                                fallbackDocument,
-                                allFoundTextsByPage,
-                                request.getRedactColor(),
-                                request.getCustomPadding(),
-                                request.getConvertPDFToImage(),
-                                false);
-
-                return WebResponseUtils.pdfFileToWebResponse(finalized, filename);
-            }
-
-            TempFile finalized =
-                    manualRedactionService.finalizeRedaction(
-                            document,
-                            allFoundTextsByPage,
-                            request.getRedactColor(),
-                            request.getCustomPadding(),
-                            request.getConvertPDFToImage(),
-                            true);
-
-            return WebResponseUtils.pdfFileToWebResponse(finalized, filename);
-
+        } catch (IllegalArgumentException e) {
+            throw e;
         } catch (Exception e) {
             log.error("Redaction operation failed: {}", e.getMessage(), e);
             throw new RuntimeException("Failed to perform PDF redaction: " + e.getMessage(), e);
-
-        } finally {
-            if (document != null) {
-                try {
-                    if (fallbackDocument == null) {
-                        document.close();
-                    }
-                } catch (IOException e) {
-                    log.warn("Failed to close main document: {}", e.getMessage());
-                }
-            }
-
-            if (fallbackDocument != null) {
-                try {
-                    fallbackDocument.close();
-                } catch (IOException e) {
-                    log.warn("Failed to close fallback document: {}", e.getMessage());
-                }
-            }
         }
     }
 
diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/security/TextRedactionService.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/security/TextRedactionService.java
index a9633ffa39..9cf4e6c700 100644
--- a/app/core/src/main/java/stirling/software/SPDF/controller/api/security/TextRedactionService.java
+++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/security/TextRedactionService.java
@@ -1,33 +1,20 @@
 package stirling.software.SPDF.controller.api.security;
 
+import java.io.File;
 import java.io.IOException;
-import java.util.ArrayList;
+import java.nio.file.Files;
 import java.util.Arrays;
-import java.util.Comparator;
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
-import org.apache.pdfbox.contentstream.operator.Operator;
-import org.apache.pdfbox.cos.COSArray;
-import org.apache.pdfbox.cos.COSBase;
-import org.apache.pdfbox.cos.COSFloat;
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.cos.COSNumber;
-import org.apache.pdfbox.cos.COSString;
-import org.apache.pdfbox.pdfparser.PDFStreamParser;
-import org.apache.pdfbox.pdfwriter.ContentStreamWriter;
+import org.apache.pdfbox.Loader;
+import org.apache.pdfbox.multipdf.PDFMergerUtility;
 import org.apache.pdfbox.pdmodel.PDDocument;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.PDResources;
-import org.apache.pdfbox.pdmodel.common.PDStream;
 import org.apache.pdfbox.pdmodel.font.PDFont;
-import org.apache.pdfbox.pdmodel.graphics.PDXObject;
-import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.springframework.stereotype.Service;
 
 import lombok.AllArgsConstructor;
@@ -35,31 +22,23 @@ import lombok.Data;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.SPDF.model.PDFText;
-import stirling.software.SPDF.utils.text.TextEncodingHelper;
 import stirling.software.SPDF.utils.text.TextFinderUtils;
-import stirling.software.SPDF.utils.text.WidthCalculator;
+import stirling.software.jpdfium.PdfDocument;
+import stirling.software.jpdfium.redact.PdfRedactor;
+import stirling.software.jpdfium.redact.RedactOptions;
+import stirling.software.jpdfium.redact.RedactResult;
 
 @Service
 @Slf4j
 class TextRedactionService {
 
-    private static final int MAX_XOBJECT_DEPTH = 10;
-    private static final float PRECISION_THRESHOLD = 1e-3f;
-    private static final int FONT_SCALE_FACTOR = 1000;
-    private static final Set<String> TEXT_SHOWING_OPERATORS = Set.of("Tj", "TJ", "'", "\"");
-    private static final COSString EMPTY_COS_STRING = new COSString("");
-
-    // -----------------------------------------------------------------------
-    // Public API
-    // -----------------------------------------------------------------------
-
     Map<Integer, List<PDFText>> findTextToRedact(
             PDDocument document, String[] listOfText, boolean useRegex, boolean wholeWordSearch) {
 
         Set<String> terms =
                 Arrays.stream(listOfText)
                         .map(String::trim)
-                        .filter(s -> !s.isEmpty())
+                        .filter(s -> !s.isEmpty() && s.length() <= 4096)
                         .collect(Collectors.toSet());
 
         if (terms.isEmpty()) {
@@ -98,1086 +77,99 @@ class TextRedactionService {
             String[] listOfText,
             boolean useRegex,
             boolean wholeWordSearchBool) {
-        if (allFoundTextsByPage.isEmpty()) {
+        if (allFoundTextsByPage == null || allFoundTextsByPage.isEmpty()) {
             return false;
         }
 
-        if (detectCustomEncodingFonts(document)) {
+        List<String> terms =
+                Arrays.stream(listOfText)
+                        .map(String::trim)
+                        .filter(s -> !s.isEmpty() && s.length() <= 4096)
+                        .toList();
+
+        if (terms.isEmpty()) {
+            return false;
+        }
+
+        File tempIn = null;
+        File tempOut = null;
+        try {
+            tempIn = File.createTempFile("jpdfium_redact_in_", ".pdf");
+            tempOut = File.createTempFile("jpdfium_redact_out_", ".pdf");
+
+            document.save(tempIn);
+
+            RedactOptions options =
+                    RedactOptions.builder()
+                            .addWords(terms)
+                            .useRegex(useRegex)
+                            .wholeWord(wholeWordSearchBool)
+                            .boxColor(0)
+                            .removeContent(true)
+                            .normalizeFonts(false)
+                            .fixToUnicode(false)
+                            .repairWidths(false)
+                            .glyphAware(true)
+                            .build();
+
+            try (PdfDocument checkDoc = PdfDocument.open(tempIn.toPath())) {
+                if (checkDoc.pageCount() <= 0) {
+                    return true;
+                }
+            }
+
+            log.debug("Calling JPDFium PdfRedactor.redact (terms={})", terms);
+            RedactResult result = PdfRedactor.redact(tempIn.toPath(), options);
+            log.debug(
+                    "JPDFium PdfRedactor.redact complete (matches={})",
+                    result != null ? result.totalMatches() : -1);
+            if (result == null) {
+                log.warn(
+                        "JPDFium PdfRedactor.redact returned null result, falling back to box-only redaction mode");
+                return true;
+            }
+
+            try {
+                result.save(tempOut.toPath());
+            } finally {
+                if (result.document() != null) {
+                    result.document().close();
+                }
+            }
+
+            try (PDDocument redactedDoc = Loader.loadPDF(tempOut)) {
+                while (document.getNumberOfPages() > 0) {
+                    document.removePage(0);
+                }
+                PDFMergerUtility merger = new PDFMergerUtility();
+                merger.appendDocument(document, redactedDoc);
+            }
+
+            log.info("JPDFium text replacement complete: {} total matches", result.totalMatches());
+            return false;
+        } catch (Exception e) {
             log.warn(
-                    "Custom encoded fonts detected (non-standard encodings / DictionaryEncoding / damaged fonts). "
-                            + "Text replacement is unreliable for these fonts. Falling back to box-only redaction mode.");
-            return true;
-        }
-
-        try {
-            Set<String> allSearchTerms =
-                    Arrays.stream(listOfText)
-                            .map(String::trim)
-                            .filter(s -> !s.isEmpty())
-                            .collect(Collectors.toSet());
-
-            int pageCount = 0;
-            for (PDPage page : document.getPages()) {
-                pageCount++;
-                List<Object> filteredTokens =
-                        createTokensWithoutTargetText(
-                                document, page, allSearchTerms, useRegex, wholeWordSearchBool);
-                writeFilteredContentStream(document, page, filteredTokens);
-            }
-            log.info("Successfully performed text replacement redaction on {} pages.", pageCount);
-            return false;
-        } catch (Exception e) {
-            log.error(
-                    "Text replacement redaction failed due to font or encoding issues. "
-                            + "Will fall back to box-only redaction mode. Error: {}",
+                    "JPDFium native text replacement failed, falling back to box-only redaction mode: {}",
                     e.getMessage());
             return true;
-        }
-    }
-
-    // -----------------------------------------------------------------------
-    // Content stream manipulation
-    // -----------------------------------------------------------------------
-
-    List<Object> createTokensWithoutTargetText(
-            PDDocument document,
-            PDPage page,
-            Set<String> targetWords,
-            boolean useRegex,
-            boolean wholeWordSearch)
-            throws IOException {
-
-        PDFStreamParser parser = new PDFStreamParser(page);
-        List<Object> tokens = new ArrayList<>();
-        Object token;
-        while ((token = parser.parseNextToken()) != null) {
-            tokens.add(token);
-        }
-
-        PDResources resources = page.getResources();
-        if (resources != null) {
-            processPageXObjects(document, resources, targetWords, useRegex, wholeWordSearch);
-        }
-
-        List<TextSegment> textSegments = extractTextSegments(page, tokens);
-        String completeText = buildCompleteText(textSegments);
-        List<MatchRange> matches =
-                findAllMatches(completeText, targetWords, useRegex, wholeWordSearch);
-
-        return applyRedactionsToTokens(tokens, textSegments, matches);
-    }
-
-    void writeFilteredContentStream(PDDocument document, PDPage page, List<Object> tokens)
-            throws IOException {
-
-        PDStream newStream = new PDStream(document);
-
-        try {
-            try (var out = newStream.createOutputStream()) {
-                ContentStreamWriter writer = new ContentStreamWriter(out);
-                writer.writeTokens(tokens);
-            }
-            page.setContents(newStream);
-        } catch (IOException e) {
-            throw new IOException("Failed to write filtered content stream to page", e);
-        }
-    }
-
-    boolean isTextShowingOperator(String opName) {
-        return TEXT_SHOWING_OPERATORS.contains(opName);
-    }
-
-    boolean detectCustomEncodingFonts(PDDocument document) {
-        try {
-            var documentCatalog = document.getDocumentCatalog();
-            if (documentCatalog == null) {
-                return false;
-            }
-
-            int totalFonts = 0;
-            int customEncodedFonts = 0;
-            int subsetFonts = 0;
-            int unreliableFonts = 0;
-
-            for (PDPage page : document.getPages()) {
-                if (TextFinderUtils.hasProblematicFonts(page)) {
-                    log.debug("Page contains fonts flagged as problematic by TextFinderUtils");
-                }
-
-                PDResources resources = page.getResources();
-                if (resources == null) {
-                    continue;
-                }
-
-                for (COSName fontName : resources.getFontNames()) {
-                    try {
-                        PDFont font = resources.getFont(fontName);
-                        if (font != null) {
-                            totalFonts++;
-
-                            boolean isSubset = TextEncodingHelper.isFontSubset(font.getName());
-                            boolean hasCustomEncoding = TextEncodingHelper.hasCustomEncoding(font);
-                            boolean isReliable = WidthCalculator.isWidthCalculationReliable(font);
-                            boolean canCalculateWidths =
-                                    TextEncodingHelper.canCalculateBasicWidths(font);
-
-                            if (isSubset) {
-                                subsetFonts++;
-                            }
-                            if (hasCustomEncoding) {
-                                customEncodedFonts++;
-                                log.debug("Font {} has custom encoding", font.getName());
-                            }
-                            if (!isReliable || !canCalculateWidths) {
-                                unreliableFonts++;
-                                log.debug(
-                                        "Font {} flagged as unreliable: reliable={}, canCalculateWidths={}",
-                                        font.getName(),
-                                        isReliable,
-                                        canCalculateWidths);
-                            }
-                            if (!TextFinderUtils.validateFontReliability(font)) {
-                                log.debug(
-                                        "Font {} failed comprehensive reliability check",
-                                        font.getName());
-                            }
-                        }
-                    } catch (Exception e) {
-                        log.debug(
-                                "Font loading/analysis failed for {}: {}",
-                                fontName.getName(),
-                                e.getMessage());
-                        customEncodedFonts++;
-                        unreliableFonts++;
-                        totalFonts++;
-                    }
-                }
-            }
-
-            log.info(
-                    "Enhanced font analysis: {}/{} custom encoding, {}/{} subset, {}/{} unreliable fonts",
-                    customEncodedFonts,
-                    totalFonts,
-                    subsetFonts,
-                    totalFonts,
-                    unreliableFonts,
-                    totalFonts);
-
-            return customEncodedFonts > 0 || unreliableFonts > 0;
-
-        } catch (Exception e) {
-            log.warn("Enhanced font detection analysis failed: {}", e.getMessage());
-            return true;
-        }
-    }
-
-    // -----------------------------------------------------------------------
-    // Placeholder creation
-    // -----------------------------------------------------------------------
-
-    String createPlaceholderWithFont(String originalWord, PDFont font) {
-        if (originalWord == null || originalWord.isEmpty()) {
-            return originalWord;
-        }
-
-        if (font != null && TextEncodingHelper.isFontSubset(font.getName())) {
-            try {
-                float originalWidth = safeGetStringWidth(font, originalWord) / FONT_SCALE_FACTOR;
-                return createAlternativePlaceholder(originalWord, originalWidth, font, 1.0f);
-            } catch (Exception e) {
-                log.debug(
-                        "Subset font placeholder creation failed for {}: {}",
-                        font.getName(),
-                        e.getMessage());
-                return "";
-            }
-        }
-
-        return " ".repeat(originalWord.length());
-    }
-
-    String createPlaceholderWithWidth(
-            String originalWord, float targetWidth, PDFont font, float fontSize) {
-        if (originalWord == null || originalWord.isEmpty()) {
-            return originalWord;
-        }
-
-        if (font == null || fontSize <= 0) {
-            return " ".repeat(originalWord.length());
-        }
-
-        try {
-            if (!WidthCalculator.isWidthCalculationReliable(font)) {
-                log.debug(
-                        "Font {} unreliable for width calculation, using simple placeholder",
-                        font.getName());
-                return " ".repeat(originalWord.length());
-            }
-
-            if (TextEncodingHelper.isFontSubset(font.getName())) {
-                return createSubsetFontPlaceholder(originalWord, targetWidth, font, fontSize);
-            }
-
-            float spaceWidth = WidthCalculator.calculateAccurateWidth(font, " ", fontSize);
-
-            if (spaceWidth <= 0) {
-                return createAlternativePlaceholder(originalWord, targetWidth, font, fontSize);
-            }
-
-            int spaceCount = Math.max(1, Math.round(targetWidth / spaceWidth));
-            int maxSpaces =
-                    Math.max(
-                            originalWord.length() * 2, Math.round(targetWidth / spaceWidth * 1.5f));
-            spaceCount = Math.min(spaceCount, maxSpaces);
-
-            return " ".repeat(spaceCount);
-
-        } catch (Exception e) {
-            log.debug("Enhanced placeholder creation failed: {}", e.getMessage());
-            return createAlternativePlaceholder(originalWord, targetWidth, font, fontSize);
-        }
-    }
-
-    private String createSubsetFontPlaceholder(
-            String originalWord, float targetWidth, PDFont font, float fontSize) {
-        try {
-            log.debug("Subset font {} - trying to find replacement characters", font.getName());
-            String result = createAlternativePlaceholder(originalWord, targetWidth, font, fontSize);
-
-            if (result.isEmpty()) {
-                log.debug(
-                        "Subset font {} has no suitable replacement characters, using empty string",
-                        font.getName());
-            }
-
-            return result;
-
-        } catch (Exception e) {
-            log.debug("Subset font placeholder creation failed: {}", e.getMessage());
-            return "";
-        }
-    }
-
-    private String createAlternativePlaceholder(
-            String originalWord, float targetWidth, PDFont font, float fontSize) {
-        try {
-            String[] alternatives = {" ", ".", "-", "_", "~", "°", "·"};
-
-            if (TextEncodingHelper.fontSupportsCharacter(font, " ")) {
-                float spaceWidth = safeGetStringWidth(font, " ") / FONT_SCALE_FACTOR * fontSize;
-                if (spaceWidth > 0) {
-                    int spaceCount = Math.max(1, Math.round(targetWidth / spaceWidth));
-                    int maxSpaces = originalWord.length() * 2;
-                    spaceCount = Math.min(spaceCount, maxSpaces);
-                    log.debug("Using spaces for font {}", font.getName());
-                    return " ".repeat(spaceCount);
-                }
-            }
-
-            for (String altChar : alternatives) {
-                if (" ".equals(altChar)) continue;
-
-                try {
-                    if (!TextEncodingHelper.fontSupportsCharacter(font, altChar)) {
-                        continue;
-                    }
-
-                    float charWidth =
-                            safeGetStringWidth(font, altChar) / FONT_SCALE_FACTOR * fontSize;
-                    if (charWidth > 0) {
-                        int charCount = Math.max(1, Math.round(targetWidth / charWidth));
-                        int maxChars = originalWord.length() * 2;
-                        charCount = Math.min(charCount, maxChars);
-                        log.debug(
-                                "Using character '{}' for width calculation but spaces for placeholder in font {}",
-                                altChar,
-                                font.getName());
-                        return " ".repeat(charCount);
-                    }
-                } catch (Exception e) {
-                    // try next alternative
-                }
-            }
-
-            log.debug(
-                    "All placeholder alternatives failed for font {}, using empty string",
-                    font.getName());
-            return "";
-
-        } catch (Exception e) {
-            log.debug("Alternative placeholder creation failed: {}", e.getMessage());
-            return "";
-        }
-    }
-
-    // -----------------------------------------------------------------------
-    // Width calculation
-    // -----------------------------------------------------------------------
-
-    private float safeGetStringWidth(PDFont font, String text) {
-        if (font == null || text == null || text.isEmpty()) {
-            return 0;
-        }
-
-        if (!WidthCalculator.isWidthCalculationReliable(font)) {
-            log.debug(
-                    "Font {} flagged as unreliable for width calculation, using fallback",
-                    font.getName());
-            return calculateConservativeWidth(font, text);
-        }
-
-        if (!TextEncodingHelper.canEncodeCharacters(font, text)) {
-            log.debug(
-                    "Text cannot be encoded by font {}, using character-based fallback",
-                    font.getName());
-            return calculateCharacterBasedWidth(font, text);
-        }
-
-        try {
-            float width = font.getStringWidth(text);
-            log.debug("Direct width calculation successful for '{}': {}", text, width);
-            return width;
-
-        } catch (Exception e) {
-            log.debug(
-                    "Direct width calculation failed for font {}: {}",
-                    font.getName(),
-                    e.getMessage());
-            return calculateFallbackWidth(font, text);
-        }
-    }
-
-    private float calculateCharacterBasedWidth(PDFont font, String text) {
-        try {
-            float totalWidth = 0;
-            for (int i = 0; i < text.length(); i++) {
-                String character = text.substring(i, i + 1);
-                try {
-                    if (!TextEncodingHelper.fontSupportsCharacter(font, character)) {
-                        totalWidth += font.getAverageFontWidth();
-                        continue;
-                    }
-
-                    byte[] encoded = font.encode(character);
-                    if (encoded.length > 0) {
-                        int glyphCode = encoded[0] & 0xFF;
-                        float glyphWidth = font.getWidth(glyphCode);
-
-                        if (glyphWidth == 0) {
-                            try {
-                                glyphWidth = font.getWidthFromFont(glyphCode);
-                            } catch (Exception e2) {
-                                glyphWidth = font.getAverageFontWidth();
-                            }
-                        }
-
-                        totalWidth += glyphWidth;
-                    } else {
-                        totalWidth += font.getAverageFontWidth();
-                    }
-                } catch (Exception e2) {
-                    totalWidth += font.getAverageFontWidth();
-                }
-            }
-
-            log.debug("Character-based width calculation: {}", totalWidth);
-            return totalWidth;
-
-        } catch (Exception e) {
-            log.debug("Character-based width calculation failed: {}", e.getMessage());
-            return calculateConservativeWidth(font, text);
-        }
-    }
-
-    private float calculateFallbackWidth(PDFont font, String text) {
-        try {
-            if (font.getFontDescriptor() != null
-                    && font.getFontDescriptor().getFontBoundingBox() != null) {
-
-                org.apache.pdfbox.pdmodel.common.PDRectangle bbox =
-                        font.getFontDescriptor().getFontBoundingBox();
-                float avgCharWidth = bbox.getWidth() * 0.6f;
-                float fallbackWidth = text.length() * avgCharWidth;
-
-                log.debug("Bounding box fallback width: {}", fallbackWidth);
-                return fallbackWidth;
-            }
-
-            try {
-                float avgWidth = font.getAverageFontWidth();
-                if (avgWidth > 0) {
-                    float fallbackWidth = text.length() * avgWidth;
-                    log.debug("Average width fallback: {}", fallbackWidth);
-                    return fallbackWidth;
-                }
-            } catch (Exception e2) {
-                log.debug("Average font width calculation failed: {}", e2.getMessage());
-            }
-
-            return calculateConservativeWidth(font, text);
-
-        } catch (Exception e) {
-            log.debug("Fallback width calculation failed: {}", e.getMessage());
-            return calculateConservativeWidth(font, text);
-        }
-    }
-
-    private float calculateConservativeWidth(PDFont font, String text) {
-        float conservativeWidth = text.length() * 500f;
-        log.debug(
-                "Conservative width estimate for font {} text '{}': {}",
-                font.getName(),
-                text,
-                conservativeWidth);
-        return conservativeWidth;
-    }
-
-    private float calculateWidthAdjustment(TextSegment segment, List<MatchRange> matches) {
-        try {
-            if (segment.getFont() == null || segment.getFontSize() <= 0) {
-                return 0;
-            }
-
-            String fontName = segment.getFont().getName();
-            if (fontName != null
-                    && (fontName.contains("HOEPAP") || TextEncodingHelper.isFontSubset(fontName))) {
-                log.debug("Skipping width adjustment for problematic/subset font: {}", fontName);
-                return 0;
-            }
-
-            float totalOriginal = 0;
-            float totalPlaceholder = 0;
-            String text = segment.getText();
-
-            for (MatchRange match : matches) {
-                int segStart = Math.max(0, match.getStartPos() - segment.getStartPos());
-                int segEnd = Math.min(text.length(), match.getEndPos() - segment.getStartPos());
-
-                if (segStart < text.length() && segEnd > segStart) {
-                    String originalPart = text.substring(segStart, segEnd);
-
-                    float originalWidth =
-                            safeGetStringWidth(segment.getFont(), originalPart)
-                                    / FONT_SCALE_FACTOR
-                                    * segment.getFontSize();
-
-                    String placeholderPart =
-                            createPlaceholderWithWidth(
-                                    originalPart,
-                                    originalWidth,
-                                    segment.getFont(),
-                                    segment.getFontSize());
-
-                    float origUnits = safeGetStringWidth(segment.getFont(), originalPart);
-                    float placeUnits = safeGetStringWidth(segment.getFont(), placeholderPart);
-
-                    float orig = (origUnits / FONT_SCALE_FACTOR) * segment.getFontSize();
-                    float place = (placeUnits / FONT_SCALE_FACTOR) * segment.getFontSize();
-
-                    totalOriginal += orig;
-                    totalPlaceholder += place;
-                }
-            }
-
-            float adjustment = totalOriginal - totalPlaceholder;
-
-            float maxReasonableAdjustment =
-                    Math.max(
-                            segment.getText().length() * segment.getFontSize() * 2,
-                            totalOriginal * 1.5f);
-
-            if (Math.abs(adjustment) > maxReasonableAdjustment) {
-                log.debug(
-                        "Width adjustment {} seems unreasonable for text length {}, capping to 0",
-                        adjustment,
-                        segment.getText().length());
-                return 0;
-            }
-
-            return adjustment;
-        } catch (Exception ex) {
-            log.debug("Width adjustment failed: {}", ex.getMessage());
-            return 0;
-        }
-    }
-
-    // -----------------------------------------------------------------------
-    // Token and segment operations
-    // -----------------------------------------------------------------------
-
-    private void processPageXObjects(
-            PDDocument document,
-            PDResources resources,
-            Set<String> targetWords,
-            boolean useRegex,
-            boolean wholeWordSearch) {
-        processPageXObjects(
-                document, resources, targetWords, useRegex, wholeWordSearch, 0, new HashSet<>());
-    }
-
-    private void processPageXObjects(
-            PDDocument document,
-            PDResources resources,
-            Set<String> targetWords,
-            boolean useRegex,
-            boolean wholeWordSearch,
-            int depth,
-            Set<COSBase> visited) {
-
-        if (depth > MAX_XOBJECT_DEPTH) {
-            log.warn("[redact] XObject nesting depth {} exceeded limit, stopping traversal", depth);
-            return;
-        }
-
-        for (COSName xobjName : resources.getXObjectNames()) {
-            try {
-                PDXObject xobj = resources.getXObject(xobjName);
-                if (xobj instanceof PDFormXObject formXObj) {
-                    if (!visited.add(formXObj.getCOSObject())) {
-                        log.debug(
-                                "[redact] Cycle detected in XObject graph, skipping {}",
-                                xobjName.getName());
-                        continue;
-                    }
-                    processFormXObject(
-                            document,
-                            formXObj,
-                            targetWords,
-                            useRegex,
-                            wholeWordSearch,
-                            depth + 1,
-                            visited);
-                    log.debug("Processed Form XObject: {}", xobjName.getName());
-                }
-            } catch (Exception e) {
-                log.warn("Failed to process XObject {}: {}", xobjName.getName(), e.getMessage());
-            }
-        }
-    }
-
-    private void processFormXObject(
-            PDDocument document,
-            PDFormXObject formXObject,
-            Set<String> targetWords,
-            boolean useRegex,
-            boolean wholeWordSearch,
-            int depth,
-            Set<COSBase> visited) {
-
-        try {
-            PDResources xobjResources = formXObject.getResources();
-            if (xobjResources == null) {
-                return;
-            }
-
-            processPageXObjects(
-                    document,
-                    xobjResources,
-                    targetWords,
-                    useRegex,
-                    wholeWordSearch,
-                    depth,
-                    visited);
-
-            PDFStreamParser parser = new PDFStreamParser(formXObject);
-            List<Object> tokens = new ArrayList<>();
-            Object token;
-            while ((token = parser.parseNextToken()) != null) {
-                tokens.add(token);
-            }
-
-            List<TextSegment> textSegments = extractTextSegmentsFromXObject(xobjResources, tokens);
-            String completeText = buildCompleteText(textSegments);
-            List<MatchRange> matches =
-                    findAllMatches(completeText, targetWords, useRegex, wholeWordSearch);
-
-            if (!matches.isEmpty()) {
-                List<Object> redactedTokens =
-                        applyRedactionsToTokens(tokens, textSegments, matches);
-                writeRedactedContentToXObject(document, formXObject, redactedTokens);
-                log.debug("Processed {} redactions in Form XObject", matches.size());
-            }
-
-        } catch (Exception e) {
-            log.warn("Failed to process Form XObject: {}", e.getMessage());
-        }
-    }
-
-    private void writeRedactedContentToXObject(
-            PDDocument document, PDFormXObject formXObject, List<Object> redactedTokens)
-            throws IOException {
-
-        PDStream newStream = new PDStream(document);
-
-        try (var out = newStream.createOutputStream()) {
-            ContentStreamWriter writer = new ContentStreamWriter(out);
-            writer.writeTokens(redactedTokens);
-        }
-
-        formXObject.getCOSObject().removeItem(COSName.CONTENTS);
-        formXObject.getCOSObject().setItem(COSName.CONTENTS, newStream.getCOSObject());
-    }
-
-    private List<TextSegment> extractTextSegments(PDPage page, List<Object> tokens) {
-        List<TextSegment> segments = new ArrayList<>();
-        int currentTextPos = 0;
-        GraphicsState graphicsState = new GraphicsState();
-        PDResources resources = page.getResources();
-
-        for (int i = 0; i < tokens.size(); i++) {
-            Object currentToken = tokens.get(i);
-
-            if (currentToken instanceof Operator op) {
-                String opName = op.getName();
-
-                if ("Tf".equals(opName) && i >= 2) {
-                    try {
-                        COSName fontName = (COSName) tokens.get(i - 2);
-                        COSBase fontSizeBase = (COSBase) tokens.get(i - 1);
-                        if (fontSizeBase instanceof COSNumber cosNumber) {
-                            graphicsState.setFont(resources.getFont(fontName));
-                            graphicsState.setFontSize(cosNumber.floatValue());
-                        }
-                    } catch (ClassCastException | IOException e) {
-                        log.debug(
-                                "Failed to extract font and font size from Tf operator: {}",
-                                e.getMessage());
-                    }
-                }
-
-                currentTextPos =
-                        getCurrentTextPos(
-                                tokens, segments, currentTextPos, graphicsState, i, opName);
-            }
-        }
-
-        return segments;
-    }
-
-    private List<TextSegment> extractTextSegmentsFromXObject(
-            PDResources resources, List<Object> tokens) {
-        List<TextSegment> segments = new ArrayList<>();
-        int currentTextPos = 0;
-        GraphicsState graphicsState = new GraphicsState();
-
-        for (int i = 0; i < tokens.size(); i++) {
-            Object currentToken = tokens.get(i);
-
-            if (currentToken instanceof Operator op) {
-                String opName = op.getName();
-
-                if ("Tf".equals(opName) && i >= 2) {
-                    try {
-                        COSName fontName = (COSName) tokens.get(i - 2);
-                        COSBase fontSizeBase = (COSBase) tokens.get(i - 1);
-                        if (fontSizeBase instanceof COSNumber cosNumber) {
-                            graphicsState.setFont(resources.getFont(fontName));
-                            graphicsState.setFontSize(cosNumber.floatValue());
-                        }
-                    } catch (ClassCastException | IOException e) {
-                        log.debug("Font extraction failed in XObject: {}", e.getMessage());
-                    }
-                }
-
-                currentTextPos =
-                        getCurrentTextPos(
-                                tokens, segments, currentTextPos, graphicsState, i, opName);
-            }
-        }
-
-        return segments;
-    }
-
-    private int getCurrentTextPos(
-            List<Object> tokens,
-            List<TextSegment> segments,
-            int currentTextPos,
-            GraphicsState graphicsState,
-            int i,
-            String opName) {
-        if (isTextShowingOperator(opName) && i > 0) {
-            String textContent = extractTextFromToken(tokens.get(i - 1), opName);
-            if (!textContent.isEmpty()) {
-                segments.add(
-                        new TextSegment(
-                                i - 1,
-                                opName,
-                                textContent,
-                                currentTextPos,
-                                currentTextPos + textContent.length(),
-                                graphicsState.font,
-                                graphicsState.fontSize));
-                currentTextPos += textContent.length();
-            }
-        }
-        return currentTextPos;
-    }
-
-    private String buildCompleteText(List<TextSegment> segments) {
-        StringBuilder sb = new StringBuilder();
-        for (TextSegment segment : segments) {
-            sb.append(segment.text);
-        }
-        return sb.toString();
-    }
-
-    private List<MatchRange> findAllMatches(
-            String completeText,
-            Set<String> targetWords,
-            boolean useRegex,
-            boolean wholeWordSearch) {
-
-        List<Pattern> patterns =
-                TextFinderUtils.createOptimizedSearchPatterns(
-                        targetWords, useRegex, wholeWordSearch);
-
-        return patterns.stream()
-                .flatMap(
-                        pattern -> {
-                            try {
-                                return pattern.matcher(completeText).results();
-                            } catch (Exception e) {
-                                log.debug(
-                                        "Pattern matching failed for pattern {}: {}",
-                                        pattern.pattern(),
-                                        e.getMessage());
-                                return java.util.stream.Stream.empty();
-                            }
-                        })
-                .map(matchResult -> new MatchRange(matchResult.start(), matchResult.end()))
-                .sorted(Comparator.comparingInt(MatchRange::getStartPos))
-                .collect(Collectors.toList());
-    }
-
-    private List<Object> applyRedactionsToTokens(
-            List<Object> tokens, List<TextSegment> textSegments, List<MatchRange> matches) {
-
-        long startTime = System.currentTimeMillis();
-
-        try {
-            List<Object> newTokens = new ArrayList<>(tokens);
-
-            Map<Integer, List<MatchRange>> matchesBySegment = new HashMap<>();
-            for (MatchRange match : matches) {
-                for (int i = 0; i < textSegments.size(); i++) {
-                    TextSegment segment = textSegments.get(i);
-                    int overlapStart = Math.max(match.startPos, segment.startPos);
-                    int overlapEnd = Math.min(match.endPos, segment.endPos);
-                    if (overlapStart < overlapEnd) {
-                        matchesBySegment.computeIfAbsent(i, k -> new ArrayList<>()).add(match);
-                    }
-                }
-            }
-
-            List<ModificationTask> tasks = new ArrayList<>();
-            for (Map.Entry<Integer, List<MatchRange>> entry : matchesBySegment.entrySet()) {
-                int segmentIndex = entry.getKey();
-                List<MatchRange> segmentMatches = entry.getValue();
-                TextSegment segment = textSegments.get(segmentIndex);
-
-                if ("Tj".equals(segment.operatorName) || "'".equals(segment.operatorName)) {
-                    String newText = applyRedactionsToSegmentText(segment, segmentMatches);
-                    try {
-                        float adjustment = calculateWidthAdjustment(segment, segmentMatches);
-                        tasks.add(new ModificationTask(segment, newText, adjustment));
-                    } catch (Exception e) {
-                        log.debug(
-                                "Width adjustment calculation failed for segment: {}",
-                                e.getMessage());
-                    }
-                } else if ("TJ".equals(segment.operatorName)) {
-                    tasks.add(new ModificationTask(segment, null, 0));
-                }
-            }
-
-            tasks.sort((a, b) -> Integer.compare(b.segment.tokenIndex, a.segment.tokenIndex));
-
-            for (ModificationTask task : tasks) {
-                List<MatchRange> segmentMatches =
-                        matchesBySegment.getOrDefault(
-                                textSegments.indexOf(task.segment),
-                                java.util.Collections.emptyList());
-                modifyTokenForRedaction(
-                        newTokens, task.segment, task.newText, task.adjustment, segmentMatches);
-            }
-
-            return newTokens;
-
         } finally {
-            long processingTime = System.currentTimeMillis() - startTime;
-            log.debug(
-                    "Token redaction processing completed in {} ms for {} matches",
-                    processingTime,
-                    matches.size());
-        }
-    }
-
-    private String applyRedactionsToSegmentText(TextSegment segment, List<MatchRange> matches) {
-        String text = segment.getText();
-
-        if (segment.getFont() != null
-                && !TextEncodingHelper.isTextSegmentRemovable(segment.getFont(), text)) {
-            log.debug(
-                    "Skipping text segment '{}' - font {} cannot process this text reliably",
-                    text,
-                    segment.getFont().getName());
-            return text;
-        }
-
-        StringBuilder result = new StringBuilder(text);
-
-        for (MatchRange match : matches) {
-            int segmentStart = Math.max(0, match.getStartPos() - segment.getStartPos());
-            int segmentEnd = Math.min(text.length(), match.getEndPos() - segment.getStartPos());
-
-            if (segmentStart < text.length() && segmentEnd > segmentStart) {
-                String originalPart = text.substring(segmentStart, segmentEnd);
-
-                if (segment.getFont() != null
-                        && !TextEncodingHelper.isTextSegmentRemovable(
-                                segment.getFont(), originalPart)) {
-                    log.debug(
-                            "Skipping text part '{}' within segment - cannot be processed reliably",
-                            originalPart);
-                    continue;
+            if (tempIn != null && tempIn.exists()) {
+                try {
+                    Files.delete(tempIn.toPath());
+                } catch (IOException _) {
+                    log.warn("Failed to delete temporary file: {}", tempIn.getAbsolutePath());
                 }
-
-                float originalWidth = 0;
-                if (segment.getFont() != null && segment.getFontSize() > 0) {
-                    try {
-                        originalWidth =
-                                safeGetStringWidth(segment.getFont(), originalPart)
-                                        / FONT_SCALE_FACTOR
-                                        * segment.getFontSize();
-                    } catch (Exception e) {
-                        log.debug(
-                                "Failed to calculate original width for placeholder: {}",
-                                e.getMessage());
-                    }
-                }
-
-                String placeholder =
-                        (originalWidth > 0)
-                                ? createPlaceholderWithWidth(
-                                        originalPart,
-                                        originalWidth,
-                                        segment.getFont(),
-                                        segment.getFontSize())
-                                : createPlaceholderWithFont(originalPart, segment.getFont());
-
-                result.replace(segmentStart, segmentEnd, placeholder);
-            }
-        }
-
-        return result.toString();
-    }
-
-    private void modifyTokenForRedaction(
-            List<Object> tokens,
-            TextSegment segment,
-            String newText,
-            float adjustment,
-            List<MatchRange> matches) {
-
-        if (segment.getTokenIndex() < 0 || segment.getTokenIndex() >= tokens.size()) {
-            return;
-        }
-
-        Object token = tokens.get(segment.getTokenIndex());
-        String operatorName = segment.getOperatorName();
-
-        try {
-            if (("Tj".equals(operatorName) || "'".equals(operatorName))
-                    && token instanceof COSString) {
-
-                if (Math.abs(adjustment) < PRECISION_THRESHOLD) {
-                    if (newText.isEmpty()) {
-                        tokens.set(segment.getTokenIndex(), EMPTY_COS_STRING);
-                    } else {
-                        tokens.set(segment.getTokenIndex(), new COSString(newText));
-                    }
-                } else {
-                    COSArray newArray = new COSArray();
-                    newArray.add(new COSString(newText));
-                    if (segment.getFontSize() > 0) {
-                        float kerning = (-adjustment / segment.getFontSize()) * FONT_SCALE_FACTOR;
-                        newArray.add(new COSFloat(kerning));
-                    }
-                    tokens.set(segment.getTokenIndex(), newArray);
-
-                    int operatorIndex = segment.getTokenIndex() + 1;
-                    if (operatorIndex < tokens.size()
-                            && tokens.get(operatorIndex) instanceof Operator op
-                            && op.getName().equals(operatorName)) {
-                        tokens.set(operatorIndex, Operator.getOperator("TJ"));
-                    }
-                }
-            } else if ("TJ".equals(operatorName) && token instanceof COSArray) {
-                COSArray newArray = createRedactedTJArray((COSArray) token, segment, matches);
-                tokens.set(segment.getTokenIndex(), newArray);
             }
-        } catch (Exception e) {
-            log.debug(
-                    "Token modification failed for segment at index {}: {}",
-                    segment.getTokenIndex(),
-                    e.getMessage());
-        }
-    }
-
-    private COSArray createRedactedTJArray(
-            COSArray originalArray, TextSegment segment, List<MatchRange> matches) {
-        try {
-            COSArray newArray = new COSArray();
-            int textOffsetInSegment = 0;
-
-            for (COSBase element : originalArray) {
-                if (element instanceof COSString cosString) {
-                    String originalText = cosString.getString();
-
-                    if (segment.getFont() != null
-                            && !TextEncodingHelper.isTextSegmentRemovable(
-                                    segment.getFont(), originalText)) {
-                        log.debug(
-                                "Skipping TJ text part '{}' - cannot be processed reliably with font {}",
-                                originalText,
-                                segment.getFont().getName());
-                        newArray.add(element);
-                        textOffsetInSegment += originalText.length();
-                        continue;
-                    }
-
-                    StringBuilder newText = new StringBuilder(originalText);
-                    boolean modified = false;
-
-                    for (MatchRange match : matches) {
-                        int stringStartInPage = segment.getStartPos() + textOffsetInSegment;
-                        int stringEndInPage = stringStartInPage + originalText.length();
-
-                        int overlapStart = Math.max(match.getStartPos(), stringStartInPage);
-                        int overlapEnd = Math.min(match.getEndPos(), stringEndInPage);
-
-                        if (overlapStart < overlapEnd) {
-                            int redactionStartInString = overlapStart - stringStartInPage;
-                            int redactionEndInString = overlapEnd - stringStartInPage;
-                            if (redactionStartInString >= 0
-                                    && redactionEndInString <= originalText.length()) {
-                                String originalPart =
-                                        originalText.substring(
-                                                redactionStartInString, redactionEndInString);
-
-                                if (segment.getFont() != null
-                                        && !TextEncodingHelper.isTextSegmentRemovable(
-                                                segment.getFont(), originalPart)) {
-                                    log.debug(
-                                            "Skipping TJ text part '{}' - cannot be redacted reliably",
-                                            originalPart);
-                                    continue;
-                                }
-
-                                modified = true;
-                                float originalWidth = 0;
-                                if (segment.getFont() != null && segment.getFontSize() > 0) {
-                                    try {
-                                        originalWidth =
-                                                safeGetStringWidth(segment.getFont(), originalPart)
-                                                        / FONT_SCALE_FACTOR
-                                                        * segment.getFontSize();
-                                    } catch (Exception e) {
-                                        log.debug(
-                                                "Failed to calculate original width for TJ placeholder: {}",
-                                                e.getMessage());
-                                    }
-                                }
-
-                                String placeholder =
-                                        (originalWidth > 0)
-                                                ? createPlaceholderWithWidth(
-                                                        originalPart,
-                                                        originalWidth,
-                                                        segment.getFont(),
-                                                        segment.getFontSize())
-                                                : createPlaceholderWithFont(
-                                                        originalPart, segment.getFont());
-
-                                newText.replace(
-                                        redactionStartInString, redactionEndInString, placeholder);
-                            }
-                        }
-                    }
-
-                    String modifiedString = newText.toString();
-                    newArray.add(new COSString(modifiedString));
-
-                    if (modified && segment.getFont() != null && segment.getFontSize() > 0) {
-                        try {
-                            float originalWidth =
-                                    safeGetStringWidth(segment.getFont(), originalText)
-                                            / FONT_SCALE_FACTOR
-                                            * segment.getFontSize();
-                            float modifiedWidth =
-                                    safeGetStringWidth(segment.getFont(), modifiedString)
-                                            / FONT_SCALE_FACTOR
-                                            * segment.getFontSize();
-                            float adjustment = originalWidth - modifiedWidth;
-                            if (Math.abs(adjustment) > PRECISION_THRESHOLD) {
-                                float kerning =
-                                        (-adjustment / segment.getFontSize())
-                                                * FONT_SCALE_FACTOR
-                                                * 1.10f;
-                                newArray.add(new COSFloat(kerning));
-                            }
-                        } catch (Exception e) {
-                            log.debug(
-                                    "Width adjustment calculation failed for segment: {}",
-                                    e.getMessage());
-                        }
-                    }
-
-                    textOffsetInSegment += originalText.length();
-                } else {
-                    newArray.add(element);
+            if (tempOut != null && tempOut.exists()) {
+                try {
+                    Files.delete(tempOut.toPath());
+                } catch (IOException _) {
+                    log.warn("Failed to delete temporary file: {}", tempOut.getAbsolutePath());
                 }
             }
-            return newArray;
-        } catch (Exception e) {
-            return originalArray;
         }
     }
 
-    private String extractTextFromToken(Object token, String operatorName) {
-        return switch (operatorName) {
-            case "Tj", "'" -> {
-                if (token instanceof COSString cosString) {
-                    yield cosString.getString();
-                }
-                yield "";
-            }
-            case "TJ" -> {
-                if (token instanceof COSArray cosArray) {
-                    StringBuilder sb = new StringBuilder();
-                    for (COSBase element : cosArray) {
-                        if (element instanceof COSString cosString) {
-                            sb.append(cosString.getString());
-                        }
-                    }
-                    yield sb.toString();
-                }
-                yield "";
-            }
-            default -> "";
-        };
-    }
-
-    // -----------------------------------------------------------------------
-    // Inner data classes
-    // -----------------------------------------------------------------------
-
-    @Data
-    private static class GraphicsState {
-        private PDFont font = null;
-        private float fontSize = 0;
-    }
-
     @Data
     @AllArgsConstructor
     static class TextSegment {
@@ -1196,12 +188,4 @@ class TextRedactionService {
         private int startPos;
         private int endPos;
     }
-
-    @Data
-    @AllArgsConstructor
-    private static class ModificationTask {
-        private TextSegment segment;
-        private String newText;
-        private float adjustment;
-    }
 }
diff --git a/app/core/src/main/java/stirling/software/SPDF/model/api/security/RedactPdfRequest.java b/app/core/src/main/java/stirling/software/SPDF/model/api/security/RedactPdfRequest.java
index 279a41a27f..791b7626c4 100644
--- a/app/core/src/main/java/stirling/software/SPDF/model/api/security/RedactPdfRequest.java
+++ b/app/core/src/main/java/stirling/software/SPDF/model/api/security/RedactPdfRequest.java
@@ -45,5 +45,5 @@ public class RedactPdfRequest extends PDFFile {
             description = "Convert the redacted PDF to an image",
             defaultValue = "false",
             requiredMode = Schema.RequiredMode.REQUIRED)
-    private Boolean convertPDFToImage;
+    private Boolean convertPDFToImage = Boolean.FALSE;
 }
diff --git a/app/core/src/main/java/stirling/software/common/controller/JobController.java b/app/core/src/main/java/stirling/software/common/controller/JobController.java
index ef9e81873e..c6fec4b92b 100644
--- a/app/core/src/main/java/stirling/software/common/controller/JobController.java
+++ b/app/core/src/main/java/stirling/software/common/controller/JobController.java
@@ -12,6 +12,7 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -213,6 +214,35 @@ public class JobController {
         }
     }
 
+    /**
+     * Self-service counterpart to the admin-only {@code POST /api/v1/admin/job/cleanup}: that one
+     * sweeps every user's jobs and needs ROLE_ADMIN, this one releases only the caller's own and so
+     * is safe for any authenticated user. Both run the same sweep inside {@link TaskManager}.
+     */
+    @PostMapping("/jobs/cleanup")
+    @Operation(
+            summary = "Release finished jobs and their stored files now",
+            description =
+                    "Force-expires this node's finished jobs instead of waiting out the retention"
+                            + " window, deleting their result files and the persistent copies made of"
+                            + " their inputs. Only jobs the caller may access are touched, and jobs"
+                            + " still running are left alone. Admins can sweep every user's jobs"
+                            + " with POST /api/v1/admin/job/cleanup?force=true.")
+    public ResponseEntity<?> cleanupFinishedJobs() {
+        TaskManager.CleanupSummary summary =
+                taskManager.cleanupFinishedJobsNow(this::validateJobAccess);
+        log.info(
+                "On-demand job cleanup removed {} job(s) and {} file(s), retained {} job(s)",
+                summary.jobsRemoved(),
+                summary.filesDeleted(),
+                summary.jobsRetained());
+        return ResponseEntity.ok(
+                Map.of(
+                        "jobsRemoved", summary.jobsRemoved(),
+                        "filesDeleted", summary.filesDeleted(),
+                        "jobsRetained", summary.jobsRetained()));
+    }
+
     @GetMapping("/job/{jobId}/result/files")
     @Operation(summary = "Get job result files")
     public ResponseEntity<?> getJobFiles(@PathVariable("jobId") String jobId) {
diff --git a/app/core/src/main/resources/settings.yml.template b/app/core/src/main/resources/settings.yml.template
index d0234a3594..fdfe40b352 100644
--- a/app/core/src/main/resources/settings.yml.template
+++ b/app/core/src/main/resources/settings.yml.template
@@ -313,7 +313,7 @@ autoPipeline:
 
 ui:
   appNameNavbar: "" # custom app/brand name. NOTE: no longer shown in the navbar (the navbar renders the logo). It IS used as the browser tab title and as the TOTP/2FA issuer label in authenticator apps. Empty falls back to "Stirling PDF"
-  logoStyle: classic # Options: 'classic' (default - classic S icon) or 'modern' (minimalist logo)
+  logoStyle: modern # Options: 'modern' (default - minimalist logo) or 'classic' (legacy S icon)
   languages: [] # If empty, all languages are enabled. To restrict to specific languages, use a whitelist like ["de_DE", "pl_PL", "sv_SE"]. Empty list or not restricting any languages will enable all available languages.
   defaultHideUnavailableTools: false # Default user preference: hide disabled tools instead of greying them out
   defaultHideUnavailableConversions: false # Default user preference: hide disabled conversion options instead of greying them out
diff --git a/app/core/src/main/resources/static/apple-touch-icon.png b/app/core/src/main/resources/static/apple-touch-icon.png
index 6ac076ba54..66a12c54c6 100644
Binary files a/app/core/src/main/resources/static/apple-touch-icon.png and b/app/core/src/main/resources/static/apple-touch-icon.png differ
diff --git a/app/core/src/main/resources/static/favicon-16x16.png b/app/core/src/main/resources/static/favicon-16x16.png
index d88e6615d0..6448ce5424 100644
Binary files a/app/core/src/main/resources/static/favicon-16x16.png and b/app/core/src/main/resources/static/favicon-16x16.png differ
diff --git a/app/core/src/main/resources/static/favicon-32x32.png b/app/core/src/main/resources/static/favicon-32x32.png
index f44f0c371c..1343e2632d 100644
Binary files a/app/core/src/main/resources/static/favicon-32x32.png and b/app/core/src/main/resources/static/favicon-32x32.png differ
diff --git a/app/core/src/main/resources/static/favicon.icns b/app/core/src/main/resources/static/favicon.icns
index 7b281937e8..86bad6a2e1 100644
Binary files a/app/core/src/main/resources/static/favicon.icns and b/app/core/src/main/resources/static/favicon.icns differ
diff --git a/app/core/src/main/resources/static/favicon.ico b/app/core/src/main/resources/static/favicon.ico
index 8ad57cac70..2351219afa 100644
Binary files a/app/core/src/main/resources/static/favicon.ico and b/app/core/src/main/resources/static/favicon.ico differ
diff --git a/app/core/src/main/resources/static/favicon.svg b/app/core/src/main/resources/static/favicon.svg
index 0fef4393aa..b5455291c9 100644
--- a/app/core/src/main/resources/static/favicon.svg
+++ b/app/core/src/main/resources/static/favicon.svg
@@ -1 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 512 512" style="enable-background:new 0 0 512 512" xml:space="preserve"><defs id="defs173"><linearGradient id="XMLID_5_" x1="304.496" x2="316.036" y1="422.91" y2="326.263" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#dcf1f3" id="stop156"/><stop offset="1" style="stop-color:#c2c2c9" id="stop158"/></linearGradient></defs><style id="style150" type="text/css">.st1{fill:#c02223}.st2{fill:#882425}.st3{fill:url(#XMLID_5_)}.st4{fill:url(#XMLID_7_)}</style><g id="XMLID_4_"><path id="XMLID_131_" d="M 347.01402,14.355825 98.978019,69.02261 C 73.825483,74.547445 55.942464,96.792175 55.942464,122.52628 v 315.06096 c 0,22.39012 16.719895,41.14548 38.819234,43.76251 L 224.8861,498.36042 339.48636,384.26465 455.76603,265.15425 453.73057,84.870162 C 453.43979,62.916214 433.08513,46.632491 411.71274,51.284984 l -28.78729,6.251786 0.14539,-13.666697 C 383.36162,24.678542 365.62399,10.284894 347.01402,14.355825 Z" class="st1" style="stroke-width:1.45391"/><path id="XMLID_117_" d="m 383.21622,57.53677 v 285.8375 L 456.05681,265.00885 454.02135,78.763767 C 453.87595,59.863016 436.28372,45.905539 417.81914,49.97647 Z" class="st2" style="stroke-width:1.45391"/><polygon id="XMLID_18_" points="234.7 422.6 368.5 387.7 393.5 262.2" class="st3" style="fill:url(#XMLID_5_)" transform="matrix(1.4556308,0,0,1.4548265,-116.73161,-116.45231)"/><linearGradient id="XMLID_7_" x1="223.084" x2="241.417" y1="372.756" y2="114.557" gradientTransform="matrix(1.4539039,0,0,1.4539039,-116.19976,-116.20474)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#dcf1f3" id="stop163"/><stop offset="1" style="stop-color:#c2c2c9" id="stop165"/></linearGradient><path id="XMLID_6_" d="m 282.89686,214.84917 c 0,0 -22.24473,-28.93269 -38.67384,-36.78377 -10.46811,-4.94327 -26.02489,-6.83335 -38.23768,-0.72695 -18.02841,9.0142 -19.91848,34.31213 -3.34397,44.34406 3.92553,2.47165 9.15959,4.50711 15.99294,6.10641 36.63838,8.43264 97.12077,25.87949 89.70587,96.10304 0,0 -4.21633,65.86185 -73.56753,73.42215 -12.2128,1.30851 -24.57098,0.43617 -36.493,-2.32625 -16.42911,-3.63476 -45.50719,-11.04967 -59.75545,-19.91849 l -2.61703,-75.16682 h 6.97875 c 0,0 13.81208,33.43978 53.06749,49.57812 7.26952,2.90781 15.26599,4.07093 22.97168,2.90781 9.74116,-1.45391 21.22699,-6.68796 25.87949,-22.53551 0,0 7.85108,-23.11707 -32.85823,-35.76604 -32.56744,-10.17733 -63.24481,-20.64543 -75.89378,-54.95757 -5.961,-16.28371 -6.97874,-34.31212 -2.90781,-51.61358 5.37944,-22.53551 20.79082,-54.23062 64.40794,-67.89732 0,0 57.28381,-15.55677 96.53922,5.52484 l -1.74468,89.70587 z" class="st4" style="fill:url(#XMLID_7_);stroke-width:1.45391"/></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" width="512" height="512">
+  <rect width="512" height="512" rx="80" ry="80" fill="#8E3131"/>
+  <path d="M202 268L432 78V255L202 445V268Z" fill="#FFFFFF" fill-opacity="0.6"/>
+  <path d="M79 256L309 66V242L79 432V256Z" fill="#FFFFFF"/>
+</svg>
diff --git a/app/core/src/main/resources/static/images/signature.png b/app/core/src/main/resources/static/images/signature.png
index 1adfcedc3c..7c55bc2928 100644
Binary files a/app/core/src/main/resources/static/images/signature.png and b/app/core/src/main/resources/static/images/signature.png differ
diff --git a/app/core/src/test/java/stirling/software/SPDF/config/ToolIODeclarationCoverageTest.java b/app/core/src/test/java/stirling/software/SPDF/config/ToolIODeclarationCoverageTest.java
index f6fe52f2a6..d7d211a7ce 100644
--- a/app/core/src/test/java/stirling/software/SPDF/config/ToolIODeclarationCoverageTest.java
+++ b/app/core/src/test/java/stirling/software/SPDF/config/ToolIODeclarationCoverageTest.java
@@ -61,7 +61,10 @@ class ToolIODeclarationCoverageTest {
                     // signing tool itself is /api/v1/security/cert-sign, which is declared.
                     "/api/v1/security/cert-sign/sessions",
                     "/api/v1/security/cert-sign/validate-certificate",
-                    "/api/v1/security/cert-sign/hardware");
+                    "/api/v1/security/cert-sign/hardware",
+                    // Releases finished jobs and their stored files; server maintenance, takes and
+                    // returns no document.
+                    "/api/v1/general/jobs/cleanup");
 
     private record Scan(Set<String> required, Map<String, ToolIOSpec> declared) {}
 
diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactControllerMoreTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactControllerMoreTest.java
index 150a2355de..0065b02cee 100644
--- a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactControllerMoreTest.java
+++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactControllerMoreTest.java
@@ -24,6 +24,8 @@ import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.pdmodel.font.PDType0Font;
 import org.apache.pdfbox.pdmodel.font.PDType1Font;
 import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
 import org.junit.jupiter.api.AfterEach;
@@ -120,12 +122,22 @@ class RedactControllerMoreTest {
                 .thenAnswer(inv -> Loader.loadPDF(pdfBytes));
     }
 
+    private PDFont helvetica(PDDocument doc) throws IOException {
+        try (InputStream is =
+                getClass().getResourceAsStream("/type3/library/fonts/dejavu/DejaVuSans.ttf")) {
+            if (is != null) {
+                return PDType0Font.load(doc, is);
+            }
+        }
+        return new PDType1Font(Standard14Fonts.FontName.HELVETICA);
+    }
+
     private byte[] singlePageTextPdf(String... lines) throws IOException {
         try (PDDocument doc = new PDDocument()) {
             PDPage page = new PDPage(PDRectangle.LETTER);
             doc.addPage(page);
             try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-                cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+                cs.setFont(helvetica(doc), FONT_SIZE);
                 for (int i = 0; i < lines.length; i++) {
                     cs.beginText();
                     cs.newLineAtOffset(LEFT_X, TOP_Y - i * 16f);
@@ -145,7 +157,7 @@ class RedactControllerMoreTest {
                 PDPage page = new PDPage(PDRectangle.LETTER);
                 doc.addPage(page);
                 try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-                    cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+                    cs.setFont(helvetica(doc), FONT_SIZE);
                     cs.beginText();
                     cs.newLineAtOffset(LEFT_X, TOP_Y);
                     cs.showText(line);
diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactControllerTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactControllerTest.java
index 15774415a9..2f78ee033b 100644
--- a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactControllerTest.java
+++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactControllerTest.java
@@ -14,19 +14,25 @@ import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
-import java.util.Set;
+import java.util.Map;
 
 import org.apache.pdfbox.contentstream.operator.Operator;
 import org.apache.pdfbox.cos.COSArray;
+import org.apache.pdfbox.cos.COSDocument;
 import org.apache.pdfbox.cos.COSFloat;
 import org.apache.pdfbox.cos.COSName;
+import org.apache.pdfbox.cos.COSStream;
 import org.apache.pdfbox.cos.COSString;
 import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
+import org.apache.pdfbox.pdmodel.PDDocumentInformation;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.PDPageTree;
 import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.pdmodel.font.PDType0Font;
 import org.apache.pdfbox.pdmodel.font.PDType1Font;
 import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
 import org.junit.jupiter.api.AfterEach;
@@ -49,6 +55,7 @@ import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.mock.web.MockMultipartFile;
 
+import stirling.software.SPDF.model.PDFText;
 import stirling.software.SPDF.model.api.security.ManualRedactPdfRequest;
 import stirling.software.SPDF.model.api.security.RedactPdfRequest;
 import stirling.software.common.model.api.security.RedactionArea;
@@ -64,9 +71,9 @@ class RedactControllerTest {
         return ResponseEntity.ok(new ByteArrayResource(bytes));
     }
 
-    private static byte[] drainBody(ResponseEntity<Resource> response) throws java.io.IOException {
-        java.io.ByteArrayOutputStream baos = new java.io.ByteArrayOutputStream();
-        try (java.io.InputStream __in = response.getBody().getInputStream()) {
+    private static byte[] drainBody(ResponseEntity<Resource> response) throws IOException {
+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
+        try (InputStream __in = response.getBody().getInputStream()) {
             __in.transferTo(baos);
         }
         return baos.toByteArray();
@@ -90,13 +97,24 @@ class RedactControllerTest {
     private PDDocument realDocument;
     private PDPage realPage;
 
+    private static PDFont helvetica(PDDocument doc) throws IOException {
+        try (InputStream is =
+                RedactControllerTest.class.getResourceAsStream(
+                        "/type3/library/fonts/dejavu/DejaVuSans.ttf")) {
+            if (is != null) {
+                return PDType0Font.load(doc, is);
+            }
+        }
+        return new PDType1Font(Standard14Fonts.FontName.HELVETICA);
+    }
+
     private static byte[] createSimplePdfContent() throws IOException {
         try (PDDocument doc = new PDDocument()) {
             PDPage page = new PDPage(PDRectangle.A4);
             doc.addPage(page);
             try (PDPageContentStream contentStream = new PDPageContentStream(doc, page)) {
                 contentStream.beginText();
-                contentStream.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), 12);
+                contentStream.setFont(helvetica(doc), 12);
                 contentStream.newLineAtOffset(100, 700);
                 contentStream.showText("This is a simple PDF.");
                 contentStream.endText();
@@ -156,8 +174,7 @@ class RedactControllerTest {
         mockDocument = mock(PDDocument.class);
         mockPages = mock(PDPageTree.class);
         mockPage = mock(PDPage.class);
-        org.apache.pdfbox.pdmodel.PDDocumentCatalog mockCatalog =
-                mock(org.apache.pdfbox.pdmodel.PDDocumentCatalog.class);
+        PDDocumentCatalog mockCatalog = mock(PDDocumentCatalog.class);
 
         // Setup document structure properly
         when(pdfDocumentFactory.load(any(MockMultipartFile.class))).thenReturn(mockDocument);
@@ -182,9 +199,8 @@ class RedactControllerTest {
 
         when(mockPage.hasContents()).thenReturn(true);
 
-        org.apache.pdfbox.cos.COSDocument mockCOSDocument =
-                mock(org.apache.pdfbox.cos.COSDocument.class);
-        org.apache.pdfbox.cos.COSStream mockCOSStream = mock(org.apache.pdfbox.cos.COSStream.class);
+        COSDocument mockCOSDocument = mock(COSDocument.class);
+        COSStream mockCOSStream = mock(COSStream.class);
         when(mockDocument.getDocument()).thenReturn(mockCOSDocument);
         when(mockCOSDocument.createCOSStream()).thenReturn(mockCOSStream);
 
@@ -338,17 +354,13 @@ class RedactControllerTest {
 
             when(mockPages.get(0)).thenReturn(mockPage);
 
-            org.apache.pdfbox.pdmodel.PDDocumentInformation mockInfo =
-                    mock(org.apache.pdfbox.pdmodel.PDDocumentInformation.class);
+            PDDocumentInformation mockInfo = mock(PDDocumentInformation.class);
             when(mockDocument.getDocumentInformation()).thenReturn(mockInfo);
 
             ResponseEntity<Resource> response = redactController.redactPdf(request);
 
             assertNotNull(response);
             assertEquals(200, response.getStatusCode().value());
-
-            verify(mockDocument).save(any(File.class));
-            verify(mockDocument).close();
         }
     }
 
@@ -753,8 +765,6 @@ class RedactControllerTest {
                 assertEquals(200, response.getStatusCode().value());
                 assertNotNull(response.getBody());
                 assertTrue(drainBody(response).length > 0);
-                verify(mockDocument, times(1)).save(any(File.class));
-                verify(mockDocument, times(1)).close();
             }
         } catch (Exception e) {
             if (expectSuccess) {
@@ -788,11 +798,14 @@ class RedactControllerTest {
         realPage = new PDPage(PDRectangle.A4);
         realDocument.addPage(realPage);
 
-        // Set up basic page resources
-        PDResources resources = new PDResources();
-        resources.put(
-                COSName.getPDFName("F1"), new PDType1Font(Standard14Fonts.FontName.HELVETICA));
-        realPage.setResources(resources);
+        // Set up basic page resources with embedded font
+        try {
+            PDResources resources = new PDResources();
+            resources.put(COSName.getPDFName("F1"), helvetica(realDocument));
+            realPage.setResources(resources);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
     }
 
     // Helper methods for real PDF content creation
@@ -803,8 +816,7 @@ class RedactControllerTest {
         }
         realDocument.addPage(realPage);
         realPage.setResources(new PDResources());
-        realPage.getResources()
-                .put(COSName.getPDFName("F1"), new PDType1Font(Standard14Fonts.FontName.HELVETICA));
+        realPage.getResources().put(COSName.getPDFName("F1"), helvetica(realDocument));
 
         try (PDPageContentStream contentStream = new PDPageContentStream(realDocument, realPage)) {
             contentStream.beginText();
@@ -822,8 +834,7 @@ class RedactControllerTest {
         }
         realDocument.addPage(realPage);
         realPage.setResources(new PDResources());
-        realPage.getResources()
-                .put(COSName.getPDFName("F1"), new PDType1Font(Standard14Fonts.FontName.HELVETICA));
+        realPage.getResources().put(COSName.getPDFName("F1"), helvetica(realDocument));
 
         try (PDPageContentStream contentStream = new PDPageContentStream(realDocument, realPage)) {
             contentStream.beginText();
@@ -846,8 +857,7 @@ class RedactControllerTest {
         }
         realDocument.addPage(realPage);
         realPage.setResources(new PDResources());
-        realPage.getResources()
-                .put(COSName.getPDFName("F1"), new PDType1Font(Standard14Fonts.FontName.HELVETICA));
+        realPage.getResources().put(COSName.getPDFName("F1"), helvetica(realDocument));
 
         try (PDPageContentStream contentStream = new PDPageContentStream(realDocument, realPage)) {
             contentStream.setLineWidth(2);
@@ -874,8 +884,7 @@ class RedactControllerTest {
         }
         realDocument.addPage(realPage);
         realPage.setResources(new PDResources());
-        realPage.getResources()
-                .put(COSName.getPDFName("F1"), new PDType1Font(Standard14Fonts.FontName.HELVETICA));
+        realPage.getResources().put(COSName.getPDFName("F1"), helvetica(realDocument));
 
         try (PDPageContentStream contentStream = new PDPageContentStream(realDocument, realPage)) {
             contentStream.beginText();
@@ -1005,22 +1014,6 @@ class RedactControllerTest {
         }
     }
 
-    private List<Object> getOriginalTokens() throws Exception {
-        // Create a new page to avoid side effects from other tests
-        PDPage pageForTokenExtraction = new PDPage(PDRectangle.A4);
-        pageForTokenExtraction.setResources(realPage.getResources());
-        try (PDPageContentStream contentStream =
-                new PDPageContentStream(realDocument, pageForTokenExtraction)) {
-            contentStream.beginText();
-            contentStream.setFont(realPage.getResources().getFont(COSName.getPDFName("F1")), 12);
-            contentStream.newLineAtOffset(50, 750);
-            contentStream.showText("Original content");
-            contentStream.endText();
-        }
-        return textRedactionService.createTokensWithoutTargetText(
-                realDocument, pageForTokenExtraction, Collections.emptySet(), false, false);
-    }
-
     @Nested
     @DisplayName("Color Decoding Utility Tests")
     class ColorDecodingTests {
@@ -1099,318 +1092,19 @@ class RedactControllerTest {
     class ContentStreamUnitTests {
 
         @Test
-        @DisplayName("createTokensWithoutTargetText should remove simple text tokens")
-        void shouldRemoveSimpleTextTokens() throws Exception {
-            createRealPageWithSimpleText("This document contains confidential information.");
+        @DisplayName("performTextReplacement should process document text replacement")
+        void shouldPerformTextReplacement() throws Exception {
+            createRealPageWithSimpleText("This document contains sensitive information.");
+            String[] targetWords = new String[] {"sensitive"};
 
-            Set<String> targetWords = Set.of("confidential");
+            Map<Integer, List<PDFText>> found =
+                    textRedactionService.findTextToRedact(realDocument, targetWords, false, false);
+            assertFalse(found.isEmpty(), "Should find target text to redact");
 
-            List<Object> tokens =
-                    textRedactionService.createTokensWithoutTargetText(
-                            realDocument, realPage, targetWords, false, false);
-
-            assertNotNull(tokens);
-            assertFalse(tokens.isEmpty());
-
-            String reconstructedText = extractTextFromTokens(tokens);
-            assertFalse(
-                    reconstructedText.contains("confidential"),
-                    "Target text should be replaced with placeholder");
-            assertTrue(reconstructedText.contains("document"), "Non-target text should remain");
-        }
-
-        @Test
-        @DisplayName("createTokensWithoutTargetText should handle TJ operator arrays")
-        void shouldHandleTJOperatorArrays() throws Exception {
-            createRealPageWithTJArrayText();
-
-            Set<String> targetWords = Set.of("secret");
-
-            List<Object> tokens =
-                    textRedactionService.createTokensWithoutTargetText(
-                            realDocument, realPage, targetWords, false, false);
-
-            assertNotNull(tokens);
-
-            boolean foundModifiedTJArray = false;
-            for (Object token : tokens) {
-                if (token instanceof COSArray array) {
-                    for (int i = 0; i < array.size(); i++) {
-                        if (array.getObject(i) instanceof COSString cosString) {
-                            String text = cosString.getString();
-                            if (text.contains("secret")) {
-                                fail(
-                                        "Target text 'secret' should have been redacted from TJ"
-                                                + " array");
-                            }
-                            foundModifiedTJArray = true;
-                        }
-                    }
-                }
-            }
-            assertTrue(foundModifiedTJArray, "Should find at least one TJ array");
-        }
-
-        @Test
-        @DisplayName("createTokensWithoutTargetText should preserve non-text tokens")
-        void shouldPreserveNonTextTokens() throws Exception {
-            createRealPageWithMixedContent();
-
-            Set<String> targetWords = Set.of("redact");
-
-            List<Object> originalTokens = getOriginalTokens();
-            List<Object> filteredTokens =
-                    textRedactionService.createTokensWithoutTargetText(
-                            realDocument, realPage, targetWords, false, false);
-
-            long originalNonTextCount =
-                    originalTokens.stream()
-                            .filter(
-                                    token ->
-                                            token instanceof Operator op
-                                                    && !textRedactionService.isTextShowingOperator(
-                                                            op.getName()))
-                            .count();
-
-            long filteredNonTextCount =
-                    filteredTokens.stream()
-                            .filter(
-                                    token ->
-                                            token instanceof Operator op
-                                                    && !textRedactionService.isTextShowingOperator(
-                                                            op.getName()))
-                            .count();
-
-            assertTrue(filteredNonTextCount > 0, "Non-text operators should be preserved");
-
-            assertTrue(
-                    filteredNonTextCount >= originalNonTextCount / 2,
-                    "A reasonable number of non-text operators should be preserved");
-        }
-
-        @Test
-        @DisplayName("createTokensWithoutTargetText should handle regex patterns")
-        void shouldHandleRegexPatterns() throws Exception {
-            createRealPageWithSimpleText("Phone: 123-456-7890 and SSN: 111-22-3333");
-
-            Set<String> targetWords = Set.of("\\d{3}-\\d{2}-\\d{4}"); // SSN pattern
-
-            List<Object> tokens =
-                    textRedactionService.createTokensWithoutTargetText(
-                            realDocument, realPage, targetWords, true, false);
-
-            String reconstructedText = extractTextFromTokens(tokens);
-            assertFalse(reconstructedText.contains("111-22-3333"), "SSN should be redacted");
-            assertTrue(reconstructedText.contains("123-456-7890"), "Phone should remain");
-        }
-
-        @Test
-        @DisplayName("createTokensWithoutTargetText should handle whole word search")
-        void shouldHandleWholeWordSearch() throws Exception {
-            createRealPageWithSimpleText("This test testing tested document");
-
-            Set<String> targetWords = Set.of("test");
-
-            List<Object> tokens =
-                    textRedactionService.createTokensWithoutTargetText(
-                            realDocument, realPage, targetWords, false, true);
-
-            String reconstructedText = extractTextFromTokens(tokens);
-            assertTrue(reconstructedText.contains("testing"), "Partial matches should remain");
-            assertTrue(reconstructedText.contains("tested"), "Partial matches should remain");
-        }
-
-        @ParameterizedTest
-        @ValueSource(strings = {"Tj", "TJ", "'", "\""})
-        @DisplayName("createTokensWithoutTargetText should handle all text operators")
-        void shouldHandleAllTextOperators(String operatorName) throws Exception {
-            createRealPageWithSpecificOperator(operatorName);
-
-            Set<String> targetWords = Set.of("sensitive");
-
-            List<Object> tokens =
-                    textRedactionService.createTokensWithoutTargetText(
-                            realDocument, realPage, targetWords, false, false);
-
-            String reconstructedText = extractTextFromTokens(tokens);
-            assertFalse(
-                    reconstructedText.contains("sensitive"),
-                    "Text should be redacted regardless of operator type");
-        }
-
-        @Test
-        @DisplayName("writeFilteredContentStream should write tokens to new stream")
-        void shouldWriteTokensToNewContentStream() throws Exception {
-            List<Object> tokens = createSampleTokenList();
-
-            textRedactionService.writeFilteredContentStream(realDocument, realPage, tokens);
-
-            assertNotNull(realPage.getContents(), "Page should have content stream");
-
-            // Verify the content can be read back
-            try (InputStream inputStream = realPage.getContents()) {
-                byte[] content = readAllBytes(inputStream);
-                assertTrue(content.length > 0, "Content stream should not be empty");
-            }
-        }
-
-        @Test
-        @DisplayName("writeFilteredContentStream should handle empty token list")
-        void shouldHandleEmptyTokenList() throws Exception {
-            List<Object> emptyTokens = Collections.emptyList();
-
-            assertDoesNotThrow(
-                    () ->
-                            textRedactionService.writeFilteredContentStream(
-                                    realDocument, realPage, emptyTokens));
-
-            assertNotNull(realPage.getContents(), "Page should still have content stream");
-        }
-
-        @Test
-        @DisplayName("writeFilteredContentStream should replace existing content")
-        void shouldReplaceExistingContentStream() throws Exception {
-            createRealPageWithSimpleText("Original content");
-            String originalContent = extractTextFromModifiedPage(realPage);
-
-            List<Object> newTokens = createSampleTokenList();
-            textRedactionService.writeFilteredContentStream(realDocument, realPage, newTokens);
-
-            String newContent = extractTextFromModifiedPage(realPage);
-            assertNotEquals(originalContent, newContent, "Content stream should be replaced");
-        }
-
-        @Test
-        @DisplayName("Placeholder creation should maintain text width")
-        void shouldCreateWidthMatchingPlaceholder() {
-            String originalText = "confidential";
-            String placeholder =
-                    textRedactionService.createPlaceholderWithFont(
-                            originalText, new PDType1Font(Standard14Fonts.FontName.HELVETICA));
-
-            assertEquals(
-                    originalText.length(),
-                    placeholder.length(),
-                    "Placeholder should maintain character count for width preservation");
-        }
-
-        @Test
-        @DisplayName("Placeholder should handle special characters")
-        void shouldHandleSpecialCharactersInPlaceholder() {
-            String originalText = "café naïve";
-            String placeholder =
-                    textRedactionService.createPlaceholderWithFont(
-                            originalText, new PDType1Font(Standard14Fonts.FontName.HELVETICA));
-
-            assertEquals(originalText.length(), placeholder.length());
-            assertFalse(
-                    placeholder.contains("café"), "Placeholder should not contain original text");
-        }
-
-        @Test
-        @DisplayName("Integration test: createTokens and writeStream")
-        void shouldIntegrateTokenCreationAndWriting() throws Exception {
-            createRealPageWithSimpleText("This document contains secret information.");
-
-            Set<String> targetWords = Set.of("secret");
-
-            List<Object> filteredTokens =
-                    textRedactionService.createTokensWithoutTargetText(
-                            realDocument, realPage, targetWords, false, false);
-
-            textRedactionService.writeFilteredContentStream(realDocument, realPage, filteredTokens);
-            assertNotNull(realPage.getContents());
-
-            String finalText = extractTextFromModifiedPage(realPage);
-            assertFalse(finalText.contains("secret"), "Target text should be completely removed");
-            assertTrue(finalText.contains("document"), "Other text should remain");
-        }
-
-        @Test
-        @DisplayName("Should preserve text positioning operators")
-        void shouldPreserveTextPositioning() throws Exception {
-            createRealPageWithPositionedText();
-
-            Set<String> targetWords = Set.of("confidential");
-
-            List<Object> filteredTokens =
-                    textRedactionService.createTokensWithoutTargetText(
-                            realDocument, realPage, targetWords, false, false);
-
-            long filteredPositioning =
-                    filteredTokens.stream()
-                            .filter(
-                                    token ->
-                                            token instanceof Operator op
-                                                    && ("Td".equals(op.getName())
-                                                            || "TD".equals(op.getName())
-                                                            || "Tm".equals(op.getName())))
-                            .count();
-
-            assertTrue(filteredPositioning > 0, "Positioning operators should be preserved");
-        }
-
-        @Test
-        @DisplayName("Should handle complex content streams with multiple operators")
-        void shouldHandleComplexContentStreams() throws Exception {
-            realPage = new PDPage(PDRectangle.A4);
-            while (realDocument.getNumberOfPages() > 0) {
-                realDocument.removePage(0);
-            }
-            realDocument.addPage(realPage);
-            realPage.setResources(new PDResources());
-            realPage.getResources()
-                    .put(
-                            COSName.getPDFName("F1"),
-                            new PDType1Font(Standard14Fonts.FontName.HELVETICA));
-
-            try (PDPageContentStream contentStream =
-                    new PDPageContentStream(realDocument, realPage)) {
-                contentStream.setLineWidth(2);
-                contentStream.moveTo(100, 100);
-                contentStream.lineTo(200, 200);
-                contentStream.stroke();
-
-                contentStream.beginText();
-                contentStream.setFont(
-                        realPage.getResources().getFont(COSName.getPDFName("F1")), 12);
-                contentStream.newLineAtOffset(50, 750);
-                contentStream.showText("This is a complex document with ");
-                contentStream.setTextRise(5);
-                contentStream.showText("confidential");
-                contentStream.setTextRise(0);
-                contentStream.showText(" information.");
-                contentStream.endText();
-
-                contentStream.addRect(300, 300, 100, 100);
-                contentStream.fill();
-            }
-
-            Set<String> targetWords = Set.of("confidential");
-
-            List<Object> tokens =
-                    textRedactionService.createTokensWithoutTargetText(
-                            realDocument, realPage, targetWords, false, false);
-
-            assertNotNull(tokens);
-            assertFalse(tokens.isEmpty());
-
-            String reconstructedText = extractTextFromTokens(tokens);
-            assertFalse(
-                    reconstructedText.contains("confidential"), "Target text should be redacted");
-
-            boolean hasGraphicsOperators =
-                    tokens.stream()
-                            .anyMatch(
-                                    token ->
-                                            token instanceof Operator op
-                                                    && ("re".equals(op.getName())
-                                                            || "f".equals(op.getName())
-                                                            || "m".equals(op.getName())
-                                                            || "l".equals(op.getName())
-                                                            || "S".equals(op.getName())));
-
-            assertTrue(hasGraphicsOperators, "Graphics operators should be preserved");
+            boolean fallback =
+                    textRedactionService.performTextReplacement(
+                            realDocument, found, targetWords, false, false);
+            assertFalse(fallback, "JPDFium text replacement should complete without fallback");
         }
 
         @Test
@@ -1423,14 +1117,13 @@ class RedactControllerTest {
             realDocument.addPage(realPage);
 
             PDResources resources = new PDResources();
-            resources.put(
-                    COSName.getPDFName("F1"), new PDType1Font(Standard14Fonts.FontName.HELVETICA));
+            resources.put(COSName.getPDFName("F1"), helvetica(realDocument));
             realPage.setResources(resources);
 
             try (PDPageContentStream contentStream =
                     new PDPageContentStream(realDocument, realPage)) {
                 contentStream.beginText();
-                contentStream.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), 12);
+                contentStream.setFont(helvetica(realDocument), 12);
                 contentStream.newLineAtOffset(50, 750);
                 contentStream.showText("This is the first text block");
                 contentStream.endText();
@@ -1441,7 +1134,7 @@ class RedactControllerTest {
                 contentStream.stroke();
 
                 contentStream.beginText();
-                contentStream.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), 12);
+                contentStream.setFont(helvetica(realDocument), 12);
                 contentStream.newLineAtOffset(50, 650);
                 contentStream.showText("This block contains confidential information");
                 contentStream.endText();
@@ -1450,7 +1143,7 @@ class RedactControllerTest {
                 contentStream.fill();
 
                 contentStream.beginText();
-                contentStream.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), 12);
+                contentStream.setFont(helvetica(realDocument), 12);
                 contentStream.newLineAtOffset(50, 550);
                 contentStream.showText("This is the third text block");
                 contentStream.endText();
diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactExecuteServiceMoreTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactExecuteServiceMoreTest.java
index 49149e3ca7..246909efba 100644
--- a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactExecuteServiceMoreTest.java
+++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactExecuteServiceMoreTest.java
@@ -10,6 +10,7 @@ import static org.mockito.Mockito.mock;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
+import java.io.InputStream;
 import java.lang.reflect.Method;
 import java.nio.file.Files;
 import java.util.ArrayList;
@@ -22,6 +23,8 @@ import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.pdmodel.font.PDType0Font;
 import org.apache.pdfbox.pdmodel.font.PDType1Font;
 import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
 import org.apache.pdfbox.pdmodel.graphics.image.PDImageXObject;
@@ -31,6 +34,7 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockMultipartFile;
 import org.springframework.web.multipart.MultipartFile;
 
 import stirling.software.SPDF.model.PDFText;
@@ -118,18 +122,26 @@ class RedactExecuteServiceMoreTest {
 
     private RedactExecuteRequest requestFor(byte[] pdfBytes) {
         RedactExecuteRequest req = new RedactExecuteRequest();
-        req.setFileInput(
-                new org.springframework.mock.web.MockMultipartFile(
-                        "fileInput", "in.pdf", "application/pdf", pdfBytes));
+        req.setFileInput(new MockMultipartFile("fileInput", "in.pdf", "application/pdf", pdfBytes));
         return req;
     }
 
+    private PDFont helvetica(PDDocument doc) throws IOException {
+        try (InputStream is =
+                getClass().getResourceAsStream("/type3/library/fonts/dejavu/DejaVuSans.ttf")) {
+            if (is != null) {
+                return PDType0Font.load(doc, is);
+            }
+        }
+        return new PDType1Font(Standard14Fonts.FontName.HELVETICA);
+    }
+
     private byte[] singlePageTextPdf(String... lines) throws IOException {
         try (PDDocument doc = new PDDocument()) {
             PDPage page = new PDPage(PDRectangle.LETTER);
             doc.addPage(page);
             try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-                cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+                cs.setFont(helvetica(doc), FONT_SIZE);
                 for (int i = 0; i < lines.length; i++) {
                     cs.beginText();
                     cs.newLineAtOffset(LEFT_X, TOP_Y - i * LINE_H);
@@ -149,7 +161,7 @@ class RedactExecuteServiceMoreTest {
                 PDPage page = new PDPage(PDRectangle.LETTER);
                 doc.addPage(page);
                 try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-                    cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+                    cs.setFont(helvetica(doc), FONT_SIZE);
                     cs.beginText();
                     cs.newLineAtOffset(LEFT_X, TOP_Y);
                     cs.showText("page " + p + " has SECRET content here");
diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactExecuteServiceTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactExecuteServiceTest.java
index 8a8b335642..9d2f50a5e4 100644
--- a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactExecuteServiceTest.java
+++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/RedactExecuteServiceTest.java
@@ -3,6 +3,7 @@ package stirling.software.SPDF.controller.api.security;
 import static org.assertj.core.api.Assertions.assertThat;
 
 import java.io.IOException;
+import java.io.InputStream;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -11,6 +12,8 @@ import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
+import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.pdmodel.font.PDType0Font;
 import org.apache.pdfbox.pdmodel.font.PDType1Font;
 import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
 import org.junit.jupiter.api.DisplayName;
@@ -219,12 +222,22 @@ class RedactExecuteServiceTest {
      * anchor) 1: line one 2: line two 3: line three 4: STOP-HERE (end anchor) 5: line five (must
      * NOT be redacted)
      */
+    private PDFont helvetica(PDDocument doc) throws IOException {
+        try (InputStream is =
+                getClass().getResourceAsStream("/type3/library/fonts/dejavu/DejaVuSans.ttf")) {
+            if (is != null) {
+                return PDType0Font.load(doc, is);
+            }
+        }
+        return new PDType1Font(Standard14Fonts.FontName.HELVETICA);
+    }
+
     private PDDocument buildSingleColumnDoc() throws IOException {
         PDDocument doc = new PDDocument();
         PDPage page = new PDPage(PDRectangle.LETTER);
         doc.addPage(page);
         try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+            cs.setFont(helvetica(doc), FONT_SIZE);
             String[] lines = {
                 "START-HERE", "line one", "line two", "line three", "STOP-HERE", "line five"
             };
@@ -247,7 +260,7 @@ class RedactExecuteServiceTest {
         PDPage page = new PDPage(PDRectangle.LETTER);
         doc.addPage(page);
         try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+            cs.setFont(helvetica(doc), FONT_SIZE);
             // Body lines are padded to make each column genuinely wide enough that column
             // detection (which ignores narrow lines) treats both sides as real columns.
             String fill = " " + "x".repeat(26);
@@ -294,7 +307,7 @@ class RedactExecuteServiceTest {
         PDPage page = new PDPage(PDRectangle.LETTER);
         doc.addPage(page);
         try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+            cs.setFont(helvetica(doc), FONT_SIZE);
             String[] lines = {
                 "#1 Auto layout",
                 "Body about auto layout.",
@@ -331,7 +344,7 @@ class RedactExecuteServiceTest {
         PDPage page = new PDPage(PDRectangle.LETTER);
         doc.addPage(page);
         try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+            cs.setFont(helvetica(doc), FONT_SIZE);
             // Header — full width, lines 0..1.
             for (int i = 0; i < 2; i++) {
                 cs.beginText();
@@ -383,7 +396,7 @@ class RedactExecuteServiceTest {
         PDPage page = new PDPage(PDRectangle.LETTER);
         doc.addPage(page);
         try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-            cs.setFont(new PDType1Font(Standard14Fonts.FontName.HELVETICA), FONT_SIZE);
+            cs.setFont(helvetica(doc), FONT_SIZE);
 
             float dateX = PAGE_WIDTH - 144f; // right-aligned dates near the right margin
 
diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceExtraTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceExtraTest.java
index 6c94dd3a24..94e4d7cb6c 100644
--- a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceExtraTest.java
+++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceExtraTest.java
@@ -3,44 +3,24 @@ package stirling.software.SPDF.controller.api.security;
 import static org.assertj.core.api.Assertions.assertThat;
 
 import java.io.IOException;
-import java.lang.reflect.Method;
-import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
+import java.io.InputStream;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
-import org.apache.pdfbox.contentstream.operator.Operator;
-import org.apache.pdfbox.cos.COSArray;
-import org.apache.pdfbox.cos.COSBase;
-import org.apache.pdfbox.cos.COSFloat;
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.cos.COSString;
-import org.apache.pdfbox.pdfparser.PDFStreamParser;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageContentStream;
-import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.common.PDStream;
 import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.pdmodel.font.PDType0Font;
 import org.apache.pdfbox.pdmodel.font.PDType1Font;
 import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
-import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
 
 import stirling.software.SPDF.model.PDFText;
 
-/**
- * Further gap-coverage tests for {@link TextRedactionService}, complementing {@code
- * TextRedactionServiceTest} and {@code TextRedactionServiceMoreTest}. These target branches the
- * other two suites leave untouched: case-sensitive vs regex find, multi-term and multi-match within
- * one segment, the kerning ({@code adjustment != 0}) path that rewrites a {@code Tj} into a {@code
- * TJ} array, nested Form XObject traversal, pages with no resources, and the private width helpers
- * exercised directly via reflection.
- */
 @DisplayName("TextRedactionService extra coverage")
 class TextRedactionServiceExtraTest {
 
@@ -50,43 +30,22 @@ class TextRedactionServiceExtraTest {
 
     private final TextRedactionService service = new TextRedactionService();
 
-    private PDFont helvetica() {
+    private PDFont helvetica(PDDocument doc) throws IOException {
+        try (InputStream is =
+                getClass().getResourceAsStream("/type3/library/fonts/dejavu/DejaVuSans.ttf")) {
+            if (is != null) {
+                return PDType0Font.load(doc, is);
+            }
+        }
         return new PDType1Font(Standard14Fonts.FontName.HELVETICA);
     }
 
-    private List<Object> parseTokens(PDPage page) throws IOException {
-        PDFStreamParser parser = new PDFStreamParser(page);
-        List<Object> tokens = new ArrayList<>();
-        Object t;
-        while ((t = parser.parseNextToken()) != null) {
-            tokens.add(t);
-        }
-        return tokens;
-    }
-
-    private String tokensText(List<Object> tokens) {
-        StringBuilder sb = new StringBuilder();
-        for (Object token : tokens) {
-            if (token instanceof COSString cs) {
-                sb.append(cs.getString());
-            } else if (token instanceof COSArray arr) {
-                for (COSBase el : arr) {
-                    if (el instanceof COSString cs) {
-                        sb.append(cs.getString());
-                    }
-                }
-            }
-        }
-        return sb.toString();
-    }
-
-    /** Single page, one Tj line per supplied text line, Helvetica 12. */
     private PDDocument buildDoc(String... lines) throws IOException {
         PDDocument doc = new PDDocument();
         PDPage page = new PDPage(PDRectangle.LETTER);
         doc.addPage(page);
         try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-            cs.setFont(helvetica(), FONT_SIZE);
+            cs.setFont(helvetica(doc), FONT_SIZE);
             for (int i = 0; i < lines.length; i++) {
                 cs.beginText();
                 cs.newLineAtOffset(LEFT_X, TOP_Y - i * 16f);
@@ -97,25 +56,6 @@ class TextRedactionServiceExtraTest {
         return doc;
     }
 
-    /** Page whose content stream is exactly {@code rawContent}, font F1=Helvetica. */
-    private PDDocument docWithRawContent(String rawContent) throws IOException {
-        PDDocument doc = new PDDocument();
-        PDPage page = new PDPage(PDRectangle.LETTER);
-        doc.addPage(page);
-        PDResources resources = new PDResources();
-        resources.put(COSName.getPDFName("F1"), helvetica());
-        page.setResources(resources);
-
-        PDStream stream = new PDStream(doc);
-        try (var out = stream.createOutputStream()) {
-            out.write(rawContent.getBytes(StandardCharsets.ISO_8859_1));
-        }
-        page.setContents(stream);
-        return doc;
-    }
-
-    // ── findTextToRedact: matching modes ─────────────────────────────────────────────────────────
-
     @Nested
     @DisplayName("findTextToRedact matching modes")
     class FindModes {
@@ -126,7 +66,6 @@ class TextRedactionServiceExtraTest {
             try (PDDocument doc = buildDoc("Secret and secret and SECRET")) {
                 Map<Integer, List<PDFText>> result =
                         service.findTextToRedact(doc, new String[] {"secret"}, false, false);
-                // Patterns are compiled CASE_INSENSITIVE, so all three occurrences match.
                 assertThat(result.get(0)).hasSize(3);
             }
         }
@@ -148,7 +87,6 @@ class TextRedactionServiceExtraTest {
             try (PDDocument doc = buildDoc("abcde")) {
                 Map<Integer, List<PDFText>> result =
                         service.findTextToRedact(doc, new String[] {"[ae]"}, true, false);
-                // 'a' and 'e' both match -> two single-character hits.
                 assertThat(result.get(0)).hasSize(2);
             }
         }
@@ -163,436 +101,4 @@ class TextRedactionServiceExtraTest {
             }
         }
     }
-
-    // ── createTokensWithoutTargetText structural branches ────────────────────────────────────────
-
-    @Nested
-    @DisplayName("createTokensWithoutTargetText structural branches")
-    class TokenStructural {
-
-        @Test
-        @DisplayName("page with null resources still parses and redacts the matched Tj text")
-        void nullResourcesStillRedacts() throws IOException {
-            try (PDDocument doc = new PDDocument()) {
-                PDPage page = new PDPage(PDRectangle.LETTER);
-                doc.addPage(page);
-                // No resources set; the content stream references no real font.
-                String raw = "BT 72 700 Td (SECRET) Tj ET";
-                PDStream stream = new PDStream(doc);
-                try (var out = stream.createOutputStream()) {
-                    out.write(raw.getBytes(StandardCharsets.ISO_8859_1));
-                }
-                page.setContents(stream);
-
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("SECRET"), false, false);
-                assertThat(tokensText(tokens)).doesNotContain("SECRET");
-            }
-        }
-
-        @Test
-        @DisplayName("a match inside a Tj segment is redacted and surrounding text survives")
-        void multipleMatchesOneSegment() throws IOException {
-            try (PDDocument doc = docWithRawContent("BT /F1 12 Tf 72 700 Td (xAAxAAx) Tj ET")) {
-                PDPage page = doc.getPage(0);
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("AA"), false, false);
-                String redacted = tokensText(tokens);
-                // The segment was rewritten away from the original literal.
-                assertThat(redacted).isNotEqualTo("xAAxAAx");
-                // Redaction replaces matched runs with whitespace, so at least one "AA" is gone
-                // (the leading occurrence) and the surrounding x characters survive.
-                assertThat(redacted.split("AA", -1).length - 1).isLessThan(2);
-                assertThat(redacted).startsWith("x ");
-                assertThat(redacted).contains("x");
-            }
-        }
-
-        @Test
-        @DisplayName("a second Tf operator updates the active font for later segments")
-        void secondTfUpdatesFont() throws IOException {
-            PDDocument doc = new PDDocument();
-            PDPage page = new PDPage(PDRectangle.LETTER);
-            doc.addPage(page);
-            PDResources resources = new PDResources();
-            resources.put(COSName.getPDFName("F1"), helvetica());
-            resources.put(
-                    COSName.getPDFName("F2"),
-                    new PDType1Font(Standard14Fonts.FontName.TIMES_ROMAN));
-            page.setResources(resources);
-            String raw = "BT /F1 12 Tf 72 700 Td (first) Tj /F2 18 Tf 0 -20 Td (SECRET) Tj ET";
-            PDStream stream = new PDStream(doc);
-            try (var out = stream.createOutputStream()) {
-                out.write(raw.getBytes(StandardCharsets.ISO_8859_1));
-            }
-            page.setContents(stream);
-            try (doc) {
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("SECRET"), false, false);
-                assertThat(tokensText(tokens)).doesNotContain("SECRET");
-                assertThat(tokensText(tokens)).contains("first");
-            }
-        }
-    }
-
-    // ── nested Form XObject traversal ────────────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("nested Form XObject traversal")
-    class NestedXObjects {
-
-        @Test
-        @DisplayName("a match in a form nested two levels deep is reached and rewritten")
-        void nestedTwoLevelsDeep() throws IOException {
-            try (PDDocument doc = new PDDocument()) {
-                PDPage page = new PDPage(PDRectangle.LETTER);
-                doc.addPage(page);
-
-                // Inner form shows SECRET.
-                PDFormXObject inner = new PDFormXObject(doc);
-                inner.setResources(new PDResources());
-                inner.getResources().put(COSName.getPDFName("F1"), helvetica());
-                inner.setBBox(new PDRectangle(0, 0, 200, 50));
-                try (var out = inner.getStream().createOutputStream()) {
-                    out.write(
-                            "BT /F1 12 Tf 0 10 Td (SECRET) Tj ET"
-                                    .getBytes(StandardCharsets.ISO_8859_1));
-                }
-
-                // Outer form references inner via Do.
-                PDFormXObject outer = new PDFormXObject(doc);
-                PDResources outerRes = new PDResources();
-                COSName innerName = outerRes.add(inner);
-                outer.setResources(outerRes);
-                outer.setBBox(new PDRectangle(0, 0, 200, 50));
-                try (var out = outer.getStream().createOutputStream()) {
-                    out.write(
-                            ("/" + innerName.getName() + " Do")
-                                    .getBytes(StandardCharsets.ISO_8859_1));
-                }
-
-                PDResources pageRes = new PDResources();
-                COSName outerName = pageRes.add(outer);
-                page.setResources(pageRes);
-                PDStream pageStream = new PDStream(doc);
-                try (var out = pageStream.createOutputStream()) {
-                    out.write(
-                            ("/" + outerName.getName() + " Do")
-                                    .getBytes(StandardCharsets.ISO_8859_1));
-                }
-                page.setContents(pageStream);
-
-                service.createTokensWithoutTargetText(doc, page, Set.of("SECRET"), false, false);
-
-                // The deep traversal must have rewritten the inner form's content stream.
-                assertThat(inner.getCOSObject().containsKey(COSName.CONTENTS)).isTrue();
-            }
-        }
-
-        @Test
-        @DisplayName("a form XObject with no resources is skipped without error")
-        void formWithoutResourcesSkipped() throws IOException {
-            try (PDDocument doc = new PDDocument()) {
-                PDPage page = new PDPage(PDRectangle.LETTER);
-                doc.addPage(page);
-
-                PDFormXObject form = new PDFormXObject(doc);
-                form.setBBox(new PDRectangle(0, 0, 100, 50));
-                // Intentionally no resources on the form.
-                try (var out = form.getStream().createOutputStream()) {
-                    out.write("q Q".getBytes(StandardCharsets.ISO_8859_1));
-                }
-
-                PDResources pageRes = new PDResources();
-                COSName formName = pageRes.add(form);
-                page.setResources(pageRes);
-                PDStream pageStream = new PDStream(doc);
-                try (var out = pageStream.createOutputStream()) {
-                    out.write(
-                            ("/" + formName.getName() + " Do")
-                                    .getBytes(StandardCharsets.ISO_8859_1));
-                }
-                page.setContents(pageStream);
-
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("SECRET"), false, false);
-                assertThat(tokens).isNotNull();
-            }
-        }
-    }
-
-    // ── kerning / adjustment path in modifyTokenForRedaction ─────────────────────────────────────
-
-    @Nested
-    @DisplayName("modifyTokenForRedaction adjustment branches")
-    class ModifyTokenAdjustment {
-
-        @Test
-        @DisplayName("a non-zero width adjustment rewrites a Tj into a TJ array with kerning")
-        void adjustmentRewritesToTjArray() throws Exception {
-            List<Object> tokens = new ArrayList<>();
-            tokens.add(new COSString("KEEP"));
-            tokens.add(Operator.getOperator("Tj"));
-
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(
-                            0, "Tj", "KEEP", 0, 4, helvetica(), FONT_SIZE);
-
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "modifyTokenForRedaction",
-                            List.class,
-                            TextRedactionService.TextSegment.class,
-                            String.class,
-                            float.class,
-                            List.class);
-            m.setAccessible(true);
-            // A clearly non-zero adjustment forces the COSArray + kerning branch.
-            m.invoke(service, tokens, segment, "AB", 5.0f, List.of());
-
-            assertThat(tokens.get(0)).isInstanceOf(COSArray.class);
-            COSArray arr = (COSArray) tokens.get(0);
-            boolean hasKern = false;
-            for (COSBase el : arr) {
-                if (el instanceof COSFloat) {
-                    hasKern = true;
-                }
-            }
-            assertThat(hasKern).as("kerning float should be appended to the TJ array").isTrue();
-            // The trailing Tj operator should have been switched to TJ.
-            assertThat(tokens.get(1)).isInstanceOf(Operator.class);
-            assertThat(((Operator) tokens.get(1)).getName()).isEqualTo("TJ");
-        }
-
-        @Test
-        @DisplayName("empty replacement text with ~zero adjustment sets the shared empty COSString")
-        void emptyReplacementZeroAdjustment() throws Exception {
-            List<Object> tokens = new ArrayList<>();
-            tokens.add(new COSString("SECRET"));
-            tokens.add(Operator.getOperator("Tj"));
-
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(
-                            0, "Tj", "SECRET", 0, 6, helvetica(), FONT_SIZE);
-
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "modifyTokenForRedaction",
-                            List.class,
-                            TextRedactionService.TextSegment.class,
-                            String.class,
-                            float.class,
-                            List.class);
-            m.setAccessible(true);
-            m.invoke(service, tokens, segment, "", 0f, List.of());
-
-            assertThat(tokens.get(0)).isInstanceOf(COSString.class);
-            assertThat(((COSString) tokens.get(0)).getString()).isEmpty();
-        }
-
-        @Test
-        @DisplayName("the ' operator with a non-zero adjustment is also rewritten to a TJ array")
-        void apostropheAdjustmentRewrites() throws Exception {
-            List<Object> tokens = new ArrayList<>();
-            tokens.add(new COSString("WORD"));
-            tokens.add(Operator.getOperator("'"));
-
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(
-                            0, "'", "WORD", 0, 4, helvetica(), FONT_SIZE);
-
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "modifyTokenForRedaction",
-                            List.class,
-                            TextRedactionService.TextSegment.class,
-                            String.class,
-                            float.class,
-                            List.class);
-            m.setAccessible(true);
-            m.invoke(service, tokens, segment, "X", 4.0f, List.of());
-
-            assertThat(tokens.get(0)).isInstanceOf(COSArray.class);
-            assertThat(((Operator) tokens.get(1)).getName()).isEqualTo("TJ");
-        }
-    }
-
-    // ── createRedactedTJArray edge branches ──────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("createRedactedTJArray edge branches")
-    class RedactedTjArray {
-
-        @Test
-        @DisplayName("non-COSString elements (kerning numbers) are preserved in order")
-        void preservesNumberElements() throws Exception {
-            COSArray original = new COSArray();
-            original.add(new COSString("AA"));
-            original.add(new COSFloat(-25f));
-            original.add(new COSString("BB"));
-
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(
-                            0, "TJ", "AABB", 0, 4, helvetica(), FONT_SIZE);
-            List<TextRedactionService.MatchRange> matches =
-                    List.of(new TextRedactionService.MatchRange(0, 2)); // "AA"
-
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "createRedactedTJArray",
-                            COSArray.class,
-                            TextRedactionService.TextSegment.class,
-                            List.class);
-            m.setAccessible(true);
-            COSArray result = (COSArray) m.invoke(service, original, segment, matches);
-
-            boolean sawFloat = false;
-            for (COSBase el : result) {
-                if (el instanceof COSFloat) {
-                    sawFloat = true;
-                }
-            }
-            assertThat(sawFloat).as("original kerning number must be retained").isTrue();
-        }
-
-        @Test
-        @DisplayName("a TJ array with no overlapping match is returned essentially unchanged")
-        void noMatchLeavesTextIntact() throws Exception {
-            COSArray original = new COSArray();
-            original.add(new COSString("hello"));
-            original.add(new COSString("world"));
-
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(
-                            0, "TJ", "helloworld", 0, 10, helvetica(), FONT_SIZE);
-            List<TextRedactionService.MatchRange> matches =
-                    List.of(new TextRedactionService.MatchRange(50, 60)); // out of range
-
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "createRedactedTJArray",
-                            COSArray.class,
-                            TextRedactionService.TextSegment.class,
-                            List.class);
-            m.setAccessible(true);
-            COSArray result = (COSArray) m.invoke(service, original, segment, matches);
-
-            StringBuilder sb = new StringBuilder();
-            for (COSBase el : result) {
-                if (el instanceof COSString cs) sb.append(cs.getString());
-            }
-            assertThat(sb.toString()).isEqualTo("helloworld");
-        }
-    }
-
-    // ── private width helpers via reflection ─────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("private width helpers via reflection")
-    class WidthHelpers {
-
-        private float invokeFloat(String name, Object... args) throws Exception {
-            Class<?>[] types = new Class<?>[] {PDFont.class, String.class};
-            Method m = TextRedactionService.class.getDeclaredMethod(name, types);
-            m.setAccessible(true);
-            return (float) m.invoke(service, args);
-        }
-
-        @Test
-        @DisplayName("calculateConservativeWidth scales linearly at 500 units per character")
-        void conservativeWidthLinear() throws Exception {
-            float w = invokeFloat("calculateConservativeWidth", helvetica(), "abcd");
-            assertThat(w).isEqualTo(4 * 500f);
-        }
-
-        @Test
-        @DisplayName("calculateCharacterBasedWidth returns a positive width for normal text")
-        void characterBasedWidthPositive() throws Exception {
-            float w = invokeFloat("calculateCharacterBasedWidth", helvetica(), "Hello");
-            assertThat(w).isGreaterThan(0f);
-        }
-
-        @Test
-        @DisplayName("calculateFallbackWidth returns a positive width using font metrics")
-        void fallbackWidthPositive() throws Exception {
-            float w = invokeFloat("calculateFallbackWidth", helvetica(), "Hello");
-            assertThat(w).isGreaterThan(0f);
-        }
-
-        @Test
-        @DisplayName("safeGetStringWidth returns 0 for null/empty inputs")
-        void safeWidthZeroForEmpty() throws Exception {
-            assertThat(invokeFloat("safeGetStringWidth", helvetica(), "")).isZero();
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "safeGetStringWidth", PDFont.class, String.class);
-            m.setAccessible(true);
-            assertThat((float) m.invoke(service, helvetica(), null)).isZero();
-            assertThat((float) m.invoke(service, (PDFont) null, "x")).isZero();
-        }
-
-        @Test
-        @DisplayName("safeGetStringWidth returns a positive width for a reliable font")
-        void safeWidthPositive() throws Exception {
-            float w = invokeFloat("safeGetStringWidth", helvetica(), "Word");
-            assertThat(w).isGreaterThan(0f);
-        }
-    }
-
-    // ── createAlternativePlaceholder via reflection ──────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("createAlternativePlaceholder via reflection")
-    class AlternativePlaceholder {
-
-        @Test
-        @DisplayName("Helvetica supports space, so output is a bounded run of spaces")
-        void boundedSpaces() throws Exception {
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "createAlternativePlaceholder",
-                            String.class,
-                            float.class,
-                            PDFont.class,
-                            float.class);
-            m.setAccessible(true);
-            String result = (String) m.invoke(service, "hidden", 20f, helvetica(), FONT_SIZE);
-            assertThat(result.chars().allMatch(c -> c == ' ')).isTrue();
-            assertThat(result.length()).isLessThanOrEqualTo("hidden".length() * 2);
-        }
-    }
-
-    // ── extractTextSegments via reflection ───────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("extractTextSegments via reflection")
-    class ExtractSegments {
-
-        @SuppressWarnings("unchecked")
-        @Test
-        @DisplayName("a Tf operator sets font and size on the segments that follow it")
-        void tfSetsFontAndSize() throws Exception {
-            try (PDDocument doc = docWithRawContent("BT /F1 14 Tf 72 700 Td (hello) Tj ET")) {
-                PDPage page = doc.getPage(0);
-                List<Object> tokens = parseTokens(page);
-
-                Method m =
-                        TextRedactionService.class.getDeclaredMethod(
-                                "extractTextSegments", PDPage.class, List.class);
-                m.setAccessible(true);
-                List<TextRedactionService.TextSegment> segments =
-                        (List<TextRedactionService.TextSegment>) m.invoke(service, page, tokens);
-
-                assertThat(segments).isNotEmpty();
-                TextRedactionService.TextSegment first = segments.get(0);
-                assertThat(first.getText()).isEqualTo("hello");
-                assertThat(first.getFontSize()).isEqualTo(14f);
-                assertThat(first.getFont()).isNotNull();
-            }
-        }
-    }
 }
diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceMoreTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceMoreTest.java
index ba0377a9e8..e0408bae55 100644
--- a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceMoreTest.java
+++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceMoreTest.java
@@ -3,40 +3,24 @@ package stirling.software.SPDF.controller.api.security;
 import static org.assertj.core.api.Assertions.assertThat;
 
 import java.io.IOException;
-import java.lang.reflect.Method;
-import java.util.ArrayList;
+import java.io.InputStream;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
-import org.apache.pdfbox.cos.COSArray;
-import org.apache.pdfbox.cos.COSBase;
-import org.apache.pdfbox.cos.COSFloat;
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.cos.COSString;
-import org.apache.pdfbox.pdfparser.PDFStreamParser;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageContentStream;
-import org.apache.pdfbox.pdmodel.PDResources;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
-import org.apache.pdfbox.pdmodel.common.PDStream;
 import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.pdmodel.font.PDType0Font;
 import org.apache.pdfbox.pdmodel.font.PDType1Font;
 import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
-import org.apache.pdfbox.pdmodel.graphics.form.PDFormXObject;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Nested;
 import org.junit.jupiter.api.Test;
 
 import stirling.software.SPDF.model.PDFText;
 
-/**
- * Gap-coverage tests for {@link TextRedactionService} targeting branches the existing {@code
- * TextRedactionServiceTest} does not reach: TJ-array redaction with kerning adjustment, the {@code
- * '} and {@code "} text-showing operators, Form XObject content rewriting, multi-page / multi-match
- * find+replace, and the private TJ/segment helpers exercised directly via reflection.
- */
 @DisplayName("TextRedactionService additional coverage")
 class TextRedactionServiceMoreTest {
 
@@ -50,201 +34,16 @@ class TextRedactionServiceMoreTest {
         return new PDType1Font(Standard14Fonts.FontName.HELVETICA);
     }
 
-    private List<Object> parseTokens(PDPage page) throws IOException {
-        PDFStreamParser parser = new PDFStreamParser(page);
-        List<Object> tokens = new ArrayList<>();
-        Object t;
-        while ((t = parser.parseNextToken()) != null) {
-            tokens.add(t);
-        }
-        return tokens;
-    }
-
-    private String tokensText(List<Object> tokens) {
-        StringBuilder sb = new StringBuilder();
-        for (Object token : tokens) {
-            if (token instanceof COSString cs) {
-                sb.append(cs.getString());
-            } else if (token instanceof COSArray arr) {
-                for (COSBase el : arr) {
-                    if (el instanceof COSString cs) {
-                        sb.append(cs.getString());
-                    }
-                }
+    private PDFont helvetica(PDDocument doc) throws IOException {
+        try (InputStream is =
+                getClass().getResourceAsStream("/type3/library/fonts/dejavu/DejaVuSans.ttf")) {
+            if (is != null) {
+                return PDType0Font.load(doc, is);
             }
         }
-        return sb.toString();
+        return helvetica();
     }
 
-    /**
-     * Builds a single page whose content stream is exactly {@code rawContent}, font F1=Helvetica.
-     */
-    private PDDocument docWithRawContent(String rawContent) throws IOException {
-        PDDocument doc = new PDDocument();
-        PDPage page = new PDPage(PDRectangle.LETTER);
-        doc.addPage(page);
-        PDResources resources = new PDResources();
-        resources.put(COSName.getPDFName("F1"), helvetica());
-        page.setResources(resources);
-
-        PDStream stream = new PDStream(doc);
-        try (var out = stream.createOutputStream()) {
-            out.write(rawContent.getBytes(java.nio.charset.StandardCharsets.ISO_8859_1));
-        }
-        page.setContents(stream);
-        return doc;
-    }
-
-    // ── ' and " operators ────────────────────────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("apostrophe and quote text-showing operators")
-    class MoveAndShowOperators {
-
-        @Test
-        @DisplayName("the ' (move-to-next-line-and-show) operator gets its text redacted")
-        void apostropheOperatorRedacted() throws IOException {
-            // ' shows a string on the next line. Content: BT /F1 12 Tf 72 700 Td (PUBLIC) Tj
-            // (SECRET) ' ET
-            String raw = "BT /F1 12 Tf 72 700 Td (PUBLIC) Tj (SECRET) ' ET";
-            try (PDDocument doc = docWithRawContent(raw)) {
-                PDPage page = doc.getPage(0);
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("SECRET"), false, false);
-                String text = tokensText(tokens);
-                assertThat(text).doesNotContain("SECRET");
-                assertThat(text).contains("PUBLIC");
-            }
-        }
-
-        @Test
-        @DisplayName("the \" operator is collected as text-showing but its text is not extracted")
-        void quoteOperatorNotExtracted() throws IOException {
-            // " is in TEXT_SHOWING_OPERATORS, but extractTextFromToken's switch only handles
-            // Tj/'/TJ, so a "-shown string yields no segment and survives. This pins that
-            // behavior: the parse path runs without error and the token list is intact.
-            String raw = "BT /F1 12 Tf 72 700 Td 1 2 (SECRET) \" ET";
-            try (PDDocument doc = docWithRawContent(raw)) {
-                PDPage page = doc.getPage(0);
-                List<Object> before = parseTokens(page);
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("SECRET"), false, false);
-                assertThat(tokens).hasSameSizeAs(before);
-                assertThat(tokensText(tokens)).contains("SECRET");
-            }
-        }
-    }
-
-    // ── TJ arrays with kerning ───────────────────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("TJ positioning arrays")
-    class TjArrays {
-
-        @Test
-        @DisplayName("partial match inside a TJ array redacts only the matched run")
-        void tjArrayPartialRedaction() throws IOException {
-            try (PDDocument doc = new PDDocument()) {
-                PDPage page = new PDPage(PDRectangle.LETTER);
-                doc.addPage(page);
-                try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-                    cs.setFont(helvetica(), FONT_SIZE);
-                    cs.beginText();
-                    cs.newLineAtOffset(LEFT_X, TOP_Y);
-                    // showTextWithPositioning emits a single TJ array.
-                    cs.showTextWithPositioning(
-                            new Object[] {"keep ", -50f, "SECRET", 20f, " tail"});
-                    cs.endText();
-                }
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("SECRET"), false, false);
-
-                boolean sawTj = tokens.stream().anyMatch(t -> t instanceof COSArray);
-                assertThat(sawTj).as("expected a TJ array token").isTrue();
-                assertThat(tokensText(tokens)).doesNotContain("SECRET");
-                assertThat(tokensText(tokens)).contains("keep");
-            }
-        }
-
-        @Test
-        @DisplayName("TJ array with no matching term is left unchanged")
-        void tjArrayNoMatch() throws IOException {
-            try (PDDocument doc = new PDDocument()) {
-                PDPage page = new PDPage(PDRectangle.LETTER);
-                doc.addPage(page);
-                try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-                    cs.setFont(helvetica(), FONT_SIZE);
-                    cs.beginText();
-                    cs.newLineAtOffset(LEFT_X, TOP_Y);
-                    cs.showTextWithPositioning(new Object[] {"alpha ", -30f, "beta"});
-                    cs.endText();
-                }
-                List<Object> before = parseTokens(page);
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("ZZZ"), false, false);
-                assertThat(tokens).hasSameSizeAs(before);
-                assertThat(tokensText(tokens)).contains("alpha");
-            }
-        }
-    }
-
-    // ── Form XObject traversal ───────────────────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("Form XObject content")
-    class FormXObjects {
-
-        @Test
-        @DisplayName("a referenced Form XObject containing a match is traversed and rewritten")
-        void traversesFormXObject() throws IOException {
-            try (PDDocument doc = new PDDocument()) {
-                PDPage page = new PDPage(PDRectangle.LETTER);
-                doc.addPage(page);
-
-                // Build a form XObject whose own content stream shows "SECRET".
-                PDFormXObject form = new PDFormXObject(doc);
-                form.setResources(new PDResources());
-                form.getResources().put(COSName.getPDFName("F1"), helvetica());
-                form.setBBox(new PDRectangle(0, 0, 200, 50));
-                String formContent = "BT /F1 12 Tf 0 10 Td (SECRET) Tj ET";
-                try (var out = form.getStream().createOutputStream()) {
-                    out.write(formContent.getBytes(java.nio.charset.StandardCharsets.ISO_8859_1));
-                }
-
-                PDResources pageResources = new PDResources();
-                COSName formName = pageResources.add(form);
-                page.setResources(pageResources);
-
-                String pageContent = "q 1 0 0 1 100 600 cm /" + formName.getName() + " Do Q";
-                PDStream pageStream = new PDStream(doc);
-                try (var out = pageStream.createOutputStream()) {
-                    out.write(pageContent.getBytes(java.nio.charset.StandardCharsets.ISO_8859_1));
-                }
-                page.setContents(pageStream);
-
-                // Processing the page walks into the XObject graph; when a match is found inside
-                // the
-                // form, writeRedactedContentToXObject runs and sets a /Contents item on the form's
-                // COS dictionary. Asserting that item appears proves the XObject redaction path
-                // executed end-to-end without throwing.
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("SECRET"), false, false);
-
-                assertThat(tokens).isNotNull();
-                assertThat(form.getCOSObject().containsKey(COSName.CONTENTS))
-                        .as("form XObject redaction path should have written a new content item")
-                        .isTrue();
-            }
-        }
-    }
-
-    // ── multi-page / multi-match public entry points ─────────────────────────────────────────────
-
     @Nested
     @DisplayName("findTextToRedact and performTextReplacement across pages")
     class MultiPage {
@@ -256,7 +55,7 @@ class TextRedactionServiceMoreTest {
                 PDPage page = new PDPage(PDRectangle.LETTER);
                 doc.addPage(page);
                 try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-                    cs.setFont(helvetica(), FONT_SIZE);
+                    cs.setFont(helvetica(doc), FONT_SIZE);
                     cs.beginText();
                     cs.newLineAtOffset(LEFT_X, TOP_Y);
                     cs.showText(line);
@@ -326,225 +125,32 @@ class TextRedactionServiceMoreTest {
         }
     }
 
-    // ── private TJ / segment helpers via reflection ──────────────────────────────────────────────
-
     @Nested
-    @DisplayName("private helpers via reflection")
-    class PrivateHelpers {
-
-        @Test
-        @DisplayName("createRedactedTJArray replaces the matched substring inside the array")
-        void createRedactedTjArray() throws Exception {
-            COSArray original = new COSArray();
-            original.add(new COSString("SECRET"));
-            original.add(new COSFloat(-40f));
-            original.add(new COSString(" tail"));
-
-            // Segment text is the concatenation "SECRET tail"; startPos 0.
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(
-                            0, "TJ", "SECRET tail", 0, 11, helvetica(), FONT_SIZE);
-            List<TextRedactionService.MatchRange> matches =
-                    List.of(new TextRedactionService.MatchRange(0, 6)); // "SECRET"
-
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "createRedactedTJArray",
-                            COSArray.class,
-                            TextRedactionService.TextSegment.class,
-                            List.class);
-            m.setAccessible(true);
-            COSArray result = (COSArray) m.invoke(service, original, segment, matches);
-
-            StringBuilder sb = new StringBuilder();
-            for (COSBase el : result) {
-                if (el instanceof COSString cs) sb.append(cs.getString());
-            }
-            assertThat(sb.toString()).doesNotContain("SECRET");
-            assertThat(sb.toString()).contains("tail");
-        }
-
-        @Test
-        @DisplayName("applyRedactionsToSegmentText swaps the matched span for a placeholder")
-        void applyRedactionsToSegmentText() throws Exception {
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(
-                            0, "Tj", "keepSECRETkeep", 0, 14, helvetica(), FONT_SIZE);
-            List<TextRedactionService.MatchRange> matches =
-                    List.of(new TextRedactionService.MatchRange(4, 10)); // SECRET
-
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "applyRedactionsToSegmentText",
-                            TextRedactionService.TextSegment.class,
-                            List.class);
-            m.setAccessible(true);
-            String out = (String) m.invoke(service, segment, matches);
-            assertThat(out).doesNotContain("SECRET");
-            assertThat(out).startsWith("keep");
-            assertThat(out).endsWith("keep");
-        }
-
-        @Test
-        @DisplayName("calculateWidthAdjustment returns 0 for a null-font segment")
-        void widthAdjustmentNullFont() throws Exception {
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(0, "Tj", "abc", 0, 3, null, FONT_SIZE);
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "calculateWidthAdjustment",
-                            TextRedactionService.TextSegment.class,
-                            List.class);
-            m.setAccessible(true);
-            float adj =
-                    (float)
-                            m.invoke(
-                                    service,
-                                    segment,
-                                    List.of(new TextRedactionService.MatchRange(0, 3)));
-            assertThat(adj).isZero();
-        }
-
-        @Test
-        @DisplayName("calculateWidthAdjustment skips subset fonts (returns 0)")
-        void widthAdjustmentSubsetFontSkipped() throws Exception {
-            // A subset font name (6 uppercase letters + '+') trips the subset short-circuit.
-            PDFont subsetNamed = new PDType1Font(Standard14Fonts.FontName.HELVETICA);
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(
-                            0, "Tj", "ABCDEF", 0, 6, subsetNamed, FONT_SIZE);
-
-            // The real Helvetica name is not a subset, so this segment goes through the normal
-            // calculation; assert the call is at least exception-free and finite.
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "calculateWidthAdjustment",
-                            TextRedactionService.TextSegment.class,
-                            List.class);
-            m.setAccessible(true);
-            float adj =
-                    (float)
-                            m.invoke(
-                                    service,
-                                    segment,
-                                    List.of(new TextRedactionService.MatchRange(0, 6)));
-            assertThat(Float.isFinite(adj)).isTrue();
-        }
-
-        @Test
-        @DisplayName("modifyTokenForRedaction with an out-of-range token index is a no-op")
-        void modifyTokenOutOfRange() throws Exception {
-            List<Object> tokens = new ArrayList<>();
-            tokens.add(new COSString("hello"));
-            TextRedactionService.TextSegment segment =
-                    new TextRedactionService.TextSegment(
-                            99, "Tj", "hello", 0, 5, helvetica(), FONT_SIZE);
-
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "modifyTokenForRedaction",
-                            List.class,
-                            TextRedactionService.TextSegment.class,
-                            String.class,
-                            float.class,
-                            List.class);
-            m.setAccessible(true);
-            m.invoke(service, tokens, segment, "", 0f, List.of());
-
-            // Token list is untouched because index 99 is out of bounds.
-            assertThat(tokens).hasSize(1);
-            assertThat(((COSString) tokens.get(0)).getString()).isEqualTo("hello");
-        }
-
-        @Test
-        @DisplayName("buildCompleteText concatenates the text of all segments in order")
-        void buildCompleteText() throws Exception {
-            List<TextRedactionService.TextSegment> segments =
-                    List.of(
-                            new TextRedactionService.TextSegment(
-                                    0, "Tj", "foo", 0, 3, helvetica(), FONT_SIZE),
-                            new TextRedactionService.TextSegment(
-                                    1, "Tj", "bar", 3, 6, helvetica(), FONT_SIZE));
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod("buildCompleteText", List.class);
-            m.setAccessible(true);
-            assertThat(m.invoke(service, segments)).isEqualTo("foobar");
-        }
-
-        @Test
-        @DisplayName("extractTextFromToken returns text for the \" operator")
-        void extractTextFromQuoteOperator() throws Exception {
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "extractTextFromToken", Object.class, String.class);
-            m.setAccessible(true);
-            // The " operator is not in the switch (Tj/'/TJ) -> default branch yields empty string.
-            assertThat(m.invoke(service, new COSString("x"), "\"")).isEqualTo("");
-        }
-    }
-
-    // ── createPlaceholderWithWidth additional branches ───────────────────────────────────────────
-
-    @Nested
-    @DisplayName("createPlaceholderWithWidth reliable-font path")
-    class PlaceholderWidthBranches {
-
-        @Test
-        @DisplayName("reliable font with positive width yields a bounded run of spaces")
-        void reliableFontBoundedSpaces() {
-            PDFont font = helvetica();
-            String original = "Secret";
-            float targetWidth;
-            try {
-                targetWidth = font.getStringWidth(original) / 1000f * FONT_SIZE;
-            } catch (IOException e) {
-                targetWidth = 30f;
-            }
-            String placeholder =
-                    service.createPlaceholderWithWidth(original, targetWidth, font, FONT_SIZE);
-            assertThat(placeholder).isNotEmpty();
-            assertThat(placeholder.chars().allMatch(c -> c == ' ')).isTrue();
-            // spaceCount is capped at originalLength*2.
-            assertThat(placeholder.length()).isLessThanOrEqualTo(original.length() * 2);
-        }
-
-        @Test
-        @DisplayName("zero target width falls back to alternative placeholder logic")
-        void zeroTargetWidth() {
-            PDFont font = helvetica();
-            String placeholder = service.createPlaceholderWithWidth("word", 0f, font, FONT_SIZE);
-            // With a reliable, non-subset font and zero width, output is still all whitespace.
-            assertThat(placeholder.chars().allMatch(c -> c == ' ')).isTrue();
-        }
-    }
-
-    // ── inner data classes ───────────────────────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("ModificationTask / GraphicsState data classes")
+    @DisplayName("TextSegment / MatchRange data classes")
     class DataClasses {
 
         @Test
-        @DisplayName("GraphicsState defaults are null font and zero size, mutators round-trip")
-        void graphicsStateRoundTrip() throws Exception {
-            Class<?> gsClass =
-                    Class.forName(
-                            "stirling.software.SPDF.controller.api.security.TextRedactionService$GraphicsState");
-            var ctor = gsClass.getDeclaredConstructor();
-            ctor.setAccessible(true);
-            Object gs = ctor.newInstance();
+        @DisplayName("TextSegment exposes its constructor values via accessors")
+        void textSegmentAccessors() {
+            PDFont font = helvetica();
+            TextRedactionService.TextSegment segment =
+                    new TextRedactionService.TextSegment(3, "Tj", "hello", 10, 15, font, 12f);
 
-            Method getFont = gsClass.getDeclaredMethod("getFont");
-            Method getSize = gsClass.getDeclaredMethod("getFontSize");
-            getFont.setAccessible(true);
-            getSize.setAccessible(true);
-            assertThat(getFont.invoke(gs)).isNull();
-            assertThat((float) getSize.invoke(gs)).isZero();
+            assertThat(segment.getTokenIndex()).isEqualTo(3);
+            assertThat(segment.getOperatorName()).isEqualTo("Tj");
+            assertThat(segment.getText()).isEqualTo("hello");
+            assertThat(segment.getStartPos()).isEqualTo(10);
+            assertThat(segment.getEndPos()).isEqualTo(15);
+            assertThat(segment.getFont()).isSameAs(font);
+            assertThat(segment.getFontSize()).isEqualTo(12f);
+        }
 
-            Method setSize = gsClass.getDeclaredMethod("setFontSize", float.class);
-            setSize.setAccessible(true);
-            setSize.invoke(gs, 14f);
-            assertThat((float) getSize.invoke(gs)).isEqualTo(14f);
+        @Test
+        @DisplayName("MatchRange exposes start and end positions")
+        void matchRangeAccessors() {
+            TextRedactionService.MatchRange range = new TextRedactionService.MatchRange(4, 9);
+            assertThat(range.getStartPos()).isEqualTo(4);
+            assertThat(range.getEndPos()).isEqualTo(9);
         }
     }
 }
diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceTest.java
index d487848e09..a47f2c15ab 100644
--- a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceTest.java
+++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/TextRedactionServiceTest.java
@@ -2,30 +2,21 @@ package stirling.software.SPDF.controller.api.security;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotNull;
-import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertSame;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.IOException;
-import java.lang.reflect.Method;
-import java.util.ArrayList;
-import java.util.Collections;
+import java.io.InputStream;
 import java.util.HashMap;
-import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 
-import org.apache.pdfbox.contentstream.operator.Operator;
-import org.apache.pdfbox.cos.COSArray;
-import org.apache.pdfbox.cos.COSString;
-import org.apache.pdfbox.pdfparser.PDFStreamParser;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageContentStream;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
 import org.apache.pdfbox.pdmodel.font.PDFont;
+import org.apache.pdfbox.pdmodel.font.PDType0Font;
 import org.apache.pdfbox.pdmodel.font.PDType1Font;
 import org.apache.pdfbox.pdmodel.font.Standard14Fonts;
 import org.junit.jupiter.api.DisplayName;
@@ -54,13 +45,23 @@ class TextRedactionServiceTest {
         return new PDType1Font(Standard14Fonts.FontName.HELVETICA);
     }
 
+    private PDFont helvetica(PDDocument doc) throws IOException {
+        try (InputStream is =
+                getClass().getResourceAsStream("/type3/library/fonts/dejavu/DejaVuSans.ttf")) {
+            if (is != null) {
+                return PDType0Font.load(doc, is);
+            }
+        }
+        return helvetica();
+    }
+
     /** Single page, single Tj line per supplied text line, Helvetica 12. */
     private PDDocument buildDoc(String... lines) throws IOException {
         PDDocument doc = new PDDocument();
         PDPage page = new PDPage(PDRectangle.LETTER);
         doc.addPage(page);
         try (PDPageContentStream cs = new PDPageContentStream(doc, page)) {
-            cs.setFont(helvetica(), FONT_SIZE);
+            cs.setFont(helvetica(doc), FONT_SIZE);
             for (int i = 0; i < lines.length; i++) {
                 cs.beginText();
                 cs.newLineAtOffset(LEFT_X, TOP_Y - i * 16f);
@@ -77,32 +78,6 @@ class TextRedactionServiceTest {
         return doc;
     }
 
-    // ── isTextShowingOperator ────────────────────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("isTextShowingOperator")
-    class IsTextShowingOperator {
-
-        @Test
-        @DisplayName("recognises the four text-showing operators")
-        void recognisesTextShowingOperators() {
-            assertTrue(service.isTextShowingOperator("Tj"));
-            assertTrue(service.isTextShowingOperator("TJ"));
-            assertTrue(service.isTextShowingOperator("'"));
-            assertTrue(service.isTextShowingOperator("\""));
-        }
-
-        @Test
-        @DisplayName("rejects non text-showing operators and junk")
-        void rejectsOthers() {
-            assertFalse(service.isTextShowingOperator("BT"));
-            assertFalse(service.isTextShowingOperator("ET"));
-            assertFalse(service.isTextShowingOperator("Tf"));
-            assertFalse(service.isTextShowingOperator(""));
-            assertFalse(service.isTextShowingOperator("tj"));
-        }
-    }
-
     // ── findTextToRedact ─────────────────────────────────────────────────────────────────────────
 
     @Nested
@@ -253,192 +228,6 @@ class TextRedactionServiceTest {
         }
     }
 
-    // ── detectCustomEncodingFonts ────────────────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("detectCustomEncodingFonts")
-    class DetectCustomEncodingFonts {
-
-        @Test
-        @DisplayName("standard Helvetica document is not flagged as custom-encoded")
-        void standardFontNotFlagged() throws IOException {
-            try (PDDocument doc = buildDoc("plain helvetica text")) {
-                assertFalse(service.detectCustomEncodingFonts(doc));
-            }
-        }
-
-        @Test
-        @DisplayName("document with no content / no fonts is not flagged")
-        void emptyDocumentNotFlagged() throws IOException {
-            try (PDDocument doc = buildEmptyDoc()) {
-                assertFalse(service.detectCustomEncodingFonts(doc));
-            }
-        }
-    }
-
-    // ── createPlaceholderWithFont ────────────────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("createPlaceholderWithFont")
-    class CreatePlaceholderWithFont {
-
-        @Test
-        @DisplayName("returns the input unchanged for null")
-        void nullReturnsNull() {
-            assertNull(service.createPlaceholderWithFont(null, helvetica()));
-        }
-
-        @Test
-        @DisplayName("returns the input unchanged for empty string")
-        void emptyReturnsEmpty() {
-            assertEquals("", service.createPlaceholderWithFont("", helvetica()));
-        }
-
-        @Test
-        @DisplayName("non-subset font yields spaces matching the original length")
-        void nonSubsetFontYieldsMatchingSpaces() {
-            String placeholder = service.createPlaceholderWithFont("hidden", helvetica());
-            assertEquals(" ".repeat("hidden".length()), placeholder);
-        }
-
-        @Test
-        @DisplayName("null font is treated as non-subset and yields spaces")
-        void nullFontYieldsSpaces() {
-            String placeholder = service.createPlaceholderWithFont("abc", null);
-            assertEquals("   ", placeholder);
-        }
-    }
-
-    // ── createPlaceholderWithWidth ───────────────────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("createPlaceholderWithWidth")
-    class CreatePlaceholderWithWidth {
-
-        @Test
-        @DisplayName("returns the input unchanged for null")
-        void nullReturnsNull() {
-            assertNull(service.createPlaceholderWithWidth(null, 10f, helvetica(), FONT_SIZE));
-        }
-
-        @Test
-        @DisplayName("returns the input unchanged for empty string")
-        void emptyReturnsEmpty() {
-            assertEquals("", service.createPlaceholderWithWidth("", 10f, helvetica(), FONT_SIZE));
-        }
-
-        @Test
-        @DisplayName("null font falls back to one space per original character")
-        void nullFontFallsBackToSpaces() {
-            String placeholder = service.createPlaceholderWithWidth("word", 50f, null, FONT_SIZE);
-            assertEquals(" ".repeat("word".length()), placeholder);
-        }
-
-        @Test
-        @DisplayName("non-positive font size falls back to one space per original character")
-        void nonPositiveFontSizeFallsBackToSpaces() {
-            String placeholder = service.createPlaceholderWithWidth("word", 50f, helvetica(), 0f);
-            assertEquals(" ".repeat("word".length()), placeholder);
-        }
-
-        @Test
-        @DisplayName("standard font produces a non-null all-whitespace placeholder")
-        void standardFontProducesWhitespacePlaceholder() {
-            PDFont font = helvetica();
-            float fontSize = FONT_SIZE;
-            String original = "Secret";
-            // Compute a realistic target width the way the service does (text-space / 1000 * size).
-            float targetWidth;
-            try {
-                targetWidth = font.getStringWidth(original) / 1000f * fontSize;
-            } catch (IOException e) {
-                targetWidth = 30f;
-            }
-
-            String placeholder =
-                    service.createPlaceholderWithWidth(original, targetWidth, font, fontSize);
-
-            assertNotNull(placeholder);
-            assertFalse(placeholder.isEmpty(), "Helvetica supports spaces, so non-empty expected");
-            assertTrue(
-                    placeholder.chars().allMatch(c -> c == ' '),
-                    "placeholder should be composed only of spaces");
-        }
-    }
-
-    // ── createTokensWithoutTargetText / writeFilteredContentStream
-    // ────────────────────────────────
-
-    @Nested
-    @DisplayName("createTokensWithoutTargetText")
-    class CreateTokensWithoutTargetText {
-
-        @Test
-        @DisplayName(
-                "returns a non-empty token list and preserves token count when nothing matches")
-        void noMatchPreservesTokens() throws IOException {
-            try (PDDocument doc = buildDoc("nothing to hide")) {
-                PDPage page = doc.getPage(0);
-                List<Object> originalTokens = parseTokens(page);
-
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("ABSENT"), false, false);
-
-                assertNotNull(tokens);
-                assertEquals(
-                        originalTokens.size(),
-                        tokens.size(),
-                        "token count should be unchanged when nothing matched");
-            }
-        }
-
-        @Test
-        @DisplayName("filtered tokens can be written back and the page re-parses cleanly")
-        void filteredTokensRoundTrip() throws IOException {
-            try (PDDocument doc = buildDoc("redact SECRET token roundtrip")) {
-                PDPage page = doc.getPage(0);
-
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Set.of("SECRET"), false, false);
-                assertNotNull(tokens);
-
-                service.writeFilteredContentStream(doc, page, tokens);
-
-                // The page must still hold valid content (at least one operator token).
-                List<Object> reparsed = parseTokens(page);
-                boolean hasOperator = reparsed.stream().anyMatch(t -> t instanceof Operator);
-                assertTrue(hasOperator, "rewritten content stream must contain operators");
-            }
-        }
-
-        @Test
-        @DisplayName("empty target-word set leaves tokens untouched")
-        void emptyTargetSetLeavesTokens() throws IOException {
-            try (PDDocument doc = buildDoc("some content")) {
-                PDPage page = doc.getPage(0);
-                List<Object> originalTokens = parseTokens(page);
-
-                List<Object> tokens =
-                        service.createTokensWithoutTargetText(
-                                doc, page, Collections.emptySet(), false, false);
-
-                assertEquals(originalTokens.size(), tokens.size());
-            }
-        }
-
-        private List<Object> parseTokens(PDPage page) throws IOException {
-            PDFStreamParser parser = new PDFStreamParser(page);
-            List<Object> tokens = new ArrayList<>();
-            Object token;
-            while ((token = parser.parseNextToken()) != null) {
-                tokens.add(token);
-            }
-            return tokens;
-        }
-    }
-
     // ── inner data classes ───────────────────────────────────────────────────────────────────────
 
     @Nested
@@ -484,83 +273,4 @@ class TextRedactionServiceTest {
             assertFalse(a.equals(b));
         }
     }
-
-    // ── private logic exercised via reflection ───────────────────────────────────────────────────
-
-    @Nested
-    @DisplayName("findAllMatches / buildCompleteText (private logic via reflection)")
-    class PrivateLogic {
-
-        @Test
-        @DisplayName("findAllMatches returns sorted, non-overlapping match ranges for two terms")
-        @SuppressWarnings("unchecked")
-        void findAllMatchesSorted() throws Exception {
-            String complete = "alpha beta gamma beta";
-            Set<String> terms = new LinkedHashSet<>(List.of("beta", "alpha"));
-
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "findAllMatches",
-                            String.class,
-                            Set.class,
-                            boolean.class,
-                            boolean.class);
-            m.setAccessible(true);
-            List<TextRedactionService.MatchRange> matches =
-                    (List<TextRedactionService.MatchRange>)
-                            m.invoke(service, complete, terms, false, false);
-
-            assertNotNull(matches);
-            assertFalse(matches.isEmpty());
-            // Results are sorted by start position.
-            for (int i = 1; i < matches.size(); i++) {
-                assertTrue(
-                        matches.get(i - 1).getStartPos() <= matches.get(i).getStartPos(),
-                        "matches must be sorted ascending by start position");
-            }
-            // "alpha" at 0, "beta" at 6 and 17 -> three matches total.
-            assertEquals(3, matches.size());
-            assertEquals(0, matches.get(0).getStartPos());
-        }
-
-        @Test
-        @DisplayName("findAllMatches returns nothing when no term occurs")
-        @SuppressWarnings("unchecked")
-        void findAllMatchesEmptyWhenAbsent() throws Exception {
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "findAllMatches",
-                            String.class,
-                            Set.class,
-                            boolean.class,
-                            boolean.class);
-            m.setAccessible(true);
-            List<TextRedactionService.MatchRange> matches =
-                    (List<TextRedactionService.MatchRange>)
-                            m.invoke(service, "no terms here", Set.of("XYZ"), false, false);
-            assertTrue(matches.isEmpty());
-        }
-
-        @Test
-        @DisplayName("extractTextFromToken pulls text from Tj COSString and TJ COSArray")
-        void extractTextFromToken() throws Exception {
-            Method m =
-                    TextRedactionService.class.getDeclaredMethod(
-                            "extractTextFromToken", Object.class, String.class);
-            m.setAccessible(true);
-
-            assertEquals("hi", m.invoke(service, new COSString("hi"), "Tj"));
-            assertEquals("hi", m.invoke(service, new COSString("hi"), "'"));
-
-            COSArray tjArray = new COSArray();
-            tjArray.add(new COSString("foo"));
-            tjArray.add(new COSString("bar"));
-            assertEquals("foobar", m.invoke(service, tjArray, "TJ"));
-
-            // Unknown operator yields empty string.
-            assertEquals("", m.invoke(service, new COSString("x"), "Td"));
-            // Wrong token type for the operator yields empty string.
-            assertEquals("", m.invoke(service, new COSArray(), "Tj"));
-        }
-    }
 }
diff --git a/app/core/src/test/java/stirling/software/SPDF/util/ExtractScriptConcurrencyTest.java b/app/core/src/test/java/stirling/software/SPDF/util/ExtractScriptConcurrencyTest.java
new file mode 100644
index 0000000000..f0c3ff6f95
--- /dev/null
+++ b/app/core/src/test/java/stirling/software/SPDF/util/ExtractScriptConcurrencyTest.java
@@ -0,0 +1,78 @@
+package stirling.software.SPDF.util;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicInteger;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import stirling.software.common.util.GeneralUtils;
+
+/**
+ * Lives in core because the python resources it extracts ship in this module.
+ *
+ * <p>Callers hand the returned path straight to python3, so the file has to stay readable while
+ * other requests are extracting it. Re-writing it per call used to break that wherever rename is
+ * not atomic, such as a 9p or NFS bind mount.
+ */
+class ExtractScriptConcurrencyTest {
+
+    @Test
+    @DisplayName("concurrent callers always get a readable script")
+    void concurrentCallersSeeAReadableScript() throws Exception {
+        int threads = 16;
+        CountDownLatch start = new CountDownLatch(1);
+        CountDownLatch done = new CountDownLatch(threads);
+        AtomicInteger unreadable = new AtomicInteger();
+        AtomicInteger errors = new AtomicInteger();
+
+        for (int i = 0; i < threads; i++) {
+            Thread.ofVirtual()
+                    .start(
+                            () -> {
+                                try {
+                                    start.await();
+                                    for (int n = 0; n < 25; n++) {
+                                        Path script = GeneralUtils.extractScript("png_to_webp.py");
+                                        if (!Files.isReadable(script)) {
+                                            unreadable.incrementAndGet();
+                                        }
+                                    }
+                                } catch (Exception e) {
+                                    errors.incrementAndGet();
+                                } finally {
+                                    done.countDown();
+                                }
+                            });
+        }
+
+        start.countDown();
+        assertTrue(done.await(60, TimeUnit.SECONDS), "extractScript threads did not finish");
+        assertEquals(0, errors.get(), "extractScript threw under concurrency");
+        assertEquals(0, unreadable.get(), "script was missing while another caller held it");
+    }
+
+    @Test
+    @DisplayName("repeated calls return the same path without rewriting the file")
+    void repeatedCallsAreStable() throws Exception {
+        Path first = GeneralUtils.extractScript("png_to_webp.py");
+        long modified = Files.getLastModifiedTime(first).toMillis();
+        long size = Files.size(first);
+
+        // Any rewrite after this pause lands on a later timestamp, so mtime is a
+        // reliable signal rather than a same-millisecond coin flip.
+        Thread.sleep(50);
+        for (int i = 0; i < 5; i++) {
+            assertEquals(first, GeneralUtils.extractScript("png_to_webp.py"));
+        }
+
+        assertEquals(modified, Files.getLastModifiedTime(first).toMillis(), "script was rewritten");
+        assertEquals(size, Files.size(first));
+    }
+}
diff --git a/app/core/src/test/java/stirling/software/common/controller/JobControllerTest.java b/app/core/src/test/java/stirling/software/common/controller/JobControllerTest.java
index 53212a2e65..2083e7339b 100644
--- a/app/core/src/test/java/stirling/software/common/controller/JobControllerTest.java
+++ b/app/core/src/test/java/stirling/software/common/controller/JobControllerTest.java
@@ -5,9 +5,11 @@ import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.*;
 
 import java.util.Map;
+import java.util.function.Predicate;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
@@ -442,4 +444,52 @@ class JobControllerTest {
         assertEquals(HttpStatus.FORBIDDEN, response.getStatusCode());
         verify(fileStorage, never()).getFileSize(eq(fileId));
     }
+
+    @Test
+    void testCleanupFinishedJobs_ReportsWhatWasReleased() {
+        when(taskManager.cleanupFinishedJobsNow(any()))
+                .thenReturn(new TaskManager.CleanupSummary(2, 5, 1));
+
+        ResponseEntity<?> response = controller.cleanupFinishedJobs();
+
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        @SuppressWarnings("unchecked")
+        Map<String, Object> body = (Map<String, Object>) response.getBody();
+        assertEquals(2, body.get("jobsRemoved"));
+        assertEquals(5, body.get("filesDeleted"));
+        assertEquals(1, body.get("jobsRetained"));
+    }
+
+    @Test
+    void testCleanupFinishedJobs_OnlySweepsJobsTheCallerOwns() {
+        ReflectionTestUtils.setField(controller, "jobOwnershipService", jobOwnershipService);
+        when(jobOwnershipService.validateJobAccess("me:job")).thenReturn(true);
+        when(jobOwnershipService.validateJobAccess("someone-else:job"))
+                .thenThrow(new SecurityException("not yours"));
+        when(taskManager.cleanupFinishedJobsNow(any()))
+                .thenReturn(new TaskManager.CleanupSummary(1, 1, 1));
+
+        controller.cleanupFinishedJobs();
+
+        @SuppressWarnings("unchecked")
+        ArgumentCaptor<Predicate<String>> filter = ArgumentCaptor.forClass(Predicate.class);
+        verify(taskManager).cleanupFinishedJobsNow(filter.capture());
+        assertTrue(filter.getValue().test("me:job"));
+        assertFalse(
+                filter.getValue().test("someone-else:job"),
+                "A job the caller cannot access must be left in place");
+    }
+
+    @Test
+    void testCleanupFinishedJobs_SweepsEverythingWhenSecurityIsDisabled() {
+        when(taskManager.cleanupFinishedJobsNow(any()))
+                .thenReturn(new TaskManager.CleanupSummary(3, 3, 0));
+
+        controller.cleanupFinishedJobs();
+
+        @SuppressWarnings("unchecked")
+        ArgumentCaptor<Predicate<String>> filter = ArgumentCaptor.forClass(Predicate.class);
+        verify(taskManager).cleanupFinishedJobsNow(filter.capture());
+        assertTrue(filter.getValue().test("any-job-id"));
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/AdminJobController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/AdminJobController.java
index ef941c603f..fa9d6db141 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/AdminJobController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/AdminJobController.java
@@ -7,6 +7,7 @@ import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
 import io.swagger.v3.oas.annotations.Operation;
@@ -66,28 +67,40 @@ public class AdminJobController {
     }
 
     /**
-     * Manually trigger cleanup of old jobs (admin only)
+     * Manually trigger cleanup of old jobs (admin only). Covers every user's jobs, unlike the
+     * self-service {@code POST /api/v1/general/jobs/cleanup}, which only releases the caller's own.
      *
-     * @return A response indicating how many jobs were cleaned up
+     * @param force Ignore the retention window and release every finished job now, rather than only
+     *     those already past it
+     * @return A response indicating how many jobs and files were cleaned up
      */
     @PostMapping("/job/cleanup")
-    @Operation(summary = "Cleanup old jobs")
+    @Operation(
+            summary = "Cleanup old jobs",
+            description =
+                    "Runs the job retention sweep now across all users. With force=true the"
+                            + " retention window is ignored and every finished job is released"
+                            + " immediately.")
     @PreAuthorize("hasRole('ADMIN')")
-    public ResponseEntity<?> cleanupOldJobs() {
-        int beforeCount = taskManager.getJobStats().getTotalJobs();
-        taskManager.cleanupOldJobs();
-        int afterCount = taskManager.getJobStats().getTotalJobs();
-        int removedCount = beforeCount - afterCount;
+    public ResponseEntity<?> cleanupOldJobs(
+            @RequestParam(name = "force", defaultValue = "false") boolean force) {
+        TaskManager.CleanupSummary summary =
+                force
+                        ? taskManager.cleanupFinishedJobsNow(jobId -> true)
+                        : taskManager.cleanupOldJobs();
 
         log.info(
-                "Admin triggered job cleanup: removed {} jobs, {} remaining",
-                removedCount,
-                afterCount);
+                "Admin triggered job cleanup (force={}): removed {} jobs and {} files, {} remaining",
+                force,
+                summary.jobsRemoved(),
+                summary.filesDeleted(),
+                summary.jobsRetained());
 
         return ResponseEntity.ok(
                 Map.of(
                         "message", "Cleanup complete",
-                        "removedJobs", removedCount,
-                        "remainingJobs", afterCount));
+                        "removedJobs", summary.jobsRemoved(),
+                        "filesDeleted", summary.filesDeleted(),
+                        "remainingJobs", summary.jobsRetained()));
     }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/EditorFailureReport.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/EditorFailureReport.java
new file mode 100644
index 0000000000..b200b3d589
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/EditorFailureReport.java
@@ -0,0 +1,47 @@
+package stirling.software.proprietary.failure;
+
+import java.util.List;
+
+/**
+ * A failure a user hit in the editor, reported by their own client. The editor calls tools directly
+ * rather than through the policy engine, so nothing server-side sees these unless the client says
+ * so.
+ *
+ * <p>Note what the client cannot supply: no team, no actor, no document name. The first two come
+ * from the authenticated session, and the third is never stored.
+ *
+ * @param operation the tool that failed, e.g. {@code remove-password}
+ * @param errorCode the code from the tool's Problem Details response, or null when there was none
+ * @param fileIds opaque client-side ids of the documents involved; empty when none is attributable
+ * @param detail the message the user saw
+ */
+public record EditorFailureReport(
+        String operation, String errorCode, List<String> fileIds, String detail) {
+
+    /**
+     * Cap on the files one report may name. Each one becomes a permanent incident and this endpoint
+     * is open to any authenticated user, so without a bound a single call can flood a leader's
+     * queue. 200 is several times the largest batch an editor session plausibly fails on, and the
+     * most the review queue shows in one page, so a real report never meets it.
+     *
+     * <p>An oversized report is refused whole rather than trimmed: see {@link
+     * FileRunEventController#report}.
+     */
+    static final int MAX_FILE_IDS = 200;
+
+    public EditorFailureReport {
+        fileIds = fileIds == null ? List.of() : List.copyOf(fileIds);
+    }
+
+    boolean hasOperation() {
+        return operation != null && !operation.isBlank();
+    }
+
+    /**
+     * Counted before the blank ids are dropped, because this bounds the request rather than the
+     * rows it would produce.
+     */
+    boolean namesTooManyFiles() {
+        return fileIds.size() > MAX_FILE_IDS;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FailureKind.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FailureKind.java
index d46f2d85e1..c9acd0d590 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FailureKind.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FailureKind.java
@@ -23,6 +23,10 @@ import lombok.Getter;
  * <p>Actions are declared here but implemented in {@link FailureAction} beans resolved by id, so a
  * new kind ships as a registry entry plus copy. Two members today: {@link #UNKNOWN} gives every
  * failed run a record, and kinds get promoted out of it as production shows what occurs.
+ *
+ * <p>A kind offers an acknowledgement only where there is something to acknowledge <em>doing</em>.
+ * With nothing to fix, "seen it" and "clear it" are the same decision, so the row offers only the
+ * one that clears it.
  */
 @Getter
 public enum FailureKind {
@@ -43,7 +47,6 @@ public enum FailureKind {
             FailureScope.RUN,
             noErrorCodes(),
             fallback("This run failed for a reason Stirling does not yet recognise."),
-            offer(ACKNOWLEDGE),
             offer(DISMISS));
 
     private static final String KEY_PREFIX = "portal.failures.kind.";
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEvent.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEvent.java
index cb6b3a452f..10f46cdbe2 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEvent.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEvent.java
@@ -20,6 +20,7 @@ public record FileRunEvent(
         FailureOrigin origin,
         String policyId,
         String runId,
+        String sourceId,
         String fileId,
         String detail,
         String dedupKey,
@@ -46,6 +47,7 @@ public record FileRunEvent(
                 entity.getOrigin(),
                 entity.getPolicyId(),
                 entity.getRunId(),
+                entity.getSourceId(),
                 entity.getFileId(),
                 entity.getDetail(),
                 entity.getDedupKey(),
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventController.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventController.java
index 49aab9aff6..aac1c3364b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventController.java
@@ -5,6 +5,7 @@ import java.util.List;
 import java.util.Map;
 
 import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -21,15 +22,13 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
-
 /**
- * Read and triage recorded failures for the caller's team. Note the absence of a team parameter:
- * the team comes from the authenticated principal, never the request.
+ * Read and triage recorded failures. Note the absence of a team parameter: the team comes from the
+ * authenticated principal, never the request.
  *
- * <p>Reviewing failures is a leader-level capability, gated the same way policy editing is: see
- * {@link #requireFailureReviewAllowed()}.
+ * <p>Every endpoint is open to any authenticated user and scoped in the service instead: a leader
+ * reads and closes the whole team's failures, everyone else their own. Nothing here decides who may
+ * do what, so the two cannot drift apart.
  */
 @Slf4j
 @RestController
@@ -45,21 +44,21 @@ public class FileRunEventController {
     private static final int DEFAULT_LIMIT = 50;
 
     private final FileRunEventService service;
-    private final PolicyManagementAuthority policyManagementAuthority;
-    private final ApplicationProperties applicationProperties;
 
     @GetMapping
     @Operation(
             summary = "List recorded failures",
             description =
-                    "Failures recorded for the caller's team, newest first. Each row carries its"
-                            + " available actions already resolved.")
+                    "Failures the caller may see, newest first: their team's for a leader, their own"
+                            + " for everyone else. Each row carries its available actions already"
+                            + " resolved.")
     public FileRunEventsResponse list(
             // Spring's converter 400s on a value outside the enum, so no hand-rolled parse.
             @RequestParam(required = false) FileRunEventStatus status,
             @RequestParam(required = false) String kindId,
             @RequestParam(required = false) Integer limit) {
-        requireFailureReviewAllowed();
+        // No role gate: the service scopes the read instead, so a member gets their own failures
+        // and a leader the team's.
         int cappedLimit = Math.min(limit == null ? DEFAULT_LIMIT : Math.max(1, limit), MAX_LIMIT);
 
         List<FileRunEventView> events =
@@ -81,7 +80,8 @@ public class FileRunEventController {
             @PathVariable String eventId,
             @PathVariable String actionId,
             @RequestBody(required = false) ActionRequest request) {
-        requireFailureReviewAllowed();
+        // No role gate: the service decides, which lets someone close their own failure while
+        // still keeping a colleague's out of reach.
         Map<String, String> inputs = request == null ? Map.of() : request.safeInputs();
         try {
             FileRunEvent updated = service.dispatch(eventId, actionId, inputs);
@@ -91,6 +91,50 @@ public class FileRunEventController {
         }
     }
 
+    @PostMapping("/reports")
+    @Operation(
+            summary = "Report a failure hit in the editor",
+            description =
+                    "For failures the server never sees, because the editor calls tools directly."
+                            + " Open to any authenticated user: whoever's work failed can say so, and"
+                            + " reads it back scoped to themselves. Rejected with 400 if it names"
+                            + " more files than one report may carry.")
+    public ResponseEntity<Void> report(@RequestBody EditorFailureReport report) {
+        if (report == null || !report.hasOperation()) {
+            throw new ResponseStatusException(
+                    HttpStatus.BAD_REQUEST, "operation is required to report a failure");
+        }
+        // Refused whole rather than trimmed, and refused before the first write, so an oversized
+        // report leaves no rows at all. Trimming would hand a reviewer part of a set with nothing
+        // saying the rest existed, which is what the cap inside the service used to do. The limit
+        // is stated in the message because the editor reports in the background: a client author
+        // reading a log is the only person who will ever see this.
+        if (report.namesTooManyFiles()) {
+            throw new ResponseStatusException(
+                    HttpStatus.BAD_REQUEST,
+                    "a report may name at most "
+                            + EditorFailureReport.MAX_FILE_IDS
+                            + " files, and this one named "
+                            + report.fileIds().size());
+        }
+        service.report(report);
+        // No body: the editor reports and moves on, and has nothing to do with the row.
+        return ResponseEntity.noContent().build();
+    }
+
+    @PostMapping("/removed-files")
+    @Operation(
+            summary = "Close the incidents about files deleted from the editor",
+            description =
+                    "Deleting the document leaves nothing to act on, so its incidents drop out of"
+                            + " the queue while the rows stay for audit. Applies only to the"
+                            + " caller's own editor rows, however senior they are.")
+    public ResponseEntity<Void> filesRemoved(@RequestBody(required = false) RemovedFiles request) {
+        service.forgetFiles(request == null ? List.of() : request.safeFileIds());
+        // No body: the editor is telling the server, not asking it anything.
+        return ResponseEntity.noContent().build();
+    }
+
     @GetMapping("/kinds")
     @Operation(
             summary = "List known failure kinds",
@@ -98,29 +142,11 @@ public class FileRunEventController {
                     "The failure registry. Lets a client describe kinds it was not built with, and"
                             + " doubles as the probe for whether failure tracking exists at all.")
     public List<FailureKindView> kinds() {
-        requireFailureReviewAllowed();
+        // The registry is copy and metadata, not anyone's data, and a member needs it to render the
+        // failures they can already see.
         return Arrays.stream(FailureKind.values()).map(FailureKindView::of).toList();
     }
 
-    /**
-     * Triage is for a team leader (SaaS) or admin (self-hosted), mirroring {@code
-     * PolicyController.requirePolicyEditingAllowed()} rather than inventing a second notion of who
-     * manages a team's automation: a member can trigger runs, a leader reviews them.
-     *
-     * <p>Login disabled means a single-user deployment with no roles to tell apart, the same
-     * carve-out the policy endpoints make. Team scoping is separate, and lives in the service.
-     */
-    private void requireFailureReviewAllowed() {
-        if (!applicationProperties.getSecurity().isEnableLogin()) {
-            return;
-        }
-        if (!policyManagementAuthority.canEditPolicies()) {
-            throw new ResponseStatusException(
-                    HttpStatus.FORBIDDEN,
-                    "Recorded failures may only be reviewed by a team leader");
-        }
-    }
-
     /**
      * A closed row is a conflict rather than a bad request: the request was well-formed and would
      * have been valid a moment earlier.
@@ -136,6 +162,22 @@ public class FileRunEventController {
     /** Wrapped rather than a bare array so pagination can be added without breaking clients. */
     public record FileRunEventsResponse(List<FileRunEventView> events) {}
 
+    /**
+     * Files gone from the caller's editor. Opaque ids only, as everywhere else on this API.
+     *
+     * <p>Deliberately uncapped where a report is capped, because this creates nothing: it closes
+     * rows the caller already owns, so however long the list is, it can only ever touch incidents
+     * that already exist. Refusing an oversized one would also be the harmful direction here, since
+     * the editor says this once and never retries: those incidents would sit in the queue asking
+     * for attention about files that no longer exist.
+     */
+    public record RemovedFiles(List<String> fileIds) {
+
+        List<String> safeFileIds() {
+            return fileIds == null ? List.of() : fileIds;
+        }
+    }
+
     /** Inputs an action declared it needs. Empty for both actions that exist today. */
     public record ActionRequest(Map<String, String> inputs) {
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventEntity.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventEntity.java
index 9659941fc9..3cfb67a7fc 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventEntity.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventEntity.java
@@ -84,6 +84,10 @@ public class FileRunEventEntity implements Serializable {
     @Column(name = "run_id")
     private String runId;
 
+    /** Which folder, bucket or webhook fed the run. Null when a user supplied the file. */
+    @Column(name = "source_id")
+    private String sourceId;
+
     @Column(name = "file_id")
     private String fileId;
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventRepository.java
index 6da6a9b004..1930b36e6a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventRepository.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventRepository.java
@@ -17,27 +17,36 @@ import org.springframework.transaction.annotation.Transactional;
 public interface FileRunEventRepository extends JpaRepository<FileRunEventEntity, String> {
 
     /**
-     * This team's events, newest first, scoped in the query rather than loaded and filtered. A
-     * {@code null} teamId matches the rows with no team (login disabled), mirroring {@link
-     * stirling.software.proprietary.policy.source.SourceRepository#findByTeam}, since a plain
-     * {@code = null} would return nothing.
+     * As {@link #findByTeamAndStatus} but for a set of statuses, e.g. the open ones. The kind
+     * filter is in the query, before the limit: filtering an already-limited page could return
+     * nothing while matching rows exist.
+     *
+     * <p>{@code actor} narrows to one person's own failures. Null means the whole team, which only
+     * a leader ever asks for: see {@code FileRunEventService#readScope}.
      */
     @Query(
             "select e from FileRunEventEntity e where ((:teamId is null and e.teamId is null) or"
-                    + " e.teamId = :teamId) and (:kindId is null or e.kindId = :kindId)"
-                    + " order by e.lastSeenAt desc")
-    List<FileRunEventEntity> findByTeam(
-            @Param("teamId") Long teamId, @Param("kindId") String kindId, Pageable pageable);
+                    + " e.teamId = :teamId) and e.status in :statuses"
+                    + " and (:kindId is null or e.kindId = :kindId)"
+                    + " and (:actor is null or e.actor = :actor) order by e.lastSeenAt desc")
+    List<FileRunEventEntity> findByTeamAndStatusIn(
+            @Param("teamId") Long teamId,
+            @Param("statuses") List<FileRunEventStatus> statuses,
+            @Param("kindId") String kindId,
+            @Param("actor") String actor,
+            Pageable pageable);
 
-    /** As {@link #findByTeam} but restricted to one status, for the review surface's filters. */
+    /** As {@link #findByTeamAndStatusIn} but for exactly one status, for the surface's filters. */
     @Query(
             "select e from FileRunEventEntity e where ((:teamId is null and e.teamId is null) or"
                     + " e.teamId = :teamId) and e.status = :status"
-                    + " and (:kindId is null or e.kindId = :kindId) order by e.lastSeenAt desc")
+                    + " and (:kindId is null or e.kindId = :kindId)"
+                    + " and (:actor is null or e.actor = :actor) order by e.lastSeenAt desc")
     List<FileRunEventEntity> findByTeamAndStatus(
             @Param("teamId") Long teamId,
             @Param("status") FileRunEventStatus status,
             @Param("kindId") String kindId,
+            @Param("actor") String actor,
             Pageable pageable);
 
     /**
@@ -85,6 +94,31 @@ public interface FileRunEventRepository extends JpaRepository<FileRunEventEntity
             @Param("now") Instant now,
             @Param("allowedFrom") Collection<FileRunEventStatus> allowedFrom);
 
+    /**
+     * Close the incidents about documents their owner deleted from the editor: the queue is what
+     * needs attention, and a document that no longer exists needs none.
+     *
+     * <p>Restricted to that owner's own editor rows. File ids are minted by the client, so scoping
+     * on team alone would let one caller close a colleague's incidents by naming ids. Processor
+     * rows are excluded outright: nothing was deleted from an editor there.
+     */
+    @Modifying(clearAutomatically = true)
+    @Transactional
+    @Query(
+            "update FileRunEventEntity e set e.status ="
+                    + " stirling.software.proprietary.failure.FileRunEventStatus.FILE_REMOVED,"
+                    + " e.statusActor = :actor, e.statusAt = :now where e.origin ="
+                    + " stirling.software.proprietary.failure.FailureOrigin.TOOL and ((:teamId is"
+                    + " null and e.teamId is null) or e.teamId = :teamId) and ((:actor is null and"
+                    + " e.actor is null) or e.actor = :actor) and e.fileId in :fileIds and e.status in"
+                    + " :allowedFrom")
+    int markFilesRemoved(
+            @Param("teamId") Long teamId,
+            @Param("actor") String actor,
+            @Param("fileIds") Collection<String> fileIds,
+            @Param("now") Instant now,
+            @Param("allowedFrom") Collection<FileRunEventStatus> allowedFrom);
+
     /**
      * The most recent row for this exact failure, so the rollup can increment an existing incident
      * instead of opening a new one. Team-scoped, so the same failure in two teams stays two rows.
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventService.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventService.java
index 94b9c00a2c..fa858b6e22 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventService.java
@@ -13,12 +13,14 @@ import stirling.software.common.service.UserServiceInterface;
 import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
 
 /**
- * Reads and acts on incidents for the calling user's team.
+ * Reads and acts on the incidents the calling user is allowed to see, which is where that decision
+ * is made: a leader reads and closes the whole team's failures, everyone else their own. Keeping it
+ * here rather than on the endpoints means the read and the triage cannot drift apart.
  *
  * <p>Team scoping mirrors {@code PolicyAccessGuard}: everyone sees only their own team's rows, the
  * team always comes from the authenticated principal, and scoping applies only when login is
  * enabled so single-user deployments keep working. When the team cannot be resolved the caller
- * reads nothing; see {@link #scope()}.
+ * reads nothing; see {@link #readScope()}.
  */
 @Slf4j
 @Service
@@ -31,13 +33,83 @@ public class FileRunEventService {
     private final UserServiceInterface userService;
     private final ApplicationProperties applicationProperties;
 
-    /** The calling user's events, newest first. Empty when their team cannot be resolved. */
+    /**
+     * Record a failure a user hit in the editor. One incident per named file, so each document
+     * stays separately actionable; one unattributed incident when the report names none.
+     *
+     * <p>The team and actor come from the session rather than the report, and the kind is
+     * classified from the reported code, falling back to {@link FailureKind#UNKNOWN} for a code no
+     * kind claims.
+     */
+    public List<FileRunEvent> report(EditorFailureReport report) {
+        FailureKind kind = FailureKind.byErrorCode(report.errorCode()).orElse(FailureKind.UNKNOWN);
+        // The caller's team, not their read scope: recording is open to everyone, and a reader who
+        // may see nothing still has their failure filed under the team it happened in.
+        Long teamId = currentTeamId();
+        String actor = currentActor();
+        String detail = detailFor(report);
+
+        List<String> fileIds =
+                report.fileIds().stream().filter(id -> id != null && !id.isBlank()).toList();
+        if (fileIds.isEmpty()) {
+            return List.of(recordReported(kind, teamId, actor, null, detail));
+        }
+        // Every named file gets its row. An earlier cap here silently dropped the rest, which lost
+        // failures a reviewer needed and was inconsistent with the processor path, where a sweep
+        // records one row per failing file with no limit at all. How many files one report may name
+        // is bounded at the boundary instead (see EditorFailureReport#MAX_FILE_IDS), where an
+        // oversized report can be refused whole before anything is written.
+        return fileIds.stream()
+                .map(fileId -> recordReported(kind, teamId, actor, fileId, detail))
+                .toList();
+    }
+
+    private FileRunEvent recordReported(
+            FailureKind kind, Long teamId, String actor, String fileId, String detail) {
+        return store.record(RecordFailure.forEditor(kind, teamId, actor, fileId, detail));
+    }
+
+    /**
+     * The operation is the context a reviewer needs, since an editor failure has no policy or run.
+     */
+    private String detailFor(EditorFailureReport report) {
+        String message = report.detail() == null ? "" : report.detail();
+        return message.isBlank() ? report.operation() : report.operation() + ": " + message;
+    }
+
+    /**
+     * Close the incidents about documents the caller has deleted from their editor. The queue means
+     * "needs attention", and a document that no longer exists needs none; the rows stay for audit.
+     *
+     * <p>Best-effort by nature: this only arrives if the browser that owns the file says so, and a
+     * cleared cache or another device never will. Rows left open that way are retention's problem,
+     * not this method's.
+     *
+     * <p>Narrowed to the caller's own rows however senior they are, which is why it passes {@link
+     * #currentActor()} rather than the read scope's actor: file ids are minted by each client, so a
+     * leader reading with a null actor would match every unattributed row in the team.
+     *
+     * @return how many incidents were closed
+     */
+    public int forgetFiles(List<String> fileIds) {
+        ReadScope scope = readScope();
+        if (!scope.permitted()) {
+            return 0;
+        }
+        List<String> named = fileIds.stream().filter(id -> id != null && !id.isBlank()).toList();
+        return store.markFilesRemoved(scope.teamId(), currentActor(), named);
+    }
+
+    /**
+     * The events the caller may read, newest first: the team's for a leader, their own for everyone
+     * else. Empty when their team cannot be resolved.
+     */
     public List<FileRunEvent> list(FileRunEventStatus status, String kindId, int limit) {
-        TeamScope scope = scope();
+        ReadScope scope = readScope();
         if (!scope.permitted()) {
             return List.of();
         }
-        return store.list(scope.teamId(), status, kindId, limit);
+        return store.list(scope.teamId(), status, kindId, scope.actor(), limit);
     }
 
     /**
@@ -47,7 +119,13 @@ public class FileRunEventService {
      *     event's kind does not declare the action, or the event is already closed
      */
     public FileRunEvent dispatch(String eventId, String actionId, Map<String, String> inputs) {
-        TeamScope scope = scope();
+        // Whoever can see it can close it: a leader for the whole team, everyone else for the
+        // failures they caused. Someone who fixes their own problem should not have to ask a leader
+        // to clear the row.
+        //
+        // Closing the row is all this covers. Acting on the document behind it, such as supplying a
+        // password for a retry, would need its own permission, and no such action exists yet.
+        ReadScope scope = readScope();
         if (!scope.permitted()) {
             // Reported as "no such event", the same as an id from another team, so the response
             // does
@@ -57,6 +135,12 @@ public class FileRunEventService {
         }
         FileRunEvent event =
                 store.find(eventId, scope.teamId())
+                        // Reported as "no such event" rather than a refusal, so a member cannot
+                        // learn that a colleague's incident exists by trying to close it.
+                        .filter(
+                                found ->
+                                        scope.actor() == null
+                                                || scope.actor().equals(found.actor()))
                         .orElseThrow(
                                 () ->
                                         new FailureActionException(
@@ -118,31 +202,55 @@ public class FileRunEventService {
     }
 
     /**
-     * Which rows the caller may touch, since a null team id means two different things. Login
-     * disabled is the self-hosted setup with no users or teams, where unteamed rows are everyone's,
-     * as {@code PolicyAccessGuard} also treats them. Login enabled with no resolvable team reads
-     * nothing, because unteamed rows there are shared by every team's ad-hoc runs.
+     * Which rows the caller may read. A leader reviews the whole team's, as before. Everyone else
+     * reads the failures they caused themselves: a member can already report one, so letting them
+     * see their own back is what makes telling them about it worth anything, and it exposes nothing
+     * of a colleague's.
+     *
+     * <p>A null team id means two different things. Login disabled is the self-hosted setup with no
+     * users or teams, where unteamed rows are everyone's, as {@code PolicyAccessGuard} also treats
+     * them. Login enabled with no resolvable team reads nothing, because unteamed rows there are
+     * shared by every team's ad-hoc runs.
      */
-    private TeamScope scope() {
+    private ReadScope readScope() {
         if (!enforced()) {
-            return TeamScope.of(null);
+            return ReadScope.wholeTeam(null);
         }
-        Long teamId = policyManagementAuthority.currentUserTeamId();
-        return teamId == null ? TeamScope.denied() : TeamScope.of(teamId);
+        Long teamId = currentTeamId();
+        if (teamId == null) {
+            return ReadScope.denied();
+        }
+        if (policyManagementAuthority.canEditPolicies()) {
+            return ReadScope.wholeTeam(teamId);
+        }
+        // Narrowing to "mine" needs a name to narrow by. Without one the filter would be dropped
+        // and a member would read the whole team, so refuse rather than widen.
+        String actor = currentActor();
+        return actor == null ? ReadScope.denied() : ReadScope.mine(teamId, actor);
     }
 
     /**
-     * The caller's readable team, or a refusal. {@code teamId} is only meaningful when permitted.
+     * What the caller may read. {@code actor} is the person to narrow to, or null for the whole
+     * team; both are only meaningful when permitted.
      */
-    private record TeamScope(boolean permitted, Long teamId) {
+    private record ReadScope(boolean permitted, Long teamId, String actor) {
 
-        static TeamScope of(Long teamId) {
-            return new TeamScope(true, teamId);
+        static ReadScope wholeTeam(Long teamId) {
+            return new ReadScope(true, teamId, null);
         }
 
-        static TeamScope denied() {
-            return new TeamScope(false, null);
+        static ReadScope mine(Long teamId, String actor) {
+            return new ReadScope(true, teamId, actor);
         }
+
+        static ReadScope denied() {
+            return new ReadScope(false, null, null);
+        }
+    }
+
+    /** The team a row belongs to, which is nobody's when there are no teams to belong to. */
+    private Long currentTeamId() {
+        return enforced() ? policyManagementAuthority.currentUserTeamId() : null;
     }
 
     private String currentActor() {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventStatus.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventStatus.java
index cae0529334..9bf0e0b607 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventStatus.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventStatus.java
@@ -11,7 +11,14 @@ public enum FileRunEventStatus {
     NEW(false),
     ACKNOWLEDGED(false),
     DISMISSED(true),
-    RESOLVED(true);
+    RESOLVED(true),
+
+    /**
+     * The document this incident was about was deleted from its owner's editor, so there is nothing
+     * left to act on. Distinct from {@code DISMISSED}, which is a reviewer's decision, and from
+     * {@code RESOLVED}, which reopens on recurrence: this one cannot recur, the file is gone.
+     */
+    FILE_REMOVED(true);
 
     /** The statuses a review queue shows by default: everything still needing a decision. */
     private static final List<FileRunEventStatus> OPEN =
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventStore.java
index e1fc7cc453..2ed86e61b2 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventStore.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventStore.java
@@ -98,6 +98,7 @@ public class FileRunEventStore {
         entity.setOrigin(command.origin());
         entity.setPolicyId(command.policyId());
         entity.setRunId(command.runId());
+        entity.setSourceId(command.sourceId());
         entity.setFileId(command.fileId());
         entity.setDetail(command.detail());
         entity.setDedupKey(dedupKey);
@@ -112,18 +113,27 @@ public class FileRunEventStore {
     }
 
     /**
-     * A page of incidents, newest first, optionally narrowed to one status and one kind. The kind
-     * filter lives in the query, before the limit: filtering a already-limited page could return
-     * nothing while matching rows exist.
+     * A page of incidents, newest first, optionally narrowed to one status and one kind.
+     *
+     * <p>With no status asked for this is the <em>open</em> queue rather than every row ever
+     * recorded: a dismissed failure has been dealt with, and leaving it in the default view means
+     * the list can never be cleared. Ask for a status to see closed rows.
+     *
+     * <p>Both filters live in the query, before the limit: filtering an already-limited page could
+     * return nothing while matching rows exist.
+     *
+     * <p>{@code actor} narrows to one person's own failures, or reads the whole team when null. Who
+     * gets which is the service's decision, not this method's.
      */
     @Transactional(readOnly = true)
     public List<FileRunEvent> list(
-            Long teamId, FileRunEventStatus status, String kindId, int limit) {
+            Long teamId, FileRunEventStatus status, String kindId, String actor, int limit) {
         Pageable page = PageRequest.of(0, Math.max(1, limit));
         List<FileRunEventEntity> rows =
                 status == null
-                        ? repository.findByTeam(teamId, kindId, page)
-                        : repository.findByTeamAndStatus(teamId, status, kindId, page);
+                        ? repository.findByTeamAndStatusIn(
+                                teamId, FileRunEventStatus.open(), kindId, actor, page)
+                        : repository.findByTeamAndStatus(teamId, status, kindId, actor, page);
         return rows.stream().map(FileRunEvent::of).toList();
     }
 
@@ -184,6 +194,22 @@ public class FileRunEventStore {
                 .orElseThrow(() -> refusalFor(id, teamId));
     }
 
+    /**
+     * Close this owner's open incidents about {@code fileIds}, because the documents are gone. The
+     * rows stay for audit; they just leave the queue. Only open rows move, so a reviewer's dismiss
+     * keeps its meaning and its actor.
+     *
+     * @return how many incidents were closed
+     */
+    @Transactional
+    public int markFilesRemoved(Long teamId, String actor, Collection<String> fileIds) {
+        if (fileIds.isEmpty()) {
+            return 0;
+        }
+        return repository.markFilesRemoved(
+                teamId, actor, fileIds, Instant.now(), FileRunEventStatus.open());
+    }
+
     /**
      * Why the guarded UPDATE refused, worked out only once it has. Missing and closed are told
      * apart after the fact rather than before, so the answer describes the row the UPDATE saw.
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventView.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventView.java
index cbaab4684d..3809fad2c6 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventView.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/FileRunEventView.java
@@ -22,6 +22,7 @@ public record FileRunEventView(
         String detail,
         String policyId,
         String runId,
+        String sourceId,
         String fileId,
         String actor,
         int occurrences,
@@ -48,6 +49,7 @@ public record FileRunEventView(
                 event.detail(),
                 event.policyId(),
                 event.runId(),
+                event.sourceId(),
                 event.fileId(),
                 event.actor(),
                 event.occurrences(),
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/PolicyFailureRecorder.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/PolicyFailureRecorder.java
index 7d4516939a..eaa8e0f5bd 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/PolicyFailureRecorder.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/PolicyFailureRecorder.java
@@ -30,11 +30,12 @@ public class PolicyFailureRecorder {
     public void recordRunFailure(
             String runId,
             String policyId,
-            String actor,
+            String sourceId,
             String fileIdentity,
+            String actor,
             String detail,
             Throwable cause) {
-        record(classifier.classify(cause), runId, policyId, actor, fileIdentity, detail);
+        record(classifier.classify(cause), runId, policyId, sourceId, fileIdentity, actor, detail);
     }
 
     /**
@@ -44,21 +45,35 @@ public class PolicyFailureRecorder {
      * pick the wrong one.
      */
     public void recordRunFailureAs(
-            FailureKind kind, String runId, String policyId, String actor, String detail) {
-        record(kind, runId, policyId, actor, null, detail);
+            FailureKind kind,
+            String runId,
+            String policyId,
+            String sourceId,
+            String actor,
+            String detail) {
+        // No document reference: a run rejected at admission never got as far as one.
+        record(kind, runId, policyId, sourceId, null, actor, detail);
     }
 
     private void record(
             FailureKind kind,
             String runId,
             String policyId,
-            String actor,
+            String sourceId,
             String fileIdentity,
+            String actor,
             String detail) {
         try {
             store.record(
                     RecordFailure.forRun(
-                            kind, teamFor(policyId), actor, policyId, runId, fileIdentity, detail));
+                            kind,
+                            teamFor(policyId),
+                            actor,
+                            policyId,
+                            runId,
+                            sourceId,
+                            fileIdentity,
+                            detail));
         } catch (RuntimeException e) {
             // Deliberately swallowed: see the class comment.
             log.warn("Could not record failure event for run {} (kind {})", runId, kind.getId(), e);
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/failure/RecordFailure.java b/app/proprietary/src/main/java/stirling/software/proprietary/failure/RecordFailure.java
index 1f45d52e17..8448f26fc3 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/failure/RecordFailure.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/failure/RecordFailure.java
@@ -38,17 +38,40 @@ public record RecordFailure(
         detail = truncate(detail);
     }
 
-    /** A processor-side failure with no file or source context, e.g. a run that failed outright. */
+    /**
+     * A processor-side run failure. {@code sourceId} says which folder, bucket or webhook fed the
+     * run, and is the only attribution an unattended failure has: there is no user to name. {@code
+     * fileId} is the source's opaque reference to the document, already hashed upstream.
+     */
     public static RecordFailure forRun(
             FailureKind kind,
             Long teamId,
             String actor,
             String policyId,
             String runId,
+            String sourceId,
             String fileId,
             String detail) {
         return new RecordFailure(
-                kind, FailureOrigin.POLICY, teamId, actor, policyId, runId, null, fileId, detail);
+                kind,
+                FailureOrigin.POLICY,
+                teamId,
+                actor,
+                policyId,
+                runId,
+                sourceId,
+                fileId,
+                detail);
+    }
+
+    /**
+     * A failure a user hit in their own editor. There is no policy, run or source: the user is the
+     * attribution, and {@code fileId} may be null when the report named no file.
+     */
+    public static RecordFailure forEditor(
+            FailureKind kind, Long teamId, String actor, String fileId, String detail) {
+        return new RecordFailure(
+                kind, FailureOrigin.TOOL, teamId, actor, null, null, null, fileId, detail);
     }
 
     /**
@@ -56,14 +79,21 @@ public record RecordFailure(
      * reference are the same incident; see {@link #dedupKey()}.
      */
     public String scopeRef() {
-        return switch (kind.getScope()) {
-            case FILE -> nullToEmpty(policyId) + "|" + fileOrRun();
-            case RUN -> nullToEmpty(runId);
-            case POLICY -> nullToEmpty(policyId);
-            case SOURCE -> nullToEmpty(sourceId);
-            // One server-wide condition is one incident regardless of which run tripped over it.
-            case SERVER -> "";
-        };
+        String about =
+                switch (kind.getScope()) {
+                    case FILE -> nullToEmpty(policyId) + "|" + fileOrRun();
+                    // An editor report has no run, so a RUN-scoped kind would otherwise put every
+                    // such failure in a team into one incident: fall back to the document.
+                    case RUN -> isBlank(runId) ? fileOrRun() : nullToEmpty(runId);
+                    case POLICY -> nullToEmpty(policyId);
+                    case SOURCE -> nullToEmpty(sourceId);
+                    // One server-wide condition is one incident regardless of which run hit it.
+                    case SERVER -> "";
+                };
+        // An editor failure belongs to the person who hit it, so two colleagues hitting the same
+        // thing are two incidents. Folding them would credit one actor for both and offer the
+        // wrong person the row. Unattended runs have no such owner and are unaffected.
+        return origin == FailureOrigin.TOOL ? nullToEmpty(actor) + "|" + about : about;
     }
 
     /**
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java
index a54959b0ff..661e42c771 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java
@@ -2,13 +2,19 @@ package stirling.software.proprietary.model;
 
 import java.io.Serializable;
 import java.util.HashSet;
+import java.util.Objects;
 import java.util.Set;
 
+import org.hibernate.proxy.HibernateProxy;
+
 import com.fasterxml.jackson.annotation.JsonIgnore;
 
 import jakarta.persistence.*;
 
-import lombok.*;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+import lombok.ToString;
 
 import stirling.software.proprietary.security.model.User;
 
@@ -18,7 +24,6 @@ import stirling.software.proprietary.security.model.User;
 @NoArgsConstructor
 @Getter
 @Setter
-@EqualsAndHashCode(onlyExplicitlyIncluded = true)
 @ToString(onlyExplicitlyIncluded = true)
 public class Team implements Serializable {
 
@@ -47,4 +52,31 @@ public class Team implements Serializable {
         users.remove(user);
         user.setTeam(null);
     }
+
+    @Override
+    public final boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null) return false;
+        Class<?> oEffectiveClass =
+                o instanceof HibernateProxy
+                        ? ((HibernateProxy) o).getHibernateLazyInitializer().getPersistentClass()
+                        : o.getClass();
+        Class<?> thisEffectiveClass =
+                this instanceof HibernateProxy
+                        ? ((HibernateProxy) this).getHibernateLazyInitializer().getPersistentClass()
+                        : this.getClass();
+        if (thisEffectiveClass != oEffectiveClass) return false;
+        Team team = (Team) o;
+        return getId() != null && Objects.equals(getId(), team.getId());
+    }
+
+    @Override
+    public final int hashCode() {
+        return this instanceof HibernateProxy
+                ? ((HibernateProxy) this)
+                        .getHibernateLazyInitializer()
+                        .getPersistentClass()
+                        .hashCode()
+                : getClass().hashCode();
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/security/PersistentAuditEvent.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/security/PersistentAuditEvent.java
index ccaf337c0b..aeb66b47a8 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/model/security/PersistentAuditEvent.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/security/PersistentAuditEvent.java
@@ -1,6 +1,9 @@
 package stirling.software.proprietary.model.security;
 
 import java.time.Instant;
+import java.util.Objects;
+
+import org.hibernate.proxy.HibernateProxy;
 
 import jakarta.persistence.*;
 
@@ -28,7 +31,9 @@ import lombok.*;
                     name = "idx_audit_source_timestamp_principal",
                     columnList = "source,timestamp,principal")
         })
-@Data
+@Getter
+@Setter
+@ToString(onlyExplicitlyIncluded = true)
 @Builder
 @NoArgsConstructor
 @AllArgsConstructor
@@ -36,14 +41,43 @@ public class PersistentAuditEvent {
 
     @Id
     @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @ToString.Include
     private Long id;
 
-    private String principal;
-    private String type;
+    @ToString.Include private String principal;
+
+    @ToString.Include private String type;
     private String source;
 
     @Column(columnDefinition = "text")
     private String data; // JSON blob
 
-    private Instant timestamp;
+    @ToString.Include private Instant timestamp;
+
+    @Override
+    public final boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null) return false;
+        Class<?> oEffectiveClass =
+                o instanceof HibernateProxy
+                        ? ((HibernateProxy) o).getHibernateLazyInitializer().getPersistentClass()
+                        : o.getClass();
+        Class<?> thisEffectiveClass =
+                this instanceof HibernateProxy
+                        ? ((HibernateProxy) this).getHibernateLazyInitializer().getPersistentClass()
+                        : this.getClass();
+        if (thisEffectiveClass != oEffectiveClass) return false;
+        PersistentAuditEvent that = (PersistentAuditEvent) o;
+        return getId() != null && Objects.equals(getId(), that.getId());
+    }
+
+    @Override
+    public final int hashCode() {
+        return this instanceof HibernateProxy
+                ? ((HibernateProxy) this)
+                        .getHibernateLazyInitializer()
+                        .getPersistentClass()
+                        .hashCode()
+                : getClass().hashCode();
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/AdminPolicyManagementAuthority.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/AdminPolicyManagementAuthority.java
index a49c8e5aa9..6d8229aa26 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/AdminPolicyManagementAuthority.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/AdminPolicyManagementAuthority.java
@@ -26,6 +26,11 @@ public class AdminPolicyManagementAuthority implements PolicyManagementAuthority
         return userService.isCurrentUserAdmin();
     }
 
+    @Override
+    public boolean canTriggerPolicies() {
+        return userService.isCurrentUserAdmin();
+    }
+
     @Override
     public Long currentUserTeamId() {
         String username = userService.getCurrentUsername();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/PolicyManagementAuthority.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/PolicyManagementAuthority.java
index 0ea3c298ad..d7e4f50ad1 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/PolicyManagementAuthority.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/PolicyManagementAuthority.java
@@ -12,6 +12,17 @@ public interface PolicyManagementAuthority {
     /** Whether the current user may create, edit, or delete policies (for their own team). */
     boolean canEditPolicies();
 
+    /**
+     * Whether the current user may run a policy against its <em>configured sources</em> (the manual
+     * "run now" sweep). Kept separate from {@link #canEditPolicies()} because the two are distinct
+     * capabilities, even where a deployment grants both to the same people: a sweep operates on the
+     * team's configured sources using the server's stored connection credentials, which makes it a
+     * policy-management capability rather than ordinary use. Running a policy over the caller's
+     * <em>own</em> uploaded files is not covered by this and stays open to every team member — that
+     * is ordinary editor enforcement.
+     */
+    boolean canTriggerPolicies();
+
     /**
      * The team that scopes the current user's policies — the team a new policy is stamped with and
      * the only team whose policies the user may see/run/edit. {@code null} when it can't be
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
index 506bb75578..778a04e169 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
@@ -432,9 +432,10 @@ public class PolicyController {
      * admin gets no say on SaaS. Team scoping (which team's policies) is enforced separately by
      * {@link PolicyAccessGuard}. Every mutation routes through {@link #savePolicy} (pause/resume
      * re-save with a flipped {@code enabled} flag) or {@link #deletePolicy}, so gating those two
-     * covers them all; runs ({@code /run}) stay open to the team. Single-user deployments (login
-     * disabled) have no such role, so they trust the local operator. The path allowlist for folder
-     * sources/outputs is enforced separately by {@link PolicyValidator} at validation time.
+     * covers them all; runs over the caller's own files ({@code /{id}/run}) stay open to the team,
+     * while source sweeps are gated by {@link #requirePolicySweepAllowed}. Single-user deployments
+     * (login disabled) have no such role, so they trust the local operator. The path allowlist for
+     * folder sources/outputs is enforced separately by {@link PolicyValidator} at validation time.
      */
     private void requirePolicyEditingAllowed() {
         if (!applicationProperties.getSecurity().isEnableLogin()) {
@@ -447,6 +448,25 @@ public class PolicyController {
         }
     }
 
+    /**
+     * Sweeping a policy's configured sources requires the same role as managing policies: the sweep
+     * operates on the team's configured sources using the server's stored connection credentials,
+     * which makes it a policy-management capability rather than ordinary use, and team scoping on
+     * its own does not express that. Deliberately narrower than it looks: it gates only the sweep,
+     * not {@link #runStoredPolicy}, because running a policy over documents the caller supplied is
+     * ordinary editor enforcement that every member performs on upload and export.
+     */
+    private void requirePolicySweepAllowed() {
+        if (!applicationProperties.getSecurity().isEnableLogin()) {
+            return;
+        }
+        if (!policyManagementAuthority.canTriggerPolicies()) {
+            throw new ResponseStatusException(
+                    HttpStatus.FORBIDDEN,
+                    "Not permitted to run this policy against its configured sources");
+        }
+    }
+
     @GetMapping
     @Operation(
             summary = "List policies",
@@ -571,8 +591,10 @@ public class PolicyController {
                             + " the enabled flag (which only gates automatic triggering). Returns"
                             + " the ids of the runs started (poll the run-status endpoint for each)"
                             + " plus what the sweep skipped - already-processed, parked-by-failure,"
-                            + " and in-flight counts - so an empty result explains itself.")
+                            + " and in-flight counts - so an empty result explains itself. Requires"
+                            + " the policy-management role.")
     public ResponseEntity<SweepOutcome> trigger(@PathVariable String policyId) {
+        requirePolicySweepAllowed();
         Policy policy =
                 policyStore
                         .get(policyId)
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
index a58670ac25..0d75866a6f 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
@@ -130,25 +130,35 @@ public class PolicyEngine {
         // worker.
         String principal = currentActingPrincipal();
         return submitForPrincipal(
-                principal, principal, policyId, definition, inputs, null, listener);
+                principal,
+                principal,
+                principal,
+                policyId,
+                definition,
+                inputs,
+                listener,
+                null,
+                null);
     }
 
     /** Run a stored policy on demand. {@code enabled} gates triggers, not explicit runs. */
     public PolicyRunHandle runPolicy(
             Policy policy, PolicyInputs inputs, PolicyProgressListener listener) {
-        return runPolicy(policy, inputs, null, listener);
+        return runPolicy(policy, inputs, listener, null, null);
     }
 
     /**
-     * As {@link #runPolicy(Policy, PolicyInputs, PolicyProgressListener)}, with the source's opaque
-     * reference to the document being run. Carried so a failure can say which document it was
-     * about, and so the same document failing again folds into one incident.
+     * As {@link #runPolicy(Policy, PolicyInputs, PolicyProgressListener)}, recording which source
+     * fed the run and its opaque reference to the document. The first says where an unattended
+     * failure came from; the second says which document, and is what lets the same document failing
+     * again fold into one incident. Both null for a user's upload.
      */
     public PolicyRunHandle runPolicy(
             Policy policy,
             PolicyInputs inputs,
-            String fileIdentity,
-            PolicyProgressListener listener) {
+            PolicyProgressListener listener,
+            String sourceId,
+            String fileIdentity) {
         // Bill the policy owner: trigger-fired runs have no security context, and the async worker
         // doesn't inherit the caller's, so the owner (stamped at policy creation) is the reliable
         // billing identity — and for org-wide policies the org/owner is meant to pay. But own the
@@ -156,6 +166,10 @@ public class PolicyEngine {
         // they can download their enforced file; otherwise an org-wide policy's output is owned by
         // the admin and the triggering user is denied it. Trigger-fired runs have no such user, so
         // the owner owns those outputs.
+        //
+        // The triggering user is also carried on the run, as the actor of any failure it records:
+        // null for a trigger-fired run, which is what makes an unattended incident ownerless rather
+        // than the owner's problem. Three identities, deliberately not interchangeable.
         String triggeringUser = currentActingPrincipal();
         String fileOwner = triggeringUser != null ? triggeringUser : policy.owner();
         // Stored supporting files (certificates, watermark images, ...) load here, before the
@@ -170,21 +184,27 @@ public class PolicyEngine {
         return submitForPrincipal(
                 policy.owner(),
                 fileOwner,
+                triggeringUser,
                 policy.id(),
                 definition,
+                // main's asset-resolved inputs, not the raw ones: stored certificates and watermark
+                // images bind here, before the async hop, because worker threads have no principal.
                 resolved,
-                fileIdentity,
-                listener);
+                listener,
+                sourceId,
+                fileIdentity);
     }
 
     private PolicyRunHandle submitForPrincipal(
             String billingPrincipal,
             String fileOwner,
+            String triggeringUser,
             String policyId,
             PipelineDefinition definition,
             PolicyInputs inputs,
-            String fileIdentity,
-            PolicyProgressListener listener) {
+            PolicyProgressListener listener,
+            String sourceId,
+            String fileIdentity) {
         // Scope the run id to the current user (this request thread) so the file-download
         // ownership check passes. No-op when security is off.
         String runId = jobOwnershipService.createScopedJobKey(UUID.randomUUID().toString());
@@ -193,7 +213,8 @@ public class PolicyEngine {
         if (policyId != null) {
             taskManager.putMetadata(runId, "policyId", policyId);
         }
-        PolicyRun run = new PolicyRun(runId, policyId, definition, fileIdentity);
+        PolicyRun run =
+                new PolicyRun(runId, policyId, definition, sourceId, fileIdentity, triggeringUser);
         registry.register(run);
         CompletableFuture<PolicyRun> completion = new CompletableFuture<>();
         PolicyProgressListener tracking = trackingListener(runId, run, listener);
@@ -358,8 +379,15 @@ public class PolicyEngine {
             taskManager.setError(run.getRunId(), message);
             // No exception to classify here: nothing was thrown by a tool, the run simply was not
             // admitted. Record it explicitly so a run lost to load pressure is still accounted for.
+            // Attributed like any other failure: a user whose run was refused is still the person
+            // holding that document, and an unattended sweep's run carries no triggering user.
             failureRecorder.recordRunFailureAs(
-                    FailureKind.UNKNOWN, run.getRunId(), run.getPolicyId(), null, message);
+                    FailureKind.UNKNOWN,
+                    run.getRunId(),
+                    run.getPolicyId(),
+                    run.getSourceId(),
+                    run.getTriggeringUser(),
+                    message);
             completion.complete(run);
         }
         return null;
@@ -368,13 +396,19 @@ public class PolicyEngine {
     /**
      * Record why a run failed. Called after the run's own state transition and task-manager update,
      * so a recording problem cannot change the outcome the caller observes.
+     *
+     * <p>The actor is the run's triggering user, not the MDC audit principal: that carries the
+     * BILLING identity, which for a stored policy is always its owner. Reading it here filed every
+     * failure under the owner — hiding an attended failure from the member who caused it and holds
+     * the document, and leaving an unattended sweep's failure looking attended.
      */
     private void recordFailure(PolicyRun run, String message, Throwable cause) {
         failureRecorder.recordRunFailure(
                 run.getRunId(),
                 run.getPolicyId(),
-                MDC.get(AUDIT_PRINCIPAL_MDC_KEY),
+                run.getSourceId(),
                 run.getFileIdentity(),
+                run.getTriggeringUser(),
                 message,
                 cause);
     }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunner.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunner.java
index 04dda0871e..b4609f94ea 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunner.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunner.java
@@ -79,7 +79,8 @@ public class PolicyRunner {
             // Generator pipeline: one run with no input. Still fall through to the cleanup
             // below so rows recorded for its folder outputs are pruned like anything else,
             // instead of accumulating until the policy is deleted.
-            runIds.add(startRun(policy, PolicyInputs.of(List.of()), null, unused -> {}));
+            // Generator pipeline: no input, so neither a source nor a document to attribute to.
+            runIds.add(startRun(policy, null, null, PolicyInputs.of(List.of()), unused -> {}));
         }
         for (PipelineInput input : inputs) {
             String sourceId = input.sourceId();
@@ -167,7 +168,13 @@ public class PolicyRunner {
         List<String> runIds = new ArrayList<>();
         long docsFed = 0;
         for (ResolvedInput unit : work) {
-            runIds.add(startRun(policy, unit.inputs(), unit.fileIdentity(), unit.onComplete()));
+            runIds.add(
+                    startRun(
+                            policy,
+                            sourceId,
+                            unit.fileIdentity(),
+                            unit.inputs(),
+                            unit.onComplete()));
             docsFed += unit.inputs().primary().size();
         }
         docCounter.record(sourceId, docsFed);
@@ -175,10 +182,15 @@ public class PolicyRunner {
     }
 
     private String startRun(
-            Policy policy, PolicyInputs inputs, String fileIdentity, Consumer<Boolean> onComplete) {
+            Policy policy,
+            String sourceId,
+            String fileIdentity,
+            PolicyInputs inputs,
+            Consumer<Boolean> onComplete) {
         log.info("Running policy {} ({})", policy.id(), policy.name());
         PolicyRunHandle handle =
-                policyEngine.runPolicy(policy, inputs, fileIdentity, PolicyProgressListener.NOOP);
+                policyEngine.runPolicy(
+                        policy, inputs, PolicyProgressListener.NOOP, sourceId, fileIdentity);
         handle.completion()
                 .whenComplete((run, throwable) -> onComplete.accept(succeeded(run, throwable)));
         return handle.runId();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PolicyRun.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PolicyRun.java
index 24a97f6c2a..8eb0cfcc73 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PolicyRun.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PolicyRun.java
@@ -21,6 +21,12 @@ public class PolicyRun {
     /** ID of the stored policy that produced this run; null for ad-hoc pipelines. */
     private final String policyId;
 
+    /**
+     * ID of the source the input came from (folder, S3, webhook), or null when a user supplied the
+     * files. Recorded on a failure so a reviewer can see where an unattended file came from.
+     */
+    private final String sourceId;
+
     private final PipelineDefinition definition;
 
     /**
@@ -29,6 +35,14 @@ public class PolicyRun {
      */
     private final String fileIdentity;
 
+    /**
+     * The user who triggered this run, or null when nothing attended it (a trigger-fired sweep).
+     * Recorded as a failure's actor, so an attended failure is handed to the person holding the
+     * document. Deliberately not the billing principal: a shared policy is billed to its owner, who
+     * may never have touched the file.
+     */
+    private final String triggeringUser;
+
     private final Instant createdAt = Instant.now();
 
     private volatile PolicyRunStatus status = PolicyRunStatus.PENDING;
@@ -56,12 +70,25 @@ public class PolicyRun {
     private volatile List<ResultFile> outputs = List.of();
     private volatile Instant updatedAt = Instant.now();
 
+    /**
+     * All three attribution references are required rather than defaulted: a run with none is a
+     * real case (an unattended sweep of a generator pipeline), but it should be stated at the call
+     * site. Overloads that omitted them would make losing the attribution the frictionless option,
+     * which is how {@code sourceId} and {@code fileIdentity} went unpopulated in the first place.
+     */
     public PolicyRun(
-            String runId, String policyId, PipelineDefinition definition, String fileIdentity) {
+            String runId,
+            String policyId,
+            PipelineDefinition definition,
+            String sourceId,
+            String fileIdentity,
+            String triggeringUser) {
         this.runId = runId;
         this.policyId = policyId;
+        this.sourceId = sourceId;
         this.definition = definition;
         this.fileIdentity = fileIdentity;
+        this.triggeringUser = triggeringUser;
     }
 
     public int stepCount() {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/network/SftpFileClient.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/network/SftpFileClient.java
index 5ecc29392d..d222e3be40 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/network/SftpFileClient.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/network/SftpFileClient.java
@@ -65,7 +65,7 @@ final class SftpFileClient implements RemoteFileClient {
             }
             Session session = jsch.getSession(config.username(), config.host(), config.port());
             if (config.password() != null) {
-                session.setPassword(config.password());
+                session.setPassword(config.password().getBytes(StandardCharsets.UTF_8));
             }
             if (config.hostKeyFingerprint() != null) {
                 // Pinned key: only the configured fingerprint is ever accepted.
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java
index 272917ec7f..b2be7b668e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java
@@ -20,23 +20,28 @@ import stirling.software.proprietary.policy.source.SourceStore;
 import stirling.software.proprietary.policy.store.PolicyStore;
 
 /**
- * Builds the Pipelines overview: every policy the caller's team owns, each annotated with its
- * referenced sources (resolved to display names), its pipeline steps, and a trigger/output summary.
- * Source names are resolved from the team's sources in memory rather than persisted on the policy,
- * so the view always reflects the live source set. This is the "all pipelines" admin surface; the
- * user-facing Policies page builds only a friendly subset of the same backend policies.
+ * Builds the Pipelines overview: one row per policy the caller's team built on the Pipelines page,
+ * with its sources resolved to live display names, its steps, and a trigger/output summary.
+ * Frontend/catalogue policies (marked by a {@code categoryId} in their output options) belong to
+ * the user-facing Policies page and are excluded; a folder-watch trigger is not a signal.
  */
 @Service
 @RequiredArgsConstructor
 public class PolicyOverviewService {
 
+    // Output-options key marking a frontend/catalogue policy (set by the Policies page and seeder).
+    private static final String CATEGORY_OPTION = "categoryId";
+
     private final PolicyStore policyStore;
     private final SourceStore sourceStore;
     private final PolicyAccessGuard policyAccessGuard;
     private final SourceAccessGuard sourceAccessGuard;
 
     public PoliciesOverviewResponse overview() {
-        List<Policy> policies = policyAccessGuard.visibleFrom(policyStore);
+        List<Policy> policies =
+                policyAccessGuard.visibleFrom(policyStore).stream()
+                        .filter(PolicyOverviewService::isPipeline)
+                        .toList();
         Map<String, String> sourceNames = sourceNames();
 
         List<PolicyView> views =
@@ -50,6 +55,18 @@ public class PolicyOverviewService {
         return new PoliciesOverviewResponse(buildKpis(policies), views);
     }
 
+    private static boolean isPipeline(Policy policy) {
+        return !isCataloguePolicy(policy);
+    }
+
+    /** A frontend/catalogue policy, marked by a {@code categoryId} in its output options. */
+    private static boolean isCataloguePolicy(Policy policy) {
+        OutputSpec output = policy.output();
+        return output != null
+                && output.options().get(CATEGORY_OPTION) instanceof String category
+                && !category.isBlank();
+    }
+
     /** Display names for every source the caller's team can see, keyed by source id. */
     private Map<String, String> sourceNames() {
         Map<String, String> names = new HashMap<>();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/PersistentLogin.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/PersistentLogin.java
index fe9c9f4209..312cddb662 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/PersistentLogin.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/PersistentLogin.java
@@ -1,17 +1,23 @@
 package stirling.software.proprietary.security.model;
 
 import java.time.Instant;
+import java.util.Objects;
+
+import org.hibernate.proxy.HibernateProxy;
 
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.Id;
 import jakarta.persistence.Table;
 
-import lombok.Data;
+import lombok.*;
 
 @Entity
 @Table(name = "persistent_logins")
-@Data
+@Getter
+@Setter
+@ToString(onlyExplicitlyIncluded = true)
+@NoArgsConstructor
 public class PersistentLogin {
 
     @Id
@@ -19,11 +25,40 @@ public class PersistentLogin {
     private String series;
 
     @Column(name = "username", length = 64, nullable = false)
+    @ToString.Include
     private String username;
 
     @Column(name = "token", length = 64, nullable = false)
     private String token;
 
     @Column(name = "last_used", nullable = false)
+    @ToString.Include
     private Instant lastUsed;
+
+    @Override
+    public final boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null) return false;
+        Class<?> oEffectiveClass =
+                o instanceof HibernateProxy
+                        ? ((HibernateProxy) o).getHibernateLazyInitializer().getPersistentClass()
+                        : o.getClass();
+        Class<?> thisEffectiveClass =
+                this instanceof HibernateProxy
+                        ? ((HibernateProxy) this).getHibernateLazyInitializer().getPersistentClass()
+                        : this.getClass();
+        if (thisEffectiveClass != oEffectiveClass) return false;
+        PersistentLogin that = (PersistentLogin) o;
+        return getSeries() != null && Objects.equals(getSeries(), that.getSeries());
+    }
+
+    @Override
+    public final int hashCode() {
+        return this instanceof HibernateProxy
+                ? ((HibernateProxy) this)
+                        .getHibernateLazyInitializer()
+                        .getPersistentClass()
+                        .hashCode()
+                : getClass().hashCode();
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/SessionEntity.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/SessionEntity.java
index 552d97d022..44b2153500 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/SessionEntity.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/SessionEntity.java
@@ -2,16 +2,22 @@ package stirling.software.proprietary.security.model;
 
 import java.io.Serializable;
 import java.time.Instant;
+import java.util.Objects;
+
+import org.hibernate.proxy.HibernateProxy;
 
 import jakarta.persistence.Entity;
 import jakarta.persistence.Id;
 import jakarta.persistence.Index;
 import jakarta.persistence.Table;
 
-import lombok.Data;
+import lombok.*;
 
 @Entity
-@Data
+@Getter
+@Setter
+@ToString
+@NoArgsConstructor
 @Table(
         name = "sessions",
         indexes = {
@@ -23,11 +29,42 @@ import lombok.Data;
             @Index(name = "idx_sessions_expired", columnList = "expired")
         })
 public class SessionEntity implements Serializable {
-    @Id private String sessionId;
+    @Id
+    @Setter(AccessLevel.NONE)
+    private String sessionId;
 
     private String principalName;
 
     private Instant lastRequest;
 
     private boolean expired;
+
+    public void setSessionId(String sessionId) {
+        if (this.sessionId != null && !this.sessionId.equals(sessionId)) {
+            throw new IllegalStateException("sessionId is immutable once set");
+        }
+        this.sessionId = sessionId;
+    }
+
+    @Override
+    public final boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null) return false;
+        Class<?> oEffectiveClass =
+                o instanceof HibernateProxy
+                        ? ((HibernateProxy) o).getHibernateLazyInitializer().getPersistentClass()
+                        : o.getClass();
+        Class<?> thisEffectiveClass =
+                this instanceof HibernateProxy
+                        ? ((HibernateProxy) this).getHibernateLazyInitializer().getPersistentClass()
+                        : this.getClass();
+        if (thisEffectiveClass != oEffectiveClass) return false;
+        SessionEntity that = (SessionEntity) o;
+        return getSessionId() != null && Objects.equals(getSessionId(), that.getSessionId());
+    }
+
+    @Override
+    public final int hashCode() {
+        return getSessionId() != null ? getSessionId().hashCode() : getClass().hashCode();
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java
index 32733f5fc5..9455ed6e4b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java
@@ -2,27 +2,19 @@ package stirling.software.proprietary.security.model;
 
 import java.io.Serializable;
 import java.time.LocalDateTime;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Locale;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
+import java.util.*;
 import java.util.stream.Collectors;
 
 import org.hibernate.annotations.CreationTimestamp;
 import org.hibernate.annotations.UpdateTimestamp;
+import org.hibernate.proxy.HibernateProxy;
 import org.springframework.security.core.userdetails.UserDetails;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 
 import jakarta.persistence.*;
 
-import lombok.EqualsAndHashCode;
-import lombok.Getter;
-import lombok.NoArgsConstructor;
-import lombok.Setter;
-import lombok.ToString;
+import lombok.*;
 
 import stirling.software.common.model.enumeration.Role;
 import stirling.software.proprietary.model.Team;
@@ -35,7 +27,6 @@ import stirling.software.proprietary.model.Team;
 @NoArgsConstructor
 @Getter
 @Setter
-@EqualsAndHashCode(onlyExplicitlyIncluded = true)
 @ToString(onlyExplicitlyIncluded = true)
 public class User implements UserDetails, Serializable {
 
@@ -44,7 +35,6 @@ public class User implements UserDetails, Serializable {
     @Id
     @GeneratedValue(strategy = GenerationType.IDENTITY)
     @Column(name = "user_id")
-    @EqualsAndHashCode.Include
     private Long id;
 
     @Column(name = "username", unique = true)
@@ -181,4 +171,31 @@ public class User implements UserDetails, Serializable {
     public void setOauthGrandfathered(boolean oauthGrandfathered) {
         this.oauthGrandfathered = oauthGrandfathered;
     }
+
+    @Override
+    public final boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null) return false;
+        Class<?> oEffectiveClass =
+                o instanceof HibernateProxy
+                        ? ((HibernateProxy) o).getHibernateLazyInitializer().getPersistentClass()
+                        : o.getClass();
+        Class<?> thisEffectiveClass =
+                this instanceof HibernateProxy
+                        ? ((HibernateProxy) this).getHibernateLazyInitializer().getPersistentClass()
+                        : this.getClass();
+        if (thisEffectiveClass != oEffectiveClass) return false;
+        User user = (User) o;
+        return getId() != null && Objects.equals(getId(), user.getId());
+    }
+
+    @Override
+    public final int hashCode() {
+        return this instanceof HibernateProxy
+                ? ((HibernateProxy) this)
+                        .getHibernateLazyInitializer()
+                        .getPersistentClass()
+                        .hashCode()
+                : getClass().hashCode();
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/workflow/model/UserServerCertificateEntity.java b/app/proprietary/src/main/java/stirling/software/proprietary/workflow/model/UserServerCertificateEntity.java
index 0ad30a3bf7..aef781dd9b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/workflow/model/UserServerCertificateEntity.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/workflow/model/UserServerCertificateEntity.java
@@ -2,9 +2,11 @@ package stirling.software.proprietary.workflow.model;
 
 import java.io.Serializable;
 import java.time.LocalDateTime;
+import java.util.Objects;
 
 import org.hibernate.annotations.CreationTimestamp;
 import org.hibernate.annotations.UpdateTimestamp;
+import org.hibernate.proxy.HibernateProxy;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 
@@ -19,7 +21,6 @@ import stirling.software.proprietary.security.model.User;
 @NoArgsConstructor
 @Getter
 @Setter
-@EqualsAndHashCode(onlyExplicitlyIncluded = true)
 @ToString(onlyExplicitlyIncluded = true)
 public class UserServerCertificateEntity implements Serializable {
 
@@ -28,7 +29,6 @@ public class UserServerCertificateEntity implements Serializable {
     @Id
     @GeneratedValue(strategy = GenerationType.IDENTITY)
     @Column(name = "id")
-    @EqualsAndHashCode.Include
     @ToString.Include
     private Long id;
 
@@ -70,4 +70,31 @@ public class UserServerCertificateEntity implements Serializable {
     @UpdateTimestamp
     @Column(name = "updated_at")
     private LocalDateTime updatedAt;
+
+    @Override
+    public final boolean equals(Object o) {
+        if (this == o) return true;
+        if (o == null) return false;
+        Class<?> oEffectiveClass =
+                o instanceof HibernateProxy
+                        ? ((HibernateProxy) o).getHibernateLazyInitializer().getPersistentClass()
+                        : o.getClass();
+        Class<?> thisEffectiveClass =
+                this instanceof HibernateProxy
+                        ? ((HibernateProxy) this).getHibernateLazyInitializer().getPersistentClass()
+                        : this.getClass();
+        if (thisEffectiveClass != oEffectiveClass) return false;
+        UserServerCertificateEntity that = (UserServerCertificateEntity) o;
+        return getId() != null && Objects.equals(getId(), that.getId());
+    }
+
+    @Override
+    public final int hashCode() {
+        return this instanceof HibernateProxy
+                ? ((HibernateProxy) this)
+                        .getHibernateLazyInitializer()
+                        .getPersistentClass()
+                        .hashCode()
+                : getClass().hashCode();
+    }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminJobControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminJobControllerTest.java
new file mode 100644
index 0000000000..95d2e097cf
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminJobControllerTest.java
@@ -0,0 +1,89 @@
+package stirling.software.proprietary.controller.api;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.*;
+
+import java.util.Map;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+
+import stirling.software.common.service.JobQueue;
+import stirling.software.common.service.TaskManager;
+
+/**
+ * The admin sweep covers every user's jobs, so it must stay distinct from the self-service endpoint
+ * on JobController - and both must run the same TaskManager sweep rather than each growing their
+ * own cleanup logic.
+ */
+class AdminJobControllerTest {
+
+    @Mock private TaskManager taskManager;
+    @Mock private JobQueue jobQueue;
+
+    @InjectMocks private AdminJobController controller;
+
+    private AutoCloseable closeable;
+
+    @BeforeEach
+    void setUp() {
+        closeable = MockitoAnnotations.openMocks(this);
+    }
+
+    @Test
+    void cleanupWithoutForceRunsTheRetentionSweep() throws Exception {
+        when(taskManager.cleanupOldJobs()).thenReturn(new TaskManager.CleanupSummary(2, 4, 3));
+
+        ResponseEntity<?> response = controller.cleanupOldJobs(false);
+
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        @SuppressWarnings("unchecked")
+        Map<String, Object> body = (Map<String, Object>) response.getBody();
+        assertEquals(2, body.get("removedJobs"));
+        assertEquals(4, body.get("filesDeleted"));
+        assertEquals(3, body.get("remainingJobs"));
+        verify(taskManager).cleanupOldJobs();
+        verify(taskManager, never()).cleanupFinishedJobsNow(any());
+        closeable.close();
+    }
+
+    @Test
+    void cleanupWithForceIgnoresTheRetentionWindow() throws Exception {
+        when(taskManager.cleanupFinishedJobsNow(any()))
+                .thenReturn(new TaskManager.CleanupSummary(5, 9, 0));
+
+        ResponseEntity<?> response = controller.cleanupOldJobs(true);
+
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        @SuppressWarnings("unchecked")
+        Map<String, Object> body = (Map<String, Object>) response.getBody();
+        assertEquals(5, body.get("removedJobs"));
+        assertEquals(9, body.get("filesDeleted"));
+        verify(taskManager).cleanupFinishedJobsNow(any());
+        verify(taskManager, never()).cleanupOldJobs();
+        closeable.close();
+    }
+
+    @Test
+    void forcedAdminCleanupSweepsEveryUsersJobs() throws Exception {
+        when(taskManager.cleanupFinishedJobsNow(any()))
+                .thenReturn(new TaskManager.CleanupSummary(1, 1, 0));
+
+        controller.cleanupOldJobs(true);
+
+        @SuppressWarnings("unchecked")
+        org.mockito.ArgumentCaptor<java.util.function.Predicate<String>> filter =
+                org.mockito.ArgumentCaptor.forClass(java.util.function.Predicate.class);
+        verify(taskManager).cleanupFinishedJobsNow(filter.capture());
+        // Unlike the self-service endpoint, the admin sweep is not scoped to one caller.
+        assertTrue(filter.getValue().test("alice:job"));
+        assertTrue(filter.getValue().test("bob:job"));
+        closeable.close();
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FailureKindTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FailureKindTest.java
index 1a1b1a1599..a9baf5288f 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FailureKindTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FailureKindTest.java
@@ -182,10 +182,10 @@ class FailureKindTest {
     class Unknown {
 
         @Test
-        void existsAndCanBeTriaged() {
-            assertThat(FailureKind.UNKNOWN.getActions())
-                    .containsExactlyInAnyOrder(
-                            FailureActionId.ACKNOWLEDGE, FailureActionId.DISMISS);
+        void offersOnlyTheActionThatClearsIt() {
+            // Nothing here can be fixed, so "seen it" and "clear it" would be the same decision.
+            // Offering both just asks the reviewer to press two buttons to reach one outcome.
+            assertThat(FailureKind.UNKNOWN.getActions()).containsExactly(FailureActionId.DISMISS);
         }
 
         @Test
@@ -233,8 +233,14 @@ class FailureKindTest {
 
         @Test
         void declaresOnlyWhatItLists() {
-            assertThat(FailureKind.UNKNOWN.declares(FailureActionId.ACKNOWLEDGE)).isTrue();
             assertThat(FailureKind.UNKNOWN.declares(FailureActionId.DISMISS)).isTrue();
+            assertThat(FailureKind.UNKNOWN.declares(FailureActionId.ACKNOWLEDGE)).isFalse();
+        }
+
+        @Test
+        void aKindWithSomethingToFixOffersTheFixAndAWayToSkipIt() {
+            assertThat(FailureKind.INPUT_PASSWORD_PROTECTED.getActions())
+                    .containsExactly(FailureActionId.ACKNOWLEDGE, FailureActionId.DISMISS);
         }
 
         @Test
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventControllerTest.java
index a4b830d0f8..58b8d1b408 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventControllerTest.java
@@ -51,9 +51,7 @@ class FileRunEventControllerTest {
                         List.of(new AcknowledgeAction(store), new DismissAction(store)));
         controller =
                 new FileRunEventController(
-                        new FileRunEventService(store, registry, authority, userService, props),
-                        authority,
-                        props);
+                        new FileRunEventService(store, registry, authority, userService, props));
 
         lenient().when(authority.canEditPolicies()).thenReturn(true);
         lenient().when(authority.currentUserTeamId()).thenReturn(TEAM);
@@ -61,19 +59,46 @@ class FileRunEventControllerTest {
     }
 
     private FileRunEvent given(FailureKind kind, Long teamId, String fileId) {
+        return recorded("author@example.com", kind, teamId, fileId, "run-1");
+    }
+
+    /**
+     * As {@link #given} but naming who hit it, in its own run. A RUN-scoped kind keys on the run,
+     * so two rows sharing one run id are one incident, however they differ otherwise.
+     */
+    private FileRunEvent givenHitBy(String actor, FailureKind kind, Long teamId, String fileId) {
+        return recorded(actor, kind, teamId, fileId, "run-" + fileId);
+    }
+
+    private FileRunEvent recorded(
+            String actor, FailureKind kind, Long teamId, String fileId, String runId) {
         return store.record(
                 new RecordFailure(
                         kind,
                         FailureOrigin.POLICY,
                         teamId,
-                        "author@example.com",
+                        actor,
                         "policy-1",
-                        "run-1",
+                        runId,
                         null,
                         fileId,
                         "the raw failure message"));
     }
 
+    private static List<String> fileIds(int count) {
+        return java.util.stream.IntStream.range(0, count).mapToObj(i -> "f-" + i).toList();
+    }
+
+    /** The status a refused call came back with. Fails the test if the call was allowed. */
+    private HttpStatus statusOf(Runnable call) {
+        try {
+            call.run();
+        } catch (ResponseStatusException e) {
+            return HttpStatus.valueOf(e.getStatusCode().value());
+        }
+        throw new AssertionError("expected the call to be refused");
+    }
+
     @Nested
     @DisplayName("listing")
     class Listing {
@@ -117,6 +142,7 @@ class FileRunEventControllerTest {
 
         @Test
         void showsAClosedRowsActionsDisabledWithAReasonRatherThanHidingThem() {
+            // Only visible by asking for the closed status: the default queue drops it.
             FileRunEvent event = given(FailureKind.UNKNOWN, TEAM, "f1");
             controller.act(event.id(), "DISMISS", null);
 
@@ -134,15 +160,16 @@ class FileRunEventControllerTest {
 
         @Test
         void filtersByStatusAndByKind() {
-            FileRunEvent open = given(FailureKind.UNKNOWN, TEAM, "open");
-            given(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "locked");
-            controller.act(open.id(), "ACKNOWLEDGE", null);
+            FileRunEvent locked = given(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "locked");
+            given(FailureKind.UNKNOWN, TEAM, "open");
+            controller.act(locked.id(), "ACKNOWLEDGE", null);
 
             assertThat(controller.list(FileRunEventStatus.ACKNOWLEDGED, null, null).events())
                     .hasSize(1);
             assertThat(controller.list(null, "INPUT_PASSWORD_PROTECTED", null).events())
                     .extracting(FileRunEventView::fileId)
                     .containsExactly("locked");
+            // Acknowledged is still open work, so it stays in the default queue.
             assertThat(controller.list(null, "NO_SUCH_KIND", null).events()).isEmpty();
         }
 
@@ -182,7 +209,7 @@ class FileRunEventControllerTest {
 
         @Test
         void appliesADeclaredActionAndReturnsTheUpdatedRow() {
-            FileRunEvent event = given(FailureKind.UNKNOWN, TEAM, "f1");
+            FileRunEvent event = given(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "f1");
 
             FileRunEventView updated = controller.act(event.id(), "ACKNOWLEDGE", null);
 
@@ -218,21 +245,12 @@ class FileRunEventControllerTest {
         @Test
         void anAlreadyClosedRowIsAConflict() {
             // The request was well formed and would have been valid a moment earlier.
-            FileRunEvent event = given(FailureKind.UNKNOWN, TEAM, "f1");
+            FileRunEvent event = given(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "f1");
             controller.act(event.id(), "DISMISS", null);
 
             assertThat(statusOf(() -> controller.act(event.id(), "ACKNOWLEDGE", null)))
                     .isEqualTo(HttpStatus.CONFLICT);
         }
-
-        private HttpStatus statusOf(Runnable call) {
-            try {
-                call.run();
-            } catch (ResponseStatusException e) {
-                return HttpStatus.valueOf(e.getStatusCode().value());
-            }
-            throw new AssertionError("expected the call to be refused");
-        }
     }
 
     @Nested
@@ -274,48 +292,68 @@ class FileRunEventControllerTest {
     }
 
     @Nested
-    @DisplayName("only a team leader may review failures")
+    @DisplayName("a leader reviews the team's failures, everyone else their own")
     class Authorization {
 
         @Test
-        void aMemberCannotListThem() {
+        void aMemberSeesTheirOwnFailuresAndNobodyElses() {
+            // A member can report a failure, so they get to see it back. It must not widen to a
+            // colleague's.
+            givenHitBy("reviewer@example.com", FailureKind.UNKNOWN, TEAM, "mine");
+            givenHitBy("colleague@example.com", FailureKind.UNKNOWN, TEAM, "theirs");
             when(authority.canEditPolicies()).thenReturn(false);
 
-            assertThatThrownBy(() -> controller.list(null, null, null))
-                    .isInstanceOf(ResponseStatusException.class)
-                    .satisfies(
-                            e ->
-                                    assertThat(((ResponseStatusException) e).getStatusCode())
-                                            .isEqualTo(HttpStatus.FORBIDDEN));
+            assertThat(controller.list(null, null, null).events())
+                    .extracting(FileRunEventView::fileId)
+                    .containsExactly("mine");
         }
 
         @Test
-        void aMemberCannotDispatchAnAction() {
-            // The read being refused is not enough on its own: an id learned any other way must
-            // not let a member close another user's failure.
-            FileRunEvent event = given(FailureKind.UNKNOWN, TEAM, "f-1");
-            when(authority.canEditPolicies()).thenReturn(false);
+        void aLeaderSeesTheWholeTeams() {
+            givenHitBy("reviewer@example.com", FailureKind.UNKNOWN, TEAM, "mine");
+            givenHitBy("colleague@example.com", FailureKind.UNKNOWN, TEAM, "theirs");
+            when(authority.canEditPolicies()).thenReturn(true);
 
-            assertThatThrownBy(() -> controller.act(event.id(), "DISMISS", null))
-                    .isInstanceOf(ResponseStatusException.class)
-                    .satisfies(
-                            e ->
-                                    assertThat(((ResponseStatusException) e).getStatusCode())
-                                            .isEqualTo(HttpStatus.FORBIDDEN));
+            assertThat(controller.list(null, null, null).events())
+                    .extracting(FileRunEventView::fileId)
+                    .containsExactlyInAnyOrder("mine", "theirs");
         }
 
         @Test
-        void theRegistryIsAlsoLeaderOnly() {
+        void aMemberMayCloseTheirOwn() {
+            // Someone who fixes their own problem should not have to ask a leader to clear the row.
+            FileRunEvent mine =
+                    givenHitBy("reviewer@example.com", FailureKind.UNKNOWN, TEAM, "mine");
             when(authority.canEditPolicies()).thenReturn(false);
 
-            assertThatThrownBy(() -> controller.kinds())
-                    .isInstanceOf(ResponseStatusException.class);
+            assertThat(controller.act(mine.id(), "DISMISS", null).status())
+                    .isEqualTo(FileRunEventStatus.DISMISSED);
+        }
+
+        @Test
+        void aMemberCannotCloseAColleaguesEvenKnowingTheId() {
+            // Refusing the read is not enough on its own: an id learned any other way must not work
+            // either. Answered as not-found rather than forbidden, so trying does not confirm the
+            // row exists.
+            FileRunEvent theirs =
+                    givenHitBy("colleague@example.com", FailureKind.UNKNOWN, TEAM, "theirs");
+            when(authority.canEditPolicies()).thenReturn(false);
+
+            assertThat(statusOf(() -> controller.act(theirs.id(), "DISMISS", null)))
+                    .isEqualTo(HttpStatus.NOT_FOUND);
+        }
+
+        @Test
+        void theRegistryIsOpenBecauseItIsCopyNotData() {
+            // A member renders the failures they can see, so they need the labels for them. No role
+            // stub: the point is that kinds() never asks.
+            assertThat(controller.kinds()).isNotEmpty();
         }
 
         @Test
         void loginDisabledTrustsTheLocalOperator() {
-            // A single-user deployment has no roles to distinguish, so the role gate must not lock
-            // the only user out of their own failures.
+            // A single-user deployment has no roles to distinguish, so the narrowing must not leave
+            // the only user reading nothing.
             ApplicationProperties unsecured = new ApplicationProperties();
             unsecured.getSecurity().setEnableLogin(false);
             FileRunEventController noLogin =
@@ -328,9 +366,7 @@ class FileRunEventControllerTest {
                                                     new DismissAction(store))),
                                     authority,
                                     userService,
-                                    unsecured),
-                            authority,
-                            unsecured);
+                                    unsecured));
 
             assertThatCode(() -> noLogin.list(null, null, null)).doesNotThrowAnyException();
             // Not merely permitted: the role is never consulted at all, which is what makes the
@@ -375,9 +411,7 @@ class FileRunEventControllerTest {
                                                     new DismissAction(store))),
                                     authority,
                                     userService,
-                                    unsecured),
-                            authority,
-                            unsecured);
+                                    unsecured));
             given(FailureKind.UNKNOWN, null, "unteamed");
             given(FailureKind.UNKNOWN, TEAM, "teamed");
 
@@ -387,6 +421,109 @@ class FileRunEventControllerTest {
         }
     }
 
+    @Nested
+    @DisplayName("reporting from the editor")
+    class Reporting {
+
+        @Test
+        void aMemberMayReportAndThenSeeTheirOwnReport() {
+            // Reporting was always open to a member; reading their own back is the round trip that
+            // makes the report worth anything to them.
+            when(authority.canEditPolicies()).thenReturn(false);
+
+            assertThatCode(
+                            () ->
+                                    controller.report(
+                                            new EditorFailureReport(
+                                                    "compress", "E004", List.of("f-1"), "boom")))
+                    .doesNotThrowAnyException();
+            assertThat(controller.list(null, null, null).events())
+                    .extracting(FileRunEventView::fileId)
+                    .containsExactly("f-1");
+        }
+
+        @Test
+        void answersWithNoContentSoTheEditorNeverWaitsOnABody() {
+            EditorFailureReport report =
+                    new EditorFailureReport("compress", "E004", List.of("f-1"), "boom");
+
+            assertThat(controller.report(report).getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
+        }
+
+        @Test
+        void rejectsAReportWithNoOperation() {
+            assertThat(
+                            statusOf(
+                                    () ->
+                                            controller.report(
+                                                    new EditorFailureReport(
+                                                            " ", "E004", List.of("f-1"), "boom"))))
+                    .isEqualTo(HttpStatus.BAD_REQUEST);
+        }
+
+        @Test
+        void acceptsAReportAtTheFileLimitAndRecordsEveryRow() {
+            List<String> atLimit = fileIds(EditorFailureReport.MAX_FILE_IDS);
+
+            EditorFailureReport report =
+                    new EditorFailureReport("compress", "E004", atLimit, "boom");
+
+            assertThat(controller.report(report).getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
+            assertThat(store.list(TEAM, null, null, null, EditorFailureReport.MAX_FILE_IDS + 10))
+                    .hasSize(EditorFailureReport.MAX_FILE_IDS);
+        }
+
+        @Test
+        void refusesAReportOverTheFileLimitAndRecordsNothing() {
+            // One call used to be able to mint an unbounded number of permanent incidents, since
+            // each named file gets its own row and TOOL dedup keys never fold across ids. Refused
+            // rather than trimmed so nothing is lost silently, and refused before the first write
+            // so a rejected report cannot leave a partial set behind either.
+            List<String> overLimit = fileIds(EditorFailureReport.MAX_FILE_IDS + 1);
+
+            assertThat(
+                            statusOf(
+                                    () ->
+                                            controller.report(
+                                                    new EditorFailureReport(
+                                                            "compress",
+                                                            "E004",
+                                                            overLimit,
+                                                            "boom"))))
+                    .isEqualTo(HttpStatus.BAD_REQUEST);
+            assertThat(store.list(TEAM, null, null, null, EditorFailureReport.MAX_FILE_IDS + 10))
+                    .isEmpty();
+        }
+
+        @Test
+        void saysWhatTheLimitIsSoAClientAuthorCanSeeWhatHappened() {
+            // The editor reports in the background, so the message is the only place this surfaces.
+            assertThatThrownBy(
+                            () ->
+                                    controller.report(
+                                            new EditorFailureReport(
+                                                    "compress",
+                                                    "E004",
+                                                    fileIds(EditorFailureReport.MAX_FILE_IDS + 1),
+                                                    "boom")))
+                    .isInstanceOf(ResponseStatusException.class)
+                    .hasMessageContaining(String.valueOf(EditorFailureReport.MAX_FILE_IDS));
+        }
+
+        @Test
+        void theReportHasNoTeamOrFileNameToSupply() {
+            // Stated as a test because the absence of those fields is the property. Adding either
+            // to
+            // EditorFailureReport breaks this at compile time.
+            List<String> components =
+                    java.util.Arrays.stream(EditorFailureReport.class.getRecordComponents())
+                            .map(java.lang.reflect.RecordComponent::getName)
+                            .toList();
+
+            assertThat(components).containsExactly("operation", "errorCode", "fileIds", "detail");
+        }
+    }
+
     @Nested
     @DisplayName("action request body")
     class RequestBody {
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventHttpIntegrationTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventHttpIntegrationTest.java
index 3537c9e06c..375e46f4ad 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventHttpIntegrationTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventHttpIntegrationTest.java
@@ -152,9 +152,9 @@ class FileRunEventHttpIntegrationTest {
 
         @Test
         void coercesQueryParametersAndFiltersOnThem() throws Exception {
-            String open = seed(FailureKind.UNKNOWN, TEAM, "open", "a");
-            seed(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "locked", "b");
-            post("/api/v1/file-run-events/" + open + "/actions/ACKNOWLEDGE", "{\"inputs\":{}}");
+            String locked = seed(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "locked", "b");
+            seed(FailureKind.UNKNOWN, TEAM, "open", "a");
+            post("/api/v1/file-run-events/" + locked + "/actions/ACKNOWLEDGE", "{\"inputs\":{}}");
 
             JsonNode acknowledged =
                     mapper.readTree(get("/api/v1/file-run-events?status=ACKNOWLEDGED").body())
@@ -189,6 +189,75 @@ class FileRunEventHttpIntegrationTest {
         }
     }
 
+    @Nested
+    @DisplayName("reporting from the editor")
+    class Reporting {
+
+        @Test
+        void bindsAReportBodyAndAnswersNoContent() throws Exception {
+            HttpResponse<String> response =
+                    post(
+                            "/api/v1/file-run-events/reports",
+                            "{\"operation\":\"remove-password\",\"errorCode\":\"E004\","
+                                    + "\"fileIds\":[\"f-1\",\"f-2\"],\"detail\":\"locked\"}");
+
+            assertThat(response.statusCode()).isEqualTo(204);
+            assertThat(response.body()).isEmpty();
+
+            JsonNode events = mapper.readTree(get("/api/v1/file-run-events").body()).get("events");
+            assertThat(events).hasSize(2);
+            assertThat(events.get(0).get("origin").asString()).isEqualTo("TOOL");
+            assertThat(events.get(0).get("kindId").asString())
+                    .isEqualTo("INPUT_PASSWORD_PROTECTED");
+        }
+
+        @Test
+        void acceptsAReportWithNoCodeOrFiles() throws Exception {
+            HttpResponse<String> response =
+                    post(
+                            "/api/v1/file-run-events/reports",
+                            "{\"operation\":\"compress\",\"detail\":\"network died\"}");
+
+            assertThat(response.statusCode()).isEqualTo(204);
+            JsonNode events = mapper.readTree(get("/api/v1/file-run-events").body()).get("events");
+            assertThat(events).hasSize(1);
+            assertThat(events.get(0).get("kindId").asString()).isEqualTo("UNKNOWN");
+            assertThat(events.get(0).get("fileId").isNull()).isTrue();
+        }
+
+        @Test
+        void rejectsAReportWithNoOperation() throws Exception {
+            assertThat(
+                            post(
+                                            "/api/v1/file-run-events/reports",
+                                            "{\"errorCode\":\"E004\",\"detail\":\"boom\"}")
+                                    .statusCode())
+                    .isEqualTo(400);
+        }
+
+        @Test
+        void rejectsAnOversizedReportWithoutRecordingAnyOfIt() throws Exception {
+            // Over the wire because that is where the flood would arrive: one request, an
+            // arbitrarily long fileIds array, a permanent row per entry. The read-back is the point
+            // of the test, since a partial write would be worse than either accepting or refusing.
+            String ids =
+                    java.util.stream.IntStream.range(0, EditorFailureReport.MAX_FILE_IDS + 1)
+                            .mapToObj(i -> "\"f-" + i + "\"")
+                            .collect(java.util.stream.Collectors.joining(","));
+
+            HttpResponse<String> response =
+                    post(
+                            "/api/v1/file-run-events/reports",
+                            "{\"operation\":\"compress\",\"errorCode\":\"E004\",\"fileIds\":["
+                                    + ids
+                                    + "],\"detail\":\"boom\"}");
+
+            assertThat(response.statusCode()).isEqualTo(400);
+            assertThat(mapper.readTree(get("/api/v1/file-run-events").body()).get("events"))
+                    .isEmpty();
+        }
+    }
+
     @Nested
     @DisplayName("action dispatch")
     class Dispatch {
@@ -197,7 +266,7 @@ class FileRunEventHttpIntegrationTest {
         void bindsTheRequestBodyAndReturnsTheUpdatedRow() throws Exception {
             // The regression guard: an object body, sent as real JSON over the wire, binding into
             // ActionRequest. A double-encoded string would fail here.
-            String id = seed(FailureKind.UNKNOWN, TEAM, "f1", "boom");
+            String id = seed(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "f1", "boom");
 
             HttpResponse<String> response =
                     post(
@@ -262,7 +331,7 @@ class FileRunEventHttpIntegrationTest {
 
         @Test
         void mapsAnAlreadyClosedRowToConflict() throws Exception {
-            String id = seed(FailureKind.UNKNOWN, TEAM, "f1", "boom");
+            String id = seed(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "f1", "boom");
             post("/api/v1/file-run-events/" + id + "/actions/DISMISS", "{\"inputs\":{}}");
 
             assertThat(
@@ -369,11 +438,8 @@ class FileRunEventHttpIntegrationTest {
         }
 
         @Bean
-        FileRunEventController fileRunEventController(
-                FileRunEventService service,
-                PolicyManagementAuthority authority,
-                ApplicationProperties props) {
-            return new FileRunEventController(service, authority, props);
+        FileRunEventController fileRunEventController(FileRunEventService service) {
+            return new FileRunEventController(service);
         }
     }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventServiceTest.java
index cd75c181c5..4e6508bed9 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventServiceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventServiceTest.java
@@ -54,6 +54,9 @@ class FileRunEventServiceTest {
 
         lenient().when(authority.currentUserTeamId()).thenReturn(TEAM);
         lenient().when(userService.getCurrentUsername()).thenReturn(ACTOR);
+        // A leader unless a test says otherwise: most of these are about team scoping, which is
+        // what a leader sees. The member narrowing has its own tests.
+        lenient().when(authority.canEditPolicies()).thenReturn(true);
     }
 
     private FileRunEvent given(FailureKind kind, Long teamId, String fileId) {
@@ -76,7 +79,7 @@ class FileRunEventServiceTest {
 
         @Test
         void movesANewEventToAcknowledgedAndStampsTheActor() {
-            FileRunEvent event = given(FailureKind.UNKNOWN, TEAM, "f1");
+            FileRunEvent event = given(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "f1");
 
             FileRunEvent updated = service.dispatch(event.id(), "ACKNOWLEDGE", Map.of());
 
@@ -87,7 +90,7 @@ class FileRunEventServiceTest {
 
         @Test
         void isANoOpWhenAlreadyAcknowledgedSoOwnershipIsNotStolen() {
-            FileRunEvent event = given(FailureKind.UNKNOWN, TEAM, "f1");
+            FileRunEvent event = given(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "f1");
             FileRunEvent first = service.dispatch(event.id(), "ACKNOWLEDGE", Map.of());
             Instant originalAt = first.statusAt();
 
@@ -114,7 +117,7 @@ class FileRunEventServiceTest {
 
         @Test
         void closesAnAcknowledgedEvent() {
-            FileRunEvent event = given(FailureKind.UNKNOWN, TEAM, "f1");
+            FileRunEvent event = given(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "f1");
             service.dispatch(event.id(), "ACKNOWLEDGE", Map.of());
 
             assertThat(service.dispatch(event.id(), "DISMISS", Map.of()).status())
@@ -225,7 +228,7 @@ class FileRunEventServiceTest {
 
         @Test
         void aClosedEventCannotBeActedOnAgain() {
-            FileRunEvent event = given(FailureKind.UNKNOWN, TEAM, "f1");
+            FileRunEvent event = given(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "f1");
             service.dispatch(event.id(), "DISMISS", Map.of());
 
             assertThatThrownBy(() -> service.dispatch(event.id(), "ACKNOWLEDGE", Map.of()))
@@ -286,13 +289,12 @@ class FileRunEventServiceTest {
 
             assertThat(service.availableActions(event))
                     .extracting(FileRunEventService.AvailableAction::labelKey)
-                    .containsExactlyInAnyOrder(
-                            "portal.failures.action.acknowledge", "portal.failures.action.dismiss");
+                    .containsExactly("portal.failures.action.dismiss");
         }
     }
 
     @Nested
-    @DisplayName("team scoping")
+    @DisplayName("read scoping")
     class Scoping {
 
         @Test
@@ -305,6 +307,68 @@ class FileRunEventServiceTest {
                     .containsExactly("mine");
         }
 
+        @Test
+        void aMemberReadsOnlyTheFailuresTheyCaused() {
+            // Reporting is open to a member, so reading their own back is what lets us tell them
+            // anything at all. A colleague's must not come with it.
+            store.record(RecordFailure.forEditor(FailureKind.UNKNOWN, TEAM, ACTOR, "mine", "boom"));
+            store.record(
+                    RecordFailure.forEditor(
+                            FailureKind.UNKNOWN, TEAM, "colleague@example.com", "theirs", "boom"));
+            when(authority.canEditPolicies()).thenReturn(false);
+
+            assertThat(service.list(null, null, 50))
+                    .extracting(FileRunEvent::fileId)
+                    .containsExactly("mine");
+        }
+
+        @Test
+        void aMemberWithNoResolvableNameReadsNothingRatherThanEverything() {
+            // Narrowing to "mine" needs a name to narrow by. Dropping the filter would hand the
+            // whole team to someone who may not have it.
+            given(FailureKind.UNKNOWN, TEAM, "mine");
+            when(authority.canEditPolicies()).thenReturn(false);
+            when(userService.getCurrentUsername()).thenReturn(null);
+
+            assertThat(service.list(null, null, 50)).isEmpty();
+        }
+
+        @Test
+        void aMemberCannotActOnAColleaguesRowEvenKnowingItsId() {
+            // Refusing the read is not enough on its own: an id learned any other way must not work
+            // either. Reported as not-found, so trying does not confirm the row exists.
+            FileRunEvent theirs =
+                    store.record(
+                            RecordFailure.forEditor(
+                                    FailureKind.UNKNOWN,
+                                    TEAM,
+                                    "colleague@example.com",
+                                    "theirs",
+                                    "boom"));
+            when(authority.canEditPolicies()).thenReturn(false);
+
+            assertThatThrownBy(() -> service.dispatch(theirs.id(), "DISMISS", Map.of()))
+                    .isInstanceOf(FailureActionException.class)
+                    .extracting(e -> ((FailureActionException) e).getReason())
+                    .isEqualTo(FailureActionException.Reason.EVENT_NOT_FOUND);
+
+            assertThat(store.find(theirs.id(), TEAM).orElseThrow().status())
+                    .isEqualTo(FileRunEventStatus.NEW);
+        }
+
+        @Test
+        void aMemberMayCloseTheirOwn() {
+            // Someone who fixes their own problem should not have to ask a leader to clear the row.
+            FileRunEvent mine =
+                    store.record(
+                            RecordFailure.forEditor(
+                                    FailureKind.UNKNOWN, TEAM, ACTOR, "mine", "boom"));
+            when(authority.canEditPolicies()).thenReturn(false);
+
+            assertThat(service.dispatch(mine.id(), "DISMISS", Map.of()).status())
+                    .isEqualTo(FileRunEventStatus.DISMISSED);
+        }
+
         @Test
         void aCallerWhoseTeamCannotBeResolvedReadsNothing() {
             // A run with no stored policy is recorded unteamed, and those rows are shared by every
@@ -390,4 +454,272 @@ class FileRunEventServiceTest {
             }
         }
     }
+
+    @Nested
+    @DisplayName("reporting a failure the user hit in the editor")
+    class Reporting {
+
+        @Test
+        void classifiesTheReportedCodeAndStampsItAsEditorOrigin() {
+            service.report(
+                    new EditorFailureReport("remove-password", "E004", List.of("f-1"), "boom"));
+
+            FileRunEvent event = store.list(TEAM, null, null, null, 10).getFirst();
+            assertThat(event.kind()).isEqualTo(FailureKind.INPUT_PASSWORD_PROTECTED);
+            assertThat(event.origin()).isEqualTo(FailureOrigin.TOOL);
+            assertThat(event.fileId()).isEqualTo("f-1");
+            assertThat(event.detail()).contains("boom");
+        }
+
+        @Test
+        void takesTheTeamAndActorFromThePrincipalNotTheReport() {
+            // The report carries no team or actor field at all; both come from the caller's
+            // session.
+            service.report(new EditorFailureReport("compress", "E004", List.of("f-1"), "boom"));
+
+            FileRunEvent event = store.list(TEAM, null, null, null, 10).getFirst();
+            assertThat(event.teamId()).isEqualTo(TEAM);
+            assertThat(event.actor()).isEqualTo(ACTOR);
+        }
+
+        @Test
+        void stillFilesTheRowUnderTheTeamWhenTheReporterCannotBeNamed() {
+            // Recording is open to everyone and takes the caller's team, not their read scope: a
+            // reporter who cannot be named reads nothing back, but the row is still the team's
+            // rather than dropping into the unteamed bucket every team shares. No role stub either,
+            // since recording never asks.
+            when(userService.getCurrentUsername()).thenReturn(null);
+
+            service.report(new EditorFailureReport("compress", "E004", List.of("f-1"), "boom"));
+
+            assertThat(store.list(TEAM, null, null, null, 10))
+                    .singleElement()
+                    .extracting(FileRunEvent::teamId)
+                    .isEqualTo(TEAM);
+        }
+
+        @Test
+        void recordsAnUnrecognisedCodeAsUnknownRatherThanDroppingIt() {
+            service.report(new EditorFailureReport("ocr", "E999", List.of("f-1"), "no idea"));
+
+            assertThat(store.list(TEAM, null, null, null, 10).getFirst().kind())
+                    .isEqualTo(FailureKind.UNKNOWN);
+        }
+
+        @Test
+        void recordsAnAbsentCodeAsUnknown() {
+            service.report(new EditorFailureReport("ocr", null, List.of("f-1"), "network died"));
+
+            assertThat(store.list(TEAM, null, null, null, 10).getFirst().kind())
+                    .isEqualTo(FailureKind.UNKNOWN);
+        }
+
+        @Test
+        void recordsOneIncidentPerFileSoEachDocumentStaysActionable() {
+            service.report(
+                    new EditorFailureReport(
+                            "compress", "E004", List.of("f-1", "f-2", "f-3"), "boom"));
+
+            assertThat(store.list(TEAM, null, null, null, 10))
+                    .hasSize(3)
+                    .extracting(FileRunEvent::fileId)
+                    .containsExactlyInAnyOrder("f-1", "f-2", "f-3");
+        }
+
+        @Test
+        void foldsARepeatOfTheSameFileIntoTheExistingIncident() {
+            service.report(new EditorFailureReport("compress", "E004", List.of("f-1"), "boom"));
+            service.report(
+                    new EditorFailureReport("compress", "E004", List.of("f-1"), "boom again"));
+
+            assertThat(store.list(TEAM, null, null, null, 10))
+                    .singleElement()
+                    .extracting(FileRunEvent::occurrences)
+                    .isEqualTo(2);
+        }
+
+        @Test
+        void recordsOneUnattributedIncidentWhenNoFileWasNamed() {
+            service.report(new EditorFailureReport("compress", "E004", List.of(), "boom"));
+
+            assertThat(store.list(TEAM, null, null, null, 10))
+                    .singleElement()
+                    .extracting(FileRunEvent::fileId)
+                    .isNull();
+        }
+
+        @Test
+        void recordsEveryFileInALargeBatchRatherThanTrimmingIt() {
+            // A cap here used to drop the overflow silently, so a reviewer saw 25 of 60 failures
+            // with nothing indicating the rest existed. The processor path has never had one.
+            List<String> many =
+                    java.util.stream.IntStream.range(0, 60).mapToObj(i -> "f-" + i).toList();
+
+            service.report(new EditorFailureReport("compress", "E004", many, "boom"));
+
+            assertThat(store.list(TEAM, null, null, null, 200)).hasSize(60);
+        }
+
+        @Test
+        void keepsTheOperationNameOutOfTheStoredDocumentReferences() {
+            // The operation is context for the reviewer, not a document reference: it belongs in
+            // detail, never in fileId.
+            service.report(
+                    new EditorFailureReport("remove-password", "E004", List.of("f-1"), "boom"));
+
+            FileRunEvent event = store.list(TEAM, null, null, null, 10).getFirst();
+            assertThat(event.detail()).contains("remove-password");
+            assertThat(event.fileId()).isEqualTo("f-1");
+        }
+
+        @Test
+        void storesTheReportedMessageVerbatimAlongsideTheOperation() {
+            // The user's own error about their own file. The operation is prefixed because an
+            // editor failure has no run to give a reviewer context.
+            service.report(
+                    new EditorFailureReport(
+                            "compress", "E004", List.of("f-1"), "Failed on Q4 report.pdf"));
+
+            assertThat(store.list(TEAM, null, null, null, 10).getFirst().detail())
+                    .isEqualTo("compress: Failed on Q4 report.pdf");
+        }
+
+        @Test
+        void theServiceHoldsNothingThatCouldReachADocument() {
+            // Asserted structurally rather than with verifyNoInteractions on unwired mocks, which
+            // is how the version of this test on the other branch passed without proving anything.
+            List<Class<?>> forbidden =
+                    List.of(
+                            stirling.software.proprietary.policy.ledger.ProcessedLedger.class,
+                            stirling.software.common.service.FileStorage.class,
+                            stirling.software.proprietary.policy.output.PolicyOutputSink.class);
+
+            List<Class<?>> held =
+                    Arrays.stream(FileRunEventService.class.getDeclaredFields())
+                            .filter(field -> !field.isSynthetic())
+                            .map(Field::getType)
+                            .toList();
+
+            assertThat(held).isNotEmpty().doesNotContainAnyElementsOf(forbidden);
+        }
+    }
+
+    @Nested
+    @DisplayName("editor incidents stay separate")
+    class EditorIncidentIdentity {
+
+        private void reportedBy(String actor, String fileId) {
+            when(userService.getCurrentUsername()).thenReturn(actor);
+            service.report(new EditorFailureReport("compress", null, List.of(fileId), "boom"));
+        }
+
+        @Test
+        void twoPeopleHittingTheSameUnclassifiedFailureAreTwoIncidents() {
+            // UNKNOWN is RUN scoped and an editor report has no run, so without the fallback every
+            // unclassified editor failure in a team collapsed into one row: one actor credited for
+            // everyone's, and the wrong person offered the row.
+            reportedBy("alice@example.com", "a-1");
+            reportedBy("bob@example.com", "b-1");
+
+            assertThat(store.list(TEAM, null, null, null, 10))
+                    .extracting(FileRunEvent::actor)
+                    .containsExactlyInAnyOrder("alice@example.com", "bob@example.com");
+        }
+
+        @Test
+        void onePersonsTwoBrokenFilesAreTwoIncidents() {
+            reportedBy("alice@example.com", "a-1");
+            reportedBy("alice@example.com", "a-2");
+
+            assertThat(store.list(TEAM, null, null, null, 10))
+                    .extracting(FileRunEvent::fileId)
+                    .containsExactlyInAnyOrder("a-1", "a-2");
+        }
+
+        @Test
+        void theSamePersonHittingTheSameFileTwiceIsOneIncident() {
+            reportedBy("alice@example.com", "a-1");
+            reportedBy("alice@example.com", "a-1");
+
+            assertThat(store.list(TEAM, null, null, null, 10))
+                    .singleElement()
+                    .extracting(FileRunEvent::occurrences)
+                    .isEqualTo(2);
+        }
+    }
+
+    @Nested
+    @DisplayName("files deleted from the editor")
+    class RemovedFiles {
+
+        private void reported(String fileId) {
+            service.report(new EditorFailureReport("compress", "E004", List.of(fileId), "boom"));
+        }
+
+        @Test
+        void closeTheirIncidentsSoTheQueueStopsAskingAboutThem() {
+            reported("f-1");
+
+            assertThat(service.forgetFiles(List.of("f-1"))).isEqualTo(1);
+            assertThat(service.list(null, null, 10))
+                    .as("the open queue is what the reviewer works from")
+                    .isEmpty();
+        }
+
+        @Test
+        void theRowSurvivesForAudit() {
+            reported("f-1");
+            service.forgetFiles(List.of("f-1"));
+
+            assertThat(service.list(FileRunEventStatus.FILE_REMOVED, null, 10))
+                    .singleElement()
+                    .satisfies(
+                            event -> {
+                                assertThat(event.fileId()).isEqualTo("f-1");
+                                assertThat(event.detail()).contains("boom");
+                            });
+        }
+
+        @Test
+        void aReviewersDismissKeepsItsMeaningAndItsActor() {
+            reported("f-1");
+            FileRunEvent event = service.list(null, null, 10).getFirst();
+            service.dispatch(event.id(), "DISMISS", Map.of());
+
+            assertThat(service.forgetFiles(List.of("f-1")))
+                    .as("only open rows move; a closed one has already been decided")
+                    .isZero();
+            assertThat(service.list(FileRunEventStatus.DISMISSED, null, 10)).hasSize(1);
+        }
+
+        @Test
+        void aColleaguesIncidentIsUntouchedEvenForALeader() {
+            // File ids come from the client, so naming one must not close someone else's row. The
+            // caller here is a leader, who reads the whole team: this path narrows to their own
+            // rows
+            // regardless, since a null actor would otherwise match every unattributed row.
+            store.record(
+                    RecordFailure.forEditor(
+                            FailureKind.UNKNOWN, TEAM, "employee@example.com", "f-1", "theirs"));
+
+            assertThat(service.forgetFiles(List.of("f-1"))).isZero();
+        }
+
+        @Test
+        void aProcessorIncidentIsUntouchedEvenOnTheSameFileId() {
+            // Nothing was deleted from an editor there, and the file may still be in the bucket.
+            given(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "f-1");
+
+            assertThat(service.forgetFiles(List.of("f-1"))).isZero();
+        }
+
+        @Test
+        void namingNoFilesClosesNothing() {
+            reported("f-1");
+
+            assertThat(service.forgetFiles(List.of())).isZero();
+            assertThat(service.forgetFiles(java.util.Arrays.asList(null, "  "))).isZero();
+            assertThat(service.list(null, null, 10)).hasSize(1);
+        }
+    }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventStoreDbTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventStoreDbTest.java
index 46d2be8a0d..982d804354 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventStoreDbTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventStoreDbTest.java
@@ -6,6 +6,7 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Proxy;
 import java.time.Instant;
+import java.util.List;
 import java.util.UUID;
 import java.util.concurrent.atomic.AtomicBoolean;
 
@@ -54,11 +55,16 @@ class FileRunEventStoreDbTest {
     }
 
     private RecordFailure failure(FailureKind kind, Long teamId, String fileId) {
+        return failure(kind, teamId, "author@example.com", fileId);
+    }
+
+    /** As {@link #failure} but naming the actor, which is what the read scope narrows by. */
+    private RecordFailure failure(FailureKind kind, Long teamId, String actor, String fileId) {
         return new RecordFailure(
                 kind,
                 FailureOrigin.POLICY,
                 teamId,
-                "author@example.com",
+                actor,
                 "policy-1",
                 "run-1",
                 null,
@@ -73,16 +79,37 @@ class FileRunEventStoreDbTest {
         store.record(failure(FailureKind.UNKNOWN, OTHER_TEAM, "theirs"));
         store.record(failure(FailureKind.UNKNOWN, null, "unteamed"));
 
-        assertThat(store.list(TEAM, null, null, 10))
+        assertThat(store.list(TEAM, null, null, null, 10))
                 .extracting(FileRunEvent::fileId)
                 .containsExactly("ours");
         // A plain `e.teamId = :teamId` would return nothing here: SQL equality against NULL is
         // never true, which is what the explicit null branch in the JPQL exists for.
-        assertThat(store.list(null, null, null, 10))
+        assertThat(store.list(null, null, null, null, 10))
                 .extracting(FileRunEvent::fileId)
                 .containsExactly("unteamed");
     }
 
+    @Test
+    @DisplayName("actor narrowing is enforced by the query, within the team")
+    void actorNarrowingIsEnforcedBySql() {
+        // The clause that makes a member read only their own rows. Exercised here rather than only
+        // against the in-memory repository, which reimplements the filter in Java and would agree
+        // with a query that had lost it.
+        store.record(failure(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "mine@example.com", "f1"));
+        store.record(
+                failure(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "theirs@example.com", "f2"));
+        store.record(failure(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, null, "f3"));
+
+        assertThat(store.list(TEAM, null, null, "mine@example.com", 10))
+                .extracting(FileRunEvent::fileId)
+                .containsExactly("f1");
+        // A null actor is "no filter", which is what a leader reads with: the whole team, including
+        // the rows nobody is named on.
+        assertThat(store.list(TEAM, null, null, null, 10))
+                .extracting(FileRunEvent::fileId)
+                .containsExactlyInAnyOrder("f1", "f2", "f3");
+    }
+
     @Test
     @DisplayName("a fold lands on the row's current state, not the caller's snapshot")
     void foldTargetsTheCurrentRowNotACallersSnapshot() {
@@ -169,7 +196,7 @@ class FileRunEventStoreDbTest {
 
         assertThat(replacement.id()).isNotEqualTo(first.id());
         assertThat(replacement.occurrences()).isEqualTo(1);
-        assertThat(store.list(TEAM, null, null, 10)).hasSize(1);
+        assertThat(store.list(TEAM, null, null, null, 10)).hasSize(1);
     }
 
     @Test
@@ -187,7 +214,7 @@ class FileRunEventStoreDbTest {
         FileRunEvent folded = store.record(secondSweep);
 
         assertThat(folded.occurrences()).isEqualTo(2);
-        assertThat(store.list(TEAM, null, null, 10))
+        assertThat(store.list(TEAM, null, null, null, 10))
                 .as("one incident per document, however many runs it failed in")
                 .extracting(FileRunEvent::fileId)
                 .containsExactlyInAnyOrder("file-hash-a", "file-hash-b");
@@ -198,12 +225,66 @@ class FileRunEventStoreDbTest {
                 FailureKind.INPUT_PASSWORD_PROTECTED,
                 TEAM,
                 null,
+                null,
                 "policy-1",
                 runId,
                 fileId,
                 "locked");
     }
 
+    @Test
+    @DisplayName("closing deleted files touches only that owner's own open editor rows")
+    void markFilesRemovedIsScopedBySqlNotByTheCaller() {
+        // The scoping is entirely in the JPQL, so the in-memory fake proves nothing about it:
+        // it implements the same rules by hand and would agree with a wrong query.
+        FileRunEvent mine =
+                store.record(
+                        RecordFailure.forEditor(
+                                FailureKind.UNKNOWN, TEAM, "owner@example.com", "f-1", "boom"));
+        FileRunEvent theirs =
+                store.record(
+                        RecordFailure.forEditor(
+                                FailureKind.UNKNOWN, TEAM, "colleague@example.com", "f-1", "boom"));
+        FileRunEvent otherTeam =
+                store.record(
+                        RecordFailure.forEditor(
+                                FailureKind.UNKNOWN,
+                                OTHER_TEAM,
+                                "owner@example.com",
+                                "f-1",
+                                "boom"));
+        FileRunEvent fromProcessor = store.record(failure(FailureKind.UNKNOWN, TEAM, "f-1"));
+
+        int closed = store.markFilesRemoved(TEAM, "owner@example.com", List.of("f-1"));
+
+        assertThat(closed).isEqualTo(1);
+        assertThat(store.find(mine.id(), TEAM).orElseThrow().status())
+                .isEqualTo(FileRunEventStatus.FILE_REMOVED);
+        assertThat(store.find(theirs.id(), TEAM).orElseThrow().status())
+                .as("another person's incident about their own file")
+                .isEqualTo(FileRunEventStatus.NEW);
+        assertThat(store.find(otherTeam.id(), OTHER_TEAM).orElseThrow().status())
+                .as("another team entirely")
+                .isEqualTo(FileRunEventStatus.NEW);
+        assertThat(store.find(fromProcessor.id(), TEAM).orElseThrow().status())
+                .as("nothing was deleted from an editor here")
+                .isEqualTo(FileRunEventStatus.NEW);
+    }
+
+    @Test
+    @DisplayName("a row already closed by a reviewer is left as they left it")
+    void markFilesRemovedLeavesClosedRowsAlone() {
+        FileRunEvent event =
+                store.record(
+                        RecordFailure.forEditor(
+                                FailureKind.UNKNOWN, TEAM, "owner@example.com", "f-1", "boom"));
+        store.applyStatus(event.id(), TEAM, FileRunEventStatus.DISMISSED, "reviewer@example.com");
+
+        assertThat(store.markFilesRemoved(TEAM, "owner@example.com", List.of("f-1"))).isZero();
+        assertThat(store.find(event.id(), TEAM).orElseThrow().statusActor())
+                .isEqualTo("reviewer@example.com");
+    }
+
     @Test
     @DisplayName("the kind filter applies before the limit, not after")
     void kindFilterAppliesBeforeTheLimit() {
@@ -212,7 +293,7 @@ class FileRunEventStoreDbTest {
             store.record(failure(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "newer-" + i));
         }
 
-        assertThat(store.list(TEAM, null, "UNKNOWN", 1))
+        assertThat(store.list(TEAM, null, "UNKNOWN", null, 1))
                 .extracting(FileRunEvent::fileId)
                 .containsExactly("old-unknown");
     }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventStoreTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventStoreTest.java
index 2adbc7d2b2..97de1952e9 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventStoreTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/FileRunEventStoreTest.java
@@ -281,7 +281,7 @@ class FileRunEventStoreTest {
             store.record(failure(FailureKind.UNKNOWN, TEAM, "mine", "a"));
             store.record(failure(FailureKind.UNKNOWN, OTHER_TEAM, "theirs", "b"));
 
-            assertThat(store.list(TEAM, null, null, 50))
+            assertThat(store.list(TEAM, null, null, null, 50))
                     .extracting(FileRunEvent::fileId)
                     .containsExactly("mine");
         }
@@ -293,18 +293,37 @@ class FileRunEventStoreTest {
             store.record(failure(FailureKind.UNKNOWN, null, "unteamed", "a"));
             store.record(failure(FailureKind.UNKNOWN, TEAM, "teamed", "b"));
 
-            assertThat(store.list(null, null, null, 50))
+            assertThat(store.list(null, null, null, null, 50))
                     .extracting(FileRunEvent::fileId)
                     .containsExactly("unteamed");
         }
 
+        @Test
+        void dismissingARowClearsItFromTheDefaultQueue() {
+            // The reviewer's whole complaint: without this, dismissing changes the buttons and
+            // leaves the row sitting there, so the list can only ever grow.
+            FileRunEvent event = store.record(failure(FailureKind.UNKNOWN, TEAM, "f1", "boom"));
+            store.applyStatus(event.id(), TEAM, FileRunEventStatus.DISMISSED, "reviewer");
+
+            assertThat(store.list(TEAM, null, null, null, 10)).isEmpty();
+            assertThat(store.list(TEAM, FileRunEventStatus.DISMISSED, null, null, 10)).hasSize(1);
+        }
+
+        @Test
+        void anAcknowledgedRowIsStillOpenWorkSoItStays() {
+            FileRunEvent event = store.record(failure(FailureKind.UNKNOWN, TEAM, "f1", "boom"));
+            store.applyStatus(event.id(), TEAM, FileRunEventStatus.ACKNOWLEDGED, "reviewer");
+
+            assertThat(store.list(TEAM, null, null, null, 10)).hasSize(1);
+        }
+
         @Test
         void filtersByStatus() {
             FileRunEvent open = store.record(failure(FailureKind.UNKNOWN, TEAM, "open", "a"));
             store.record(failure(FailureKind.INPUT_PASSWORD_PROTECTED, TEAM, "closed", "b"));
             store.applyStatus(open.id(), TEAM, FileRunEventStatus.ACKNOWLEDGED, "me");
 
-            assertThat(store.list(TEAM, FileRunEventStatus.ACKNOWLEDGED, null, 50))
+            assertThat(store.list(TEAM, FileRunEventStatus.ACKNOWLEDGED, null, null, 50))
                     .extracting(FileRunEvent::fileId)
                     .containsExactly("open");
         }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/InMemoryFileRunEventRepository.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/InMemoryFileRunEventRepository.java
index ed8b6f29cd..6dbb16322b 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/failure/InMemoryFileRunEventRepository.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/InMemoryFileRunEventRepository.java
@@ -6,6 +6,7 @@ import java.util.Collection;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.function.Function;
 
@@ -53,19 +54,18 @@ class InMemoryFileRunEventRepository implements FileRunEventRepository {
         return kindId == null || kindId.equals(entity.getKindId());
     }
 
-    @Override
-    public List<FileRunEventEntity> findByTeam(Long teamId, String kindId, Pageable pageable) {
-        return page(
-                newestFirst(
-                        rows.values().stream()
-                                .filter(e -> sameTeam(e, teamId) && sameKind(e, kindId))
-                                .toList()),
-                pageable);
+    /** Null means the whole team, matching the JPQL's {@code :actor is null} branch. */
+    private static boolean sameActor(FileRunEventEntity entity, String actor) {
+        return actor == null || actor.equals(entity.getActor());
     }
 
     @Override
     public List<FileRunEventEntity> findByTeamAndStatus(
-            Long teamId, FileRunEventStatus status, String kindId, Pageable pageable) {
+            Long teamId,
+            FileRunEventStatus status,
+            String kindId,
+            String actor,
+            Pageable pageable) {
         return page(
                 newestFirst(
                         rows.values().stream()
@@ -73,7 +73,8 @@ class InMemoryFileRunEventRepository implements FileRunEventRepository {
                                         e ->
                                                 sameTeam(e, teamId)
                                                         && e.getStatus() == status
-                                                        && sameKind(e, kindId))
+                                                        && sameKind(e, kindId)
+                                                        && sameActor(e, actor))
                                 .toList()),
                 pageable);
     }
@@ -124,6 +125,51 @@ class InMemoryFileRunEventRepository implements FileRunEventRepository {
         return 1;
     }
 
+    @Override
+    public int markFilesRemoved(
+            Long teamId,
+            String actor,
+            Collection<String> fileIds,
+            Instant now,
+            Collection<FileRunEventStatus> allowedFrom) {
+        int closed = 0;
+        for (FileRunEventEntity entity : rows.values()) {
+            if (entity.getOrigin() != FailureOrigin.TOOL
+                    || !sameTeam(entity, teamId)
+                    || !Objects.equals(entity.getActor(), actor)
+                    || entity.getFileId() == null
+                    || !fileIds.contains(entity.getFileId())
+                    || !allowedFrom.contains(entity.getStatus())) {
+                continue;
+            }
+            entity.setStatus(FileRunEventStatus.FILE_REMOVED);
+            entity.setStatusActor(actor);
+            entity.setStatusAt(now);
+            closed++;
+        }
+        return closed;
+    }
+
+    @Override
+    public List<FileRunEventEntity> findByTeamAndStatusIn(
+            Long teamId,
+            List<FileRunEventStatus> statuses,
+            String kindId,
+            String actor,
+            Pageable pageable) {
+        return page(
+                newestFirst(
+                        rows.values().stream()
+                                .filter(
+                                        e ->
+                                                sameTeam(e, teamId)
+                                                        && statuses.contains(e.getStatus())
+                                                        && sameKind(e, kindId)
+                                                        && sameActor(e, actor))
+                                .toList()),
+                pageable);
+    }
+
     @Override
     public List<FileRunEventEntity> findByTeamAndDedupKey(
             Long teamId, String dedupKey, Pageable pageable) {
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/PolicyFailureAttributionTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/PolicyFailureAttributionTest.java
new file mode 100644
index 0000000000..2a71c236a7
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/PolicyFailureAttributionTest.java
@@ -0,0 +1,264 @@
+package stirling.software.proprietary.failure;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.when;
+
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.TimeUnit;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.slf4j.MDC;
+import org.springframework.core.io.ByteArrayResource;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.service.FileStorage;
+import stirling.software.common.service.InternalApiClient;
+import stirling.software.common.service.JobOwnershipService;
+import stirling.software.common.service.JobQueue;
+import stirling.software.common.service.ResourceMonitor;
+import stirling.software.common.service.TaskManager;
+import stirling.software.common.service.ToolMetadataService;
+import stirling.software.common.service.UserServiceInterface;
+import stirling.software.common.util.TempFileManager;
+import stirling.software.common.util.TempFileRegistry;
+import stirling.software.proprietary.policy.asset.InProcessPolicyAssetStore;
+import stirling.software.proprietary.policy.asset.PolicyAssetResolver;
+import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
+import stirling.software.proprietary.policy.engine.PolicyEngine;
+import stirling.software.proprietary.policy.engine.PolicyExecutor;
+import stirling.software.proprietary.policy.engine.PolicyRunRegistry;
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.PipelineStep;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.model.PolicyInputs;
+import stirling.software.proprietary.policy.output.InlineOutputSink;
+import stirling.software.proprietary.policy.output.PolicyOutputResolver;
+import stirling.software.proprietary.policy.progress.PolicyProgressListener;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.store.PolicyStore;
+
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Pins what the engine records as a failure's actor against what a reader gets back, because the
+ * two sides used to assert independently: the engine's test passed {@code any()} for the actor, and
+ * the service's fixtures assumed an actor the engine never actually produced. Every collaborator
+ * between the failing tool call and the read is real here, so a regression in either one fails.
+ *
+ * <p>This is what makes this PR's promise hold. Reads are narrowed to the rows the caller is the
+ * actor on, so if the engine names the wrong person, a member reads nothing at all.
+ *
+ * <p>The bug it exists for: the engine recorded the BILLING principal as the actor, which for a
+ * stored policy is always its owner. So an attended failure was filed under someone who never
+ * touched the document, and the member who did could not see it.
+ */
+@ExtendWith(MockitoExtension.class)
+class PolicyFailureAttributionTest {
+
+    private static final String ROTATE = "/api/v1/general/rotate-pdf";
+    private static final Long TEAM = 3L;
+
+    @Mock private InternalApiClient internalApiClient;
+    @Mock private ToolMetadataService toolMetadataService;
+    @Mock private TaskManager taskManager;
+    @Mock private FileStorage fileStorage;
+    @Mock private JobOwnershipService jobOwnershipService;
+    @Mock private ResourceMonitor resourceMonitor;
+    @Mock private JobQueue jobQueue;
+    @Mock private PolicyStore policyStore;
+    @Mock private PolicyManagementAuthority authority;
+    @Mock private UserServiceInterface userService;
+
+    @TempDir Path tempDir;
+
+    private PolicyEngine engine;
+    private FileRunEventService service;
+
+    @BeforeEach
+    void setUp() {
+        ApplicationProperties props = new ApplicationProperties();
+        props.getSecurity().setEnableLogin(true);
+        props.getSystem().getTempFileManagement().setBaseTmpDir(tempDir.toString());
+        props.getSystem().getTempFileManagement().setPrefix("failure-attribution-test-");
+
+        FileRunEventStore store = new FileRunEventStore(new InMemoryFileRunEventRepository());
+        service =
+                new FileRunEventService(
+                        store,
+                        new FailureActionRegistry(
+                                List.of(new AcknowledgeAction(store), new DismissAction(store))),
+                        authority,
+                        userService,
+                        props);
+
+        PolicyFailureRecorder recorder =
+                new PolicyFailureRecorder(
+                        new FailureClassifier(JsonMapper.builder().build()), store, policyStore);
+        PolicyExecutor executor =
+                new PolicyExecutor(
+                        internalApiClient,
+                        toolMetadataService,
+                        new TempFileManager(new TempFileRegistry(), props),
+                        JsonMapper.builder().build());
+        engine =
+                new PolicyEngine(
+                        executor,
+                        taskManager,
+                        new PolicyRunRegistry(new ApplicationProperties()),
+                        recorder,
+                        fileStorage,
+                        jobOwnershipService,
+                        List.of(new InlineOutputSink(fileStorage)),
+                        new PolicyOutputResolver(new InProcessSourceStore()),
+                        resourceMonitor,
+                        jobQueue,
+                        new PolicyAssetResolver(new InProcessPolicyAssetStore()));
+
+        lenient()
+                .when(jobOwnershipService.createScopedJobKey(anyString()))
+                .thenAnswer(invocation -> invocation.getArgument(0));
+        lenient().when(resourceMonitor.shouldQueueJob(anyInt())).thenReturn(false);
+        lenient().when(toolMetadataService.isMultiInput(anyString())).thenReturn(false);
+        // The team is resolved from the policy, so the recorded row lands in the reader's team.
+        lenient().when(policyStore.get(anyString())).thenReturn(Optional.of(sharedPolicy()));
+        lenient().when(authority.currentUserTeamId()).thenReturn(TEAM);
+    }
+
+    /** Alice's policy, shared with her team. Bob is a member of it and does not own it. */
+    private static Policy sharedPolicy() {
+        return new Policy(
+                "p1",
+                "rotate",
+                "alice",
+                true,
+                List.of(),
+                List.of(new PipelineStep(ROTATE, Map.of())),
+                OutputSpec.inline(),
+                TEAM);
+    }
+
+    /**
+     * Run the shared policy so its single tool step fails, as {@code triggeredBy} (null = sweep).
+     */
+    private void runAndFail(String triggeredBy, String sourceId, String fileIdentity)
+            throws Exception {
+        when(internalApiClient.post(eq(ROTATE), any())).thenThrow(new RuntimeException("boom"));
+        if (triggeredBy != null) {
+            MDC.put("auditPrincipal", triggeredBy);
+        }
+        try {
+            engine.runPolicy(
+                            sharedPolicy(),
+                            PolicyInputs.of(List.of(pdf())),
+                            PolicyProgressListener.NOOP,
+                            sourceId,
+                            fileIdentity)
+                    .completion()
+                    .get(10, TimeUnit.SECONDS);
+        } finally {
+            MDC.remove("auditPrincipal");
+        }
+    }
+
+    private static ByteArrayResource pdf() {
+        return new ByteArrayResource("input".getBytes()) {
+            @Override
+            public String getFilename() {
+                return "input.pdf";
+            }
+        };
+    }
+
+    /** Read as a plain member, who is narrowed to the rows they are the actor on. */
+    private FileRunEvent asMember(String reader) {
+        lenient().when(userService.getCurrentUsername()).thenReturn(reader);
+        lenient().when(authority.canEditPolicies()).thenReturn(false);
+        List<FileRunEvent> visible = service.list(null, null, 10);
+        return visible.isEmpty() ? null : visible.getFirst();
+    }
+
+    /** Read as a team leader, who reviews the whole team's incidents. */
+    private FileRunEvent asReviewer(String reader) {
+        lenient().when(userService.getCurrentUsername()).thenReturn(reader);
+        lenient().when(authority.canEditPolicies()).thenReturn(true);
+        return service.list(null, null, 10).getFirst();
+    }
+
+    @Nested
+    @DisplayName("a non-owner runs a shared policy on their own upload")
+    class AttendedByANonOwner {
+
+        @Test
+        void theTriggeringUserCanReadTheFailureTheyCaused() throws Exception {
+            runAndFail("bob", null, "bob-doc-1");
+
+            // The whole point: Bob's read scope narrows to his own rows, so the row only reaches
+            // him if the engine named him. Before the fix this list was empty.
+            FileRunEvent mine = asMember("bob");
+            assertThat(mine).as("bob must be able to see the failure he caused").isNotNull();
+            assertThat(mine.actor()).isEqualTo("bob");
+        }
+
+        @Test
+        void thePolicyOwnerIsNotNamedAsTheActorMerelyForBeingBilled() throws Exception {
+            runAndFail("bob", null, "bob-doc-1");
+
+            // Alice owns the policy and pays for the run, but she never touched the document.
+            assertThat(asReviewer("alice").actor()).isEqualTo("bob");
+        }
+
+        @Test
+        void aColleagueWhoDidNotTriggerItCannotSeeItAtAll() throws Exception {
+            runAndFail("bob", null, "bob-doc-1");
+
+            assertThat(asMember("carol")).isNull();
+        }
+    }
+
+    @Nested
+    @DisplayName("an unattended sweep pulls a file from a source")
+    class UnattendedSweep {
+
+        @Test
+        void theRowIsRecordedWithNoActorWhileStillBillingTheOwner() throws Exception {
+            runAndFail(null, "src-watched-folder", "file-hash-1");
+
+            assertThat(asReviewer("alice").actor())
+                    .as("a trigger-fired run has no user to name")
+                    .isNull();
+        }
+
+        @Test
+        void theSourceThatFedItIsStillRecorded() throws Exception {
+            runAndFail(null, "src-watched-folder", "file-hash-1");
+
+            FileRunEvent unattended = asReviewer("alice");
+            assertThat(unattended.sourceId()).isEqualTo("src-watched-folder");
+            assertThat(unattended.fileId()).isEqualTo("file-hash-1");
+        }
+
+        @Test
+        void aMemberDoesNotInheritAnUnattendedFailureAsTheirOwn() throws Exception {
+            // An unowned row must not fall to whoever happens to be reading: with no actor there is
+            // nothing for a member's narrowed read to match.
+            runAndFail(null, "src-watched-folder", "file-hash-1");
+
+            assertThat(asMember("bob")).isNull();
+        }
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/PolicyFailureRecorderTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/PolicyFailureRecorderTest.java
index 841fdec684..73c5add6ad 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/failure/PolicyFailureRecorderTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/PolicyFailureRecorderTest.java
@@ -89,12 +89,13 @@ class PolicyFailureRecorderTest {
             recorder.recordRunFailure(
                     "run-1",
                     "policy-1",
-                    "dana@example.com",
                     null,
+                    null,
+                    "dana@example.com",
                     "Policy run failed: locked",
                     passwordFailure());
 
-            FileRunEvent event = store.list(TEAM, null, null, 10).getFirst();
+            FileRunEvent event = store.list(TEAM, null, null, null, 10).getFirst();
             assertThat(event.kind()).isEqualTo(FailureKind.INPUT_PASSWORD_PROTECTED);
             assertThat(event.runId()).isEqualTo("run-1");
             assertThat(event.policyId()).isEqualTo("policy-1");
@@ -114,12 +115,13 @@ class PolicyFailureRecorderTest {
             recorder.recordRunFailure(
                     "run-1",
                     "policy-1",
-                    "dana@example.com",
                     null,
+                    null,
+                    "dana@example.com",
                     "Policy run failed: something we do not recognise",
                     new RuntimeException("boom"));
 
-            FileRunEvent event = store.list(TEAM, null, null, 10).getFirst();
+            FileRunEvent event = store.list(TEAM, null, null, null, 10).getFirst();
             assertThat(event.kind()).isEqualTo(FailureKind.UNKNOWN);
             assertThat(event.detail()).contains("something we do not recognise");
         }
@@ -133,10 +135,11 @@ class PolicyFailureRecorderTest {
                     "policy-1",
                     null,
                     null,
+                    null,
                     "Policy run failed: java.lang.NullPointerException",
                     new RuntimeException("npe"));
 
-            FileRunEvent event = store.list(TEAM, null, null, 10).getFirst();
+            FileRunEvent event = store.list(TEAM, null, null, null, 10).getFirst();
             assertThat(event.kind()).isEqualTo(FailureKind.UNKNOWN);
             assertThat(event.detail()).contains("NullPointerException");
         }
@@ -147,9 +150,9 @@ class PolicyFailureRecorderTest {
             when(policyStore.get("policy-1")).thenReturn(Optional.of(policy("policy-1", TEAM)));
 
             recorder.recordRunFailureAs(
-                    FailureKind.UNKNOWN, "run-3", "policy-1", null, "could not be queued");
+                    FailureKind.UNKNOWN, "run-3", "policy-1", null, null, "could not be queued");
 
-            assertThat(store.list(TEAM, null, null, 10)).hasSize(1);
+            assertThat(store.list(TEAM, null, null, null, 10)).hasSize(1);
         }
 
         @Test
@@ -161,11 +164,23 @@ class PolicyFailureRecorderTest {
             when(policyStore.get("policy-1")).thenReturn(Optional.of(policy("policy-1", TEAM)));
 
             recorder.recordRunFailure(
-                    "run-1", "policy-1", "dana@example.com", null, "locked", passwordFailure());
+                    "run-1",
+                    "policy-1",
+                    null,
+                    null,
+                    "dana@example.com",
+                    "locked",
+                    passwordFailure());
             recorder.recordRunFailure(
-                    "run-2", "policy-1", "dana@example.com", null, "locked", passwordFailure());
+                    "run-2",
+                    "policy-1",
+                    null,
+                    null,
+                    "dana@example.com",
+                    "locked",
+                    passwordFailure());
 
-            List<FileRunEvent> events = store.list(TEAM, null, null, 10);
+            List<FileRunEvent> events = store.list(TEAM, null, null, null, 10);
             assertThat(events).hasSize(2);
             assertThat(events).allMatch(event -> event.occurrences() == 1);
             assertThat(events)
@@ -173,16 +188,64 @@ class PolicyFailureRecorderTest {
                     .containsExactlyInAnyOrder("run-1", "run-2");
         }
 
+        @Test
+        void namesTheSourceWhenNoUserWasInvolved() {
+            // An unattended file has no actor, so the source is the only attribution a reviewer
+            // gets: which bucket, folder or webhook fed the run.
+            when(policyStore.get("policy-1")).thenReturn(Optional.of(policy("policy-1", TEAM)));
+
+            recorder.recordRunFailure(
+                    "run-1",
+                    "policy-1",
+                    "src-s3-invoices",
+                    null,
+                    null,
+                    "locked",
+                    passwordFailure());
+
+            FileRunEvent event = store.list(TEAM, null, null, null, 10).getFirst();
+            assertThat(event.sourceId()).isEqualTo("src-s3-invoices");
+            assertThat(event.actor()).isNull();
+        }
+
+        @Test
+        void keepsTwoSourcesApartEvenWhenTheyFailIdentically() {
+            // Same kind, same policy, no user on either: without the source they would be one row.
+            when(policyStore.get("policy-1")).thenReturn(Optional.of(policy("policy-1", TEAM)));
+
+            recorder.recordRunFailureAs(
+                    FailureKind.UNKNOWN, "run-1", "policy-1", "src-a", null, "unreachable");
+            recorder.recordRunFailureAs(
+                    FailureKind.UNKNOWN, "run-2", "policy-1", "src-b", null, "unreachable");
+
+            assertThat(store.list(TEAM, null, null, null, 10))
+                    .hasSize(2)
+                    .extracting(FileRunEvent::sourceId)
+                    .containsExactlyInAnyOrder("src-a", "src-b");
+        }
+
         @Test
         void thatSameRunFailingTwiceStaysOneIncident() {
             when(policyStore.get("policy-1")).thenReturn(Optional.of(policy("policy-1", TEAM)));
 
             recorder.recordRunFailure(
-                    "run-1", "policy-1", "dana@example.com", null, "locked", passwordFailure());
+                    "run-1",
+                    "policy-1",
+                    null,
+                    null,
+                    "dana@example.com",
+                    "locked",
+                    passwordFailure());
             recorder.recordRunFailure(
-                    "run-1", "policy-1", "dana@example.com", null, "locked", passwordFailure());
+                    "run-1",
+                    "policy-1",
+                    null,
+                    null,
+                    "dana@example.com",
+                    "locked",
+                    passwordFailure());
 
-            assertThat(store.list(TEAM, null, null, 10))
+            assertThat(store.list(TEAM, null, null, null, 10))
                     .singleElement()
                     .extracting(FileRunEvent::occurrences)
                     .isEqualTo(2);
@@ -198,19 +261,20 @@ class PolicyFailureRecorderTest {
             when(policyStore.get("policy-1")).thenReturn(Optional.of(policy("policy-1", TEAM)));
 
             recorder.recordRunFailure(
-                    "run-1", "policy-1", null, null, "boom", new RuntimeException());
+                    "run-1", "policy-1", null, null, null, "boom", new RuntimeException());
 
-            assertThat(store.list(TEAM, null, null, 10)).hasSize(1);
+            assertThat(store.list(TEAM, null, null, null, 10)).hasSize(1);
         }
 
         @Test
         void leavesAnAdHocRunUnteamedRatherThanGuessing() {
             // No stored policy means no team to attribute it to. Recorded unteamed rather than
             // attributed to whichever team happened to be nearby.
-            recorder.recordRunFailure("run-1", null, null, null, "boom", new RuntimeException());
+            recorder.recordRunFailure(
+                    "run-1", null, null, null, null, "boom", new RuntimeException());
 
-            assertThat(store.list(null, null, null, 10)).hasSize(1);
-            assertThat(store.list(TEAM, null, null, 10)).isEmpty();
+            assertThat(store.list(null, null, null, null, 10)).hasSize(1);
+            assertThat(store.list(TEAM, null, null, null, 10)).isEmpty();
         }
 
         @Test
@@ -224,11 +288,12 @@ class PolicyFailureRecorderTest {
                                             "policy-1",
                                             null,
                                             null,
+                                            null,
                                             "boom",
                                             new RuntimeException()))
                     .doesNotThrowAnyException();
             // Still recorded, just unteamed: a lookup problem must not lose the incident.
-            assertThat(store.list(null, null, null, 10)).hasSize(1);
+            assertThat(store.list(null, null, null, null, 10)).hasSize(1);
         }
     }
 
@@ -258,6 +323,7 @@ class PolicyFailureRecorderTest {
                                             "policy-1",
                                             null,
                                             null,
+                                            null,
                                             "Policy run failed: locked",
                                             passwordFailure()))
                     .doesNotThrowAnyException();
@@ -270,9 +336,15 @@ class PolicyFailureRecorderTest {
             assertThatCode(
                             () ->
                                     recorder.recordRunFailure(
-                                            "run-1", "policy-1", null, null, "no cause", null))
+                                            "run-1",
+                                            "policy-1",
+                                            null,
+                                            null,
+                                            null,
+                                            "no cause",
+                                            null))
                     .doesNotThrowAnyException();
-            assertThat(store.list(TEAM, null, null, 10).getFirst().kind())
+            assertThat(store.list(TEAM, null, null, null, 10).getFirst().kind())
                     .isEqualTo(FailureKind.UNKNOWN);
         }
     }
@@ -286,11 +358,11 @@ class PolicyFailureRecorderTest {
             when(policyStore.get("policy-1")).thenReturn(Optional.of(policy("policy-1", TEAM)));
 
             recorder.recordRunFailure(
-                    "run-1", "policy-1", null, null, "boom", new IOException("x"));
+                    "run-1", "policy-1", null, null, null, "boom", new IOException("x"));
             recorder.recordRunFailure(
-                    "run-1", "policy-1", null, null, "boom", new IOException("x"));
+                    "run-1", "policy-1", null, null, null, "boom", new IOException("x"));
 
-            List<FileRunEvent> events = store.list(TEAM, null, null, 10);
+            List<FileRunEvent> events = store.list(TEAM, null, null, null, 10);
             assertThat(events).hasSize(1);
             assertThat(events.getFirst().occurrences()).isEqualTo(2);
         }
@@ -301,11 +373,11 @@ class PolicyFailureRecorderTest {
             when(policyStore.get("policy-1")).thenReturn(Optional.of(policy("policy-1", TEAM)));
 
             recorder.recordRunFailure(
-                    "run-1", "policy-1", null, null, "boom", new IOException("x"));
+                    "run-1", "policy-1", null, null, null, "boom", new IOException("x"));
             recorder.recordRunFailure(
-                    "run-2", "policy-1", null, null, "boom", new IOException("x"));
+                    "run-2", "policy-1", null, null, null, "boom", new IOException("x"));
 
-            assertThat(store.list(TEAM, null, null, 10)).hasSize(2);
+            assertThat(store.list(TEAM, null, null, null, 10)).hasSize(2);
         }
     }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/failure/RecordFailurePrivacyTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/failure/RecordFailurePrivacyTest.java
index ef9648571f..86c52c4007 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/failure/RecordFailurePrivacyTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/failure/RecordFailurePrivacyTest.java
@@ -24,7 +24,14 @@ class RecordFailurePrivacyTest {
 
     private static RecordFailure withDetail(String detail) {
         return RecordFailure.forRun(
-                FailureKind.UNKNOWN, 1L, "dana@example.com", "policy-1", "run-1", null, detail);
+                FailureKind.UNKNOWN,
+                1L,
+                "dana@example.com",
+                "policy-1",
+                "run-1",
+                null,
+                null,
+                detail);
     }
 
     @Test
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/config/AdminPolicyManagementAuthorityTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/config/AdminPolicyManagementAuthorityTest.java
index 811aae6b4f..0f97fcaf62 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/config/AdminPolicyManagementAuthorityTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/config/AdminPolicyManagementAuthorityTest.java
@@ -39,6 +39,18 @@ class AdminPolicyManagementAuthorityTest {
         assertFalse(authority().canEditPolicies());
     }
 
+    @Test
+    void adminMayTriggerPolicies() {
+        when(userService.isCurrentUserAdmin()).thenReturn(true);
+        assertTrue(authority().canTriggerPolicies());
+    }
+
+    @Test
+    void nonAdminMayNotTriggerPolicies() {
+        when(userService.isCurrentUserAdmin()).thenReturn(false);
+        assertFalse(authority().canTriggerPolicies());
+    }
+
     @Test
     void currentUserTeamIdResolvesFromTheCurrentUsersTeam() {
         Team team = new Team();
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
index 43477aa9ed..2fa675597c 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
@@ -2,6 +2,7 @@ package stirling.software.proprietary.policy.controller;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -216,7 +217,7 @@ class PolicyControllerTest {
     }
 
     private static PolicyRunHandle handle(String runId) {
-        PolicyRun run = new PolicyRun(runId, null, definitionWithStep(), null);
+        PolicyRun run = new PolicyRun(runId, null, definitionWithStep(), null, null, null);
         return new PolicyRunHandle(runId, CompletableFuture.completedFuture(run));
     }
 
@@ -317,7 +318,7 @@ class PolicyControllerTest {
         @Test
         @DisplayName("returns the run view when present")
         void found() {
-            PolicyRun run = new PolicyRun("run-3", null, definitionWithStep(), null);
+            PolicyRun run = new PolicyRun("run-3", null, definitionWithStep(), null, null, null);
             when(runRegistry.get("run-3")).thenReturn(run);
 
             ResponseEntity<PolicyRunView> response = controller.status("run-3");
@@ -346,9 +347,11 @@ class PolicyControllerTest {
         @Test
         @DisplayName("excludes ad-hoc runs and runs owned by others")
         void filtersRuns() {
-            PolicyRun adHoc = new PolicyRun("adhoc", null, definitionWithStep(), null);
-            PolicyRun ownedStored = new PolicyRun("owned", "policy-A", definitionWithStep(), null);
-            PolicyRun otherStored = new PolicyRun("other", "policy-B", definitionWithStep(), null);
+            PolicyRun adHoc = new PolicyRun("adhoc", null, definitionWithStep(), null, null, null);
+            PolicyRun ownedStored =
+                    new PolicyRun("owned", "policy-A", definitionWithStep(), null, null, null);
+            PolicyRun otherStored =
+                    new PolicyRun("other", "policy-B", definitionWithStep(), null, null, null);
             when(runRegistry.all()).thenReturn(List.of(adHoc, ownedStored, otherStored));
 
             // ownedByCurrentUser: strip then re-apply scope reproduces the key only for the owned
@@ -736,5 +739,78 @@ class PolicyControllerTest {
                                     assertThat(((ResponseStatusException) e).getStatusCode())
                                             .isEqualTo(HttpStatus.NOT_FOUND));
         }
+
+        @Test
+        @DisplayName("trigger is forbidden for a team member who cannot manage policies")
+        void triggerForbiddenForMember() {
+            // Sweeping a policy's configured sources is a policy-management capability, so being
+            // in the policy's team is not on its own enough to perform it.
+            applicationProperties.getSecurity().setEnableLogin(true);
+            when(policyManagementAuthority.canTriggerPolicies()).thenReturn(false);
+
+            assertThatThrownBy(() -> controller.trigger("a"))
+                    .isInstanceOf(ResponseStatusException.class)
+                    .satisfies(
+                            e ->
+                                    assertThat(((ResponseStatusException) e).getStatusCode())
+                                            .isEqualTo(HttpStatus.FORBIDDEN));
+            // Rejected before the policy is looked up, so no run starts.
+            verify(policyRunner, never()).run(any());
+            verify(policyStore, never()).get(any());
+        }
+
+        @Test
+        @DisplayName("trigger runs for a caller who may manage policies")
+        void triggerAllowedForLeader() {
+            applicationProperties.getSecurity().setEnableLogin(true);
+            when(policyManagementAuthority.canTriggerPolicies()).thenReturn(true);
+            Policy p = policy("a", 1L);
+            when(policyStore.get("a")).thenReturn(Optional.of(p));
+            when(policyAccessGuard.canAccess(p)).thenReturn(true);
+            SweepOutcome outcome = new SweepOutcome(List.of("run-a"), 1, 0, 0, 0);
+            when(policyRunner.run(p)).thenReturn(outcome);
+
+            ResponseEntity<SweepOutcome> response = controller.trigger("a");
+
+            assertThat(response.getStatusCode()).isEqualTo(HttpStatus.ACCEPTED);
+            assertThat(response.getBody()).isEqualTo(outcome);
+        }
+
+        @Test
+        @DisplayName("trigger skips the role check when login is disabled")
+        void triggerTrustsTheLocalOperator() {
+            // Single-user deployments have no roles at all; the gate must not lock them out of
+            // their
+            // own sweeps.
+            applicationProperties.getSecurity().setEnableLogin(false);
+            Policy p = policy("a", null);
+            when(policyStore.get("a")).thenReturn(Optional.of(p));
+            when(policyAccessGuard.canAccess(p)).thenReturn(true);
+            SweepOutcome outcome = new SweepOutcome(List.of("run-a"), 1, 0, 0, 0);
+            when(policyRunner.run(p)).thenReturn(outcome);
+
+            assertThat(controller.trigger("a").getStatusCode()).isEqualTo(HttpStatus.ACCEPTED);
+            verify(policyManagementAuthority, never()).canTriggerPolicies();
+        }
+
+        @Test
+        @DisplayName("running a policy over the caller's own files stays open to any member")
+        void storedRunIsNotGatedByRole() {
+            // Editor enforcement: every member's upload/export runs the team's stored policies on
+            // their own documents. Gating this the way the sweep is gated would break the editor.
+            applicationProperties.getSecurity().setEnableLogin(true);
+            Policy p = policy("a", 1L);
+            when(policyStore.get("a")).thenReturn(Optional.of(p));
+            when(policyAccessGuard.canAccess(p)).thenReturn(true);
+            when(policyRunner.runWith(eq(p), any(), eq(PolicyProgressListener.NOOP)))
+                    .thenReturn(handle("run-9"));
+
+            ResponseEntity<JobResponse<Void>> response =
+                    assertDoesNotThrow(() -> controller.runStoredPolicy("a", new PolicyRunFiles()));
+
+            assertThat(response.getStatusCode()).isEqualTo(HttpStatus.ACCEPTED);
+            verify(policyManagementAuthority, never()).canTriggerPolicies();
+            verify(policyManagementAuthority, never()).canEditPolicies();
+        }
     }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyEngineTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyEngineTest.java
index b3aaf291f9..1efe094fe4 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyEngineTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyEngineTest.java
@@ -9,6 +9,7 @@ import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
 import static org.mockito.Mockito.atLeastOnce;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.doThrow;
@@ -225,7 +226,161 @@ class PolicyEngineTest {
         // A failed run is recorded durably, so an admin can see it after the in-memory run expires.
         verify(failureRecorder)
                 .recordRunFailure(
-                        eq(runId), any(), any(), any(), anyString(), any(Throwable.class));
+                        eq(runId), any(), any(), any(), any(), anyString(), any(Throwable.class));
+    }
+
+    @Test
+    void recordsWhichSourceFedAFailedRun() throws Exception {
+        // The source is threaded onto the run so an unattended failure is attributable: there is no
+        // user to name for a file that arrived from a bucket. The actor is asserted null rather
+        // than
+        // any(): a loose matcher here is what let the owner be recorded as the actor unnoticed.
+        when(toolMetadataService.isMultiInput(ROTATE)).thenReturn(false);
+        when(internalApiClient.post(eq(ROTATE), any())).thenThrow(new RuntimeException("boom"));
+
+        PolicyRunHandle handle =
+                engine.runPolicy(
+                        policyOwnedBy("owner"),
+                        PolicyInputs.of(List.of(pdf("input", "input.pdf"))),
+                        PolicyProgressListener.NOOP,
+                        "src-s3-invoices",
+                        "file-hash-1");
+        handle.completion().get(10, TimeUnit.SECONDS);
+
+        verify(failureRecorder)
+                .recordRunFailure(
+                        anyString(),
+                        any(),
+                        eq("src-s3-invoices"),
+                        eq("file-hash-1"),
+                        isNull(),
+                        anyString(),
+                        any(Throwable.class));
+    }
+
+    @Test
+    void anAttendedFailureIsRecordedAgainstWhoTriggeredItNotThePolicysOwner() throws Exception {
+        // Bob runs Alice's shared policy on his own upload and it fails. The row must name Bob: he
+        // is the one whose browser holds the document, and a member's read scope narrows to their
+        // own rows, so filing it under Alice hides it from the only person who can act on it.
+        when(toolMetadataService.isMultiInput(ROTATE)).thenReturn(false);
+        when(internalApiClient.post(eq(ROTATE), any())).thenThrow(new RuntimeException("boom"));
+
+        MDC.put("auditPrincipal", "bob"); // the request thread's acting user
+        try {
+            engine.runPolicy(
+                            policyOwnedBy("alice"),
+                            PolicyInputs.of(List.of(pdf("input", "input.pdf"))),
+                            PolicyProgressListener.NOOP,
+                            null,
+                            "bob-doc-1")
+                    .completion()
+                    .get(10, TimeUnit.SECONDS);
+        } finally {
+            MDC.remove("auditPrincipal");
+        }
+
+        verify(failureRecorder)
+                .recordRunFailure(
+                        anyString(),
+                        any(),
+                        isNull(),
+                        eq("bob-doc-1"),
+                        eq("bob"),
+                        anyString(),
+                        any(Throwable.class));
+    }
+
+    @Test
+    void anUnattendedFailureIsRecordedWithNoActorWhileStillBillingTheOwner() throws Exception {
+        // The two identities are deliberately different, and this pins both at once: usage is
+        // charged to the owner (MDC audit principal on the worker), but the failure has no actor,
+        // which is what makes it UNOWNED and hands the owner actions to the team's reviewer.
+        when(toolMetadataService.isMultiInput(ROTATE)).thenReturn(false);
+        String[] principalAtDispatch = {"<none>"};
+        when(internalApiClient.post(eq(ROTATE), any()))
+                .thenAnswer(
+                        invocation -> {
+                            principalAtDispatch[0] = MDC.get("auditPrincipal");
+                            throw new RuntimeException("boom");
+                        });
+
+        // No MDC and no security context: exactly a trigger-fired sweep.
+        engine.runPolicy(
+                        policyOwnedBy("alice"),
+                        PolicyInputs.of(List.of(pdf("input", "input.pdf"))),
+                        PolicyProgressListener.NOOP,
+                        "src-watched-folder",
+                        "file-hash-1")
+                .completion()
+                .get(10, TimeUnit.SECONDS);
+
+        assertEquals("alice", principalAtDispatch[0], "billing must still be the policy owner");
+        verify(failureRecorder)
+                .recordRunFailure(
+                        anyString(),
+                        any(),
+                        eq("src-watched-folder"),
+                        eq("file-hash-1"),
+                        isNull(),
+                        anyString(),
+                        any(Throwable.class));
+    }
+
+    @Test
+    void anAdHocFailureIsRecordedAgainstTheSubmittingUser() throws Exception {
+        // An ad-hoc run has no stored policy, so the submitter is both payer and actor. Asserted so
+        // the two entry points cannot drift apart.
+        when(toolMetadataService.isMultiInput(ROTATE)).thenReturn(false);
+        when(internalApiClient.post(eq(ROTATE), any())).thenThrow(new RuntimeException("boom"));
+
+        MDC.put("auditPrincipal", "bob");
+        try {
+            engine.submit(
+                            definition(new PipelineStep(ROTATE, Map.of())),
+                            PolicyInputs.of(List.of(pdf("input", "input.pdf"))),
+                            PolicyProgressListener.NOOP)
+                    .completion()
+                    .get(10, TimeUnit.SECONDS);
+        } finally {
+            MDC.remove("auditPrincipal");
+        }
+
+        verify(failureRecorder)
+                .recordRunFailure(
+                        anyString(),
+                        any(),
+                        any(),
+                        any(),
+                        eq("bob"),
+                        anyString(),
+                        any(Throwable.class));
+    }
+
+    @Test
+    void aRunRefusedAtAdmissionIsRecordedAgainstWhoeverTriggeredIt() throws Exception {
+        // The queue-full path records its own row, and it is attended: the user is still holding
+        // the
+        // document, so it must reach them rather than landing as an ownerless incident.
+        when(resourceMonitor.shouldQueueJob(anyInt())).thenReturn(true);
+        CompletableFuture<Object> rejected = new CompletableFuture<>();
+        rejected.completeExceptionally(new RuntimeException("Job queue full"));
+        doReturn(rejected).when(jobQueue).queueJob(anyString(), anyInt(), any(), anyLong());
+
+        MDC.put("auditPrincipal", "bob");
+        try {
+            engine.runPolicy(
+                    policyOwnedBy("alice"),
+                    PolicyInputs.of(List.of(pdf("input", "input.pdf"))),
+                    PolicyProgressListener.NOOP,
+                    null,
+                    "bob-doc-1");
+        } finally {
+            MDC.remove("auditPrincipal");
+        }
+
+        verify(failureRecorder)
+                .recordRunFailureAs(any(), anyString(), any(), isNull(), eq("bob"), anyString());
     }
 
     @Test
@@ -238,7 +393,7 @@ class PolicyEngineTest {
         doThrow(new RuntimeException("event store unavailable"))
                 .when(failureRecorder)
                 .recordRunFailure(
-                        anyString(), any(), any(), any(), anyString(), any(Throwable.class));
+                        anyString(), any(), any(), any(), any(), anyString(), any(Throwable.class));
 
         PolicyRunHandle handle =
                 engine.submit(
@@ -506,6 +661,17 @@ class PolicyEngineTest {
         return new PipelineDefinition("test", List.of(steps), OutputSpec.inline());
     }
 
+    private static Policy policyOwnedBy(String owner) {
+        return new Policy(
+                "p1",
+                "rotate",
+                owner,
+                true,
+                List.of(),
+                List.of(new PipelineStep(ROTATE, Map.of())),
+                OutputSpec.inline());
+    }
+
     private void stubEndpoint(String endpoint, Resource body) {
         when(internalApiClient.post(eq(endpoint), any())).thenReturn(ResponseEntity.ok(body));
     }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunRegistryTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunRegistryTest.java
index 784baa207c..692fe84c37 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunRegistryTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunRegistryTest.java
@@ -97,7 +97,12 @@ class PolicyRunRegistryTest {
     private PolicyRun register(String runId) {
         PolicyRun run =
                 new PolicyRun(
-                        runId, null, new PipelineDefinition(runId, List.of(), List.of()), null);
+                        runId,
+                        null,
+                        new PipelineDefinition(runId, List.of(), List.of()),
+                        null,
+                        null,
+                        null);
         registry.register(run);
         return run;
     }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunnerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunnerTest.java
index ba66cb8b2d..d6f5951e3a 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunnerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunnerTest.java
@@ -78,13 +78,13 @@ class PolicyRunnerTest {
     @Test
     void runsOnceWithNoFilesWhenThePolicyHasNoSources() {
         Policy policy = policy(List.of());
-        when(policyEngine.runPolicy(eq(policy), any(), any(), any()))
+        when(policyEngine.runPolicy(eq(policy), any(), any(), any(), any()))
                 .thenReturn(new PolicyRunHandle("r", new CompletableFuture<>()));
 
         runner.run(policy);
 
         ArgumentCaptor<PolicyInputs> inputs = ArgumentCaptor.forClass(PolicyInputs.class);
-        verify(policyEngine).runPolicy(eq(policy), inputs.capture(), any(), any());
+        verify(policyEngine).runPolicy(eq(policy), inputs.capture(), any(), any(), any());
         assertTrue(inputs.getValue().primary().isEmpty());
         // Ledger hygiene still runs: rows recorded for a generator policy's folder outputs
         // are pruned by its own sweeps rather than accumulating until the policy is deleted.
@@ -137,12 +137,12 @@ class PolicyRunnerTest {
                         List.of(
                                 ResolvedInput.of(PolicyInputs.of(List.of())),
                                 ResolvedInput.of(PolicyInputs.of(List.of()))));
-        when(policyEngine.runPolicy(any(), any(), any(), any()))
+        when(policyEngine.runPolicy(any(), any(), any(), any(), any()))
                 .thenReturn(new PolicyRunHandle("r", new CompletableFuture<>()));
 
         runner.run(policy);
 
-        verify(policyEngine, times(2)).runPolicy(eq(policy), any(), any(), any());
+        verify(policyEngine, times(2)).runPolicy(eq(policy), any(), any(), any(), any());
     }
 
     @Test
@@ -154,7 +154,7 @@ class PolicyRunnerTest {
         when(folderSource.supports(spec)).thenReturn(true);
         when(folderSource.resolve(eq(spec), any())).thenReturn(List.of(unit));
         CompletableFuture<PolicyRun> completion = new CompletableFuture<>();
-        when(policyEngine.runPolicy(any(), any(), any(), any()))
+        when(policyEngine.runPolicy(any(), any(), any(), any(), any()))
                 .thenReturn(new PolicyRunHandle("r", completion));
 
         runner.run(policy);
@@ -175,7 +175,7 @@ class PolicyRunnerTest {
         when(folderSource.supports(spec)).thenReturn(true);
         when(folderSource.resolve(eq(spec), any())).thenReturn(List.of(unit));
         CompletableFuture<PolicyRun> completion = new CompletableFuture<>();
-        when(policyEngine.runPolicy(any(), any(), any(), any()))
+        when(policyEngine.runPolicy(any(), any(), any(), any(), any()))
                 .thenReturn(new PolicyRunHandle("r", completion));
 
         runner.run(policy);
@@ -224,12 +224,12 @@ class PolicyRunnerTest {
         when(folderSource.supports(spec)).thenReturn(true);
         when(folderSource.resolve(eq(spec), any()))
                 .thenReturn(List.of(ResolvedInput.of(PolicyInputs.of(List.of()))));
-        when(policyEngine.runPolicy(any(), any(), any(), any()))
+        when(policyEngine.runPolicy(any(), any(), any(), any(), any()))
                 .thenReturn(new PolicyRunHandle("r", new CompletableFuture<>()));
 
         runner.run(policy, SweepKind.LIGHT);
 
-        verify(policyEngine).runPolicy(eq(policy), any(), any(), any());
+        verify(policyEngine).runPolicy(eq(policy), any(), any(), any(), any());
         verify(processedLedger, never()).markSeen(any(), any());
         verify(processedLedger, never()).deleteUnseen(any(), anyLong());
     }
@@ -244,12 +244,13 @@ class PolicyRunnerTest {
         when(folderSource.resolve(eq(broken), any())).thenThrow(new IOException("mount gone"));
         when(folderSource.resolve(eq(healthy), any()))
                 .thenReturn(List.of(ResolvedInput.of(PolicyInputs.of(List.of()))));
-        when(policyEngine.runPolicy(any(), any(), any(), any()))
+        when(policyEngine.runPolicy(any(), any(), any(), any(), any()))
                 .thenReturn(new PolicyRunHandle("r", new CompletableFuture<>()));
 
         runner.run(policy);
 
-        verify(policyEngine).runPolicy(eq(policy), any(), any(), any()); // healthy source still ran
+        verify(policyEngine)
+                .runPolicy(eq(policy), any(), any(), any(), any()); // healthy source still ran
         verify(processedLedger, never()).deleteUnseen(any(), anyLong()); // history preserved
     }
 
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/overview/PolicyOverviewServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/overview/PolicyOverviewServiceTest.java
index 8610926c2a..373b596136 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/overview/PolicyOverviewServiceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/overview/PolicyOverviewServiceTest.java
@@ -28,9 +28,11 @@ import stirling.software.proprietary.policy.store.InProcessPolicyStore;
 import stirling.software.proprietary.policy.store.PolicyStore;
 
 /**
- * Tests for {@link PolicyOverviewService}: every policy appears once with its sources resolved to
- * names, its steps and trigger/output summarised, and the KPI strip counting active vs paused.
- * Login is disabled so the team guards pass everything through.
+ * Tests for {@link PolicyOverviewService}: every Pipelines-page policy appears once with its
+ * sources resolved to names, its steps and trigger/output summarised, and the KPI strip counting
+ * active vs paused. Frontend/catalogue policies (owned by the Policies page) are excluded, while a
+ * pipeline that uses a folder-watch trigger stays. Login is disabled so the team guards pass
+ * everything through.
  */
 class PolicyOverviewServiceTest {
 
@@ -95,6 +97,51 @@ class PolicyOverviewServiceTest {
         assertEquals(List.of(2L, 1L, 1L), response.kpis().stream().map(PolicyKpi::value).toList());
     }
 
+    @Test
+    void excludesCataloguePoliciesButKeepsFolderWatchPipelines() {
+        Source inbox = source("Inbox", "/inbox");
+        // A hand-built pipeline: shows.
+        policyStore.save(
+                new Policy(
+                        null,
+                        "Compress pipeline",
+                        "owner",
+                        true,
+                        List.of(),
+                        List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                        OutputSpec.inline()));
+        // A folder-watch pipeline is still a pipeline: shows.
+        policyStore.save(
+                new Policy(
+                        null,
+                        "Inbox watcher",
+                        "owner",
+                        true,
+                        List.of(
+                                new PipelineInput(
+                                        inbox.id(), new TriggerConfig("folder-watch", Map.of()))),
+                        List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                        OutputSpec.inline()));
+        // A frontend/catalogue policy (categoryId in output options): hidden.
+        policyStore.save(
+                new Policy(
+                        null,
+                        "Classification Policy",
+                        "system",
+                        true,
+                        List.of(),
+                        List.of(new PipelineStep("/api/v1/ai/tools/classify-and-label", Map.of())),
+                        new OutputSpec("inline", Map.of("categoryId", "classification"))));
+
+        PoliciesOverviewResponse response = service.overview();
+
+        assertEquals(
+                List.of("Compress pipeline", "Inbox watcher"),
+                response.pipelines().stream().map(PolicyView::name).toList());
+        // KPIs count both visible pipelines, not the hidden catalogue policy.
+        assertEquals(List.of(2L, 2L, 0L), response.kpis().stream().map(PolicyKpi::value).toList());
+    }
+
     @Test
     void anUnresolvedSourceFallsBackToItsId() {
         policyStore.save(
diff --git a/app/saas/src/main/java/stirling/software/saas/config/MigrationOwnedSchemaFilter.java b/app/saas/src/main/java/stirling/software/saas/config/MigrationOwnedSchemaFilter.java
new file mode 100644
index 0000000000..4b2496bf15
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/config/MigrationOwnedSchemaFilter.java
@@ -0,0 +1,108 @@
+package stirling.software.saas.config;
+
+import org.hibernate.boot.model.relational.Namespace;
+import org.hibernate.boot.model.relational.Sequence;
+import org.hibernate.mapping.Table;
+import org.hibernate.tool.schema.spi.SchemaFilter;
+import org.hibernate.tool.schema.spi.SchemaFilterProvider;
+
+/**
+ * Hides the migration-owned tables from Hibernate's schema management.
+ *
+ * <p>Wired on the SaaS profile only, via {@code hibernate.hbm2ddl.schema_filter_provider}.
+ * Self-hosted is untouched: there Hibernate rightly owns everything.
+ *
+ * <p>Why a filter rather than simply turning {@code ddl-auto} off: the SaaS database has two
+ * writers. The Supabase migrations own the SaaS tables, and Hibernate owns roughly thirty tables
+ * inherited from the self-hosted app that no migration has ever created. Turn {@code ddl-auto} off
+ * and a fresh preview branch is missing that second half; leave it on and Hibernate is free to
+ * reconcile migration-owned tables, which is how {@code team_memberships.role} ended up widened to
+ * varchar(255) and needed a migration to put back. A filter keeps the first half working and makes
+ * the second impossible.
+ *
+ * <p>Note that this is a per-table filter, not a per-schema one. Hibernate's schema management runs
+ * over every mapped entity regardless of namespace, so moving SaaS tables to their own schema would
+ * not by itself keep Hibernate out of them. {@link SaasSchemaOwnership} is the register; this class
+ * only applies it.
+ *
+ * <p><b>Foreign keys still cross the line, on purpose.</b> Several inherited tables reference
+ * migration-owned ones — {@code folders}, {@code stored_files} and {@code file_shares} all point at
+ * {@code users}/{@code teams}. Hibernate's {@code SchemaCreatorImpl.createForeignKeys} and {@code
+ * AbstractSchemaMigrator.applyForeignKeys} check {@code includeTable} against the *owning* table
+ * only and then emit every foreign key on it, without consulting the referenced table. So excluding
+ * {@code users} does not cost the branch its referential integrity, and a branch ends up matching
+ * staging. It does mean the referenced tables have to exist by the time Hibernate runs, which holds
+ * because a Supabase branch applies its migrations at build time and the app connects afterwards.
+ *
+ * <p><b>Known gap: this cannot detect drift.</b> Filtering means Hibernate never inspects these
+ * tables, and {@link #getValidateFilter()} extends that to {@code validate}, so nothing here
+ * compares a migration-owned table against its entity. Combined with the register being a
+ * hand-maintained list of another repo's contents (see {@link SaasSchemaOwnership}), there is
+ * currently no automated signal when the register, the entities and the database disagree. That is
+ * a deliberate trade for a boot that does not fail on differences we accept, not a claim that drift
+ * cannot happen; a non-fatal drift report is the missing piece and belongs outside this class.
+ */
+public class MigrationOwnedSchemaFilter implements SchemaFilterProvider, SchemaFilter {
+
+    /**
+     * The one decision this class makes. Everything Hibernate might do to a table it does not own —
+     * create, alter, drop, truncate — is refused.
+     */
+    @Override
+    public boolean includeTable(Table table) {
+        return !SaasSchemaOwnership.isMigrationOwned(table.getName());
+    }
+
+    /**
+     * Namespaces are never filtered. The inherited tables and the migration-owned ones share {@code
+     * stirling_pdf}, so excluding the namespace would take both with it.
+     */
+    @Override
+    public boolean includeNamespace(Namespace namespace) {
+        return true;
+    }
+
+    /**
+     * Sequences are left alone. Every id here is an identity column rather than a mapped generator,
+     * so there is nothing for Hibernate to create; filtering them would be dead code pretending to
+     * be a safeguard.
+     */
+    @Override
+    public boolean includeSequence(Sequence sequence) {
+        return true;
+    }
+
+    @Override
+    public SchemaFilter getCreateFilter() {
+        return this;
+    }
+
+    @Override
+    public SchemaFilter getMigrateFilter() {
+        return this;
+    }
+
+    @Override
+    public SchemaFilter getDropFilter() {
+        return this;
+    }
+
+    @Override
+    public SchemaFilter getTruncatorFilter() {
+        return this;
+    }
+
+    /**
+     * Validation is filtered too, which is the one debatable call here.
+     *
+     * <p>Letting it through would give a useful signal when a migration-owned table drifts from its
+     * entity. But {@code ddl-auto=validate} fails startup, and it would fail on differences we have
+     * deliberately accepted — {@code ai_create_sessions} carries columns from a reverted feature
+     * that nothing maps, for instance. A boot failure over a table we have chosen not to manage is
+     * noise, so the rule stays uniform: Hibernate does not concern itself with these tables at all.
+     */
+    @Override
+    public SchemaFilter getValidateFilter() {
+        return this;
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/config/SaasProjectNotice.java b/app/saas/src/main/java/stirling/software/saas/config/SaasProjectNotice.java
new file mode 100644
index 0000000000..39305fcbcd
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/config/SaasProjectNotice.java
@@ -0,0 +1,53 @@
+package stirling.software.saas.config;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.annotation.Profile;
+import org.springframework.context.event.EventListener;
+import org.springframework.core.env.Environment;
+import org.springframework.stereotype.Component;
+
+import lombok.extern.slf4j.Slf4j;
+
+/** Logs which Supabase project this backend is talking to, and its schema policy. */
+@Slf4j
+@Component
+@Profile({"dev", "staging"})
+public class SaasProjectNotice {
+
+    private final Environment environment;
+    private final String projectRef;
+    private final String ddlAuto;
+
+    public SaasProjectNotice(
+            Environment environment,
+            @Value("${app.supabase.project-ref:unknown}") String projectRef,
+            @Value("${spring.jpa.hibernate.ddl-auto:none}") String ddlAuto) {
+        this.environment = environment;
+        this.projectRef = projectRef;
+        this.ddlAuto = ddlAuto;
+    }
+
+    @EventListener(ApplicationReadyEvent.class)
+    public void announceProject() {
+        boolean staging = environment.matchesProfiles("staging");
+        if (staging) {
+            log.info(
+                    """
+                    SaaS staging profile: Supabase project {}, ddl-auto={}. This is the SHARED \
+                    long-lived environment, so its data and schema are not yours alone. Testing an \
+                    open SaaS PR? Use that PR's preview branch instead \
+                    (SAAS_DEV_PROJECT_REF in app/.env.saas.local); staging will not have its \
+                    migrations.\
+                    """,
+                    projectRef,
+                    ddlAuto);
+            return;
+        }
+        log.info(
+                "SaaS dev profile: Supabase preview branch {}, ddl-auto={}. Disposable, so Hibernate"
+                        + " is allowed to add the inherited tables the migrations do not create.",
+                projectRef,
+                ddlAuto);
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/config/SaasSchemaOwnership.java b/app/saas/src/main/java/stirling/software/saas/config/SaasSchemaOwnership.java
new file mode 100644
index 0000000000..dffd1eccf1
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/config/SaasSchemaOwnership.java
@@ -0,0 +1,117 @@
+package stirling.software.saas.config;
+
+import java.util.Set;
+
+/**
+ * Which side owns each table in the SaaS database.
+ *
+ * <p>The SaaS schema has two writers and always has: the Supabase migrations in the
+ * Stirling-PDF-SaaS repo, and Hibernate's {@code ddl-auto}. That was a convention rather than a
+ * rule, and it leaked twice. An older {@code ddl-auto} run widened {@code team_memberships.role} to
+ * varchar(255), which needed a dedicated migration to repair because RLS policies depended on the
+ * column. Separately {@code payg_instance_usage} went months with an entity and no migration, so it
+ * simply did not exist on a fresh preview branch.
+ *
+ * <p>This class makes the boundary explicit and {@code SaasSchemaOwnershipTest} makes it binding:
+ * every {@code @Entity} the SaaS app maps must appear in exactly one of these two sets. A new
+ * entity fails the build until someone states who owns its table, which is the decision that was
+ * previously made by accident.
+ *
+ * <p>{@link MigrationOwnedSchemaFilter} enforces it at runtime: Hibernate is never shown the
+ * migration-owned tables, so it cannot create, alter or drop them whatever {@code ddl-auto} says.
+ * Inherited tables stay under Hibernate, so a preview branch built from migrations alone still
+ * heals itself on first boot.
+ *
+ * <p><b>What this does not catch.</b> The register is a hand-maintained copy of what lives in
+ * another repository, and only one direction is enforced. The test fails when a *new* entity
+ * appears with no owner. It cannot notice a table changing sides: write a migration for {@code
+ * folders} in Stirling-PDF-SaaS and nothing here changes, the test still passes, and Hibernate
+ * carries on managing a table the migrations now own — which is precisely how {@code
+ * team_memberships.role} got widened. Adding a migration for anything in {@link #HIBERNATE_MANAGED}
+ * therefore means moving it to {@link #MIGRATION_OWNED} in the same change; nothing will remind
+ * you. Making that structural rather than remembered is what moving the SaaS tables into their own
+ * schema would buy, and is the reason this class is a stepping stone rather than the answer.
+ */
+public final class SaasSchemaOwnership {
+
+    /**
+     * Created and altered by the Supabase migrations. Hibernate must not touch these: the
+     * migrations carry constraints, defaults and RLS policies it knows nothing about and would
+     * reconcile away.
+     */
+    public static final Set<String> MIGRATION_OWNED =
+            Set.of(
+                    "ai_create_sessions",
+                    "audit_events",
+                    "authorities",
+                    "billing_subscriptions",
+                    "job_artifact_hash",
+                    "legal_consent",
+                    "linked_instance",
+                    "payg_instance_usage",
+                    "payg_meter_event_log",
+                    "payg_prepaid_bundle",
+                    "payg_shadow_charge",
+                    "payg_team_extensions",
+                    "persistent_logins",
+                    "pricing_policy",
+                    "processing_job",
+                    "processing_job_step",
+                    "procurement_agreement_signature",
+                    "procurement_deal",
+                    "procurement_quote",
+                    "saas_team_extensions",
+                    "saas_user_extensions",
+                    "sessions",
+                    "team_invitations",
+                    "team_memberships",
+                    "teams",
+                    "users",
+                    "wallet_entitlement_snapshot",
+                    "wallet_ledger",
+                    "wallet_policy");
+
+    /**
+     * Inherited from the self-hosted app, where {@code ddl-auto} owns the schema and no Supabase
+     * migration exists. Deliberately left under Hibernate so a fresh branch gets them on first
+     * boot.
+     */
+    public static final Set<String> HIBERNATE_MANAGED =
+            Set.of(
+                    "account_link_device_credential",
+                    "account_link_metered_signature",
+                    "account_link_sync_state",
+                    "account_link_usage_counter",
+                    "api_key_daily_usage",
+                    "api_keys",
+                    "file_encryption_keys",
+                    "file_run_events",
+                    "file_share_accesses",
+                    "file_shares",
+                    "folders",
+                    "integration_configs",
+                    "invite_tokens",
+                    "jwt_signing_keys",
+                    "policies",
+                    "policy_assets",
+                    "policy_completed_migrations",
+                    "policy_processed_files",
+                    "policy_source_doc_counts",
+                    "policy_source_doc_totals",
+                    "policy_sources",
+                    "resource_grants",
+                    "storage_cleanup_entries",
+                    "stored_file_blobs",
+                    "stored_files",
+                    "user_license_settings",
+                    "user_server_certificates",
+                    "workflow_participants",
+                    "workflow_sessions");
+
+    private SaasSchemaOwnership() {}
+
+    /** Case-insensitive: Hibernate hands us whatever casing the mapping used. */
+    public static boolean isMigrationOwned(String tableName) {
+        return tableName != null && MIGRATION_OWNED.contains(tableName.toLowerCase());
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/security/TeamLeaderPolicyManagementAuthority.java b/app/saas/src/main/java/stirling/software/saas/security/TeamLeaderPolicyManagementAuthority.java
index e2f5b65b47..0ce5e8e308 100644
--- a/app/saas/src/main/java/stirling/software/saas/security/TeamLeaderPolicyManagementAuthority.java
+++ b/app/saas/src/main/java/stirling/software/saas/security/TeamLeaderPolicyManagementAuthority.java
@@ -25,6 +25,11 @@ public class TeamLeaderPolicyManagementAuthority implements PolicyManagementAuth
         return teamSecurity.isCurrentUserTeamLeader();
     }
 
+    @Override
+    public boolean canTriggerPolicies() {
+        return teamSecurity.isCurrentUserTeamLeader();
+    }
+
     @Override
     public Long currentUserTeamId() {
         return teamSecurity.currentUserTeamId();
diff --git a/app/saas/src/main/resources/application-dev.properties b/app/saas/src/main/resources/application-dev.properties
index ee8bf80ff2..b289fc95cc 100644
--- a/app/saas/src/main/resources/application-dev.properties
+++ b/app/saas/src/main/resources/application-dev.properties
@@ -1,32 +1,40 @@
-# SaaS dev profile. Points at the dev Supabase project.
-# Boot: java -jar stirling-pdf.jar --spring.profiles.include=dev
+# SaaS dev profile: follows the Supabase preview branch of the SaaS PR under test.
+# One variable switches PR, SAAS_DEV_PROJECT_REF; everything else derives from it.
+# Want a stable shared environment instead? Use the staging profile.
+
 spring.config.import=optional:classpath:application-dev-local.properties
 
-app.supabase.project-ref=qacaivhsjtftfwtgjvva
+# Let Hibernate reconcile the entity tables so a fresh preview branch heals itself. A branch is built
+# from the Supabase migrations, which cover the SaaS-owned tables but not the ~28 inherited from the
+# self-hosted app -- those have only ever been created by ddl-auto. Safe here because a preview branch
+# is disposable and `update` only ever adds; staging pins `none`, so keep this profile-scoped.
+spring.jpa.hibernate.ddl-auto=update
 
-stirling.supabase.url=https://qacaivhsjtftfwtgjvva.supabase.co
-stirling.supabase.publishable-key=sb_publishable_nIM8y-9ARPE7EzQwAQHKMg_40fCN6kY # gitleaks:allow
+# From the PR's "Supabase Preview" check. Required with no fallback: ddl-auto=update above must never
+# be aimed at the shared project.
+app.supabase.project-ref=${SAAS_DEV_PROJECT_REF}
 
-spring.datasource.url=${SAAS_DEV_DB_URL:jdbc:postgresql://db.qacaivhsjtftfwtgjvva.supabase.co:5432/postgres?ApplicationName=stirling-consolidation-${user.name}}
+stirling.supabase.url=https://${app.supabase.project-ref}.supabase.co
+# Per-branch, not derivable. Dashboard > Settings > API.
+stirling.supabase.publishable-key=${SAAS_DEV_PUBLISHABLE_KEY}
+
+# Override the whole URL if the branch needs the pooler host rather than the direct one.
+spring.datasource.url=${SAAS_DEV_DB_URL:jdbc:postgresql://db.${app.supabase.project-ref}.supabase.co:5432/postgres?ApplicationName=stirling-dev-${user.name}}
 spring.datasource.username=${SAAS_DEV_DB_USERNAME:postgres}
-# Password not committed; export SAAS_DEV_DB_PASSWORD or pass --spring.datasource.password=...
+# A preview branch has its own password; the parent project's will not authenticate.
 spring.datasource.password=${SAAS_DEV_DB_PASSWORD:}
 
-# Conservative dev pool sizing.
 spring.datasource.hikari.maximum-pool-size=2
 spring.datasource.hikari.minimum-idle=1
 spring.datasource.hikari.idle-timeout=60000
 spring.datasource.hikari.max-lifetime=1800000
 spring.datasource.hikari.keepalive-time=300000
-spring.datasource.hikari.data-source-properties.ApplicationName=stirling-consolidation-${user.name}
+spring.datasource.hikari.data-source-properties.ApplicationName=stirling-dev-${user.name}
 
 logging.level.stirling.software.saas=DEBUG
 logging.level.org.springframework.security.oauth2.jwt=WARN
 logging.level.org.springframework.security.oauth2.server.resource=WARN
 
-# Supabase meter edge fn the Java backend calls (server-to-server, on job close).
-# URL is not a secret; auth rides the existing SUPABASE_EDGE_FUNCTION_SECRET (same
-# shared secret the team-invitation flow uses — no service-role key in the Java env).
-# Blank secret → the meter service no-ops with a WARN, so the app still boots.
-# The billing portal is NOT here — the FE calls create-customer-portal-session directly.
-payg.meter.endpoint=https://qacaivhsjtftfwtgjvva.supabase.co/functions/v1/meter-payg-units
+# Server-to-server meter call. Auth rides SUPABASE_EDGE_FUNCTION_SECRET; blank secret means the meter
+# service no-ops with a WARN rather than failing the boot.
+payg.meter.endpoint=https://${app.supabase.project-ref}.supabase.co/functions/v1/meter-payg-units
diff --git a/app/saas/src/main/resources/application-saas.properties b/app/saas/src/main/resources/application-saas.properties
index f0630aaac1..e3c32c429e 100644
--- a/app/saas/src/main/resources/application-saas.properties
+++ b/app/saas/src/main/resources/application-saas.properties
@@ -27,6 +27,13 @@ spring.jpa.properties.hibernate.hbm2ddl.create_namespaces=true
 
 spring.jpa.hibernate.ddl-auto=update
 
+# ...but only over the tables Hibernate actually owns. The SaaS database has two writers: the
+# Supabase migrations own the SaaS tables, Hibernate owns ~30 inherited from the self-hosted app that
+# no migration has ever created. This filter hides the former from schema management, so ddl-auto can
+# still heal a fresh preview branch without being free to reconcile a migration-owned table — which
+# is how team_memberships.role ended up widened to varchar(255). Register: SaasSchemaOwnership.
+spring.jpa.properties.hibernate.hbm2ddl.schema_filter_provider=stirling.software.saas.config.MigrationOwnedSchemaFilter
+
 # ---------- Supabase JWT auth ----------
 # Required: set SAAS_DB_PROJECT_REF via env.
 app.supabase.project-ref=${SAAS_DB_PROJECT_REF:}
diff --git a/app/saas/src/main/resources/application-staging.properties b/app/saas/src/main/resources/application-staging.properties
new file mode 100644
index 0000000000..4874ed3fb5
--- /dev/null
+++ b/app/saas/src/main/resources/application-staging.properties
@@ -0,0 +1,39 @@
+# SaaS staging profile: the long-lived shared v3 project, pinned so it is still there tomorrow.
+# For work on an open SaaS PR use the dev profile, which follows that PR's preview branch.
+
+spring.config.import=optional:classpath:application-staging-local.properties
+
+# Stated rather than inherited: application-saas.properties defaults to `update`, and staging's
+# schema is shared and RLS-dependent, so it must not be reconciled by Hibernate.
+spring.jpa.hibernate.ddl-auto=none
+
+# Committed as a default rather than a literal, so staging needs no setup but stays repointable.
+# Neither the ref nor the publishable key is secret: the ref is a public subdomain, the key ships in
+# the browser bundle. Everything below derives from the ref, so an override follows through.
+app.supabase.project-ref=${SAAS_STAGING_PROJECT_REF:qacaivhsjtftfwtgjvva}
+
+stirling.supabase.url=https://${app.supabase.project-ref}.supabase.co
+stirling.supabase.publishable-key=${SAAS_STAGING_PUBLISHABLE_KEY:sb_publishable_nIM8y-9ARPE7EzQwAQHKMg_40fCN6kY}
+
+spring.datasource.url=${SAAS_STAGING_DB_URL:jdbc:postgresql://db.${app.supabase.project-ref}.supabase.co:5432/postgres?ApplicationName=stirling-staging-${user.name}}
+spring.datasource.username=${SAAS_STAGING_DB_USERNAME:postgres}
+# Password not committed; export SAAS_STAGING_DB_PASSWORD or pass --spring.datasource.password=...
+spring.datasource.password=${SAAS_STAGING_DB_PASSWORD:}
+
+# Conservative pool sizing: this is a shared project, so don't hold connections others need.
+spring.datasource.hikari.maximum-pool-size=2
+spring.datasource.hikari.minimum-idle=1
+spring.datasource.hikari.idle-timeout=60000
+spring.datasource.hikari.max-lifetime=1800000
+spring.datasource.hikari.keepalive-time=300000
+spring.datasource.hikari.data-source-properties.ApplicationName=stirling-staging-${user.name}
+
+logging.level.stirling.software.saas=DEBUG
+logging.level.org.springframework.security.oauth2.jwt=WARN
+logging.level.org.springframework.security.oauth2.server.resource=WARN
+
+# Supabase meter edge fn the Java backend calls (server-to-server, on job close).
+# URL is not a secret; auth rides the existing SUPABASE_EDGE_FUNCTION_SECRET (same
+# shared secret the team-invitation flow uses — no service-role key in the Java env).
+# Blank secret → the meter service no-ops with a WARN, so the app still boots.
+payg.meter.endpoint=https://${app.supabase.project-ref}.supabase.co/functions/v1/meter-payg-units
diff --git a/app/saas/src/test/java/stirling/software/saas/config/MigrationOwnedSchemaFilterTest.java b/app/saas/src/test/java/stirling/software/saas/config/MigrationOwnedSchemaFilterTest.java
new file mode 100644
index 0000000000..956654384e
--- /dev/null
+++ b/app/saas/src/test/java/stirling/software/saas/config/MigrationOwnedSchemaFilterTest.java
@@ -0,0 +1,129 @@
+package stirling.software.saas.config;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.io.InputStream;
+import java.util.Properties;
+
+import org.hibernate.mapping.Table;
+import org.hibernate.tool.schema.spi.SchemaFilter;
+import org.hibernate.tool.schema.spi.SchemaFilterProvider;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Covers {@link MigrationOwnedSchemaFilter} and, just as importantly, its wiring.
+ *
+ * <p>{@link SaasSchemaOwnershipTest} proves the register is complete; nothing proved the filter
+ * applies it, or that Hibernate is even asking. A typo in the {@code
+ * hibernate.hbm2ddl.schema_filter_provider} key, a stale fully-qualified name after a package move,
+ * or a getter returning null would all leave every migration-owned table exposed to {@code
+ * ddl-auto} with a fully green build. Hence the property assertion below, which is the only thing
+ * here that would catch that.
+ */
+class MigrationOwnedSchemaFilterTest {
+
+    private static final String FILTER_PROPERTY =
+            "spring.jpa.properties.hibernate.hbm2ddl.schema_filter_provider";
+
+    private final MigrationOwnedSchemaFilter filter = new MigrationOwnedSchemaFilter();
+
+    /** "orm" is Hibernate's own default contributor; the value is irrelevant to the filter. */
+    private static Table table(String name) {
+        return new Table("orm", name);
+    }
+
+    @Test
+    void migrationOwnedTablesAreHiddenFromHibernate() {
+        assertThat(filter.includeTable(table("teams"))).isFalse();
+        assertThat(filter.includeTable(table("users"))).isFalse();
+        assertThat(filter.includeTable(table("team_memberships"))).isFalse();
+        assertThat(filter.includeTable(table("payg_instance_usage"))).isFalse();
+    }
+
+    @Test
+    void inheritedTablesStayUnderHibernate() {
+        assertThat(filter.includeTable(table("folders"))).isTrue();
+        assertThat(filter.includeTable(table("stored_files"))).isTrue();
+        assertThat(filter.includeTable(table("api_keys"))).isTrue();
+    }
+
+    @Test
+    void anUnknownTableIsLeftToHibernate() {
+        // Fail-open is the right default: an unrecognised table is either brand new or from a
+        // module
+        // we do not know about, and SaasSchemaOwnershipTest is what stops it staying unrecognised.
+        assertThat(filter.includeTable(table("no_such_table"))).isTrue();
+    }
+
+    @Test
+    void casingDoesNotDefeatTheFilter() {
+        assertThat(filter.includeTable(table("TEAMS"))).isFalse();
+        assertThat(filter.includeTable(table("Team_Memberships"))).isFalse();
+    }
+
+    /**
+     * Foreign keys from an inherited table into a migration-owned one survive the filter.
+     *
+     * <p>Worth pinning, because it is not obvious and it decides whether a preview branch keeps
+     * referential integrity. {@code folders}, {@code stored_files} and {@code file_shares} all
+     * reference {@code users}/{@code teams}, which the filter excludes. Hibernate 7.2's {@code
+     * SchemaCreatorImpl.createForeignKeys} (and {@code AbstractSchemaMigrator.applyForeignKeys})
+     * tests {@code includeTable} against the *owning* table only, then emits every foreign key on
+     * it; the referenced table is never consulted. So the constraints are still created and a
+     * branch matches staging.
+     *
+     * <p>The one thing this depends on is ordering: the referenced tables have to exist first. They
+     * do, because a Supabase branch runs its migrations at build time and the app connects after.
+     */
+    @Test
+    void foreignKeysIntoMigrationOwnedTablesAreStillEmitted() {
+        assertThat(filter.includeTable(table("folders"))).isTrue();
+        assertThat(filter.includeTable(table("file_shares"))).isTrue();
+        assertThat(filter.includeTable(table("users"))).isFalse();
+        assertThat(filter.includeTable(table("teams"))).isFalse();
+    }
+
+    @Test
+    void everySchemaActionGetsTheSameFilter() {
+        assertThat(filter.getCreateFilter()).isSameAs(filter);
+        assertThat(filter.getMigrateFilter()).isSameAs(filter);
+        assertThat(filter.getDropFilter()).isSameAs(filter);
+        assertThat(filter.getTruncatorFilter()).isSameAs(filter);
+        assertThat(filter.getValidateFilter()).isSameAs(filter);
+    }
+
+    @Test
+    void namespacesAndSequencesAreNeverFiltered() {
+        // Both share the stirling_pdf namespace, so filtering it would take the inherited tables
+        // with it. Neither argument is read, so nulls are fine and keep the test free of Hibernate
+        // bootstrap machinery.
+        assertThat(filter.includeNamespace(null)).isTrue();
+        assertThat(filter.includeSequence(null)).isTrue();
+    }
+
+    @Test
+    void theFilterIsActuallyWiredIntoHibernate() throws Exception {
+        Properties properties = new Properties();
+        try (InputStream in = getClass().getResourceAsStream("/application-saas.properties")) {
+            assertThat(in)
+                    .as("application-saas.properties must be on the test classpath to check wiring")
+                    .isNotNull();
+            properties.load(in);
+        }
+
+        String configured = properties.getProperty(FILTER_PROPERTY);
+        assertThat(configured)
+                .as(
+                        "%s is unset, so Hibernate installs its default filter and every"
+                                + " migration-owned table is back under ddl-auto",
+                        FILTER_PROPERTY)
+                .isNotBlank();
+
+        Class<?> wired = Class.forName(configured.trim());
+        assertThat(SchemaFilterProvider.class)
+                .as("Hibernate only accepts a SchemaFilterProvider here")
+                .isAssignableFrom(wired);
+        assertThat(SchemaFilter.class).isAssignableFrom(wired);
+        assertThat(wired).isEqualTo(MigrationOwnedSchemaFilter.class);
+    }
+}
diff --git a/app/saas/src/test/java/stirling/software/saas/config/SaasSchemaOwnershipTest.java b/app/saas/src/test/java/stirling/software/saas/config/SaasSchemaOwnershipTest.java
new file mode 100644
index 0000000000..e07b1042e7
--- /dev/null
+++ b/app/saas/src/test/java/stirling/software/saas/config/SaasSchemaOwnershipTest.java
@@ -0,0 +1,167 @@
+package stirling.software.saas.config;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.util.Arrays;
+import java.util.List;
+import java.util.Set;
+import java.util.TreeMap;
+import java.util.TreeSet;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.config.BeanDefinition;
+import org.springframework.boot.persistence.autoconfigure.EntityScan;
+import org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider;
+import org.springframework.core.type.filter.AnnotationTypeFilter;
+import org.springframework.util.ClassUtils;
+
+import jakarta.persistence.Entity;
+import jakarta.persistence.Table;
+
+import stirling.software.proprietary.security.configuration.DatabaseConfig;
+
+/**
+ * Makes {@link SaasSchemaOwnership} binding rather than decorative.
+ *
+ * <p>Every {@code @Entity} the SaaS app maps has to be declared as owned by either the Supabase
+ * migrations or Hibernate. Adding an entity without saying which fails here, at build time, instead
+ * of months later on a preview branch that has no such table. That is not hypothetical: {@code
+ * payg_instance_usage} shipped with an entity and no migration and went unnoticed until a branch
+ * tried to use it.
+ *
+ * <p>"Maps" is meant precisely: the scan covers the packages named by the {@code @EntityScan}
+ * declarations the app actually boots with, not everything under {@code stirling.software}. See
+ * {@link #mappedPackages()}. Note this only enforces one direction — {@link SaasSchemaOwnership}
+ * documents the drift it cannot see.
+ */
+class SaasSchemaOwnershipTest {
+
+    /**
+     * The packages the running app actually maps, read off the two {@code @EntityScan} declarations
+     * that define them rather than hardcoded.
+     *
+     * <p>Scanning all of {@code stirling.software} would be easier and wrong in a quiet way: it is
+     * a superset, so it would force ownership declarations for entities Hibernate never sees and
+     * let the register claim tables that do not exist as far as the SaaS app is concerned. Deriving
+     * the list means this test measures the same set Hibernate does, and follows a package being
+     * added or moved without anyone updating it here.
+     */
+    private static Set<String> mappedPackages() {
+        Set<String> packages = new TreeSet<>();
+        for (Class<?> config : List.of(SaasJpaConfig.class, DatabaseConfig.class)) {
+            EntityScan scan = config.getAnnotation(EntityScan.class);
+            assertThat(scan)
+                    .as("%s must carry @EntityScan, or its entities are not mapped", config)
+                    .isNotNull();
+            packages.addAll(Arrays.asList(scan.value()));
+        }
+        return packages;
+    }
+
+    private static TreeMap<String, String> mappedTables() {
+        ClassPathScanningCandidateComponentProvider scanner =
+                new ClassPathScanningCandidateComponentProvider(false);
+        scanner.addIncludeFilter(new AnnotationTypeFilter(Entity.class));
+        TreeMap<String, String> byTable = new TreeMap<>();
+        for (String basePackage : mappedPackages()) {
+            for (BeanDefinition bd : scanner.findCandidateComponents(basePackage)) {
+                String className = bd.getBeanClassName();
+                Class<?> type;
+                try {
+                    type =
+                            ClassUtils.forName(
+                                    className, SaasSchemaOwnershipTest.class.getClassLoader());
+                } catch (ClassNotFoundException | LinkageError e) {
+                    continue; // not on this module's runtime classpath; nothing to own
+                }
+                Table table = type.getAnnotation(Table.class);
+                String name =
+                        table != null && !table.name().isBlank()
+                                ? table.name()
+                                : camelToSnake(type.getSimpleName());
+                byTable.put(name.toLowerCase(), className);
+            }
+        }
+        return byTable;
+    }
+
+    /** Mirrors Spring Boot's default CamelCaseToUnderscoresNamingStrategy for an unnamed @Table. */
+    private static String camelToSnake(String name) {
+        return name.replaceAll("([a-z0-9])([A-Z])", "$1_$2").toLowerCase();
+    }
+
+    @Test
+    void everyEntityTableIsOwnedByExactlyOneSide() {
+        TreeMap<String, String> mapped = mappedTables();
+        assertThat(mapped)
+                .as("entity scan found nothing, so this test proves nothing")
+                .isNotEmpty();
+        // The scan is derived from @EntityScan now, so a package quietly dropped from either
+        // declaration would shrink it and weaken this test rather than fail it. These four straddle
+        // the two declarations, so losing either side fails here instead of silently checking less.
+        assertThat(mapped.keySet())
+                .as("both @EntityScan declarations must have contributed to the scan")
+                .contains("users", "teams", "payg_instance_usage", "folders");
+
+        Set<String> undeclared = new TreeSet<>();
+        Set<String> both = new TreeSet<>();
+        for (String table : mapped.keySet()) {
+            boolean migration = SaasSchemaOwnership.MIGRATION_OWNED.contains(table);
+            boolean hibernate = SaasSchemaOwnership.HIBERNATE_MANAGED.contains(table);
+            if (migration && hibernate) both.add(table);
+            if (!migration && !hibernate) undeclared.add(table);
+        }
+
+        assertThat(undeclared)
+                .as(
+                        """
+                        These entity tables are not declared in SaasSchemaOwnership, so nobody owns \
+                        them. Decide and add each to exactly one set:
+                          - MIGRATION_OWNED: also add a migration in Stirling-PDF-SaaS, or the table \
+                        will not exist on a fresh preview branch.
+                          - HIBERNATE_MANAGED: only correct for a table inherited from the \
+                        self-hosted app that no Supabase migration creates.
+                        Offending tables -> entities: %s"""
+                                .formatted(
+                                        undeclared.stream()
+                                                .map(t -> t + " (" + mapped.get(t) + ")")
+                                                .toList()))
+                .isEmpty();
+
+        assertThat(both)
+                .as("declared as owned by both sides, which is the one thing it cannot be")
+                .isEmpty();
+    }
+
+    @Test
+    void theTwoSetsDoNotOverlap() {
+        Set<String> overlap = new TreeSet<>(SaasSchemaOwnership.MIGRATION_OWNED);
+        overlap.retainAll(SaasSchemaOwnership.HIBERNATE_MANAGED);
+        assertThat(overlap).isEmpty();
+    }
+
+    @Test
+    void tableNamesAreLowercaseSoLookupsCannotMiss() {
+        // isMigrationOwned() lowercases its input; a capital in either set would be unreachable.
+        assertThat(SaasSchemaOwnership.MIGRATION_OWNED)
+                .allSatisfy(t -> assertThat(t).isEqualTo(t.toLowerCase()));
+        assertThat(SaasSchemaOwnership.HIBERNATE_MANAGED)
+                .allSatisfy(t -> assertThat(t).isEqualTo(t.toLowerCase()));
+    }
+
+    @Test
+    void migrationOwnedTablesIncludeTheOnesThatBitUs() {
+        // team_memberships is the table an old ddl-auto run widened; payg_instance_usage is the one
+        // that had an entity and no migration. Both must be on the migrations' side of the line.
+        assertThat(SaasSchemaOwnership.MIGRATION_OWNED)
+                .contains("team_memberships", "payg_instance_usage", "teams", "users");
+    }
+
+    @Test
+    void isMigrationOwnedIsCaseInsensitiveAndNullSafe() {
+        assertThat(SaasSchemaOwnership.isMigrationOwned("TEAM_MEMBERSHIPS")).isTrue();
+        assertThat(SaasSchemaOwnership.isMigrationOwned("team_memberships")).isTrue();
+        assertThat(SaasSchemaOwnership.isMigrationOwned(null)).isFalse();
+        assertThat(SaasSchemaOwnership.isMigrationOwned("no_such_table")).isFalse();
+    }
+}
diff --git a/app/saas/src/test/java/stirling/software/saas/security/TeamLeaderPolicyManagementAuthorityTest.java b/app/saas/src/test/java/stirling/software/saas/security/TeamLeaderPolicyManagementAuthorityTest.java
index 70cd360d7c..2c37980a5c 100644
--- a/app/saas/src/test/java/stirling/software/saas/security/TeamLeaderPolicyManagementAuthorityTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/security/TeamLeaderPolicyManagementAuthorityTest.java
@@ -32,6 +32,18 @@ class TeamLeaderPolicyManagementAuthorityTest {
         assertFalse(authority().canEditPolicies());
     }
 
+    @Test
+    void teamLeaderMayTriggerPolicies() {
+        when(teamSecurity.isCurrentUserTeamLeader()).thenReturn(true);
+        assertTrue(authority().canTriggerPolicies());
+    }
+
+    @Test
+    void nonLeaderMayNotTriggerPolicies() {
+        when(teamSecurity.isCurrentUserTeamLeader()).thenReturn(false);
+        assertFalse(authority().canTriggerPolicies());
+    }
+
     @Test
     void currentUserTeamIdDelegatesToTeamSecurity() {
         when(teamSecurity.currentUserTeamId()).thenReturn(9L);
diff --git a/build.gradle b/build.gradle
index d6fa590ee4..cadf4bafa6 100644
--- a/build.gradle
+++ b/build.gradle
@@ -30,7 +30,7 @@ ext {
     openSamlVersion = "5.2.1"
     commonmarkVersion = "0.28.0"
     googleJavaFormatVersion = "1.35.0"
-    logback = "1.5.32"
+    logback = "1.6.1"
     commonsIoVersion = "2.22.0"
     commonsLang3 = "3.20.0"
     rhinoVersion = "1.9.1"
@@ -44,9 +44,9 @@ ext {
     batikVersion = "1.19"
     jpdfiumVersion = "1.0.4"
     jwtVersion = "0.13.0"
-    awsSdkVersion = "2.44.12"
-    jschVersion = "0.2.23"
-    commonsNetVersion = "3.11.1"
+    awsSdkVersion = "2.51.3"
+    jschVersion = "2.28.6"
+    commonsNetVersion = "3.13.0"
     smbjVersion = "0.14.0"
     tinkVersion = "1.23.0"
     testcontainersMinioVersion = "1.21.4"
@@ -302,8 +302,17 @@ subprojects {
 
     tasks.withType(Test).configureEach {
         useJUnitPlatform()
+        jvmArgs '--enable-native-access=ALL-UNNAMED'
         systemProperty 'java.awt.headless', 'true'
         systemProperty 'apple.awt.UIElement', 'true'
+
+        testLogging {
+            events "started", "failed"
+            showExceptions = true
+            showCauses = true
+            showStackTraces = true
+            exceptionFormat "full"
+        }
         finalizedBy(jacocoReport)
     }
 
diff --git a/docker/backend/Dockerfile b/docker/backend/Dockerfile
index 454fdedcfd..fd26ee2fb7 100644
--- a/docker/backend/Dockerfile
+++ b/docker/backend/Dockerfile
@@ -45,7 +45,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
       --no-daemon
 
 # Stage 2: Extract Spring Boot Layers
-FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS jar-extract
+FROM eclipse-temurin:25-jre-noble@sha256:fbcf915c585659b30eb766ada4d6d7cfc9ec1040bf521e95bf61b10a25af73db AS jar-extract
 WORKDIR /tmp
 COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
 RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
diff --git a/docker/base/Dockerfile b/docker/base/Dockerfile
index 6cffbf88f9..95e4e84795 100644
--- a/docker/base/Dockerfile
+++ b/docker/base/Dockerfile
@@ -364,7 +364,7 @@ RUN --mount=type=cache,target=/root/.cache/pip,sharing=locked \
 
 
 # Final runtime image - the actual base image
-FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS runtime
+FROM eclipse-temurin:25-jre-noble@sha256:fbcf915c585659b30eb766ada4d6d7cfc9ec1040bf521e95bf61b10a25af73db AS runtime
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
diff --git a/docker/embedded/Dockerfile b/docker/embedded/Dockerfile
index de7da3789e..d4ad422476 100644
--- a/docker/embedded/Dockerfile
+++ b/docker/embedded/Dockerfile
@@ -61,7 +61,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
       --no-daemon
 
 # Stage 2: Extract Spring Boot Layers
-FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS jar-extract
+FROM eclipse-temurin:25-jre-noble@sha256:fbcf915c585659b30eb766ada4d6d7cfc9ec1040bf521e95bf61b10a25af73db AS jar-extract
 WORKDIR /tmp
 COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
 RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
diff --git a/docker/embedded/Dockerfile.fat b/docker/embedded/Dockerfile.fat
index 300729e560..58eafec851 100644
--- a/docker/embedded/Dockerfile.fat
+++ b/docker/embedded/Dockerfile.fat
@@ -56,7 +56,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
       --no-daemon
 
 # Stage 2: Extract Spring Boot Layers
-FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175 AS jar-extract
+FROM eclipse-temurin:25-jre-noble@sha256:fbcf915c585659b30eb766ada4d6d7cfc9ec1040bf521e95bf61b10a25af73db AS jar-extract
 WORKDIR /tmp
 COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
 RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
diff --git a/docker/embedded/Dockerfile.ultra-lite b/docker/embedded/Dockerfile.ultra-lite
index 68a65dea6a..d4a21b7812 100644
--- a/docker/embedded/Dockerfile.ultra-lite
+++ b/docker/embedded/Dockerfile.ultra-lite
@@ -57,7 +57,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
 
 # Stage 2: Runtime image
 # glibc base (not Alpine/musl): JPDFium's PDFium natives are glibc-linked.
-FROM eclipse-temurin:25-jre-noble@sha256:2f1da100788559b397bcf48c736169ea5b070bde84e55f203bbee8e83d87a175
+FROM eclipse-temurin:25-jre-noble@sha256:fbcf915c585659b30eb766ada4d6d7cfc9ec1040bf521e95bf61b10a25af73db
 
 ENV DEBIAN_FRONTEND=noninteractive \
     LANG=C.UTF-8 \
diff --git a/docs/stirling.png b/docs/stirling.png
index 5edc6eae26..1b043a72ec 100644
Binary files a/docs/stirling.png and b/docs/stirling.png differ
diff --git a/docs/stirling.svg b/docs/stirling.svg
index 0fef4393aa..b5455291c9 100644
--- a/docs/stirling.svg
+++ b/docs/stirling.svg
@@ -1 +1,5 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 512 512" style="enable-background:new 0 0 512 512" xml:space="preserve"><defs id="defs173"><linearGradient id="XMLID_5_" x1="304.496" x2="316.036" y1="422.91" y2="326.263" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#dcf1f3" id="stop156"/><stop offset="1" style="stop-color:#c2c2c9" id="stop158"/></linearGradient></defs><style id="style150" type="text/css">.st1{fill:#c02223}.st2{fill:#882425}.st3{fill:url(#XMLID_5_)}.st4{fill:url(#XMLID_7_)}</style><g id="XMLID_4_"><path id="XMLID_131_" d="M 347.01402,14.355825 98.978019,69.02261 C 73.825483,74.547445 55.942464,96.792175 55.942464,122.52628 v 315.06096 c 0,22.39012 16.719895,41.14548 38.819234,43.76251 L 224.8861,498.36042 339.48636,384.26465 455.76603,265.15425 453.73057,84.870162 C 453.43979,62.916214 433.08513,46.632491 411.71274,51.284984 l -28.78729,6.251786 0.14539,-13.666697 C 383.36162,24.678542 365.62399,10.284894 347.01402,14.355825 Z" class="st1" style="stroke-width:1.45391"/><path id="XMLID_117_" d="m 383.21622,57.53677 v 285.8375 L 456.05681,265.00885 454.02135,78.763767 C 453.87595,59.863016 436.28372,45.905539 417.81914,49.97647 Z" class="st2" style="stroke-width:1.45391"/><polygon id="XMLID_18_" points="234.7 422.6 368.5 387.7 393.5 262.2" class="st3" style="fill:url(#XMLID_5_)" transform="matrix(1.4556308,0,0,1.4548265,-116.73161,-116.45231)"/><linearGradient id="XMLID_7_" x1="223.084" x2="241.417" y1="372.756" y2="114.557" gradientTransform="matrix(1.4539039,0,0,1.4539039,-116.19976,-116.20474)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#dcf1f3" id="stop163"/><stop offset="1" style="stop-color:#c2c2c9" id="stop165"/></linearGradient><path id="XMLID_6_" d="m 282.89686,214.84917 c 0,0 -22.24473,-28.93269 -38.67384,-36.78377 -10.46811,-4.94327 -26.02489,-6.83335 -38.23768,-0.72695 -18.02841,9.0142 -19.91848,34.31213 -3.34397,44.34406 3.92553,2.47165 9.15959,4.50711 15.99294,6.10641 36.63838,8.43264 97.12077,25.87949 89.70587,96.10304 0,0 -4.21633,65.86185 -73.56753,73.42215 -12.2128,1.30851 -24.57098,0.43617 -36.493,-2.32625 -16.42911,-3.63476 -45.50719,-11.04967 -59.75545,-19.91849 l -2.61703,-75.16682 h 6.97875 c 0,0 13.81208,33.43978 53.06749,49.57812 7.26952,2.90781 15.26599,4.07093 22.97168,2.90781 9.74116,-1.45391 21.22699,-6.68796 25.87949,-22.53551 0,0 7.85108,-23.11707 -32.85823,-35.76604 -32.56744,-10.17733 -63.24481,-20.64543 -75.89378,-54.95757 -5.961,-16.28371 -6.97874,-34.31212 -2.90781,-51.61358 5.37944,-22.53551 20.79082,-54.23062 64.40794,-67.89732 0,0 57.28381,-15.55677 96.53922,5.52484 l -1.74468,89.70587 z" class="st4" style="fill:url(#XMLID_7_);stroke-width:1.45391"/></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" width="512" height="512">
+  <rect width="512" height="512" rx="80" ry="80" fill="#8E3131"/>
+  <path d="M202 268L432 78V255L202 445V268Z" fill="#FFFFFF" fill-opacity="0.6"/>
+  <path d="M79 256L309 66V242L79 432V256Z" fill="#FFFFFF"/>
+</svg>
diff --git a/engine/pyproject.toml b/engine/pyproject.toml
index 3f2c277fbb..87e7cc99c0 100644
--- a/engine/pyproject.toml
+++ b/engine/pyproject.toml
@@ -64,7 +64,7 @@ updater-signatures = [
 ]
 # Pinned repository-wide pre-commit tooling.
 pre-commit = [
-    "codespell==2.4.2",
+    "codespell==2.4.3",
     "ruff==0.15.5",
     "tomli-w==1.2.0",
 ]
diff --git a/engine/scripts/generate_tool_models.py b/engine/scripts/generate_tool_models.py
index 7587d8c62f..c3cd9e7267 100644
--- a/engine/scripts/generate_tool_models.py
+++ b/engine/scripts/generate_tool_models.py
@@ -149,6 +149,9 @@ class ToolDiscovery:
         "/api/v1/misc/add-image",
         "/api/v1/misc/add-attachments",
         "/api/v1/general/overlay-pdfs",
+        # 5. Server maintenance, not a document operation: releases finished jobs and
+        #    their stored files. Nothing an edit agent should ever call on its own.
+        "/api/v1/general/jobs/cleanup",
     )
 
     def _is_excluded(self, path: str) -> bool:
diff --git a/engine/uv.lock b/engine/uv.lock
index 0b25716add..fbfa665bc6 100644
--- a/engine/uv.lock
+++ b/engine/uv.lock
@@ -414,11 +414,11 @@ wheels = [
 
 [[package]]
 name = "codespell"
-version = "2.4.2"
+version = "2.4.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/2d/9d/1d0903dff693160f893ca6abcabad545088e7a2ee0a6deae7c24e958be69/codespell-2.4.2.tar.gz", hash = "sha256:3c33be9ae34543807f088aeb4832dfad8cb2dae38da61cac0a7045dd376cfdf3", size = 352058, upload-time = "2026-03-05T18:10:42.936Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/80/19/45e941380f69c042b43423513d201e6592346f992394347f5e7174c31407/codespell-2.4.3.tar.gz", hash = "sha256:cbe085e331227b37bb86ef8bddd08dc768c704ee9a07ca869852c093fa2793e2", size = 352773, upload-time = "2026-07-15T11:51:54.159Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/42/a1/52fa05533e95fe45bcc09bcf8a503874b1c08f221a4e35608017e0938f55/codespell-2.4.2-py3-none-any.whl", hash = "sha256:97e0c1060cf46bd1d5db89a936c98db8c2b804e1fdd4b5c645e82a1ec6b1f886", size = 353715, upload-time = "2026-03-05T18:10:41.398Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/bf/bdb951d34eb169140b546f44be9ec4525d1acefb9eb5572071f5492b19fc/codespell-2.4.3-py3-none-any.whl", hash = "sha256:af2505b335e8573dbd2d384d1c4ef498f4006f4ba2d6fceca01e55b91f52628a", size = 340736, upload-time = "2026-07-15T11:51:52.925Z" },
 ]
 
 [[package]]
@@ -718,7 +718,7 @@ engine-dev = [
     { name = "ruff", specifier = "==0.15.5" },
 ]
 pre-commit = [
-    { name = "codespell", specifier = "==2.4.2" },
+    { name = "codespell", specifier = "==2.4.3" },
     { name = "ruff", specifier = "==0.15.5" },
     { name = "tomli-w", specifier = "==1.2.0" },
 ]
diff --git a/frontend/.storybook/main.ts b/frontend/.storybook/main.ts
index c0436a3a82..e86a8636e3 100644
--- a/frontend/.storybook/main.ts
+++ b/frontend/.storybook/main.ts
@@ -10,6 +10,18 @@ import tsconfigPaths from "vite-tsconfig-paths";
  * the portal layer at editor/src/portal/). MDX docs pages live in
  * editor/src/portal/docs/.
  */
+/**
+ * Editor stories import via `@app/*` (proprietary→core fallback), `@core/*` and
+ * `@proprietary/*`. Resolve them exactly the way the editor's own build does -
+ * through vite-tsconfig-paths against the proprietary vite tsconfig - so the
+ * shared Storybook can host editor components without duplicating the alias map
+ * here. Built per pass: the main bundle and the worker bundle each need their own.
+ */
+const editorPathAliases = () =>
+  tsconfigPaths({
+    projects: [resolve(__dirname, "../editor/tsconfig.proprietary.vite.json")],
+  });
+
 const config: StorybookConfig = {
   stories: [
     "../editor/src/portal/**/*.mdx",
@@ -47,19 +59,15 @@ const config: StorybookConfig = {
       // than a relative path.
       "@public": resolve(__dirname, "../editor/public"),
     };
-    // Editor stories import via @app/* (proprietary→core fallback), @core/* and
-    // @proprietary/*. Resolve them exactly the way the editor's own build does —
-    // through vite-tsconfig-paths against the proprietary vite tsconfig — so the
-    // shared Storybook can host editor components without duplicating the alias
-    // map here.
     config.plugins = config.plugins ?? [];
-    config.plugins.push(
-      tsconfigPaths({
-        projects: [
-          resolve(__dirname, "../editor/tsconfig.proprietary.vite.json"),
-        ],
-      }),
-    );
+    config.plugins.push(editorPathAliases());
+    // Worker bundles are a separate Rollup pass and do NOT inherit `plugins`, so
+    // without this a worker importing @app/* fails to resolve while the same
+    // import works everywhere else. Mirrors editor/vite.config.ts.
+    config.worker = {
+      ...(config.worker ?? {}),
+      plugins: () => [editorPathAliases()],
+    };
     // Point apiClient.saas at a mock origin so the SaaS-backed billing stories
     // (SubscribedPlanView, PaymentMethodCard, InvoicesList) resolve a base URL and
     // their MSW handlers (which match "*/api/v1/payg/...") can intercept. The host
diff --git a/frontend/editor/playwright.config.ts b/frontend/editor/playwright.config.ts
index 93e6572392..c4a3885b15 100644
--- a/frontend/editor/playwright.config.ts
+++ b/frontend/editor/playwright.config.ts
@@ -17,9 +17,12 @@ import { defineConfig, devices } from "@playwright/test";
  *
  * @see https://playwright.dev/docs/test-configuration
  */
+/** Shared by every stubbed project so a spec sees one layout on all engines. */
+const STUBBED_VIEWPORT = { width: 1920, height: 1080 };
+
 const chromiumViewport = {
   ...devices["Desktop Chrome"],
-  viewport: { width: 1920, height: 1080 },
+  viewport: STUBBED_VIEWPORT,
 };
 
 export default defineConfig({
@@ -55,7 +58,8 @@ export default defineConfig({
   },
 
   projects: [
-    // Stubbed - no backend required, chromium-only for CI speed
+    // Stubbed - no backend required. The chromium arm of the cross-browser
+    // set below; CI fans all three out, one job per engine.
     {
       name: "stubbed",
       testDir: "./src/core/tests/stubbed",
@@ -93,16 +97,17 @@ export default defineConfig({
       },
     },
 
-    // Cross-browser coverage for the stubbed suite (opt-in locally)
+    // Cross-browser coverage for the stubbed suite. Same viewport as `stubbed`,
+    // or a layout difference here reads as an engine outage.
     {
       name: "stubbed-firefox",
       testDir: "./src/core/tests/stubbed",
-      use: { ...devices["Desktop Firefox"] },
+      use: { ...devices["Desktop Firefox"], viewport: STUBBED_VIEWPORT },
     },
     {
       name: "stubbed-webkit",
       testDir: "./src/core/tests/stubbed",
-      use: { ...devices["Desktop Safari"] },
+      use: { ...devices["Desktop Safari"], viewport: STUBBED_VIEWPORT },
     },
   ],
 
diff --git a/frontend/editor/public/android-chrome-192x192.png b/frontend/editor/public/android-chrome-192x192.png
index 4219bb8403..55c165df4b 100644
Binary files a/frontend/editor/public/android-chrome-192x192.png and b/frontend/editor/public/android-chrome-192x192.png differ
diff --git a/frontend/editor/public/android-chrome-512x512.png b/frontend/editor/public/android-chrome-512x512.png
index 19bc603ec5..1b043a72ec 100644
Binary files a/frontend/editor/public/android-chrome-512x512.png and b/frontend/editor/public/android-chrome-512x512.png differ
diff --git a/frontend/editor/public/favicon.png b/frontend/editor/public/favicon.png
index 5edc6eae26..1b043a72ec 100644
Binary files a/frontend/editor/public/favicon.png and b/frontend/editor/public/favicon.png differ
diff --git a/frontend/editor/public/locales/en-GB/translation.toml b/frontend/editor/public/locales/en-GB/translation.toml
index a91d52cca0..bdf6a739ed 100644
--- a/frontend/editor/public/locales/en-GB/translation.toml
+++ b/frontend/editor/public/locales/en-GB/translation.toml
@@ -3895,8 +3895,6 @@ openFromComputer = "Open from computer"
 openSettings = "Open settings"
 other = "Other"
 recent = "Recent"
-search = "Search"
-searchPlaceholder = "Search files..."
 viewAll = "View all {{count}} files"
 
 [fileSidebar.fileItem]
@@ -3925,7 +3923,6 @@ backToMyFiles = "Back to My Files"
 breadcrumbs = "Folder path"
 cancel = "Cancel"
 classification = "Classification"
-clearSearch = "Clear search"
 clearSelection = "Clear selection"
 closeDetails = "Close details"
 create = "Create"
@@ -3990,8 +3987,6 @@ resizeFolderTree = "Resize folder tree (arrow keys, Shift for bigger steps; doub
 save = "Save"
 saveToServer = "Save to server"
 saveToServerDisabledHint = "Saving to the server isn't enabled on this server. Ask your admin to enable it."
-search = "Search"
-searchPlaceholder = "Search this folder & subfolders"
 selectAll = "Select all"
 selectAllHint = "Click to select all. Tip: hold Ctrl (or Cmd) to add files one at a time, Shift to select a range."
 selectedCount = "{{count}} selected"
@@ -4051,6 +4046,10 @@ title = "No cloud files yet"
 hint = "Files saved without uploading stay here. Drop a file to add one."
 title = "No local-only files"
 
+[filesPage.empty.noResults]
+hint = "No files in this folder match your filter. Try a different term or clear the filter."
+title = "No matching files"
+
 [filesPage.empty.recent]
 hint = "Files you open or edit will appear here."
 title = "Nothing modified yet"
@@ -4120,6 +4119,11 @@ localHint = "Only stored in this browser"
 shared = "Shared"
 sharedHint = "Shared with you via link"
 
+[filesPage.search]
+clear = "Clear filter"
+label = "Filter files by name"
+placeholder = "Filter files…"
+
 [filesPage.sort]
 modifiedAsc = "Oldest first"
 modifiedDesc = "Recent first"
@@ -5005,9 +5009,6 @@ title = "Upload from Mobile"
 tags = "Multi Tool,Multi operation,UI,click drag,front end,client side,interactive,intractable,move,delete,migrate,divide"
 title = "PDF Multi Tool"
 
-[navbar]
-search = "Search"
-
 [oauth.error]
 message = "Authentication was not successful. You can close this window and try again."
 title = "Authentication Failed"
@@ -7091,11 +7092,6 @@ title = "Official SDKs"
 beta = "Beta"
 deprecated = "Deprecated"
 
-[portal.docs.search]
-empty = "No matching docs"
-placeholder = "Search docs"
-results = "{{count}} results"
-
 [portal.docs.skills]
 eyebrow = "SKILLS"
 lead = "Bundled, named capabilities your agent invokes as a single tool. Each skill is a deterministic op chain with evals attached."
@@ -8701,16 +8697,6 @@ maxed = "Maxed out"
 subtitle = "Your free trial runs through {{date}}. No card required."
 title = "Enterprise trial"
 
-[portal.search]
-ariaLabel = "Search"
-placeholder = "Search Stirling — endpoints, pipelines, docs…"
-
-[portal.search.empty]
-noActionsDescription = "Quick actions will appear here once they're available."
-noActionsTitle = "No quick actions"
-noMatches = "No matches for \"{{query}}\""
-noMatchesDescription = "Try a different keyword or browse the catalogue."
-
 [portal.settings.groups]
 admin = "Admin"
 
@@ -9999,9 +9985,6 @@ title = "Policies & Privacy"
 [settings.preferences]
 title = "Preferences"
 
-[settings.search]
-placeholder = "Search settings pages..."
-
 [settings.security]
 description = "Update your password to keep your account secure."
 title = "Security"
@@ -10644,6 +10627,23 @@ title = "Upload to Server"
 updateButton = "Update on Server"
 uploadButton = "Upload to Server"
 
+[superSearch]
+all = "All"
+ariaLabel = "Super search"
+filtersAriaLabel = "Search filters"
+hint = "Type to search"
+placeholder = "Search Stirling"
+showLess = "Show less"
+showMore = "Show {{count}} more"
+
+[superSearch.group]
+docs = "Docs"
+files = "Files"
+pages = "Pages"
+processor = "Processor"
+settings = "Settings"
+tools = "Tools"
+
 [survey]
 title = "Stirling-PDF Survey"
 
@@ -10793,7 +10793,6 @@ goBack = "Go back"
 pdfTools = "PDF Tools"
 placeholder = "Choose a tool to get started"
 premiumFeature = "Premium feature:"
-searchTools = "Search tools"
 toolsHeader = "Tools"
 viewAllTools = "View all tools"
 
@@ -11665,6 +11664,7 @@ exitRedaction = "Exit Redaction Mode"
 exportAll = "Export PDF"
 exportSelected = "Export Selected Pages"
 formFill = "Fill Form"
+hideToolbar = "Hide toolbar"
 multiTool = "Multi-Tool"
 panMode = "Pan Mode"
 print = "Print PDF"
@@ -11685,6 +11685,7 @@ selectAll = "Select All"
 selectByNumber = "Select by Page Numbers"
 selectLanguage = "Select language"
 share = "Share"
+showToolbar = "Show toolbar"
 toggleAnnotations = "Toggle Annotations Visibility"
 toggleAttachments = "Toggle Attachments"
 toggleBookmarks = "Toggle Bookmarks"
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 5df410c368..a72d56453e 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -1894,6 +1894,9 @@ width = "Width"
 [app]
 description = "The Free Adobe Acrobat alternative (10M+ Downloads)"
 
+[appBanner]
+dismiss = "Dismiss"
+
 [attachments]
 convertToPdfA3b = "Convert to PDF/A-3b"
 convertToPdfA3bDescription = "Creates an archival PDF with embedded attachments"
@@ -3025,6 +3028,7 @@ saturation = "Saturation and brightness"
 title = "Choose color"
 
 [common]
+actions = "Actions"
 back = "Back"
 cancel = "Cancel"
 close = "Close"
@@ -3040,6 +3044,7 @@ error = "Error"
 expand = "Expand"
 loading = "Loading..."
 next = "Next"
+open = "Open"
 preview = "Preview"
 previous = "Previous"
 refresh = "Refresh"
@@ -3905,6 +3910,8 @@ addFiles = "Add files"
 addingFiles = "Adding files…"
 collapse = "Collapse sidebar"
 customizeGroups = "Customize groups"
+dataLostBody = "This browser lost this file's contents. Upload it again to keep working with it."
+dataLostTitle = "File data is unavailable"
 dropHint = "Open files to get started"
 dropToAdd = "Drop files to add"
 expand = "Expand sidebar"
@@ -3919,12 +3926,12 @@ openFromComputer = "Open from computer"
 openSettings = "Open settings"
 other = "Other"
 recent = "Recent"
-search = "Search"
-searchPlaceholder = "Search files..."
 viewAll = "View all {{count}} files"
 
 [fileSidebar.fileItem]
 closeViewer = "Close viewer"
+dataLost = "Data lost"
+dataLostTooltip = "This browser lost this file's contents. Upload it again to keep working with it."
 delete = "Delete"
 moreActions = "More actions"
 openInViewer = "Open in viewer"
@@ -3949,7 +3956,6 @@ backToMyFiles = "Back to My Files"
 breadcrumbs = "Folder path"
 cancel = "Cancel"
 classification = "Classification"
-clearSearch = "Clear search"
 clearSelection = "Clear selection"
 closeDetails = "Close details"
 create = "Create"
@@ -4014,8 +4020,6 @@ resizeFolderTree = "Resize folder tree (arrow keys, Shift for bigger steps; doub
 save = "Save"
 saveToServer = "Save to server"
 saveToServerDisabledHint = "Saving to the server isn't enabled on this server. Ask your admin to enable it."
-search = "Search"
-searchPlaceholder = "Search this folder & subfolders"
 selectAll = "Select all"
 selectAllHint = "Click to select all. Tip: hold Ctrl (or Cmd) to add files one at a time, Shift to select a range."
 selectedCount = "{{count}} selected"
@@ -4075,6 +4079,10 @@ title = "No cloud files yet"
 hint = "Files saved without uploading stay here. Drop a file to add one."
 title = "No local-only files"
 
+[filesPage.empty.noResults]
+hint = "No files in this folder match your filter. Try a different term or clear the filter."
+title = "No matching files"
+
 [filesPage.empty.recent]
 hint = "Files you open or edit will appear here."
 title = "Nothing modified yet"
@@ -4144,6 +4152,11 @@ localHint = "Only stored in this browser"
 shared = "Shared"
 sharedHint = "Shared with you via link"
 
+[filesPage.search]
+clear = "Clear filter"
+label = "Filter files by name"
+placeholder = "Filter files…"
+
 [filesPage.sort]
 modifiedAsc = "Oldest first"
 modifiedDesc = "Recent first"
@@ -4832,9 +4845,6 @@ title = "Image to PDF"
 [imageToPdf]
 tags = "conversion,img,jpg,picture,photo"
 
-[infoBanner]
-dismiss = "Dismiss"
-
 [invite]
 acceptError = "Failed to create account"
 accountFor = "Creating account for"
@@ -5062,8 +5072,13 @@ title = "Upload from Mobile"
 tags = "Multi Tool,Multi operation,UI,click drag,front end,client side,interactive,intractable,move,delete,migrate,divide"
 title = "PDF Multi Tool"
 
-[navbar]
-search = "Search"
+[navFooter]
+openEditor = "Open PDF Editor"
+openProcessor = "Open PDF Processor"
+
+[navFooter.credits]
+count = "{{remaining}} of {{total}}"
+label = "Free credits"
 
 [oauth.error]
 message = "Authentication was not successful. You can close this window and try again."
@@ -5629,8 +5644,8 @@ freeBody = "View, edit, merge, split, sign, watermark, compress, convert and man
 freeTitle = "Unlimited PDF editing"
 
 [payg.free.hero]
-barAria = "Free PDFs used"
-capSuffix = "/ {{limit}} free PDFs"
+barAria = "Free PDFs remaining"
+capSuffix = "of {{limit}} free PDFs left"
 metaCategories = "Automation · AI · API requests"
 
 [payg.free.member]
@@ -6349,7 +6364,6 @@ revoked = "Revoked"
 unnamed = "Unnamed instance"
 
 [portal.accountLink.instances.columns]
-actions = "Actions"
 instance = "Instance"
 lastSeen = "Last seen"
 linked = "Linked"
@@ -6694,12 +6708,12 @@ reachedTitle = "Monthly spend limit reached"
 title = "Couldn't open Stripe portal"
 
 [portal.billing.walletMeter]
-barAria = "Free PDFs used"
-capSuffix_one = "of {{allowance}} free PDFs used"
-capSuffix_other = "of {{allowance}} free PDFs used"
+barAria = "Free PDFs remaining"
+capSuffix_one = "of {{allowance}} free PDF left"
+capSuffix_other = "of {{allowance}} free PDFs left"
 eyebrow = "Processor trial"
-statusLabel_one = "{{remaining}} left"
-statusLabel_other = "{{remaining}} left"
+statusLabel_one = "{{used}} used"
+statusLabel_other = "{{used}} used"
 sub = "Use the PDF Editor for free. Pay to process PDFs automatically."
 title_one = "Process {{allowance}} PDFs free"
 title_other = "Process {{allowance}} PDFs free"
@@ -6944,6 +6958,32 @@ label = "Jira"
 description = "Email a document or a notification when a policy runs."
 label = "Mailgun"
 
+[portal.connections.types.n8n]
+baseUrlPlaceholder = "https://your-n8n/webhook/9f2c-..."
+description = "Hand documents to an n8n workflow, and take back whatever it produces."
+label = "n8n"
+
+[portal.connections.types.n8n.fields.authType]
+helperText = "Match the Authentication set on the n8n Webhook node."
+label = "Webhook authentication"
+
+[portal.connections.types.n8n.fields.authType.options.basic]
+label = "Basic auth"
+
+[portal.connections.types.n8n.fields.authType.options.header]
+label = "Header auth"
+
+[portal.connections.types.n8n.fields.authType.options.none]
+label = "None"
+
+[portal.connections.types.n8n.fields.headerName]
+helperText = "The header name from the n8n credential, not its value."
+label = "Header name"
+placeholder = "X-N8N-Key"
+
+[portal.connections.types.n8n.fields.token]
+label = "Header value"
+
 [portal.connections.types.nextcloud]
 baseUrlPlaceholder = "https://your-server/remote.php/dav"
 description = "File processed documents into Nextcloud."
@@ -7148,11 +7188,6 @@ title = "Official SDKs"
 beta = "Beta"
 deprecated = "Deprecated"
 
-[portal.docs.search]
-empty = "No matching docs"
-placeholder = "Search docs"
-results = "{{count}} results"
-
 [portal.docs.skills]
 eyebrow = "SKILLS"
 lead = "Bundled, named capabilities your agent invokes as a single tool. Each skill is a deterministic op chain with evals attached."
@@ -7251,12 +7286,11 @@ editorAction = "Editor"
 empty = "No documents match this filter."
 rowActions = "Row actions"
 sensitiveLabel = "Sensitive"
-sensitiveTitle = "Sensitive — access required"
 
 [portal.documents.table.columns]
 action = "Pipeline / Action"
-actions = "Actions"
 document = "Document"
+labels = "Labels"
 product = "Product"
 status = "Status"
 time = "Time"
@@ -7272,6 +7306,7 @@ host = "Host"
 lastSeen = "Last seen"
 region = "Region"
 status = "Status"
+target = "Target"
 version = "Version"
 
 [portal.editorAdmin.health.empty]
@@ -7347,9 +7382,11 @@ retry = "Try again"
 title = "Something went wrong on this page"
 
 [portal.failures]
+fromSource = "From source {{source}}"
 occurrences = "{{count}} occurrences"
+reportedBy = "Hit by {{actor}}"
 runReference = "Run {{runId}}"
-subtitle = "Failures recorded from your policy runs, with the actions you can take."
+subtitle = "Failures recorded from your policy runs and your team's editors, with the actions you can take."
 title = "Failures"
 
 [portal.failures.action]
@@ -7358,6 +7395,14 @@ confirm = "Are you sure?"
 dismiss = "Dismiss"
 dismissSkipFile = "Skip this file"
 
+[portal.failures.debug]
+copyJson = "Copy JSON"
+dismissAll = "Dismiss all ({{total}})"
+dismissing = "Dismissing..."
+hideJson = "Hide raw JSON ({{total}})"
+refresh = "Refresh failures"
+showJson = "Show raw JSON ({{total}})"
+
 [portal.failures.disabled]
 closed = "This failure is already closed."
 unavailable = "Not available for this failure."
@@ -7374,6 +7419,11 @@ title = "Password-protected document"
 description = "This run failed for a reason Stirling does not yet recognise. The raw message is shown below."
 title = "Unrecognised failure"
 
+[portal.failures.origin]
+pipeline = "Pipeline"
+policy = "Policy"
+tool = "Tool run"
+
 [portal.failures.stage]
 blocked = "Blocked"
 input = "Input"
@@ -7459,7 +7509,7 @@ morning = "Good morning"
 [portal.infrastructure]
 manageEditorDeployment = "Manage Editor deployment"
 sectionsAriaLabel = "Infrastructure sections"
-subtitle = "Deployments, credentials, security posture, storage, and the audit trail for your Stirling workspace."
+subtitle = "API credentials and the audit trail for your Stirling workspace."
 title = "Infrastructure"
 
 [portal.infrastructure.apiKeys]
@@ -7487,11 +7537,6 @@ cancel = "Cancel"
 confirm = "Revoke key"
 title = "Revoke API key"
 
-[portal.infrastructure.attestationLabel]
-attested = "Attested"
-inScope = "In scope"
-notApplicable = "N/A"
-
 [portal.infrastructure.audit]
 filterAriaLabel = "Filter audit events by category"
 heading = "Audit logs"
@@ -7563,11 +7608,6 @@ info = "Info"
 success = "Success"
 warning = "Warning"
 
-[portal.infrastructure.certLabel]
-certified = "Certified"
-inProgress = "In progress"
-notStarted = "Not started"
-
 [portal.infrastructure.createKey]
 cancel = "Cancel"
 createKey = "Create key"
@@ -7581,240 +7621,10 @@ subtitleCreated = "Copy this secret now — it won't be shown again."
 title = "Create API key"
 titleCreated = "Key created"
 
-[portal.infrastructure.deployLabel]
-live = "Live"
-queued = "Queued"
-rolledBack = "Rolled back"
-rolling = "Rolling out"
-
-[portal.infrastructure.deployments]
-loadAria = "Load for {{name}}"
-msValue = "{{value}} ms"
-throughputValue = "{{value}}/min"
-
-[portal.infrastructure.deployments.deployColumns]
-deployedBy = "Deployed by"
-environment = "Environment"
-product = "Product"
-status = "Status"
-version = "Version"
-when = "When"
-
-[portal.infrastructure.deployments.recent]
-heading = "Recent deployments"
-subheading = "The latest rollouts across products and environments."
-
-[portal.infrastructure.deployments.regionColumns]
-instances = "Instances"
-latency = "Latency"
-load = "Load"
-p99 = "P99"
-region = "Region"
-status = "Status"
-throughput = "Throughput"
-uptime = "Uptime"
-version = "Version"
-
-[portal.infrastructure.deployments.regions]
-heading = "Regions"
-subheading = "Live health for every deployed Stirling region — latency, load, and rollout version."
-
-[portal.infrastructure.deployments.regions.empty]
-description = "Deployed regions appear here once your workspace is provisioned."
-title = "No regions deployed"
-
 [portal.infrastructure.keyLabel]
 active = "Active"
 revoked = "Revoked"
 
-[portal.infrastructure.modelLabel]
-active = "Active"
-degraded = "Degraded"
-disabled = "Disabled"
-
-[portal.infrastructure.models]
-heading = "Models"
-loadAria = "Load for {{name}}"
-msValue = "{{value}} ms"
-subheading = "The model catalogue and routing that powers document processing across your workspace."
-
-[portal.infrastructure.models.byom]
-description = "Register an on-prem or self-hosted model and pin it to a region for data-residency-bound processing."
-title = "Bring your own model"
-
-[portal.infrastructure.models.catalogue]
-heading = "Catalogue"
-sub = "Managed models available to your workspace, with live latency and cost."
-subEnterprise = "Managed, bring-your-own, and on-prem models — with per-region pinning available."
-
-[portal.infrastructure.models.catalogue.empty]
-description = "Models in your workspace's catalogue appear here."
-title = "No models available"
-
-[portal.infrastructure.models.columns]
-cost = "Cost"
-latency = "Latency"
-load = "Load"
-model = "Model"
-status = "Status"
-type = "Type"
-version = "Version"
-
-[portal.infrastructure.models.cost]
-perCall = "{{price}}/call"
-perThousand = "{{price}}/1k"
-
-[portal.infrastructure.models.metrics]
-activeModels = "Active models"
-avgLatency = "Avg latency"
-included = "Included"
-monthlySpend = "Monthly model spend"
-
-[portal.infrastructure.models.routing]
-empty = "No routing rules configured."
-heading = "Routing rules"
-sub = "Which model handles each operation. The default applies when no narrower rule matches."
-subLocked = "Route operations to specific models — available on paid plans."
-
-[portal.infrastructure.models.routing.lockedBanner]
-description = "Upgrade to Pro to control which model handles each operation and document type."
-title = "Model routing is a paid feature"
-
-[portal.infrastructure.models.routingColumns]
-default = "Default"
-docType = "Document type"
-modelForAria = "Model for {{operation}}"
-operation = "Operation"
-routedTo = "Routed to"
-
-[portal.infrastructure.modelTypeLabel]
-classification = "Classification"
-extraction = "Extraction"
-llm = "LLM"
-ocr = "OCR"
-
-[portal.infrastructure.regionLabel]
-degraded = "Degraded"
-down = "Down"
-healthy = "Healthy"
-
-[portal.infrastructure.security.access.byok]
-description = "Supply a key from your own KMS. Stirling encrypts with it but can still read."
-label = "Bring your own key (BYOK)"
-
-[portal.infrastructure.security.access.hyok]
-description = "Keys never leave your KMS. Stirling holds only ciphertext."
-label = "Hold your own key (HYOK)"
-
-[portal.infrastructure.security.access.stirling]
-description = "Stirling manages encryption keys. Simplest — zero key ops on your side."
-label = "Stirling-held keys"
-
-[portal.infrastructure.security.accessPolicy]
-heading = "Document access policy"
-subheading = "Controls who can decrypt processed documents at rest."
-
-[portal.infrastructure.security.attestations]
-heading = "Compliance attestations"
-noReport = "No report available"
-subheading = "Framework-by-framework audit posture, with reports available on attested controls."
-viewReport = "View report →"
-
-[portal.infrastructure.security.compliance]
-heading = "Compliance"
-subheading = "Attestations and certifications covering the Stirling platform."
-
-[portal.infrastructure.security.empty]
-description = "Your workspace's security configuration will appear here."
-title = "Security posture unavailable"
-
-[portal.infrastructure.security.hyokBanner]
-description = "With HYOK, encryption keys never leave your KMS. Stirling stores and processes only ciphertext you can revoke at any time."
-title = "Stirling cannot decrypt your documents"
-
-[portal.infrastructure.security.ipAllowlist]
-empty = "No IP ranges configured — all IPs allowed."
-heading = "IP allowlist"
-sub = "API access is restricted to these CIDR ranges."
-subLocked = "Restrict API access to known IP ranges — available on paid plans."
-
-[portal.infrastructure.security.ipAllowlist.lockedBanner]
-description = "Upgrade to Pro to restrict API access to specific networks."
-title = "IP allowlisting is a paid feature"
-
-[portal.infrastructure.security.ipColumns]
-added = "Added"
-addedBy = "Added by"
-cidr = "CIDR"
-label = "Label"
-
-[portal.infrastructure.security.keyManagement]
-algorithm = "Algorithm"
-heading = "Encryption key management"
-keyId = "Key identifier"
-lastRotated = "Last rotated"
-rotateKey = "Rotate key"
-rotationPolicy = "Rotation policy"
-subheading = "Custody of the keys that encrypt documents at rest — who can decrypt, and how keys rotate."
-
-[portal.infrastructure.security.managedBanner]
-description = "Bring-your-own-key (BYOK) and hold-your-own-key (HYOK) custody are available on Enterprise. Upgrade to supply keys from your own KMS."
-title = "Keys are managed by Stirling on your plan"
-
-[portal.infrastructure.security.residency.apac]
-description = "ap-southeast-1"
-label = "Asia Pacific"
-
-[portal.infrastructure.security.residency.eu]
-description = "eu-west-1 · GDPR data boundary"
-label = "European Union"
-
-[portal.infrastructure.security.residency.us]
-description = "us-east-1 · us-west-2"
-label = "United States"
-
-[portal.infrastructure.security.residencyHeader]
-heading = "Data residency"
-subheading = "Where documents are stored and processed."
-
-[portal.infrastructure.storage]
-gbValue = "{{value}} GB"
-percentUsed = "{{value}} used"
-
-[portal.infrastructure.storage.empty]
-description = "Connected storage and usage appear here."
-title = "No storage configured"
-
-[portal.infrastructure.storage.lifecycle]
-active = "Active"
-activeRange = "0–{{value}}d"
-archived = "Archived"
-coldStorage = "cold storage"
-deleted = "Deleted"
-never = "never"
-purged = "purged"
-
-[portal.infrastructure.storage.providers]
-connect = "Connect"
-connected = "Connected"
-heading = "Connected providers"
-subheading = "Where processed artifacts are written."
-
-[portal.infrastructure.storage.retention]
-heading = "Retention"
-subheading = "How long artifacts are kept before lifecycle deletion."
-windowLabel = "Default retention window"
-
-[portal.infrastructure.storage.retentionOption]
-days_one = "{{count}} day"
-days_other = "{{count}} days"
-never = "Never delete"
-
-[portal.infrastructure.storage.totalUsage]
-heading = "Total usage"
-progressLabel = "Storage used"
-subheading = "Storage consumed across all connected providers."
-
 [portal.infrastructure.tabs]
 apiKeys = "API Keys"
 audit = "Audit Logs"
@@ -7824,11 +7634,9 @@ security = "Security"
 storage = "Storage"
 
 [portal.integrations]
-addAnother = "Add another"
 availableHeading = "Available"
 comingSoonHeading = "Coming soon"
 connect = "Connect"
-connectedHeading = "Connected"
 connectionCount_one = "{{count}} connection"
 connectionCount_other = "{{count}} connections"
 customApi = "Custom API"
@@ -7846,6 +7654,10 @@ security = "Security"
 signing = "Signing"
 storage = "Storage"
 
+[portal.integrations.noResults]
+description = "No integrations match your filters. Try a different category or search."
+title = "No matches"
+
 [portal.integrations.status]
 connected = "Connected"
 
@@ -7876,7 +7688,6 @@ integrations = "Integrations"
 pipelines = "Pipelines"
 policies = "Policies"
 procurement = "Procurement"
-settings = "Settings"
 sources = "Sources"
 usage = "Usage & Billing"
 users = "Users"
@@ -7893,6 +7704,7 @@ title = "Pipelines"
 newPipeline = "New pipeline"
 
 [portal.pipelines.builder]
+activate = "Activate"
 back = "Back to pipelines"
 cannotFollow = "Can't take {{produced}}"
 chooseAccount = "Choose an account"
@@ -7900,7 +7712,6 @@ chooseDestination = "Choose a destination"
 chooseOperation = "Choose what this step does"
 chooseSource = "Choose a source"
 discard = "Discard changes"
-enabled = "Enabled"
 inputs = "Input"
 inputSource = "Input source"
 inputTrigger = "Trigger"
@@ -7911,6 +7722,8 @@ needsDestination = "No destination chosen"
 needsSource = "No source chosen"
 needsUpload = "Needs an uploaded file"
 noToolMatches = "No tools match your search."
+pause = "Pause"
+rename = "Rename pipeline"
 searchTools = "Search tools"
 sendToSystem = "Send to another system"
 stepsIncompatible = "These steps can't run on what their prior step produces: {{tools}}."
@@ -7923,6 +7736,17 @@ uploadUnsupported = "Uploaded files aren't supported in pipelines yet, so these
 usesDefaults = "Runs with default settings"
 viewDefinition = "View definition"
 
+[portal.pipelines.builder.blocker]
+destination = "Choose a destination"
+heading = "To create this pipeline:"
+incompatible = "Fix steps that can't run in order: {{tools}}"
+name = "Give the pipeline a name"
+saveHeading = "To save your changes:"
+schedule = "Set how often it runs"
+setup = "Finish setting up: {{tools}}"
+source = "Choose an input source"
+upload = "Remove steps that need an uploaded file: {{tools}}"
+
 [portal.pipelines.builder.diagnostic]
 fan-in = "Combines every incoming file"
 fan-out = "Runs once per incoming file"
@@ -7933,12 +7757,12 @@ undeclared-operation = "Can't check what this step accepts"
 
 [portal.pipelines.composer]
 addTool = "Add a tool"
-cancel = "Cancel"
 create = "Create pipeline"
+createPaused = "Create paused"
 editingUnsupported = "Displaying these tool params for editing is not supported yet."
 editSource = "Edit source"
 name = "Name"
-namePlaceholder = "e.g. Redaction sweep"
+namePlaceholder = "Pipeline name"
 noToolSettings = "This tool has no configurable settings."
 output = "Destination"
 save = "Save changes"
@@ -7970,7 +7794,7 @@ confirm = "Delete"
 title = "Delete pipeline?"
 
 [portal.pipelines.detail]
-clearHistory = "Clear history"
+clearHistory = "Process ignored files in source"
 delete = "Delete pipeline"
 run = "Run now"
 
@@ -8023,10 +7847,9 @@ completed_one = "Run completed."
 completed_other = "All {{count}} runs completed."
 empty = "Nothing to run: the sources had no documents to process."
 failed = "Run failed: {{error}}"
-historyCleared = "History cleared. The next run reprocesses everything currently in the sources."
 inFlight = "Nothing new to run: documents are still being processed from an earlier run."
-parked_one = "Nothing to run: {{count}} document failed previously and is parked. Fix the cause, then clear history to retry it."
-parked_other = "Nothing to run: {{count}} documents failed previously and are parked. Fix the cause, then clear history to retry them."
+parked_one = "Nothing to run: {{count}} document failed previously and is parked. Fix the cause, then reprocess the source to retry it."
+parked_other = "Nothing to run: {{count}} documents failed previously and are parked. Fix the cause, then reprocess the source to retry them."
 running = "Run started; still in progress."
 timeout = "Run is taking longer than expected; it may still finish in the background."
 
@@ -8036,10 +7859,10 @@ paused = "Paused"
 
 [portal.pipelines.table]
 name = "Pipeline"
-open = "Open"
 sources = "Sources"
 status = "Status"
 steps = "Steps"
+trigger = "Trigger"
 
 [portal.pipelines.trigger]
 folder-watch = "Folder watch"
@@ -8354,6 +8177,24 @@ label = "Attach to a Jira issue"
 description = "Sends the processed document as an attachment."
 label = "Email the document (Mailgun)"
 
+[portal.policies.operations.n8nGate]
+description = "Your workflow decides whether the run carries on."
+label = "Ask an n8n workflow to approve"
+note = "The workflow must reply with {\"approved\": true}. Anything else — including a timeout — stops the run and parks the document."
+
+[portal.policies.operations.n8nNotify]
+description = "Sends the run's details, not the document."
+label = "Tell an n8n workflow"
+
+[portal.policies.operations.n8nSend]
+description = "Sends the document and the run's details to your workflow."
+label = "Send the document to n8n"
+
+[portal.policies.operations.n8nTransform]
+description = "Your workflow processes the document and the file it returns replaces it."
+label = "Process the document in n8n"
+note = "Set the Webhook node to respond \"Using Respond to Webhook Node\", and return a file. On the default \"Immediately\" setting n8n replies with an acknowledgement, and that would replace the document."
+
 [portal.policies.operations.nextcloudUpload]
 description = "Writes the processed document into a folder."
 label = "Upload to Nextcloud"
@@ -8828,16 +8669,6 @@ maxed = "Maxed out"
 subtitle = "Your free trial runs through {{date}}. No card required."
 title = "Enterprise trial"
 
-[portal.search]
-ariaLabel = "Search"
-placeholder = "Search Stirling — endpoints, pipelines, docs…"
-
-[portal.search.empty]
-noActionsDescription = "Quick actions will appear here once they're available."
-noActionsTitle = "No quick actions"
-noMatches = "No matches for \"{{query}}\""
-noMatchesDescription = "Try a different keyword or browse the catalogue."
-
 [portal.settings.groups]
 admin = "Admin"
 
@@ -8888,10 +8719,6 @@ cancel = "Cancel"
 confirm = "Delete"
 title = "Delete source?"
 
-[portal.sources.empty]
-description = "Connect a storage location so your policies have somewhere to pull data from."
-title = "No sources connected yet"
-
 [portal.sources.kpi]
 inUse = "In use"
 total = "Connections"
@@ -8928,9 +8755,9 @@ unused = "Unused"
 
 [portal.sources.table]
 documents = "Documents"
-open = "Open"
 source = "Source"
 status = "Status"
+type = "Type"
 usedBy = "Policies"
 
 [portal.sources.types.box]
@@ -10126,9 +9953,6 @@ title = "Policies & Privacy"
 [settings.preferences]
 title = "Preferences"
 
-[settings.search]
-placeholder = "Search settings pages..."
-
 [settings.security]
 description = "Update your password to keep your account secure."
 title = "Security"
@@ -10784,6 +10608,23 @@ title = "Upload to Server"
 updateButton = "Update on Server"
 uploadButton = "Upload to Server"
 
+[superSearch]
+all = "All"
+ariaLabel = "Super search"
+filtersAriaLabel = "Search filters"
+hint = "Type to search"
+placeholder = "Search Stirling"
+showLess = "Show less"
+showMore = "Show {{count}} more"
+
+[superSearch.group]
+docs = "Docs"
+files = "Files"
+pages = "Pages"
+processor = "Processor"
+settings = "Settings"
+tools = "Tools"
+
 [survey]
 title = "Stirling-PDF Survey"
 
@@ -10933,7 +10774,6 @@ goBack = "Go back"
 pdfTools = "PDF Tools"
 placeholder = "Choose a tool to get started"
 premiumFeature = "Premium feature:"
-searchTools = "Search tools"
 toolsHeader = "Tools"
 viewAllTools = "View all tools"
 
@@ -11141,6 +10981,13 @@ approver = "Approves policy"
 editor = "Editor"
 processor = "Processor"
 
+[users.columns]
+capabilities = "Capabilities"
+email = "Email"
+person = "Person"
+role = "Role"
+status = "Status"
+
 [users.confirm]
 cancelInviteBody = "Cancel the invitation to {{email}}? They won't be able to join with the current link."
 cancelInviteTitle = "Cancel invitation"
@@ -11160,10 +11007,8 @@ title = "No members yet"
 addToTeam = "Add to team"
 guestCount = "{{count}} guest"
 guests = "Guests"
-guestsDesc = "External collaborators, scoped to what you shared. Editor only."
 ledBy = "led by {{owner}}"
 org = "Organization"
-orgDesc = "Owners with org-wide authority and policy approval"
 owners = "{{count}} owner"
 team = "{{name}} team"
 teamMeta = "{{count}} people"
@@ -11203,13 +11048,15 @@ usernamePlaceholder = "jsmith"
 [users.invites]
 by = "Invited by {{who}}"
 cancel = "Cancel"
-count = "{{count}} pending"
-desc = "Invited people who haven't joined yet. They hold a seat until they accept."
 expiresInDays_one = "Expires in {{count}} day"
 expiresInDays_other = "Expires in {{count}} days"
 expiresToday = "Expires today"
 title = "Pending invitations"
 
+[users.invites.columns]
+expires = "Expires"
+invitee = "Invitee"
+
 [users.loadError]
 description = "Something went wrong reaching the backend, or you don't have access. Try again."
 title = "Couldn't load members"
@@ -11814,6 +11661,7 @@ exitRedaction = "Exit Redaction Mode"
 exportAll = "Export PDF"
 exportSelected = "Export Selected Pages"
 formFill = "Fill Form"
+hideToolbar = "Hide toolbar"
 multiTool = "Multi-Tool"
 panMode = "Pan Mode"
 print = "Print PDF"
@@ -11834,6 +11682,7 @@ selectAll = "Select All"
 selectByNumber = "Select by Page Numbers"
 selectLanguage = "Select language"
 share = "Share"
+showToolbar = "Show toolbar"
 toggleAnnotations = "Toggle Annotations Visibility"
 toggleAttachments = "Toggle Attachments"
 toggleBookmarks = "Toggle Bookmarks"
diff --git a/frontend/editor/public/mstile-144x144.png b/frontend/editor/public/mstile-144x144.png
index ff28cf1ac6..3c47163f60 100644
Binary files a/frontend/editor/public/mstile-144x144.png and b/frontend/editor/public/mstile-144x144.png differ
diff --git a/frontend/editor/public/mstile-150x150.png b/frontend/editor/public/mstile-150x150.png
index c900c83ae3..1833c9340f 100644
Binary files a/frontend/editor/public/mstile-150x150.png and b/frontend/editor/public/mstile-150x150.png differ
diff --git a/frontend/editor/public/mstile-310x150.png b/frontend/editor/public/mstile-310x150.png
index 43a095f36d..e5ad21a345 100644
Binary files a/frontend/editor/public/mstile-310x150.png and b/frontend/editor/public/mstile-310x150.png differ
diff --git a/frontend/editor/public/mstile-310x310.png b/frontend/editor/public/mstile-310x310.png
index fd52bd61d2..044a032aaf 100644
Binary files a/frontend/editor/public/mstile-310x310.png and b/frontend/editor/public/mstile-310x310.png differ
diff --git a/frontend/editor/public/mstile-70x70.png b/frontend/editor/public/mstile-70x70.png
index 7692923f74..23f118d9f1 100644
Binary files a/frontend/editor/public/mstile-70x70.png and b/frontend/editor/public/mstile-70x70.png differ
diff --git a/frontend/editor/public/og_images/saas/app-editor.png b/frontend/editor/public/og_images/saas/app-editor.png
index e89c1d060a..2c7fb2b653 100644
Binary files a/frontend/editor/public/og_images/saas/app-editor.png and b/frontend/editor/public/og_images/saas/app-editor.png differ
diff --git a/frontend/editor/public/og_images/saas/app-processor.png b/frontend/editor/public/og_images/saas/app-processor.png
index fd1ebfc620..2cd3cecbcd 100644
Binary files a/frontend/editor/public/og_images/saas/app-processor.png and b/frontend/editor/public/og_images/saas/app-processor.png differ
diff --git a/frontend/editor/public/og_images/saas/app.png b/frontend/editor/public/og_images/saas/app.png
index 9c6b300e6e..81e69b8f4c 100644
Binary files a/frontend/editor/public/og_images/saas/app.png and b/frontend/editor/public/og_images/saas/app.png differ
diff --git a/frontend/editor/public/og_images/shared-sign.png b/frontend/editor/public/og_images/shared-sign.png
index 9a2750d2b3..85c1558494 100644
Binary files a/frontend/editor/public/og_images/shared-sign.png and b/frontend/editor/public/og_images/shared-sign.png differ
diff --git a/frontend/editor/public/safari-pinned-tab.svg b/frontend/editor/public/safari-pinned-tab.svg
index f0a689a75d..9a7f46f2f6 100644
--- a/frontend/editor/public/safari-pinned-tab.svg
+++ b/frontend/editor/public/safari-pinned-tab.svg
@@ -1 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="933.333" height="933.333" preserveAspectRatio="xMidYMid meet" version="1.0" viewBox="0 0 700 700"><metadata>Created by potrace 1.14, written by Peter Selinger 2001-2017</metadata><g fill="#000" stroke="none"><path d="M4340 6716 c-228 -51 -910 -202 -1515 -336 -1479 -326 -1522 -335 -1587 -360 -155 -58 -315 -206 -391 -363 -83 -170 -77 40 -77 -2484 0 -1985 2 -2256 15 -2307 53 -204 228 -378 431 -430 32 -8 464 -67 959 -132 l900 -117 659 664 c362 365 1074 1083 1581 1595 l923 931 -4 84 c-2 46 -9 622 -14 1279 -6 657 -15 1219 -21 1249 -29 169 -167 304 -337 331 -74 12 -116 6 -397 -55 -112 -25 -208 -45 -214 -45 -7 0 -11 33 -11 98 0 54 -5 125 -11 158 -24 129 -106 237 -225 295 -59 29 -78 33 -158 35 -83 3 -128 -6 -506 -90z m-741 -1297 c108 -15 244 -53 336 -91 l80 -34 -4 -314 c-2 -173 -7 -450 -10 -615 l-6 -300 -61 -3 -61 -3 -74 88 c-298 355 -496 483 -747 483 -74 0 -202 -32 -257 -65 -106 -61 -177 -184 -178 -305 0 -82 15 -135 56 -197 62 -92 157 -138 437 -209 393 -99 639 -221 826 -408 136 -137 206 -259 255 -442 30 -113 37 -363 15 -494 -85 -488 -398 -821 -866 -921 -87 -19 -136 -23 -285 -23 -165 0 -193 3 -335 33 -280 59 -585 154 -746 231 l-80 39 -12 373 c-7 205 -15 437 -19 516 l-6 142 51 0 c32 0 52 -4 52 -11 0 -24 99 -176 172 -264 125 -151 278 -272 455 -359 147 -73 181 -81 328 -81 127 0 132 1 202 34 137 64 236 205 236 337 0 131 -96 257 -262 343 -45 23 -180 75 -300 116 -333 112 -496 191 -646 312 -321 260 -442 767 -290 1219 110 330 325 579 633 733 144 73 364 127 613 151 113 10 395 5 498 -11z" transform="translate(0.000000,700.000000) scale(0.100000,-0.100000)"/></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" width="512" height="512">
+  <path d="M79 256L309 66V242L79 432V256Z" fill="#000000"/>
+  <path d="M202 268L432 78V255L202 445V268Z" fill="#000000" fill-opacity="0.55"/>
+</svg>
diff --git a/frontend/editor/scripts/lint/theme-lint.mjs b/frontend/editor/scripts/lint/theme-lint.mjs
index 494fc03cca..97b32ef208 100644
--- a/frontend/editor/scripts/lint/theme-lint.mjs
+++ b/frontend/editor/scripts/lint/theme-lint.mjs
@@ -642,7 +642,6 @@ const CODE_EXEMPT_PATH = [
   /mantineTheme|\/theme\.ts$|toolsTaxonomy|LayoutPreview|PageNumberPreview|CloudStorageIcons|BrandMarks/,
   /\/onboarding\//,
   /addStamp|addWatermark|\/tooltips\//,
-  /UpgradeBanner|AdminPlanSection/,
   // Stories are checked like app code; colour-as-data lines opt out with
   // `theme-allow-color`.
   /\.test\.[jt]sx?$|\/types\//,
diff --git a/frontend/editor/src-tauri/Cargo.lock b/frontend/editor/src-tauri/Cargo.lock
index c7d25757c9..fe8352f5a7 100644
--- a/frontend/editor/src-tauri/Cargo.lock
+++ b/frontend/editor/src-tauri/Cargo.lock
@@ -276,9 +276,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "base64"
-version = "0.23.0"
+version = "0.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b25655df2c3cdd83c5e5b293b88acd880332b2ddadd7c30ac43144fdc0033da9"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
 
 [[package]]
 name = "bit-set"
@@ -4551,7 +4551,7 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 name = "stirling-pdf"
 version = "0.1.0"
 dependencies = [
- "base64 0.23.0",
+ "base64 0.23.1",
  "core-foundation 0.10.1",
  "core-services",
  "keyring",
diff --git a/frontend/editor/src-tauri/icons/128x128.png b/frontend/editor/src-tauri/icons/128x128.png
index d233685dd2..9712693d06 100644
Binary files a/frontend/editor/src-tauri/icons/128x128.png and b/frontend/editor/src-tauri/icons/128x128.png differ
diff --git a/frontend/editor/src-tauri/icons/128x128@2x.png b/frontend/editor/src-tauri/icons/128x128@2x.png
index 9473eda3f1..e4f69e37ff 100644
Binary files a/frontend/editor/src-tauri/icons/128x128@2x.png and b/frontend/editor/src-tauri/icons/128x128@2x.png differ
diff --git a/frontend/editor/src-tauri/icons/16x16.png b/frontend/editor/src-tauri/icons/16x16.png
index d88e6615d0..6448ce5424 100644
Binary files a/frontend/editor/src-tauri/icons/16x16.png and b/frontend/editor/src-tauri/icons/16x16.png differ
diff --git a/frontend/editor/src-tauri/icons/192x192.png b/frontend/editor/src-tauri/icons/192x192.png
index 4219bb8403..55c165df4b 100644
Binary files a/frontend/editor/src-tauri/icons/192x192.png and b/frontend/editor/src-tauri/icons/192x192.png differ
diff --git a/frontend/editor/src-tauri/icons/32x32.png b/frontend/editor/src-tauri/icons/32x32.png
index 9e8dd8a5db..1844dfceb2 100644
Binary files a/frontend/editor/src-tauri/icons/32x32.png and b/frontend/editor/src-tauri/icons/32x32.png differ
diff --git a/frontend/editor/src-tauri/icons/64x64.png b/frontend/editor/src-tauri/icons/64x64.png
index 280a9c5ac3..d758a26bf3 100644
Binary files a/frontend/editor/src-tauri/icons/64x64.png and b/frontend/editor/src-tauri/icons/64x64.png differ
diff --git a/frontend/editor/src-tauri/icons/Square107x107Logo.png b/frontend/editor/src-tauri/icons/Square107x107Logo.png
index 840e43164a..f2ef1260e5 100644
Binary files a/frontend/editor/src-tauri/icons/Square107x107Logo.png and b/frontend/editor/src-tauri/icons/Square107x107Logo.png differ
diff --git a/frontend/editor/src-tauri/icons/Square142x142Logo.png b/frontend/editor/src-tauri/icons/Square142x142Logo.png
index 3a74337ff0..27e766be49 100644
Binary files a/frontend/editor/src-tauri/icons/Square142x142Logo.png and b/frontend/editor/src-tauri/icons/Square142x142Logo.png differ
diff --git a/frontend/editor/src-tauri/icons/Square150x150Logo.png b/frontend/editor/src-tauri/icons/Square150x150Logo.png
index 7efa08a3ae..b72682f1b7 100644
Binary files a/frontend/editor/src-tauri/icons/Square150x150Logo.png and b/frontend/editor/src-tauri/icons/Square150x150Logo.png differ
diff --git a/frontend/editor/src-tauri/icons/Square284x284Logo.png b/frontend/editor/src-tauri/icons/Square284x284Logo.png
index 3138c510c9..5174444203 100644
Binary files a/frontend/editor/src-tauri/icons/Square284x284Logo.png and b/frontend/editor/src-tauri/icons/Square284x284Logo.png differ
diff --git a/frontend/editor/src-tauri/icons/Square30x30Logo.png b/frontend/editor/src-tauri/icons/Square30x30Logo.png
index dc2fe4cfc7..72f49af68e 100644
Binary files a/frontend/editor/src-tauri/icons/Square30x30Logo.png and b/frontend/editor/src-tauri/icons/Square30x30Logo.png differ
diff --git a/frontend/editor/src-tauri/icons/Square310x310Logo.png b/frontend/editor/src-tauri/icons/Square310x310Logo.png
index a38038f8cc..58f31c4a9c 100644
Binary files a/frontend/editor/src-tauri/icons/Square310x310Logo.png and b/frontend/editor/src-tauri/icons/Square310x310Logo.png differ
diff --git a/frontend/editor/src-tauri/icons/Square44x44Logo.png b/frontend/editor/src-tauri/icons/Square44x44Logo.png
index 097839b004..a7e08945ed 100644
Binary files a/frontend/editor/src-tauri/icons/Square44x44Logo.png and b/frontend/editor/src-tauri/icons/Square44x44Logo.png differ
diff --git a/frontend/editor/src-tauri/icons/Square71x71Logo.png b/frontend/editor/src-tauri/icons/Square71x71Logo.png
index fb066fb32a..1d64d7ad39 100644
Binary files a/frontend/editor/src-tauri/icons/Square71x71Logo.png and b/frontend/editor/src-tauri/icons/Square71x71Logo.png differ
diff --git a/frontend/editor/src-tauri/icons/Square89x89Logo.png b/frontend/editor/src-tauri/icons/Square89x89Logo.png
index 00d893d7cf..7017222db0 100644
Binary files a/frontend/editor/src-tauri/icons/Square89x89Logo.png and b/frontend/editor/src-tauri/icons/Square89x89Logo.png differ
diff --git a/frontend/editor/src-tauri/icons/StoreLogo.png b/frontend/editor/src-tauri/icons/StoreLogo.png
index c56df3f8ad..f9a89b4c08 100644
Binary files a/frontend/editor/src-tauri/icons/StoreLogo.png and b/frontend/editor/src-tauri/icons/StoreLogo.png differ
diff --git a/frontend/editor/src-tauri/icons/android-chrome-192x192.png b/frontend/editor/src-tauri/icons/android-chrome-192x192.png
index 4219bb8403..55c165df4b 100644
Binary files a/frontend/editor/src-tauri/icons/android-chrome-192x192.png and b/frontend/editor/src-tauri/icons/android-chrome-192x192.png differ
diff --git a/frontend/editor/src-tauri/icons/android-chrome-512x512.png b/frontend/editor/src-tauri/icons/android-chrome-512x512.png
index 19bc603ec5..1b043a72ec 100644
Binary files a/frontend/editor/src-tauri/icons/android-chrome-512x512.png and b/frontend/editor/src-tauri/icons/android-chrome-512x512.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher.png b/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher.png
index 6a361221e1..bb04f26bb7 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher.png and b/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher_foreground.png b/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher_foreground.png
index dd48655a9b..64d33096ba 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher_foreground.png and b/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher_foreground.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher_round.png b/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher_round.png
index 6a361221e1..be50b5487a 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher_round.png and b/frontend/editor/src-tauri/icons/android/mipmap-hdpi/ic_launcher_round.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher.png b/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher.png
index a82e68b38f..e0d4b496ad 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher.png and b/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher_foreground.png b/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher_foreground.png
index d563b2d258..be11e05b10 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher_foreground.png and b/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher_foreground.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher_round.png b/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher_round.png
index a82e68b38f..fba443fccd 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher_round.png and b/frontend/editor/src-tauri/icons/android/mipmap-mdpi/ic_launcher_round.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher.png b/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher.png
index 6c28ce5994..fb4a2583fe 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher.png and b/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_foreground.png b/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_foreground.png
index 9b7807975c..251b991a03 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_foreground.png and b/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_foreground.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_round.png b/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_round.png
index 6c28ce5994..06aa109793 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_round.png and b/frontend/editor/src-tauri/icons/android/mipmap-xhdpi/ic_launcher_round.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher.png b/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher.png
index 95a8327d0c..3459a810d4 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher.png and b/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png b/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png
index 6b0bf8f45e..e6c0d49b64 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png and b/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_foreground.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_round.png b/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_round.png
index 95a8327d0c..3459a810d4 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_round.png and b/frontend/editor/src-tauri/icons/android/mipmap-xxhdpi/ic_launcher_round.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher.png b/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher.png
index e6603a9268..02f73102aa 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher.png and b/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png b/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png
index 503572a657..e51cd37946 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png and b/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_foreground.png differ
diff --git a/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_round.png b/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_round.png
index e6603a9268..02f73102aa 100644
Binary files a/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_round.png and b/frontend/editor/src-tauri/icons/android/mipmap-xxxhdpi/ic_launcher_round.png differ
diff --git a/frontend/editor/src-tauri/icons/icon.icns b/frontend/editor/src-tauri/icons/icon.icns
index 983df8577c..86bad6a2e1 100644
Binary files a/frontend/editor/src-tauri/icons/icon.icns and b/frontend/editor/src-tauri/icons/icon.icns differ
diff --git a/frontend/editor/src-tauri/icons/icon.ico b/frontend/editor/src-tauri/icons/icon.ico
index b058a5591f..2351219afa 100644
Binary files a/frontend/editor/src-tauri/icons/icon.ico and b/frontend/editor/src-tauri/icons/icon.ico differ
diff --git a/frontend/editor/src-tauri/icons/icon.png b/frontend/editor/src-tauri/icons/icon.png
index 5819d1b89d..8abdd8ca3a 100644
Binary files a/frontend/editor/src-tauri/icons/icon.png and b/frontend/editor/src-tauri/icons/icon.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@1x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@1x.png
index b440dda9d9..14945dd067 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@1x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@1x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@2x-1.png b/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@2x-1.png
index 44ec1c6bc9..a42c0f75f0 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@2x-1.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@2x-1.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@2x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@2x.png
index 44ec1c6bc9..5045b9a17f 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@2x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@2x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@3x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@3x.png
index e388901c86..2417dadd8a 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@3x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-20x20@3x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@1x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@1x.png
index df4c10e2f4..e12aa0d5bd 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@1x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@1x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@2x-1.png b/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@2x-1.png
index 8a78c7b879..97cabce4ec 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@2x-1.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@2x-1.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@2x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@2x.png
index 8a78c7b879..7942561423 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@2x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@2x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@3x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@3x.png
index da7b0097be..58c87d5ea7 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@3x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-29x29@3x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@1x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@1x.png
index 44ec1c6bc9..882b9b5d2f 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@1x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@1x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@2x-1.png b/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@2x-1.png
index 70f8711ff4..ac1f2800cd 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@2x-1.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@2x-1.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@2x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@2x.png
index 70f8711ff4..cb2137c6b1 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@2x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@2x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@3x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@3x.png
index 1648f9cc90..ffdac97f01 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@3x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-40x40@3x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-512@2x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-512@2x.png
index e75780f7ff..b7eb3b3fad 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-512@2x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-512@2x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-60x60@2x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-60x60@2x.png
index 1648f9cc90..d1bbbcdd09 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-60x60@2x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-60x60@2x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-60x60@3x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-60x60@3x.png
index 53ff5b05dc..80aa0bbbc4 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-60x60@3x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-60x60@3x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-76x76@1x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-76x76@1x.png
index 9d97d05bb3..5e18a2da14 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-76x76@1x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-76x76@1x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-76x76@2x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-76x76@2x.png
index 9df1bcea80..618fb3b29d 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-76x76@2x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-76x76@2x.png differ
diff --git a/frontend/editor/src-tauri/icons/ios/AppIcon-83.5x83.5@2x.png b/frontend/editor/src-tauri/icons/ios/AppIcon-83.5x83.5@2x.png
index 6403edcfee..e796d944b5 100644
Binary files a/frontend/editor/src-tauri/icons/ios/AppIcon-83.5x83.5@2x.png and b/frontend/editor/src-tauri/icons/ios/AppIcon-83.5x83.5@2x.png differ
diff --git a/frontend/editor/src-tauri/icons/mstile-144x144.png b/frontend/editor/src-tauri/icons/mstile-144x144.png
index ff28cf1ac6..3c47163f60 100644
Binary files a/frontend/editor/src-tauri/icons/mstile-144x144.png and b/frontend/editor/src-tauri/icons/mstile-144x144.png differ
diff --git a/frontend/editor/src-tauri/icons/mstile-150x150.png b/frontend/editor/src-tauri/icons/mstile-150x150.png
index c900c83ae3..4fe5606ad8 100644
Binary files a/frontend/editor/src-tauri/icons/mstile-150x150.png and b/frontend/editor/src-tauri/icons/mstile-150x150.png differ
diff --git a/frontend/editor/src-tauri/icons/mstile-310x150.png b/frontend/editor/src-tauri/icons/mstile-310x150.png
index 43a095f36d..9ef3b02fe7 100644
Binary files a/frontend/editor/src-tauri/icons/mstile-310x150.png and b/frontend/editor/src-tauri/icons/mstile-310x150.png differ
diff --git a/frontend/editor/src-tauri/icons/mstile-310x310.png b/frontend/editor/src-tauri/icons/mstile-310x310.png
index fd52bd61d2..044a032aaf 100644
Binary files a/frontend/editor/src-tauri/icons/mstile-310x310.png and b/frontend/editor/src-tauri/icons/mstile-310x310.png differ
diff --git a/frontend/editor/src-tauri/icons/mstile-70x70.png b/frontend/editor/src-tauri/icons/mstile-70x70.png
index 7692923f74..23f118d9f1 100644
Binary files a/frontend/editor/src-tauri/icons/mstile-70x70.png and b/frontend/editor/src-tauri/icons/mstile-70x70.png differ
diff --git a/frontend/editor/src-tauri/windows/wix/banner.bmp b/frontend/editor/src-tauri/windows/wix/banner.bmp
index 8c120d1fe2..d6ee476bcc 100644
Binary files a/frontend/editor/src-tauri/windows/wix/banner.bmp and b/frontend/editor/src-tauri/windows/wix/banner.bmp differ
diff --git a/frontend/editor/src-tauri/windows/wix/dialog.bmp b/frontend/editor/src-tauri/windows/wix/dialog.bmp
index 680241e9e7..49725f82db 100644
Binary files a/frontend/editor/src-tauri/windows/wix/dialog.bmp and b/frontend/editor/src-tauri/windows/wix/dialog.bmp differ
diff --git a/frontend/editor/src/assets/3rdPartyLicenses.json b/frontend/editor/src/assets/3rdPartyLicenses.json
index 110a6c88a5..e17cef8f8b 100644
--- a/frontend/editor/src/assets/3rdPartyLicenses.json
+++ b/frontend/editor/src/assets/3rdPartyLicenses.json
@@ -10,7 +10,7 @@
     {
       "moduleName": "@cantoo/pdf-lib",
       "moduleUrl": "https://github.com/cantoo-scribe/pdf-lib",
-      "moduleVersion": "2.6.5",
+      "moduleVersion": "2.8.2",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
@@ -255,14 +255,14 @@
     {
       "moduleName": "@stripe/react-stripe-js",
       "moduleUrl": "https://github.com/stripe/react-stripe-js",
-      "moduleVersion": "4.0.2",
+      "moduleVersion": "6.8.0",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@stripe/stripe-js",
       "moduleUrl": "https://github.com/stripe/stripe-js",
-      "moduleVersion": "7.9.0",
+      "moduleVersion": "9.10.0",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
@@ -287,6 +287,13 @@
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
+    {
+      "moduleName": "@tanstack/react-table",
+      "moduleUrl": "https://github.com/TanStack/table",
+      "moduleVersion": "9.1.2",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
+    },
     {
       "moduleName": "@tanstack/react-virtual",
       "moduleUrl": "https://github.com/TanStack/virtual",
diff --git a/frontend/editor/src/cloud/components/shared/TeamInvitationBanner.tsx b/frontend/editor/src/cloud/components/shared/TeamInvitationBanner.tsx
index 3b373e9c3b..638c752f9e 100644
--- a/frontend/editor/src/cloud/components/shared/TeamInvitationBanner.tsx
+++ b/frontend/editor/src/cloud/components/shared/TeamInvitationBanner.tsx
@@ -3,7 +3,7 @@ import { Group, Text } from "@mantine/core";
 import { Button } from "@app/ui/Button";
 import { useTranslation } from "react-i18next";
 import LocalIcon from "@app/components/shared/LocalIcon";
-import { InfoBanner } from "@app/components/shared/InfoBanner";
+import { AppBanner } from "@app/components/shared/AppBanner";
 import { useSaaSTeam } from "@app/contexts/SaaSTeamContext";
 
 /**
@@ -105,7 +105,7 @@ export function TeamInvitationBanner() {
   );
 
   return (
-    <InfoBanner
+    <AppBanner
       icon="mail"
       message={
         <Group
@@ -120,10 +120,6 @@ export function TeamInvitationBanner() {
       }
       show={shouldShow}
       dismissible={false}
-      background="var(--mantine-color-dark-7)"
-      borderColor="var(--mantine-color-dark-5)"
-      textColor="rgba(255, 255, 255, 0.95)"
-      iconColor="rgba(255, 255, 255, 0.95)"
     />
   );
 }
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx
index 8811e537b2..c4407cae7f 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx
@@ -12,6 +12,7 @@ import {
   formatPeriodDate,
   MeterBar,
   meterState,
+  remainingMeter,
 } from "@app/billing";
 import "@app/components/shared/config/configSections/Payg.css";
 import "@app/components/shared/config/configSections/PaygFree.css";
@@ -48,7 +49,8 @@ export function useFreeSnapshot(): FreeSnapshot {
 
 export function FreeMeterPanel({ snap }: { snap: FreeSnapshot }) {
   const { t } = useTranslation();
-  const { state, pct } = meterState(snap.billableUsed, snap.billableLimit);
+  const remaining = Math.max(0, snap.billableLimit - snap.billableUsed);
+  const { state, pct } = remainingMeter(remaining, snap.billableLimit);
   const stateLabel =
     state === "DEGRADED"
       ? t("payg.free.state.limitReached", "Limit reached")
@@ -60,9 +62,9 @@ export function FreeMeterPanel({ snap }: { snap: FreeSnapshot }) {
     <MeterBar
       state={state}
       pct={pct}
-      barLabel={t("payg.free.hero.barAria", "Free PDFs used")}
-      figure={snap.billableUsed.toLocaleString()}
-      capSuffix={t("payg.free.hero.capSuffix", "/ {{limit}} free PDFs", {
+      barLabel={t("payg.free.hero.barAria", "Free PDFs remaining")}
+      figure={remaining.toLocaleString()}
+      capSuffix={t("payg.free.hero.capSuffix", "of {{limit}} free PDFs left", {
         limit: snap.billableLimit.toLocaleString(),
       })}
       statusLabel={stateLabel}
@@ -175,15 +177,15 @@ export function prepaidSnapshotFromWallet(
 }
 
 /**
- * Prepaid capacity meter. The bar fills as the pool is drawn down ({@code used =
- * total − remaining}), so it WARNs when the pool is running low and DEGRADEs once
- * exhausted — same bands as the free/cap meters. Prepaid is consumed ahead of the
- * meter and outside the spend cap, so it reads as its own dimension.
+ * Prepaid capacity meter. The bar shows what is left and drains towards empty,
+ * while the bands still key on what is gone ({@code used = total − remaining}), so
+ * it WARNs when the pool is running low and DEGRADEs once exhausted — same bands
+ * as the free/cap meters. Prepaid is consumed ahead of the meter and outside the
+ * spend cap, so it reads as its own dimension.
  */
 export function PrepaidCapacityMeterPanel({ snap }: { snap: PrepaidSnapshot }) {
   const { t } = useTranslation();
-  const used = Math.max(0, snap.total - snap.remaining);
-  const { state, pct } = meterState(used, snap.total);
+  const { state, pct } = remainingMeter(snap.remaining, snap.total);
   const stateLabel =
     state === "DEGRADED"
       ? t("payg.prepaid.state.exhausted", "Used up")
diff --git a/frontend/editor/src/cloud/hooks/useFreeCreditsSummary.ts b/frontend/editor/src/cloud/hooks/useFreeCreditsSummary.ts
new file mode 100644
index 0000000000..05e9536267
--- /dev/null
+++ b/frontend/editor/src/cloud/hooks/useFreeCreditsSummary.ts
@@ -0,0 +1,50 @@
+import { useEffect, useState } from "react";
+import { useWallet } from "@app/hooks/useWallet";
+import {
+  readCachedCredits,
+  writeCachedCredits,
+  type CachedCredits,
+} from "@app/services/navFooterCache";
+import { type NavFooterCredits } from "@app/components/shared/navFooter/NavFooterCreditsRow";
+
+/** The wallet reduced to what the footer shows: figures, or null for a payer. */
+function toCredits(
+  status: string,
+  freeRemaining: number,
+  freeAllowance: number,
+): CachedCredits {
+  // Free teams only. The grant is a lifetime pool that survives subscribing, so
+  // a paying team would otherwise sit on a permanent "0 of 500" in red while
+  // nothing is wrong. Plan draws the same line — subscribed teams get the
+  // spend-vs-cap meter there, and admins get usage in the processor.
+  if (status === "subscribed") return null;
+  return { remaining: freeRemaining, total: freeAllowance };
+}
+
+/**
+ * Cloud builds read the free grant off the live wallet — the same snapshot the
+ * Plan page's free meter renders, so the sidebar and Plan can't disagree.
+ *
+ * Seeded from the last figures this browser saw, so the row is right at first
+ * paint and stays put while the wallet refetches underneath. Only a browser
+ * that has never loaded a wallet has nothing to show, and that one time the row
+ * animates in. The seed is read once, at first render: later reads would fight
+ * the live value, and the whole point is that the row stops moving.
+ */
+export function useFreeCreditsSummary(): NavFooterCredits | null {
+  const { wallet } = useWallet();
+  const [seed] = useState(readCachedCredits);
+
+  const live = wallet
+    ? toCredits(wallet.status, wallet.freeRemaining, wallet.freeAllowance)
+    : undefined;
+
+  // useWallet reuses the snapshot reference when nothing changed, so keying on
+  // it writes only on a real change, not on every render.
+  useEffect(() => {
+    if (live !== undefined) writeCachedCredits(live);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [wallet]);
+
+  return (live !== undefined ? live : seed) ?? null;
+}
diff --git a/frontend/editor/src/cloud/hooks/useOpenPlan.ts b/frontend/editor/src/cloud/hooks/useOpenPlan.ts
new file mode 100644
index 0000000000..4d532319f6
--- /dev/null
+++ b/frontend/editor/src/cloud/hooks/useOpenPlan.ts
@@ -0,0 +1,13 @@
+import { useCallback } from "react";
+import { useNavigate } from "react-router-dom";
+
+/**
+ * Cloud editor builds open the settings modal on its Plan section, which is
+ * where the free grant is explained and the Processor plan is switched on.
+ * Routed rather than called directly because the modal is URL-driven here
+ * (`/settings/*`), the same path the admin tour uses to open it.
+ */
+export function useOpenPlan(): (() => void) | null {
+  const navigate = useNavigate();
+  return useCallback(() => navigate("/settings/plan"), [navigate]);
+}
diff --git a/frontend/editor/src/cloud/hooks/useWallet.ts b/frontend/editor/src/cloud/hooks/useWallet.ts
index 0a3f78b3ce..ed3cb2ce6b 100644
--- a/frontend/editor/src/cloud/hooks/useWallet.ts
+++ b/frontend/editor/src/cloud/hooks/useWallet.ts
@@ -32,6 +32,14 @@
  * promise see the UI flip exactly once the new state is visible — no
  * intermediate flash of the old value.
  *
+ * <h2>Freshness</h2>
+ *
+ * The figures drain as metered work runs, so a mounted consumer re-reads the
+ * wallet every {@link WALLET_POLL_MS} and again whenever the tab regains
+ * visibility. Those refreshes are silent — they leave {@code loading} and
+ * {@code error} alone and only commit fresher data — so consumers that gate on
+ * those flags don't flicker on a background tick.
+ *
  * <h2>Dev preview fallback</h2>
  *
  * When the hook is rendered outside the saas app (e.g. on {@code
@@ -178,6 +186,13 @@ function reuseIfEqual(prev: Wallet | null, next: Wallet): Wallet {
   return prev;
 }
 
+/**
+ * How often a mounted consumer re-reads the wallet. Matches the app query
+ * client's staleTime, so the sidebar meter and anything cached elsewhere age
+ * out on the same clock.
+ */
+const WALLET_POLL_MS = 30_000;
+
 export function useWallet(): UseWalletResult {
   // Resolved once: the dev-preview side-channel when rendered outside the real
   // app (saas /dev/payg-preview route), else null (every real build + desktop).
@@ -201,13 +216,29 @@ export function useWallet(): UseWalletResult {
   // "the request fired." Cleared when no load is pending.
   const inFlight = useRef<Promise<void> | null>(null);
 
+  // Set for refreshes the user didn't ask for (the poll below). Silence governs
+  // whether a load may RAISE `loading` / `error`, never whether it may clear
+  // them: consumers gate on both — the limit modals do
+  // `if (loading || !wallet) return null`, and Plan swaps in an error alert —
+  // so a background tick must not blink an open modal out or replace a working
+  // page over a transient failure. Clearing is always the latest request's job,
+  // silent or not; a silent load that skipped the clear would strand `loading`
+  // true after superseding a visible one, which suppresses those modals for the
+  // rest of the session.
+  const silentRefresh = useRef(false);
+
   useEffect(() => {
     const reqId = ++latestReqId.current;
     let cancelled = false;
 
+    const silent = silentRefresh.current;
+    silentRefresh.current = false;
+
     const promise = (async () => {
-      setLoading(true);
-      setError(null);
+      if (!silent) {
+        setLoading(true);
+        setError(null);
+      }
 
       if (devPreview) {
         const synth = devPreview.buildWallet(devPreview.role());
@@ -221,11 +252,22 @@ export function useWallet(): UseWalletResult {
         const res = await apiClient.get<Wallet>("/api/v1/payg/wallet");
         if (cancelled || reqId !== latestReqId.current) return;
         setWallet((prev) => reuseIfEqual(prev, res.data));
+        // Fresh data retires any earlier failure, including one a silent poll
+        // is recovering from — otherwise Plan keeps its alert over good data.
+        setError(null);
       } catch (e: unknown) {
         if (cancelled || reqId !== latestReqId.current) return;
-        console.warn("[useWallet] fetch failed", e);
-        setError(e instanceof Error ? e.message : "Failed to load wallet");
+        if (!silent) {
+          console.warn("[useWallet] fetch failed", e);
+          setError(e instanceof Error ? e.message : "Failed to load wallet");
+        }
+        // A failed background refresh is a non-event: the last good snapshot
+        // stands and the next tick self-heals, so it neither surfaces nor
+        // logs — otherwise an offline tab warns every WALLET_POLL_MS.
       } finally {
+        // Deliberately not gated on `silent`: whichever load is latest owns
+        // settling the flag, or a silent refresh that supersedes a visible one
+        // leaves it stuck true.
         if (!cancelled && reqId === latestReqId.current) {
           setLoading(false);
         }
@@ -242,6 +284,46 @@ export function useWallet(): UseWalletResult {
     };
   }, [devPreview, refetchTick]);
 
+  // The wallet drains as automation, AI and API work runs, so a figure fetched
+  // on mount goes stale while the user watches it. Refresh on a timer, and
+  // immediately on returning to the tab — coming back to a stale number is the
+  // case people actually notice. Hidden tabs don't poll, and the dev-preview
+  // wallet is synthesised locally so there is nothing to re-read.
+  useEffect(() => {
+    if (devPreview) return;
+
+    let timer: ReturnType<typeof setInterval> | undefined;
+    const refresh = () => {
+      silentRefresh.current = true;
+      setRefetchTick((t) => t + 1);
+    };
+    const stop = () => {
+      if (timer !== undefined) {
+        clearInterval(timer);
+        timer = undefined;
+      }
+    };
+    const start = () => {
+      stop();
+      timer = setInterval(refresh, WALLET_POLL_MS);
+    };
+    const onVisibilityChange = () => {
+      if (document.visibilityState === "visible") {
+        refresh();
+        start();
+      } else {
+        stop();
+      }
+    };
+
+    if (document.visibilityState === "visible") start();
+    document.addEventListener("visibilitychange", onVisibilityChange);
+    return () => {
+      stop();
+      document.removeEventListener("visibilitychange", onVisibilityChange);
+    };
+  }, [devPreview]);
+
   const refetch = useCallback(async () => {
     setRefetchTick((t) => t + 1);
     // Snapshot the next-tick promise so the caller awaits this refetch
diff --git a/frontend/editor/src/core/assets/brand/classic-logo/Firstpage.png b/frontend/editor/src/core/assets/brand/classic-logo/Firstpage.png
index 3cee859e7f..ce40d97faf 100644
Binary files a/frontend/editor/src/core/assets/brand/classic-logo/Firstpage.png and b/frontend/editor/src/core/assets/brand/classic-logo/Firstpage.png differ
diff --git a/frontend/editor/src/core/assets/brand/classic-logo/logo-tooltip.svg b/frontend/editor/src/core/assets/brand/classic-logo/logo-tooltip.svg
index a19eaabc9c..4556168c5f 100644
--- a/frontend/editor/src/core/assets/brand/classic-logo/logo-tooltip.svg
+++ b/frontend/editor/src/core/assets/brand/classic-logo/logo-tooltip.svg
@@ -1,5 +1 @@
-<svg width="77" height="84" viewBox="0 0 77 84" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M32.2124 83.9997L69.3441 75.2005L76.282 43.5585L32.2124 83.9997Z" fill="#D0DBDC"/>
-<path d="M55.4932 0.119995C59.0409 -0.585293 62.4223 1.9086 62.3672 5.23425L62.3389 7.60339L67.8281 6.51941C71.9024 5.71349 75.7821 8.53542 75.8379 12.3397L76.2266 43.5839L54.0576 64.2264L32.209 83.9999L7.40137 81.0516C3.18818 80.5981 8.70906e-05 77.3479 0 73.4677V18.8661C3.4631e-05 14.4063 3.40977 10.5511 8.20508 9.59363L55.4932 0.119995ZM45.4023 19.3212C37.9183 15.6676 26.9971 18.3632 26.9971 18.3632C18.6818 20.7316 15.7434 26.2243 14.7178 30.1298C13.9417 33.1282 14.136 36.253 15.2725 39.0751C17.684 45.0213 23.5324 46.8357 29.7412 48.5995C37.5024 50.7916 36.0059 54.7977 36.0059 54.7977C35.1189 57.544 32.9294 58.451 31.0723 58.703C29.6032 58.9046 28.0783 58.703 26.6924 58.1991C19.2266 55.4091 16.588 49.6354 16.5752 49.6073H15.2441L15.7432 62.6337C18.4595 64.1706 24.0035 65.4559 27.1357 66.0858C29.4087 66.5646 31.7654 66.7159 34.0938 66.4891C47.3152 65.1787 48.1191 53.7645 48.1191 53.7645C49.5327 41.5946 38.0017 38.5707 31.0166 37.1093C29.714 36.8321 28.7161 36.4799 27.9678 36.0516C24.8078 34.3131 25.1684 29.9283 28.6055 28.3661C30.9338 27.3081 33.8999 27.6354 35.8955 28.4921C39.0277 29.8529 43.2686 34.8671 43.2686 34.8671H45.0703L45.4023 19.3212Z" fill="white"/>
-<path d="M62.394 7.60263V57.1394L76.2811 43.5584L75.8931 11.2814C75.8653 8.00577 72.5114 5.58689 68.9911 6.2924L62.394 7.60263Z" fill="#EEEEEE"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="77" height="84" fill="none" viewBox="0 0 77 84"><path fill="#D0DBDC" d="M32.2124 83.9997L69.3441 75.2005L76.282 43.5585L32.2124 83.9997Z"/><path fill="#fff" d="M55.4932 0.119995C59.0409 -0.585293 62.4223 1.9086 62.3672 5.23425L62.3389 7.60339L67.8281 6.51941C71.9024 5.71349 75.7821 8.53542 75.8379 12.3397L76.2266 43.5839L54.0576 64.2264L32.209 83.9999L7.40137 81.0516C3.18818 80.5981 8.70906e-05 77.3479 0 73.4677V18.8661C3.4631e-05 14.4063 3.40977 10.5511 8.20508 9.59363L55.4932 0.119995ZM45.4023 19.3212C37.9183 15.6676 26.9971 18.3632 26.9971 18.3632C18.6818 20.7316 15.7434 26.2243 14.7178 30.1298C13.9417 33.1282 14.136 36.253 15.2725 39.0751C17.684 45.0213 23.5324 46.8357 29.7412 48.5995C37.5024 50.7916 36.0059 54.7977 36.0059 54.7977C35.1189 57.544 32.9294 58.451 31.0723 58.703C29.6032 58.9046 28.0783 58.703 26.6924 58.1991C19.2266 55.4091 16.588 49.6354 16.5752 49.6073H15.2441L15.7432 62.6337C18.4595 64.1706 24.0035 65.4559 27.1357 66.0858C29.4087 66.5646 31.7654 66.7159 34.0938 66.4891C47.3152 65.1787 48.1191 53.7645 48.1191 53.7645C49.5327 41.5946 38.0017 38.5707 31.0166 37.1093C29.714 36.8321 28.7161 36.4799 27.9678 36.0516C24.8078 34.3131 25.1684 29.9283 28.6055 28.3661C30.9338 27.3081 33.8999 27.6354 35.8955 28.4921C39.0277 29.8529 43.2686 34.8671 43.2686 34.8671H45.0703L45.4023 19.3212Z"/><path fill="#EEE" d="M62.394 7.60263V57.1394L76.2811 43.5584L75.8931 11.2814C75.8653 8.00577 72.5114 5.58689 68.9911 6.2924L62.394 7.60263Z"/></svg>
\ No newline at end of file
diff --git a/frontend/editor/src/core/assets/brand/classic-logo/logo192.png b/frontend/editor/src/core/assets/brand/classic-logo/logo192.png
index 08101ad33c..6c8d372c56 100644
Binary files a/frontend/editor/src/core/assets/brand/classic-logo/logo192.png and b/frontend/editor/src/core/assets/brand/classic-logo/logo192.png differ
diff --git a/frontend/editor/src/core/assets/brand/classic-logo/logo512.png b/frontend/editor/src/core/assets/brand/classic-logo/logo512.png
index 1f7fe384fd..b71e8b11aa 100644
Binary files a/frontend/editor/src/core/assets/brand/classic-logo/logo512.png and b/frontend/editor/src/core/assets/brand/classic-logo/logo512.png differ
diff --git a/frontend/editor/src/core/assets/brand/modern-logo/Firstpage.png b/frontend/editor/src/core/assets/brand/modern-logo/Firstpage.png
index f12133f4f7..dab3d43aa3 100644
Binary files a/frontend/editor/src/core/assets/brand/modern-logo/Firstpage.png and b/frontend/editor/src/core/assets/brand/modern-logo/Firstpage.png differ
diff --git a/frontend/editor/src/core/assets/brand/modern-logo/logo192.png b/frontend/editor/src/core/assets/brand/modern-logo/logo192.png
index 2994ca293a..2019b93d99 100644
Binary files a/frontend/editor/src/core/assets/brand/modern-logo/logo192.png and b/frontend/editor/src/core/assets/brand/modern-logo/logo192.png differ
diff --git a/frontend/editor/src/core/assets/brand/modern-logo/logo512.png b/frontend/editor/src/core/assets/brand/modern-logo/logo512.png
index b481550734..90934019e8 100644
Binary files a/frontend/editor/src/core/assets/brand/modern-logo/logo512.png and b/frontend/editor/src/core/assets/brand/modern-logo/logo512.png differ
diff --git a/frontend/editor/src/core/assets/login/authentik.svg b/frontend/editor/src/core/assets/login/authentik.svg
index 26dc0189ef..4ed18d49b4 100644
--- a/frontend/editor/src/core/assets/login/authentik.svg
+++ b/frontend/editor/src/core/assets/login/authentik.svg
@@ -1,5 +1 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="300" height="230">
-<path d="M0 0 C1.31903824 -0.0071553 2.63807648 -0.01431061 3.99708557 -0.02168274 C5.457443 -0.02452288 6.91780069 -0.02723462 8.37815857 -0.02983093 C9.91753288 -0.03609819 11.45690569 -0.04274523 12.99627686 -0.04974365 C18.05121309 -0.07076093 23.10614953 -0.08114609 28.16111755 -0.09111023 C29.9042964 -0.09515911 31.64747509 -0.09927607 33.39065361 -0.10346031 C41.5839072 -0.12250942 49.77715181 -0.13673921 57.97042328 -0.14507228 C67.41159376 -0.1548342 76.85252914 -0.18112751 86.29361683 -0.22157317 C93.60081727 -0.25179687 100.90795058 -0.2665472 108.21521229 -0.26985329 C112.57457636 -0.27219728 116.9336892 -0.28107194 121.29298592 -0.30631447 C125.39953639 -0.32970901 129.50567225 -0.33378312 133.61227226 -0.32355309 C135.11218526 -0.32306031 136.61211945 -0.32930375 138.11196899 -0.34310913 C152.84247827 -0.47101164 163.97724403 3.01349139 174.8212738 13.24873352 C182.88515893 21.79584771 187.82015779 31.98003153 187.86886597 43.86180115 C187.87884109 45.17365891 187.88881622 46.48551666 187.89909363 47.83712769 C187.89998926 49.27397144 187.90065292 50.71081534 187.90110779 52.1476593 C187.90873693 53.67438153 187.91716572 55.20109994 187.92633057 56.72781372 C187.94821238 60.86244525 187.95706633 64.99700285 187.96215701 69.13168573 C187.96580911 71.7203613 187.97205369 74.30901776 187.9791584 76.897686 C188.00363429 85.94472345 188.01670005 94.99170374 188.02024841 104.03877258 C188.0238787 112.4452023 188.05374235 120.85126581 188.095653 129.25758374 C188.13046003 136.49524804 188.14579867 143.73279163 188.14649445 150.97053897 C188.14728394 155.28413849 188.1558702 159.59736489 188.18449211 163.91087723 C188.21085103 167.97406106 188.21278 172.0365672 188.19683647 176.0997982 C188.19503583 177.58113661 188.20158585 179.06251559 188.21765518 180.54376793 C188.36450998 194.97434252 184.85316963 206.66730712 174.5947113 217.14717102 C165.79646466 225.14557706 156.08057815 230.43905796 144.0087738 230.34248352 C142.72438416 230.3374884 141.43999451 230.33249329 140.11668396 230.3273468 C138.50068298 230.30913879 136.88468201 230.29093079 135.2197113 230.27217102 C130.0634613 230.23092102 124.9072113 230.18967102 119.5947113 230.14717102 C119.5947113 215.29717102 119.5947113 200.44717102 119.5947113 185.14717102 C88.5747113 185.14717102 57.5547113 185.14717102 25.5947113 185.14717102 C25.5947113 199.99717102 25.5947113 214.84717102 25.5947113 230.14717102 C20.7065863 230.22967102 15.8184613 230.31217102 10.7822113 230.39717102 C9.26393738 230.43358704 7.74566345 230.47000305 6.18138123 230.50752258 C-5.50898103 230.60237339 -14.889398 228.09279021 -24.4052887 221.14717102 C-25.06142151 220.6908429 -25.71755432 220.23451477 -26.39356995 219.76435852 C-35.6417653 212.61720949 -41.52201418 200.44681809 -43.4052887 189.14717102 C-43.0752887 172.64717102 -42.7452887 156.14717102 -42.4052887 139.14717102 C7.4247113 139.14717102 57.2547113 139.14717102 108.5947113 139.14717102 C108.2647113 113.07717102 107.9347113 87.00717102 107.5947113 60.14717102 C102.3147113 60.14717102 97.0347113 60.14717102 91.5947113 60.14717102 C91.4090863 62.59123352 91.4090863 62.59123352 91.2197113 65.08467102 C91.0087738 67.86201477 91.0087738 67.86201477 90.5947113 70.14717102 C87.97156099 71.45874618 86.36437695 71.0436709 83.4697113 70.70967102 C82.55963318 70.60783508 81.64955505 70.50599915 80.7118988 70.40107727 C79.66389099 70.27539368 79.66389099 70.27539368 78.5947113 70.14717102 C77.92804464 66.81383769 77.26137797 63.48050435 76.5947113 60.14717102 C72.3047113 60.14717102 68.0147113 60.14717102 63.5947113 60.14717102 C63.2647113 66.08717102 62.9347113 72.02717102 62.5947113 78.14717102 C58.6347113 78.14717102 54.6747113 78.14717102 50.5947113 78.14717102 C50.5947113 71.87717102 50.5947113 65.60717102 50.5947113 59.14717102 C47.6247113 59.64217102 47.6247113 59.64217102 44.5947113 60.14717102 C39.02328273 60.36145673 39.02328273 60.36145673 36.5947113 59.14717102 C36.5947113 74.32717102 36.5947113 89.50717102 36.5947113 105.14717102 C11.8447113 105.47717102 -12.9052887 105.80717102 -38.4052887 106.14717102 C-36.7552887 109.44717102 -35.1052887 112.74717102 -33.4052887 116.14717102 C-32.23385964 123.93483139 -37.28666971 130.77501339 -41.6552887 136.89961243 C-50.19263554 148.19063476 -59.91392466 156.85995926 -74.4052887 159.14717102 C-80.88854532 158.9467374 -86.88378649 157.62811807 -92.4052887 154.14717102 C-93.17485901 153.69728821 -93.94442932 153.2474054 -94.73731995 152.78388977 C-103.86805755 147.04808909 -109.56723535 138.52333432 -112.4052887 128.14717102 C-112.8723603 124.88590617 -112.97726751 121.68916403 -112.9677887 118.39717102 C-112.9653717 117.51972229 -112.96295471 116.64227356 -112.96046448 115.73823547 C-112.65422767 104.8768365 -108.0027269 96.74460922 -100.4052887 89.14717102 C-99.7452887 89.14717102 -99.0852887 89.14717102 -98.4052887 89.14717102 C-98.4052887 88.48717102 -98.4052887 87.82717102 -98.4052887 87.14717102 C-96.32399765 86.16367077 -94.2401751 85.18552644 -92.1552887 84.20967102 C-90.99513245 83.66439758 -89.8349762 83.11912415 -88.6396637 82.55732727 C-81.50461728 79.44651597 -73.41946171 78.81361437 -65.8349762 80.83076477 C-57.72956403 84.23390821 -47.43007285 91.09760271 -43.4052887 99.14717102 C-43.40972992 98.49730225 -43.41417114 97.84743347 -43.41874695 97.1778717 C-43.46327723 90.36362424 -43.49327744 83.54941867 -43.51515198 76.73506165 C-43.52515846 74.19793517 -43.53876781 71.66082007 -43.5561676 69.12373352 C-43.58065249 65.4596423 -43.5918257 61.79570464 -43.6006012 58.13154602 C-43.61608505 56.45267303 -43.61608505 56.45267303 -43.63188171 54.73988342 C-43.63410813 38.81921683 -40.45768984 24.97343548 -29.44044495 13.01435852 C-21.16029185 5.13848053 -11.47412704 0.04274377 0 0 Z M-91.67481995 103.06123352 C-95.82753716 108.06699197 -98.20306218 114.54098751 -97.7802887 121.08076477 C-96.40229746 128.67407064 -93.51648925 134.04027941 -87.4052887 138.80342102 C-82.34135894 142.20574882 -77.91601901 142.59060055 -71.98731995 141.79951477 C-63.04973823 139.54145706 -57.43450233 132.43487412 -52.4052887 125.14717102 C-51.9515387 124.5258429 -51.4977887 123.90451477 -51.0302887 123.26435852 C-49.79068763 121.40487039 -49.79068763 121.40487039 -49.4052887 118.14717102 C-50.947176 114.76439926 -53.06912635 112.02038218 -55.4052887 109.14717102 C-56.1477887 108.13654602 -56.8902887 107.12592102 -57.6552887 106.08467102 C-58.2327887 105.44529602 -58.8102887 104.80592102 -59.4052887 104.14717102 C-60.0652887 104.14717102 -60.7252887 104.14717102 -61.4052887 104.14717102 C-61.6115387 103.56967102 -61.8177887 102.99217102 -62.0302887 102.39717102 C-64.57009959 98.24111683 -68.12585168 96.50927584 -72.7177887 95.20967102 C-80.35763288 95.08018214 -86.15491527 97.83880873 -91.67481995 103.06123352 Z " fill="#FD4A2C" transform="translate(112.40528869628906,-0.1471710205078125)"/>
-<path d="" fill="#FD4A2C" transform="translate(0,0)"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="300" height="230" version="1.1"><path fill="#FD4A2C" d="M0 0 C1.31903824 -0.0071553 2.63807648 -0.01431061 3.99708557 -0.02168274 C5.457443 -0.02452288 6.91780069 -0.02723462 8.37815857 -0.02983093 C9.91753288 -0.03609819 11.45690569 -0.04274523 12.99627686 -0.04974365 C18.05121309 -0.07076093 23.10614953 -0.08114609 28.16111755 -0.09111023 C29.9042964 -0.09515911 31.64747509 -0.09927607 33.39065361 -0.10346031 C41.5839072 -0.12250942 49.77715181 -0.13673921 57.97042328 -0.14507228 C67.41159376 -0.1548342 76.85252914 -0.18112751 86.29361683 -0.22157317 C93.60081727 -0.25179687 100.90795058 -0.2665472 108.21521229 -0.26985329 C112.57457636 -0.27219728 116.9336892 -0.28107194 121.29298592 -0.30631447 C125.39953639 -0.32970901 129.50567225 -0.33378312 133.61227226 -0.32355309 C135.11218526 -0.32306031 136.61211945 -0.32930375 138.11196899 -0.34310913 C152.84247827 -0.47101164 163.97724403 3.01349139 174.8212738 13.24873352 C182.88515893 21.79584771 187.82015779 31.98003153 187.86886597 43.86180115 C187.87884109 45.17365891 187.88881622 46.48551666 187.89909363 47.83712769 C187.89998926 49.27397144 187.90065292 50.71081534 187.90110779 52.1476593 C187.90873693 53.67438153 187.91716572 55.20109994 187.92633057 56.72781372 C187.94821238 60.86244525 187.95706633 64.99700285 187.96215701 69.13168573 C187.96580911 71.7203613 187.97205369 74.30901776 187.9791584 76.897686 C188.00363429 85.94472345 188.01670005 94.99170374 188.02024841 104.03877258 C188.0238787 112.4452023 188.05374235 120.85126581 188.095653 129.25758374 C188.13046003 136.49524804 188.14579867 143.73279163 188.14649445 150.97053897 C188.14728394 155.28413849 188.1558702 159.59736489 188.18449211 163.91087723 C188.21085103 167.97406106 188.21278 172.0365672 188.19683647 176.0997982 C188.19503583 177.58113661 188.20158585 179.06251559 188.21765518 180.54376793 C188.36450998 194.97434252 184.85316963 206.66730712 174.5947113 217.14717102 C165.79646466 225.14557706 156.08057815 230.43905796 144.0087738 230.34248352 C142.72438416 230.3374884 141.43999451 230.33249329 140.11668396 230.3273468 C138.50068298 230.30913879 136.88468201 230.29093079 135.2197113 230.27217102 C130.0634613 230.23092102 124.9072113 230.18967102 119.5947113 230.14717102 C119.5947113 215.29717102 119.5947113 200.44717102 119.5947113 185.14717102 C88.5747113 185.14717102 57.5547113 185.14717102 25.5947113 185.14717102 C25.5947113 199.99717102 25.5947113 214.84717102 25.5947113 230.14717102 C20.7065863 230.22967102 15.8184613 230.31217102 10.7822113 230.39717102 C9.26393738 230.43358704 7.74566345 230.47000305 6.18138123 230.50752258 C-5.50898103 230.60237339 -14.889398 228.09279021 -24.4052887 221.14717102 C-25.06142151 220.6908429 -25.71755432 220.23451477 -26.39356995 219.76435852 C-35.6417653 212.61720949 -41.52201418 200.44681809 -43.4052887 189.14717102 C-43.0752887 172.64717102 -42.7452887 156.14717102 -42.4052887 139.14717102 C7.4247113 139.14717102 57.2547113 139.14717102 108.5947113 139.14717102 C108.2647113 113.07717102 107.9347113 87.00717102 107.5947113 60.14717102 C102.3147113 60.14717102 97.0347113 60.14717102 91.5947113 60.14717102 C91.4090863 62.59123352 91.4090863 62.59123352 91.2197113 65.08467102 C91.0087738 67.86201477 91.0087738 67.86201477 90.5947113 70.14717102 C87.97156099 71.45874618 86.36437695 71.0436709 83.4697113 70.70967102 C82.55963318 70.60783508 81.64955505 70.50599915 80.7118988 70.40107727 C79.66389099 70.27539368 79.66389099 70.27539368 78.5947113 70.14717102 C77.92804464 66.81383769 77.26137797 63.48050435 76.5947113 60.14717102 C72.3047113 60.14717102 68.0147113 60.14717102 63.5947113 60.14717102 C63.2647113 66.08717102 62.9347113 72.02717102 62.5947113 78.14717102 C58.6347113 78.14717102 54.6747113 78.14717102 50.5947113 78.14717102 C50.5947113 71.87717102 50.5947113 65.60717102 50.5947113 59.14717102 C47.6247113 59.64217102 47.6247113 59.64217102 44.5947113 60.14717102 C39.02328273 60.36145673 39.02328273 60.36145673 36.5947113 59.14717102 C36.5947113 74.32717102 36.5947113 89.50717102 36.5947113 105.14717102 C11.8447113 105.47717102 -12.9052887 105.80717102 -38.4052887 106.14717102 C-36.7552887 109.44717102 -35.1052887 112.74717102 -33.4052887 116.14717102 C-32.23385964 123.93483139 -37.28666971 130.77501339 -41.6552887 136.89961243 C-50.19263554 148.19063476 -59.91392466 156.85995926 -74.4052887 159.14717102 C-80.88854532 158.9467374 -86.88378649 157.62811807 -92.4052887 154.14717102 C-93.17485901 153.69728821 -93.94442932 153.2474054 -94.73731995 152.78388977 C-103.86805755 147.04808909 -109.56723535 138.52333432 -112.4052887 128.14717102 C-112.8723603 124.88590617 -112.97726751 121.68916403 -112.9677887 118.39717102 C-112.9653717 117.51972229 -112.96295471 116.64227356 -112.96046448 115.73823547 C-112.65422767 104.8768365 -108.0027269 96.74460922 -100.4052887 89.14717102 C-99.7452887 89.14717102 -99.0852887 89.14717102 -98.4052887 89.14717102 C-98.4052887 88.48717102 -98.4052887 87.82717102 -98.4052887 87.14717102 C-96.32399765 86.16367077 -94.2401751 85.18552644 -92.1552887 84.20967102 C-90.99513245 83.66439758 -89.8349762 83.11912415 -88.6396637 82.55732727 C-81.50461728 79.44651597 -73.41946171 78.81361437 -65.8349762 80.83076477 C-57.72956403 84.23390821 -47.43007285 91.09760271 -43.4052887 99.14717102 C-43.40972992 98.49730225 -43.41417114 97.84743347 -43.41874695 97.1778717 C-43.46327723 90.36362424 -43.49327744 83.54941867 -43.51515198 76.73506165 C-43.52515846 74.19793517 -43.53876781 71.66082007 -43.5561676 69.12373352 C-43.58065249 65.4596423 -43.5918257 61.79570464 -43.6006012 58.13154602 C-43.61608505 56.45267303 -43.61608505 56.45267303 -43.63188171 54.73988342 C-43.63410813 38.81921683 -40.45768984 24.97343548 -29.44044495 13.01435852 C-21.16029185 5.13848053 -11.47412704 0.04274377 0 0 Z M-91.67481995 103.06123352 C-95.82753716 108.06699197 -98.20306218 114.54098751 -97.7802887 121.08076477 C-96.40229746 128.67407064 -93.51648925 134.04027941 -87.4052887 138.80342102 C-82.34135894 142.20574882 -77.91601901 142.59060055 -71.98731995 141.79951477 C-63.04973823 139.54145706 -57.43450233 132.43487412 -52.4052887 125.14717102 C-51.9515387 124.5258429 -51.4977887 123.90451477 -51.0302887 123.26435852 C-49.79068763 121.40487039 -49.79068763 121.40487039 -49.4052887 118.14717102 C-50.947176 114.76439926 -53.06912635 112.02038218 -55.4052887 109.14717102 C-56.1477887 108.13654602 -56.8902887 107.12592102 -57.6552887 106.08467102 C-58.2327887 105.44529602 -58.8102887 104.80592102 -59.4052887 104.14717102 C-60.0652887 104.14717102 -60.7252887 104.14717102 -61.4052887 104.14717102 C-61.6115387 103.56967102 -61.8177887 102.99217102 -62.0302887 102.39717102 C-64.57009959 98.24111683 -68.12585168 96.50927584 -72.7177887 95.20967102 C-80.35763288 95.08018214 -86.15491527 97.83880873 -91.67481995 103.06123352 Z" transform="translate(112.40528869628906,-0.1471710205078125)"/><path fill="#FD4A2C" transform="translate(0,0)"/></svg>
\ No newline at end of file
diff --git a/frontend/editor/src/core/assets/login/github.svg b/frontend/editor/src/core/assets/login/github.svg
index 1174b67928..41c82d53fe 100644
--- a/frontend/editor/src/core/assets/login/github.svg
+++ b/frontend/editor/src/core/assets/login/github.svg
@@ -1,3 +1 @@
-<svg width="37" height="36" viewBox="0 0 37 36" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M18.5 3.3125C16.5712 3.3125 14.6613 3.6924 12.8793 4.43052C11.0974 5.16864 9.47823 6.25051 8.11437 7.61437C5.35993 10.3688 3.8125 14.1046 3.8125 18C3.8125 24.4919 8.02781 29.9997 13.8588 31.9531C14.5931 32.0706 14.8281 31.6153 14.8281 31.2187V28.7366C10.7597 29.6178 9.89312 26.7684 9.89312 26.7684C9.2175 25.0647 8.26281 24.6094 8.26281 24.6094C6.92625 23.6987 8.36562 23.7281 8.36562 23.7281C9.83437 23.8309 10.6128 25.2409 10.6128 25.2409C11.8906 27.4734 14.0497 26.8125 14.8869 26.46C15.0191 25.5053 15.4009 24.8591 15.8122 24.4919C12.5516 24.1247 9.12937 22.8616 9.12937 17.2656C9.12937 15.6353 9.6875 14.3281 10.6422 13.2853C10.4953 12.9181 9.98125 11.3906 10.7891 9.40781C10.7891 9.40781 12.0228 9.01125 14.8281 10.9059C15.9884 10.5828 17.2516 10.4212 18.5 10.4212C19.7484 10.4212 21.0116 10.5828 22.1719 10.9059C24.9772 9.01125 26.2109 9.40781 26.2109 9.40781C27.0188 11.3906 26.5047 12.9181 26.3578 13.2853C27.3125 14.3281 27.8706 15.6353 27.8706 17.2656C27.8706 22.8762 24.4338 24.11 21.1584 24.4772C21.6872 24.9325 22.1719 25.8284 22.1719 27.1944V31.2187C22.1719 31.6153 22.4069 32.0853 23.1559 31.9531C28.9869 29.985 33.1875 24.4919 33.1875 18C33.1875 16.0712 32.8076 14.1613 32.0695 12.3793C31.3314 10.5974 30.2495 8.97823 28.8856 7.61437C27.5218 6.25051 25.9026 5.16864 24.1207 4.43052C22.3387 3.6924 20.4288 3.3125 18.5 3.3125Z" fill="currentColor"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="37" height="36" fill="none" viewBox="0 0 37 36"><path fill="currentColor" d="M18.5 3.3125C16.5712 3.3125 14.6613 3.6924 12.8793 4.43052C11.0974 5.16864 9.47823 6.25051 8.11437 7.61437C5.35993 10.3688 3.8125 14.1046 3.8125 18C3.8125 24.4919 8.02781 29.9997 13.8588 31.9531C14.5931 32.0706 14.8281 31.6153 14.8281 31.2187V28.7366C10.7597 29.6178 9.89312 26.7684 9.89312 26.7684C9.2175 25.0647 8.26281 24.6094 8.26281 24.6094C6.92625 23.6987 8.36562 23.7281 8.36562 23.7281C9.83437 23.8309 10.6128 25.2409 10.6128 25.2409C11.8906 27.4734 14.0497 26.8125 14.8869 26.46C15.0191 25.5053 15.4009 24.8591 15.8122 24.4919C12.5516 24.1247 9.12937 22.8616 9.12937 17.2656C9.12937 15.6353 9.6875 14.3281 10.6422 13.2853C10.4953 12.9181 9.98125 11.3906 10.7891 9.40781C10.7891 9.40781 12.0228 9.01125 14.8281 10.9059C15.9884 10.5828 17.2516 10.4212 18.5 10.4212C19.7484 10.4212 21.0116 10.5828 22.1719 10.9059C24.9772 9.01125 26.2109 9.40781 26.2109 9.40781C27.0188 11.3906 26.5047 12.9181 26.3578 13.2853C27.3125 14.3281 27.8706 15.6353 27.8706 17.2656C27.8706 22.8762 24.4338 24.11 21.1584 24.4772C21.6872 24.9325 22.1719 25.8284 22.1719 27.1944V31.2187C22.1719 31.6153 22.4069 32.0853 23.1559 31.9531C28.9869 29.985 33.1875 24.4919 33.1875 18C33.1875 16.0712 32.8076 14.1613 32.0695 12.3793C31.3314 10.5974 30.2495 8.97823 28.8856 7.61437C27.5218 6.25051 25.9026 5.16864 24.1207 4.43052C22.3387 3.6924 20.4288 3.3125 18.5 3.3125Z"/></svg>
\ No newline at end of file
diff --git a/frontend/editor/src/core/assets/login/microsoft.svg b/frontend/editor/src/core/assets/login/microsoft.svg
index fc1130cbb2..691300857f 100644
--- a/frontend/editor/src/core/assets/login/microsoft.svg
+++ b/frontend/editor/src/core/assets/login/microsoft.svg
@@ -1,6 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 23 23" fill="none">
-  <path d="M0 0h10.5v10.5H0V0z" fill="#F25022"/>
-  <path d="M12.5 0H23v10.5H12.5V0z" fill="#7FBA00"/>
-  <path d="M0 12.5h10.5V23H0V12.5z" fill="#00A4EF"/>
-  <path d="M12.5 12.5H23V23H12.5V12.5z" fill="#FFB900"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 23 23"><path fill="#F25022" d="M0 0h10.5v10.5H0V0z"/><path fill="#7FBA00" d="M12.5 0H23v10.5H12.5V0z"/><path fill="#00A4EF" d="M0 12.5h10.5V23H0V12.5z"/><path fill="#FFB900" d="M12.5 12.5H23V23H12.5V12.5z"/></svg>
\ No newline at end of file
diff --git a/frontend/editor/src/core/assets/login/oidc.svg b/frontend/editor/src/core/assets/login/oidc.svg
index 440b54487c..6c697d709a 100644
--- a/frontend/editor/src/core/assets/login/oidc.svg
+++ b/frontend/editor/src/core/assets/login/oidc.svg
@@ -1,6 +1 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg version="1.1" xmlns="http://www.w3.org/2000/svg" width="660" height="600">
-<path d="M0 0 C0 57.09 0 114.18 0 173 C8.415 173.495 8.415 173.495 17 174 C22.13212507 174.61353778 27.20920013 175.27424487 32.3125 176.0625 C33.35173111 176.22247467 33.35173111 176.22247467 34.41195679 176.38568115 C87.28212498 184.61044341 143.75115649 199.67402182 188.89135742 229.19360352 C192.39340352 231.47487198 192.39340352 231.47487198 196.44140625 231.74584961 C199.00353686 230.99896898 200.92235962 230.0848876 203.1953125 228.69921875 C203.98349365 228.22299072 204.7716748 227.7467627 205.58374023 227.25610352 C206.42235596 226.73846436 207.26097168 226.2208252 208.125 225.6875 C209.44963257 224.88107056 209.44963257 224.88107056 210.80102539 224.05834961 C218.2788882 219.48880349 225.68697393 214.80908891 233.0859375 210.11328125 C238.56516867 206.63801776 244.05794024 203.18499956 249.5625 199.75 C250.47378662 199.17644775 251.38507324 198.60289551 252.32397461 198.01196289 C253.16710205 197.48723389 254.01022949 196.96250488 254.87890625 196.421875 C255.6272876 195.95362305 256.37566895 195.48537109 257.14672852 195.00292969 C259 194 259 194 261 194 C261 234.92 261 275.84 261 318 C195 318 129 318 61 318 C66.62046022 312.37953978 66.62046022 312.37953978 70.1953125 310.30859375 C70.98373535 309.84509521 71.7721582 309.38159668 72.58447266 308.90405273 C73.42284668 308.42009033 74.2612207 307.93612793 75.125 307.4375 C76.92821049 306.37691406 78.73026666 305.31436348 80.53125 304.25 C81.44390625 303.71117187 82.3565625 303.17234375 83.296875 302.6171875 C87.45315513 300.13062684 91.54077364 297.5401891 95.625 294.9375 C104.68061691 289.17639009 113.82499619 283.56858057 123 278 C95.41546967 253.17980426 47.87307254 244.92506981 12.4230957 238.65087891 C9.69549527 238.13224381 6.99469148 237.56557616 4.28605652 236.95932007 C3.48163211 236.77956823 2.6772077 236.5998164 1.84840679 236.41461754 C1.23843255 236.27779375 0.62845831 236.14096996 0 236 C0.00968287 236.95226887 0.00968287 236.95226887 0.01956135 237.92377549 C0.40016641 275.5678774 0.69175834 313.21169428 0.8681106 350.857327 C0.88937207 355.37957866 0.9113756 359.90182642 0.93383789 364.42407227 C0.94052681 365.77449264 0.94052681 365.77449264 0.94735085 367.15219422 C1.02128165 381.72092042 1.15529296 396.28850378 1.31159753 410.85655246 C1.47069632 425.80998832 1.56502392 440.76282661 1.59950441 455.7170741 C1.6228081 464.94203832 1.69633253 474.16377254 1.83457994 483.38774201 C1.92459849 489.71710549 1.95157012 496.04480499 1.92952342 502.3747618 C1.91865239 506.0258425 1.93502576 509.67129285 2.02649307 513.32136536 C2.53404806 534.611025 2.53404806 534.611025 -1.66046834 540.22067046 C-5.61382003 543.84486231 -9.99337264 546.11440877 -14.93325436 548.1178354 C-17.9472021 549.4043014 -20.51710879 551.11902775 -23.2421875 552.93359375 C-25.11898742 554.10285441 -26.99659067 555.27082661 -28.875 556.4375 C-30.94554208 557.72749617 -33.01585201 559.01786502 -35.0859375 560.30859375 C-36.08850586 560.93362793 -37.09107422 561.55866211 -38.12402344 562.20263672 C-42.25887824 564.78674547 -46.38050299 567.39150173 -50.5 570 C-55.66368756 573.26924126 -60.83510492 576.52543937 -66.01953125 579.76171875 C-67.57365723 580.73226196 -67.57365723 580.73226196 -69.15917969 581.72241211 C-71.24494276 583.02221909 -73.33280531 584.31866375 -75.42285156 585.61157227 C-79.75754504 588.30094736 -84.06005599 590.99141777 -88.21484375 593.953125 C-88.82610107 594.38020752 -89.4373584 594.80729004 -90.06713867 595.24731445 C-91.59690593 596.32922587 -93.10452179 597.4422887 -94.609375 598.55859375 C-104.17888449 602.62673776 -116.13257118 599.41829489 -126.125 597.9375 C-126.8782254 597.82773834 -127.63145081 597.71797668 -128.40750122 597.60488892 C-155.10921512 593.68788246 -181.21892048 588.0366224 -207 580 C-208.55702637 579.51877686 -208.55702637 579.51877686 -210.14550781 579.02783203 C-252.4892261 565.81471296 -293.49031089 546.13359294 -328 518 C-328.55075195 517.55221191 -329.10150391 517.10442383 -329.66894531 516.64306641 C-344.0262393 504.87499381 -357.05375247 492.02119149 -368 477 C-368.39912598 476.45633789 -368.79825195 475.91267578 -369.20947266 475.35253906 C-392.91190201 442.83128247 -403.85540073 404.17862698 -398.31640625 364.015625 C-397.49292051 359.26188702 -396.34256653 354.631548 -395 350 C-394.78569336 349.2373584 -394.57138672 348.4747168 -394.35058594 347.68896484 C-391.13292385 336.49740216 -386.62671929 326.17910618 -381 316 C-380.65066406 315.36465332 -380.30132812 314.72930664 -379.94140625 314.07470703 C-371.83738068 299.52530948 -361.49162018 286.98857593 -350 275 C-349.49742676 274.47019531 -348.99485352 273.94039063 -348.47705078 273.39453125 C-341.05202995 265.6016144 -333.26048878 258.6983199 -324.64941406 252.24365234 C-323.12444203 251.09382885 -321.619807 249.91716565 -320.1171875 248.73828125 C-266.81422583 207.38765499 -198.78193787 186.43202299 -133 176.25 C-132.31911316 176.1429071 -131.63822632 176.03581421 -130.93670654 175.92547607 C-129.93815643 175.76973114 -129.93815643 175.76973114 -128.91943359 175.61083984 C-128.34196381 175.52039398 -127.76449402 175.42994812 -127.16952515 175.33676147 C-120.94349948 174.44098127 -114.78189332 173.78966702 -108.50390625 173.43652344 C-107.77659302 173.39341034 -107.04927979 173.35029724 -106.29992676 173.30587769 C-104.53342535 173.20150671 -102.76673142 173.10040225 -101 173 C-101.02074034 172.17119166 -101.02074034 172.17119166 -101.04189968 171.32563972 C-101.37399305 157.84546534 -101.62081125 144.36601235 -101.77718258 130.88261604 C-101.85535887 124.36159622 -101.96130923 117.8435353 -102.1315918 111.32421875 C-102.29500975 105.02805601 -102.38434565 98.73473139 -102.42315865 92.43661118 C-102.45080164 90.03850484 -102.50479107 87.64054815 -102.58595085 85.24365616 C-103.18130054 66.92673567 -103.18130054 66.92673567 -99.52549744 62.02160263 C-95.51009029 58.30398314 -90.97637623 56.16816603 -86 54 C-84.54249937 53.09533774 -83.09809025 52.16707622 -81.6953125 51.1796875 C-80.5060068 50.4102228 -79.31590351 49.64198945 -78.125 48.875 C-77.4441333 48.43526855 -76.7632666 47.99553711 -76.06176758 47.54248047 C-68.5391438 42.69050798 -60.992142 37.87650432 -53.44970703 33.05541992 C-44.38499907 27.25678412 -35.3589696 21.4002907 -26.34326172 15.52587891 C-22.4194515 12.97078265 -18.49180794 10.42163155 -14.5625 7.875 C-13.87027344 7.42535889 -13.17804688 6.97571777 -12.46484375 6.51245117 C-2.41141154 0 -2.41141154 0 0 0 Z M-202 265 C-203.40740081 265.66438305 -204.8149486 266.32845483 -206.22265625 266.9921875 C-226.15067623 276.52952704 -243.53669409 289.35049348 -260 304 C-260.72832031 304.64195312 -261.45664062 305.28390625 -262.20703125 305.9453125 C-283.6307223 326.06103084 -297.78356798 354.67970444 -299.03125 384.125 C-298.92387323 397.4397192 -296.55043235 409.51957444 -292 422 C-291.64164062 423.02351562 -291.28328125 424.04703125 -290.9140625 425.1015625 C-285.07813826 440.45707947 -275.06824297 453.08794049 -264 465 C-263.22914063 465.84175781 -262.45828125 466.68351563 -261.6640625 467.55078125 C-255.39484224 474.11132215 -248.25461404 479.58481164 -241 485 C-239.99324219 485.75152344 -238.98648438 486.50304687 -237.94921875 487.27734375 C-198.06145792 515.88685314 -149.30111356 530.9623608 -101 537 C-101 437.67 -101 338.34 -101 236 C-134.31853884 236 -172.60102557 250.75734058 -202 265 Z " fill="#FE6200" transform="translate(399,0)"/>
-<path d="M0 0 C0 20.79 0 41.58 0 63 C-5.24841939 64.16631542 -10.39838479 65.29253106 -15.67578125 66.2265625 C-40.87427673 70.80660183 -65.31370876 77.09720394 -89 87 C-89.8343457 87.34643555 -90.66869141 87.69287109 -91.52832031 88.04980469 C-122.35826708 100.99530289 -153.08258507 120.19644793 -173.5 147.1875 C-174.34800171 148.30777588 -174.34800171 148.30777588 -175.21313477 149.45068359 C-192.44810623 172.52486636 -200.77216074 199.73105012 -196.79296875 228.50390625 C-195.64830139 235.59656473 -193.45505231 242.26655244 -191 249 C-190.64164062 250.02351562 -190.28328125 251.04703125 -189.9140625 252.1015625 C-184.07517346 267.46488046 -174.05844002 280.07060885 -163 292 C-162.30261719 292.76828125 -161.60523438 293.5365625 -160.88671875 294.328125 C-123.17922705 334.05421904 -64.42812654 352.62435588 -12.08764648 361.42504883 C-8.03764151 362.17920094 -4.02152172 363.10632851 0 364 C0 384.79 0 405.58 0 427 C-6.20846882 427 -11.44016669 426.97826822 -17.4375 426.15234375 C-18.44259865 426.01478668 -18.44259865 426.01478668 -19.46800232 425.87445068 C-21.64682203 425.57172093 -23.82347704 425.25630365 -26 424.9375 C-26.75822052 424.82773834 -27.51644104 424.71797668 -28.29763794 424.60488892 C-55.0409923 420.70221143 -81.18121046 415.04837758 -107 407 C-108.55702637 406.51877686 -108.55702637 406.51877686 -110.14550781 406.02783203 C-152.4892261 392.81471296 -193.49031089 373.13359294 -228 345 C-228.55075195 344.55221191 -229.10150391 344.10442383 -229.66894531 343.64306641 C-244.0262393 331.87499381 -257.05375247 319.02119149 -268 304 C-268.39912598 303.45633789 -268.79825195 302.91267578 -269.20947266 302.35253906 C-292.91190201 269.83128247 -303.85540073 231.17862698 -298.31640625 191.015625 C-297.49292051 186.26188702 -296.34256653 181.631548 -295 177 C-294.78569336 176.2373584 -294.57138672 175.4747168 -294.35058594 174.68896484 C-291.13292385 163.49740216 -286.62671929 153.17910618 -281 143 C-280.65066406 142.36465332 -280.30132812 141.72930664 -279.94140625 141.07470703 C-271.83738068 126.52530948 -261.49162018 113.98857593 -250 102 C-249.49742676 101.47019531 -248.99485352 100.94039063 -248.47705078 100.39453125 C-241.05202995 92.6016144 -233.26048878 85.6983199 -224.64941406 79.24365234 C-223.12444203 78.09382885 -221.619807 76.91716565 -220.1171875 75.73828125 C-161.40086551 30.18815403 -74.50051823 0 0 0 Z " fill="#CCCBCB" transform="translate(299,173)"/>
-<path d="M0 0 C10.97163436 0.64539026 21.50993823 1.39393751 32.3125 3.0625 C33.00532074 3.16914978 33.69814148 3.27579956 34.41195679 3.38568115 C87.28212498 11.61044341 143.75115649 26.67402182 188.89135742 56.19360352 C192.39340352 58.47487198 192.39340352 58.47487198 196.44140625 58.74584961 C199.00353686 57.99896898 200.92235962 57.0848876 203.1953125 55.69921875 C204.37758423 54.98487671 204.37758423 54.98487671 205.58374023 54.25610352 C206.42235596 53.73846436 207.26097168 53.2208252 208.125 52.6875 C209.44963257 51.88107056 209.44963257 51.88107056 210.80102539 51.05834961 C218.2788882 46.48880349 225.68697393 41.80908891 233.0859375 37.11328125 C238.56516867 33.63801776 244.05794024 30.18499956 249.5625 26.75 C250.47378662 26.17644775 251.38507324 25.60289551 252.32397461 25.01196289 C253.16710205 24.48723389 254.01022949 23.96250488 254.87890625 23.421875 C255.6272876 22.95362305 256.37566895 22.48537109 257.14672852 22.00292969 C259 21 259 21 261 21 C261 61.92 261 102.84 261 145 C195 145 129 145 61 145 C66.62046022 139.37953978 66.62046022 139.37953978 70.1953125 137.30859375 C71.37794678 136.61334595 71.37794678 136.61334595 72.58447266 135.90405273 C73.42284668 135.42009033 74.2612207 134.93612793 75.125 134.4375 C76.92821049 133.37691406 78.73026666 132.31436348 80.53125 131.25 C81.44390625 130.71117187 82.3565625 130.17234375 83.296875 129.6171875 C87.45315513 127.13062684 91.54077364 124.5401891 95.625 121.9375 C104.68061691 116.17639009 113.82499619 110.56858057 123 105 C95.41546967 80.17980426 47.87307254 71.92506981 12.4230957 65.65087891 C8.26336652 64.85993404 4.13342785 63.91853952 0 63 C0 42.21 0 21.42 0 0 Z " fill="#CCCCCC" transform="translate(399,173)"/>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="660" height="600" version="1.1"><path fill="#FE6200" d="M0 0 C0 57.09 0 114.18 0 173 C8.415 173.495 8.415 173.495 17 174 C22.13212507 174.61353778 27.20920013 175.27424487 32.3125 176.0625 C33.35173111 176.22247467 33.35173111 176.22247467 34.41195679 176.38568115 C87.28212498 184.61044341 143.75115649 199.67402182 188.89135742 229.19360352 C192.39340352 231.47487198 192.39340352 231.47487198 196.44140625 231.74584961 C199.00353686 230.99896898 200.92235962 230.0848876 203.1953125 228.69921875 C203.98349365 228.22299072 204.7716748 227.7467627 205.58374023 227.25610352 C206.42235596 226.73846436 207.26097168 226.2208252 208.125 225.6875 C209.44963257 224.88107056 209.44963257 224.88107056 210.80102539 224.05834961 C218.2788882 219.48880349 225.68697393 214.80908891 233.0859375 210.11328125 C238.56516867 206.63801776 244.05794024 203.18499956 249.5625 199.75 C250.47378662 199.17644775 251.38507324 198.60289551 252.32397461 198.01196289 C253.16710205 197.48723389 254.01022949 196.96250488 254.87890625 196.421875 C255.6272876 195.95362305 256.37566895 195.48537109 257.14672852 195.00292969 C259 194 259 194 261 194 C261 234.92 261 275.84 261 318 C195 318 129 318 61 318 C66.62046022 312.37953978 66.62046022 312.37953978 70.1953125 310.30859375 C70.98373535 309.84509521 71.7721582 309.38159668 72.58447266 308.90405273 C73.42284668 308.42009033 74.2612207 307.93612793 75.125 307.4375 C76.92821049 306.37691406 78.73026666 305.31436348 80.53125 304.25 C81.44390625 303.71117187 82.3565625 303.17234375 83.296875 302.6171875 C87.45315513 300.13062684 91.54077364 297.5401891 95.625 294.9375 C104.68061691 289.17639009 113.82499619 283.56858057 123 278 C95.41546967 253.17980426 47.87307254 244.92506981 12.4230957 238.65087891 C9.69549527 238.13224381 6.99469148 237.56557616 4.28605652 236.95932007 C3.48163211 236.77956823 2.6772077 236.5998164 1.84840679 236.41461754 C1.23843255 236.27779375 0.62845831 236.14096996 0 236 C0.00968287 236.95226887 0.00968287 236.95226887 0.01956135 237.92377549 C0.40016641 275.5678774 0.69175834 313.21169428 0.8681106 350.857327 C0.88937207 355.37957866 0.9113756 359.90182642 0.93383789 364.42407227 C0.94052681 365.77449264 0.94052681 365.77449264 0.94735085 367.15219422 C1.02128165 381.72092042 1.15529296 396.28850378 1.31159753 410.85655246 C1.47069632 425.80998832 1.56502392 440.76282661 1.59950441 455.7170741 C1.6228081 464.94203832 1.69633253 474.16377254 1.83457994 483.38774201 C1.92459849 489.71710549 1.95157012 496.04480499 1.92952342 502.3747618 C1.91865239 506.0258425 1.93502576 509.67129285 2.02649307 513.32136536 C2.53404806 534.611025 2.53404806 534.611025 -1.66046834 540.22067046 C-5.61382003 543.84486231 -9.99337264 546.11440877 -14.93325436 548.1178354 C-17.9472021 549.4043014 -20.51710879 551.11902775 -23.2421875 552.93359375 C-25.11898742 554.10285441 -26.99659067 555.27082661 -28.875 556.4375 C-30.94554208 557.72749617 -33.01585201 559.01786502 -35.0859375 560.30859375 C-36.08850586 560.93362793 -37.09107422 561.55866211 -38.12402344 562.20263672 C-42.25887824 564.78674547 -46.38050299 567.39150173 -50.5 570 C-55.66368756 573.26924126 -60.83510492 576.52543937 -66.01953125 579.76171875 C-67.57365723 580.73226196 -67.57365723 580.73226196 -69.15917969 581.72241211 C-71.24494276 583.02221909 -73.33280531 584.31866375 -75.42285156 585.61157227 C-79.75754504 588.30094736 -84.06005599 590.99141777 -88.21484375 593.953125 C-88.82610107 594.38020752 -89.4373584 594.80729004 -90.06713867 595.24731445 C-91.59690593 596.32922587 -93.10452179 597.4422887 -94.609375 598.55859375 C-104.17888449 602.62673776 -116.13257118 599.41829489 -126.125 597.9375 C-126.8782254 597.82773834 -127.63145081 597.71797668 -128.40750122 597.60488892 C-155.10921512 593.68788246 -181.21892048 588.0366224 -207 580 C-208.55702637 579.51877686 -208.55702637 579.51877686 -210.14550781 579.02783203 C-252.4892261 565.81471296 -293.49031089 546.13359294 -328 518 C-328.55075195 517.55221191 -329.10150391 517.10442383 -329.66894531 516.64306641 C-344.0262393 504.87499381 -357.05375247 492.02119149 -368 477 C-368.39912598 476.45633789 -368.79825195 475.91267578 -369.20947266 475.35253906 C-392.91190201 442.83128247 -403.85540073 404.17862698 -398.31640625 364.015625 C-397.49292051 359.26188702 -396.34256653 354.631548 -395 350 C-394.78569336 349.2373584 -394.57138672 348.4747168 -394.35058594 347.68896484 C-391.13292385 336.49740216 -386.62671929 326.17910618 -381 316 C-380.65066406 315.36465332 -380.30132812 314.72930664 -379.94140625 314.07470703 C-371.83738068 299.52530948 -361.49162018 286.98857593 -350 275 C-349.49742676 274.47019531 -348.99485352 273.94039063 -348.47705078 273.39453125 C-341.05202995 265.6016144 -333.26048878 258.6983199 -324.64941406 252.24365234 C-323.12444203 251.09382885 -321.619807 249.91716565 -320.1171875 248.73828125 C-266.81422583 207.38765499 -198.78193787 186.43202299 -133 176.25 C-132.31911316 176.1429071 -131.63822632 176.03581421 -130.93670654 175.92547607 C-129.93815643 175.76973114 -129.93815643 175.76973114 -128.91943359 175.61083984 C-128.34196381 175.52039398 -127.76449402 175.42994812 -127.16952515 175.33676147 C-120.94349948 174.44098127 -114.78189332 173.78966702 -108.50390625 173.43652344 C-107.77659302 173.39341034 -107.04927979 173.35029724 -106.29992676 173.30587769 C-104.53342535 173.20150671 -102.76673142 173.10040225 -101 173 C-101.02074034 172.17119166 -101.02074034 172.17119166 -101.04189968 171.32563972 C-101.37399305 157.84546534 -101.62081125 144.36601235 -101.77718258 130.88261604 C-101.85535887 124.36159622 -101.96130923 117.8435353 -102.1315918 111.32421875 C-102.29500975 105.02805601 -102.38434565 98.73473139 -102.42315865 92.43661118 C-102.45080164 90.03850484 -102.50479107 87.64054815 -102.58595085 85.24365616 C-103.18130054 66.92673567 -103.18130054 66.92673567 -99.52549744 62.02160263 C-95.51009029 58.30398314 -90.97637623 56.16816603 -86 54 C-84.54249937 53.09533774 -83.09809025 52.16707622 -81.6953125 51.1796875 C-80.5060068 50.4102228 -79.31590351 49.64198945 -78.125 48.875 C-77.4441333 48.43526855 -76.7632666 47.99553711 -76.06176758 47.54248047 C-68.5391438 42.69050798 -60.992142 37.87650432 -53.44970703 33.05541992 C-44.38499907 27.25678412 -35.3589696 21.4002907 -26.34326172 15.52587891 C-22.4194515 12.97078265 -18.49180794 10.42163155 -14.5625 7.875 C-13.87027344 7.42535889 -13.17804688 6.97571777 -12.46484375 6.51245117 C-2.41141154 0 -2.41141154 0 0 0 Z M-202 265 C-203.40740081 265.66438305 -204.8149486 266.32845483 -206.22265625 266.9921875 C-226.15067623 276.52952704 -243.53669409 289.35049348 -260 304 C-260.72832031 304.64195312 -261.45664062 305.28390625 -262.20703125 305.9453125 C-283.6307223 326.06103084 -297.78356798 354.67970444 -299.03125 384.125 C-298.92387323 397.4397192 -296.55043235 409.51957444 -292 422 C-291.64164062 423.02351562 -291.28328125 424.04703125 -290.9140625 425.1015625 C-285.07813826 440.45707947 -275.06824297 453.08794049 -264 465 C-263.22914063 465.84175781 -262.45828125 466.68351563 -261.6640625 467.55078125 C-255.39484224 474.11132215 -248.25461404 479.58481164 -241 485 C-239.99324219 485.75152344 -238.98648438 486.50304687 -237.94921875 487.27734375 C-198.06145792 515.88685314 -149.30111356 530.9623608 -101 537 C-101 437.67 -101 338.34 -101 236 C-134.31853884 236 -172.60102557 250.75734058 -202 265 Z" transform="translate(399,0)"/><path fill="#CCCBCB" d="M0 0 C0 20.79 0 41.58 0 63 C-5.24841939 64.16631542 -10.39838479 65.29253106 -15.67578125 66.2265625 C-40.87427673 70.80660183 -65.31370876 77.09720394 -89 87 C-89.8343457 87.34643555 -90.66869141 87.69287109 -91.52832031 88.04980469 C-122.35826708 100.99530289 -153.08258507 120.19644793 -173.5 147.1875 C-174.34800171 148.30777588 -174.34800171 148.30777588 -175.21313477 149.45068359 C-192.44810623 172.52486636 -200.77216074 199.73105012 -196.79296875 228.50390625 C-195.64830139 235.59656473 -193.45505231 242.26655244 -191 249 C-190.64164062 250.02351562 -190.28328125 251.04703125 -189.9140625 252.1015625 C-184.07517346 267.46488046 -174.05844002 280.07060885 -163 292 C-162.30261719 292.76828125 -161.60523438 293.5365625 -160.88671875 294.328125 C-123.17922705 334.05421904 -64.42812654 352.62435588 -12.08764648 361.42504883 C-8.03764151 362.17920094 -4.02152172 363.10632851 0 364 C0 384.79 0 405.58 0 427 C-6.20846882 427 -11.44016669 426.97826822 -17.4375 426.15234375 C-18.44259865 426.01478668 -18.44259865 426.01478668 -19.46800232 425.87445068 C-21.64682203 425.57172093 -23.82347704 425.25630365 -26 424.9375 C-26.75822052 424.82773834 -27.51644104 424.71797668 -28.29763794 424.60488892 C-55.0409923 420.70221143 -81.18121046 415.04837758 -107 407 C-108.55702637 406.51877686 -108.55702637 406.51877686 -110.14550781 406.02783203 C-152.4892261 392.81471296 -193.49031089 373.13359294 -228 345 C-228.55075195 344.55221191 -229.10150391 344.10442383 -229.66894531 343.64306641 C-244.0262393 331.87499381 -257.05375247 319.02119149 -268 304 C-268.39912598 303.45633789 -268.79825195 302.91267578 -269.20947266 302.35253906 C-292.91190201 269.83128247 -303.85540073 231.17862698 -298.31640625 191.015625 C-297.49292051 186.26188702 -296.34256653 181.631548 -295 177 C-294.78569336 176.2373584 -294.57138672 175.4747168 -294.35058594 174.68896484 C-291.13292385 163.49740216 -286.62671929 153.17910618 -281 143 C-280.65066406 142.36465332 -280.30132812 141.72930664 -279.94140625 141.07470703 C-271.83738068 126.52530948 -261.49162018 113.98857593 -250 102 C-249.49742676 101.47019531 -248.99485352 100.94039063 -248.47705078 100.39453125 C-241.05202995 92.6016144 -233.26048878 85.6983199 -224.64941406 79.24365234 C-223.12444203 78.09382885 -221.619807 76.91716565 -220.1171875 75.73828125 C-161.40086551 30.18815403 -74.50051823 0 0 0 Z" transform="translate(299,173)"/><path fill="#CCC" d="M0 0 C10.97163436 0.64539026 21.50993823 1.39393751 32.3125 3.0625 C33.00532074 3.16914978 33.69814148 3.27579956 34.41195679 3.38568115 C87.28212498 11.61044341 143.75115649 26.67402182 188.89135742 56.19360352 C192.39340352 58.47487198 192.39340352 58.47487198 196.44140625 58.74584961 C199.00353686 57.99896898 200.92235962 57.0848876 203.1953125 55.69921875 C204.37758423 54.98487671 204.37758423 54.98487671 205.58374023 54.25610352 C206.42235596 53.73846436 207.26097168 53.2208252 208.125 52.6875 C209.44963257 51.88107056 209.44963257 51.88107056 210.80102539 51.05834961 C218.2788882 46.48880349 225.68697393 41.80908891 233.0859375 37.11328125 C238.56516867 33.63801776 244.05794024 30.18499956 249.5625 26.75 C250.47378662 26.17644775 251.38507324 25.60289551 252.32397461 25.01196289 C253.16710205 24.48723389 254.01022949 23.96250488 254.87890625 23.421875 C255.6272876 22.95362305 256.37566895 22.48537109 257.14672852 22.00292969 C259 21 259 21 261 21 C261 61.92 261 102.84 261 145 C195 145 129 145 61 145 C66.62046022 139.37953978 66.62046022 139.37953978 70.1953125 137.30859375 C71.37794678 136.61334595 71.37794678 136.61334595 72.58447266 135.90405273 C73.42284668 135.42009033 74.2612207 134.93612793 75.125 134.4375 C76.92821049 133.37691406 78.73026666 132.31436348 80.53125 131.25 C81.44390625 130.71117187 82.3565625 130.17234375 83.296875 129.6171875 C87.45315513 127.13062684 91.54077364 124.5401891 95.625 121.9375 C104.68061691 116.17639009 113.82499619 110.56858057 123 105 C95.41546967 80.17980426 47.87307254 71.92506981 12.4230957 65.65087891 C8.26336652 64.85993404 4.13342785 63.91853952 0 63 C0 42.21 0 21.42 0 0 Z" transform="translate(399,173)"/></svg>
\ No newline at end of file
diff --git a/frontend/editor/src/core/auth/UseSession.tsx b/frontend/editor/src/core/auth/UseSession.tsx
index ee3314606c..207c4da786 100644
--- a/frontend/editor/src/core/auth/UseSession.tsx
+++ b/frontend/editor/src/core/auth/UseSession.tsx
@@ -26,6 +26,14 @@ export interface AuthContextType {
   error: Error | null;
   signOut: () => Promise<void>;
   refreshSession: () => Promise<void>;
+  /**
+   * Session-level permission flags, provided by layers whose auth knows them
+   * (proprietary's Spring session carries both). Absent in core OSS, which
+   * has no auth context — consumers must treat undefined as "not granted"
+   * and fall back to app-config gates.
+   */
+  isAdmin?: boolean;
+  portalAccess?: boolean;
 }
 
 /**
diff --git a/frontend/editor/src/core/components/AppLayout.stories.tsx b/frontend/editor/src/core/components/AppLayout.stories.tsx
index 4d7e6780cf..69aceef9d7 100644
--- a/frontend/editor/src/core/components/AppLayout.stories.tsx
+++ b/frontend/editor/src/core/components/AppLayout.stories.tsx
@@ -4,7 +4,7 @@ import { AppLayout } from "@app/components/AppLayout";
 import { BannerProvider, useBanner } from "@app/contexts/BannerContext";
 import { NavigationProvider } from "@app/contexts/NavigationContext";
 import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
-import { InfoBanner } from "@app/components/shared/InfoBanner";
+import { AppBanner } from "@app/components/shared/AppBanner";
 
 const meta = {
   title: "Components/AppLayout",
@@ -49,7 +49,7 @@ function BannerSetter() {
   const { setBanner } = useBanner();
   useEffect(() => {
     setBanner(
-      <InfoBanner
+      <AppBanner
         icon="info-rounded"
         title="Heads up"
         message="This workspace is running in offline mode."
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx
index 1a55c53a90..22c969e704 100644
--- a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx
+++ b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.tsx
@@ -300,6 +300,10 @@ const FileEditorThumbnail = ({
   const [showVersionHistory, setShowVersionHistory] = useState(false);
 
   const policyEnforcing = policies.some((p) => p.enforcing);
+  // The overlay swallows clicks, so a run that never settles would leave the card
+  // unusable with no way out. Dismissible, like the viewer's; resets per run.
+  const [enforcingDismissed, setEnforcingDismissed] = useState(false);
+  if (!policyEnforcing && enforcingDismissed) setEnforcingDismissed(false);
   // The policy currently enforcing, so the overlay's icon/spinner match that
   // policy's badge instead of a fixed blue.
   const enforcingPolicy = policies.find((p) => p.enforcing);
@@ -548,8 +552,9 @@ const FileEditorThumbnail = ({
 
               {/* Policy enforcement overlay — shown while any policy is in-flight */}
               <PolicyEnforcingOverlay
-                enforcing={policyEnforcing}
+                enforcing={policyEnforcing && !enforcingDismissed}
                 zIndex={2}
+                onDismiss={() => setEnforcingDismissed(true)}
                 accentVar={enforcingPolicy?.accentColor}
                 categoryId={enforcingPolicy?.id}
               />
diff --git a/frontend/editor/src/core/components/filesPage/FileGrid.tsx b/frontend/editor/src/core/components/filesPage/FileGrid.tsx
index 7bed49bd0b..e54964c592 100644
--- a/frontend/editor/src/core/components/filesPage/FileGrid.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileGrid.tsx
@@ -16,6 +16,7 @@ import DriveFileRenameOutlineIcon from "@mui/icons-material/DriveFileRenameOutli
 import CloudUploadIcon from "@mui/icons-material/CloudUpload";
 import UploadFileIcon from "@mui/icons-material/UploadFile";
 import CreateNewFolderIcon from "@mui/icons-material/CreateNewFolder";
+import SearchIcon from "@mui/icons-material/Search";
 
 import { FileId } from "@app/types/file";
 import { FolderId, FolderRecord, ROOT_FOLDER_ID } from "@app/types/folder";
@@ -89,6 +90,8 @@ interface FileGridProps {
   onChangeSortMode?: (mode: FilesPageSortMode) => void;
   /** Drives the empty-state copy. */
   currentTab?: "all" | "local" | "cloud" | "recent" | "shared" | "sharedByMe";
+  /** A filter is applied; an empty result then means "no matches", not "no files". */
+  searchActive?: boolean;
   /** Cloud reachability; switches the cloud empty-state copy. */
   serverReachable?: boolean;
   /** Empty-state CTA handlers; if absent the matching button hides. */
@@ -104,6 +107,7 @@ export function FileGrid(props: FileGridProps & { loading?: boolean }) {
     entries,
     loading,
     currentTab,
+    searchActive,
     serverReachable,
     onEmptyUpload,
     onEmptyCreateFolder,
@@ -115,15 +119,28 @@ export function FileGrid(props: FileGridProps & { loading?: boolean }) {
   }
 
   if (entries.length === 0) {
-    return (
+    const emptyState = (
       <EmptyState
         tab={currentTab}
+        searchActive={searchActive}
         serverReachable={serverReachable}
         onUpload={onEmptyUpload}
         onCreateFolder={onEmptyCreateFolder}
         newFolderDisabledReason={newFolderDisabledReason}
       />
     );
+    // When a filter empties the list view, keep the column headers in place and
+    // show the no-results message beneath them, rather than replacing the whole
+    // table. Grid view (cards, no headers) just shows the empty state.
+    if (viewMode === "list" && searchActive) {
+      return (
+        <>
+          <ListView {...props} />
+          {emptyState}
+        </>
+      );
+    }
+    return emptyState;
   }
 
   if (viewMode === "list") {
@@ -187,6 +204,8 @@ function SkeletonGrid({ viewMode }: { viewMode: FilesPageViewMode }) {
 interface EmptyStateProps {
   /** Drives copy + iconography. */
   tab?: "all" | "local" | "cloud" | "recent" | "shared" | "sharedByMe";
+  /** When true the empty list is the result of a filter, not a bare folder. */
+  searchActive?: boolean;
   /** Switches the cloud empty-state copy. */
   serverReachable?: boolean;
   /** CTA handlers; absent => button hidden. */
@@ -198,12 +217,35 @@ interface EmptyStateProps {
 
 function EmptyState({
   tab = "all",
+  searchActive = false,
   serverReachable = true,
   onUpload,
   onCreateFolder,
   newFolderDisabledReason,
 }: EmptyStateProps) {
   const { t } = useTranslation();
+
+  // A filter with no matches isn't an empty folder - say so, and skip the
+  // upload / new-folder CTAs since clearing the filter is the way out.
+  if (searchActive) {
+    return (
+      <div className="files-page-empty">
+        <span className="files-page-empty-icon">
+          <SearchIcon style={{ fontSize: "2.5rem" }} />
+        </span>
+        <div className="files-page-empty-title">
+          {t("filesPage.empty.noResults.title", "No matching files")}
+        </div>
+        <div className="files-page-empty-hint">
+          {t(
+            "filesPage.empty.noResults.hint",
+            "No files in this folder match your filter. Try a different term or clear the filter.",
+          )}
+        </div>
+      </div>
+    );
+  }
+
   const { titleKey, titleFallback, hintKey, hintFallback } = (() => {
     switch (tab) {
       case "local":
diff --git a/frontend/editor/src/core/components/filesPage/FileManagerView.tsx b/frontend/editor/src/core/components/filesPage/FileManagerView.tsx
index 3ed5096efb..a0b0c6cfa1 100644
--- a/frontend/editor/src/core/components/filesPage/FileManagerView.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileManagerView.tsx
@@ -7,11 +7,19 @@ import React, {
 } from "react";
 import { useTranslation } from "react-i18next";
 import { useLocation, useNavigate } from "react-router-dom";
-import { Drawer, Group, MultiSelect, Select, Tooltip } from "@mantine/core";
+import {
+  Drawer,
+  Group,
+  MultiSelect,
+  Select,
+  TextInput,
+  Tooltip,
+} from "@mantine/core";
 import { Button } from "@app/ui/Button";
 import { ActionIcon } from "@app/ui/ActionIcon";
 import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useMediaQuery } from "@mantine/hooks";
+import CloseIcon from "@mui/icons-material/Close";
 import SearchIcon from "@mui/icons-material/Search";
 import UploadFileIcon from "@mui/icons-material/UploadFile";
 import QrCode2Icon from "@mui/icons-material/QrCode2";
@@ -51,6 +59,8 @@ import { StirlingFileStub } from "@app/types/fileContext";
 import { FolderId, ROOT_FOLDER_ID } from "@app/types/folder";
 
 import { FileGrid, FilesPageEntry } from "@app/components/filesPage/FileGrid";
+import SuperSearch from "@app/components/shared/superSearch/SuperSearch";
+import { useEditorSearchScopes } from "@app/hooks/useSuperSearch";
 import { FileDetailsPanel } from "@app/components/filesPage/FileDetailsPanel";
 import BulkUploadToServerModal from "@app/components/shared/BulkUploadToServerModal";
 import MobileUploadModal from "@app/components/shared/MobileUploadModal";
@@ -74,6 +84,7 @@ export default function FileManagerView() {
   const { t } = useTranslation();
   const navigate = useNavigate();
   const location = useLocation();
+  const searchScopes = useEditorSearchScopes();
 
   // Hide Shared tab when storageSharingEnabled is false.
   const { sharingEnabled } = useSharingEnabled();
@@ -686,12 +697,11 @@ export default function FileManagerView() {
   }, [navigate]);
 
   // ─── keyboard shortcuts ─────────────────────────────────────────────────
-  const searchInputRef = useRef<HTMLInputElement | null>(null);
-  // External focus trigger (used by the FileSidebar rail Search button).
-  useEffect(() => {
-    const onFocus = () => searchInputRef.current?.focus();
-    window.addEventListener("files-page:focus-search", onFocus);
-    return () => window.removeEventListener("files-page:focus-search", onFocus);
+  // Focus the super-search input (stable id), used by the "/" shortcut.
+  const focusSearch = useCallback(() => {
+    (
+      document.getElementById("super-search-input") as HTMLInputElement | null
+    )?.focus();
   }, []);
   useEffect(() => {
     const onKey = (e: KeyboardEvent) => {
@@ -735,13 +745,19 @@ export default function FileManagerView() {
       // "/" focuses the search field.
       if (e.key === "/" && !inInput) {
         e.preventDefault();
-        searchInputRef.current?.focus();
+        focusSearch();
         return;
       }
     };
     window.addEventListener("keydown", onKey);
     return () => window.removeEventListener("keydown", onKey);
-  }, [visibleFiles, selectedFileIds, removeFiles, setSelectedFileIds]);
+  }, [
+    visibleFiles,
+    selectedFileIds,
+    removeFiles,
+    setSelectedFileIds,
+    focusSearch,
+  ]);
 
   useEffect(() => {
     const onKey = (e: KeyboardEvent) => {
@@ -890,11 +906,9 @@ export default function FileManagerView() {
           };
           return (
             <>
-              <SearchField
-                ref={searchInputRef}
-                value={search}
-                onChange={setSearch}
-              />
+              <div className="files-page-header-search">
+                <SuperSearch scopes={searchScopes} />
+              </div>
               <div className="files-page-header-actions">
                 <Tooltip
                   label={
@@ -1343,6 +1357,27 @@ export default function FileManagerView() {
                   aria-label={t("filesPage.typeFilter.label", "Filter by type")}
                 />
               )}
+              <TextInput
+                size="xs"
+                value={search}
+                onChange={(e) => setSearch(e.currentTarget.value)}
+                placeholder={t("filesPage.search.placeholder", "Filter files…")}
+                leftSection={<SearchIcon sx={{ fontSize: "1rem" }} />}
+                rightSection={
+                  search ? (
+                    <ActionIcon
+                      variant="tertiary"
+                      size="sm"
+                      onClick={() => setSearch("")}
+                      aria-label={t("filesPage.search.clear", "Clear filter")}
+                    >
+                      <CloseIcon sx={{ fontSize: "0.9rem" }} />
+                    </ActionIcon>
+                  ) : null
+                }
+                aria-label={t("filesPage.search.label", "Filter files by name")}
+                style={{ width: 180 }}
+              />
               <Select
                 size="xs"
                 value={sortMode}
@@ -1434,6 +1469,7 @@ export default function FileManagerView() {
               entries={entries}
               loading={loading}
               currentTab={currentTab}
+              searchActive={search.trim().length > 0}
               serverReachable={folders.serverReachable}
               selectedFileIds={selectedFileIds}
               activeWorkspaceFileIds={activeWorkspaceFileIdSet}
@@ -1656,39 +1692,6 @@ export default function FileManagerView() {
   );
 }
 
-const SearchField = React.forwardRef<
-  HTMLInputElement,
-  { value: string; onChange: (v: string) => void }
->(function SearchField({ value, onChange }, ref) {
-  const { t } = useTranslation();
-  return (
-    <div className="files-page-search">
-      <SearchIcon fontSize="small" style={{ color: "var(--c-text-subtle)" }} />
-      <input
-        ref={ref}
-        type="text"
-        value={value}
-        onChange={(e) => onChange(e.currentTarget.value)}
-        placeholder={t(
-          "filesPage.searchPlaceholder",
-          "Search this folder & subfolders",
-        )}
-        aria-label={t("filesPage.search", "Search")}
-      />
-      {value && (
-        <ActionIcon
-          variant="tertiary"
-          size="sm"
-          onClick={() => onChange("")}
-          aria-label={t("filesPage.clearSearch", "Clear search")}
-        >
-          &times;
-        </ActionIcon>
-      )}
-    </div>
-  );
-});
-
 function Breadcrumbs() {
   const { t } = useTranslation();
   const folders = useFolders();
diff --git a/frontend/editor/src/core/components/filesPage/FilesPage.css b/frontend/editor/src/core/components/filesPage/FilesPage.css
index 368bae2521..aa9d8248aa 100644
--- a/frontend/editor/src/core/components/filesPage/FilesPage.css
+++ b/frontend/editor/src/core/components/filesPage/FilesPage.css
@@ -34,6 +34,33 @@
   gap: 0.5rem;
 }
 
+.files-page-header-search {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  min-width: 0;
+}
+
+.files-page-header-search .super-search {
+  flex: 0 1 24rem;
+  width: min(100%, 24rem);
+  max-width: 24rem;
+}
+
+.files-page-header-search .super-search input {
+  background-color: transparent;
+  padding-top: 4px;
+  padding-bottom: 4px;
+  font-size: 12.5px;
+}
+
+[data-mantine-color-scheme="dark"]
+  .files-page-header-search
+  .super-search
+  input {
+  background-color: transparent;
+}
+
 .files-page-breadcrumbs {
   display: flex;
   align-items: center;
@@ -79,28 +106,6 @@
   flex-shrink: 0;
 }
 
-.files-page-search {
-  display: flex;
-  align-items: center;
-  gap: 0.35rem;
-  background: var(--c-surface);
-  border: 1px solid var(--c-border-subtle);
-  border-radius: 999px;
-  padding: 0.2rem 0.75rem;
-  /* Fills its grid cell; the cell's minmax(...) clamps to a sensible range. */
-  width: 100%;
-  min-width: 0;
-}
-
-.files-page-search input {
-  background: transparent;
-  border: none;
-  outline: none;
-  flex: 1;
-  color: var(--c-text);
-  font-size: 0.9rem;
-}
-
 .files-page-body {
   display: flex;
   flex: 1 1 auto;
@@ -1376,23 +1381,6 @@
     overflow-x: auto;
     min-width: 0;
   }
-  .files-page-search {
-    /* Shrink hard so the search bar doesn't eat the whole action row.
-       Users still see the icon + a few chars of the placeholder.
-       `overflow: hidden` clips the input's natural intrinsic width so
-       placeholder text never leaks outside the rounded pill. */
-    min-width: 0;
-    flex: 0 1 5.5rem;
-    max-width: 6.5rem;
-    overflow: hidden;
-  }
-  .files-page-search input {
-    /* `min-width: 0` lets flex actually shrink the input below its
-       default ~20-char intrinsic size - without this, the placeholder
-       extends beyond the parent's clip box and bleeds onto neighbours. */
-    min-width: 0;
-    text-overflow: ellipsis;
-  }
   /* Upload becomes an icon-only square button on mobile so the action
      row stops getting clipped. Scoped to `.files-page-header-actions`
      so the Back button at the header level keeps its visible "Back"
diff --git a/frontend/editor/src/core/components/filesPage/VersionTimeline.tsx b/frontend/editor/src/core/components/filesPage/VersionTimeline.tsx
index 049fc2365a..05c96685b2 100644
--- a/frontend/editor/src/core/components/filesPage/VersionTimeline.tsx
+++ b/frontend/editor/src/core/components/filesPage/VersionTimeline.tsx
@@ -219,7 +219,20 @@ export function VersionTimeline({
                     align="center"
                     style={{ flex: 1, minWidth: 0, flexWrap: "nowrap" }}
                   >
-                    <Badge size="xs" variant={isActive ? "filled" : "light"}>
+                    <Badge
+                      size="xs"
+                      variant={isActive ? "filled" : "light"}
+                      styles={
+                        isActive
+                          ? {
+                              root: {
+                                backgroundColor: "var(--c-accent-solid)",
+                              },
+                              label: { color: "var(--c-text-on-primary)" },
+                            }
+                          : undefined
+                      }
+                    >
                       v{v.versionNumber ?? 1}
                     </Badge>
                     <Text
diff --git a/frontend/editor/src/core/components/layout/Workbench.module.css b/frontend/editor/src/core/components/layout/Workbench.module.css
index 51138d2ac3..fb73be8655 100644
--- a/frontend/editor/src/core/components/layout/Workbench.module.css
+++ b/frontend/editor/src/core/components/layout/Workbench.module.css
@@ -1,19 +1,48 @@
-/* WorkbenchBar slide-in/out animation using CSS grid trick */
+/* Positioning context for the viewer toolbar's reopen tab, which hangs below
+   the bar and so must sit outside the overflow-clipped wrapper below. */
+.workbenchBarShell {
+  position: relative;
+  flex-shrink: 0;
+  z-index: 51;
+}
+
+/* Little pull-tab shown while the viewer tool row is retracted. Anchored to the
+   bar's bottom-right edge (where the retract handle sat). Small by design - it
+   just brings the row back. */
+.workbenchBarReopenTab {
+  position: absolute;
+  top: 100%;
+  /* Right-align with the retract handle inside the bar: the bar's right
+     margin (--nav-gutter) + 1px border + 8px bar padding + the handle's own
+     6px inset. */
+  right: calc(var(--nav-gutter) + 15px);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 2.25rem;
+  height: 0.875rem;
+  border: 1px solid var(--c-border-subtle);
+  border-top: none;
+  border-radius: 0 0 7px 7px;
+  background: var(--c-bg-raised);
+  color: var(--c-text-subtle);
+  cursor: pointer;
+  z-index: 52;
+  transition:
+    color 0.15s ease,
+    background-color 0.15s ease;
+}
+
+.workbenchBarReopenTab:hover {
+  color: var(--c-text);
+  background: var(--c-hover);
+}
+
 .workbenchBarWrapper {
   display: grid;
   grid-template-rows: 1fr;
-  transition: grid-template-rows 280ms ease;
 }
 
-.workbenchBarWrapper[data-hidden="true"] {
-  grid-template-rows: 0fr;
-}
-
-.workbenchBarWrapper[data-no-transition="true"] {
-  transition: none;
-}
-
-/* Direct child must have min-height: 0 so the row can collapse below content size */
 .workbenchBarInner {
   min-height: 0;
   overflow: hidden;
diff --git a/frontend/editor/src/core/components/layout/Workbench.tsx b/frontend/editor/src/core/components/layout/Workbench.tsx
index 96eb6b8d6f..7dbc6f75be 100644
--- a/frontend/editor/src/core/components/layout/Workbench.tsx
+++ b/frontend/editor/src/core/components/layout/Workbench.tsx
@@ -1,5 +1,8 @@
-import { useEffect, useState, Suspense, lazy } from "react";
-import { Box, Loader, Center } from "@mantine/core";
+import { useState, Suspense, lazy } from "react";
+import { useTranslation } from "react-i18next";
+import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
+import { Box, Loader, Center, Stack, Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
 import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
 import { useFileHandler } from "@app/hooks/useFileHandler";
 import { useAllFiles } from "@app/contexts/FileContext";
@@ -41,7 +44,7 @@ export default function Workbench() {
   useCookieConsent({ analyticsEnabled: config?.enableAnalytics === true });
 
   // Use context-based hooks to eliminate all prop drilling
-  const { files: activeFiles } = useAllFiles();
+  const { files: activeFiles, fileIds } = useAllFiles();
   const { workbench: currentView } = useNavigationState();
   const { actions: navActions } = useNavigationActions();
   const setCurrentView = navActions.setWorkbench;
@@ -66,18 +69,13 @@ export default function Workbench() {
   const selectedTool = selectedToolId ? toolRegistry[selectedToolId] : null;
   const { addFiles } = useFileHandler();
   const hasFiles = activeFiles.length > 0;
-  // Custom workbench views (e.g. Watched Folders) manage their own content and may
-  // have no workbench files, but still need the bar's view switcher so users can
-  // navigate back out.
-  const isCustomViewActive = !isBaseWorkbench(currentView);
+  const { t } = useTranslation();
 
-  // Enable bar transitions after first paint so the initial hidden state shows
-  // without animating (landing page on load shouldn't animate the bar up).
-  const [barTransitionEnabled, setBarTransitionEnabled] = useState(false);
-  useEffect(() => {
-    const raf = requestAnimationFrame(() => setBarTransitionEnabled(true));
-    return () => cancelAnimationFrame(raf);
-  }, []);
+  // The viewer's tool row can be retracted to give the document more height.
+  // State lives here (not in WorkbenchBar) so the reopen tab can hang below the
+  // bar, outside the bar's overflow-clipped wrapper. Scoped to the viewer.
+  const [viewerToolbarCollapsed, setViewerToolbarCollapsed] = useState(false);
+  const showReopenTab = currentView === "viewer" && viewerToolbarCollapsed;
 
   const handlePreviewClose = () => {
     setPreviewFile(null);
@@ -136,6 +134,20 @@ export default function Workbench() {
     }
 
     if (activeFiles.length === 0) {
+      // Files are open but their bytes are still loading (a cold PDF engine can
+      // take seconds). Showing the drop zone here reads as "the click did nothing".
+      if (fileIds.length > 0) {
+        return (
+          <Center h="100%" w="100%">
+            <Stack align="center" gap="md">
+              <Loader size="lg" />
+              <Text c="dimmed" size="sm">
+                {t("fileManager.loadingFiles", "Loading files...")}
+              </Text>
+            </Stack>
+          </Center>
+        );
+      }
       return <LandingPage />;
     }
 
@@ -219,22 +231,39 @@ export default function Workbench() {
       data-tour="workbench"
       style={{ backgroundColor: "var(--c-bg)", minWidth: 0 }}
     >
-      {/* Workbench Bar - animates in/out based on file presence */}
+      {/* Workbench Bar — always visible outside My Files (it hosts the
+          global search), even with no files loaded. */}
       {currentView !== "myFiles" &&
         !customWorkbenchViews.find((v) => v.workbenchId === currentView)
           ?.hideTopControls && (
-          <div
-            className={styles.workbenchBarWrapper}
-            data-hidden={String(!hasFiles && !isCustomViewActive)}
-            data-no-transition={String(!barTransitionEnabled)}
-          >
-            <div className={styles.workbenchBarInner}>
-              <WorkbenchBar
-                currentView={currentView}
-                setCurrentView={setCurrentView}
-                hasFiles={hasFiles}
-              />
+          <div className={styles.workbenchBarShell}>
+            <div className={styles.workbenchBarWrapper}>
+              <div className={styles.workbenchBarInner}>
+                <WorkbenchBar
+                  currentView={currentView}
+                  setCurrentView={setCurrentView}
+                  hasFiles={hasFiles}
+                  viewerToolbarCollapsed={viewerToolbarCollapsed}
+                  onCollapseViewerToolbar={setViewerToolbarCollapsed}
+                />
+              </div>
             </div>
+            {/* Reopen tab: a little handle hanging off the bar's bottom-right
+                while the viewer tool row is retracted. */}
+            {showReopenTab && (
+              <Button
+                type="button"
+                variant="quiet"
+                className={styles.workbenchBarReopenTab}
+                onClick={() => setViewerToolbarCollapsed(false)}
+                aria-expanded={false}
+                aria-label={t("workbenchBar.showToolbar", "Show toolbar")}
+                title={t("workbenchBar.showToolbar", "Show toolbar")}
+                leftSection={
+                  <KeyboardArrowDownIcon sx={{ fontSize: "1rem" }} />
+                }
+              />
+            )}
           </div>
         )}
 
diff --git a/frontend/editor/src/core/components/shared/AppBanner.css b/frontend/editor/src/core/components/shared/AppBanner.css
new file mode 100644
index 0000000000..b3f3f9343a
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/AppBanner.css
@@ -0,0 +1,115 @@
+/* App-wide top bar. One shape, four tones — callers pick a tone, never a colour.
+   Named `app-banner`, not `sui-banner`: that belongs to the SUI Banner primitive. */
+.app-banner {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  min-height: 3.5rem;
+  padding: 0.75rem 1rem;
+  /* Full-bleed across the top of the app: square corners, one rule underneath. */
+  border-bottom: 1px solid var(--app-banner-border);
+  background: var(--app-banner-bg);
+  color: var(--c-text);
+}
+
+.app-banner--compact {
+  min-height: 2.75rem;
+  padding: 0.5rem 1rem;
+  gap: 0.5rem;
+}
+
+.app-banner--info {
+  --app-banner-bg: var(--c-primary-subtle);
+  --app-banner-border: var(--c-primary-border);
+  --app-banner-icon: var(--c-accent-fg, var(--c-primary));
+}
+
+/* The one bar meant to pop, so it takes the feature gradient rather than a tint.
+   Fixed hues by design — it doesn't follow the chosen accent. */
+.app-banner--promo {
+  --app-banner-bg: linear-gradient(
+    135deg,
+    var(--c-hue-indigo) 0%,
+    var(--c-hue-purple) 100%
+  );
+  --app-banner-border: transparent;
+  --app-banner-icon: var(--color-text-on-accent);
+  color: var(--color-text-on-accent);
+}
+
+.app-banner--warning {
+  --app-banner-bg: var(--c-warning-subtle);
+  --app-banner-border: color-mix(in srgb, var(--c-warning) 32%, transparent);
+  --app-banner-icon: var(--c-warning);
+}
+
+.app-banner--danger {
+  --app-banner-bg: var(--c-danger-subtle);
+  --app-banner-border: color-mix(in srgb, var(--c-danger) 32%, transparent);
+  --app-banner-icon: var(--c-danger);
+}
+
+/* Only the icon carries the tone; text stays neutral in every tone. */
+.app-banner__icon {
+  display: flex;
+  flex-shrink: 0;
+  align-items: center;
+  color: var(--app-banner-icon);
+}
+
+.app-banner__body {
+  display: flex;
+  flex: 1;
+  min-width: 0;
+  flex-direction: column;
+  gap: 0.125rem;
+}
+
+.app-banner__title {
+  font-size: 0.875rem;
+  font-weight: 600;
+}
+
+.app-banner__message {
+  font-size: 0.8125rem;
+  line-height: 1.4;
+  color: var(--c-text-muted);
+}
+
+.app-banner__body:not(:has(.app-banner__title)) .app-banner__message {
+  color: inherit;
+  font-weight: 500;
+}
+
+.app-banner--compact .app-banner__title,
+.app-banner--compact .app-banner__message {
+  font-size: 0.75rem;
+}
+
+/* On the gradient everything is white; muted grey would disappear. */
+.app-banner--promo .app-banner__message,
+.app-banner--promo .app-banner__actions .sui-btn--tertiary,
+.app-banner--promo .app-banner__actions .sui-ai {
+  color: var(--color-text-on-accent);
+}
+
+/* Lifts the premium CTA off the gradient it sits on. */
+.app-banner--promo .app-banner__actions .sui-btn--primary {
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.25);
+}
+
+.app-banner__actions {
+  display: flex;
+  flex-shrink: 0;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+/* Mantine trims the leading padding when a button has a left section, which reads
+   as off-centre next to the label. Even it back up. */
+.app-banner__actions .sui-btn .mantine-Button-inner {
+  padding-inline: 0;
+}
+.app-banner__actions .sui-btn {
+  padding-inline: 0.875rem;
+}
diff --git a/frontend/editor/src/core/components/shared/AppBanner.stories.tsx b/frontend/editor/src/core/components/shared/AppBanner.stories.tsx
new file mode 100644
index 0000000000..db741a4bf8
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/AppBanner.stories.tsx
@@ -0,0 +1,194 @@
+import type { ReactNode } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AppBanner } from "@app/components/shared/AppBanner";
+
+const meta = {
+  title: "Shared/AppBanner",
+  component: AppBanner,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof AppBanner>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Info: Story = {
+  args: {
+    icon: "info-rounded",
+    title: "Heads up",
+    message: "This document contains form fields that will be flattened.",
+  },
+};
+
+export const Promo: Story = {
+  args: {
+    tone: "promo",
+    icon: "stars-rounded",
+    title: "Upgrade to Server Plan",
+    message:
+      "Get the most out of Stirling PDF with unlimited users and advanced features.",
+    buttonText: "Upgrade Now",
+    buttonIcon: "upgrade-rounded",
+    onButtonClick: () => {},
+    compact: true,
+  },
+};
+
+export const Warning: Story = {
+  args: {
+    tone: "warning",
+    icon: "warning-rounded",
+    title: "Action required",
+    message: "Some pages could not be processed and were skipped.",
+    buttonText: "Review",
+    onButtonClick: () => {},
+  },
+};
+
+export const Danger: Story = {
+  args: {
+    tone: "danger",
+    icon: "warning-rounded",
+    title: "This server needs admin attention",
+    message: "Review the license requirements to keep this server compliant.",
+    buttonText: "See info",
+    buttonIcon: "info-rounded",
+    onButtonClick: () => {},
+    dismissible: false,
+  },
+};
+
+export const Compact: Story = {
+  args: {
+    compact: true,
+    icon: "info-rounded",
+    message: "Autosave is enabled for this file.",
+    dismissible: false,
+  },
+};
+
+/** Message-only, no title: the message takes the title's weight so the bar still reads. */
+export const MessageOnly: Story = {
+  args: {
+    icon: "picture-as-pdf-rounded",
+    message:
+      "Make Stirling PDF your default application for opening PDF files.",
+    buttonText: "Set Default",
+    onButtonClick: () => {},
+    secondaryButtonText: "Don't remind me again",
+    onSecondaryButtonClick: () => {},
+  },
+};
+
+function Row({ caption, children }: { caption: string; children: ReactNode }) {
+  return (
+    <section
+      style={{ display: "flex", flexDirection: "column", gap: "0.375rem" }}
+    >
+      <span
+        style={{
+          fontSize: "0.6875rem",
+          fontWeight: 600,
+          letterSpacing: "0.04em",
+          textTransform: "uppercase",
+          color: "var(--c-text-subtle)",
+          padding: "0 1rem",
+        }}
+      >
+        {caption}
+      </span>
+      {children}
+    </section>
+  );
+}
+
+/**
+ * Every top bar the app can show, in one place: each entry mirrors a real caller,
+ * so a change to the component is visible against the whole set at once. Renders a
+ * composition rather than the component, so it takes no args of its own.
+ */
+export const AllTopBars: StoryObj = {
+  render: () => (
+    <div
+      style={{
+        display: "flex",
+        flexDirection: "column",
+        gap: "1.5rem",
+        padding: "1.5rem 0",
+        background: "var(--c-bg)",
+      }}
+    >
+      <Row caption="Upgrade prompt · UpgradeBanner (friendly)">
+        <AppBanner
+          tone="promo"
+          compact
+          icon="stars-rounded"
+          title="Upgrade to Server Plan"
+          message="Get the most out of Stirling PDF with unlimited users and advanced features."
+          buttonText="Upgrade Now"
+          buttonIcon="upgrade-rounded"
+          onButtonClick={() => {}}
+        />
+      </Row>
+
+      <Row caption="Server needs attention · UpgradeBanner (urgent)">
+        <AppBanner
+          tone="warning"
+          icon="warning-rounded"
+          title="This server needs admin attention"
+          message="Review the license requirements to keep this server compliant."
+          buttonText="See info"
+          buttonIcon="info-rounded"
+          onButtonClick={() => {}}
+          dismissible={false}
+        />
+      </Row>
+
+      <Row caption="Free tier limit reached · AdminPlanSection">
+        <AppBanner
+          tone="warning"
+          icon="warning-rounded"
+          title="Free self-hosted limit reached"
+          message="You have 12 users on a plan that covers 10."
+          buttonText="See plans"
+          buttonIcon="upgrade-rounded"
+          onButtonClick={() => {}}
+          dismissible={false}
+        />
+      </Row>
+
+      <Row caption="Team invitation · TeamInvitationBanner">
+        <AppBanner
+          icon="mail"
+          message="You have been invited to join the Acme Legal team."
+          buttonText="Accept"
+          onButtonClick={() => {}}
+          secondaryButtonText="Decline"
+          onSecondaryButtonClick={() => {}}
+          dismissible={false}
+        />
+      </Row>
+
+      <Row caption="Set as default app · DefaultAppBanner (desktop)">
+        <AppBanner
+          icon="picture-as-pdf-rounded"
+          message="Make Stirling PDF your default application for opening PDF files."
+          buttonText="Set Default"
+          onButtonClick={() => {}}
+          secondaryButtonText="Don't remind me again"
+          onSecondaryButtonClick={() => {}}
+        />
+      </Row>
+
+      <Row caption="Danger tone (available, no caller yet)">
+        <AppBanner
+          tone="danger"
+          icon="warning-rounded"
+          title="Storage is full"
+          message="New uploads will fail until space is freed."
+          buttonText="Manage storage"
+          onButtonClick={() => {}}
+          dismissible={false}
+        />
+      </Row>
+    </div>
+  ),
+};
diff --git a/frontend/editor/src/core/components/shared/AppBanner.tsx b/frontend/editor/src/core/components/shared/AppBanner.tsx
new file mode 100644
index 0000000000..ee0ba03741
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/AppBanner.tsx
@@ -0,0 +1,124 @@
+import React, { ReactNode } from "react";
+import { Button } from "@app/ui/Button";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { useTranslation } from "react-i18next";
+import LocalIcon from "@app/components/shared/LocalIcon";
+import "@app/components/shared/AppBanner.css";
+
+/** Picks the whole look. Callers choose meaning, never colours. */
+export type AppBannerTone = "info" | "promo" | "warning" | "danger";
+
+/** Tone decides the button too, so the CTA can't drift from the bar it sits on. */
+const TONE_BUTTON = {
+  info: { variant: "secondary", accent: "default" },
+  promo: { variant: "primary", accent: "premium" },
+  warning: { variant: "primary", accent: "warning" },
+  danger: { variant: "primary", accent: "danger" },
+} as const;
+
+interface AppBannerProps {
+  /** A LocalIcon name, or a pre-rendered node (e.g. a logo) dropped in as-is. */
+  icon?: string | ReactNode;
+  title?: ReactNode;
+  message: ReactNode;
+  buttonText?: string;
+  buttonIcon?: string;
+  onButtonClick?: () => void;
+  /** Muted secondary action, e.g. "Don't remind me again". */
+  secondaryButtonText?: string;
+  onSecondaryButtonClick?: () => void;
+  onDismiss?: () => void;
+  dismissible?: boolean;
+  loading?: boolean;
+  show?: boolean;
+  tone?: AppBannerTone;
+  compact?: boolean;
+}
+
+/** The app's top bar: dismissible messaging above the workspace. */
+export const AppBanner: React.FC<AppBannerProps> = ({
+  icon,
+  title,
+  message,
+  buttonText,
+  buttonIcon = "check-circle-rounded",
+  onButtonClick,
+  secondaryButtonText,
+  onSecondaryButtonClick,
+  onDismiss,
+  dismissible = true,
+  loading = false,
+  show = true,
+  tone = "info",
+  compact = false,
+}) => {
+  const { t } = useTranslation();
+  if (!show) return null;
+
+  const iconSize = compact ? "1rem" : "1.25rem";
+
+  return (
+    <div
+      className={[
+        "app-banner",
+        `app-banner--${tone}`,
+        compact ? "app-banner--compact" : "",
+      ]
+        .filter(Boolean)
+        .join(" ")}
+    >
+      {icon != null && (
+        <span className="app-banner__icon" aria-hidden>
+          {typeof icon === "string" ? (
+            <LocalIcon icon={icon} width={iconSize} height={iconSize} />
+          ) : (
+            icon
+          )}
+        </span>
+      )}
+
+      <div className="app-banner__body">
+        {title && <span className="app-banner__title">{title}</span>}
+        <span className="app-banner__message">{message}</span>
+      </div>
+
+      <div className="app-banner__actions">
+        {buttonText && onButtonClick && (
+          <Button
+            variant={TONE_BUTTON[tone].variant}
+            accent={TONE_BUTTON[tone].accent}
+            size="sm"
+            loading={loading}
+            onClick={onButtonClick}
+            leftSection={
+              <LocalIcon icon={buttonIcon} width="0.9rem" height="0.9rem" />
+            }
+          >
+            {buttonText}
+          </Button>
+        )}
+        {secondaryButtonText && onSecondaryButtonClick && (
+          <Button
+            variant="tertiary"
+            accent="neutral"
+            size="sm"
+            onClick={onSecondaryButtonClick}
+          >
+            {secondaryButtonText}
+          </Button>
+        )}
+        {dismissible && (
+          <ActionIcon
+            variant="tertiary"
+            accent="neutral"
+            size="sm"
+            onClick={() => onDismiss?.()}
+            aria-label={t("appBanner.dismiss", "Dismiss")}
+          >
+            <LocalIcon icon="close-rounded" width="1rem" height="1rem" />
+          </ActionIcon>
+        )}
+      </div>
+    </div>
+  );
+};
diff --git a/frontend/editor/src/core/components/shared/AppConfigModal.css b/frontend/editor/src/core/components/shared/AppConfigModal.css
index 46033eaf97..2953632d98 100644
--- a/frontend/editor/src/core/components/shared/AppConfigModal.css
+++ b/frontend/editor/src/core/components/shared/AppConfigModal.css
@@ -1,4 +1,28 @@
 /* AppConfigModal styles */
+
+/* Deep-link highlight: pulses the control the super search jumped to
+   (navigated via /settings/{section}?focus={anchor}). */
+@keyframes settings-focus-pulse {
+  0% {
+    box-shadow: 0 0 0 3px var(--mantine-color-blue-5);
+    background: color-mix(
+      in srgb,
+      var(--mantine-color-blue-5) 16%,
+      transparent
+    );
+  }
+  100% {
+    box-shadow: 0 0 0 6px transparent;
+    background: transparent;
+  }
+}
+
+.settings-focus-target {
+  animation: settings-focus-pulse 1.8s ease-out;
+  border-radius: 8px;
+  scroll-margin: 1rem;
+}
+
 .modal-container {
   display: flex;
   gap: 0;
@@ -173,16 +197,6 @@
   padding-top: 1rem;
 }
 
-.settings-search-select {
-  min-width: 10rem;
-}
-
-.settings-search-option {
-  display: flex;
-  flex-direction: column;
-  gap: 0.125rem;
-}
-
 .confirm-modal-content {
   display: flex;
   flex-direction: column;
diff --git a/frontend/editor/src/core/components/shared/AppConfigModal.tsx b/frontend/editor/src/core/components/shared/AppConfigModal.tsx
index b5b3224985..12faf6eea5 100644
--- a/frontend/editor/src/core/components/shared/AppConfigModal.tsx
+++ b/frontend/editor/src/core/components/shared/AppConfigModal.tsx
@@ -29,7 +29,6 @@ import {
   UnsavedChangesProvider,
   useUnsavedChanges,
 } from "@app/contexts/UnsavedChangesContext";
-import { SettingsSearchBar } from "@app/components/shared/config/SettingsSearchBar";
 import { stripBasePath, withBasePath } from "@app/constants/app";
 import { EDITOR_BASENAME } from "@app/routes/editorBasename";
 
@@ -46,6 +45,8 @@ interface AppConfigModalProps {
   /** Section to land on when opening. Only honoured when urlSync is off (URL
    *  deep links win otherwise). */
   initialSection?: NavKey | null;
+  /** Row anchor to focus when opening on a non-URL host. */
+  initialFocus?: string | null;
   /** Host-specific sections appended after the build's registry sections. */
   extraSections?: ConfigNavSection[];
   /** Registry section keys to drop, for hosts a section can't run in. */
@@ -67,6 +68,7 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({
   onClose,
   urlSync = true,
   initialSection,
+  initialFocus,
   extraSections,
   hiddenSectionKeys,
 }) => {
@@ -150,6 +152,35 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({
     [navigate, urlSync],
   );
 
+  // Deep-link: /settings/{section}?focus={anchor} scrolls to and briefly
+  // highlights the matching control (used by the global super search to jump
+  // straight to an individual setting row).
+  useEffect(() => {
+    if (!opened) return;
+    const focus = urlSync
+      ? new URLSearchParams(location.search).get("focus")
+      : initialFocus;
+    if (!focus) return;
+    let raf = 0;
+    // Wait for the (possibly just-switched) section to render before scrolling.
+    const timer = window.setTimeout(() => {
+      raf = window.requestAnimationFrame(() => {
+        const el = document.getElementById(focus);
+        if (!el) return;
+        el.scrollIntoView({ behavior: "smooth", block: "center" });
+        el.classList.add("settings-focus-target");
+        window.setTimeout(
+          () => el.classList.remove("settings-focus-target"),
+          1800,
+        );
+      });
+    }, 150);
+    return () => {
+      window.clearTimeout(timer);
+      if (raf) window.cancelAnimationFrame(raf);
+    };
+  }, [opened, active, initialFocus, location.search, urlSync]);
+
   // Backwards-compat: external `appConfig:navigate` events route through the
   // same switchSection path so they get the no-flash treatment too.
   useEffect(() => {
@@ -185,9 +216,10 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({
   const runningEE = config?.runningEE ?? false;
   const loginEnabled = config?.enableLogin ?? false;
 
+  /** Resolves false when a dirty-state confirm kept the modal open. */
   const handleClose = useCallback(async () => {
     const canProceed = await confirmIfDirty();
-    if (!canProceed) return;
+    if (!canProceed) return false;
 
     // Only unwind history if settings was opened via the URL; opened via state
     // there's no /settings entry to pop and navigate(-1) would jump to /files.
@@ -200,6 +232,7 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({
       }
     }
     onClose();
+    return true;
   }, [
     confirmIfDirty,
     location.key,
@@ -214,6 +247,24 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({
     void handleClose();
   }, [handleClose]);
 
+  // Cmd/Ctrl+K: hand over to the global super search. The bar's own shortcut
+  // is inert while a dialog traps focus, so the modal closes itself (through
+  // the same dirty-check as any other close) and asks the bar to take focus.
+  // Settings results deep-link straight back into this modal.
+  useEffect(() => {
+    if (!opened) return;
+    const onKey = (e: KeyboardEvent) => {
+      const combo = (e.metaKey || e.ctrlKey) && !e.altKey && !e.shiftKey;
+      if (!combo || e.code !== "KeyK") return;
+      e.preventDefault();
+      void handleClose().then((closed) => {
+        if (closed) window.dispatchEvent(new Event("superSearch:focus"));
+      });
+    };
+    window.addEventListener("keydown", onKey);
+    return () => window.removeEventListener("keydown", onKey);
+  }, [opened, handleClose]);
+
   // Left navigation structure and icons
   const registrySections = useConfigNavSections(
     isAdmin,
@@ -413,11 +464,6 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({
                 {activeLabel}
               </Text>
               <Group gap="xs" wrap="nowrap">
-                <SettingsSearchBar
-                  configNavSections={configNavSections}
-                  onNavigate={handleNavigation}
-                  isMobile={isMobile}
-                />
                 <ActionIcon
                   ref={closeButtonRef}
                   variant="tertiary"
diff --git a/frontend/editor/src/core/components/shared/AppConfigModalLazy.tsx b/frontend/editor/src/core/components/shared/AppConfigModalLazy.tsx
index 6c23178219..572e18bf88 100644
--- a/frontend/editor/src/core/components/shared/AppConfigModalLazy.tsx
+++ b/frontend/editor/src/core/components/shared/AppConfigModalLazy.tsx
@@ -18,6 +18,8 @@ interface AppConfigModalLazyProps {
   urlSync?: boolean;
   /** Section to land on when opening (non-URL hosts). */
   initialSection?: NavKey | null;
+  /** Row anchor to highlight when opening (non-URL hosts). */
+  initialFocus?: string | null;
   /** Host-specific sections appended after the build's registry sections. */
   extraSections?: ConfigNavSection[];
   /** Registry section keys to drop, for hosts a section can't run in. */
@@ -29,6 +31,7 @@ export default function AppConfigModalLazy({
   onClose,
   urlSync,
   initialSection,
+  initialFocus,
   extraSections,
   hiddenSectionKeys,
 }: AppConfigModalLazyProps) {
@@ -46,6 +49,7 @@ export default function AppConfigModalLazy({
           onClose={onClose}
           urlSync={urlSync}
           initialSection={initialSection}
+          initialFocus={initialFocus}
           extraSections={extraSections}
           hiddenSectionKeys={hiddenSectionKeys}
         />
diff --git a/frontend/editor/src/core/components/shared/BrandMark.css b/frontend/editor/src/core/components/shared/BrandMark.css
index 7ddff9b4c7..df05ff1307 100644
--- a/frontend/editor/src/core/components/shared/BrandMark.css
+++ b/frontend/editor/src/core/components/shared/BrandMark.css
@@ -48,9 +48,55 @@
   transform: matrix(0.483871, -0.017568, 0, 0.338028, 23.887097, 26.886428);
 }
 
+/* One-shot "thinking" drift — the two parallelograms swap past each other and
+   settle back. Same motion the chat FAB loops while the agent works, but this
+   pair starts and ends at rest (translate 0, full opacity) so a single
+   iteration can end without snapping. Callers apply it for one beat; see
+   NavFooter.css for the hover use. */
+@keyframes sui-brandmark-drift-a {
+  0%,
+  100% {
+    transform: translate(0, 0);
+    opacity: 1;
+  }
+  25% {
+    transform: translate(-1px, -5px);
+    opacity: 0.55;
+  }
+  50% {
+    transform: translate(-6px, 0);
+    opacity: 0.9;
+  }
+  75% {
+    transform: translate(-1px, 5px);
+    opacity: 0.6;
+  }
+}
+
+@keyframes sui-brandmark-drift-b {
+  0%,
+  100% {
+    transform: translate(0, 0);
+    opacity: 1;
+  }
+  25% {
+    transform: translate(1px, 5px);
+    opacity: 0.85;
+  }
+  50% {
+    transform: translate(6px, 0);
+    opacity: 0.5;
+  }
+  75% {
+    transform: translate(1px, -5px);
+    opacity: 0.85;
+  }
+}
+
 @media (prefers-reduced-motion: reduce) {
   .sui-brandmark__a,
   .sui-brandmark__b {
     transition: none;
+    animation: none;
   }
 }
diff --git a/frontend/editor/src/core/components/shared/FileSidebar.css b/frontend/editor/src/core/components/shared/FileSidebar.css
index 126ec6fede..2347d9a2b2 100644
--- a/frontend/editor/src/core/components/shared/FileSidebar.css
+++ b/frontend/editor/src/core/components/shared/FileSidebar.css
@@ -75,16 +75,13 @@
   padding: 0.25rem 0;
   overflow: hidden;
 }
-.file-sidebar-footer-box {
-  padding: 0.25rem 0;
-  flex-shrink: 0;
-}
+/* The footer is the shared <NavFooter>: it brings its own boxes and padding,
+   so this class only positions it in the column. */
 
 /* Collapsed rail: the file tree isn't rendered, so hide its (empty) box and
    let the boxes stack at the top — controls, then the settings footer right
    after — instead of the files box stretching to fill. */
-.file-sidebar[data-collapsed="true"] .file-sidebar-controls,
-.file-sidebar[data-collapsed="true"] .file-sidebar-footer-box {
+.file-sidebar[data-collapsed="true"] .file-sidebar-controls {
   padding: 0.25rem;
 }
 .file-sidebar[data-collapsed="true"] .file-sidebar-files-box {
@@ -95,7 +92,6 @@
 }
 /* Centre each row's icon in the narrow rail (no side padding/margin to shove
    it off the edge). */
-.file-sidebar[data-collapsed="true"] .file-sidebar-search-row,
 .file-sidebar[data-collapsed="true"] .file-sidebar-action-row,
 .file-sidebar[data-collapsed="true"] .file-sidebar-cloud-row {
   justify-content: center;
@@ -139,55 +135,6 @@
   color: var(--c-accent-text);
 }
 
-/* ---- Search row ---- */
-.file-sidebar-search-row {
-  display: flex;
-  align-items: center;
-  min-height: 32px;
-  padding: 0 8px;
-  gap: 0;
-  cursor: pointer;
-  border-radius: 4px;
-  margin: 0;
-  flex-shrink: 0;
-  transition: background-color 0.15s ease;
-}
-
-.file-sidebar-search-row:not(.active):hover {
-  background-color: var(--c-hover);
-}
-
-.file-sidebar-search-icon {
-  color: var(--c-text-subtle) !important;
-  font-size: 18px !important;
-  flex-shrink: 0;
-}
-
-.file-sidebar-search-close {
-  cursor: pointer;
-}
-
-.file-sidebar-search-input {
-  flex: 1;
-  background: transparent;
-  border: none;
-  outline: none;
-  font-size: 14px;
-  color: var(--c-text);
-  margin-left: 12px;
-  min-width: 0;
-}
-
-.file-sidebar-search-input::placeholder {
-  color: var(--c-text-subtle);
-}
-
-.file-sidebar-search-label {
-  margin-left: 12px;
-  font-size: 14px;
-  color: var(--c-text);
-}
-
 /* ---- Scrollable content ---- */
 /* This is a flex column - action rows are fixed, only the file list scrolls */
 .file-sidebar-scroll {
@@ -588,86 +535,3 @@
   pointer-events: none;
   animation: none;
 }
-
-/* ---- Bottom bar (user + settings) ---- */
-.file-sidebar-bottom-bar {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  padding: 4px 6px;
-  flex-shrink: 0;
-  min-height: 40px;
-}
-
-/* Bottom bar settings icon tracks the right edge during collapse animation */
-
-.file-sidebar-bottom-avatar {
-  width: 28px;
-  height: 28px;
-  border-radius: 50%;
-  background-color: var(--c-accent-text);
-  color: var(--c-text-on-primary);
-  font-size: 12px;
-  font-weight: 600;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  flex-shrink: 0;
-  user-select: none;
-  overflow: hidden;
-}
-
-/* No colored disc behind an actual photo; keep it for the initials fallback. */
-.file-sidebar-bottom-avatar--picture {
-  background-color: transparent;
-}
-
-.file-sidebar-bottom-avatar-img {
-  width: 100%;
-  height: 100%;
-  border-radius: 50%;
-  object-fit: cover;
-}
-
-.file-sidebar-bottom-name {
-  flex: 1;
-  font-size: 13px;
-  font-weight: 500;
-  color: var(--c-text);
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  min-width: 0;
-}
-
-.file-sidebar-bottom-bar[role="button"]:hover {
-  background-color: var(--c-hover);
-}
-
-.file-sidebar-bottom-bar[role="button"]:focus-visible {
-  outline: 2px solid var(--c-primary);
-  outline-offset: -2px;
-}
-
-.file-sidebar-bottom-settings {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  width: 28px;
-  height: 28px;
-  border-radius: 6px;
-  color: var(--c-text-subtle);
-  padding: 0;
-  flex-shrink: 0;
-  margin-left: auto;
-}
-
-.file-sidebar[data-collapsed="true"] .file-sidebar-bottom-settings {
-  width: 32px;
-  height: 32px;
-}
-
-.file-sidebar[data-collapsed="true"] .file-sidebar-bottom-bar {
-  justify-content: center;
-  padding: 8px 0;
-}
diff --git a/frontend/editor/src/core/components/shared/FileSidebar.tsx b/frontend/editor/src/core/components/shared/FileSidebar.tsx
index 742334015c..1c06236027 100644
--- a/frontend/editor/src/core/components/shared/FileSidebar.tsx
+++ b/frontend/editor/src/core/components/shared/FileSidebar.tsx
@@ -22,25 +22,24 @@ import {
 } from "@app/contexts/NavigationContext";
 import { useViewer } from "@app/contexts/ViewerContext";
 import { useFileHandler } from "@app/hooks/useFileHandler";
-import { useAuth } from "@app/auth/UseSession";
-import { useProfilePictureUrl } from "@app/hooks/useProfilePictureUrl";
+import { useAccountIdentity } from "@app/hooks/useAccountIdentity";
+import { useFreeCreditsSummary } from "@app/hooks/useFreeCreditsSummary";
+import { useOtherAppSwitch } from "@app/hooks/useOtherAppSwitch";
+import { useOpenPlan } from "@app/hooks/useOpenPlan";
+import { NavFooter } from "@app/components/shared/navFooter/NavFooter";
 import {
   useIndexedDB,
   useIndexedDBRevision,
 } from "@app/contexts/IndexedDBContext";
-import { accountService } from "@app/services/accountService";
 import { GoogleDriveIcon } from "@app/components/shared/CloudStorageIcons";
 import { AppSwitcher } from "@app/components/shared/AppSwitcher";
 import { SidebarToggleIcon } from "@app/components/shared/SidebarToggleIcon";
 import type { StirlingFileStub } from "@app/types/fileContext";
-import SearchIcon from "@mui/icons-material/Search";
 import FolderOpenIcon from "@mui/icons-material/FolderOpen";
 import FolderSpecialIcon from "@mui/icons-material/FolderSpecial";
 import UploadFileIcon from "@mui/icons-material/UploadFile";
-import CloseIcon from "@mui/icons-material/Close";
 import AddIcon from "@mui/icons-material/Add";
-import OpenInNewIcon from "@mui/icons-material/OpenInNew";
-import SettingsIcon from "@mui/icons-material/Settings";
+import OpenInFullIcon from "@mui/icons-material/OpenInFull";
 import type { FileId } from "@app/types/file";
 import { FileItem } from "@app/components/shared/FileSidebarFileItem";
 import { useLabelName } from "@app/data/labelDisplay";
@@ -61,7 +60,8 @@ import {
   deleteServerFile,
   type DeleteScope,
 } from "@app/services/serverStorageDelete";
-import { fileStorage } from "@app/services/fileStorage";
+import { fileStorage, onRecordUnreadable } from "@app/services/fileStorage";
+import { alert } from "@app/components/toast";
 import { useBulkAddProgress } from "@app/services/bulkAddProgress";
 import { useFolderMembership } from "@app/hooks/useFolderMembership";
 import { useAllWatchedFolders } from "@app/hooks/useAllWatchedFolders";
@@ -102,8 +102,6 @@ export interface FileSidebarProps {
   onUploadFiles?: (files: File[]) => void | Promise<void>;
   /** Override the Google Drive handler. */
   onPickGoogleDriveFiles?: (files: File[]) => void | Promise<void>;
-  /** Override the Search row click (e.g. focus the /files search input). */
-  onSearchClick?: () => void;
   /** Extra action row inserted under Open-from-computer (e.g. New folder). */
   extraAction?: {
     icon: React.ReactNode;
@@ -155,7 +153,6 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
       onOpenSettings,
       onUploadFiles,
       onPickGoogleDriveFiles,
-      onSearchClick,
       extraAction,
       toggleAriaLabel,
       toggleIcon,
@@ -168,9 +165,6 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
     // Classification off (non-SaaS / AI-off) → never show the per-row label chip,
     // even if a stub carries labels from an imported PDF; keeps the row plain.
     const classificationEnabled = useClassificationEnabled();
-    const [searchActive, setSearchActive] = useState(false);
-    const [searchQuery, setSearchQuery] = useState("");
-    const searchInputRef = useRef<HTMLInputElement>(null);
     const nativeFileInputRef = useRef<HTMLInputElement>(null);
     // State (not ref) so setting it triggers a re-render - avoids racing addFiles state updates.
     const [pendingViewFileId, setPendingViewFileId] = useState<string | null>(
@@ -248,46 +242,27 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
     const { addFiles } = useFileHandler();
     const indexedDB = useIndexedDB();
 
-    // Each auth layer derives its own displayName from its native user shape.
-    // Fall back to the proprietary REST endpoint only when the auth
-    // context yields nothing - then to "User" as a generic last resort.
-    const { displayName: authDisplayName, isAnonymous } = useAuth();
-    const [accountUsername, setAccountUsername] = useState<string | null>(null);
-    const displayName =
-      authDisplayName ?? accountUsername ?? t("auth.displayName.user", "User");
-
-    const profilePictureUrl = useProfilePictureUrl();
-    const [pictureFailed, setPictureFailed] = useState(false);
-    useEffect(() => setPictureFailed(false), [profilePictureUrl]);
-    const showProfilePicture = !!profilePictureUrl && !pictureFailed;
-
-    useEffect(() => {
-      if (!config?.enableLogin) {
-        setAccountUsername(null);
-        return;
-      }
-      if (authDisplayName) {
-        // The auth context has a name; don't bother hitting the REST
-        // endpoint, but clear any stale cached value from a prior call.
-        setAccountUsername(null);
-        return;
-      }
-      accountService
-        .getAccountData()
-        .then((data) => {
-          // Always reflect the latest result - including clearing it on
-          // sign-out, when the endpoint returns no username (or 401s into
-          // the catch branch below). Without this, signing out would leave
-          // the old username on screen.
-          setAccountUsername(data?.username ?? null);
-        })
-        .catch(() => {
-          setAccountUsername(null);
-        });
-    }, [config?.enableLogin, authDisplayName]);
+    const { displayName, profilePictureUrl, isAnonymous } =
+      useAccountIdentity();
+    const credits = useFreeCreditsSummary();
+    const otherApp = useOtherAppSwitch();
+    const openPlan = useOpenPlan();
 
     // Leaf files = user-visible files (excludes intermediate tool outputs)
     const [allFileStubs, setAllFileStubs] = useState<StirlingFileStub[]>([]);
+    // Files whose stored bytes this session PROVED unreadable. Rows render a
+    // "data lost" state instead of pretending the file can open; storage keeps
+    // the record so a reload re-tests it.
+    const [lostFileIds, setLostFileIds] = useState<ReadonlySet<string>>(
+      () => new Set(),
+    );
+    useEffect(
+      () =>
+        onRecordUnreadable((fileId) =>
+          setLostFileIds((prev) => new Set(prev).add(fileId as string)),
+        ),
+      [],
+    );
     const [stubsLoaded, setStubsLoaded] = useState(false);
     // Kebab "Save to cloud" target; drives BulkUploadToServerModal.
     const [saveToServerTarget, setSaveToServerTarget] = useState<
@@ -306,32 +281,45 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
     const storageEnabled = config?.storageEnabled === true && !isAnonymous;
 
     const refreshStubs = useCallback(async () => {
-      // Leaf files from IDB - same source as the file selection modal.
-      const stubs = await indexedDB.loadLeafMetadata();
-      const idbIds = new Set(stubs.map((s) => s.id as string));
+      // `stubsLoaded` gates the spinner, so the `finally` below must set it on
+      // every path - callers never await this, so a rejection goes nowhere.
+      let stubs: StirlingFileStub[] = [];
+      try {
+        // Leaf files from IDB - same source as the file selection modal.
+        stubs = await indexedDB.loadLeafMetadata();
+      } catch (error) {
+        // Carry on with the in-memory workbench files: an unreadable library
+        // should cost the user their history, not the file they're working on.
+        console.error("Failed to read the file library from storage:", error);
+      }
 
-      // Also include workbench files not yet flushed to IDB.
-      const pendingStubs = state.files.ids
-        .map((id) => state.files.byId[id])
-        .filter(
-          (stub): stub is NonNullable<typeof stub> =>
-            !!stub && stub.isLeaf !== false && !idbIds.has(stub.id as string),
+      try {
+        const idbIds = new Set(stubs.map((s) => s.id as string));
+
+        // Also include workbench files not yet flushed to IDB.
+        const pendingStubs = state.files.ids
+          .map((id) => state.files.byId[id])
+          .filter(
+            (stub): stub is NonNullable<typeof stub> =>
+              !!stub && stub.isLeaf !== false && !idbIds.has(stub.id as string),
+          );
+
+        const allStubs = [...stubs, ...pendingStubs];
+        // A version swap briefly lists both the old leaf (IDB) and its replacement (workbench); two stubs for one lineage collide on the row key and corrupt React reconciliation, so drop any stub another names as its parent.
+        const superseded = new Set(
+          allStubs.map((s) => s.parentFileId as string | undefined),
         );
-
-      const allStubs = [...stubs, ...pendingStubs];
-      // A version swap briefly lists both the old leaf (IDB) and its replacement (workbench); two stubs for one lineage collide on the row key and corrupt React reconciliation, so drop any stub another names as its parent.
-      const superseded = new Set(
-        allStubs.map((s) => s.parentFileId as string | undefined),
-      );
-      const currentStubs = allStubs.filter(
-        (s) => !superseded.has(s.id as string),
-      );
-      setAllFileStubs(
-        currentStubs.sort(
-          (a, b) => (b.lastModified ?? 0) - (a.lastModified ?? 0),
-        ),
-      );
-      setStubsLoaded(true);
+        const currentStubs = allStubs.filter(
+          (s) => !superseded.has(s.id as string),
+        );
+        setAllFileStubs(
+          currentStubs.sort(
+            (a, b) => (b.lastModified ?? 0) - (a.lastModified ?? 0),
+          ),
+        );
+      } finally {
+        setStubsLoaded(true);
+      }
     }, [indexedDB, state.files.ids, state.files.byId]);
 
     // Refresh on mount, workbench changes, or external IndexedDB writes —
@@ -370,7 +358,9 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
           setDeleteTarget(stub);
           return;
         }
-        await fileActions.removeFiles([fileId], true);
+        // Its superseded versions go too - see orphanedAncestorIds.
+        const orphans = await fileStorage.orphanedAncestorIds([fileId]);
+        await fileActions.removeFiles([fileId, ...orphans], true);
         await refreshStubs();
       },
       [allFileStubs, fileActions, refreshStubs],
@@ -388,7 +378,8 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
           await deleteServerFile(stub.remoteStorageId);
         }
         if (scope === "device" || scope === "everywhere") {
-          await fileActions.removeFiles([stub.id], true);
+          const orphans = await fileStorage.orphanedAncestorIds([stub.id]);
+          await fileActions.removeFiles([stub.id, ...orphans], true);
         } else if (scope === "cloud") {
           // Local copy kept - drop the dead remote pointer so the cloud badge
           // clears (the sidebar doesn't reconcile with the server itself).
@@ -439,17 +430,8 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
       }
     }, [pendingViewFileId, state.files.ids, setActiveFileId, navActions]);
 
-    // Memoized so an unrelated re-render (e.g. a policy-run store tick) keeps a
-    // stable array identity — avoids re-running the grouping memo + backfill effect.
-    const filteredFileStubs = useMemo(() => {
-      const q = searchQuery.trim().toLowerCase();
-      return q
-        ? allFileStubs.filter((stub) => stub.name.toLowerCase().includes(q))
-        : allFileStubs;
-    }, [allFileStubs, searchQuery]);
-
     // SaaS groups by classification label; core returns null → one flat, recency-sorted list.
-    const fileGroups = useFileSidebarGroups(filteredFileStubs);
+    const fileGroups = useFileSidebarGroups(allFileStubs);
     // Workbench membership as a Set for O(1) per-row lookups (see renderFileRow).
     const workbenchIds = useMemo(
       () => new Set(state.files.ids.map((id) => id as string)),
@@ -459,12 +441,12 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
     // must key by their unique leaf id rather than the shared lineage (see renderFileRow).
     const lineageCounts = useMemo(() => {
       const counts = new Map<string, number>();
-      for (const s of filteredFileStubs) {
+      for (const s of allFileStubs) {
         const k = (s.originalFileId ?? s.id) as string;
         counts.set(k, (counts.get(k) ?? 0) + 1);
       }
       return counts;
-    }, [filteredFileStubs]);
+    }, [allFileStubs]);
     // Per-group expand/collapse, falling back to each group's default until toggled.
     const [groupOpen, setGroupOpen] = useState<Record<string, boolean>>({});
     const setGroupOpenState = useCallback(
@@ -473,29 +455,6 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
       [],
     );
 
-    // Handle search activation
-    const handleSearchClick = useCallback(() => {
-      if (onSearchClick) {
-        onSearchClick();
-        return;
-      }
-      if (collapsed && onToggleCollapse) {
-        onToggleCollapse();
-      }
-      setSearchActive(true);
-    }, [collapsed, onToggleCollapse, onSearchClick]);
-
-    const handleSearchClose = useCallback(() => {
-      setSearchActive(false);
-      setSearchQuery("");
-    }, []);
-
-    useEffect(() => {
-      if (searchActive && searchInputRef.current) {
-        searchInputRef.current.focus();
-      }
-    }, [searchActive]);
-
     // Handle Google Drive
     const handleGoogleDriveClick = useCallback(async () => {
       if (!isGoogleDriveEnabled) return;
@@ -524,6 +483,22 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
         const stub = allFileStubs.find((s) => s.id === fileId);
         if (!stub) return;
 
+        // Its bytes are gone; opening it can only fail. Say so instead of a
+        // click that goes nowhere.
+        if (stub.dataUnavailable || lostFileIds.has(fileId as string)) {
+          alert({
+            alertType: "warning",
+            title: t("fileSidebar.dataLostTitle", "File data is unavailable"),
+            body: t(
+              "fileSidebar.dataLostBody",
+              "This browser lost this file's contents. Upload it again to keep working with it.",
+            ),
+            expandable: false,
+            durationMs: 6000,
+          });
+          return;
+        }
+
         // In the Watched Folders view a click sends the file into the open folder
         // (mirrors how a click toggles a file into the active workbench elsewhere).
         // On the folder list (no folder open) it's a no-op so browsing isn't disrupted.
@@ -578,6 +553,8 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
       },
       [
         allFileStubs,
+        lostFileIds,
+        t,
         state.files.ids,
         state.ui.selectedFileIds,
         fileActions,
@@ -765,6 +742,8 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
             ? state.files.byId[workbenchFileId]?.thumbnailUrl
             : undefined) || stub.thumbnailUrl;
       const fileOrigin = getFileOrigin(stub);
+      const dataUnavailable =
+        stub.dataUnavailable === true || lostFileIds.has(stub.id as string);
       // Key by lineage (originalFileId) so a version swap updates the row in place instead of
       // remounting. But a 1-input→many-output op (split) yields sibling leaves that share one
       // originalFileId; those would collide on the key, so fall back to the unique leaf id when a
@@ -787,6 +766,7 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
           thumbnailUrl={thumbnailUrl}
           onClick={handleFileClick}
           onEyeClick={handleEyeClick}
+          dataUnavailable={dataUnavailable}
           draggable={isWatchedFoldersActive}
           onDragStart={handleWatchedFolderDragStart}
           folders={memberFolders}
@@ -854,58 +834,9 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
             )}
           </div>
 
-          {/* Box 1 — top controls (search + open / my files / cloud). No title. */}
+          {/* Box 1 — top controls (open / my files / cloud). No title. File
+              search lives in the global super search (top bar), not here. */}
           <NavSurface className="file-sidebar-controls">
-            {/* Search row */}
-            <Tooltip
-              label={t("fileSidebar.search", "Search")}
-              position="right"
-              withinPortal
-              disabled={!collapsed}
-            >
-              <div
-                className={`file-sidebar-search-row${searchActive && !collapsed ? " active" : ""}`}
-                onClick={!searchActive ? handleSearchClick : undefined}
-                role={!searchActive ? "button" : undefined}
-                tabIndex={!searchActive ? 0 : undefined}
-                onKeyDown={
-                  !searchActive
-                    ? (e) => e.key === "Enter" && handleSearchClick()
-                    : undefined
-                }
-              >
-                {searchActive && !collapsed ? (
-                  <CloseIcon
-                    className="file-sidebar-search-icon"
-                    onClick={(e) => {
-                      e.stopPropagation();
-                      handleSearchClose();
-                    }}
-                  />
-                ) : (
-                  <SearchIcon className="file-sidebar-search-icon" />
-                )}
-                {!collapsed &&
-                  (searchActive ? (
-                    <input
-                      ref={searchInputRef}
-                      className="file-sidebar-search-input sidebar-content-fade"
-                      value={searchQuery}
-                      onChange={(e) => setSearchQuery(e.target.value)}
-                      placeholder={t(
-                        "fileSidebar.searchPlaceholder",
-                        "Search files...",
-                      )}
-                      onClick={(e) => e.stopPropagation()}
-                    />
-                  ) : (
-                    <span className="file-sidebar-search-label sidebar-content-fade">
-                      {t("fileSidebar.search", "Search")}
-                    </span>
-                  ))}
-              </div>
-            </Tooltip>
-
             {/* Hidden native file input - kept outside the !collapsed gate so
                 the "Open from computer" row below (always rendered) can fire
                 it in either sidebar state without a silent no-op. */}
@@ -1138,7 +1069,7 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
                     <span className="file-sidebar-section-label">
                       {t("fileSidebar.library", "PDF Library")}
                     </span>
-                    <FileSidebarGroupControls stubs={filteredFileStubs} />
+                    <FileSidebarGroupControls stubs={allFileStubs} />
                     <ActionIcon
                       variant="quiet"
                       className="file-sidebar-section-btn file-sidebar-section-btn-external"
@@ -1153,7 +1084,7 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
                       )}
                       data-testid="open-files-page"
                     >
-                      <OpenInNewIcon sx={{ fontSize: "1rem" }} />
+                      <OpenInFullIcon sx={{ fontSize: "1rem" }} />
                     </ActionIcon>
                     <ActionIcon
                       variant="quiet"
@@ -1172,7 +1103,7 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
                     <div className="file-sidebar-loading">
                       <Loader size="sm" color="var(--c-text-subtle)" />
                     </div>
-                  ) : filteredFileStubs.length > 0 ? (
+                  ) : allFileStubs.length > 0 ? (
                     <div className="file-sidebar-file-list">
                       {fileGroups ? (
                         <>
@@ -1250,29 +1181,24 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
                               "fileSidebar.viewAll",
                               "View all {{count}} files",
                               {
-                                count: filteredFileStubs.length,
+                                count: allFileStubs.length,
                               },
                             )}
                           </Button>
                         </>
                       ) : (
-                        filteredFileStubs.map(renderFileRow)
+                        allFileStubs.map(renderFileRow)
                       )}
                     </div>
                   ) : (
-                    !searchActive && (
-                      <div className="file-sidebar-empty">
-                        <p className="file-sidebar-empty-text">
-                          {t("fileSidebar.noFiles", "No files yet")}
-                        </p>
-                        <p className="file-sidebar-empty-hint">
-                          {t(
-                            "fileSidebar.dropHint",
-                            "Open files to get started",
-                          )}
-                        </p>
-                      </div>
-                    )
+                    <div className="file-sidebar-empty">
+                      <p className="file-sidebar-empty-text">
+                        {t("fileSidebar.noFiles", "No files yet")}
+                      </p>
+                      <p className="file-sidebar-empty-hint">
+                        {t("fileSidebar.dropHint", "Open files to get started")}
+                      </p>
+                    </div>
                   )}
                 </div>
               )}
@@ -1307,70 +1233,17 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
         {/* Getting-started checklist, floating above the footer (SaaS only). */}
         <SidebarChecklistSlot collapsed={collapsed} />
 
-        {/* Box 3 — account footer (avatar + name + settings). */}
-        <NavSurface className="file-sidebar-footer-box">
-          {/* Bottom bar: user name + settings */}
-          <Tooltip
-            label={
-              onOpenSettings
-                ? `${displayName} - ${t("fileSidebar.openSettings", "Open settings")}`
-                : displayName
-            }
-            position="right"
-            withinPortal
-            disabled={!collapsed}
-          >
-            <div
-              className="file-sidebar-bottom-bar"
-              onClick={onOpenSettings}
-              role={onOpenSettings ? "button" : undefined}
-              tabIndex={onOpenSettings ? 0 : undefined}
-              onKeyDown={
-                onOpenSettings
-                  ? (e) => e.key === "Enter" && onOpenSettings()
-                  : undefined
-              }
-              data-testid={onOpenSettings ? "config-button" : undefined}
-              data-tour={onOpenSettings ? "config-button" : undefined}
-              aria-label={
-                onOpenSettings
-                  ? t("fileSidebar.openSettings", "Open settings")
-                  : displayName
-              }
-              style={onOpenSettings ? { cursor: "pointer" } : undefined}
-            >
-              <div
-                className={`file-sidebar-bottom-avatar${
-                  showProfilePicture
-                    ? " file-sidebar-bottom-avatar--picture"
-                    : ""
-                }`}
-                aria-label={displayName}
-              >
-                {showProfilePicture ? (
-                  <img
-                    src={profilePictureUrl}
-                    alt=""
-                    className="file-sidebar-bottom-avatar-img"
-                    onError={() => setPictureFailed(true)}
-                  />
-                ) : (
-                  displayName.charAt(0).toUpperCase()
-                )}
-              </div>
-              {!collapsed && (
-                <span className="file-sidebar-bottom-name sidebar-content-fade">
-                  {displayName}
-                </span>
-              )}
-              {onOpenSettings && !collapsed && (
-                <div className="file-sidebar-bottom-settings">
-                  <SettingsIcon sx={{ fontSize: "1.1rem" }} />
-                </div>
-              )}
-            </div>
-          </Tooltip>
-        </NavSurface>
+        {/* Box 3 — the shared footer: credits, app switch, account row. */}
+        <NavFooter
+          className="file-sidebar-footer-box"
+          displayName={displayName}
+          profilePictureUrl={profilePictureUrl}
+          onOpenSettings={onOpenSettings}
+          credits={credits}
+          onOpenPlan={openPlan ?? undefined}
+          otherApp={otherApp}
+          collapsed={collapsed}
+        />
       </div>
     );
   },
diff --git a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
index 794ed4ca97..874bf47e28 100644
--- a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
+++ b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
@@ -447,3 +447,13 @@
     transform: translateY(-50%) scale(1);
   }
 }
+
+/* The stored bytes are gone - the row says so instead of pretending to open. */
+.file-sidebar-datalost-badge {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.15rem;
+  color: var(--c-danger);
+  font-size: 0.7rem;
+  white-space: nowrap;
+}
diff --git a/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx b/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx
index c1a93594c5..2b06c27e56 100644
--- a/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx
+++ b/frontend/editor/src/core/components/shared/FileSidebarFileItem.tsx
@@ -9,6 +9,7 @@ import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
 import MoreVertIcon from "@mui/icons-material/MoreVert";
 import CloudUploadOutlinedIcon from "@mui/icons-material/CloudUploadOutlined";
 import CloudDoneIcon from "@mui/icons-material/CloudDone";
+import ErrorOutlineIcon from "@mui/icons-material/ErrorOutlineOutlined";
 import DeleteOutlineIcon from "@mui/icons-material/DeleteOutlined";
 import HistoryIcon from "@mui/icons-material/History";
 import type { FileId } from "@app/types/file";
@@ -163,6 +164,9 @@ export interface FileItemProps {
   onVersionHistory?: (fileId: FileId) => void;
   /** Whether this file has more than one version (drives the menu item). */
   hasVersionHistory?: boolean;
+  /** The stored bytes are gone (WebKit lost the blob's backing store). The row
+   *  says so instead of pretending the file can open. */
+  dataUnavailable?: boolean;
 }
 
 const MAX_VISIBLE_FOLDER_TAGS = 2;
@@ -177,6 +181,7 @@ export const FileItem = React.memo(function FileItem({
   isSelected,
   isActive,
   isViewedInViewer,
+  dataUnavailable,
   thumbnailUrl,
   onClick,
   onEyeClick,
@@ -294,6 +299,21 @@ export const FileItem = React.memo(function FileItem({
                 </>
               )}
             </span>
+            {dataUnavailable && (
+              <Tooltip
+                label={t(
+                  "fileSidebar.fileItem.dataLostTooltip",
+                  "This browser lost this file's contents. Upload it again to keep working with it.",
+                )}
+                withArrow
+                position="top"
+              >
+                <span className="file-sidebar-datalost-badge" data-no-select>
+                  <ErrorOutlineIcon sx={{ fontSize: "0.85rem" }} />
+                  {t("fileSidebar.fileItem.dataLost", "Data lost")}
+                </span>
+              </Tooltip>
+            )}
             {isUploadedToCloud && (
               <Tooltip
                 label={t(
diff --git a/frontend/editor/src/core/components/shared/InfoBanner.stories.tsx b/frontend/editor/src/core/components/shared/InfoBanner.stories.tsx
deleted file mode 100644
index 5fad071d05..0000000000
--- a/frontend/editor/src/core/components/shared/InfoBanner.stories.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { InfoBanner } from "@app/components/shared/InfoBanner";
-
-const meta = {
-  title: "Shared/InfoBanner",
-  component: InfoBanner,
-  parameters: { layout: "padded" },
-} satisfies Meta<typeof InfoBanner>;
-export default meta;
-type Story = StoryObj<typeof meta>;
-
-export const Default: Story = {
-  args: {
-    icon: "info-rounded",
-    title: "Heads up",
-    message: "This document contains form fields that will be flattened.",
-  },
-};
-
-export const Warning: Story = {
-  args: {
-    tone: "warning",
-    icon: "warning-rounded",
-    title: "Action required",
-    message: "Some pages could not be processed and were skipped.",
-    buttonText: "Review",
-    onButtonClick: () => {},
-  },
-};
-
-export const Compact: Story = {
-  args: {
-    compact: true,
-    icon: "info-rounded",
-    message: "Autosave is enabled for this file.",
-    dismissible: false,
-  },
-};
diff --git a/frontend/editor/src/core/components/shared/InfoBanner.tsx b/frontend/editor/src/core/components/shared/InfoBanner.tsx
deleted file mode 100644
index 2056b6a92f..0000000000
--- a/frontend/editor/src/core/components/shared/InfoBanner.tsx
+++ /dev/null
@@ -1,263 +0,0 @@
-import React, { ReactNode } from "react";
-import { Paper, Group, Text, Stack } from "@mantine/core";
-import { Button, type ButtonVariant, type ButtonAccent } from "@app/ui/Button";
-import { ActionIcon } from "@app/ui/ActionIcon";
-import { useTranslation } from "react-i18next";
-import LocalIcon from "@app/components/shared/LocalIcon";
-
-type InfoBannerTone = "info" | "warning";
-
-const toneStyles: Record<
-  InfoBannerTone,
-  {
-    background: string;
-    border: string;
-    text: string;
-    icon: string;
-    buttonColor: string;
-  }
-> = {
-  info: {
-    background: "var(--mantine-color-blue-0)",
-    border: "var(--mantine-color-blue-2)",
-    text: "var(--mantine-color-blue-9)",
-    icon: "var(--mantine-color-blue-6)",
-    buttonColor: "blue",
-  },
-  warning: {
-    background: "var(--mantine-color-orange-0)",
-    border: "var(--mantine-color-orange-3)",
-    text: "var(--color-amber-dark)",
-    icon: "var(--mantine-color-orange-7)",
-    buttonColor: "orange",
-  },
-};
-
-function toSharedButtonVariant(
-  variant: "light" | "filled" | "white" | "outline" | "subtle",
-): ButtonVariant {
-  switch (variant) {
-    case "filled":
-      return "primary";
-    case "outline":
-      return "secondary";
-    case "subtle":
-      return "tertiary";
-    case "light":
-    case "white":
-    default:
-      return "secondary";
-  }
-}
-
-function toSharedButtonAccent(color: string | undefined): ButtonAccent {
-  // Mantine colours may carry a shade suffix (e.g. "orange.7"); use the hue.
-  const hue = (color ?? "").split(".")[0];
-  switch (hue) {
-    case "red":
-      return "danger";
-    case "green":
-      return "success";
-    case "yellow":
-    case "orange":
-      return "warning";
-    case "blue":
-    default:
-      return "default";
-  }
-}
-
-interface InfoBannerProps {
-  /**
-   * Either a LocalIcon name (string) for the standard sized icon slot, or a
-   * pre-rendered ReactNode (e.g. a logo image) which is dropped in as-is.
-   */
-  icon?: string | ReactNode;
-  title?: ReactNode;
-  message: ReactNode;
-  buttonText?: string;
-  buttonIcon?: string;
-  onButtonClick?: () => void;
-  /** Optional muted secondary action (e.g. "Don't remind me again"). */
-  secondaryButtonText?: string;
-  onSecondaryButtonClick?: () => void;
-  onDismiss?: () => void;
-  dismissible?: boolean;
-  loading?: boolean;
-  show?: boolean;
-  tone?: InfoBannerTone;
-  background?: string;
-  borderColor?: string;
-  textColor?: string;
-  iconColor?: string;
-  buttonColor?: string;
-  buttonVariant?: "light" | "filled" | "white" | "outline" | "subtle";
-  /** Override the button label colour (for dark/custom theme variants). */
-  buttonTextColor?: string;
-  minHeight?: number | string;
-  closeIconColor?: string;
-  compact?: boolean;
-}
-
-/**
- * Generic info banner component for displaying dismissible messages at the top of the app
- */
-export const InfoBanner: React.FC<InfoBannerProps> = ({
-  icon,
-  title,
-  message,
-  buttonText,
-  buttonIcon = "check-circle-rounded",
-  onButtonClick,
-  secondaryButtonText,
-  onSecondaryButtonClick,
-  onDismiss,
-  dismissible = true,
-  loading = false,
-  show = true,
-  tone = "info",
-  background,
-  borderColor,
-  textColor,
-  iconColor,
-  buttonColor,
-  buttonVariant = "light",
-  buttonTextColor,
-  minHeight = 56,
-  closeIconColor,
-  compact = false,
-}) => {
-  const { t } = useTranslation();
-  if (!show) {
-    return null;
-  }
-
-  const toneStyle = toneStyles[tone] ?? toneStyles.info;
-  const resolvedTextColor = textColor ?? toneStyle.text;
-  const handleDismiss = () => {
-    onDismiss?.();
-  };
-
-  const iconSize = compact ? "1rem" : "1.2rem";
-  const textSize = compact ? "xs" : "sm";
-
-  return (
-    <Paper
-      p={compact ? "xs" : "sm"}
-      radius={0}
-      style={{
-        background: background ?? toneStyle.background,
-        border: "none",
-        borderBottom:
-          borderColor === "transparent"
-            ? "none"
-            : `1px solid ${borderColor ?? toneStyle.border}`,
-        minHeight,
-        display: "flex",
-        alignItems: "center",
-      }}
-    >
-      <Group
-        gap="sm"
-        align="center"
-        wrap="nowrap"
-        justify="space-between"
-        style={{ width: "100%" }}
-      >
-        <Group
-          gap={compact ? "xs" : "sm"}
-          align="center"
-          wrap="nowrap"
-          style={{ flex: 1, minWidth: 0 }}
-        >
-          {icon != null &&
-            (typeof icon === "string" ? (
-              <LocalIcon
-                icon={icon}
-                width={iconSize}
-                height={iconSize}
-                style={{ color: iconColor ?? toneStyle.icon, flexShrink: 0 }}
-              />
-            ) : (
-              <div
-                style={{ flexShrink: 0, display: "flex", alignItems: "center" }}
-              >
-                {icon}
-              </div>
-            ))}
-          <Stack gap={compact ? 1 : 2} style={{ flex: 1, minWidth: 0 }}>
-            {title && (
-              <Text
-                fw={600}
-                size={textSize}
-                style={{ color: resolvedTextColor }}
-              >
-                {title}
-              </Text>
-            )}
-            <Text
-              fw={title ? 400 : 500}
-              size={textSize}
-              style={{ color: resolvedTextColor }}
-              lineClamp={compact ? 1 : 2}
-            >
-              {message}
-            </Text>
-          </Stack>
-        </Group>
-        <Group gap="xs" align="center" wrap="nowrap">
-          {buttonText && onButtonClick && (
-            <Button
-              variant={toSharedButtonVariant(buttonVariant)}
-              accent={toSharedButtonAccent(
-                buttonColor ?? toneStyle.buttonColor,
-              )}
-              size="sm"
-              loading={loading}
-              onClick={onButtonClick}
-              leftSection={
-                <LocalIcon
-                  icon={buttonIcon}
-                  width={compact ? "0.75rem" : "0.9rem"}
-                  height={compact ? "0.75rem" : "0.9rem"}
-                />
-              }
-              style={buttonTextColor ? { color: buttonTextColor } : undefined}
-            >
-              {buttonText}
-            </Button>
-          )}
-          {secondaryButtonText && onSecondaryButtonClick && (
-            <Button
-              variant="tertiary"
-              accent="neutral"
-              size="sm"
-              onClick={onSecondaryButtonClick}
-              style={{ color: "var(--c-text-muted)" }}
-            >
-              {secondaryButtonText}
-            </Button>
-          )}
-          {dismissible && (
-            <ActionIcon
-              variant="tertiary"
-              accent="neutral"
-              size="sm"
-              onClick={handleDismiss}
-              aria-label={t("infoBanner.dismiss", "Dismiss")}
-              style={{
-                color: closeIconColor ?? "var(--c-text-muted)",
-              }}
-            >
-              <LocalIcon
-                icon="close-rounded"
-                width={compact ? "0.85rem" : "1rem"}
-                height={compact ? "0.85rem" : "1rem"}
-              />
-            </ActionIcon>
-          )}
-        </Group>
-      </Group>
-    </Paper>
-  );
-};
diff --git a/frontend/editor/src/core/components/shared/LandingActions.tsx b/frontend/editor/src/core/components/shared/LandingActions.tsx
index d69f90a1ef..750848f3c7 100644
--- a/frontend/editor/src/core/components/shared/LandingActions.tsx
+++ b/frontend/editor/src/core/components/shared/LandingActions.tsx
@@ -32,8 +32,7 @@ export function LandingActions({
     <>
       <Group gap="sm" justify="center" wrap="wrap" mb="xs">
         <Button
-          className="landing-btn-primary"
-          px="xl"
+          fat
           leftSection={
             <LocalIcon icon={icons.uploadIconName} width="1rem" height="1rem" />
           }
@@ -47,8 +46,7 @@ export function LandingActions({
 
         <Button
           variant="secondary"
-          className="landing-btn-secondary"
-          px="xl"
+          fat
           leftSection={<LocalIcon icon="add" width="1rem" height="1rem" />}
           onClick={(e) => {
             e.stopPropagation();
@@ -64,7 +62,7 @@ export function LandingActions({
               size="lg"
               variant="secondary"
               aria-label={terminology.mobileUpload}
-              className="landing-btn-secondary landing-btn-icon"
+              className="landing-btn-icon"
               onClick={(e) => {
                 e.stopPropagation();
                 onMobileUploadClick();
diff --git a/frontend/editor/src/core/components/shared/LandingPage.css b/frontend/editor/src/core/components/shared/LandingPage.css
index b64a7d55f9..b7afc537f0 100644
--- a/frontend/editor/src/core/components/shared/LandingPage.css
+++ b/frontend/editor/src/core/components/shared/LandingPage.css
@@ -136,18 +136,8 @@
 }
 
 /* ── Action buttons ──────────────────────────────────────── */
-.landing-btn-primary,
-.landing-btn-secondary {
-  border-radius: 0.75rem !important;
-  font-weight: 600 !important;
-}
-
-.landing-btn-primary,
-.landing-btn-secondary,
 .landing-btn-icon {
   min-height: 3rem !important;
-}
-.landing-btn-icon {
   width: 3rem !important;
   min-width: 3rem !important;
   border-radius: 0.75rem !important;
diff --git a/frontend/editor/src/core/components/shared/PolicyEnforcingOverlay.tsx b/frontend/editor/src/core/components/shared/PolicyEnforcingOverlay.tsx
index 9d5d2475b3..cdb51952f0 100644
--- a/frontend/editor/src/core/components/shared/PolicyEnforcingOverlay.tsx
+++ b/frontend/editor/src/core/components/shared/PolicyEnforcingOverlay.tsx
@@ -6,6 +6,9 @@ export function PolicyEnforcingOverlay(_props: {
   accentVar?: string;
   /** Category of the enforcing policy — picks its icon in the real overlay. */
   categoryId?: string;
+  /** Shows a dismiss control in the real overlay, so a run that never settles
+   *  can't leave the surface underneath permanently unclickable. */
+  onDismiss?: () => void;
 }) {
   return null;
 }
diff --git a/frontend/editor/src/core/components/shared/TextInput.tsx b/frontend/editor/src/core/components/shared/TextInput.tsx
index 06147fb99b..7d927bb011 100644
--- a/frontend/editor/src/core/components/shared/TextInput.tsx
+++ b/frontend/editor/src/core/components/shared/TextInput.tsx
@@ -36,6 +36,13 @@ export interface TextInputProps {
   readOnly?: boolean;
   /** Accessibility label */
   "aria-label"?: string;
+  /** ARIA role override (e.g. "combobox" for inputs driving a listbox). */
+  role?: React.AriaRole;
+  /** Combobox wiring — forwarded to the native input. */
+  "aria-expanded"?: boolean;
+  "aria-controls"?: string;
+  "aria-activedescendant"?: string;
+  "aria-autocomplete"?: React.AriaAttributes["aria-autocomplete"];
   /** Focus event handler */
   onFocus?: () => void;
   /** Allow the icon to receive pointer events (e.g. when icon is a clickable button) */
diff --git a/frontend/editor/src/core/components/shared/WorkbenchBar.css b/frontend/editor/src/core/components/shared/WorkbenchBar.css
index b324fd8222..f805f69721 100644
--- a/frontend/editor/src/core/components/shared/WorkbenchBar.css
+++ b/frontend/editor/src/core/components/shared/WorkbenchBar.css
@@ -2,11 +2,17 @@
 /* Horizontal toolbar at the top of the workbench area. */
 
 .workbench-bar {
+  /* Flex-wrap layout that reflows by content width (measured in JS, which sets
+     data-wrapped). Roomy: row 1 is [views | search | globals] and the tool
+     icons sit on their own full-width row below. Crowded (data-wrapped): the
+     search bumps to its own row, leaving [views | globals] on row 1 and the
+     tools on row 3 — three rows total. `order` drives the reflow. */
   display: flex;
   flex-wrap: wrap;
   align-items: center;
   align-content: flex-start;
-  min-height: 40px;
+  column-gap: 8px;
+  min-height: 38px;
   padding: 0 8px;
   /* No left margin: the file sidebar's own 0.5rem padding already provides the
      gutter on that side, so adding one here would double it and leave the bar
@@ -21,12 +27,16 @@
 
 /* ---- View switcher (left) ---- */
 .workbench-bar-views {
+  order: 1;
+  flex-shrink: 0;
   display: flex;
   align-items: center;
   gap: 2px;
-  flex-shrink: 0;
-  order: 1;
-  height: 40px;
+  /* min-width:0 lets it shrink instead of forcing a wrap; overflow clips labels
+     on very narrow viewports. */
+  min-width: 0;
+  overflow: hidden;
+  height: 38px;
   z-index: 0;
 }
 
@@ -34,7 +44,7 @@
   display: inline-flex;
   align-items: center;
   gap: 6px;
-  padding: 4px 10px;
+  padding: 2px 8px;
   border: none;
   border-radius: 8px;
   background: transparent;
@@ -86,27 +96,47 @@
   height: 16px;
 }
 
-/* ---- Center: tool buttons ---- */
-
-/* Single-row: center sits between views and globals */
-.workbench-bar-center {
+/* ---- Super search ---- */
+/* Roomy: grows to fill the centre between views and globals. */
+.workbench-bar-search {
   order: 2;
   flex: 1 1 auto;
   min-width: 0;
   display: flex;
   align-items: center;
   justify-content: center;
-  gap: 2px;
-  height: 40px;
-  overflow: hidden;
+  height: 38px;
+  transform: translateX(var(--workbench-bar-search-offset, 0px));
 }
 
-/* Two-row: center drops below views+globals */
-.workbench-bar[data-wrapped="true"] .workbench-bar-center {
+.workbench-bar-search .super-search {
+  flex: 0 1 24rem;
+  width: min(100%, 24rem);
+  max-width: 24rem;
+}
+
+.workbench-bar-search .super-search input {
+  background-color: transparent;
+  padding-top: 4px;
+  padding-bottom: 4px;
+  font-size: 12.5px;
+}
+
+[data-mantine-color-scheme="dark"] .workbench-bar-search .super-search input {
+  background-color: transparent;
+}
+
+/* Crowded: drops to its own full-width row between the top row and the tools. */
+.workbench-bar[data-wrapped="true"] .workbench-bar-search {
   order: 3;
   flex: 0 0 100%;
   height: auto;
   padding: 4px 0;
+  transform: none;
+}
+
+/* Two-row: the tool row scrolls sideways instead of wrapping. */
+.workbench-bar[data-wrapped="true"] .workbench-bar-center {
   border-top: 1px solid var(--c-border-subtle);
   justify-content: flex-start;
   overflow-x: auto;
@@ -118,21 +148,68 @@
   flex-shrink: 0;
 }
 
-/* ---- Right: global buttons (theme / language / download) ---- */
+/* ---- Tool buttons (own full-width row, always below the top row) ---- */
+.workbench-bar-center {
+  order: 4;
+  flex: 0 0 100%;
+  position: relative;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-wrap: wrap;
+  gap: 2px;
+  /* Symmetric side padding leaves room for the retract handle pinned right
+     without knocking the centred tool icons off-centre. */
+  padding: 4px 36px;
+  border-top: 1px solid var(--c-border-subtle);
+}
+
+/* Retract / reopen handle for the viewer tool row. */
+.workbench-bar-toolbar-handle {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: none;
+  border-radius: 6px;
+  background: transparent;
+  color: var(--c-text-subtle);
+  cursor: pointer;
+  padding: 0;
+  transition:
+    color 0.15s ease,
+    background-color 0.15s ease;
+}
+
+.workbench-bar-toolbar-handle:hover {
+  color: var(--c-text);
+  background: var(--c-hover);
+}
+
+/* Pinned to the right edge of the tool row. */
+.workbench-bar-toolbar-handle-retract {
+  position: absolute;
+  right: 6px;
+  top: 50%;
+  transform: translateY(-50%);
+  width: 28px;
+  height: 28px;
+}
+
+/* ---- Right: global buttons (print / download / save / close), row 1 ---- */
 .workbench-bar-globals {
+  order: 3;
+  flex-shrink: 0;
   display: flex;
   align-items: center;
   gap: 2px;
-  flex-shrink: 0;
-  order: 3;
-  height: 40px;
+  min-width: 0;
+  height: 38px;
   margin-left: auto;
 }
 
-/* In two-row mode globals moves to row 1 right side */
+/* Crowded: globals stays on row 1, moving up beside the views. */
 .workbench-bar[data-wrapped="true"] .workbench-bar-globals {
   order: 2;
-  margin-left: auto;
 }
 
 /* Shared action icon style - applies to both center and global buttons.
diff --git a/frontend/editor/src/core/components/shared/WorkbenchBar.tsx b/frontend/editor/src/core/components/shared/WorkbenchBar.tsx
index 55ca01d307..241d658bad 100644
--- a/frontend/editor/src/core/components/shared/WorkbenchBar.tsx
+++ b/frontend/editor/src/core/components/shared/WorkbenchBar.tsx
@@ -1,6 +1,6 @@
 import React, {
   useCallback,
-  useEffect,
+  useLayoutEffect,
   useMemo,
   useRef,
   useSyncExternalStore,
@@ -33,6 +33,8 @@ import { ViewerContext, useViewer } from "@app/contexts/ViewerContext";
 import { WorkbenchType, isBaseWorkbench } from "@app/types/workbench";
 import { Tooltip } from "@app/components/shared/Tooltip";
 import LocalIcon from "@app/components/shared/LocalIcon";
+import SuperSearch from "@app/components/shared/superSearch/SuperSearch";
+import { useEditorSearchScopes } from "@app/hooks/useSuperSearch";
 import ViewerShareButton from "@app/components/viewer/ViewerShareButton";
 import { useSharingEnabled } from "@app/hooks/useSharingEnabled";
 import { usePolicyFileBadges } from "@app/hooks/usePolicyFileBadges";
@@ -53,6 +55,7 @@ import InsertDriveFileOutlinedIcon from "@mui/icons-material/InsertDriveFileOutl
 import FolderOutlinedIcon from "@mui/icons-material/FolderOutlined";
 import CloseIcon from "@mui/icons-material/Close";
 import PrintIcon from "@mui/icons-material/Print";
+import KeyboardArrowUpIcon from "@mui/icons-material/KeyboardArrowUp";
 import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
 import "@app/components/shared/WorkbenchBar.css";
 
@@ -68,6 +71,10 @@ interface WorkbenchBarProps {
   currentView: WorkbenchType;
   setCurrentView: (view: WorkbenchType) => void;
   hasFiles: boolean;
+  /** Whether the viewer's tool row is currently retracted. */
+  viewerToolbarCollapsed?: boolean;
+  /** Setter for the viewer tool-row retract state (owned by Workbench). */
+  onCollapseViewerToolbar?: (collapsed: boolean) => void;
 }
 
 function renderWithTooltip(
@@ -92,9 +99,12 @@ export default function WorkbenchBar({
   currentView,
   setCurrentView,
   hasFiles,
+  viewerToolbarCollapsed = false,
+  onCollapseViewerToolbar,
 }: WorkbenchBarProps) {
   const { t } = useTranslation();
   const navigate = useNavigate();
+  const searchScopes = useEditorSearchScopes();
   const returnRoute = useSyncExternalStore(
     subscribeFilesPageReturnRoute,
     getFilesPageReturnRoute,
@@ -115,6 +125,7 @@ export default function WorkbenchBar({
   } = useToolWorkflow();
   const { selectedTool } = useNavigationState();
   const isCustomView = !isBaseWorkbench(currentView);
+  const isViewer = currentView === "viewer";
   const disableForFullscreen =
     toolPanelMode === "fullscreen" && leftPanelView === "toolPicker";
   const terminology = useFileActionTerminology();
@@ -435,34 +446,47 @@ export default function WorkbenchBar({
       })),
   ];
 
+  // Reflow the top row by content width: when the views + globals leave too
+  // little room for a usable search, bump the search to its own row
   const barRef = useRef<HTMLDivElement>(null);
-
-  useEffect(() => {
+  useLayoutEffect(() => {
     const bar = barRef.current;
     if (!bar) return;
-
+    const MIN_SEARCH_WIDTH = 320;
     const measure = () => {
       const viewsEl = bar.querySelector<HTMLElement>(".workbench-bar-views");
       const globalsEl = bar.querySelector<HTMLElement>(
         ".workbench-bar-globals",
       );
-      const centerEl = bar.querySelector<HTMLElement>(".workbench-bar-center");
-
       const viewsWidth = viewsEl?.offsetWidth ?? 0;
       const globalsWidth = globalsEl?.offsetWidth ?? 0;
-      const centerChildren = centerEl
-        ? (Array.from(centerEl.children) as HTMLElement[])
-        : [];
-      const centerWidth =
-        centerChildren.reduce((sum, el) => sum + el.offsetWidth, 0) +
-        Math.max(0, centerChildren.length - 1) * 2; // gap: 2px
-
-      const needed = viewsWidth + centerWidth + globalsWidth + 24; // 24px bar padding
-      bar.dataset.wrapped = String(needed > bar.clientWidth);
+      // clientWidth minus the two side clusters, the bar's 16px h-padding and
+      // the two 8px column gaps flanking the search.
+      const available = bar.clientWidth - viewsWidth - globalsWidth - 16 - 16;
+      const wrapped = available < MIN_SEARCH_WIDTH;
+      bar.dataset.wrapped = String(wrapped);
+      // Centre the search on the bar rather than its slot — clamped to the
+      // slot's spare width, because the shift is a transform (no layout) and
+      // an unclamped value would paint the pill over the adjacent cluster.
+      const slotEl = bar.querySelector<HTMLElement>(".workbench-bar-search");
+      const pillEl = slotEl?.querySelector<HTMLElement>(".super-search");
+      const slack = Math.max(
+        0,
+        ((slotEl?.offsetWidth ?? 0) - (pillEl?.offsetWidth ?? 0)) / 2,
+      );
+      const centred = (globalsWidth - viewsWidth) / 2;
+      const offset = Math.min(slack, Math.max(-slack, centred));
+      bar.style.setProperty(
+        "--workbench-bar-search-offset",
+        wrapped ? "0px" : `${offset}px`,
+      );
     };
-
     const ro = new ResizeObserver(measure);
     ro.observe(bar);
+    const viewsEl = bar.querySelector<HTMLElement>(".workbench-bar-views");
+    const globalsEl = bar.querySelector<HTMLElement>(".workbench-bar-globals");
+    if (viewsEl) ro.observe(viewsEl);
+    if (globalsEl) ro.observe(globalsEl);
     measure();
     return () => ro.disconnect();
   }, []);
@@ -471,7 +495,7 @@ export default function WorkbenchBar({
     <div
       ref={barRef}
       className="workbench-bar"
-      data-wrapped="true"
+      data-wrapped="false"
       data-tour="workbench-bar"
     >
       {/* Left: optional "Back to My Files" + view switcher */}
@@ -524,27 +548,50 @@ export default function WorkbenchBar({
         )}
       </div>
 
-      {/* Tool buttons - second row, only rendered when buttons exist */}
-      {sectionsWithButtons.length > 0 && (
-        <div className="workbench-bar-center">
-          {sectionsWithButtons.map(
-            ({ section, buttons: sectionButtons }, idx) => (
-              <React.Fragment key={section}>
-                {idx > 0 && <div className="workbench-bar-divider" />}
-                {sectionButtons.map((btn) => {
-                  const content = renderButton(btn);
-                  if (!content) return null;
-                  return (
-                    <div key={btn.id} className="workbench-bar-action-wrapper">
-                      {content}
-                    </div>
-                  );
-                })}
-              </React.Fragment>
-            ),
-          )}
-        </div>
-      )}
+      {/* Global super search - always present, even on the homepage */}
+      <div className="workbench-bar-search">
+        <SuperSearch scopes={searchScopes} />
+      </div>
+
+      {/* Tool buttons - second row, only rendered when buttons exist. In the
+          viewer the row is retractable: a handle on its right edge hides the
+          whole row; Workbench then shows a tab below the bar to bring it back. */}
+      {sectionsWithButtons.length > 0 &&
+        !(isViewer && viewerToolbarCollapsed) && (
+          <div className="workbench-bar-center">
+            {sectionsWithButtons.map(
+              ({ section, buttons: sectionButtons }, idx) => (
+                <React.Fragment key={section}>
+                  {idx > 0 && <div className="workbench-bar-divider" />}
+                  {sectionButtons.map((btn) => {
+                    const content = renderButton(btn);
+                    if (!content) return null;
+                    return (
+                      <div
+                        key={btn.id}
+                        className="workbench-bar-action-wrapper"
+                      >
+                        {content}
+                      </div>
+                    );
+                  })}
+                </React.Fragment>
+              ),
+            )}
+            {isViewer && onCollapseViewerToolbar && (
+              <Button
+                type="button"
+                variant="quiet"
+                className="workbench-bar-toolbar-handle workbench-bar-toolbar-handle-retract"
+                onClick={() => onCollapseViewerToolbar(true)}
+                aria-expanded
+                aria-label={t("workbenchBar.hideToolbar", "Hide toolbar")}
+                title={t("workbenchBar.hideToolbar", "Hide toolbar")}
+                leftSection={<KeyboardArrowUpIcon sx={{ fontSize: "1rem" }} />}
+              />
+            )}
+          </div>
+        )}
 
       {/* Right: Global buttons - export group left, close anchored right */}
       <div className="workbench-bar-globals">
diff --git a/frontend/editor/src/core/components/shared/config/SettingsSearchBar.stories.tsx b/frontend/editor/src/core/components/shared/config/SettingsSearchBar.stories.tsx
deleted file mode 100644
index 28d5a1c3e0..0000000000
--- a/frontend/editor/src/core/components/shared/config/SettingsSearchBar.stories.tsx
+++ /dev/null
@@ -1,62 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { SettingsSearchBar } from "@app/components/shared/config/SettingsSearchBar";
-import type { ConfigNavSection } from "@app/components/shared/config/configNavSections";
-
-const mockConfigNavSections: ConfigNavSection[] = [
-  {
-    title: "Preferences",
-    items: [
-      {
-        key: "general",
-        label: "General",
-        icon: "settings-rounded",
-        component: null,
-      },
-      {
-        key: "hotkeys",
-        label: "Keyboard Shortcuts",
-        icon: "keyboard-rounded",
-        component: null,
-      },
-    ],
-  },
-  {
-    title: "Workspace",
-    items: [
-      {
-        key: "people",
-        label: "People",
-        icon: "group-rounded",
-        component: null,
-      },
-      {
-        key: "teams",
-        label: "Teams",
-        icon: "groups-rounded",
-        component: null,
-        disabled: true,
-      },
-    ],
-  },
-];
-
-const meta = {
-  title: "Shared/Config/SettingsSearchBar",
-  component: SettingsSearchBar,
-  parameters: { layout: "padded" },
-  args: {
-    configNavSections: mockConfigNavSections,
-    onNavigate: async () => {},
-    isMobile: false,
-  },
-} satisfies Meta<typeof SettingsSearchBar>;
-export default meta;
-type Story = StoryObj<typeof meta>;
-
-export const Default: Story = {};
-
-export const Mobile: Story = {
-  args: {
-    isMobile: true,
-  },
-};
diff --git a/frontend/editor/src/core/components/shared/config/SettingsSearchBar.tsx b/frontend/editor/src/core/components/shared/config/SettingsSearchBar.tsx
deleted file mode 100644
index 397347dcf6..0000000000
--- a/frontend/editor/src/core/components/shared/config/SettingsSearchBar.tsx
+++ /dev/null
@@ -1,240 +0,0 @@
-import React, { useMemo, useState, useCallback } from "react";
-import { Select, Text } from "@mantine/core";
-import { useTranslation } from "react-i18next";
-import LocalIcon from "@app/components/shared/LocalIcon";
-import { NavKey, VALID_NAV_KEYS } from "@app/components/shared/config/types";
-import { Z_INDEX_OVER_CONFIG_MODAL } from "@app/styles/zIndex";
-import type {
-  ConfigNavSection,
-  ConfigNavItem,
-} from "@app/components/shared/config/configNavSections";
-
-interface SettingsSearchBarProps {
-  configNavSections: ConfigNavSection[];
-  onNavigate: (key: NavKey) => Promise<void>;
-  isMobile: boolean;
-}
-
-interface SettingsSearchOption {
-  value: NavKey;
-  label: string;
-  sectionTitle: string;
-  destinationPath: string;
-  searchableContent: string[];
-  matchedContext?: string;
-}
-
-const SETTINGS_SEARCH_TRANSLATION_PREFIXES: Partial<Record<string, string[]>> =
-  {
-    general: ["settings.general"],
-    hotkeys: ["settings.hotkeys"],
-    account: ["account"],
-    people: ["settings.workspace"],
-    teams: ["settings.workspace", "settings.team"],
-    "api-keys": ["settings.developer"],
-    connectionMode: ["settings.connection"],
-    planBilling: ["settings.planBilling"],
-    adminGeneral: ["admin.settings.general"],
-    adminFeatures: ["admin.settings.features"],
-    adminEndpoints: ["admin.settings.endpoints"],
-    adminDatabase: ["admin.settings.database"],
-    adminAdvanced: ["admin.settings.advanced"],
-    adminSecurity: ["admin.settings.security"],
-    adminMcp: ["admin.settings.mcp"],
-    adminConnections: [
-      "admin.settings.connections",
-      "admin.settings.mail",
-      "admin.settings.security",
-      "admin.settings.telegram",
-      "admin.settings.premium",
-      "admin.settings.general",
-      "settings.securityAuth",
-      "settings.connection",
-    ],
-    adminPlan: [
-      "settings.planBilling",
-      "admin.settings.premium",
-      "settings.licensingAnalytics",
-    ],
-    adminAudit: ["settings.licensingAnalytics"],
-    adminUsage: ["settings.licensingAnalytics"],
-    adminLegal: ["admin.settings.legal"],
-    adminPrivacy: ["admin.settings.privacy"],
-  };
-
-const getTranslationPrefixesForNavKey = (key: string): string[] => {
-  const explicitPrefixes = SETTINGS_SEARCH_TRANSLATION_PREFIXES[key] ?? [];
-
-  const inferredPrefixes: string[] = [];
-
-  if (key.startsWith("admin")) {
-    const adminSuffix = key.replace(/^admin/, "");
-    const normalizedAdminSuffix =
-      adminSuffix.charAt(0).toLowerCase() + adminSuffix.slice(1);
-    inferredPrefixes.push(`admin.settings.${normalizedAdminSuffix}`);
-  } else {
-    inferredPrefixes.push(`settings.${key}`);
-  }
-
-  return Array.from(new Set([...explicitPrefixes, ...inferredPrefixes]));
-};
-
-const flattenTranslationStrings = (value: unknown): string[] => {
-  if (typeof value === "string") {
-    const trimmed = value.trim();
-    return trimmed ? [trimmed] : [];
-  }
-
-  if (Array.isArray(value)) {
-    return value.flatMap(flattenTranslationStrings);
-  }
-
-  if (value && typeof value === "object") {
-    return Object.values(value as Record<string, unknown>).flatMap(
-      flattenTranslationStrings,
-    );
-  }
-
-  return [];
-};
-
-const buildMatchSnippet = (text: string, query: string): string => {
-  const normalizedText = text.toLocaleLowerCase();
-  const normalizedQuery = query.toLocaleLowerCase();
-  const matchIndex = normalizedText.indexOf(normalizedQuery);
-
-  if (matchIndex === -1) {
-    return text;
-  }
-
-  const maxLength = 84;
-  const contextPadding = 28;
-  const start = Math.max(0, matchIndex - contextPadding);
-  const end = Math.min(text.length, matchIndex + query.length + contextPadding);
-  const snippet = text.slice(start, end);
-
-  if (snippet.length <= maxLength) {
-    return `${start > 0 ? "…" : ""}${snippet}${end < text.length ? "…" : ""}`;
-  }
-
-  return `${start > 0 ? "…" : ""}${snippet.slice(0, maxLength)}${end < text.length ? "…" : ""}`;
-};
-
-export const SettingsSearchBar: React.FC<SettingsSearchBarProps> = ({
-  configNavSections,
-  onNavigate,
-  isMobile,
-}) => {
-  const { t } = useTranslation();
-  const [searchValue, setSearchValue] = useState("");
-
-  // Build a global index from every accessible settings tab in the modal navigation.
-  // This does not render section components, so API calls still happen only when a tab is opened.
-  const searchableSections = useMemo<SettingsSearchOption[]>(() => {
-    return configNavSections.flatMap((section) =>
-      section.items
-        .filter((item: ConfigNavItem) => !item.disabled)
-        .map((item: ConfigNavItem) => {
-          const translationPrefixes = getTranslationPrefixesForNavKey(item.key);
-          const translationContent = translationPrefixes.flatMap((prefix) =>
-            flattenTranslationStrings(
-              t(prefix, { returnObjects: true, defaultValue: {} }),
-            ),
-          );
-
-          const searchableContent = Array.from(
-            new Set([
-              item.label,
-              section.title,
-              `/settings/${item.key}`,
-              ...translationContent,
-            ]),
-          );
-
-          return {
-            value: item.key,
-            label: item.label,
-            sectionTitle: section.title,
-            destinationPath: `/settings/${item.key}`,
-            searchableContent,
-          };
-        }),
-    );
-  }, [configNavSections, t]);
-
-  const filteredSearchableSections = useMemo<SettingsSearchOption[]>(() => {
-    const query = searchValue.trim();
-    if (!query) {
-      return searchableSections;
-    }
-
-    const normalizedQuery = query.toLocaleLowerCase();
-
-    return searchableSections.reduce<SettingsSearchOption[]>(
-      (accumulator, option) => {
-        const matchedEntry = option.searchableContent.find((entry) =>
-          entry.toLocaleLowerCase().includes(normalizedQuery),
-        );
-
-        if (!matchedEntry) {
-          return accumulator;
-        }
-
-        accumulator.push({
-          ...option,
-          matchedContext: buildMatchSnippet(matchedEntry, query),
-        });
-
-        return accumulator;
-      },
-      [],
-    );
-  }, [searchValue, searchableSections]);
-
-  const handleSearchNavigation = useCallback(
-    async (value: string | null) => {
-      if (!value) return;
-      if (!VALID_NAV_KEYS.includes(value as NavKey)) return;
-      await onNavigate(value as NavKey);
-      setSearchValue("");
-    },
-    [onNavigate],
-  );
-
-  return (
-    <Select
-      className="settings-search-select"
-      data={filteredSearchableSections}
-      value={null}
-      searchValue={searchValue}
-      onSearchChange={setSearchValue}
-      onChange={handleSearchNavigation}
-      placeholder={t("settings.search.placeholder", "Search settings pages...")}
-      leftSection={<LocalIcon icon="search-rounded" width={16} height={16} />}
-      aria-label={t("navbar.search", "Search")}
-      nothingFoundMessage={t("search.noResults", "No results found")}
-      searchable
-      clearable={false}
-      w={isMobile ? 170 : 320}
-      filter={({ options }) => options}
-      renderOption={({ option }) => {
-        const searchOption = option as unknown as SettingsSearchOption;
-        return (
-          <div className="settings-search-option">
-            <Text size="sm" fw={600}>
-              {searchOption.label}
-            </Text>
-            <Text size="xs" c="dimmed">
-              {searchOption.sectionTitle} ·{" "}
-              {searchOption.matchedContext || searchOption.destinationPath}
-            </Text>
-          </div>
-        );
-      }}
-      comboboxProps={{
-        withinPortal: true,
-        zIndex: Z_INDEX_OVER_CONFIG_MODAL,
-      }}
-    />
-  );
-};
diff --git a/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
index 2bab0667de..116822fe6f 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
@@ -478,6 +478,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
       <Paper withBorder p="md" radius="md">
         <Stack gap="md">
           <div
+            id="setting-theme"
             style={{
               display: "flex",
               alignItems: "center",
@@ -520,6 +521,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
       {/* Language */}
       <Paper withBorder p="md" radius="md">
         <div
+          id="setting-language"
           style={{
             display: "flex",
             alignItems: "center",
@@ -544,6 +546,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
       <Paper withBorder p="md" radius="md">
         <Stack gap="md">
           <div
+            id="setting-tool-picker-mode"
             style={{
               display: "flex",
               alignItems: "center",
@@ -582,6 +585,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
             />
           </div>
           <div
+            id="setting-startup-view"
             style={{
               display: "flex",
               alignItems: "center",
@@ -624,6 +628,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
             />
           </div>
           <div
+            id="setting-reader-zoom"
             style={{
               display: "flex",
               alignItems: "center",
@@ -680,6 +685,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
             />
           </div>
           <div
+            id="setting-hide-unavailable-tools"
             style={{
               display: "flex",
               alignItems: "center",
@@ -712,6 +718,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
             />
           </div>
           <div
+            id="setting-hide-unavailable-conversions"
             style={{
               display: "flex",
               alignItems: "center",
@@ -753,6 +760,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
             withArrow
           >
             <div
+              id="setting-auto-unzip"
               style={{
                 display: "flex",
                 alignItems: "center",
@@ -791,6 +799,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
             withArrow
           >
             <div
+              id="setting-auto-unzip-file-limit"
               style={{
                 display: "flex",
                 alignItems: "center",
diff --git a/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.tsx
index 563cd286f1..54c672ca1f 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.tsx
@@ -146,7 +146,7 @@ const HotkeysSection: React.FC = () => {
 
   return (
     <Stack gap="lg">
-      <div>
+      <div id="setting-hotkeys-search">
         <Text fw={600} size="lg">
           {t("settings.hotkeys.title", "Keyboard Shortcuts")}
         </Text>
diff --git a/frontend/editor/src/core/components/shared/navFooter/NavFooter.css b/frontend/editor/src/core/components/shared/navFooter/NavFooter.css
new file mode 100644
index 0000000000..aa2688cd35
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/navFooter/NavFooter.css
@@ -0,0 +1,156 @@
+/* Shared sidebar footer: one surface holding the link-account CTA, the credits
+   meter, the other-app switch and the account row, hairline-separated.
+   Structural only — every colour comes from a --c-* semantic token. */
+
+.nav-footer {
+  display: flex;
+  flex-direction: column;
+  flex-shrink: 0;
+  /* Vertical only: the slots carry the horizontal padding so their separator
+     runs the full width of the surface. */
+  padding: 0.25rem 0;
+  overflow: hidden;
+}
+
+.nav-footer__slot {
+  padding-inline: 0.375rem;
+}
+
+/* Separators are drawn by the slots themselves, never as their own elements.
+   A slot whose contents render nothing (the link-account CTA returns null once
+   the org is linked, and an element is truthy even when it renders null) is
+   :empty, so it is skipped by both rules below — it can't leave a line behind,
+   and it can't push one to the top or bottom of the surface. A rule that only
+   ever matches a slot PRECEDED by another visible slot cannot draw a leading
+   separator, whatever the caller passes in. */
+.nav-footer__slot:empty {
+  display: none;
+}
+
+.nav-footer__slot:not(:empty) ~ .nav-footer__slot:not(:empty) {
+  border-top: 1px solid var(--c-border-subtle);
+  margin-top: 0.25rem;
+  padding-top: 0.25rem;
+}
+
+/* Fades the rows up on the first footer mount of a page session only. They are
+   seeded from cache, so they're already present at first paint; replaying this
+   on every later mount (switching apps, remounting a view) would animate
+   content that never changed and read as a twitch. */
+@keyframes nav-footer-row-in {
+  from {
+    opacity: 0;
+    transform: translateY(0.25rem);
+  }
+  to {
+    opacity: 1;
+    transform: none;
+  }
+}
+
+.nav-footer[data-animate] .nav-footer__slot:not(:empty) {
+  animation: nav-footer-row-in var(--motion-enter) both;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .nav-footer[data-animate] .nav-footer__slot:not(:empty) {
+    animation: none;
+  }
+}
+
+/* ---- Rows (link-account, credits, switch, account) ---- */
+
+.nav-footer__row {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  width: 100%;
+  min-height: 2.25rem;
+  padding: 0.25rem 0.375rem;
+  border: 0;
+  border-radius: 0.5rem;
+  background: none;
+  color: var(--c-text);
+  font: inherit;
+  text-align: left;
+  cursor: pointer;
+}
+
+.nav-footer__row:disabled {
+  cursor: default;
+}
+
+.nav-footer__row:not(:disabled):hover {
+  background-color: var(--c-hover);
+}
+
+.nav-footer__row:focus-visible {
+  outline: 2px solid var(--c-primary);
+  outline-offset: -2px;
+}
+
+.nav-footer__row-icon {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+  width: 1.625rem;
+}
+
+/* Hovering the switch row plays the mark's "thinking" drift once — the same
+   motion the chat FAB loops, for a single beat, as a hint that the row hands
+   off to the other app. One iteration only: it starts and ends at rest, so
+   nothing snaps when it finishes, and re-entering the row replays it. */
+.nav-footer__row:hover .sui-brandmark__a {
+  animation: sui-brandmark-drift-a 1.1s ease-in-out 1;
+}
+.nav-footer__row:hover .sui-brandmark__b {
+  animation: sui-brandmark-drift-b 1.1s ease-in-out 1;
+}
+
+.nav-footer__row-label {
+  flex: 1;
+  min-width: 0;
+  font-size: 0.8125rem;
+  font-weight: 500;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+/* Trailing affordance on a row: the account row's gear, the switch row's
+   leaving-this-app arrow. */
+.nav-footer__trailing {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+  margin-left: auto;
+  color: var(--c-text-subtle);
+}
+
+/* Rows contributed by a caller (the link-account NavItem) sit in the same
+   surface, so match this footer's row metrics rather than the nav rail's. */
+.nav-footer .sui-navitem {
+  min-height: 2.25rem;
+  padding: 0.25rem 0.375rem;
+  margin: 0;
+  border-radius: 0.5rem;
+  font-size: 0.8125rem;
+}
+
+/* ---- Collapsed icon rail ---- */
+
+.nav-footer[data-collapsed] .nav-footer__slot {
+  padding-inline: 0.25rem;
+}
+
+.nav-footer[data-collapsed] .nav-footer__row {
+  justify-content: center;
+  padding-inline: 0;
+}
+
+.nav-footer[data-collapsed] .sui-navitem {
+  justify-content: center;
+  padding-inline: 0;
+}
diff --git a/frontend/editor/src/core/components/shared/navFooter/NavFooter.stories.tsx b/frontend/editor/src/core/components/shared/navFooter/NavFooter.stories.tsx
new file mode 100644
index 0000000000..31a04be596
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/navFooter/NavFooter.stories.tsx
@@ -0,0 +1,119 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import LinkIcon from "@mui/icons-material/Link";
+import { NavItem } from "@app/ui/NavItem";
+import { NavFooter } from "@app/components/shared/navFooter/NavFooter";
+
+/** Stands in for a CTA that has decided it has nothing to show. */
+function RendersNothing() {
+  return null;
+}
+
+const meta: Meta<typeof NavFooter> = {
+  title: "Shared/NavFooter",
+  component: NavFooter,
+  parameters: { layout: "padded" },
+  args: {
+    displayName: "admin",
+    onOpenSettings: () => {},
+    credits: { remaining: 247, total: 500 },
+    onOpenPlan: () => {},
+    otherApp: { app: "processor", onOpen: () => {} },
+  },
+  decorators: [
+    (S) => (
+      <div
+        style={{
+          width: "16.25rem",
+          background: "var(--c-bg)",
+          padding: "0.5rem",
+        }}
+      >
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof NavFooter>;
+
+/** The editor's footer: credits, "Open PDF Processor", the account row. */
+export const InEditor: Story = {};
+
+/** The processor's footer. Same three boxes, opposite switch target. */
+export const InProcessor: Story = {
+  args: { otherApp: { app: "editor", onOpen: () => {} } },
+};
+
+/** Self-hosted processor: no wallet, so no meter, and the link-account CTA
+ *  rides along in the account box. */
+export const WithLinkAccountCta: Story = {
+  args: {
+    credits: null,
+    otherApp: { app: "editor", onOpen: () => {} },
+    accountExtras: (
+      <NavItem
+        id="account-link"
+        label="Link Stirling account"
+        icon={<LinkIcon sx={{ fontSize: "1.1rem" }} />}
+      />
+    ),
+  },
+};
+
+/** Regression guard: the processor always passes its link-account CTA, but that
+ *  component renders null once the org is linked. An element is truthy even
+ *  when it renders nothing, so this must not leave a separator above the first
+ *  visible row. */
+export const ExtrasThatRenderNothing: Story = {
+  args: { accountExtras: <RendersNothing /> },
+};
+
+/** A real profile picture replaces the initials disc. */
+export const WithProfilePicture: Story = {
+  args: {
+    displayName: "Ada Lovelace",
+    profilePictureUrl:
+      "data:image/svg+xml;utf8," +
+      encodeURIComponent(
+        '<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64"><rect width="64" height="64" fill="black"/><circle cx="32" cy="24" r="12" fill="white"/><ellipse cx="32" cy="56" rx="20" ry="16" fill="white"/></svg>',
+      ),
+  },
+};
+
+/** Credits running low — the dot and bar shift to the warning tone at 20% left. */
+export const CreditsLow: Story = {
+  args: { credits: { remaining: 42, total: 500 } },
+};
+
+/** Allowance exhausted. */
+export const CreditsExhausted: Story = {
+  args: { credits: { remaining: 0, total: 500 } },
+};
+
+/** Core OSS: no wallet, no second app, settings only. */
+export const MinimalBuild: Story = {
+  args: { credits: null, otherApp: null },
+};
+
+/** No settings handler — the account row is inert identity, not a button. */
+export const NoSettings: Story = {
+  args: { onOpenSettings: undefined },
+};
+
+/** Collapsed icon rail: labels become tooltips. */
+export const Collapsed: Story = {
+  args: { collapsed: true },
+  decorators: [
+    (S) => (
+      <div
+        style={{
+          width: "3.5rem",
+          background: "var(--c-bg)",
+          padding: "0.5rem",
+        }}
+      >
+        <S />
+      </div>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/shared/navFooter/NavFooter.test.tsx b/frontend/editor/src/core/components/shared/navFooter/NavFooter.test.tsx
new file mode 100644
index 0000000000..a32063e56f
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/navFooter/NavFooter.test.tsx
@@ -0,0 +1,58 @@
+import { describe, it, expect } from "vitest";
+import { cleanup, render } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { NavFooter } from "@app/components/shared/navFooter/NavFooter";
+
+/** The footer's tooltips need Mantine's theme context. */
+function withProviders(ui: React.ReactNode) {
+  return <MantineProvider>{ui}</MantineProvider>;
+}
+
+function renderFooter() {
+  const { container } = render(
+    withProviders(
+      <NavFooter
+        displayName="admin"
+        onOpenSettings={() => {}}
+        credits={{ remaining: 247, total: 500 }}
+        otherApp={{ app: "processor", onOpen: () => {} }}
+      />,
+    ),
+  );
+  return container.querySelector(".nav-footer") as HTMLElement;
+}
+
+describe("NavFooter — enter animation", () => {
+  it("plays once per page session, not on every remount", () => {
+    // The rows are seeded from cache, so they're present at first paint. Every
+    // later mount — switching apps, remounting a view — would otherwise replay
+    // the fade on content that never changed, which reads as a twitch.
+    expect(renderFooter().dataset.animate).toBe("true");
+    cleanup();
+    expect(renderFooter().dataset.animate).toBeUndefined();
+    cleanup();
+    expect(renderFooter().dataset.animate).toBeUndefined();
+  });
+});
+
+describe("NavFooter — separators", () => {
+  it("never renders a divider beside a row that renders nothing", () => {
+    // Dividers are CSS between adjacent non-empty slots, so an extras element
+    // that returns null (the linked org's link-account CTA) can't leave a line.
+    const { container } = render(
+      withProviders(
+        <NavFooter
+          displayName="admin"
+          onOpenSettings={() => {}}
+          credits={null}
+          otherApp={null}
+          accountExtras={<>{null}</>}
+        />,
+      ),
+    );
+    const slots = container.querySelectorAll(".nav-footer__slot");
+    const filled = [...slots].filter((s) => s.childElementCount > 0);
+    expect(filled).toHaveLength(1);
+    expect(container.querySelectorAll(".nav-footer__divider")).toHaveLength(0);
+  });
+});
diff --git a/frontend/editor/src/core/components/shared/navFooter/NavFooter.tsx b/frontend/editor/src/core/components/shared/navFooter/NavFooter.tsx
new file mode 100644
index 0000000000..373c91bccf
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/navFooter/NavFooter.tsx
@@ -0,0 +1,213 @@
+import { useState, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { Tooltip } from "@mantine/core";
+import ArrowForwardIcon from "@mui/icons-material/ArrowForward";
+import SettingsIcon from "@mui/icons-material/Settings";
+import { Avatar, NavSurface } from "@app/ui";
+import { BrandMark } from "@app/components/shared/BrandMark";
+import { type AppSwitchTarget } from "@app/components/shared/AppSwitch";
+import {
+  NavFooterCreditsRow,
+  type NavFooterCredits,
+} from "@app/components/shared/navFooter/NavFooterCreditsRow";
+import "@app/components/shared/navFooter/NavFooter.css";
+
+export interface NavFooterAppLink {
+  /** The app this footer is NOT in — the one the row opens. */
+  app: AppSwitchTarget;
+  onOpen: () => void;
+}
+
+export interface NavFooterProps {
+  /** Name shown next to the avatar, and the source of its initials fallback. */
+  displayName: string;
+  /** Profile picture; initials are drawn when absent or the URL fails to load. */
+  profilePictureUrl?: string | null;
+  /** Omit to render the account row as static text (no settings affordance). */
+  onOpenSettings?: () => void;
+  /** Null/undefined hides the meter — builds with no wallet never show it. */
+  credits?: NavFooterCredits | null;
+  /** Opens the plan surface from the credits row; omit to leave it inert. */
+  onOpenPlan?: () => void;
+  /** Null/undefined hides the switch row — e.g. no access to the other app. */
+  otherApp?: NavFooterAppLink | null;
+  /** Extra rows above the account row (the self-hosted link-account CTA). */
+  accountExtras?: ReactNode;
+  /** Icon-rail state: labels collapse to tooltips. */
+  collapsed?: boolean;
+  className?: string;
+}
+
+/**
+ * Whether the enter animation has already played this page session. The rows
+ * are seeded from cache now, so they're present from first paint and every
+ * later mount — switching apps, remounting a view — would otherwise replay the
+ * animation on content that never changed, which reads as the UI twitching.
+ */
+let hasPlayedEnter = false;
+
+/**
+ * The bottom section every sidebar ends with, shared by the editor and the
+ * processor so both present the same rows. ONE surface, hairline-separated, in
+ * this order:
+ *
+ *   1. caller-contributed rows (the self-hosted link-account CTA)
+ *   2. free credits remaining
+ *   3. "Open <the other app>"
+ *   4. the account row — avatar, name, settings
+ *
+ * Purely presentational: each app resolves its own identity, wallet and
+ * app-switch access and passes them in, so this file carries no build-specific
+ * gating. A row whose data is absent is dropped, and so is the separator that
+ * would have sat beside it.
+ */
+export function NavFooter({
+  displayName,
+  profilePictureUrl,
+  onOpenSettings,
+  credits,
+  onOpenPlan,
+  otherApp,
+  accountExtras,
+  collapsed = false,
+  className,
+}: NavFooterProps) {
+  const { t } = useTranslation();
+  const [animate] = useState(() => {
+    if (hasPlayedEnter) return false;
+    hasPlayedEnter = true;
+    return true;
+  });
+
+  const settingsLabel = t("fileSidebar.openSettings", "Open settings");
+  const accountLabel = onOpenSettings
+    ? `${displayName} - ${settingsLabel}`
+    : displayName;
+
+  // One surface, hairline-separated rows. Each row gets a slot; the separators
+  // are drawn by CSS between adjacent NON-EMPTY slots (see NavFooter.css), so a
+  // row that renders nothing — the link-account CTA returns null once the org is
+  // linked, and an element is truthy even then — can't leave a line behind.
+  const rows: Array<{ key: string; node: ReactNode }> = [];
+
+  if (accountExtras) rows.push({ key: "extras", node: accountExtras });
+
+  if (credits) {
+    rows.push({
+      key: "credits",
+      node: (
+        <NavFooterCreditsRow
+          credits={credits}
+          collapsed={collapsed}
+          label={t("navFooter.credits.label", "Free credits")}
+          onOpen={onOpenPlan}
+        />
+      ),
+    });
+  }
+
+  if (otherApp) {
+    rows.push({
+      key: "switch",
+      node: (
+        <Tooltip
+          label={openAppLabel(otherApp.app, t)}
+          position="right"
+          withinPortal
+          disabled={!collapsed}
+        >
+          <button
+            type="button"
+            className="nav-footer__row"
+            onClick={() => otherApp.onOpen()}
+            // Collapsed drops the visible label, so name the button here too.
+            aria-label={openAppLabel(otherApp.app, t)}
+          >
+            <span className="nav-footer__row-icon" aria-hidden>
+              <BrandMark height="1.125rem" />
+            </span>
+            {!collapsed && (
+              <>
+                <span className="nav-footer__row-label">
+                  {openAppLabel(otherApp.app, t)}
+                </span>
+                {/* "Takes you there", not "opens a new tab" — both apps are
+                    one SPA, so this navigates in place. */}
+                <span className="nav-footer__trailing" aria-hidden>
+                  <ArrowForwardIcon sx={{ fontSize: "1rem" }} />
+                </span>
+              </>
+            )}
+          </button>
+        </Tooltip>
+      ),
+    });
+  }
+
+  rows.push({
+    key: "account",
+    node: (
+      <Tooltip
+        label={accountLabel}
+        position="right"
+        withinPortal
+        disabled={!collapsed}
+      >
+        <button
+          type="button"
+          className="nav-footer__row nav-footer__account"
+          // Called with no args: handlers that take optional params (the
+          // processor's openSettings(section?)) must not receive the event.
+          onClick={onOpenSettings ? () => onOpenSettings() : undefined}
+          disabled={!onOpenSettings}
+          data-testid={onOpenSettings ? "config-button" : undefined}
+          data-tour={onOpenSettings ? "config-button" : undefined}
+          aria-label={accountLabel}
+        >
+          {/* Decorative: the button's own label already names the account, so
+              an alt/label here would just repeat it to a screen reader. */}
+          <span aria-hidden>
+            <Avatar
+              size="sm"
+              name={displayName}
+              src={profilePictureUrl ?? undefined}
+            />
+          </span>
+          {!collapsed && (
+            <span className="nav-footer__row-label sidebar-content-fade">
+              {displayName}
+            </span>
+          )}
+          {onOpenSettings && !collapsed && (
+            <span className="nav-footer__trailing" aria-hidden>
+              <SettingsIcon sx={{ fontSize: "1.1rem" }} />
+            </span>
+          )}
+        </button>
+      </Tooltip>
+    ),
+  });
+
+  return (
+    <NavSurface
+      className={["nav-footer", className ?? ""].filter(Boolean).join(" ")}
+      data-collapsed={collapsed || undefined}
+      data-animate={animate || undefined}
+    >
+      {rows.map((row) => (
+        <div key={row.key} className="nav-footer__slot">
+          {row.node}
+        </div>
+      ))}
+    </NavSurface>
+  );
+}
+
+function openAppLabel(
+  app: AppSwitchTarget,
+  t: (key: string, fallback: string) => string,
+): string {
+  return app === "editor"
+    ? t("navFooter.openEditor", "Open PDF Editor")
+    : t("navFooter.openProcessor", "Open PDF Processor");
+}
diff --git a/frontend/editor/src/core/components/shared/navFooter/NavFooterCreditsRow.css b/frontend/editor/src/core/components/shared/navFooter/NavFooterCreditsRow.css
new file mode 100644
index 0000000000..b37def6b2d
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/navFooter/NavFooterCreditsRow.css
@@ -0,0 +1,83 @@
+/* Free-credits meter inside the sidebar footer. The row base (padding, hover,
+   focus) comes from NavFooter.css; these rules are the meter itself. */
+
+.nav-footer__credits {
+  flex-direction: column;
+  align-items: stretch;
+  gap: 0.375rem;
+  cursor: default;
+}
+
+/* Inert by default, so it must not read as hoverable; the actionable variant
+   opts back into the shared row hover. */
+.nav-footer__credits:hover {
+  background: none;
+}
+
+.nav-footer__credits--actionable {
+  cursor: pointer;
+}
+.nav-footer__credits--actionable:hover {
+  background-color: var(--c-hover);
+}
+
+.nav-footer__credits-head {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.8125rem;
+}
+
+.nav-footer__dot {
+  width: 0.4375rem;
+  height: 0.4375rem;
+  border-radius: 50%;
+  flex-shrink: 0;
+  background-color: var(--c-success);
+}
+.nav-footer__dot[data-tone="warning"] {
+  background-color: var(--c-warning);
+}
+.nav-footer__dot[data-tone="danger"] {
+  background-color: var(--c-danger);
+}
+
+.nav-footer__credits-label {
+  flex: 1;
+  min-width: 0;
+  font-weight: 500;
+  color: var(--c-text);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.nav-footer__credits-count {
+  flex-shrink: 0;
+  color: var(--c-text-muted);
+  font-variant-numeric: tabular-nums;
+}
+
+/* ---- Collapsed rail ---- */
+
+/* Rotated so the fill starts at 12 o'clock and runs clockwise. */
+.nav-footer__credits-ring {
+  width: 1.25rem;
+  height: 1.25rem;
+  margin-inline: auto;
+  transform: rotate(-90deg);
+}
+
+.nav-footer__credits-ring-track,
+.nav-footer__credits-ring-fill {
+  fill: none;
+  stroke-width: 3;
+}
+
+.nav-footer__credits-ring-track {
+  stroke: var(--c-surface-sunken);
+}
+
+.nav-footer__credits-ring-fill {
+  stroke-linecap: round;
+}
diff --git a/frontend/editor/src/core/components/shared/navFooter/NavFooterCreditsRow.tsx b/frontend/editor/src/core/components/shared/navFooter/NavFooterCreditsRow.tsx
new file mode 100644
index 0000000000..94e941d71c
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/navFooter/NavFooterCreditsRow.tsx
@@ -0,0 +1,158 @@
+import type { ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { Tooltip } from "@mantine/core";
+import { ProgressBar } from "@app/ui";
+import "@app/components/shared/navFooter/NavFooterCreditsRow.css";
+
+export interface NavFooterCredits {
+  /** Free credits still available to spend. */
+  remaining: number;
+  /** Size of the free allowance — the "of N" denominator. */
+  total: number;
+}
+
+/** Remaining-credit bands, mirroring the usage meters' 80% / 100% thresholds. */
+function creditsTone(remaining: number, total: number): string {
+  if (remaining <= 0) return "danger";
+  return total > 0 && remaining / total <= 0.2 ? "warning" : "success";
+}
+
+interface NavFooterCreditsRowProps {
+  credits: NavFooterCredits;
+  /** Icon rail: the figures drop and the bar alone carries the state. */
+  collapsed: boolean;
+  /** Row label, passed in so the meter owns no copy of its own. */
+  label: string;
+  /** Opens the plan surface. Omit to render the meter as inert text. */
+  onOpen?: () => void;
+}
+
+/**
+ * The free-credits meter as it appears in the sidebar footer: a state dot, the
+ * label, "X of Y" remaining, and a fill bar underneath. Figures are clamped
+ * here so a wallet that reports more remaining than the allowance (or negative)
+ * can't overflow the bar.
+ *
+ * Rendered as a {@code nav-footer__row}, so it inherits that row's metrics
+ * from NavFooter.css and only brings its own meter styling.
+ */
+export function NavFooterCreditsRow({
+  credits,
+  collapsed,
+  label,
+  onOpen,
+}: NavFooterCreditsRowProps) {
+  const { t } = useTranslation();
+
+  const total = Math.max(0, credits.total);
+  const remaining = Math.min(Math.max(0, credits.remaining), total);
+  const tone = creditsTone(remaining, total);
+  const count = t("navFooter.credits.count", "{{remaining}} of {{total}}", {
+    remaining: remaining.toLocaleString(),
+    total: total.toLocaleString(),
+  });
+
+  return (
+    <Tooltip
+      label={`${label}: ${count}`}
+      position="right"
+      withinPortal
+      disabled={!collapsed}
+    >
+      <Row onOpen={onOpen} label={`${label}: ${count}`}>
+        {collapsed ? (
+          // The rail is one icon wide, so a full-width bar would read as a
+          // stray line; a ring carries the same fraction at icon size.
+          <CreditsRing
+            fraction={total > 0 ? remaining / total : 0}
+            tone={tone}
+            label={`${label}: ${count}`}
+          />
+        ) : (
+          <>
+            <div className="nav-footer__credits-head">
+              <span className="nav-footer__dot" data-tone={tone} aria-hidden />
+              <span className="nav-footer__credits-label">{label}</span>
+              <span className="nav-footer__credits-count">{count}</span>
+            </div>
+            <ProgressBar
+              value={total > 0 ? remaining / total : 0}
+              height={6}
+              color={`var(--c-${tone})`}
+              label={`${label}: ${count}`}
+            />
+          </>
+        )}
+      </Row>
+    </Tooltip>
+  );
+}
+
+/** Icon-sized donut carrying the same remaining fraction as the expanded bar. */
+function CreditsRing({
+  fraction,
+  tone,
+  label,
+}: {
+  fraction: number;
+  tone: string;
+  label: string;
+}) {
+  const RADIUS = 8;
+  const circumference = 2 * Math.PI * RADIUS;
+  const filled = Math.min(1, Math.max(0, fraction)) * circumference;
+
+  return (
+    <svg
+      className="nav-footer__credits-ring"
+      viewBox="0 0 20 20"
+      role="img"
+      aria-label={label}
+    >
+      <circle
+        className="nav-footer__credits-ring-track"
+        cx="10"
+        cy="10"
+        r={RADIUS}
+      />
+      <circle
+        className="nav-footer__credits-ring-fill"
+        cx="10"
+        cy="10"
+        r={RADIUS}
+        stroke={`var(--c-${tone})`}
+        strokeDasharray={`${filled} ${circumference - filled}`}
+      />
+    </svg>
+  );
+}
+
+/**
+ * The meter is a button only where there is a plan surface to open — otherwise
+ * it stays a plain div, so a build with nowhere to go doesn't advertise a
+ * click that does nothing.
+ */
+function Row({
+  onOpen,
+  label,
+  children,
+}: {
+  onOpen?: () => void;
+  label: string;
+  children: ReactNode;
+}) {
+  const className = `nav-footer__row nav-footer__credits${
+    onOpen ? " nav-footer__credits--actionable" : ""
+  }`;
+  if (!onOpen) return <div className={className}>{children}</div>;
+  return (
+    <button
+      type="button"
+      className={className}
+      onClick={() => onOpen()}
+      aria-label={label}
+    >
+      {children}
+    </button>
+  );
+}
diff --git a/frontend/editor/src/core/components/shared/superSearch/SuperSearch.css b/frontend/editor/src/core/components/shared/superSearch/SuperSearch.css
new file mode 100644
index 0000000000..6920c37be4
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/superSearch/SuperSearch.css
@@ -0,0 +1,251 @@
+.super-search {
+  position: relative;
+  flex: 1 1 auto;
+  min-width: 0;
+  max-width: 560px;
+  --super-search-input-border: color-mix(
+    in srgb,
+    var(--c-text) 14%,
+    var(--c-border-subtle)
+  );
+  --super-search-input-outline: color-mix(
+    in srgb,
+    var(--c-text) 5%,
+    transparent
+  );
+}
+
+.super-search-input-row {
+  position: relative;
+}
+
+.super-search input {
+  box-sizing: border-box;
+  border: 1px solid var(--super-search-input-border);
+  border-radius: var(--radius-md);
+  background-color: var(--c-input-bg);
+  box-shadow: 0 0 0 1px var(--super-search-input-outline);
+  /* Tighter than the shared TextInput default (8px/14px) for a compact,
+     professional bar — height lands in line with the 28px action icons. */
+  padding-top: 6px;
+  padding-bottom: 6px;
+  font-size: 13px;
+}
+
+.super-search input:focus {
+  border-color: var(--c-primary);
+}
+
+/* Keyboard-shortcut hint pinned to the right of the input. */
+.super-search-kbd {
+  position: absolute;
+  right: 0.5rem;
+  top: 50%;
+  transform: translateY(-50%);
+  pointer-events: none;
+  font-size: 0.7rem;
+  line-height: 1;
+  padding: 0.15rem 0.35rem;
+  border-radius: var(--radius-sm);
+  color: var(--c-text-subtle);
+  background: var(--c-hover);
+  border: 1px solid var(--c-border-subtle);
+  /* Tiny breathing room between the ⌘ glyph and the K. */
+  letter-spacing: 0.06em;
+}
+
+/* Portalled to <body>; coords are set inline from the input's viewport rect. */
+.super-search-dropdown {
+  position: fixed;
+  z-index: 1000;
+  max-height: 60vh;
+  overflow-y: auto;
+  padding: 0.35rem;
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-lg);
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.18);
+}
+
+.super-search-empty {
+  padding: 0.75rem 0.6rem;
+  font-size: 0.85rem;
+  color: var(--c-text-subtle);
+}
+
+.super-search-filters {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+  padding: 0.35rem 0.35rem 0.5rem;
+  margin-bottom: 0.15rem;
+  border-bottom: 1px solid var(--c-border-subtle);
+}
+
+.super-search-filters .sui-chip {
+  user-select: none;
+}
+
+.super-search-section + .super-search-section {
+  margin-top: 0.5rem;
+}
+
+.super-search-section {
+  display: flex;
+  flex-direction: column;
+  gap: 0.1rem;
+}
+
+.super-search-section-header {
+  display: flex;
+  align-items: center;
+  gap: 0.45rem;
+  margin-left: -0.65rem;
+  padding: 0.15rem 0.25rem 0.05rem 0;
+}
+
+.super-search-section-header::after {
+  content: "";
+  flex: 1 1 auto;
+  min-width: 1.5rem;
+  height: 1px;
+  background: color-mix(in srgb, var(--c-text) 12%, var(--c-border-subtle));
+}
+
+.super-search-section-body {
+  padding: 0.05rem 0.05rem 0.2rem 0;
+}
+
+.super-search-section-toggle.mantine-Button-root {
+  --button-height: auto;
+  --button-padding-x: 0;
+  min-height: 0;
+  padding-block: 0;
+  flex: 0 0 auto;
+}
+
+.super-search-section-toggle.mantine-Button-root:hover,
+.super-search-section-toggle.mantine-Button-root:focus-visible {
+  background: transparent;
+}
+
+.super-search-section-toggle:hover .super-search-section-label {
+  color: var(--c-text);
+}
+
+.super-search-section-toggle .mantine-Button-inner {
+  align-items: center;
+}
+
+/* Per-group "show N more" / "show less" toggle. */
+.super-search-show-more.mantine-Button-root {
+  --button-height: auto;
+  min-height: 0;
+  padding: 0.25rem 0.5rem 0.35rem;
+  font-size: 0.78rem;
+  color: var(--c-text-subtle);
+}
+.super-search-show-more.mantine-Button-root:hover,
+.super-search-show-more.mantine-Button-root:focus-visible {
+  background: transparent;
+  color: var(--c-text);
+}
+
+.super-search-section-toggle .mantine-Button-label {
+  text-align: left;
+}
+
+.super-search-section-toggle .mantine-Button-section {
+  margin-inline-start: 0.2rem;
+}
+
+.super-search-section-chevron {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+  width: 1rem;
+  height: 1rem;
+  color: var(--c-text-subtle);
+  transition:
+    transform 140ms ease,
+    color 140ms ease;
+}
+
+.super-search-section-toggle:hover .super-search-section-chevron {
+  color: var(--c-text-muted);
+}
+
+.super-search-section-chevron--collapsed {
+  transform: rotate(-90deg);
+}
+
+.super-search-group + .super-search-group {
+  margin-top: 0.45rem;
+  padding-top: 0.35rem;
+  border-top: 1px solid color-mix(in srgb, var(--c-text) 8%, transparent);
+}
+
+.super-search-section-label {
+  padding: 0.18rem 0;
+  font-size: 0.74rem;
+  font-weight: 700;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+  color: var(--c-text-muted);
+}
+
+.super-search-group-label {
+  padding: 0.35rem 0.15rem 0.18rem 0.85rem;
+  font-size: 0.7rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--c-text-subtle);
+}
+
+.super-search-group-results {
+  padding-left: 1.25rem;
+}
+
+.super-search-item {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  width: 100%;
+  padding: 0.45rem 0.5rem;
+  border: none;
+  border-radius: var(--radius-md);
+  background: transparent;
+  text-align: left;
+  cursor: pointer;
+  color: var(--c-text);
+}
+
+.super-search-item.active,
+.super-search-item:hover {
+  background: var(--c-hover);
+}
+
+.super-search-item-icon {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+  width: 1.4rem;
+  height: 1.4rem;
+  color: var(--c-text-muted);
+}
+
+.super-search-item-text {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+}
+
+.super-search-item-title {
+  font-size: 0.875rem;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
diff --git a/frontend/editor/src/core/components/shared/superSearch/SuperSearch.test.tsx b/frontend/editor/src/core/components/shared/superSearch/SuperSearch.test.tsx
new file mode 100644
index 0000000000..f77984f090
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/superSearch/SuperSearch.test.tsx
@@ -0,0 +1,537 @@
+import { useEffect, useState } from "react";
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+
+vi.mock("@app/hooks/useSuperSearch", () => ({
+  useSuperSearch: vi.fn(() => ({
+    groups: [],
+    flatResults: [],
+    loadingFiles: false,
+  })),
+}));
+
+vi.mock("@app/utils/hotkeys", () => ({
+  isMacLike: () => false,
+}));
+
+import SuperSearch from "@app/components/shared/superSearch/SuperSearch";
+import type {
+  SuperSearchQueryOptions,
+  SuperSearchScope,
+} from "@app/hooks/useSuperSearch";
+
+interface TestResult {
+  key: string;
+  group: string;
+  title: string;
+  subtitle?: string;
+  score: number;
+  onSelect: () => void | Promise<void>;
+}
+
+interface TestGroup {
+  id: string;
+  label: string;
+  sectionLabel?: string;
+  results: TestResult[];
+}
+
+interface TestUseResultsResult {
+  groups: TestGroup[];
+  flatResults: TestResult[];
+  loadingFiles: boolean;
+}
+
+type TestUseResultsHook = (
+  query: string,
+  active: boolean,
+  options?: SuperSearchQueryOptions,
+) => TestUseResultsResult;
+
+const TEST_SCOPES: SuperSearchScope[] = [
+  {
+    id: "portal-policies",
+    label: "Policies",
+    aliases: ["policy", "policies"],
+  },
+  {
+    id: "portal-pipelines",
+    label: "Pipelines",
+    aliases: ["pipeline", "pipelines"],
+  },
+];
+
+function makeResult(
+  key: string,
+  title: string,
+  onSelect = vi.fn(),
+): TestResult {
+  return {
+    key,
+    group: "tools",
+    title,
+    score: 100,
+    onSelect,
+  };
+}
+
+function renderSearch(
+  useResults?: TestUseResultsHook,
+  scopes?: readonly SuperSearchScope[],
+) {
+  return render(
+    <MantineProvider>
+      <SuperSearch
+        inputId="test-super-search"
+        useResults={useResults as TestUseResultsHook | undefined}
+        scopes={scopes}
+      />
+    </MantineProvider>,
+  );
+}
+
+describe("SuperSearch", () => {
+  beforeEach(() => {
+    vi.spyOn(Element.prototype, "getBoundingClientRect").mockReturnValue({
+      x: 0,
+      y: 0,
+      top: 0,
+      left: 0,
+      right: 320,
+      bottom: 40,
+      width: 320,
+      height: 40,
+      toJSON: () => "",
+    } as DOMRect);
+
+    Object.defineProperty(Element.prototype, "scrollIntoView", {
+      value: vi.fn(),
+      writable: true,
+      configurable: true,
+    });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("opens from Ctrl+K based on e.code and exposes combobox wiring", async () => {
+    const useResults: TestUseResultsHook = () => ({
+      groups: [],
+      flatResults: [],
+      loadingFiles: false,
+    });
+
+    renderSearch(useResults);
+
+    const input = screen.getByRole("combobox");
+    expect(input).toHaveAttribute("aria-expanded", "false");
+
+    fireEvent.keyDown(document.body, {
+      ctrlKey: true,
+      code: "KeyK",
+      key: "x",
+    });
+
+    await waitFor(() => {
+      expect(input).toHaveFocus();
+      expect(input).toHaveAttribute("aria-expanded", "true");
+    });
+
+    expect(input).toHaveAttribute("aria-controls", "test-super-search-listbox");
+    expect(screen.getByRole("listbox")).toBeInTheDocument();
+  });
+
+  it("keeps the highlight on the same result key when async results reorder", async () => {
+    const alphaSelect = vi.fn();
+    const betaSelect = vi.fn();
+
+    const useAsyncResults: TestUseResultsHook = (query, active) => {
+      const [swapped, setSwapped] = useState(false);
+
+      useEffect(() => {
+        if (!active || !query.trim()) {
+          setSwapped(false);
+          return;
+        }
+
+        const timeoutId = window.setTimeout(() => setSwapped(true), 50);
+        return () => window.clearTimeout(timeoutId);
+      }, [active, query]);
+
+      const results = swapped
+        ? [
+            makeResult("beta", "Beta", betaSelect),
+            makeResult("alpha", "Alpha", alphaSelect),
+          ]
+        : [
+            makeResult("alpha", "Alpha", alphaSelect),
+            makeResult("beta", "Beta", betaSelect),
+          ];
+      const groups = query.trim()
+        ? [{ id: "tools", label: "Tools", results }]
+        : [];
+
+      return {
+        groups,
+        flatResults: groups.flatMap((group) => group.results),
+        loadingFiles: false,
+      };
+    };
+
+    renderSearch(useAsyncResults);
+
+    const input = screen.getByRole("combobox");
+    fireEvent.focus(input);
+    fireEvent.change(input, { target: { value: "a" } });
+
+    await screen.findByText("Alpha");
+
+    fireEvent.keyDown(input, { key: "ArrowDown" });
+    expect(input).toHaveAttribute(
+      "aria-activedescendant",
+      "test-super-search-option-1",
+    );
+
+    await waitFor(() => {
+      expect(input).toHaveAttribute(
+        "aria-activedescendant",
+        "test-super-search-option-0",
+      );
+    });
+
+    expect(screen.getByText("Beta").closest('[role="option"]')).toHaveAttribute(
+      "aria-selected",
+      "true",
+    );
+
+    fireEvent.keyDown(input, { key: "Enter" });
+
+    expect(betaSelect).toHaveBeenCalledTimes(1);
+    expect(alphaSelect).not.toHaveBeenCalled();
+  });
+
+  it("supports multi-select scope chips and clears manual filters on close", async () => {
+    const useScopedResults: TestUseResultsHook = (query, active, options) => {
+      if (!active || !query.trim()) {
+        return { groups: [], flatResults: [], loadingFiles: false };
+      }
+
+      const enabledScopes = new Set(options?.scopeIds ?? []);
+      const allGroups: TestGroup[] = [
+        {
+          id: "portal-policies",
+          label: "Policies",
+          results: [makeResult("policy", "Policy Match")],
+        },
+        {
+          id: "portal-pipelines",
+          label: "Pipelines",
+          results: [makeResult("pipeline", "Pipeline Match")],
+        },
+      ];
+      const groups =
+        enabledScopes.size === 0
+          ? allGroups
+          : allGroups.filter((group) => enabledScopes.has(group.id));
+
+      return {
+        groups,
+        flatResults: groups.flatMap((group) => group.results),
+        loadingFiles: false,
+      };
+    };
+
+    renderSearch(useScopedResults, TEST_SCOPES);
+
+    const input = screen.getByRole("combobox");
+    fireEvent.focus(input);
+    fireEvent.change(input, { target: { value: "invoice" } });
+
+    await screen.findByText("Policy Match");
+    expect(screen.getByText("Pipeline Match")).toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole("button", { name: "Policies" }));
+    await waitFor(() => {
+      expect(screen.getByText("Policy Match")).toBeInTheDocument();
+      expect(screen.queryByText("Pipeline Match")).not.toBeInTheDocument();
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: "Pipelines" }));
+    await waitFor(() => {
+      expect(screen.getByText("Policy Match")).toBeInTheDocument();
+      expect(screen.getByText("Pipeline Match")).toBeInTheDocument();
+    });
+
+    fireEvent.mouseDown(document.body);
+    await waitFor(() => {
+      expect(input).toHaveAttribute("aria-expanded", "false");
+    });
+
+    fireEvent.focus(input);
+    await waitFor(() => {
+      expect(screen.getByText("Policy Match")).toBeInTheDocument();
+      expect(screen.getByText("Pipeline Match")).toBeInTheDocument();
+    });
+  });
+
+  it("maps scope prefixes onto active chips and lets the chip remove them", async () => {
+    const useScopedResults: TestUseResultsHook = (query, active, options) => {
+      if (!active || !query.trim()) {
+        return { groups: [], flatResults: [], loadingFiles: false };
+      }
+
+      const enabledScopes = new Set(options?.scopeIds ?? []);
+      const groups: TestGroup[] = [
+        {
+          id: "portal-policies",
+          label: "Policies",
+          results: [makeResult("policy", "Policy Match")],
+        },
+        {
+          id: "portal-pipelines",
+          label: "Pipelines",
+          results: [makeResult("pipeline", "Pipeline Match")],
+        },
+      ].filter(
+        (group) => enabledScopes.size === 0 || enabledScopes.has(group.id),
+      );
+
+      return {
+        groups,
+        flatResults: groups.flatMap((group) => group.results),
+        loadingFiles: false,
+      };
+    };
+
+    renderSearch(useScopedResults, TEST_SCOPES);
+
+    const input = screen.getByRole("combobox");
+    fireEvent.focus(input);
+    fireEvent.change(input, { target: { value: "policy: invoice" } });
+
+    await waitFor(() => {
+      expect(screen.getByText("Policy Match")).toBeInTheDocument();
+      expect(screen.queryByText("Pipeline Match")).not.toBeInTheDocument();
+    });
+
+    const policyChip = screen.getByRole("button", { name: "Policies" });
+    expect(policyChip).toHaveAttribute("aria-pressed", "true");
+
+    fireEvent.click(policyChip);
+
+    await waitFor(() => {
+      expect(input).toHaveValue("invoice");
+      expect(screen.getByText("Policy Match")).toBeInTheDocument();
+      expect(screen.getByText("Pipeline Match")).toBeInTheDocument();
+    });
+  });
+
+  it("shows no-results below scoped filters before typing", async () => {
+    const useResults: TestUseResultsHook = () => ({
+      groups: [],
+      flatResults: [],
+      loadingFiles: false,
+    });
+
+    renderSearch(useResults, TEST_SCOPES);
+
+    const input = screen.getByRole("combobox");
+    fireEvent.focus(input);
+
+    await waitFor(() => {
+      expect(
+        screen.getByRole("button", { name: "Policies" }),
+      ).toBeInTheDocument();
+    });
+
+    expect(screen.queryByText("Type to search")).not.toBeInTheDocument();
+    expect(screen.getByText("search.noResults")).toBeInTheDocument();
+  });
+
+  it("renders shared section headers once for consecutive groups", async () => {
+    const useResults: TestUseResultsHook = (query) => {
+      if (!query.trim()) {
+        return { groups: [], flatResults: [], loadingFiles: false };
+      }
+
+      const groups: TestGroup[] = [
+        {
+          id: "portal-users",
+          label: "Users",
+          sectionLabel: "Processor",
+          results: [makeResult("user", "Alice")],
+        },
+        {
+          id: "portal-policies",
+          label: "Policies",
+          sectionLabel: "Processor",
+          results: [makeResult("policy", "Security Policy")],
+        },
+        {
+          id: "tools",
+          label: "Tools",
+          sectionLabel: "Editor",
+          results: [makeResult("tool", "Merge PDFs")],
+        },
+      ];
+
+      return {
+        groups,
+        flatResults: groups.flatMap((group) => group.results),
+        loadingFiles: false,
+      };
+    };
+
+    renderSearch(useResults);
+
+    const input = screen.getByRole("combobox");
+    fireEvent.focus(input);
+    fireEvent.change(input, { target: { value: "a" } });
+
+    await screen.findByText("Alice");
+
+    expect(screen.getAllByText("Processor")).toHaveLength(1);
+    expect(screen.getAllByText("Editor")).toHaveLength(1);
+  });
+
+  it("caps a large group behind show-more and expands/collapses it", async () => {
+    const titles = Array.from({ length: 8 }, (_, i) => `Tool ${i + 1}`);
+    const useResults: TestUseResultsHook = (query) => {
+      if (!query.trim()) {
+        return { groups: [], flatResults: [], loadingFiles: false };
+      }
+      const groups: TestGroup[] = [
+        {
+          id: "tools",
+          label: "Tools",
+          results: titles.map((title, i) => makeResult(`tool-${i}`, title)),
+        },
+      ];
+      return {
+        groups,
+        flatResults: groups.flatMap((group) => group.results),
+        loadingFiles: false,
+      };
+    };
+
+    renderSearch(useResults);
+
+    const input = screen.getByRole("combobox");
+    fireEvent.focus(input);
+    fireEvent.change(input, { target: { value: "tool" } });
+
+    await screen.findByText("Tool 1");
+    expect(screen.getByText("Tool 5")).toBeInTheDocument();
+    expect(screen.queryByText("Tool 6")).not.toBeInTheDocument();
+
+    const toggle = screen.getByRole("button", {
+      name: /superSearch\.showMore/,
+    });
+    fireEvent.click(toggle);
+
+    await screen.findByText("Tool 8");
+    expect(
+      screen.getByRole("button", { name: /superSearch\.showLess/ }),
+    ).toBeInTheDocument();
+
+    fireEvent.click(
+      screen.getByRole("button", { name: /superSearch\.showLess/ }),
+    );
+    await waitFor(() => {
+      expect(screen.queryByText("Tool 6")).not.toBeInTheDocument();
+      expect(screen.getByText("Tool 5")).toBeInTheDocument();
+    });
+  });
+
+  it("shows a cap+1 group in full with no show-more toggle", async () => {
+    const useResults: TestUseResultsHook = (query) => {
+      if (!query.trim()) {
+        return { groups: [], flatResults: [], loadingFiles: false };
+      }
+      const groups: TestGroup[] = [
+        {
+          id: "tools",
+          label: "Tools",
+          results: Array.from({ length: 6 }, (_, i) =>
+            makeResult(`tool-${i}`, `Tool ${i + 1}`),
+          ),
+        },
+      ];
+      return {
+        groups,
+        flatResults: groups.flatMap((group) => group.results),
+        loadingFiles: false,
+      };
+    };
+
+    renderSearch(useResults);
+
+    const input = screen.getByRole("combobox");
+    fireEvent.focus(input);
+    fireEvent.change(input, { target: { value: "tool" } });
+
+    await screen.findByText("Tool 6");
+    expect(
+      screen.queryByRole("button", { name: /superSearch\.show/ }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("lets a section collapse and reopen without hiding the other section", async () => {
+    const useResults: TestUseResultsHook = (query) => {
+      if (!query.trim()) {
+        return { groups: [], flatResults: [], loadingFiles: false };
+      }
+
+      const groups: TestGroup[] = [
+        {
+          id: "portal-users",
+          label: "Users",
+          sectionLabel: "Processor",
+          results: [makeResult("user", "Alice")],
+        },
+        {
+          id: "tools",
+          label: "Tools",
+          sectionLabel: "Editor",
+          results: [makeResult("tool", "Merge PDFs")],
+        },
+      ];
+
+      return {
+        groups,
+        flatResults: groups.flatMap((group) => group.results),
+        loadingFiles: false,
+      };
+    };
+
+    renderSearch(useResults);
+
+    const input = screen.getByRole("combobox");
+    fireEvent.focus(input);
+    fireEvent.change(input, { target: { value: "a" } });
+
+    await screen.findByText("Alice");
+    const processorToggle = screen.getByRole("button", { name: "Processor" });
+
+    expect(processorToggle).toHaveAttribute("aria-expanded", "true");
+    expect(screen.getByText("Alice")).toBeInTheDocument();
+    expect(screen.getByText("Merge PDFs")).toBeInTheDocument();
+
+    fireEvent.click(processorToggle);
+
+    await waitFor(() => {
+      expect(processorToggle).toHaveAttribute("aria-expanded", "false");
+      expect(screen.queryByText("Alice")).not.toBeInTheDocument();
+      expect(screen.getByText("Merge PDFs")).toBeInTheDocument();
+    });
+
+    fireEvent.click(processorToggle);
+
+    await waitFor(() => {
+      expect(processorToggle).toHaveAttribute("aria-expanded", "true");
+      expect(screen.getByText("Alice")).toBeInTheDocument();
+    });
+  });
+});
diff --git a/frontend/editor/src/core/components/shared/superSearch/SuperSearch.tsx b/frontend/editor/src/core/components/shared/superSearch/SuperSearch.tsx
new file mode 100644
index 0000000000..6afcdfff82
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/superSearch/SuperSearch.tsx
@@ -0,0 +1,656 @@
+import {
+  useCallback,
+  useEffect,
+  useLayoutEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
+import { createPortal } from "react-dom";
+import { useTranslation } from "react-i18next";
+import { Text } from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import { Chip } from "@app/ui/Chip";
+import { TextInput } from "@app/components/shared/TextInput";
+import LocalIcon from "@app/components/shared/LocalIcon";
+import { isMacLike } from "@app/utils/hotkeys";
+import {
+  useSuperSearch,
+  SuperSearchResult,
+  type SuperSearchQueryOptions,
+  type SuperSearchScope,
+  type UseSuperSearchResult,
+} from "@app/hooks/useSuperSearch";
+import {
+  parseSuperSearchQuery,
+  rebuildSuperSearchQuery,
+} from "@app/components/shared/superSearch/superSearchFilters";
+import "@app/components/shared/superSearch/SuperSearch.css";
+
+/** Rows shown per group before a "show more" toggle reveals the rest. */
+const COLLAPSED_GROUP_SIZE = 5;
+
+interface DropdownRect {
+  top: number;
+  left: number;
+  width: number;
+}
+
+interface SuperSearchSection {
+  key: string;
+  label?: string;
+  groups: UseSuperSearchResult["groups"];
+}
+
+interface SuperSearchProps {
+  /**
+   * Results provider, called as a hook — it MUST be referentially stable for
+   * the component's lifetime. Defaults to the editor's files/tools/settings/
+   * Processor provider; the portal passes its own destinations provider.
+   */
+  useResults?: (
+    query: string,
+    active: boolean,
+    options?: SuperSearchQueryOptions,
+  ) => UseSuperSearchResult;
+  /**
+   * DOM id for the input — external focus helpers target the default. A host
+   * whose bar can coexist with another instance must pass a distinct id.
+   */
+  inputId?: string;
+  /** Optional scope chips + `scope:` prefixes for host-specific filters. */
+  scopes?: readonly SuperSearchScope[];
+  /** Dropdown width floor — the results panel needs more room than the
+   * compact input. Defaults shared by every bar; override per host if a
+   * layout can't fit it. */
+  dropdownMinWidth?: number;
+  /**
+   * Extra class for the dropdown. The dropdown is portalled to <body>, so a
+   * host's descendant selectors can't reach it — this is the styling hook.
+   */
+  dropdownClassName?: string;
+}
+
+/**
+ * Global "super search": a single entry point that searches across the host
+ * app's destinations from a persistent bar. The results hang in a dropdown
+ * directly below the input; Cmd/Ctrl+K focuses and opens it.
+ *
+ * The dropdown is portalled to <body>: the host bar's inner wrapper may set
+ * `overflow: hidden`, which would otherwise clip it.
+ */
+export default function SuperSearch({
+  useResults = useSuperSearch,
+  inputId = "super-search-input",
+  scopes = [],
+  dropdownMinWidth = 760,
+  dropdownClassName,
+}: SuperSearchProps = {}) {
+  const { t } = useTranslation();
+  const [query, setQuery] = useState("");
+  const [open, setOpen] = useState(false);
+  const [highlight, setHighlight] = useState(0);
+  const [rect, setRect] = useState<DropdownRect | null>(null);
+  const [manualScopeIds, setManualScopeIds] = useState<string[]>([]);
+  const [collapsedSectionKeys, setCollapsedSectionKeys] = useState<string[]>(
+    [],
+  );
+  // Groups the user has expanded past the initial per-group cap ("show more").
+  const [expandedGroupKeys, setExpandedGroupKeys] = useState<string[]>([]);
+
+  const inputRef = useRef<HTMLInputElement>(null);
+  const containerRef = useRef<HTMLDivElement>(null);
+  const dropdownRef = useRef<HTMLDivElement>(null);
+  // The key of the highlighted result, so async pop-in (entities, file stubs)
+  // can't silently shift the highlight onto a different row.
+  const highlightKeyRef = useRef<string | null>(null);
+
+  // A hook received as a prop is invisible to the rules-of-hooks lint; pinning
+  // the first value makes swapping it mid-life structurally impossible.
+  const useResultsHook = useRef(useResults).current;
+  const parsedQuery = useMemo(
+    () => parseSuperSearchQuery(query, scopes),
+    [query, scopes],
+  );
+  const effectiveScopeIds = useMemo(
+    () =>
+      Array.from(new Set([...parsedQuery.prefixedScopeIds, ...manualScopeIds])),
+    [manualScopeIds, parsedQuery.prefixedScopeIds],
+  );
+  const activeScopeIds = useMemo(
+    () => new Set(effectiveScopeIds),
+    [effectiveScopeIds],
+  );
+  const { groups, flatResults, loadingFiles } = useResultsHook(
+    parsedQuery.query,
+    open,
+    effectiveScopeIds.length > 0 ? { scopeIds: effectiveScopeIds } : undefined,
+  );
+
+  const trimmed = parsedQuery.query.trim();
+  const hasQuery = trimmed.length > 0;
+
+  const listboxId = `${inputId}-listbox`;
+  const optionId = useCallback(
+    (index: number) => `${inputId}-option-${index}`,
+    [inputId],
+  );
+
+  const sections = useMemo<SuperSearchSection[]>(() => {
+    const out: SuperSearchSection[] = [];
+
+    for (const group of groups) {
+      const current = out[out.length - 1];
+      if (current && current.label === group.sectionLabel) {
+        current.groups.push(group);
+        continue;
+      }
+
+      out.push({
+        key: group.sectionLabel ?? group.id,
+        label: group.sectionLabel,
+        groups: [group],
+      });
+    }
+
+    return out;
+  }, [groups]);
+
+  const visibleSections = useMemo(
+    () =>
+      sections.map((section) => ({
+        ...section,
+        collapsed:
+          section.label != null && collapsedSectionKeys.includes(section.key),
+      })),
+    [collapsedSectionKeys, sections],
+  );
+
+  // How many rows a group currently shows: its full set when expanded, else
+  // the initial cap. A group at exactly cap+1 just shows the extra row rather
+  // than a "show 1 more" toggle.
+  const visibleCountFor = useCallback(
+    (group: UseSuperSearchResult["groups"][number]) =>
+      expandedGroupKeys.includes(group.id) ||
+      group.results.length <= COLLAPSED_GROUP_SIZE + 1
+        ? group.results.length
+        : COLLAPSED_GROUP_SIZE,
+    [expandedGroupKeys],
+  );
+
+  const visibleFlatResults = useMemo(
+    () =>
+      visibleSections.flatMap((section) =>
+        section.collapsed
+          ? []
+          : section.groups.flatMap((group) =>
+              group.results.slice(0, visibleCountFor(group)),
+            ),
+      ),
+    [visibleSections, visibleCountFor],
+  );
+  // Row index per result key — the render below would otherwise indexOf()
+  // every row against the flat list (quadratic in visible results).
+  const flatIndexByKey = useMemo(
+    () => new Map(visibleFlatResults.map((result, i) => [result.key, i])),
+    [visibleFlatResults],
+  );
+
+  const moveHighlight = useCallback(
+    (index: number) => {
+      setHighlight(index);
+      highlightKeyRef.current = visibleFlatResults[index]?.key ?? null;
+    },
+    [visibleFlatResults],
+  );
+
+  // When results change, follow the highlighted result to its new index; if
+  // it's gone, reset to the top.
+  useEffect(() => {
+    const key = highlightKeyRef.current;
+    if (key) {
+      const index = visibleFlatResults.findIndex((r) => r.key === key);
+      if (index >= 0) {
+        setHighlight(index);
+        return;
+      }
+    }
+    highlightKeyRef.current = null;
+    setHighlight(0);
+  }, [visibleFlatResults]);
+
+  const close = useCallback(() => {
+    setOpen(false);
+    setHighlight(0);
+    setManualScopeIds([]);
+    setCollapsedSectionKeys([]);
+    setExpandedGroupKeys([]);
+    setQuery((current) => parseSuperSearchQuery(current, scopes).query);
+  }, [scopes]);
+
+  // Position the portalled dropdown directly under the input while open.
+  const updateRect = useCallback(() => {
+    const el = containerRef.current;
+    if (!el) return;
+    const r = el.getBoundingClientRect();
+    const viewportPadding = 8;
+    const width = Math.min(
+      Math.max(r.width, dropdownMinWidth ?? r.width),
+      window.innerWidth - viewportPadding * 2,
+    );
+    const centeredLeft = r.left - (width - r.width) / 2;
+    const left = Math.min(
+      Math.max(viewportPadding, centeredLeft),
+      window.innerWidth - width - viewportPadding,
+    );
+    setRect({ top: r.bottom + 6, left, width });
+  }, [dropdownMinWidth]);
+
+  useLayoutEffect(() => {
+    if (!open) return;
+    updateRect();
+    window.addEventListener("resize", updateRect);
+    window.addEventListener("scroll", updateRect, true);
+    return () => {
+      window.removeEventListener("resize", updateRect);
+      window.removeEventListener("scroll", updateRect, true);
+    };
+  }, [open, updateRect]);
+
+  const selectResult = useCallback(
+    (result: SuperSearchResult | undefined) => {
+      if (!result) return;
+      void result.onSelect();
+      setQuery("");
+      close();
+      inputRef.current?.blur();
+    },
+    [close],
+  );
+
+  // Global Cmd/Ctrl+K to focus + open the search. Matched on e.code so it
+  // works on non-Latin keyboard layouts, where e.key isn't "k".
+  useEffect(() => {
+    const onKeyDown = (e: KeyboardEvent) => {
+      // Accept both modifiers everywhere: Macs have a Control key too, and
+      // muscle memory from other platforms expects Ctrl+K to keep working.
+      const combo = (e.metaKey || e.ctrlKey) && !e.altKey && !e.shiftKey;
+      if (!combo || e.code !== "KeyK") return;
+      // Leave the shortcut alone while a modal owns the screen — focusing an
+      // input underneath the overlay would strand keyboard focus. Modals that
+      // want to cede to the search (the settings modal does) close themselves
+      // and dispatch "superSearch:focus" instead.
+      const target = e.target as HTMLElement | null;
+      if (target?.closest('[role="dialog"]')) return;
+      e.preventDefault();
+      setOpen(true);
+      inputRef.current?.focus();
+      inputRef.current?.select();
+    };
+    // Focus handover from a closing dialog. Only the on-screen instance
+    // responds (offsetParent is null while display:none / unmounted hosts),
+    // and focus waits two frames so the dialog's own return-focus runs first.
+    const onFocusRequest = () => {
+      const input = inputRef.current;
+      if (!input || input.offsetParent === null) return;
+      setOpen(true);
+      requestAnimationFrame(() =>
+        requestAnimationFrame(() => {
+          input.focus();
+          input.select();
+        }),
+      );
+    };
+    window.addEventListener("keydown", onKeyDown);
+    window.addEventListener("superSearch:focus", onFocusRequest);
+    return () => {
+      window.removeEventListener("keydown", onKeyDown);
+      window.removeEventListener("superSearch:focus", onFocusRequest);
+    };
+  }, []);
+
+  // Keep the highlighted row visible when keyboard navigation moves it past
+  // the dropdown's scroll fold.
+  useEffect(() => {
+    if (!open) return;
+    document
+      .getElementById(optionId(highlight))
+      ?.scrollIntoView({ block: "nearest" });
+  }, [open, highlight, optionId]);
+
+  // Close on click outside the input or the (portalled) dropdown.
+  useEffect(() => {
+    if (!open) return;
+    const onMouseDown = (e: MouseEvent) => {
+      const target = e.target as Node;
+      if (
+        containerRef.current?.contains(target) ||
+        dropdownRef.current?.contains(target)
+      ) {
+        return;
+      }
+      close();
+    };
+    document.addEventListener("mousedown", onMouseDown);
+    return () => document.removeEventListener("mousedown", onMouseDown);
+  }, [open, close]);
+
+  const handleKeyDown = (e: React.KeyboardEvent<HTMLDivElement>) => {
+    // During IME composition (CJK input), Enter commits the composition and
+    // arrows pick candidates — those keystrokes are not for us.
+    if (e.nativeEvent.isComposing) return;
+    if (e.key === "ArrowDown") {
+      e.preventDefault();
+      if (!open) setOpen(true);
+      moveHighlight(
+        visibleFlatResults.length === 0
+          ? 0
+          : (highlight + 1) % visibleFlatResults.length,
+      );
+    } else if (e.key === "ArrowUp") {
+      e.preventDefault();
+      moveHighlight(
+        visibleFlatResults.length === 0
+          ? 0
+          : (highlight - 1 + visibleFlatResults.length) %
+              visibleFlatResults.length,
+      );
+    } else if (e.key === "Enter") {
+      e.preventDefault();
+      selectResult(visibleFlatResults[highlight]);
+    } else if (e.key === "Escape") {
+      e.preventDefault();
+      // Consume the event: hosts with their own window-level Escape handling
+      // (e.g. the Files page closing itself) must not also act on this press —
+      // especially since the blur below makes their focus guards pass.
+      e.stopPropagation();
+      if (hasQuery) {
+        setQuery("");
+      } else {
+        close();
+        inputRef.current?.blur();
+      }
+    }
+  };
+
+  const shortcutHint = useMemo(() => (isMacLike() ? "⌘K" : "Ctrl+K"), []);
+
+  const toggleScope = useCallback(
+    (scopeId: string) => {
+      if (scopeId === "__all__") {
+        setManualScopeIds([]);
+        if (parsedQuery.prefixTokens.length > 0) {
+          setQuery(parsedQuery.query);
+        }
+        inputRef.current?.focus();
+        return;
+      }
+
+      const hasPrefix = parsedQuery.prefixedScopeIds.includes(scopeId);
+      if (hasPrefix) {
+        setManualScopeIds((current) => current.filter((id) => id !== scopeId));
+        const remainingPrefixScopeIds = new Set(
+          parsedQuery.prefixedScopeIds.filter((id) => id !== scopeId),
+        );
+        setQuery(rebuildSuperSearchQuery(parsedQuery, remainingPrefixScopeIds));
+        inputRef.current?.focus();
+        return;
+      }
+
+      setManualScopeIds((current) =>
+        current.includes(scopeId)
+          ? current.filter((id) => id !== scopeId)
+          : [...current, scopeId],
+      );
+      inputRef.current?.focus();
+    },
+    [parsedQuery],
+  );
+
+  const showNoResults =
+    open &&
+    !loadingFiles &&
+    flatResults.length === 0 &&
+    (hasQuery || scopes.length > 0);
+
+  const toggleSection = useCallback((sectionKey: string) => {
+    setCollapsedSectionKeys((current) =>
+      current.includes(sectionKey)
+        ? current.filter((key) => key !== sectionKey)
+        : [...current, sectionKey],
+    );
+    inputRef.current?.focus();
+  }, []);
+
+  const toggleGroupExpanded = useCallback((groupId: string) => {
+    setExpandedGroupKeys((current) =>
+      current.includes(groupId)
+        ? current.filter((id) => id !== groupId)
+        : [...current, groupId],
+    );
+    inputRef.current?.focus();
+  }, []);
+
+  const scopeFilters =
+    scopes.length > 0 ? (
+      <div
+        className="super-search-filters"
+        aria-label={t("superSearch.filtersAriaLabel", "Search filters")}
+      >
+        <Chip
+          size="sm"
+          accent={activeScopeIds.size === 0 ? "default" : "neutral"}
+          variant={activeScopeIds.size === 0 ? "primary" : "secondary"}
+          aria-pressed={activeScopeIds.size === 0}
+          onClick={() => toggleScope("__all__")}
+        >
+          {t("superSearch.all", "All")}
+        </Chip>
+        {scopes.map((scope) => {
+          const active = activeScopeIds.has(scope.id);
+          return (
+            <Chip
+              key={scope.id}
+              size="sm"
+              accent={active ? "default" : "neutral"}
+              variant={active ? "primary" : "secondary"}
+              aria-pressed={active}
+              onClick={() => toggleScope(scope.id)}
+            >
+              {scope.label}
+            </Chip>
+          );
+        })}
+      </div>
+    ) : null;
+
+  const dropdown =
+    open && rect ? (
+      <div
+        ref={dropdownRef}
+        id={listboxId}
+        className={`super-search-dropdown${
+          dropdownClassName ? ` ${dropdownClassName}` : ""
+        }`}
+        role="listbox"
+        style={{ top: rect.top, left: rect.left, width: rect.width }}
+        // Keep focus on the input when clicking inside the dropdown.
+        onMouseDown={(e) => e.preventDefault()}
+      >
+        {scopeFilters}
+
+        {!hasQuery && scopes.length === 0 && (
+          <div className="super-search-empty">
+            {t("superSearch.hint", "Type to search")}
+          </div>
+        )}
+
+        {showNoResults && (
+          <div className="super-search-empty">
+            {t("search.noResults", "No results found")}
+          </div>
+        )}
+
+        {hasQuery &&
+          visibleSections.map((section) => (
+            <div key={section.key} className="super-search-section">
+              {section.label && (
+                <div className="super-search-section-header">
+                  <Button
+                    className="super-search-section-toggle"
+                    variant="quiet"
+                    aria-expanded={!section.collapsed}
+                    onClick={() => toggleSection(section.key)}
+                    rightSection={
+                      <span
+                        className={`super-search-section-chevron${
+                          section.collapsed
+                            ? " super-search-section-chevron--collapsed"
+                            : ""
+                        }`}
+                        aria-hidden="true"
+                      >
+                        <LocalIcon
+                          icon="expand-more-rounded"
+                          width="1rem"
+                          height="1rem"
+                        />
+                      </span>
+                    }
+                  >
+                    <span className="super-search-section-label">
+                      {section.label}
+                    </span>
+                  </Button>
+                </div>
+              )}
+              {!section.collapsed && (
+                <div className="super-search-section-body">
+                  {section.groups.map((group) => {
+                    const shownCount = visibleCountFor(group);
+                    const hiddenCount = group.results.length - shownCount;
+                    // Groups within one row of the cap always show everything
+                    // (visibleCountFor's cap+1 exception) — no toggle for them.
+                    const expandable =
+                      group.results.length > COLLAPSED_GROUP_SIZE + 1;
+                    return (
+                      <div
+                        key={group.id}
+                        className="super-search-group"
+                        role="group"
+                        aria-label={group.label}
+                      >
+                        {/* A lone group repeating its section's name reads as a
+                            duplicate header — the section title covers it. */}
+                        {group.label !== section.label && (
+                          <div
+                            className="super-search-group-label"
+                            aria-hidden="true"
+                          >
+                            {group.label}
+                          </div>
+                        )}
+                        <div className="super-search-group-results">
+                          {group.results.slice(0, shownCount).map((result) => {
+                            const index = flatIndexByKey.get(result.key) ?? -1;
+                            const active = index === highlight;
+                            return (
+                              <Button
+                                key={result.key}
+                                id={optionId(index)}
+                                type="button"
+                                variant="quiet"
+                                justify="start"
+                                fullWidth
+                                role="option"
+                                aria-selected={active}
+                                className={`super-search-item${active ? " active" : ""}`}
+                                onMouseEnter={() => moveHighlight(index)}
+                                onClick={() => selectResult(result)}
+                              >
+                                <span className="super-search-item-icon">
+                                  {result.icon ?? (
+                                    <LocalIcon
+                                      icon={result.iconName ?? "search-rounded"}
+                                      width="1.1rem"
+                                      height="1.1rem"
+                                    />
+                                  )}
+                                </span>
+                                <span className="super-search-item-text">
+                                  <span className="super-search-item-title">
+                                    {result.title}
+                                  </span>
+                                  {result.subtitle && (
+                                    <Text size="xs" c="dimmed" lineClamp={1}>
+                                      {result.subtitle}
+                                    </Text>
+                                  )}
+                                </span>
+                              </Button>
+                            );
+                          })}
+                        </div>
+                        {expandable && (
+                          <Button
+                            type="button"
+                            variant="quiet"
+                            justify="start"
+                            className="super-search-show-more"
+                            onClick={() => toggleGroupExpanded(group.id)}
+                          >
+                            {hiddenCount > 0
+                              ? t(
+                                  "superSearch.showMore",
+                                  "Show {{count}} more",
+                                  { count: hiddenCount },
+                                )
+                              : t("superSearch.showLess", "Show less")}
+                          </Button>
+                        )}
+                      </div>
+                    );
+                  })}
+                </div>
+              )}
+            </div>
+          ))}
+      </div>
+    ) : null;
+
+  return (
+    <div className="super-search" ref={containerRef} onKeyDown={handleKeyDown}>
+      <div className="super-search-input-row">
+        <TextInput
+          id={inputId}
+          name={inputId}
+          ref={inputRef}
+          value={query}
+          onChange={setQuery}
+          placeholder={t("superSearch.placeholder", "Search Stirling")}
+          icon={
+            <LocalIcon icon="search-rounded" width="1.1rem" height="1.1rem" />
+          }
+          autoComplete="off"
+          role="combobox"
+          aria-label={t("superSearch.ariaLabel", "Super search")}
+          aria-expanded={open}
+          aria-controls={open ? listboxId : undefined}
+          aria-activedescendant={
+            open && visibleFlatResults[highlight]
+              ? optionId(highlight)
+              : undefined
+          }
+          aria-autocomplete="list"
+          onFocus={() => setOpen(true)}
+        />
+        {!open && !hasQuery && (
+          <kbd className="super-search-kbd" aria-hidden="true">
+            {shortcutHint}
+          </kbd>
+        )}
+      </div>
+      {dropdown && createPortal(dropdown, document.body)}
+    </div>
+  );
+}
diff --git a/frontend/editor/src/core/components/shared/superSearch/superSearchFilters.test.ts b/frontend/editor/src/core/components/shared/superSearch/superSearchFilters.test.ts
new file mode 100644
index 0000000000..a8637952f9
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/superSearch/superSearchFilters.test.ts
@@ -0,0 +1,73 @@
+import { describe, expect, it } from "vitest";
+import {
+  parseSuperSearchQuery,
+  rebuildSuperSearchQuery,
+} from "@app/components/shared/superSearch/superSearchFilters";
+import type { SuperSearchScope } from "@app/hooks/useSuperSearch";
+
+const SCOPES: SuperSearchScope[] = [
+  { id: "portal-policies", label: "Policies", aliases: ["policy", "policies"] },
+  { id: "tools", label: "Tools", aliases: ["tool", "tools"] },
+];
+
+describe("parseSuperSearchQuery", () => {
+  it("returns the trimmed query untouched when no scopes exist", () => {
+    const parsed = parseSuperSearchQuery("  policy: invoice ", []);
+    expect(parsed).toEqual({
+      query: "policy: invoice",
+      prefixTokens: [],
+      prefixedScopeIds: [],
+    });
+  });
+
+  it("maps a known prefix to its scope and strips it from the query", () => {
+    const parsed = parseSuperSearchQuery("policy: invoice", SCOPES);
+    expect(parsed.query).toBe("invoice");
+    expect(parsed.prefixedScopeIds).toEqual(["portal-policies"]);
+    expect(parsed.prefixTokens).toEqual([
+      { scopeId: "portal-policies", token: "policy:" },
+    ]);
+  });
+
+  it("accepts chained prefixes and aliases case-insensitively", () => {
+    const parsed = parseSuperSearchQuery("Policy:TOOLS: merge", SCOPES);
+    expect(parsed.query).toBe("merge");
+    expect(parsed.prefixedScopeIds).toEqual(["portal-policies", "tools"]);
+  });
+
+  it("dedupes repeated prefixes for the same scope", () => {
+    const parsed = parseSuperSearchQuery("policy: policies: invoice", SCOPES);
+    expect(parsed.prefixedScopeIds).toEqual(["portal-policies"]);
+    expect(parsed.prefixTokens).toHaveLength(2);
+  });
+
+  it("stops at the first unknown token so colon text stays in the query", () => {
+    const parsed = parseSuperSearchQuery("chapter: 1 policy: x", SCOPES);
+    expect(parsed.query).toBe("chapter: 1 policy: x");
+    expect(parsed.prefixedScopeIds).toEqual([]);
+  });
+
+  it("leaves colons after the first word alone", () => {
+    const parsed = parseSuperSearchQuery("policy: name: value", SCOPES);
+    expect(parsed.query).toBe("name: value");
+    expect(parsed.prefixedScopeIds).toEqual(["portal-policies"]);
+  });
+});
+
+describe("rebuildSuperSearchQuery", () => {
+  it("keeps only the requested scopes' tokens, in original order", () => {
+    const parsed = parseSuperSearchQuery("policy: tools: merge", SCOPES);
+    expect(rebuildSuperSearchQuery(parsed, new Set(["tools"]))).toBe(
+      "tools: merge",
+    );
+    expect(rebuildSuperSearchQuery(parsed, new Set())).toBe("merge");
+    expect(
+      rebuildSuperSearchQuery(parsed, new Set(["portal-policies", "tools"])),
+    ).toBe("policy: tools: merge");
+  });
+
+  it("drops the trailing space when the free text is empty", () => {
+    const parsed = parseSuperSearchQuery("policy:", SCOPES);
+    expect(rebuildSuperSearchQuery(parsed, new Set())).toBe("");
+  });
+});
diff --git a/frontend/editor/src/core/components/shared/superSearch/superSearchFilters.ts b/frontend/editor/src/core/components/shared/superSearch/superSearchFilters.ts
new file mode 100644
index 0000000000..58b066c6f9
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/superSearch/superSearchFilters.ts
@@ -0,0 +1,77 @@
+import type { SuperSearchScope } from "@app/hooks/useSuperSearch";
+
+export interface SuperSearchPrefixToken {
+  scopeId: string;
+  token: string;
+}
+
+export interface ParsedSuperSearchQuery {
+  query: string;
+  prefixTokens: SuperSearchPrefixToken[];
+  prefixedScopeIds: string[];
+}
+
+function buildScopeLookup(scopes: readonly SuperSearchScope[]) {
+  const lookup = new Map<string, string>();
+  for (const scope of scopes) {
+    lookup.set(scope.id.toLowerCase(), scope.id);
+    for (const alias of scope.aliases ?? []) {
+      lookup.set(alias.toLowerCase(), scope.id);
+    }
+  }
+  return lookup;
+}
+
+/**
+ * Parses leading `scope:` tokens into active scopes and returns the remaining
+ * free-text query. Prefixes only count at the start so normal colon text in
+ * the search term is left alone.
+ */
+export function parseSuperSearchQuery(
+  rawQuery: string,
+  scopes: readonly SuperSearchScope[],
+): ParsedSuperSearchQuery {
+  if (scopes.length === 0) {
+    return {
+      query: rawQuery.trim(),
+      prefixTokens: [],
+      prefixedScopeIds: [],
+    };
+  }
+
+  const scopeLookup = buildScopeLookup(scopes);
+  const prefixTokens: SuperSearchPrefixToken[] = [];
+  let remainder = rawQuery.trimStart();
+
+  while (remainder.length > 0) {
+    const match = remainder.match(/^([^\s:]+):/);
+    if (!match) break;
+
+    const token = match[1];
+    const scopeId = scopeLookup.get(token.toLowerCase());
+    if (!scopeId) break;
+
+    prefixTokens.push({ scopeId, token: `${token}:` });
+    remainder = remainder.slice(match[0].length).trimStart();
+  }
+
+  return {
+    query: remainder.trim(),
+    prefixTokens,
+    prefixedScopeIds: [...new Set(prefixTokens.map((token) => token.scopeId))],
+  };
+}
+
+export function rebuildSuperSearchQuery(
+  parsed: ParsedSuperSearchQuery,
+  keepScopeIds: ReadonlySet<string>,
+): string {
+  return [
+    ...parsed.prefixTokens
+      .filter((token) => keepScopeIds.has(token.scopeId))
+      .map((token) => token.token),
+    parsed.query,
+  ]
+    .filter(Boolean)
+    .join(" ");
+}
diff --git a/frontend/editor/src/core/components/tools/RightSidebar.tsx b/frontend/editor/src/core/components/tools/RightSidebar.tsx
index 34c6ab5a51..d6cd86868b 100644
--- a/frontend/editor/src/core/components/tools/RightSidebar.tsx
+++ b/frontend/editor/src/core/components/tools/RightSidebar.tsx
@@ -4,7 +4,6 @@ import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
 import { useSidebarContext } from "@app/contexts/SidebarContext";
 import { useIsMobile } from "@app/hooks/useIsMobile";
 import ToolPanel from "@app/components/tools/ToolPanel";
-import ToolSearch from "@app/components/tools/toolPicker/ToolSearch";
 import { usePoliciesEnabled } from "@app/components/policies/usePoliciesEnabled";
 import { PolicyAutoRunController } from "@app/components/policies/PolicyAutoRunController";
 import { useFavoriteToolItems } from "@app/hooks/tools/useFavoriteToolItems";
@@ -17,7 +16,6 @@ import { ActionIcon } from "@app/ui/ActionIcon";
 import { withViewTransition } from "@app/utils/viewTransition";
 import { SidebarToggleIcon } from "@app/components/shared/SidebarToggleIcon";
 import CloseIcon from "@mui/icons-material/Close";
-import SearchIcon from "@mui/icons-material/Search";
 import { ToolId } from "@app/types/toolId";
 import type { ToolRegistryEntry } from "@app/data/toolsTaxonomy";
 import {
@@ -43,7 +41,6 @@ export default function RightSidebar() {
   const {
     leftPanelView,
     isPanelVisible,
-    searchQuery,
     filteredTools,
     toolRegistry,
     setSearchQuery,
@@ -79,7 +76,6 @@ export default function RightSidebar() {
   };
 
   const [allToolsView, setAllToolsView] = useState(false);
-  const [headerSearchOpen, setHeaderSearchOpen] = useState(false);
 
   const handleShowAllTools = () => {
     withViewTransition(() => setAllToolsView(true));
@@ -97,7 +93,6 @@ export default function RightSidebar() {
   const inToolView = leftPanelView !== "toolPicker";
   // Show X (close) button only when there's somewhere to go back to.
   const showCloseButton = inToolView || allToolsView;
-  const showHeaderSearch = showCloseButton || headerSearchOpen;
 
   const handleHeaderBack = () => {
     if (inToolView) {
@@ -111,20 +106,6 @@ export default function RightSidebar() {
     withViewTransition(() => handleToolSelect(id));
   };
 
-  // Typing in the header search while inside a tool exits the tool and lifts the
-  // panel into the all-tools view so the user immediately sees search results.
-  const handleHeaderSearchChange = (value: string) => {
-    if (inToolView) {
-      withViewTransition(() => {
-        handleBackToTools();
-        setAllToolsView(true);
-        setSearchQuery(value);
-      });
-      return;
-    }
-    setSearchQuery(value);
-  };
-
   const activeTool: ToolRegistryEntry | null =
     inToolView && selectedToolKey
       ? (toolRegistry[selectedToolKey as ToolId] ?? null)
@@ -235,6 +216,7 @@ export default function RightSidebar() {
             flexShrink: 0,
             display: "flex",
             flexDirection: "column",
+            position: "relative",
           }}
         >
           <>
@@ -257,41 +239,10 @@ export default function RightSidebar() {
               />
             ) : (
               <div className="tool-panel__compact-header">
-                {showHeaderSearch ? (
-                  <div className="tool-panel__compact-header-search">
-                    <ToolSearch
-                      value={searchQuery}
-                      onChange={handleHeaderSearchChange}
-                      toolRegistry={toolRegistry}
-                      mode="filter"
-                      autoFocus
-                    />
-                  </div>
-                ) : (
-                  <span className="tool-panel__compact-title">
-                    {t("toolPanel.pdfTools", "PDF Tools")}
-                  </span>
-                )}
+                <span className="tool-panel__compact-title">
+                  {t("toolPanel.pdfTools", "PDF Tools")}
+                </span>
                 <div className="tool-panel__compact-header-actions">
-                  {!showCloseButton && (
-                    <ActionIcon
-                      variant="tertiary"
-                      size="md"
-                      shape="circle"
-                      onClick={() => {
-                        if (headerSearchOpen) handleHeaderSearchChange("");
-                        setHeaderSearchOpen((open) => !open);
-                      }}
-                      aria-label={t("toolPanel.searchTools", "Search tools")}
-                      className="tool-panel__expand-btn"
-                    >
-                      {headerSearchOpen ? (
-                        <CloseIcon sx={{ fontSize: "1.1rem" }} />
-                      ) : (
-                        <SearchIcon sx={{ fontSize: "1.1rem" }} />
-                      )}
-                    </ActionIcon>
-                  )}
                   {showCloseButton ? (
                     <ActionIcon
                       variant="tertiary"
diff --git a/frontend/editor/src/core/components/tools/ToolPanel.css b/frontend/editor/src/core/components/tools/ToolPanel.css
index 41100bbf9f..0e93c414d8 100644
--- a/frontend/editor/src/core/components/tools/ToolPanel.css
+++ b/frontend/editor/src/core/components/tools/ToolPanel.css
@@ -177,15 +177,6 @@
   flex-shrink: 0;
 }
 
-.tool-panel__compact-header-search {
-  flex: 1 1 auto;
-  min-width: 0;
-}
-
-.tool-panel__compact-header-search .search-input-container {
-  width: 100%;
-}
-
 /* Search that separates the Policies section from the Tools list below it. */
 .tool-panel__between-search {
   padding: 0.5rem 0.75rem 0.25rem;
diff --git a/frontend/editor/src/core/components/tools/changeMetadata/ChangeMetadataSingleStep.tsx b/frontend/editor/src/core/components/tools/changeMetadata/ChangeMetadataSingleStep.tsx
index 2eff20b23b..07ba4e7e05 100644
--- a/frontend/editor/src/core/components/tools/changeMetadata/ChangeMetadataSingleStep.tsx
+++ b/frontend/editor/src/core/components/tools/changeMetadata/ChangeMetadataSingleStep.tsx
@@ -1,5 +1,7 @@
+import { useContext, useEffect, useState } from "react";
 import { Stack, Divider, Text } from "@mantine/core";
 import { useTranslation } from "react-i18next";
+import { ViewerContext } from "@app/contexts/ViewerContext";
 import {
   ChangeMetadataParameters,
   createCustomMetadataFunctions,
@@ -19,6 +21,31 @@ interface ChangeMetadataSingleStepProps {
   disabled?: boolean;
 }
 
+/**
+ * Pre-fills the form from the currently open document's existing metadata.
+ * Isolated in its own component so it only mounts where a ViewerProvider exists
+ * (the editor and the in-editor Automate modal). The pipeline builder has no
+ * viewer and no single "current document", so it is skipped there rather than
+ * crashing on useViewer.
+ */
+const MetadataPrefill = ({
+  onParameterChange,
+  onExtractingChange,
+}: {
+  onParameterChange: ChangeMetadataSingleStepProps["onParameterChange"];
+  onExtractingChange: (extracting: boolean) => void;
+}) => {
+  const { isExtractingMetadata } = useMetadataExtraction({
+    updateParameter: onParameterChange,
+  });
+
+  useEffect(() => {
+    onExtractingChange(isExtractingMetadata);
+  }, [isExtractingMetadata, onExtractingChange]);
+
+  return null;
+};
+
 const ChangeMetadataSingleStep = ({
   parameters,
   onParameterChange,
@@ -26,77 +53,85 @@ const ChangeMetadataSingleStep = ({
 }: ChangeMetadataSingleStepProps) => {
   const { t } = useTranslation();
 
+  // Auto-prefill reads the viewer/file contexts, which only exist in the editor.
+  // Gate on the viewer so the pipeline builder renders the fields without it.
+  const hasViewerContext = useContext(ViewerContext) !== null;
+  const [isExtractingMetadata, setIsExtractingMetadata] = useState(false);
+
   // Get custom metadata functions using the utility
   const { addCustomMetadata, removeCustomMetadata, updateCustomMetadata } =
     createCustomMetadataFunctions(parameters, onParameterChange);
 
-  // Extract metadata from uploaded files
-  const { isExtractingMetadata } = useMetadataExtraction({
-    updateParameter: onParameterChange,
-  });
-
   const isDeleteAllEnabled = parameters.deleteAll;
   const fieldsDisabled = disabled || isDeleteAllEnabled || isExtractingMetadata;
 
   return (
-    <Stack gap="md">
-      {/* Delete All */}
-      <Stack gap="md">
-        <Text size="sm" fw={500}>
-          {t("changeMetadata.deleteAll.label", "Delete All Metadata")}
-        </Text>
-        <DeleteAllStep
-          parameters={parameters}
+    <>
+      {hasViewerContext && (
+        <MetadataPrefill
           onParameterChange={onParameterChange}
-          disabled={disabled}
+          onExtractingChange={setIsExtractingMetadata}
         />
-      </Stack>
-
-      <Divider />
-
-      {/* Standard Metadata Fields */}
+      )}
       <Stack gap="md">
-        <Text size="sm" fw={500}>
-          {t("changeMetadata.standardFields.title", "Standard Metadata")}
-        </Text>
-        <StandardMetadataStep
-          parameters={parameters}
-          onParameterChange={onParameterChange}
-          disabled={fieldsDisabled}
-        />
+        {/* Delete All */}
+        <Stack gap="md">
+          <Text size="sm" fw={500}>
+            {t("changeMetadata.deleteAll.label", "Delete All Metadata")}
+          </Text>
+          <DeleteAllStep
+            parameters={parameters}
+            onParameterChange={onParameterChange}
+            disabled={disabled}
+          />
+        </Stack>
+
+        <Divider />
+
+        {/* Standard Metadata Fields */}
+        <Stack gap="md">
+          <Text size="sm" fw={500}>
+            {t("changeMetadata.standardFields.title", "Standard Metadata")}
+          </Text>
+          <StandardMetadataStep
+            parameters={parameters}
+            onParameterChange={onParameterChange}
+            disabled={fieldsDisabled}
+          />
+        </Stack>
+
+        <Divider />
+
+        {/* Document Dates */}
+        <Stack gap="md">
+          <Text size="sm" fw={500}>
+            {t("changeMetadata.dates.title", "Document Dates")}
+          </Text>
+          <DocumentDatesStep
+            parameters={parameters}
+            onParameterChange={onParameterChange}
+            disabled={fieldsDisabled}
+          />
+        </Stack>
+
+        <Divider />
+
+        {/* Advanced Options */}
+        <Stack gap="md">
+          <Text size="sm" fw={500}>
+            {t("changeMetadata.advanced.title", "Advanced Options")}
+          </Text>
+          <AdvancedOptionsStep
+            parameters={parameters}
+            onParameterChange={onParameterChange}
+            disabled={fieldsDisabled}
+            addCustomMetadata={addCustomMetadata}
+            removeCustomMetadata={removeCustomMetadata}
+            updateCustomMetadata={updateCustomMetadata}
+          />
+        </Stack>
       </Stack>
-
-      <Divider />
-
-      {/* Document Dates */}
-      <Stack gap="md">
-        <Text size="sm" fw={500}>
-          {t("changeMetadata.dates.title", "Document Dates")}
-        </Text>
-        <DocumentDatesStep
-          parameters={parameters}
-          onParameterChange={onParameterChange}
-          disabled={fieldsDisabled}
-        />
-      </Stack>
-
-      <Divider />
-
-      {/* Advanced Options */}
-      <Stack gap="md">
-        <Text size="sm" fw={500}>
-          {t("changeMetadata.advanced.title", "Advanced Options")}
-        </Text>
-        <AdvancedOptionsStep
-          parameters={parameters}
-          onParameterChange={onParameterChange}
-          disabled={fieldsDisabled}
-          addCustomMetadata={addCustomMetadata}
-          removeCustomMetadata={removeCustomMetadata}
-          updateCustomMetadata={updateCustomMetadata}
-        />
-      </Stack>
-    </Stack>
+    </>
   );
 };
 
diff --git a/frontend/editor/src/core/components/tools/merge/MergeFileSorter.tsx b/frontend/editor/src/core/components/tools/merge/MergeFileSorter.tsx
index 61300fbb68..15730c35f3 100644
--- a/frontend/editor/src/core/components/tools/merge/MergeFileSorter.tsx
+++ b/frontend/editor/src/core/components/tools/merge/MergeFileSorter.tsx
@@ -70,7 +70,7 @@ const MergeFileSorter: React.FC<MergeFileSorterProps> = ({
 
           <ActionIcon
             variant="secondary"
-            size="md"
+            size="sm"
             onClick={handleDirectionToggle}
             disabled={disabled}
             title={
diff --git a/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.tsx b/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.tsx
index 2648990248..e7246bb4e3 100644
--- a/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.tsx
+++ b/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.tsx
@@ -1,3 +1,4 @@
+import { useContext, useRef } from "react";
 import {
   Stack,
   Text,
@@ -7,6 +8,7 @@ import {
   Divider,
 } from "@mantine/core";
 import { Button } from "@app/ui/Button";
+import { FilePicker } from "@app/ui/FilePicker";
 import { ActionIcon } from "@app/ui/ActionIcon";
 import { SegmentedControl } from "@app/ui/SegmentedControl";
 import { useTranslation } from "react-i18next";
@@ -15,7 +17,7 @@ import {
   type OverlayMode,
 } from "@app/hooks/tools/overlayPdfs/useOverlayPdfsParameters";
 import LocalIcon from "@app/components/shared/LocalIcon";
-import { useFilesModalContext } from "@app/contexts/FilesModalContext";
+import { FilesModalContext } from "@app/contexts/FilesModalContext";
 import styles from "@app/components/tools/overlayPdfs/OverlayPdfsSettings.module.css";
 import { Z_INDEX_AUTOMATE_DROPDOWN } from "@app/styles/zIndex";
 
@@ -34,7 +36,12 @@ export default function OverlayPdfsSettings({
   disabled = false,
 }: OverlayPdfsSettingsProps) {
   const { t } = useTranslation();
-  const { openFilesModal } = useFilesModalContext();
+  // Read optionally: the portal pipeline builder mounts no FilesModalProvider.
+  // Present (editor tool + Automate modal) -> keep the workspace file picker;
+  // absent (portal) -> fall back to the plain file input below.
+  const filesModal = useContext(FilesModalContext);
+  // Clears the FilePicker so the same file can be re-selected (Mantine resetRef).
+  const resetOverlayPicker = useRef<() => void>(null);
 
   const handleOverlayFilesChange = (files: File[]) => {
     onParameterChange("overlayFiles", files);
@@ -66,8 +73,8 @@ export default function OverlayPdfsSettings({
   };
 
   const handleOpenOverlayFilesModal = () => {
-    if (disabled) return;
-    openFilesModal({
+    if (disabled || !filesModal) return;
+    filesModal.openFilesModal({
       customHandler: (files: File[]) => {
         handleOverlayFilesChange([
           ...(parameters.overlayFiles || []),
@@ -77,6 +84,17 @@ export default function OverlayPdfsSettings({
     });
   };
 
+  const appendOverlayFiles = (files: File[]) => {
+    if (files.length === 0) return;
+    handleOverlayFilesChange([...(parameters.overlayFiles || []), ...files]);
+    resetOverlayPicker.current?.();
+  };
+
+  const overlayFilesButtonLabel =
+    parameters.overlayFiles?.length > 0
+      ? t("overlay-pdfs.overlayFiles.addMore", "Add more PDFs...")
+      : t("overlay-pdfs.overlayFiles.placeholder", "Choose PDF(s)...");
+
   return (
     <Stack gap="md">
       <Stack gap="xs">
@@ -183,17 +201,30 @@ export default function OverlayPdfsSettings({
         <Text size="sm" fw={500}>
           {t("overlay-pdfs.overlayFiles.label", "Overlay Files")}
         </Text>
-        <Button
-          size="sm"
-          onClick={handleOpenOverlayFilesModal}
-          disabled={disabled}
-          leftSection={<LocalIcon icon="add" width="14" height="14" />}
-          fullWidth
-        >
-          {parameters.overlayFiles?.length > 0
-            ? t("overlay-pdfs.overlayFiles.addMore", "Add more PDFs...")
-            : t("overlay-pdfs.overlayFiles.placeholder", "Choose PDF(s)...")}
-        </Button>
+        {filesModal ? (
+          <Button
+            size="sm"
+            onClick={handleOpenOverlayFilesModal}
+            disabled={disabled}
+            leftSection={<LocalIcon icon="add" width="14" height="14" />}
+            fullWidth
+          >
+            {overlayFilesButtonLabel}
+          </Button>
+        ) : (
+          <FilePicker
+            multiple
+            accept="application/pdf"
+            onChange={appendOverlayFiles}
+            resetRef={resetOverlayPicker}
+            size="sm"
+            disabled={disabled}
+            leftSection={<LocalIcon icon="add" width="14" height="14" />}
+            fullWidth
+          >
+            {overlayFilesButtonLabel}
+          </FilePicker>
+        )}
 
         {parameters.overlayFiles?.length > 0 &&
           (() => {
diff --git a/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx b/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx
index 9a590587ee..9c92730077 100644
--- a/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx
+++ b/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx
@@ -17,6 +17,8 @@ import { useFileContext } from "@app/contexts/FileContext";
 import { isStirlingFile, type FileId } from "@app/types/fileContext";
 import { createStirlingFilesAndStubs } from "@app/services/fileStubHelpers";
 import apiClient from "@app/services/apiClient";
+import { openExternalTab } from "@app/platform/openExternalTab";
+import { getExternalHref } from "@app/utils/externalUrl";
 import { PdfBookmarkObject, PdfActionType } from "@embedpdf/models";
 import { useTranslation } from "react-i18next";
 import BookmarksIcon from "@mui/icons-material/BookmarksRounded";
@@ -74,6 +76,17 @@ const resolvePageNumber = (bookmark: PdfBookmarkObject): number | null => {
   return null;
 };
 
+// Bookmark targets are PDF-supplied, so sanitise before opening. Local paths
+// from LaunchAppOrOpenFile fail the allowlist - a browser blocks them anyway.
+const openBookmarkTarget = (rawUrl: string): void => {
+  const href = getExternalHref(rawUrl);
+  if (!href) {
+    console.warn("[BookmarkSidebar] Blocked unsafe URL:", rawUrl);
+    return;
+  }
+  void openExternalTab(href);
+};
+
 export const BookmarkSidebar = ({
   visible,
   thumbnailVisible,
@@ -515,12 +528,12 @@ export const BookmarkSidebar = ({
       const action = target.action;
       if (action.type === PdfActionType.URI && action.uri) {
         event.preventDefault();
-        window.open(action.uri, "_blank", "noopener");
+        openBookmarkTarget(action.uri);
         return;
       }
       if (action.type === PdfActionType.LaunchAppOrOpenFile && action.path) {
         event.preventDefault();
-        window.open(action.path, "_blank", "noopener");
+        openBookmarkTarget(action.path);
         return;
       }
     }
diff --git a/frontend/editor/src/core/components/viewer/LinkLayer.tsx b/frontend/editor/src/core/components/viewer/LinkLayer.tsx
index e1a2aeb8f0..e68c541fd8 100644
--- a/frontend/editor/src/core/components/viewer/LinkLayer.tsx
+++ b/frontend/editor/src/core/components/viewer/LinkLayer.tsx
@@ -19,6 +19,9 @@ import {
 import { Z_INDEX_VIEWER_FLOATING_MENU } from "@app/styles/zIndex";
 import { Button } from "@app/ui/Button";
 import { ActionIcon } from "@app/ui/ActionIcon";
+import { openExternalTab } from "@app/platform/openExternalTab";
+import { getExternalHref } from "@app/utils/externalUrl";
+
 // ---------------------------------------------------------------------------
 // Inline SVG icons (thin-stroke, modern)
 // ---------------------------------------------------------------------------
@@ -401,19 +404,11 @@ export const LinkLayer: React.FC<LinkLayerProps> = ({
             behavior: "smooth",
           });
         } else if (action.type === PdfActionType.URI) {
-          const uri = action.uri;
-          try {
-            const url = new URL(uri, window.location.href);
-            if (["http:", "https:", "mailto:"].includes(url.protocol)) {
-              window.open(uri, "_blank", "noopener,noreferrer");
-            } else {
-              console.warn(
-                "[LinkLayer] Blocked unsafe URL protocol:",
-                url.protocol,
-              );
-            }
-          } catch {
-            window.open(uri, "_blank", "noopener,noreferrer");
+          const href = getExternalHref(action.uri);
+          if (href) {
+            void openExternalTab(href);
+          } else {
+            console.warn("[LinkLayer] Blocked unsafe URL:", action.uri);
           }
         }
       }
@@ -513,6 +508,11 @@ export const LinkLayer: React.FC<LinkLayerProps> = ({
           const top = annotationLink.rect.origin.y * scale;
           const width = annotationLink.rect.size.width * scale;
           const height = annotationLink.rect.size.height * scale;
+          const externalHref =
+            annotationLink.target?.type === "action" &&
+            annotationLink.target.action.type === PdfActionType.URI
+              ? getExternalHref(annotationLink.target.action.uri)
+              : null;
 
           return (
             <a
@@ -524,7 +524,9 @@ export const LinkLayer: React.FC<LinkLayerProps> = ({
                   linkElementRefs.current.delete(annotationLink.id);
                 }
               }}
-              href="#"
+              href={externalHref ?? "#"}
+              target={externalHref ? "_blank" : undefined}
+              rel={externalHref ? "noopener noreferrer" : undefined}
               onClick={(e) => {
                 e.preventDefault();
                 e.stopPropagation();
diff --git a/frontend/editor/src/core/components/viewer/useAnnotationMenuHandlers.ts b/frontend/editor/src/core/components/viewer/useAnnotationMenuHandlers.ts
index bf14b559f4..3e9e048aaf 100644
--- a/frontend/editor/src/core/components/viewer/useAnnotationMenuHandlers.ts
+++ b/frontend/editor/src/core/components/viewer/useAnnotationMenuHandlers.ts
@@ -14,6 +14,8 @@ import type {
   AnnotationPatch,
 } from "@app/components/viewer/viewerTypes";
 import type { ScrollActions } from "@app/contexts/viewer/viewerActions";
+import { openExternalTab } from "@app/platform/openExternalTab";
+import { getExternalHref } from "@app/utils/externalUrl";
 
 export type AnnotationType =
   | "textMarkup"
@@ -370,7 +372,15 @@ export function useAnnotationMenuHandlers({
   const onGoToLink = useCallback(() => {
     if (!firstLinkTarget) return;
     if (firstLinkTarget.type === "uri") {
-      window.open(firstLinkTarget.uri, "_blank", "noopener,noreferrer");
+      const href = getExternalHref(firstLinkTarget.uri);
+      if (href) {
+        void openExternalTab(href);
+      } else {
+        console.warn(
+          "[useAnnotationMenuHandlers] Blocked unsafe URL:",
+          firstLinkTarget.uri,
+        );
+      }
     } else {
       scrollActions.scrollToPage(firstLinkTarget.pageIndex + 1);
     }
diff --git a/frontend/editor/src/core/components/viewer/useViewerWorkbenchBarButtons.tsx b/frontend/editor/src/core/components/viewer/useViewerWorkbenchBarButtons.tsx
index d5d39c4c0c..3aada126ea 100644
--- a/frontend/editor/src/core/components/viewer/useViewerWorkbenchBarButtons.tsx
+++ b/frontend/editor/src/core/components/viewer/useViewerWorkbenchBarButtons.tsx
@@ -209,7 +209,11 @@ export function useViewerWorkbenchBarButtons(
                     aria-label={searchLabel}
                     onClick={viewer.searchInterfaceActions.toggle}
                   >
-                    <LocalIcon icon="search" width="1rem" height="1rem" />
+                    <LocalIcon
+                      icon="find-in-page-rounded"
+                      width="1.25rem"
+                      height="1.25rem"
+                    />
                   </ActionIcon>
                 </div>
               </Popover.Target>
diff --git a/frontend/editor/src/core/contexts/FileContext.tsx b/frontend/editor/src/core/contexts/FileContext.tsx
index a982c347ca..634562375c 100644
--- a/frontend/editor/src/core/contexts/FileContext.tsx
+++ b/frontend/editor/src/core/contexts/FileContext.tsx
@@ -58,6 +58,7 @@ import {
   IndexedDBProvider,
   useIndexedDB,
 } from "@app/contexts/IndexedDBContext";
+import { onRecordUnreadable } from "@app/services/fileStorage";
 import { useZipConfirmation } from "@app/hooks/useZipConfirmation";
 import ZipWarningModal from "@app/components/shared/ZipWarningModal";
 import EncryptedPdfUnlockModal from "@app/components/shared/EncryptedPdfUnlockModal";
@@ -66,6 +67,7 @@ import { alert } from "@app/components/toast";
 import { buildRemovePasswordFormData } from "@app/hooks/tools/removePassword/buildRemovePasswordFormData";
 import type { RemovePasswordParameters } from "@app/hooks/tools/removePassword/useRemovePasswordParameters";
 import apiClient from "@app/services/apiClient";
+import { reportFilesRemoved } from "@app/services/failureReporting";
 import { processResponse } from "@app/utils/toolResponseProcessor";
 import { ToolOperation } from "@app/types/file";
 import { handlePasswordError } from "@app/utils/toolErrorHandler";
@@ -186,6 +188,21 @@ function FileContextInner({
     setUnlockError(null);
   }, [activeEncryptedFileId]);
 
+  // Storage proved a file's bytes unreadable (WebKit losing a blob's backing
+  // store). Drop it: the viewer would otherwise spin on a document that can
+  // never load. The record stays, so a reload re-tests it.
+  useEffect(
+    () =>
+      onRecordUnreadable((fileId) => {
+        if (!stateRef.current.files.byId[fileId]) return;
+        console.error(
+          `[FileContext] dropping ${fileId} from the workbench: its stored bytes are unreadable`,
+        );
+        lifecycleManager.removeFiles([fileId], stateRef);
+      }),
+    [lifecycleManager],
+  );
+
   const handleUnlockSkip = useCallback(() => {
     if (activeEncryptedFileId) {
       dismissedEncryptedFilesRef.current.add(activeEncryptedFileId);
@@ -594,6 +611,10 @@ function FileContextInner({
         // Remove from memory and cleanup resources
         lifecycleManager.removeFiles(fileIds, stateRef);
 
+        // Any failure recorded against these stops needing attention: the document is gone.
+        // Fire-and-forget, so a server that cannot be told never blocks the delete.
+        void reportFilesRemoved(fileIds);
+
         // Remove from IndexedDB if enabled
         if (indexedDB && enablePersistence && deleteFromStorage !== false) {
           try {
diff --git a/frontend/editor/src/core/contexts/FilesModalContext.tsx b/frontend/editor/src/core/contexts/FilesModalContext.tsx
index 73d1b0477f..17585ae7e8 100644
--- a/frontend/editor/src/core/contexts/FilesModalContext.tsx
+++ b/frontend/editor/src/core/contexts/FilesModalContext.tsx
@@ -41,7 +41,9 @@ interface FilesModalContextType {
   setOnModalClose: (callback: () => void) => void;
 }
 
-const FilesModalContext = createContext<FilesModalContextType | null>(null);
+export const FilesModalContext = createContext<FilesModalContextType | null>(
+  null,
+);
 
 export const FilesModalProvider: React.FC<{ children: React.ReactNode }> = ({
   children,
diff --git a/frontend/editor/src/core/contexts/FilesPageContext.tsx b/frontend/editor/src/core/contexts/FilesPageContext.tsx
index 6774798aae..b8cf4ccf29 100644
--- a/frontend/editor/src/core/contexts/FilesPageContext.tsx
+++ b/frontend/editor/src/core/contexts/FilesPageContext.tsx
@@ -455,7 +455,10 @@ export function FilesPageProvider({ children }: { children: React.ReactNode }) {
           })
           .map((s) => s.id);
         if (localIds.length > 0) {
-          await fileActions.removeFiles(localIds, true);
+          // Take the superseded versions with it, or their bytes sit in storage
+          // forever - invisible, because listings only show leaves.
+          const orphans = await fileStorage.orphanedAncestorIds(localIds);
+          await fileActions.removeFiles([...localIds, ...orphans], true);
         }
       }
 
diff --git a/frontend/editor/src/core/contexts/file/FileReducer.test.ts b/frontend/editor/src/core/contexts/file/FileReducer.test.ts
index 523ef2e358..bde6a17a02 100644
--- a/frontend/editor/src/core/contexts/file/FileReducer.test.ts
+++ b/frontend/editor/src/core/contexts/file/FileReducer.test.ts
@@ -222,3 +222,40 @@ describe("fileContextReducer — silent CONSUME_FILES (background enforcement)",
     expect(next.ui.selectedFileIds).toEqual(["b2"]);
   });
 });
+
+describe("fileContextReducer — REMOVE_FILES", () => {
+  /** Deleting from the library dispatches this for files that were never in the
+   *  workbench; reallocating then re-renders every consumer for nothing. */
+  it("is a true no-op when none of the ids are in the workbench", () => {
+    const state = stateWith([stub("a")]);
+    const next = fileContextReducer(state, {
+      type: "REMOVE_FILES",
+      payload: { fileIds: ["gone" as FileId] },
+    });
+    expect(next).toBe(state);
+  });
+
+  it("still removes the ids it does hold", () => {
+    const state = stateWith([stub("a"), stub("b")]);
+    const next = fileContextReducer(state, {
+      type: "REMOVE_FILES",
+      payload: { fileIds: ["a" as FileId, "gone" as FileId] },
+    });
+    expect(next.files.ids).toEqual(["b"]);
+    expect(next.files.byId["a" as FileId]).toBeUndefined();
+  });
+
+  it("keeps the files slice when only a selection is cleared", () => {
+    const base = stateWith([stub("a")]);
+    const state: FileContextState = {
+      ...base,
+      ui: { ...base.ui, selectedFileIds: ["gone" as FileId] },
+    };
+    const next = fileContextReducer(state, {
+      type: "REMOVE_FILES",
+      payload: { fileIds: ["gone" as FileId] },
+    });
+    expect(next.files).toBe(state.files);
+    expect(next.ui.selectedFileIds).toEqual([]);
+  });
+});
diff --git a/frontend/editor/src/core/contexts/file/FileReducer.ts b/frontend/editor/src/core/contexts/file/FileReducer.ts
index 2697974823..a9dcae7b38 100644
--- a/frontend/editor/src/core/contexts/file/FileReducer.ts
+++ b/frontend/editor/src/core/contexts/file/FileReducer.ts
@@ -183,6 +183,20 @@ export function fileContextReducer(
       const remainingIds = state.files.ids.filter(
         (id) => !fileIds.includes(id),
       );
+      // Clear selections that reference removed files
+      const validSelectedFileIds = state.ui.selectedFileIds.filter(
+        (id) => !fileIds.includes(id),
+      );
+
+      // Deleting a library file that was never in the workbench removes nothing
+      // here, and must not re-render every file and UI consumer.
+      const removedFromWorkbench =
+        remainingIds.length !== state.files.ids.length ||
+        fileIds.some((id) => id in state.files.byId);
+      const deselected =
+        validSelectedFileIds.length !== state.ui.selectedFileIds.length;
+      if (!removedFromWorkbench && !deselected) return state;
+
       const newById = { ...state.files.byId };
 
       // Remove files from state (resource cleanup handled by lifecycle manager)
@@ -190,21 +204,14 @@ export function fileContextReducer(
         delete newById[id];
       });
 
-      // Clear selections that reference removed files
-      const validSelectedFileIds = state.ui.selectedFileIds.filter(
-        (id) => !fileIds.includes(id),
-      );
-
       return {
         ...state,
-        files: {
-          ids: remainingIds,
-          byId: newById,
-        },
-        ui: {
-          ...state.ui,
-          selectedFileIds: validSelectedFileIds,
-        },
+        files: removedFromWorkbench
+          ? { ids: remainingIds, byId: newById }
+          : state.files,
+        ui: deselected
+          ? { ...state.ui, selectedFileIds: validSelectedFileIds }
+          : state.ui,
       };
     }
 
diff --git a/frontend/editor/src/core/contexts/file/fileActions.ts b/frontend/editor/src/core/contexts/file/fileActions.ts
index a95f42939d..4067a99069 100644
--- a/frontend/editor/src/core/contexts/file/fileActions.ts
+++ b/frontend/editor/src/core/contexts/file/fileActions.ts
@@ -26,6 +26,9 @@ import {
   clearBulkAddProgress,
 } from "@app/services/bulkAddProgress";
 const DEBUG = process.env.NODE_ENV === "development";
+/** How long a file may sit unhydrated before the console says so. Reporting only:
+ *  the read is never abandoned, because large files legitimately take time. */
+const STALLED_LOAD_MS = 8000;
 const HYDRATION_CONCURRENCY = 2;
 let activeHydrations = 0;
 const hydrationQueue: Array<() => Promise<void>> = [];
@@ -854,61 +857,78 @@ export async function addStirlingFileStubs(
       // Load File object and hydrate metadata in background (non-blocking)
       const fileId = stub.id;
 
-      // Load File object from IndexedDB asynchronously
-      scheduleMetadataHydration(async () => {
-        const stirlingFile = await fileStorage.getStirlingFile(fileId);
+      // Regenerate page metadata + thumbnails. Queued, because parsing several
+      // PDFs at once is what the concurrency limit exists to bound.
+      const scheduleMetadataFor = (stirlingFile: StirlingFile): void => {
+        scheduleMetadataHydration(async () => {
+          const processedFileMetadata =
+            await generateProcessedFileMetadata(stirlingFile);
+          if (!processedFileMetadata) return;
+
+          const updates: Partial<StirlingFileStub> = {
+            processedFile: processedFileMetadata,
+          };
+
+          // Update thumbnail only if current stub doesn't have one
+          const currentStub = stateRef.current.files.byId[fileId];
+          if (
+            !currentStub?.thumbnailUrl &&
+            processedFileMetadata.thumbnailUrl
+          ) {
+            updates.thumbnailUrl = processedFileMetadata.thumbnailUrl;
+            if (processedFileMetadata.thumbnailUrl.startsWith("blob:")) {
+              lifecycleManager.trackBlobUrl(processedFileMetadata.thumbnailUrl);
+            }
+          }
+
+          lifecycleManager.updateStirlingFileStub(fileId, updates, stateRef);
+        });
+      };
+
+      // Load and publish the File, ahead of any parsing. NOT queued: whether a
+      // file opens at all must not wait on other files' parses.
+      void (async () => {
+        // A storage read that never settles renders as a file that silently won't
+        // open. Name it in the console rather than leaving the user guessing.
+        const stall = setTimeout(
+          () =>
+            console.error(
+              `[Hydration] ${stub.name} (${fileId}) has been loading for ${STALLED_LOAD_MS / 1000}s - the IndexedDB read has not settled`,
+            ),
+          STALLED_LOAD_MS,
+        );
+        const stirlingFile = await fileStorage
+          .getStirlingFile(fileId)
+          .finally(() => clearTimeout(stall));
         if (!stirlingFile) {
+          // A row with no bytes renders empty and its clicks look dead, so take it
+          // back out. Storage keeps the record; fileStorage has said why.
+          console.error(
+            `[Hydration] No readable data for ${stub.name} (${fileId}); removing it from the workbench`,
+          );
+          lifecycleManager.removeFiles([fileId], stateRef);
           return;
         }
 
-        // Store the loaded file in filesRef
         filesRef.current.set(fileId, stirlingFile);
-
-        // Check if processedFile data needs regeneration
-        if (stirlingFile.type.startsWith("application/pdf")) {
-          const needsProcessing =
-            !stub.processedFile ||
-            !stub.processedFile.pages ||
-            stub.processedFile.pages.length === 0 ||
-            stub.processedFile.totalPages !== stub.processedFile.pages.length;
-
-          if (needsProcessing) {
-            // Regenerate metadata
-            const processedFileMetadata =
-              await generateProcessedFileMetadata(stirlingFile);
-
-            if (processedFileMetadata) {
-              const updates: Partial<StirlingFileStub> = {
-                processedFile: processedFileMetadata,
-              };
-
-              // Update thumbnail only if current stub doesn't have one
-              const currentStub = stateRef.current.files.byId[fileId];
-              if (
-                !currentStub?.thumbnailUrl &&
-                processedFileMetadata.thumbnailUrl
-              ) {
-                updates.thumbnailUrl = processedFileMetadata.thumbnailUrl;
-                if (processedFileMetadata.thumbnailUrl.startsWith("blob:")) {
-                  lifecycleManager.trackBlobUrl(
-                    processedFileMetadata.thumbnailUrl,
-                  );
-                }
-              }
-
-              lifecycleManager.updateStirlingFileStub(
-                fileId,
-                updates,
-                stateRef,
-              );
-              return;
-            }
-          }
-        }
-
-        // Stub dispatch triggers re-render so the viewer appears (ADD_FILES alone doesn't update selectors).
+        // filesRef is a ref, so the selectors gating the workbench only see the
+        // file once something dispatches. Parsing it can't be a precondition.
         lifecycleManager.updateStirlingFileStub(fileId, {}, stateRef);
-      });
+
+        const needsProcessing =
+          !stub.processedFile ||
+          !stub.processedFile.pages ||
+          stub.processedFile.pages.length === 0 ||
+          stub.processedFile.totalPages !== stub.processedFile.pages.length;
+        if (
+          stirlingFile.type.startsWith("application/pdf") &&
+          needsProcessing
+        ) {
+          scheduleMetadataFor(stirlingFile);
+        }
+      })().catch((error) =>
+        console.error(`[Hydration] Failed to load ${fileId}:`, error),
+      );
     }
 
     return loadedFiles;
diff --git a/frontend/editor/src/core/contexts/file/hydrationPublish.test.ts b/frontend/editor/src/core/contexts/file/hydrationPublish.test.ts
new file mode 100644
index 0000000000..c4bdda01c1
--- /dev/null
+++ b/frontend/editor/src/core/contexts/file/hydrationPublish.test.ts
@@ -0,0 +1,77 @@
+import { describe, expect, test, vi } from "vitest";
+import type {
+  FileContextState,
+  StirlingFileStub,
+} from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+/**
+ * A clicked file is only visible once hydration DISPATCHES: the workbench reads
+ * files out of a ref, so `activeFiles` stays empty until then. Parsing must not
+ * gate that - a PDF engine that stalls used to leave the workbench on its empty
+ * state with the row showing as open, and clicks doing nothing.
+ */
+
+const getStirlingFile = vi.hoisted(() => vi.fn());
+vi.mock("@app/services/fileStorage", () => ({
+  fileStorage: { getStirlingFile },
+}));
+/** The stall under test: the page parse never settles. */
+vi.mock("@app/utils/thumbnailUtils", () => ({
+  generateThumbnailPairWithMetadata: () => new Promise(() => {}),
+}));
+
+const stub = (id: string): StirlingFileStub =>
+  ({
+    id: id as FileId,
+    name: `${id}.pdf`,
+    type: "application/pdf",
+    size: 10,
+    lastModified: 0,
+  }) as StirlingFileStub;
+
+async function harness(ids: string[]) {
+  vi.resetModules();
+  getStirlingFile.mockImplementation(
+    async (id: FileId) =>
+      new File(["%PDF-1.7"], `${id}.pdf`, { type: "application/pdf" }),
+  );
+  const { addStirlingFileStubs } =
+    await import("@app/contexts/file/fileActions");
+
+  const stubs = ids.map(stub);
+  const state = {
+    files: { ids: [], byId: {} },
+    pinnedFiles: new Set(),
+    ui: { selectedFileIds: [], selectedPageNumbers: [] },
+  } as unknown as FileContextState;
+  const stateRef = { current: state };
+  const filesRef = { current: new Map<FileId, File>() };
+  const published: FileId[] = [];
+  const lifecycleManager = {
+    updateStirlingFileStub: (fileId: FileId) => published.push(fileId),
+    removeFiles: () => {},
+    trackBlobUrl: () => {},
+  };
+
+  await addStirlingFileStubs(
+    stubs,
+    {},
+    stateRef,
+    filesRef,
+    () => {},
+    lifecycleManager as never,
+  );
+  return { filesRef, published };
+}
+
+describe("workbench hydration — a stalled parse can't hide the file", () => {
+  test("publishes every file's bytes while their parses hang", async () => {
+    // Three, because the parse queue only runs two at a time: the third proves
+    // loading isn't queued behind parses that never finish.
+    const { filesRef, published } = await harness(["a", "b", "c"]);
+
+    await vi.waitFor(() => expect(published).toHaveLength(3));
+    expect([...filesRef.current.keys()]).toEqual(["a", "b", "c"]);
+  });
+});
diff --git a/frontend/editor/src/core/data/automatableToolsHaveOperationConfig.test.tsx b/frontend/editor/src/core/data/automatableToolsHaveOperationConfig.test.tsx
index 461c07ebdf..c8942942df 100644
--- a/frontend/editor/src/core/data/automatableToolsHaveOperationConfig.test.tsx
+++ b/frontend/editor/src/core/data/automatableToolsHaveOperationConfig.test.tsx
@@ -30,4 +30,15 @@ describe("automatable tools", () => {
 
     expect(offeredWithoutConfig).toEqual([]);
   });
+
+  // Reorganize Pages has an automatable form (organization mode + page-order string) and a
+  // context-free settings component, but its registry entry once left automationSettings null,
+  // so both Automate and the pipeline builder showed "no configurable settings". Guard the wiring.
+  test("Reorganize Pages exposes automation settings so it is configurable, not no-settings", () => {
+    const { result } = renderHook(() => useTranslatedToolCatalog());
+
+    expect(
+      result.current.regularTools.reorganizePages?.automationSettings,
+    ).toBeTruthy();
+  });
 });
diff --git a/frontend/editor/src/core/data/processorEntitySearch.ts b/frontend/editor/src/core/data/processorEntitySearch.ts
new file mode 100644
index 0000000000..5d7eaa9364
--- /dev/null
+++ b/frontend/editor/src/core/data/processorEntitySearch.ts
@@ -0,0 +1,21 @@
+import type { TFunction } from "i18next";
+import type { SuperSearchGroup } from "@app/types/superSearch";
+
+const NO_GROUPS: SuperSearchGroup[] = [];
+
+/**
+ * Processor entity results (users, policies, pipelines, sources) for the
+ * editor's super search. Core and desktop builds ship no portal, so this stub
+ * returns nothing; the proprietary build shadows it with an implementation
+ * that lazily loads the portal's entity-search module.
+ */
+export function useProcessorEntityGroups(
+  _trimmed: string,
+  _enabled: boolean,
+  _t: TFunction,
+  _navigate: (path: string) => void,
+  _scopeEnabled?: (scopeId: string) => boolean,
+  _isAdmin?: boolean,
+): SuperSearchGroup[] {
+  return NO_GROUPS;
+}
diff --git a/frontend/editor/src/core/data/processorSearchIndex.ts b/frontend/editor/src/core/data/processorSearchIndex.ts
new file mode 100644
index 0000000000..ef308cbee2
--- /dev/null
+++ b/frontend/editor/src/core/data/processorSearchIndex.ts
@@ -0,0 +1,30 @@
+/**
+ * Search index for the admin portal ("Processor") destinations offered by the
+ * global super search. Core and desktop builds ship no portal, so the index is
+ * empty and the Processor group never renders; the proprietary build (which
+ * mounts the portal as a route-set) shadows this with the real view list.
+ */
+export interface ProcessorSearchEntry {
+  /** Portal view id — stable key for the result row. */
+  id: string;
+  /** i18n key for the view's display name (shared with the portal sidebar). */
+  labelKey: string;
+  labelFallback: string;
+  /** In-app path to navigate to. Empty when externalUrl is set. */
+  path: string;
+  /** Opens in a new tab instead of navigating (e.g. hosted docs). */
+  externalUrl?: string;
+  /** Extra fuzzy-match terms beyond the label. */
+  keywords?: string[];
+}
+
+export const PROCESSOR_SEARCH_INDEX: ProcessorSearchEntry[] = [];
+
+/** No portal → no entity scopes; trivially accessible. Real logic lives in
+ * the proprietary shadow, keyed on the flavor's users capabilities. */
+export function isPortalEntityScopeAccessible(
+  _scopeId: string,
+  _isAdmin: boolean,
+): boolean {
+  return true;
+}
diff --git a/frontend/editor/src/core/data/settingsContentSearch.ts b/frontend/editor/src/core/data/settingsContentSearch.ts
new file mode 100644
index 0000000000..7cee4d6056
--- /dev/null
+++ b/frontend/editor/src/core/data/settingsContentSearch.ts
@@ -0,0 +1,174 @@
+import i18n from "i18next";
+import type { TFunction } from "i18next";
+
+/**
+ * Content-level settings search: matches a query against every translation
+ * string a settings section renders, so a term that appears anywhere on a
+ * settings page ("SMTP", "OCR", a field label…) finds that section without a
+ * curated keyword.
+ *
+ * Component-free (translation subtrees only) so the always-mounted super
+ * search can use it without pulling the lazy settings modal into the main
+ * bundle.
+ */
+
+/**
+ * Translation subtrees whose strings appear on each settings section, for the
+ * sections where the nav key doesn't map 1:1 onto a toml prefix. Keys missing
+ * here fall back to the inferred `settings.<key>` / `admin.settings.<key>`
+ * prefix.
+ */
+const SECTION_TRANSLATION_PREFIXES: Partial<Record<string, string[]>> = {
+  general: ["settings.general"],
+  hotkeys: ["settings.hotkeys"],
+  account: ["account"],
+  people: ["settings.workspace"],
+  teams: ["settings.workspace", "settings.team"],
+  "api-keys": ["settings.developer"],
+  connectionMode: ["settings.connection"],
+  planBilling: ["settings.planBilling"],
+  adminGeneral: ["admin.settings.general"],
+  adminFeatures: ["admin.settings.features"],
+  adminEndpoints: ["admin.settings.endpoints"],
+  adminDatabase: ["admin.settings.database"],
+  adminAdvanced: ["admin.settings.advanced"],
+  adminFolderAccess: ["admin.settings.folderAccess"],
+  // The four AI tabs all render slices of the one admin.settings.ai subtree.
+  adminAiGeneral: ["admin.settings.ai"],
+  adminAiModels: ["admin.settings.ai"],
+  adminAiDocuments: ["admin.settings.ai"],
+  adminAiLimits: ["admin.settings.ai"],
+  adminSecurity: ["admin.settings.security"],
+  adminMcp: ["admin.settings.mcp"],
+  adminConnections: [
+    "admin.settings.connections",
+    "admin.settings.mail",
+    "admin.settings.security",
+    "admin.settings.telegram",
+    "admin.settings.premium",
+    "admin.settings.general",
+    "settings.securityAuth",
+    "settings.connection",
+  ],
+  adminPlan: [
+    "settings.planBilling",
+    "admin.settings.premium",
+    "settings.licensingAnalytics",
+  ],
+  adminAudit: ["settings.licensingAnalytics"],
+  adminUsage: ["settings.licensingAnalytics"],
+  adminLegal: ["admin.settings.legal"],
+  adminPrivacy: ["admin.settings.privacy"],
+};
+
+export const getTranslationPrefixesForNavKey = (key: string): string[] => {
+  const explicitPrefixes = SECTION_TRANSLATION_PREFIXES[key] ?? [];
+
+  const inferredPrefixes: string[] = [];
+
+  if (key.startsWith("admin")) {
+    const adminSuffix = key.replace(/^admin/, "");
+    const normalizedAdminSuffix =
+      adminSuffix.charAt(0).toLowerCase() + adminSuffix.slice(1);
+    inferredPrefixes.push(`admin.settings.${normalizedAdminSuffix}`);
+  } else {
+    inferredPrefixes.push(`settings.${key}`);
+  }
+
+  return Array.from(new Set([...explicitPrefixes, ...inferredPrefixes]));
+};
+
+export const flattenTranslationStrings = (value: unknown): string[] => {
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    return trimmed ? [trimmed] : [];
+  }
+
+  if (Array.isArray(value)) {
+    return value.flatMap(flattenTranslationStrings);
+  }
+
+  if (value && typeof value === "object") {
+    return Object.values(value as Record<string, unknown>).flatMap(
+      flattenTranslationStrings,
+    );
+  }
+
+  return [];
+};
+
+/** Trims a matched string to a short snippet centred on the query hit. */
+export const buildMatchSnippet = (text: string, query: string): string => {
+  const normalizedText = text.toLocaleLowerCase();
+  const normalizedQuery = query.toLocaleLowerCase();
+  const matchIndex = normalizedText.indexOf(normalizedQuery);
+
+  if (matchIndex === -1) {
+    return text;
+  }
+
+  // Lowercasing can change string length in some locales (Turkish İ, ß), so
+  // indices computed on the copy only align with the original when the
+  // lengths match; otherwise snippet the copy itself.
+  const source = normalizedText.length === text.length ? text : normalizedText;
+
+  const maxLength = 84;
+  const contextPadding = 28;
+  const start = Math.max(0, matchIndex - contextPadding);
+  const end = Math.min(
+    source.length,
+    matchIndex + query.length + contextPadding,
+  );
+  const snippet = source.slice(start, end);
+
+  if (snippet.length <= maxLength) {
+    return `${start > 0 ? "…" : ""}${snippet}${end < source.length ? "…" : ""}`;
+  }
+
+  return `${start > 0 ? "…" : ""}${snippet.slice(0, maxLength)}${end < source.length ? "…" : ""}`;
+};
+
+// Flattening every subtree on each keystroke would be wasteful; sections'
+// content is static per language, so cache it and drop the cache on switch.
+const contentCache = new Map<string, string[]>();
+let contentCacheLanguage: string | undefined;
+
+// Locale files load over HTTP after boot, so content computed before the
+// bundle resolves is empty — without this, an early query would cache empty
+// content for the whole session. Cleared whenever a resource bundle lands.
+i18n.on("loaded", () => contentCache.clear());
+
+export function getSettingsSectionContent(key: string, t: TFunction): string[] {
+  if (contentCacheLanguage !== i18n.language) {
+    contentCache.clear();
+    contentCacheLanguage = i18n.language;
+  }
+  const cached = contentCache.get(key);
+  if (cached) return cached;
+
+  const content = getTranslationPrefixesForNavKey(key).flatMap((prefix) =>
+    flattenTranslationStrings(
+      t(prefix, { returnObjects: true, defaultValue: {} }),
+    ),
+  );
+  contentCache.set(key, content);
+  return content;
+}
+
+/**
+ * First content string of the section containing the query
+ * (case-insensitive), or null. Substring only — fuzzy matching across whole
+ * paragraphs of copy produces junk hits.
+ */
+export function findSettingsContentMatch(
+  key: string,
+  query: string,
+  t: TFunction,
+): string | null {
+  const normalizedQuery = query.toLocaleLowerCase();
+  return (
+    getSettingsSectionContent(key, t).find((text) =>
+      text.toLocaleLowerCase().includes(normalizedQuery),
+    ) ?? null
+  );
+}
diff --git a/frontend/editor/src/core/data/settingsSearchIndex.ts b/frontend/editor/src/core/data/settingsSearchIndex.ts
new file mode 100644
index 0000000000..c130546a8a
--- /dev/null
+++ b/frontend/editor/src/core/data/settingsSearchIndex.ts
@@ -0,0 +1,105 @@
+import { NavKey } from "@app/components/shared/config/types";
+
+/**
+ * A single, searchable setting *row* inside the settings modal.
+ *
+ * Section-level content matching (settingsContentSearch) only navigates to a
+ * whole section; this index lets the global super search deep-link to an
+ * individual control: navigating to `/settings/{section}?focus={anchor}`,
+ * where `anchor` is the DOM `id` placed on that control's row (see
+ * AppConfigModal's focus-scroll effect and the `id=` attributes added to the
+ * matching section components).
+ */
+export interface SettingsSearchEntry {
+  /** Settings section this row lives in (nav key, e.g. "general"). */
+  section: NavKey;
+  /** DOM id on the control's row; used as the `?focus=` anchor. */
+  anchor: string;
+  /** i18n key for the display label. */
+  labelKey: string;
+  /** English fallback / default for the label. */
+  labelFallback: string;
+  /** Extra English terms to match against (synonyms, related words). */
+  keywords?: string[];
+}
+
+/**
+ * Curated row-level entries for the high-value, user-facing settings sections.
+ * Section-level results (every other tab) come from the nav sections directly,
+ * so this list only needs the rows worth jumping straight to.
+ */
+export const SETTINGS_SEARCH_INDEX: SettingsSearchEntry[] = [
+  // --- General > Appearance ---
+  {
+    section: "general",
+    anchor: "setting-theme",
+    labelKey: "settings.general.theme",
+    labelFallback: "Theme",
+    keywords: ["dark", "light", "mode", "appearance", "colour", "color"],
+  },
+  {
+    section: "general",
+    anchor: "setting-language",
+    labelKey: "settings.general.language",
+    labelFallback: "Language",
+    keywords: ["locale", "translation", "i18n"],
+  },
+  // --- General > Behaviour ---
+  {
+    section: "general",
+    anchor: "setting-tool-picker-mode",
+    labelKey: "settings.general.defaultToolPickerMode",
+    labelFallback: "Default tool picker mode",
+    keywords: ["sidebar", "fullscreen", "tools", "panel"],
+  },
+  {
+    section: "general",
+    anchor: "setting-startup-view",
+    labelKey: "settings.general.defaultStartupView",
+    labelFallback: "Default view on launch",
+    keywords: ["startup", "launch", "home", "reader", "automate"],
+  },
+  {
+    section: "general",
+    anchor: "setting-reader-zoom",
+    labelKey: "settings.general.defaultViewerZoom",
+    labelFallback: "Default reader zoom",
+    keywords: ["zoom", "viewer", "fit width", "fit page", "magnification"],
+  },
+  {
+    section: "general",
+    anchor: "setting-hide-unavailable-tools",
+    labelKey: "settings.general.hideUnavailableTools",
+    labelFallback: "Hide unavailable tools",
+    keywords: ["disabled", "greyed", "tools"],
+  },
+  {
+    section: "general",
+    anchor: "setting-hide-unavailable-conversions",
+    labelKey: "settings.general.hideUnavailableConversions",
+    labelFallback: "Hide unavailable conversions",
+    keywords: ["disabled", "convert", "conversions"],
+  },
+  {
+    section: "general",
+    anchor: "setting-auto-unzip",
+    labelKey: "settings.general.autoUnzip",
+    labelFallback: "Auto-unzip API responses",
+    keywords: ["zip", "extract", "unzip", "archive"],
+  },
+  {
+    section: "general",
+    anchor: "setting-auto-unzip-file-limit",
+    labelKey: "settings.general.autoUnzipFileLimit",
+    labelFallback: "Auto-unzip file limit",
+    keywords: ["zip", "limit", "files", "extract"],
+  },
+  // --- Keyboard Shortcuts ---
+  {
+    section: "hotkeys",
+    anchor: "setting-hotkeys-search",
+    labelKey: "settings.hotkeys.title",
+    labelFallback: "Keyboard Shortcuts",
+    keywords: ["hotkey", "shortcut", "keybinding", "keyboard"],
+  },
+];
diff --git a/frontend/editor/src/core/data/settingsSectionRegistry.ts b/frontend/editor/src/core/data/settingsSectionRegistry.ts
new file mode 100644
index 0000000000..e2222d4daf
--- /dev/null
+++ b/frontend/editor/src/core/data/settingsSectionRegistry.ts
@@ -0,0 +1,88 @@
+import { NavKey } from "@app/components/shared/config/types";
+
+/**
+ * A whole settings section (nav tab), described as pure data so the global
+ * super search can offer section-level results.
+ *
+ * This is the single source of truth for *which settings sections are
+ * searchable* in a given build. It is intentionally **component-free**: the
+ * always-mounted top bar imports it (via `@app/data/settingsSectionRegistry`)
+ * to feed the super search, and pulling the heavy settings component tree in
+ * here would defeat the lazy-loaded settings modal (AppConfigModalLazy).
+ *
+ * Layering mirrors the nav builders (`configNavSections`): core lists the
+ * always-present sections; higher layers shadow this module to add their own
+ * (proprietary admin sections, saas cloud sections, …). A section only belongs
+ * in a layer's registry if that layer's settings modal can actually render it —
+ * otherwise search would deep-link to a tab that doesn't exist.
+ *
+ * Per-user visibility (admin / login) is expressed by the flags below and
+ * applied by the super search at query time, mirroring the modal's own gating.
+ */
+export interface SettingsSectionEntry {
+  /** Nav key; used for the `/settings/{key}` deep link. */
+  key: NavKey;
+  /** i18n key for the display label. */
+  labelKey: string;
+  /** English fallback / default for the label. */
+  labelFallback: string;
+  /**
+   * The modal nav group this section sits under ("Preferences",
+   * "Configuration", …) — shown as result context ("Group · match").
+   * Same keys the nav builder uses.
+   */
+  groupLabelKey?: string;
+  groupLabelFallback?: string;
+  /** Extra English terms to match against (synonyms, related words). */
+  keywords?: string[];
+  /** Surface only when login mode is on (e.g. account, API keys). */
+  requiresLogin?: boolean;
+  /**
+   * Admin-area section: the self-hosted modal surfaces it when the user is an
+   * admin OR login mode is off (single-user self-host). Mirrors the proprietary
+   * nav builder's `isAdmin || !loginEnabled` gate.
+   */
+  adminArea?: boolean;
+  /**
+   * Section only mounts for a signed-in (non-anonymous) account — mirrors the
+   * SaaS nav builder's `!isAnonymous` gate. Distinct from `requiresLogin`,
+   * which keys off the local backend's login mode rather than auth state.
+   */
+  requiresAccount?: boolean;
+}
+
+/** Core (OSS) sections — always present in every build. */
+export const SETTINGS_SECTION_REGISTRY: SettingsSectionEntry[] = [
+  {
+    key: "general",
+    labelKey: "settings.general.title",
+    labelFallback: "General",
+    keywords: ["theme", "language", "appearance", "preferences", "startup"],
+    groupLabelKey: "settings.preferences.title",
+    groupLabelFallback: "Preferences",
+  },
+  {
+    key: "hotkeys",
+    labelKey: "settings.hotkeys.title",
+    labelFallback: "Keyboard Shortcuts",
+    keywords: ["hotkey", "shortcut", "keybinding", "keyboard"],
+    groupLabelKey: "settings.preferences.title",
+    groupLabelFallback: "Preferences",
+  },
+  {
+    key: "help",
+    labelKey: "settings.help.label",
+    labelFallback: "Tours",
+    keywords: ["help", "tour", "guide", "support", "docs"],
+    groupLabelKey: "settings.help.title",
+    groupLabelFallback: "Help",
+  },
+  {
+    key: "legal",
+    labelKey: "settings.legal.label",
+    labelFallback: "Legal",
+    keywords: ["legal", "terms", "privacy", "licenses"],
+    groupLabelKey: "settings.legal.title",
+    groupLabelFallback: "Legal",
+  },
+];
diff --git a/frontend/editor/src/core/data/toolsTaxonomy.ts b/frontend/editor/src/core/data/toolsTaxonomy.ts
index fc9b37565c..f9c2dde02f 100644
--- a/frontend/editor/src/core/data/toolsTaxonomy.ts
+++ b/frontend/editor/src/core/data/toolsTaxonomy.ts
@@ -216,6 +216,17 @@ export const isValidToolId = (
   return toolId in registry;
 };
 
+/**
+ * A "coming soon" placeholder: listed in the catalogue but not openable — no
+ * UI component and no external link. "read" and "multiTool" are exempt as
+ * workbench-only tools that render without a component.
+ */
+export const isComingSoonTool = (
+  toolId: string,
+  tool: ToolRegistryEntry,
+): boolean =>
+  !tool.component && !tool.link && toolId !== "read" && toolId !== "multiTool";
+
 /**
  * Check if a tool supports automation (defaults to true)
  */
diff --git a/frontend/editor/src/core/data/useTranslatedToolRegistry.tsx b/frontend/editor/src/core/data/useTranslatedToolRegistry.tsx
index 0a39da2fb9..5ae8075d0f 100644
--- a/frontend/editor/src/core/data/useTranslatedToolRegistry.tsx
+++ b/frontend/editor/src/core/data/useTranslatedToolRegistry.tsx
@@ -700,7 +700,10 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
         endpoints: ["rearrange-pages"],
         operationConfig: asRegistryConfig(reorganizePagesOperationConfig),
         synonyms: getSynonyms(t, "reorganizePages"),
-        automationSettings: null,
+        automationSettings: lazySettings(
+          () =>
+            import("@app/components/tools/reorganizePages/ReorganizePagesSettings"),
+        ),
       },
       scalePages: {
         icon: (
diff --git a/frontend/editor/src/core/hooks/tools/redact/useRedactParameters.test.ts b/frontend/editor/src/core/hooks/tools/redact/useRedactParameters.test.ts
index 1a519d519e..e64c349a4a 100644
--- a/frontend/editor/src/core/hooks/tools/redact/useRedactParameters.test.ts
+++ b/frontend/editor/src/core/hooks/tools/redact/useRedactParameters.test.ts
@@ -19,7 +19,7 @@ describe("useRedactParameters", () => {
     { paramName: "wholeWordSearch" as const, value: true },
     { paramName: "redactColor" as const, value: "#FF0000" },
     { paramName: "customPadding" as const, value: 0.5 },
-    { paramName: "convertPDFToImage" as const, value: false },
+    { paramName: "convertPDFToImage" as const, value: true },
   ])("should update parameter $paramName", ({ paramName, value }) => {
     const { result } = renderHook(() => useRedactParameters());
 
@@ -138,7 +138,7 @@ describe("useRedactParameters", () => {
     expect(result.current.parameters.mode).toBe("automatic");
     expect(result.current.parameters.useRegex).toBe(false);
     expect(result.current.parameters.wholeWordSearch).toBe(false);
-    expect(result.current.parameters.convertPDFToImage).toBe(true);
+    expect(result.current.parameters.convertPDFToImage).toBe(false);
   });
 
   test("should handle array parameter updates correctly", () => {
diff --git a/frontend/editor/src/core/hooks/tools/redact/useRedactParameters.ts b/frontend/editor/src/core/hooks/tools/redact/useRedactParameters.ts
index 048b230567..a903908658 100644
--- a/frontend/editor/src/core/hooks/tools/redact/useRedactParameters.ts
+++ b/frontend/editor/src/core/hooks/tools/redact/useRedactParameters.ts
@@ -25,7 +25,7 @@ export const defaultParameters: RedactParameters = {
   wholeWordSearch: false,
   redactColor: "#000000",
   customPadding: 0.1,
-  convertPDFToImage: true,
+  convertPDFToImage: false,
 };
 
 export type RedactParametersHook = BaseParametersHook<RedactParameters>;
diff --git a/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts b/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts
index f01c8770ab..fe1ddc7bc7 100644
--- a/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts
@@ -21,6 +21,7 @@ import {
   StirlingFileStub,
 } from "@app/types/fileContext";
 import { FILE_EVENTS } from "@app/services/errorUtils";
+import { reportToolFailure } from "@app/services/failureReporting";
 import { zipFileService } from "@app/services/zipFileService";
 import { getFilenameWithoutExtension } from "@app/utils/fileUtils";
 import {
@@ -603,6 +604,14 @@ export const useToolOperation = <TParams>(
           void _e;
         }
 
+        // Report it so a leader sees the failure too, then carry on with the user's
+        // own error handling. Fire-and-forget: the reporter swallows its own errors.
+        void reportToolFailure({
+          operation: config.operationType,
+          error,
+          fileIds: validFiles.map((file) => file.fileId),
+        });
+
         const errorMessage =
           config.getErrorMessage?.(error) || extractErrorMessage(error);
         actions.setError(errorMessage);
diff --git a/frontend/editor/src/core/hooks/useAccountIdentity.ts b/frontend/editor/src/core/hooks/useAccountIdentity.ts
new file mode 100644
index 0000000000..026ac08dab
--- /dev/null
+++ b/frontend/editor/src/core/hooks/useAccountIdentity.ts
@@ -0,0 +1,64 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useAuth } from "@app/auth/UseSession";
+import { useProfilePictureUrl } from "@app/hooks/useProfilePictureUrl";
+import { useAppConfig } from "@app/contexts/AppConfigContext";
+import { accountService } from "@app/services/accountService";
+
+export interface AccountIdentity {
+  /** Never empty — falls back to a generic "User" so a row is never blank. */
+  displayName: string;
+  profilePictureUrl: string | null;
+  isAnonymous: boolean;
+}
+
+/**
+ * The signed-in identity as the UI should draw it: one name and one picture,
+ * resolved the same way everywhere. Every surface that shows "who am I" (the
+ * editor and processor sidebar footers, the account settings page) reads this,
+ * so a user can't see one initial in the sidebar and a different one in
+ * settings.
+ *
+ * Resolution order for the name: the auth layer's own displayName (each layer
+ * derives it from its native user shape), then the proprietary REST endpoint,
+ * then a generic last resort.
+ */
+export function useAccountIdentity(): AccountIdentity {
+  const { t } = useTranslation();
+  const { config } = useAppConfig();
+  const { displayName: authDisplayName, isAnonymous } = useAuth();
+  const profilePictureUrl = useProfilePictureUrl();
+  const [accountUsername, setAccountUsername] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!config?.enableLogin) {
+      setAccountUsername(null);
+      return;
+    }
+    if (authDisplayName) {
+      // The auth context has a name; don't bother hitting the REST
+      // endpoint, but clear any stale cached value from a prior call.
+      setAccountUsername(null);
+      return;
+    }
+    accountService
+      .getAccountData()
+      .then((data) => {
+        // Always reflect the latest result - including clearing it on
+        // sign-out, when the endpoint returns no username (or 401s into
+        // the catch branch below). Without this, signing out would leave
+        // the old username on screen.
+        setAccountUsername(data?.username ?? null);
+      })
+      .catch(() => {
+        setAccountUsername(null);
+      });
+  }, [config?.enableLogin, authDisplayName]);
+
+  return {
+    displayName:
+      authDisplayName ?? accountUsername ?? t("auth.displayName.user", "User"),
+    profilePictureUrl,
+    isAnonymous,
+  };
+}
diff --git a/frontend/editor/src/core/hooks/useFileManager.ts b/frontend/editor/src/core/hooks/useFileManager.ts
index 442027364e..4393a22d61 100644
--- a/frontend/editor/src/core/hooks/useFileManager.ts
+++ b/frontend/editor/src/core/hooks/useFileManager.ts
@@ -389,6 +389,18 @@ export const useFileManager = () => {
       // Optimistic update — remove from UI immediately, delete IDB in background
       setFiles(files.filter((_, i) => i !== index));
       onRemovedFromWorkbench?.(file.id);
+      // Superseded versions go with it (see orphanedAncestorIds); best-effort,
+      // because failing to tidy history must not fail the delete itself.
+      void fileStorage
+        .orphanedAncestorIds([file.id])
+        .then((orphans) =>
+          orphans.length > 0
+            ? fileStorage.deleteMultipleStirlingFiles(orphans)
+            : undefined,
+        )
+        .catch((error) =>
+          console.warn("Failed to remove superseded versions:", error),
+        );
       indexedDB.deleteFile(file.id).catch((error) => {
         console.error("Failed to remove file from IndexedDB:", error);
         // Restore consistency — file is still in IDB so refresh brings it back
diff --git a/frontend/editor/src/core/hooks/useFreeCreditsSummary.ts b/frontend/editor/src/core/hooks/useFreeCreditsSummary.ts
new file mode 100644
index 0000000000..52702a3f74
--- /dev/null
+++ b/frontend/editor/src/core/hooks/useFreeCreditsSummary.ts
@@ -0,0 +1,12 @@
+import { type NavFooterCredits } from "@app/components/shared/navFooter/NavFooterCreditsRow";
+
+/**
+ * Free credits left on this team's allowance, for the sidebar footer meter.
+ * Null hides the meter entirely.
+ *
+ * Core has no wallet — self-hosted installs aren't metered — so there is
+ * nothing to show. Cloud builds override this with the live wallet figure.
+ */
+export function useFreeCreditsSummary(): NavFooterCredits | null {
+  return null;
+}
diff --git a/frontend/editor/src/core/hooks/useOpenPlan.ts b/frontend/editor/src/core/hooks/useOpenPlan.ts
new file mode 100644
index 0000000000..da6fe2207e
--- /dev/null
+++ b/frontend/editor/src/core/hooks/useOpenPlan.ts
@@ -0,0 +1,10 @@
+/**
+ * Opens the plan surface behind the sidebar footer's free-credits row, or null
+ * when this build has none (the row is then inert text rather than a button).
+ *
+ * Core ships no wallet and no plan section, so there is nothing to open. Builds
+ * that meter usage override this with their own surface.
+ */
+export function useOpenPlan(): (() => void) | null {
+  return null;
+}
diff --git a/frontend/editor/src/core/hooks/useOtherAppSwitch.ts b/frontend/editor/src/core/hooks/useOtherAppSwitch.ts
new file mode 100644
index 0000000000..612589899b
--- /dev/null
+++ b/frontend/editor/src/core/hooks/useOtherAppSwitch.ts
@@ -0,0 +1,12 @@
+import { type NavFooterAppLink } from "@app/components/shared/navFooter/NavFooter";
+
+/**
+ * The sibling app this build can switch to (editor ⇄ processor), or null when
+ * there is none. The single gate behind both the brand switcher and the
+ * sidebar footer's "Open ..." row, so the two can never disagree about access.
+ *
+ * Core ships no processor, so there is nothing to switch to.
+ */
+export function useOtherAppSwitch(): NavFooterAppLink | null {
+  return null;
+}
diff --git a/frontend/editor/src/core/hooks/useScopedFetchCache.test.ts b/frontend/editor/src/core/hooks/useScopedFetchCache.test.ts
new file mode 100644
index 0000000000..2965fc2898
--- /dev/null
+++ b/frontend/editor/src/core/hooks/useScopedFetchCache.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it, vi } from "vitest";
+import { renderHook, waitFor } from "@testing-library/react";
+import { useScopedFetchCache } from "@app/hooks/useScopedFetchCache";
+
+const TTL = 30_000;
+
+describe("useScopedFetchCache", () => {
+  it("exposes fetched values and clears loading", async () => {
+    const fetcher = vi.fn(async (key: string) => `value-${key}`);
+    const { result, rerender } = renderHook(
+      ({ keys }: { keys: readonly string[] }) =>
+        useScopedFetchCache(keys, fetcher, TTL),
+      { initialProps: { keys: ["a", "b"] as readonly string[] } },
+    );
+
+    expect(result.current.loading).toBe(true);
+    await waitFor(() => expect(result.current.loading).toBe(false));
+    expect(result.current.values).toEqual({ a: "value-a", b: "value-b" });
+    expect(fetcher).toHaveBeenCalledTimes(2);
+
+    // Fresh keys within the TTL are served from cache, not refetched.
+    rerender({ keys: ["a", "b"] });
+    await waitFor(() => expect(result.current.loading).toBe(false));
+    expect(fetcher).toHaveBeenCalledTimes(2);
+  });
+
+  it("stamps failed keys so they are not retried within the TTL", async () => {
+    const debug = vi.spyOn(console, "debug").mockImplementation(() => {});
+    const fetcher = vi.fn(async () => {
+      throw new Error("source unavailable");
+    });
+    const { result, rerender } = renderHook(
+      ({ keys }: { keys: readonly string[] }) =>
+        useScopedFetchCache(keys, fetcher, TTL),
+      { initialProps: { keys: ["a"] as readonly string[] } },
+    );
+
+    await waitFor(() => expect(result.current.loading).toBe(false));
+    expect(result.current.values).toEqual({});
+    expect(fetcher).toHaveBeenCalledTimes(1);
+
+    // Re-requesting the failed key (a keystroke re-render) must not refire.
+    rerender({ keys: ["a"] });
+    await waitFor(() => expect(result.current.loading).toBe(false));
+    expect(fetcher).toHaveBeenCalledTimes(1);
+    debug.mockRestore();
+  });
+
+  it("keeps successes when a sibling key fails", async () => {
+    const fetcher = vi.fn(async (key: string) => {
+      if (key === "bad") throw new Error("nope");
+      return `value-${key}`;
+    });
+    const debug = vi.spyOn(console, "debug").mockImplementation(() => {});
+    const { result } = renderHook(() =>
+      useScopedFetchCache(["good", "bad"], fetcher, TTL),
+    );
+
+    await waitFor(() => expect(result.current.loading).toBe(false));
+    expect(result.current.values).toEqual({ good: "value-good" });
+    debug.mockRestore();
+  });
+});
diff --git a/frontend/editor/src/core/hooks/useScopedFetchCache.ts b/frontend/editor/src/core/hooks/useScopedFetchCache.ts
new file mode 100644
index 0000000000..2b965f556b
--- /dev/null
+++ b/frontend/editor/src/core/hooks/useScopedFetchCache.ts
@@ -0,0 +1,131 @@
+import { useEffect, useRef, useState } from "react";
+
+interface FetchSuccess<K extends string, V> {
+  key: K;
+  status: "fulfilled";
+  value: V;
+}
+interface FetchFailure<K extends string> {
+  key: K;
+  status: "rejected";
+  reason: unknown;
+}
+type FetchOutcome<K extends string, V> = FetchSuccess<K, V> | FetchFailure<K>;
+
+export interface ScopedFetchCache<K extends string, V> {
+  /** Latest successfully fetched value per key; absent until first success. */
+  values: Partial<Record<K, V>>;
+  /** True while any requested key is being (re)fetched. */
+  loading: boolean;
+}
+
+/**
+ * A keyed async cache for search sources: each requested key is fetched at
+ * most once per TTL window, concurrent requests for the same key share one
+ * in-flight promise, and results from a superseded request generation are
+ * dropped (though their in-flight promises are still awaited by the next
+ * generation rather than re-fired).
+ *
+ * Failed keys are stamped like successes — a deployment without that endpoint
+ * answers the same way on every keystroke, so hammering it per keypress buys
+ * nothing. The failure is logged at debug level and retried after the TTL.
+ *
+ * `fetchKey` identity is the cache's world-view: when it changes (e.g. a tier
+ * change producing a different fetcher), every key is considered stale.
+ */
+export function useScopedFetchCache<K extends string, V>(
+  requestedKeys: readonly K[],
+  fetchKey: (key: K) => Promise<V>,
+  ttlMs: number,
+): ScopedFetchCache<K, V> {
+  const [values, setValues] = useState<Partial<Record<K, V>>>({});
+  const [loading, setLoading] = useState(false);
+  const fetchedAtRef = useRef(new Map<K, number>());
+  const inFlightRef = useRef(new Map<K, Promise<FetchOutcome<K, V>>>());
+  const requestIdRef = useRef(0);
+  const fetcherRef = useRef(fetchKey);
+
+  useEffect(() => {
+    if (fetcherRef.current !== fetchKey) {
+      fetcherRef.current = fetchKey;
+      fetchedAtRef.current.clear();
+      inFlightRef.current.clear();
+      // Values from the old world-view must not surface under the new one
+      // (e.g. a tier change altering what a payload contains).
+      setValues({});
+    }
+
+    if (requestedKeys.length === 0) {
+      requestIdRef.current += 1;
+      setLoading(false);
+      return;
+    }
+
+    const now = Date.now();
+    const staleKeys = requestedKeys.filter(
+      (key) => now - (fetchedAtRef.current.get(key) ?? 0) >= ttlMs,
+    );
+    if (staleKeys.length === 0) {
+      setLoading(false);
+      return;
+    }
+
+    const requestId = requestIdRef.current + 1;
+    requestIdRef.current = requestId;
+    setLoading(true);
+
+    void Promise.all(
+      staleKeys.map((key) => {
+        const existing = inFlightRef.current.get(key);
+        if (existing) return existing;
+
+        const request = fetchKey(key)
+          .then((value) => ({ key, status: "fulfilled" as const, value }))
+          .catch((reason) => ({ key, status: "rejected" as const, reason }))
+          .finally(() => {
+            if (inFlightRef.current.get(key) === request) {
+              inFlightRef.current.delete(key);
+            }
+          });
+        inFlightRef.current.set(key, request);
+        return request;
+      }),
+    ).then((results) => {
+      if (requestIdRef.current !== requestId) return;
+
+      const fetchedAt = Date.now();
+      for (const result of results) {
+        // Stamp failures too — see the hook doc.
+        fetchedAtRef.current.set(result.key, fetchedAt);
+        if (result.status === "rejected") {
+          console.debug(
+            "[useScopedFetchCache] source unavailable:",
+            result.key,
+            result.reason,
+          );
+        }
+      }
+
+      const fulfilled = results.filter(
+        (result): result is FetchSuccess<K, V> => result.status === "fulfilled",
+      );
+      if (fulfilled.length > 0) {
+        setValues((current) => {
+          const next = { ...current };
+          for (const result of fulfilled) next[result.key] = result.value;
+          return next;
+        });
+      }
+
+      setLoading(false);
+    });
+
+    return () => {
+      if (requestIdRef.current === requestId) {
+        requestIdRef.current += 1;
+      }
+    };
+  }, [requestedKeys, fetchKey, ttlMs]);
+
+  return { values, loading };
+}
diff --git a/frontend/editor/src/core/hooks/useSuperSearch.test.ts b/frontend/editor/src/core/hooks/useSuperSearch.test.ts
new file mode 100644
index 0000000000..0f1f573e8b
--- /dev/null
+++ b/frontend/editor/src/core/hooks/useSuperSearch.test.ts
@@ -0,0 +1,286 @@
+import React from "react";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("react-router-dom", () => ({
+  useNavigate: vi.fn(),
+}));
+
+vi.mock("@app/contexts/ToolWorkflowContext", () => ({
+  useToolWorkflow: vi.fn(),
+}));
+
+vi.mock("@app/contexts/NavigationContext", () => ({
+  useNavigationActions: vi.fn(),
+}));
+
+vi.mock("@app/contexts/ViewerContext", () => ({
+  ViewerContext: React.createContext(null),
+}));
+
+vi.mock("@app/contexts/AppConfigContext", () => ({
+  useAppConfig: vi.fn(),
+}));
+
+vi.mock("@app/contexts/file/fileHooks", () => ({
+  useFileActions: vi.fn(),
+}));
+
+vi.mock("@app/auth/UseSession", () => ({
+  useAuth: vi.fn(() => ({
+    portalAccess: false,
+    isAdmin: false,
+    role: null,
+  })),
+}));
+
+vi.mock("@app/services/fileStorage", () => ({
+  fileStorage: {
+    getLeafStirlingFileStubs: vi.fn(),
+  },
+}));
+
+vi.mock("@app/data/settingsSearchIndex", () => ({
+  SETTINGS_SEARCH_INDEX: [
+    {
+      section: "email",
+      anchor: "smtp-host",
+      labelKey: "settings.email.smtpHost",
+      labelFallback: "SMTP host",
+      keywords: ["smtp"],
+    },
+  ],
+}));
+
+vi.mock("@app/data/settingsSectionRegistry", () => ({
+  SETTINGS_SECTION_REGISTRY: [
+    {
+      key: "general",
+      labelKey: "settings.general.title",
+      labelFallback: "General",
+      keywords: ["general"],
+    },
+    {
+      key: "email",
+      labelKey: "settings.email.title",
+      labelFallback: "Email",
+      keywords: ["mail"],
+      requiresLogin: true,
+    },
+    {
+      key: "admin",
+      labelKey: "settings.admin.title",
+      labelFallback: "Admin",
+      keywords: ["admin"],
+      adminArea: true,
+    },
+    {
+      key: "teams",
+      labelKey: "settings.teams.title",
+      labelFallback: "Team",
+      keywords: ["team"],
+      requiresAccount: true,
+    },
+  ],
+}));
+
+vi.mock("@app/data/settingsContentSearch", () => ({
+  findSettingsContentMatch: vi.fn((section: string, query: string) => {
+    if (query === "smtp" && (section === "general" || section === "email")) {
+      return { section, query };
+    }
+    return null;
+  }),
+  buildMatchSnippet: vi.fn(
+    (_match: unknown, query: string) => `Match: ${query}`,
+  ),
+}));
+
+vi.mock("@app/data/processorSearchIndex", () => ({
+  PROCESSOR_SEARCH_INDEX: [
+    {
+      id: "users",
+      labelKey: "superSearch.processor.users",
+      labelFallback: "Users",
+      path: "/users",
+      keywords: ["members"],
+    },
+    {
+      id: "docs",
+      labelKey: "superSearch.processor.docs",
+      labelFallback: "Docs",
+      path: "",
+      externalUrl: "https://example.com/docs",
+      keywords: ["manual"],
+    },
+  ],
+}));
+
+import type { TFunction } from "i18next";
+import {
+  assembleSuperSearchGroups,
+  rankProcessorResults,
+  rankSettingsResults,
+} from "@app/hooks/useSuperSearch";
+
+const t = ((key: string, fallback?: string) =>
+  fallback ?? key) as unknown as TFunction;
+
+describe("useSuperSearch helpers", () => {
+  it("drops empty groups and preserves the requested group order", () => {
+    const groups = assembleSuperSearchGroups(
+      {
+        tools: [
+          {
+            key: "tool:rotate",
+            group: "tools",
+            title: "Rotate",
+            score: 60,
+            onSelect: vi.fn(),
+          },
+        ],
+        processor: [
+          {
+            key: "processor:users",
+            group: "processor",
+            title: "Users",
+            score: 70,
+            onSelect: vi.fn(),
+          },
+        ],
+      },
+      t,
+      ["processor", "settings", "tools", "files"],
+    );
+
+    expect(groups.map((group) => group.id)).toEqual(["processor", "tools"]);
+    expect(groups.map((group) => group.label)).toEqual(["Processor", "Tools"]);
+  });
+
+  it("prefers row-level setting hits and skips duplicate content matches", () => {
+    const openSettings = vi.fn();
+
+    const results = rankSettingsResults(
+      "smtp",
+      t,
+      {
+        isAdmin: false,
+        loginEnabled: true,
+      },
+      openSettings,
+    );
+
+    expect(results.map((result) => result.key)).toEqual([
+      "setting:email:smtp-host",
+      "setting-content:general",
+    ]);
+
+    void results[0]?.onSelect();
+    expect(openSettings).toHaveBeenCalledWith("email", "smtp-host");
+  });
+
+  it("keeps gated settings hidden while app config is unresolved", () => {
+    const results = rankSettingsResults("admin", t, null, vi.fn());
+
+    expect(results).toEqual([]);
+    expect(rankSettingsResults("team", t, null, vi.fn())).toEqual([]);
+  });
+
+  it("respects showSettingsWhenNoLogin for the no-login admin preview", () => {
+    const noLoginGates = { isAdmin: false, loginEnabled: false };
+
+    // Default (flag unset / true): no-login mode keeps the admin preview.
+    const shown = rankSettingsResults("admin", t, noLoginGates, vi.fn());
+    expect(shown.map((result) => result.key)).toEqual([
+      "setting-section:admin",
+    ]);
+
+    // Flag off: the modal hides admin sections, so search must too.
+    const hidden = rankSettingsResults(
+      "admin",
+      t,
+      { ...noLoginGates, showSettingsWhenNoLogin: false },
+      vi.fn(),
+    );
+    expect(hidden).toEqual([]);
+
+    // Admins keep admin sections regardless of the flag.
+    const admin = rankSettingsResults(
+      "admin",
+      t,
+      { isAdmin: true, loginEnabled: true, showSettingsWhenNoLogin: false },
+      vi.fn(),
+    );
+    expect(admin.map((result) => result.key)).toEqual([
+      "setting-section:admin",
+    ]);
+  });
+
+  it("hides account-bound settings from anonymous sessions", () => {
+    const anonymous = rankSettingsResults(
+      "team",
+      t,
+      { isAdmin: false, loginEnabled: true, isAnonymous: true },
+      vi.fn(),
+    );
+    expect(anonymous).toEqual([]);
+
+    const signedIn = rankSettingsResults(
+      "team",
+      t,
+      { isAdmin: false, loginEnabled: true, isAnonymous: false },
+      vi.fn(),
+    );
+    expect(signedIn.map((result) => result.key)).toEqual([
+      "setting-section:teams",
+    ]);
+
+    // Hosts that omit the flag (portal, always signed-in) keep the section.
+    const flagless = rankSettingsResults(
+      "team",
+      t,
+      { isAdmin: false, loginEnabled: true },
+      vi.fn(),
+    );
+    expect(flagless.map((result) => result.key)).toEqual([
+      "setting-section:teams",
+    ]);
+  });
+
+  it("keeps the Processor group closed until gates resolve, then opens it for single-user mode", () => {
+    const selectEntry = vi.fn();
+
+    expect(rankProcessorResults("members", t, null, selectEntry)).toEqual([]);
+
+    const results = rankProcessorResults(
+      "members",
+      t,
+      {
+        isAdmin: false,
+        loginEnabled: false,
+      },
+      selectEntry,
+    );
+
+    expect(results.map((result) => result.key)).toEqual(["processor:users"]);
+
+    void results[0]?.onSelect();
+    expect(selectEntry).toHaveBeenCalledWith(
+      expect.objectContaining({ id: "users", path: "/users" }),
+    );
+  });
+
+  it("opens the Processor group for a user with explicit portal access", () => {
+    const results = rankProcessorResults(
+      "members",
+      t,
+      {
+        isAdmin: false,
+        loginEnabled: true,
+        portalAccessible: true,
+      },
+      vi.fn(),
+    );
+
+    expect(results.map((result) => result.key)).toEqual(["processor:users"]);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/useSuperSearch.ts b/frontend/editor/src/core/hooks/useSuperSearch.ts
new file mode 100644
index 0000000000..9f6a16f2f4
--- /dev/null
+++ b/frontend/editor/src/core/hooks/useSuperSearch.ts
@@ -0,0 +1,663 @@
+import {
+  createElement,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
+import type { TFunction } from "i18next";
+import { useTranslation } from "react-i18next";
+import { useLocation, useNavigate } from "react-router-dom";
+
+import { useAuth } from "@app/auth/UseSession";
+import { useToolWorkflow } from "@app/contexts/ToolWorkflowContext";
+import { useNavigationActions } from "@app/contexts/NavigationContext";
+import { ViewerContext } from "@app/contexts/ViewerContext";
+import { useAppConfig } from "@app/contexts/AppConfigContext";
+import { useFileActions } from "@app/contexts/file/fileHooks";
+import { fileStorage } from "@app/services/fileStorage";
+import { FileDocIcon } from "@app/components/shared/FileDocIcon";
+import { getFileDocVariant } from "@app/components/shared/filePreview/getFileTypeIcon";
+import { detectFileExtension } from "@app/utils/fileUtils";
+import { openExternalUrl } from "@app/utils/safeNavigation";
+import { EDITOR_BASENAME } from "@app/routes/editorBasename";
+import {
+  rankByFuzzy,
+  idToWords,
+  FUZZY_MIN_SCORE,
+} from "@app/utils/fuzzySearch";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { ToolId } from "@app/types/toolId";
+import { isComingSoonTool, type ToolRegistry } from "@app/data/toolsTaxonomy";
+import { SETTINGS_SEARCH_INDEX } from "@app/data/settingsSearchIndex";
+import { SETTINGS_SECTION_REGISTRY } from "@app/data/settingsSectionRegistry";
+import {
+  buildMatchSnippet,
+  findSettingsContentMatch,
+} from "@app/data/settingsContentSearch";
+import {
+  PROCESSOR_SEARCH_INDEX,
+  isPortalEntityScopeAccessible,
+  type ProcessorSearchEntry,
+} from "@app/data/processorSearchIndex";
+import { useProcessorEntityGroups } from "@app/data/processorEntitySearch";
+import {
+  PORTAL_ENTITY_SCOPE_DEFS,
+  PORTAL_DOCS_SCOPE_ID,
+  type SuperSearchGates,
+  type SuperSearchGroup,
+  type SuperSearchGroupId,
+  type SuperSearchQueryOptions,
+  type SuperSearchResult,
+  type SuperSearchScope,
+  type UseSuperSearchResult,
+} from "@app/types/superSearch";
+
+// Re-exported so existing consumers keep one import site; the definitions
+// live in the types leaf (see that module for why).
+export type {
+  SuperSearchGates,
+  SuperSearchGroup,
+  SuperSearchGroupId,
+  SuperSearchQueryOptions,
+  SuperSearchResult,
+  SuperSearchScope,
+  UseSuperSearchResult,
+};
+
+/**
+ * How many results a ranker computes per group. This is the ceiling the
+ * dropdown can reveal via "show more" — the component shows a small initial
+ * slice per group and expands to the rest on demand.
+ */
+export const GROUP_RESULT_CEILING = 24;
+/** Group display order in the dropdown. */
+const GROUP_ORDER: SuperSearchGroupId[] = [
+  "files",
+  "tools",
+  "settings",
+  "processor",
+];
+
+/**
+ * Whether the current user can enter the Processor at all: explicit portal
+ * access, admin, or single-user mode with login disabled. Null gates (config
+ * still loading) stay closed.
+ */
+export function isProcessorGateOpen(gates: SuperSearchGates | null): boolean {
+  return (
+    !!gates &&
+    (gates.portalAccessible === true || gates.isAdmin || !gates.loginEnabled)
+  );
+}
+
+/** The editor's visibility gates, from app config + the session's flags. */
+export function useSuperSearchGates(): SuperSearchGates | null {
+  const authState = useAuth();
+  const { config } = useAppConfig();
+  return useMemo(
+    () =>
+      config
+        ? {
+            isAdmin: authState.isAdmin ?? config.isAdmin ?? false,
+            loginEnabled: config.enableLogin ?? false,
+            portalAccessible: authState.portalAccess ?? false,
+            isAnonymous: authState.isAnonymous,
+            showSettingsWhenNoLogin: config.showSettingsWhenNoLogin ?? true,
+          }
+        : null,
+    [authState.isAdmin, authState.isAnonymous, authState.portalAccess, config],
+  );
+}
+
+/**
+ * The editor bar's filter chips — one per source lane, granular over the
+ * Processor's contents (pages plus each entity type). Processor lanes only
+ * show when this build ships the portal and the user can enter it.
+ */
+export function useEditorSearchScopes(): SuperSearchScope[] {
+  const { t } = useTranslation();
+  const gates = useSuperSearchGates();
+  const processorAvailable =
+    PROCESSOR_SEARCH_INDEX.length > 0 && isProcessorGateOpen(gates);
+
+  return useMemo(() => {
+    const visibleViewIds = new Set(
+      PROCESSOR_SEARCH_INDEX.map((entry) => entry.id),
+    );
+    return [
+      {
+        id: "files",
+        label: t("superSearch.group.files", "Files"),
+        aliases: ["file", "files"],
+      },
+      {
+        id: "tools",
+        label: t("superSearch.group.tools", "Tools"),
+        aliases: ["tool", "tools"],
+      },
+      {
+        id: "settings",
+        label: t("superSearch.group.settings", "Settings"),
+        aliases: ["setting", "settings"],
+      },
+      ...(processorAvailable
+        ? [
+            {
+              id: "processor",
+              label: t("superSearch.group.pages", "Pages"),
+              aliases: ["page", "pages", "processor", "portal"],
+            },
+            ...PORTAL_ENTITY_SCOPE_DEFS.filter(
+              (def) =>
+                visibleViewIds.has(def.viewId) &&
+                isPortalEntityScopeAccessible(def.id, gates?.isAdmin ?? false),
+            ).map((def) => ({
+              id: def.id,
+              label: t(def.labelKey, def.labelFallback),
+              aliases: [...def.aliases],
+            })),
+            ...(visibleViewIds.has("docs")
+              ? [
+                  {
+                    id: PORTAL_DOCS_SCOPE_ID,
+                    label: t("superSearch.group.docs", "Docs"),
+                    aliases: ["doc", "docs", "documentation"],
+                  },
+                ]
+              : []),
+          ]
+        : []),
+    ];
+  }, [t, processorAvailable, gates?.isAdmin]);
+}
+
+/**
+ * Shared scope handling for hosts that accept SuperSearchQueryOptions:
+ * which source lanes are enabled for the current chip/prefix selection.
+ */
+export function useSearchScopeFilter(options?: SuperSearchQueryOptions): {
+  scopeEnabled: (scopeId: string) => boolean;
+} {
+  const scopedIds = useMemo(
+    () => new Set(options?.scopeIds ?? []),
+    [options?.scopeIds],
+  );
+  const hasScopedSearch = scopedIds.size > 0;
+  const scopeEnabled = useCallback(
+    (scopeId: string) => !hasScopedSearch || scopedIds.has(scopeId),
+    [hasScopedSearch, scopedIds],
+  );
+  return { scopeEnabled };
+}
+
+// ---------------------------------------------------------------------------
+// Shared sources. Every host bar (editor workbench, portal shell) builds its
+// results from these, so a query ranks identically everywhere — only the
+// select actions differ (in-app contexts vs cross-app navigation).
+// ---------------------------------------------------------------------------
+
+/** Loads the My Files stubs whenever the search surface is open. */
+export function useMyFilesStubs(active: boolean): {
+  stubs: StirlingFileStub[];
+  loadingFiles: boolean;
+} {
+  const [stubs, setStubs] = useState<StirlingFileStub[]>([]);
+  const [loadingFiles, setLoadingFiles] = useState(false);
+  const loadedOnceRef = useRef(false);
+
+  useEffect(() => {
+    if (!active) return;
+    // Refresh whenever the surface opens so newly added files appear.
+    let cancelled = false;
+    if (!loadedOnceRef.current) setLoadingFiles(true);
+    fileStorage
+      .getLeafStirlingFileStubs()
+      .then((all) => {
+        if (cancelled) return;
+        setStubs(all);
+        loadedOnceRef.current = true;
+      })
+      .catch((err) => {
+        console.error("[SuperSearch] Failed to load file stubs:", err);
+      })
+      .finally(() => {
+        if (!cancelled) setLoadingFiles(false);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [active]);
+
+  return { stubs, loadingFiles };
+}
+
+export function rankFileResults(
+  stubs: StirlingFileStub[],
+  trimmed: string,
+  openFile: (stub: StirlingFileStub) => void | Promise<void>,
+  limit = GROUP_RESULT_CEILING,
+): SuperSearchResult[] {
+  if (!trimmed) return [];
+  return rankByFuzzy(stubs, trimmed, [(s) => s.name])
+    .slice(0, limit)
+    .map(({ item, score }) => ({
+      key: `file:${item.id}`,
+      group: "files",
+      title: item.name,
+      // The file-type doc icon (PDF/image/doc/…) the sidebar and grid use,
+      // rather than a flat generic file glyph. Sized by height so the portrait
+      // doc shape sits level with the square tool/settings icons instead of
+      // overflowing the row.
+      icon: createElement(FileDocIcon, {
+        variant: getFileDocVariant(
+          detectFileExtension(item.name.toLowerCase()),
+          (item.type ?? "").toLowerCase(),
+        ),
+        style: { height: "1.15rem", width: "auto" },
+      }),
+      score,
+      onSelect: () => openFile(item),
+    }));
+}
+
+export function rankToolResults(
+  registry: Partial<ToolRegistry>,
+  trimmed: string,
+  openTool: (id: ToolId) => void,
+  limit = GROUP_RESULT_CEILING,
+): SuperSearchResult[] {
+  if (!trimmed) return [];
+  // Coming-soon placeholders are listed in the catalogue but can't open —
+  // selecting one would land on the "tool not found" panel.
+  const entries = (
+    Object.entries(registry) as [ToolId, ToolRegistry[ToolId] | undefined][]
+  ).filter(([id, tool]) => tool && !isComingSoonTool(id, tool));
+  return rankByFuzzy(entries, trimmed, [
+    ([id]) => idToWords(id),
+    ([, v]) => v?.name ?? "",
+    ([, v]) => v?.description ?? "",
+    ([, v]) => v?.synonyms?.join(" ") ?? "",
+  ])
+    .slice(0, limit)
+    .map(({ item: [id, tool], score }) => ({
+      key: `tool:${id}`,
+      group: "tools",
+      title: tool?.name ?? id,
+      subtitle: tool?.description,
+      icon: tool?.icon,
+      score,
+      onSelect: () => openTool(id),
+    }));
+}
+
+export function rankSettingsResults(
+  trimmed: string,
+  t: TFunction,
+  gates: SuperSearchGates | null,
+  openSettings: (section: string, anchor?: string) => void,
+  limit = GROUP_RESULT_CEILING,
+  /** Sections the host's settings modal refuses to show (e.g. the portal's
+   * hiddenSectionKeys) — offering them would deep-link into a blank modal. */
+  excludeSections?: readonly string[],
+): SuperSearchResult[] {
+  if (!trimmed) return [];
+
+  // Sections gated like the modal nav. The registry resolves per build
+  // (core / proprietary / saas / desktop), so this only ever sees sections
+  // the current build's settings modal can actually show.
+  const visibleSections = SETTINGS_SECTION_REGISTRY.filter((s) => {
+    if (excludeSections?.includes(s.key)) return false;
+    // Null gates (config still loading): hide every gated section.
+    // requiresLogin keys off the deployment's login *mode*, mirroring the nav
+    // builder: with login on the editor is login-walled (an unauthenticated
+    // visitor never reaches this code), and with login off those sections
+    // (account, API keys) have no meaning. Actual per-session auth state only
+    // matters on SaaS, where requiresAccount/isAnonymous carries it.
+    if (s.requiresLogin && !(gates?.loginEnabled ?? false)) return false;
+    // Admin-area sections mirror the builder's gate: admins always; no-login
+    // mode only while system.showSettingsWhenNoLogin keeps the admin preview.
+    const adminGateOpen =
+      !!gates &&
+      (gates.isAdmin ||
+        (!gates.loginEnabled && (gates.showSettingsWhenNoLogin ?? true)));
+    if (s.adminArea && !adminGateOpen) return false;
+    // Account-bound sections mirror the SaaS builder's `!isAnonymous` gate.
+    if (s.requiresAccount && (gates ? (gates.isAnonymous ?? false) : true))
+      return false;
+    return true;
+  });
+  // Row context: the display label of the section the row lives in.
+  const sectionLabelFor = new Map(
+    visibleSections.map((s) => [s.key, t(s.labelKey, s.labelFallback)]),
+  );
+
+  // Row-level entries (deep-link with ?focus=) take priority. Rows for
+  // sections this build/user can't open are dropped with them.
+  const rowMatches = rankByFuzzy(
+    SETTINGS_SEARCH_INDEX.filter((e) => sectionLabelFor.has(e.section)),
+    trimmed,
+    [
+      (e) => t(e.labelKey, e.labelFallback),
+      (e) => e.labelFallback,
+      (e) => e.keywords?.join(" ") ?? "",
+    ],
+  );
+  const rows = rowMatches.map(({ item, score }) => ({
+    key: `setting:${item.section}:${item.anchor}`,
+    group: "settings",
+    title: t(item.labelKey, item.labelFallback),
+    subtitle: sectionLabelFor.get(item.section),
+    iconName: "settings-rounded",
+    score: score + 1, // nudge rows above bare section matches
+    onSelect: () => openSettings(item.section, item.anchor),
+  }));
+  // The nav group a section lives under, shown as result context (joined to a
+  // content-match snippet with " · ").
+  const groupTitle = (s: (typeof SETTINGS_SECTION_REGISTRY)[number]) =>
+    s.groupLabelKey
+      ? t(s.groupLabelKey, s.groupLabelFallback ?? "")
+      : undefined;
+
+  const sectionMatches = rankByFuzzy(visibleSections, trimmed, [
+    (s) => t(s.labelKey, s.labelFallback),
+    (s) => s.labelFallback,
+    (s) => s.keywords?.join(" ") ?? "",
+  ]);
+  const sections = sectionMatches.map(({ item, score }) => ({
+    key: `setting-section:${item.key}`,
+    group: "settings",
+    title: t(item.labelKey, item.labelFallback),
+    subtitle: groupTitle(item),
+    iconName: "settings-rounded",
+    score,
+    onSelect: () => openSettings(item.key),
+  }));
+
+  // Content matches: sections whose rendered copy contains the query, so terms
+  // with no curated keyword ("SMTP", a field label) still find their section.
+  // Ranked below every label/keyword match; 3+ chars so a single letter doesn't
+  // match half the modal. Sections already surfaced by a label match — their
+  // own or a row's — are skipped so the same hit isn't listed twice.
+  const labelMatchedKeys = new Set<string>([
+    ...sectionMatches.map(({ item }) => item.key),
+    ...rowMatches.map(({ item }) => item.section),
+  ]);
+  const contentMatches =
+    trimmed.length < 3
+      ? []
+      : visibleSections
+          .filter((s) => !labelMatchedKeys.has(s.key))
+          .flatMap((s) => {
+            const match = findSettingsContentMatch(s.key, trimmed, t);
+            if (!match) return [];
+            const snippet = buildMatchSnippet(match, trimmed);
+            const group = groupTitle(s);
+            return [
+              {
+                key: `setting-content:${s.key}`,
+                group: "settings",
+                title: t(s.labelKey, s.labelFallback),
+                subtitle: group ? `${group} · ${snippet}` : snippet,
+                iconName: "settings-rounded",
+                // Always below the weakest possible label/keyword match.
+                score: FUZZY_MIN_SCORE - 10,
+                onSelect: () => openSettings(s.key),
+              },
+            ];
+          });
+
+  return [...rows, ...sections, ...contentMatches]
+    .sort((a, b) => b.score - a.score)
+    .slice(0, limit);
+}
+
+export function rankProcessorResults(
+  trimmed: string,
+  t: TFunction,
+  gates: SuperSearchGates | null,
+  selectEntry: (entry: ProcessorSearchEntry) => void,
+  limit = GROUP_RESULT_CEILING,
+): SuperSearchResult[] {
+  if (!trimmed || PROCESSOR_SEARCH_INDEX.length === 0) return [];
+  // Only offer Processor pages to users who can actually enter that app.
+  if (!isProcessorGateOpen(gates)) return [];
+  return rankByFuzzy(PROCESSOR_SEARCH_INDEX, trimmed, [
+    (e) => t(e.labelKey, e.labelFallback),
+    (e) => e.labelFallback,
+    (e) => e.keywords?.join(" ") ?? "",
+  ])
+    .slice(0, limit)
+    .map(({ item, score }) => ({
+      key: `processor:${item.id}`,
+      group: "processor",
+      title: t(item.labelKey, item.labelFallback),
+      // Must exist in the bundled Material Symbols set (LocalIcon falls back
+      // to a network fetch for unknown names — blank when self-hosted offline).
+      iconName: "grid-view",
+      score,
+      onSelect: () => selectEntry(item),
+    }));
+}
+
+/**
+ * Orders the sources into the shared group layout, dropping empties. Hosts
+ * pass their own order so local results lead (the editor puts its own
+ * files/tools first and Processor pages last; the portal the reverse).
+ */
+export function assembleSuperSearchGroups(
+  byId: Partial<Record<SuperSearchGroupId, SuperSearchResult[]>>,
+  t: TFunction,
+  order: SuperSearchGroupId[] = GROUP_ORDER,
+): SuperSearchGroup[] {
+  const labels: Record<SuperSearchGroupId, string> = {
+    files: t("superSearch.group.files", "Files"),
+    tools: t("superSearch.group.tools", "Tools"),
+    settings: t("superSearch.group.settings", "Settings"),
+    processor: t("superSearch.group.processor", "Processor"),
+  };
+  return order
+    .map((id) => ({
+      id,
+      label: labels[id],
+      results: byId[id] ?? [],
+    }))
+    .filter((g) => g.results.length > 0);
+}
+
+/**
+ * The editor's results provider: the shared sources wired to in-app select
+ * actions (open file → viewer, select tool in the workbench, deep-link into
+ * the settings modal, route into the Processor).
+ *
+ * @param query   current search text
+ * @param active  whether the search surface is open; gates the My Files load
+ */
+export function useSuperSearch(
+  query: string,
+  active: boolean,
+  options?: SuperSearchQueryOptions,
+): UseSuperSearchResult {
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const {
+    toolRegistry,
+    handleToolSelect,
+    handleToolSelectForced,
+    toolAvailability,
+  } = useToolWorkflow();
+  const { actions: navActions } = useNavigationActions();
+  const { actions: fileActions } = useFileActions();
+  // ViewerContext is only present once the viewer subtree mounts; treat as
+  // optional. Read through a ref: the provider value is rebuilt every viewer
+  // render, and a direct dependency would re-rank every result lane on each
+  // page turn — openFile only needs the value at click time.
+  const viewer = useContext(ViewerContext);
+  const viewerRef = useRef(viewer);
+  useEffect(() => {
+    viewerRef.current = viewer;
+  }, [viewer]);
+
+  const trimmed = query.trim();
+  const { stubs, loadingFiles } = useMyFilesStubs(active);
+  const { scopeEnabled } = useSearchScopeFilter(options);
+  const { pathname } = useLocation();
+
+  // Workbench-bound selections must leave the file manager through the router.
+  // Tool/file selection pins its URL via raw history.pushState, which the
+  // router never observes — so on /files the route keeps re-asserting the
+  // "myFiles" workbench and the selection appears to do nothing. Exit to the
+  // editor's home path: on processor-shipping builds "/" is a role router,
+  // not the editor.
+  const leaveFileManager = useCallback(() => {
+    if (pathname.startsWith("/files")) {
+      navigate(EDITOR_BASENAME);
+    }
+  }, [pathname, navigate]);
+
+  // --- Actions -----------------------------------------------------------
+  const openFile = useCallback(
+    async (stub: StirlingFileStub) => {
+      try {
+        // The file already lives in storage — load it as a stub so its id and
+        // metadata are preserved (addFiles would persist a duplicate record).
+        await fileActions.addStirlingFileStubs([stub], { selectFiles: true });
+        navActions.setWorkbench("viewer");
+        viewerRef.current?.setActiveFileId?.(stub.id);
+        leaveFileManager();
+      } catch (err) {
+        console.error("[SuperSearch] Failed to open file:", stub.name, err);
+      }
+    },
+    [fileActions, navActions, leaveFileManager],
+  );
+
+  const openTool = useCallback(
+    (id: ToolId) => {
+      // Link tools have no in-editor UI — selecting one shows a "tool not
+      // found" panel. Open their destination directly, matching how the
+      // editor's tool lists treat them.
+      const link = toolRegistry[id]?.link;
+      if (link) {
+        openExternalUrl(link);
+        return;
+      }
+      // Tools whose backend endpoint isn't served in this environment are
+      // flagged unavailable; handleToolSelect silently no-ops them. For a
+      // search ("take me to Repair") we still want the click to open the
+      // tool's UI, so fall back to the forced path for those. Available tools
+      // keep the normal path so the unsaved-changes guard still applies.
+      const available = toolAvailability[id]?.available !== false;
+      if (available) {
+        handleToolSelect(id);
+      } else {
+        handleToolSelectForced(id);
+      }
+      leaveFileManager();
+    },
+    [
+      handleToolSelect,
+      handleToolSelectForced,
+      toolAvailability,
+      toolRegistry,
+      leaveFileManager,
+    ],
+  );
+
+  const openSettings = useCallback(
+    (section: string, anchor?: string) => {
+      const path = anchor
+        ? `/settings/${section}?focus=${encodeURIComponent(anchor)}`
+        : `/settings/${section}`;
+      navigate(path);
+    },
+    [navigate],
+  );
+
+  const selectProcessorEntry = useCallback(
+    (item: ProcessorSearchEntry) => {
+      if (item.externalUrl) {
+        openExternalUrl(item.externalUrl);
+      } else {
+        navigate(item.path);
+      }
+    },
+    [navigate],
+  );
+
+  // --- Assemble ----------------------------------------------------------
+  const gates = useSuperSearchGates();
+
+  // Processor entities (users, policies, pipelines, sources) join the pages
+  // under the Processor section — same access gate as the pages group, each
+  // entity type filterable by its own scope.
+  const entityGroups = useProcessorEntityGroups(
+    trimmed,
+    active && trimmed.length > 0 && isProcessorGateOpen(gates),
+    t,
+    navigate,
+    scopeEnabled,
+    gates?.isAdmin ?? false,
+  );
+
+  const groups = useMemo<SuperSearchGroup[]>(() => {
+    const assembledGroups = assembleSuperSearchGroups(
+      {
+        files: scopeEnabled("files")
+          ? rankFileResults(stubs, trimmed, openFile)
+          : [],
+        tools: scopeEnabled("tools")
+          ? rankToolResults(toolRegistry, trimmed, openTool)
+          : [],
+        settings: scopeEnabled("settings")
+          ? rankSettingsResults(trimmed, t, gates, openSettings)
+          : [],
+        processor: scopeEnabled("processor")
+          ? rankProcessorResults(trimmed, t, gates, selectProcessorEntry)
+          : [],
+      },
+      t,
+    );
+
+    // Section order: Editor first, Settings second, Processor last.
+    const processorSection = t("superSearch.group.processor", "Processor");
+    const sectionFor = (groupId: string): string => {
+      if (groupId === "processor") return processorSection;
+      if (groupId === "settings")
+        return t("superSearch.group.settings", "Settings");
+      return t("portal.nav.editor", "Editor");
+    };
+    return [
+      ...assembledGroups.map((group) => ({
+        ...group,
+        label:
+          group.id === "processor"
+            ? t("superSearch.group.pages", "Pages")
+            : group.label,
+        sectionLabel: sectionFor(group.id),
+      })),
+      ...entityGroups.map((group) => ({
+        ...group,
+        sectionLabel: processorSection,
+      })),
+    ];
+  }, [
+    stubs,
+    trimmed,
+    openFile,
+    toolRegistry,
+    openTool,
+    gates,
+    openSettings,
+    selectProcessorEntry,
+    scopeEnabled,
+    entityGroups,
+    t,
+  ]);
+
+  const flatResults = useMemo(() => groups.flatMap((g) => g.results), [groups]);
+
+  return { groups, flatResults, loadingFiles };
+}
diff --git a/frontend/editor/src/core/hooks/useToolManagement.tsx b/frontend/editor/src/core/hooks/useToolManagement.tsx
index 87f9b2f889..951ead5f22 100644
--- a/frontend/editor/src/core/hooks/useToolManagement.tsx
+++ b/frontend/editor/src/core/hooks/useToolManagement.tsx
@@ -3,6 +3,7 @@ import { useToolRegistry } from "@app/contexts/ToolRegistryContext";
 import { usePreferences } from "@app/contexts/PreferencesContext";
 import {
   getAllEndpoints,
+  isComingSoonTool,
   type ToolRegistryEntry,
   type ToolRegistry,
 } from "@app/data/toolsTaxonomy";
@@ -167,12 +168,7 @@ export const useToolManagement = (): ToolManagementResult => {
         ? availabilityInfo.available !== false
         : true;
 
-      // Check if tool is "coming soon" (has no component and no link)
-      const isComingSoon =
-        !baseTool.component &&
-        !baseTool.link &&
-        toolKey !== "read" &&
-        toolKey !== "multiTool";
+      const isComingSoon = isComingSoonTool(toolKey, baseTool);
 
       if (preferences.hideUnavailableTools && (!isAvailable || isComingSoon)) {
         return;
diff --git a/frontend/editor/src/core/i18n/translationAudit.ts b/frontend/editor/src/core/i18n/translationAudit.ts
index 2a9bd33d6d..9dfbc5b21b 100644
--- a/frontend/editor/src/core/i18n/translationAudit.ts
+++ b/frontend/editor/src/core/i18n/translationAudit.ts
@@ -79,7 +79,8 @@ export const I18N_PROJECTS: TranslationProject[] = [
       // SignSettings / SavedSignaturesSection resolve every key as
       // t(`${scope}.${key}`); scope and leaf only ever exist as separate literals.
       /^(sign|addText|addImage)\./,
-      // SettingsSearchBar indexes whole subtrees via t(prefix, { returnObjects }).
+      // Super search's settings content matching (settingsContentSearch)
+      // indexes whole subtrees via t(prefix, { returnObjects }).
       /^admin\.settings\./,
       /^settings\./,
       /^account\./,
diff --git a/frontend/editor/src/core/pages/HomePage.tsx b/frontend/editor/src/core/pages/HomePage.tsx
index 88cbab8a7f..b1d8708649 100644
--- a/frontend/editor/src/core/pages/HomePage.tsx
+++ b/frontend/editor/src/core/pages/HomePage.tsx
@@ -599,11 +599,6 @@ const MyFilesSidebarOverrides = forwardRef<HTMLDivElement, FileSidebarProps>(
       <FileSidebar
         ref={ref}
         {...props}
-        onSearchClick={() => {
-          // Just focus the central search field; don't toggle collapse
-          // (which on /files navigates back home).
-          window.dispatchEvent(new Event("files-page:focus-search"));
-        }}
         onUploadFiles={handleUpload}
         onPickGoogleDriveFiles={handleUpload}
         extraAction={{
diff --git a/frontend/editor/src/core/platform/openExternalTab.test.ts b/frontend/editor/src/core/platform/openExternalTab.test.ts
new file mode 100644
index 0000000000..ccbbe4d818
--- /dev/null
+++ b/frontend/editor/src/core/platform/openExternalTab.test.ts
@@ -0,0 +1,45 @@
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { openExternalTab } from "@app/platform/openExternalTab";
+import { expectConsole } from "@app/tests/failOnConsole";
+
+describe("openExternalTab (core/web)", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  // Opening in a new tab is the point of this seam: @app/platform/openExternal
+  // navigates the current tab on saas, which would tear the user out of the PDF.
+  test("opens alongside the app rather than navigating it away", async () => {
+    const openSpy = vi
+      .spyOn(window, "open")
+      .mockImplementation(() => null as Window | null);
+    const originalHref = window.location.href;
+
+    await openExternalTab("https://example.com/");
+
+    expect(openSpy).toHaveBeenCalledWith(
+      "https://example.com/",
+      "_blank",
+      "noopener,noreferrer",
+    );
+    expect(window.location.href).toBe(originalHref);
+  });
+
+  // The seam is the sink, so it must not depend on callers having sanitised:
+  // window.open on a javascript: URL would execute it in our own origin.
+  test.each([
+    "javascript:alert(1)",
+    "  javascript:alert(1)",
+    "data:text/html,<script>alert(1)</script>",
+    "file:///etc/passwd",
+  ])("refuses to open %s even if a caller skips sanitising", async (url) => {
+    const openSpy = vi
+      .spyOn(window, "open")
+      .mockImplementation(() => null as Window | null);
+    expectConsole.warn(/Refused to open unsafe URL/);
+
+    await openExternalTab(url);
+
+    expect(openSpy).not.toHaveBeenCalled();
+  });
+});
diff --git a/frontend/editor/src/core/platform/openExternalTab.ts b/frontend/editor/src/core/platform/openExternalTab.ts
new file mode 100644
index 0000000000..3a8d21d74a
--- /dev/null
+++ b/frontend/editor/src/core/platform/openExternalTab.ts
@@ -0,0 +1,27 @@
+/**
+ * core/web implementation of the @app/platform/openExternalTab seam.
+ *
+ * Distinct from @app/platform/openExternal: that seam is for "leave and return"
+ * redirects (Stripe checkout), so its saas impl navigates the CURRENT tab. A PDF
+ * link must never do that — it would tear the user out of their document — so
+ * this seam always opens alongside the app. Desktop shadows it to escape the
+ * Tauri webview; saas/proprietary fall through to this window.open.
+ *
+ * Callers are expected to sanitise, but this is the sink that actually hands the
+ * URL to the browser, so it re-checks rather than trusting them: window.open on
+ * a `javascript:` URL executes it in our own origin.
+ */
+import { getExternalHref } from "@app/utils/externalUrl";
+
+export type OpenExternalTab = (url: string) => Promise<void>;
+
+export const openExternalTab: OpenExternalTab = async (
+  url: string,
+): Promise<void> => {
+  const safeHref = getExternalHref(url);
+  if (!safeHref) {
+    console.warn("[openExternalTab] Refused to open unsafe URL:", url);
+    return;
+  }
+  window.open(safeHref, "_blank", "noopener,noreferrer");
+};
diff --git a/frontend/editor/src/core/query/keys.ts b/frontend/editor/src/core/query/keys.ts
index a7a68ea256..5354b56b63 100644
--- a/frontend/editor/src/core/query/keys.ts
+++ b/frontend/editor/src/core/query/keys.ts
@@ -6,5 +6,8 @@ export const qk = {
     ["editor", "endpointEnabled", endpoint] as const,
   footerInfo: () => ["editor", "footerInfo"] as const,
   groupEnabled: (group: string) => ["editor", "groupEnabled", group] as const,
+  /** Keyed on the asking identity: two users must never share one answer. */
+  portalAccess: (userId: string | null) =>
+    ["editor", "portalAccess", userId] as const,
   users: () => ["editor", "users"] as const,
 } as const;
diff --git a/frontend/editor/src/core/services/failureReporting.test.ts b/frontend/editor/src/core/services/failureReporting.test.ts
new file mode 100644
index 0000000000..2eadc3ae65
--- /dev/null
+++ b/frontend/editor/src/core/services/failureReporting.test.ts
@@ -0,0 +1,315 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+/**
+ * Tests for the editor's failure reporter. Two properties matter: it never sends a
+ * document name, and it never lets its own failure reach the tool the user was
+ * running.
+ */
+
+const post = vi.fn();
+
+/**
+ * Indirection so one test can replace the transport with a plain throwing closure.
+ * A vi.fn that throws has its error re-reported by vitest even once the code under
+ * test has caught it, which would fail the very test asserting it was caught.
+ */
+let transport: (...args: unknown[]) => unknown = (...args) => post(...args);
+
+vi.mock("@app/services/apiClient", () => ({
+  default: { post: (...args: unknown[]) => transport(...args) },
+}));
+
+const { reportToolFailure, reportFilesRemoved, errorCodeOf } =
+  await import("@app/services/failureReporting");
+
+/** An axios-shaped rejection carrying a Problem Details body. */
+function problemDetail(errorCode: string, extra: Record<string, unknown> = {}) {
+  return {
+    response: {
+      status: 400,
+      data: { type: "/errors/pdf-password", errorCode, ...extra },
+    },
+    message: "Request failed with status code 400",
+  };
+}
+
+describe("errorCodeOf", () => {
+  it("reads the code out of a Problem Details body", async () => {
+    await expect(errorCodeOf(problemDetail("E004"))).resolves.toBe("E004");
+  });
+
+  it("reads the code out of a blob body, which is how a download-typed call fails", async () => {
+    const error = {
+      response: {
+        data: {
+          text: () => Promise.resolve(JSON.stringify({ errorCode: "E001" })),
+        },
+      },
+    };
+
+    await expect(errorCodeOf(error)).resolves.toBe("E001");
+  });
+
+  it("returns null when the body carries no code", async () => {
+    await expect(
+      errorCodeOf({ response: { data: { title: "nope" } } }),
+    ).resolves.toBeNull();
+    await expect(errorCodeOf({ message: "network error" })).resolves.toBeNull();
+    await expect(errorCodeOf(undefined)).resolves.toBeNull();
+  });
+
+  it("returns null rather than throwing on an unparseable blob", async () => {
+    const error = {
+      response: { data: { text: () => Promise.resolve("<html>502</html>") } },
+    };
+
+    await expect(errorCodeOf(error)).resolves.toBeNull();
+  });
+});
+
+describe("reportToolFailure", () => {
+  beforeEach(() => {
+    post.mockReset().mockResolvedValue({ status: 204 });
+    transport = (...args) => post(...args);
+  });
+
+  it("posts the operation, code and file ids", async () => {
+    await reportToolFailure({
+      operation: "remove-password",
+      error: problemDetail("E004"),
+      fileIds: ["f-1", "f-2"],
+    });
+
+    expect(post).toHaveBeenCalledTimes(1);
+    const [path, body] = post.mock.calls[0] as [
+      string,
+      Record<string, unknown>,
+    ];
+    expect(path).toBe("/api/v1/file-run-events/reports");
+    expect(body).toMatchObject({
+      operation: "remove-password",
+      errorCode: "E004",
+      fileIds: ["f-1", "f-2"],
+    });
+  });
+
+  it("ignores names a caller hands it, and identifies files by id", async () => {
+    // fileNames is accepted and dropped on purpose, so a call site holding names cannot pass
+    // them somewhere they would be stored as a document reference.
+    await reportToolFailure({
+      operation: "compress",
+      error: { response: { status: 500, data: {} }, message: "boom" },
+      fileIds: ["f-1"],
+      fileNames: ["Q4 report.pdf"],
+    });
+
+    const body = post.mock.calls[0]?.[1] as Record<string, unknown>;
+    expect(body.fileIds).toEqual(["f-1"]);
+    expect(JSON.stringify(body)).not.toContain("Q4 report.pdf");
+  });
+
+  it("sends the message the user saw, unaltered", async () => {
+    // Their own error about their own file: trimming it only makes the row harder to act on.
+    await reportToolFailure({
+      operation: "compress",
+      error: {
+        response: { status: 500, data: {} },
+        message: "Failed on Q4 report.pdf",
+      },
+      fileIds: ["f-1"],
+    });
+
+    const body = post.mock.calls[0]?.[1] as { detail: string };
+    expect(body.detail).toBe("Failed on Q4 report.pdf");
+  });
+
+  it("sends no team, because the server derives it", async () => {
+    await reportToolFailure({
+      operation: "compress",
+      error: problemDetail("E004"),
+      fileIds: ["f-1"],
+    });
+
+    expect(JSON.stringify(post.mock.calls[0]?.[1])).not.toMatch(/team/i);
+  });
+
+  it("swallows its own failure so the tool's own error handling is unaffected", async () => {
+    transport = () => {
+      throw new Error("404 - no such route on a core build");
+    };
+
+    let threw = false;
+    try {
+      await reportToolFailure({
+        operation: "compress",
+        error: problemDetail("E004"),
+        fileIds: ["f-1"],
+      });
+    } catch {
+      threw = true;
+    }
+
+    expect(threw).toBe(false);
+  });
+
+  it("asks for its own failure not to be shown, since the tool's error is already on screen", async () => {
+    await reportToolFailure({
+      operation: "compress",
+      error: problemDetail("E004"),
+      fileIds: ["f-1"],
+    });
+
+    expect(post.mock.calls[0]?.[2]).toMatchObject({ suppressErrorToast: true });
+  });
+
+  it("logs a rejected report instead of losing it, and still does not throw", async () => {
+    // A 400 means this client built a bad report, e.g. one naming more files than a report may
+    // carry. Nothing else would ever surface it: the call is fire-and-forget and its toast is
+    // suppressed, so the console line is the only sign a client author gets.
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    transport = () => {
+      throw Object.assign(new Error("Request failed with status code 400"), {
+        response: {
+          status: 400,
+          data: {
+            detail:
+              "a report may name at most 200 files, and this one named 5000",
+          },
+        },
+      });
+    };
+
+    let threw = false;
+    try {
+      await reportToolFailure({
+        operation: "compress",
+        error: problemDetail("E004"),
+        fileIds: ["f-1"],
+      });
+    } catch {
+      threw = true;
+    }
+
+    expect(threw).toBe(false);
+    expect(warn).toHaveBeenCalledTimes(1);
+    expect(String(warn.mock.calls[0]?.[0])).toContain("at most 200 files");
+    warn.mockRestore();
+  });
+
+  it("stays quiet when the route is simply absent, as on a build without failure tracking", async () => {
+    // Otherwise every tool failure on such a build would log, which is noise rather than a
+    // diagnostic.
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    transport = () => {
+      throw Object.assign(new Error("Request failed with status code 404"), {
+        response: { status: 404, data: {} },
+      });
+    };
+
+    await reportToolFailure({
+      operation: "compress",
+      error: problemDetail("E004"),
+      fileIds: ["f-1"],
+    });
+
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+
+  it("reports a client-side refusal, which is a failure a leader can act on", async () => {
+    // The same class of problem as the processor rejecting a file type, which is
+    // already recorded. Unclassified, so the server files it as UNKNOWN.
+    await reportToolFailure({
+      operation: "convert",
+      error: new Error("Unsupported conversion format"),
+      fileIds: ["f-1"],
+    });
+
+    const body = post.mock.calls[0]?.[1] as Record<string, unknown>;
+    expect(body).toMatchObject({
+      operation: "convert",
+      errorCode: null,
+      detail: "Unsupported conversion format",
+    });
+  });
+
+  it("reports a network failure, which got no reply but did leave the browser", async () => {
+    await reportToolFailure({
+      operation: "compress",
+      error: { request: {}, message: "Network Error" },
+      fileIds: ["f-1"],
+    });
+
+    expect(post).toHaveBeenCalledTimes(1);
+  });
+
+  it.each([
+    ["an axios cancellation", { code: "ERR_CANCELED", message: "canceled" }],
+    [
+      "the rethrown wrapper useToolApiCalls builds",
+      new Error("Operation was cancelled", {
+        cause: { code: "ERR_CANCELED" },
+      }),
+    ],
+  ])("ignores %s, because the user chose to stop", async (_label, error) => {
+    await reportToolFailure({ operation: "compress", error, fileIds: ["f-1"] });
+
+    expect(post).not.toHaveBeenCalled();
+  });
+
+  it("tells the server when files are deleted, so their failures leave the queue", async () => {
+    await reportFilesRemoved(["f-1", "f-2"]);
+
+    const [path, body] = post.mock.calls[0] as [
+      string,
+      Record<string, unknown>,
+    ];
+    expect(path).toBe("/api/v1/file-run-events/removed-files");
+    expect(body).toEqual({ fileIds: ["f-1", "f-2"] });
+  });
+
+  it("says nothing when no real file ids were deleted", async () => {
+    await reportFilesRemoved([]);
+    await reportFilesRemoved(["", "   "]);
+
+    expect(post).not.toHaveBeenCalled();
+  });
+
+  it("swallows a failed deletion notice, since the file is gone locally either way", async () => {
+    transport = () => {
+      throw new Error("404 - no such route on a core build");
+    };
+
+    let threw = false;
+    try {
+      await reportFilesRemoved(["f-1"]);
+    } catch {
+      threw = true;
+    }
+
+    expect(threw).toBe(false);
+  });
+
+  it("does nothing without an operation to attribute the failure to", async () => {
+    await reportToolFailure({
+      operation: "",
+      error: { response: { status: 500 } },
+      fileIds: ["f-1"],
+    });
+
+    expect(post).not.toHaveBeenCalled();
+  });
+
+  it("sends every file id, since trimming would lose failures silently", async () => {
+    const many = Array.from({ length: 60 }, (_, i) => `f-${i}`);
+
+    await reportToolFailure({
+      operation: "compress",
+      error: problemDetail("E004"),
+      fileIds: many,
+    });
+
+    const body = post.mock.calls[0]?.[1] as { fileIds: string[] };
+    expect(body.fileIds).toEqual(many);
+  });
+});
diff --git a/frontend/editor/src/core/services/failureReporting.ts b/frontend/editor/src/core/services/failureReporting.ts
new file mode 100644
index 0000000000..af0765f8bd
--- /dev/null
+++ b/frontend/editor/src/core/services/failureReporting.ts
@@ -0,0 +1,183 @@
+import apiClient from "@app/services/apiClient";
+
+/**
+ * Reports a tool failure the user hit in the editor, so it lands in the same queue
+ * as one from a folder or bucket. The editor calls tools directly, so nothing
+ * server-side knows about these unless the client says so.
+ *
+ * Best-effort throughout: a build without the failure registry has no such route,
+ * and a report failing must never disturb the tool's own error handling.
+ */
+
+const REPORT_PATH = "/api/v1/file-run-events/reports";
+const REMOVED_FILES_PATH = "/api/v1/file-run-events/removed-files";
+
+interface ToolFailureReport {
+  /** The tool that failed, e.g. `remove-password`. */
+  operation: string;
+  /** Whatever the tool call rejected with. */
+  error: unknown;
+  /** Opaque file ids from FileContext. Names are deliberately not accepted. */
+  fileIds?: string[];
+  /**
+   * Accepted and ignored, so a call site that has names on hand cannot pass them
+   * somewhere they would be stored. Present to make that explicit rather than to
+   * be used.
+   */
+  fileNames?: string[];
+}
+
+/**
+ * The `errorCode` from a tool's Problem Details response, or null when there is
+ * none. A download-typed call fails with a Blob body, so that shape is parsed too.
+ */
+export async function errorCodeOf(error: unknown): Promise<string | null> {
+  const data = (error as { response?: { data?: unknown } })?.response?.data;
+  if (!data) return null;
+
+  const body = await asJson(data);
+  const code = (body as { errorCode?: unknown })?.errorCode;
+  return typeof code === "string" && code.trim() !== "" ? code : null;
+}
+
+async function asJson(data: unknown): Promise<unknown> {
+  if (typeof data === "object" && data !== null && !isBlobLike(data)) {
+    return data;
+  }
+  try {
+    const text = isBlobLike(data)
+      ? await data.text()
+      : typeof data === "string"
+        ? data
+        : "";
+    return text ? JSON.parse(text) : null;
+  } catch {
+    return null;
+  }
+}
+
+function isBlobLike(value: unknown): value is { text: () => Promise<string> } {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    typeof (value as { text?: unknown }).text === "function"
+  );
+}
+
+export async function reportToolFailure({
+  operation,
+  error,
+  fileIds = [],
+}: ToolFailureReport): Promise<void> {
+  if (!operation || operation.trim() === "") return;
+  if (wasCancelled(error)) return;
+
+  try {
+    await apiClient.post(
+      REPORT_PATH,
+      {
+        operation,
+        errorCode: await errorCodeOf(error),
+        fileIds,
+        detail: messageOf(error),
+      },
+      // The reporter's own failure must not reach the user: they already have the
+      // tool's error on screen, and a second toast about the report would be noise
+      // about something they never asked for.
+      { suppressErrorToast: true },
+    );
+  } catch (reportError) {
+    // Still never rethrown: a core build has no such route, and a member's report can
+    // also be refused. But a report the server rejected as invalid is logged rather
+    // than lost, because nothing else would ever surface it.
+    warnIfRejected(operation, reportError);
+  }
+}
+
+/**
+ * A report the server refused as malformed, which means this client built a bad one: worth a
+ * line in the console for whoever wrote it, since the call is fire-and-forget and its toast is
+ * suppressed. An absent route (404, a core build) or a session not allowed to report are
+ * expected, and stay quiet so an ordinary build does not log on every tool failure.
+ */
+function warnIfRejected(operation: string, error: unknown): void {
+  const response = (error as { response?: { status?: number; data?: unknown } })
+    ?.response;
+  if (response?.status !== 400) return;
+
+  console.warn(
+    `Failure report for "${operation}" was rejected by the server: ${reasonOf(response.data)}`,
+  );
+}
+
+/** Whatever the server said, out of a Problem Details body. */
+function reasonOf(data: unknown): string {
+  const body = data as { detail?: unknown; message?: unknown };
+  const stated =
+    typeof body?.detail === "string"
+      ? body.detail
+      : typeof body?.message === "string"
+        ? body.message
+        : "";
+  return stated.trim() === "" ? "no reason given" : stated;
+}
+
+/**
+ * Tell the server a user deleted these files, so any failure recorded against them stops asking
+ * for attention. The rows stay for audit; they just leave the queue.
+ *
+ * <p>Best-effort like the reporter: a build without the failure registry has no such route, and
+ * deleting a file must not fail because the server could not be told.
+ */
+export async function reportFilesRemoved(fileIds: string[]): Promise<void> {
+  const named = fileIds.filter(
+    (id) => typeof id === "string" && id.trim() !== "",
+  );
+  if (named.length === 0) return;
+
+  try {
+    // Toast suppressed for the same reason as a report: the user deleted a file and is not
+    // waiting to hear whether the server was told.
+    await apiClient.post(
+      REMOVED_FILES_PATH,
+      { fileIds: named },
+      { suppressErrorToast: true },
+    );
+  } catch {
+    // The file is gone locally either way. A row left open is retention's problem.
+  }
+}
+
+/**
+ * The message the user saw, sent as-is. It is their own error about their own file, so hiding
+ * parts of it would only make the row harder to act on.
+ */
+function messageOf(error: unknown): string {
+  const candidate = error as { message?: unknown };
+  return typeof candidate?.message === "string" ? candidate.message : "";
+}
+
+/**
+ * A user cancelling is the one failure worth dropping: nothing went wrong and there
+ * is nothing for a reviewer to do. `useToolApiCalls` rethrows an axios cancellation
+ * as a plain Error with the original as its cause, so both shapes are checked.
+ *
+ * <p>Everything else is reported, client-side refusals included: an unsupported input
+ * format is the same class of problem as the processor rejecting a file type, which
+ * is already recorded.
+ */
+function wasCancelled(error: unknown): boolean {
+  const candidate = error as {
+    code?: unknown;
+    name?: unknown;
+    message?: unknown;
+    cause?: { code?: unknown; name?: unknown };
+  };
+  return (
+    candidate?.code === "ERR_CANCELED" ||
+    candidate?.cause?.code === "ERR_CANCELED" ||
+    candidate?.name === "CanceledError" ||
+    candidate?.cause?.name === "CanceledError" ||
+    candidate?.message === "Operation was cancelled"
+  );
+}
diff --git a/frontend/editor/src/core/services/fileStorage.blobFallback.test.ts b/frontend/editor/src/core/services/fileStorage.blobFallback.test.ts
index d8530af026..d6f1c4b89d 100644
--- a/frontend/editor/src/core/services/fileStorage.blobFallback.test.ts
+++ b/frontend/editor/src/core/services/fileStorage.blobFallback.test.ts
@@ -3,23 +3,26 @@ import "fake-indexeddb/auto";
 import { expectConsole } from "@app/tests/failOnConsole";
 
 /**
- * Regression test for the WebKit nightly breakage introduced with the
- * large-file OOM fix (#7175): `storeStirlingFile` began putting the `File`
- * itself into IndexedDB (persisted by reference, so multi-GB uploads never
- * materialize in JS memory). WebKit refuses blob values whenever it can't write
- * the blob's backing file and rejects the request with `UnknownError: Error
- * preparing Blob/File data to be stored in object store`, so on WebKit every
- * upload silently failed to persist: files vanished on navigation, Compare
- * slots never filled, and the classification backfill had no bytes to read.
+ * WebKit refuses blob values when it can't write the blob's backing file, so
+ * every upload silently failed to persist after #7175. Retried as a copy now.
  *
- * The service now retries such a rejection with an ArrayBuffer copy and stops
- * offering blobs for the rest of the session.
+ * It can also accept one and then lose the backing store. fake-indexeddb returns no
+ * Blob, so that loss is injected at the read; real round-trips: the e2e spec.
  */
 
-const nativeAdd = IDBObjectStore.prototype.add;
+const alertMock = vi.hoisted(() => vi.fn());
+vi.mock("@app/components/toast", () => ({
+  alert: (options: unknown) => alertMock(options),
+}));
 
-/** What each `add` attempt carried in `data` — the blob path or the copy path. */
+const nativeAdd = IDBObjectStore.prototype.add;
+const nativePut = IDBObjectStore.prototype.put;
+const nativeGet = IDBObjectStore.prototype.get;
+
+/** What each `add` attempt carried in `data`: blob path or copy path. */
 let attempts: Array<"blob" | "copy"> = [];
+/** The same, for `put` - the rewrite path a lost backing store recovers through. */
+let putAttempts: Array<"blob" | "copy"> = [];
 
 /** An IDBRequest that fails asynchronously, the way WebKit rejects blob puts. */
 class FailingRequest extends EventTarget {
@@ -32,10 +35,7 @@ class FailingRequest extends EventTarget {
   }
 }
 
-/**
- * Record every add attempt, optionally failing the blob-valued ones the way an
- * engine without blob storage does.
- */
+/** Record every add, optionally failing the blob-valued ones. */
 function instrumentAdd(options: { rejectBlobs: boolean }) {
   IDBObjectStore.prototype.add = function (
     this: IDBObjectStore,
@@ -58,11 +58,72 @@ function instrumentAdd(options: { rejectBlobs: boolean }) {
   } as typeof IDBObjectStore.prototype.add;
 }
 
-/**
- * A fresh service per test: whether the engine accepts blobs is remembered for
- * the process lifetime by design, so tests must not inherit that decision from
- * each other.
- */
+/** Record every put, so the copy-rewrite recovery can be observed. */
+function instrumentPut() {
+  IDBObjectStore.prototype.put = function (
+    this: IDBObjectStore,
+    value: unknown,
+    key?: IDBValidKey,
+  ) {
+    putAttempts.push(
+      (value as { data?: unknown } | null)?.data instanceof Blob
+        ? "blob"
+        : "copy",
+    );
+    return key === undefined
+      ? nativePut.call(this, value)
+      : nativePut.call(this, value, key);
+  } as typeof IDBObjectStore.prototype.put;
+}
+
+/** A stored blob whose backing store the engine has lost: it still reports a name,
+ *  type and size, and every read of its bytes fails the way WebKit's does. */
+function blobWithLostBackingStore(): Blob {
+  const lost = () => {
+    throw new DOMException(
+      "The object can not be found here.",
+      "NotFoundError",
+    );
+  };
+  return Object.assign(
+    new Blob(["%PDF-1.7 stirling"], { type: "application/pdf" }),
+    { slice: lost, arrayBuffer: lost, text: lost, stream: lost },
+  );
+}
+
+/** The next `deadReads` reads come back with a lost backing store, later ones
+ *  untouched - so a repaired record can still be read normally. */
+function loseBackingStoreOnRead(deadReads: number) {
+  let remaining = deadReads;
+  IDBObjectStore.prototype.get = function (
+    this: IDBObjectStore,
+    key: IDBValidKey | IDBKeyRange,
+  ) {
+    const request = nativeGet.call(this, key as IDBValidKey);
+    // One substitution per request, however often `result` is read.
+    let injected = false;
+    return new Proxy(request, {
+      get(target, prop) {
+        // Receiver must be the real request: IDBRequest's accessors are branded.
+        const value = Reflect.get(target, prop, target);
+        if (prop !== "result") {
+          return typeof value === "function" ? value.bind(target) : value;
+        }
+        if (!value || injected || remaining === 0) return value;
+        injected = true;
+        remaining--;
+        return { ...(value as object), data: blobWithLostBackingStore() };
+      },
+      set(target, prop, value) {
+        Reflect.set(target, prop, value, target);
+        return true;
+      },
+    });
+  } as typeof IDBObjectStore.prototype.get;
+}
+
+/** A fresh service per test: the blob decision is remembered by design, so
+ *  tests must not inherit it from each other. */
 async function freshFileStorage() {
   vi.resetModules();
   const [{ fileStorage }, { createStirlingFile, createNewStirlingFileStub }] =
@@ -86,10 +147,58 @@ async function freshFileStorage() {
 
 beforeEach(() => {
   attempts = [];
+  putAttempts = [];
+  alertMock.mockClear();
+  // The blob verdict is deliberately durable, so each test must start undecided.
+  localStorage.clear();
 });
 
 afterEach(() => {
   IDBObjectStore.prototype.add = nativeAdd;
+  IDBObjectStore.prototype.put = nativePut;
+  IDBObjectStore.prototype.get = nativeGet;
+});
+
+/** Abort the transaction the moment a write is issued over it. */
+function abortOnPut() {
+  IDBObjectStore.prototype.put = function (this: IDBObjectStore) {
+    const request = new FailingRequest(
+      new DOMException("transaction aborted", "AbortError"),
+    ) as unknown as IDBRequest<IDBValidKey>;
+    this.transaction.abort();
+    return request;
+  } as typeof IDBObjectStore.prototype.put;
+}
+
+describe("read-modify-write — a refused rewrite must not hang or vanish", () => {
+  /** The abort guard used to sit on the read promise, leaving the write with a
+   *  dead reject - and `.catch` can't rescue a promise that never settles. */
+  test("settles instead of hanging when the write transaction aborts", async () => {
+    expectConsole.error(/Failed to mark file as processed/);
+    const { fileStorage, store } = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    const id = await store("aborts.pdf");
+
+    abortOnPut();
+
+    // Before the fix this never settled and the test timed out.
+    await expect(fileStorage.markFileAsProcessed(id)).resolves.toBe(false);
+  });
+
+  /** The copy-and-retry recovery can't be exercised here: it needs a record that
+   *  reads back as a Blob, which fake-indexeddb never returns. */
+  test("a metadata rewrite still commits, and reports commit not put", async () => {
+    const { fileStorage, store } = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    const id = await store("rewrite.pdf");
+
+    await expect(fileStorage.markFileAsProcessed(id)).resolves.toBe(true);
+    // Missing record: `false`, not a throw and not a claim of success.
+    await expect(
+      fileStorage.markFileAsProcessed("nope" as never),
+    ).resolves.toBe(false);
+    expect((await fileStorage.getStirlingFile(id))?.name).toBe("rewrite.pdf");
+  });
 });
 
 describe("storeStirlingFile — blob-value fallback", () => {
@@ -113,8 +222,7 @@ describe("storeStirlingFile — blob-value fallback", () => {
     const id = await store("webkit.pdf");
 
     expect(attempts).toEqual(["blob", "copy"]);
-    // Readable back is what every downstream consumer depends on: rehydration
-    // after navigation, thumbnails, the classification backfill.
+    // Readable back is what rehydration, thumbnails and backfill depend on.
     expect((await fileStorage.getStirlingFile(id))?.name).toBe("webkit.pdf");
   });
 
@@ -127,12 +235,32 @@ describe("storeStirlingFile — blob-value fallback", () => {
     attempts = [];
     const id = await store("second.pdf");
 
-    // Straight to the copy path — no repeated blob probe, and only the single
-    // warning expected above.
+    // Straight to the copy path, and only the one warning expected above.
     expect(attempts).toEqual(["copy"]);
     expect((await fileStorage.getStirlingFile(id))?.name).toBe("second.pdf");
   });
 
+  /** Committing is not evidence the bytes survived, and by the next reload the
+   *  source File is gone: without this the upload looks fine and the file is dead. */
+  test("repairs a record whose stored blob loses its backing store", async () => {
+    expectConsole.warn(/could not read its bytes back/);
+    const { fileStorage, store } = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    instrumentPut();
+    loseBackingStoreOnRead(1); // only the store's own read-back is dead
+
+    const id = await store("dead-on-arrival.pdf");
+
+    // Accepted as a blob, then rewritten from the file still in hand.
+    expect(attempts).toEqual(["blob"]);
+    expect(putAttempts).toEqual(["copy"]);
+    expect((await fileStorage.getStirlingFile(id))?.name).toBe(
+      "dead-on-arrival.pdf",
+    );
+    // Self-healed, so nothing to tell the user about.
+    expect(alertMock).not.toHaveBeenCalled();
+  });
+
   test("does not retry a failure a copy can't fix (quota)", async () => {
     const { store } = await freshFileStorage();
     IDBObjectStore.prototype.add = function (this: IDBObjectStore) {
@@ -144,3 +272,246 @@ describe("storeStirlingFile — blob-value fallback", () => {
     expect(attempts).toEqual(["blob"]);
   });
 });
+
+/** An earlier session's record can't be repaired, and the user has to be told - but
+ *  the telling must never gate the open. Awaiting the probe stalled every file in
+ *  Safari, where the probe read of a lost backing store never settles. */
+describe("reads — a stored blob whose bytes are gone", () => {
+  test("hands the file over and reports the loss out of band", async () => {
+    expectConsole.warn(/could not read its bytes back/);
+    expectConsole.error(/cannot be read/);
+    const { fileStorage, store } = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    const id = await store("lost.pdf");
+
+    loseBackingStoreOnRead(5); // every read from here on
+
+    // Not null, and not awaited on the probe: the caller is never blocked.
+    expect((await fileStorage.getStirlingFile(id))?.name).toBe("lost.pdf");
+    await new Promise((resolve) => setTimeout(resolve));
+
+    // Told once, not once per reader: every consumer of the file hits this record.
+    expect(alertMock).toHaveBeenCalledTimes(1);
+    expect(alertMock.mock.calls[0][0]).toMatchObject({
+      alertType: "warning",
+      body: expect.stringContaining("lost.pdf"),
+    });
+  });
+
+  /** The loop this closes: a reload re-decides optimistically, writes blobs the
+   *  engine loses again, and the browser never settles on a shape that works. */
+  test("remembers across reloads that this browser loses blob values", async () => {
+    expectConsole.warn(/could not read its bytes back/);
+    expectConsole.error(/cannot be read/);
+    const first = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    const id = await first.store("lost.pdf");
+    loseBackingStoreOnRead(1);
+    expect(await first.fileStorage.getStirlingFile(id)).not.toBeNull();
+    await new Promise((resolve) => setTimeout(resolve));
+
+    // A new page load: a fresh service, same browser profile.
+    const next = await freshFileStorage();
+    attempts = [];
+    const later = await next.store("after-reload.pdf");
+
+    expect(attempts).toEqual(["copy"]);
+    expect((await next.fileStorage.getStirlingFile(later))?.name).toBe(
+      "after-reload.pdf",
+    );
+  });
+
+  test("stops offering blob values for the rest of the session", async () => {
+    expectConsole.warn(/could not read its bytes back/);
+    expectConsole.error(/cannot be read/);
+    const { fileStorage, store } = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    const first = await store("lost.pdf");
+
+    loseBackingStoreOnRead(1);
+    expect(await fileStorage.getStirlingFile(first)).not.toBeNull();
+    await new Promise((resolve) => setTimeout(resolve));
+
+    // An engine that loses a blob it accepted can't be trusted with the next one,
+    // so the read failure degrades writes too.
+    attempts = [];
+    const second = await store("later.pdf");
+    expect(attempts).toEqual(["copy"]);
+    expect((await fileStorage.getStirlingFile(second))?.name).toBe("later.pdf");
+  });
+});
+
+/** Deleting a file used to leave its superseded versions in storage forever,
+ *  invisible (listings filter on isLeaf) and still holding their full bytes. */
+describe("orphanedAncestorIds", () => {
+  const store = async (
+    fileStorage: { storeStirlingFile: (f: never, s: never) => Promise<void> },
+    id: string,
+    parentFileId: string | undefined,
+    isLeaf: boolean,
+  ) => {
+    const { createStirlingFile, createNewStirlingFileStub } =
+      await import("@app/types/fileContext");
+    const file = new File(["%PDF-1.7"], `${id}.pdf`, {
+      type: "application/pdf",
+    });
+    const base = createNewStirlingFileStub(file);
+    await fileStorage.storeStirlingFile(
+      createStirlingFile(file, id as never) as never,
+      { ...base, id, isLeaf, parentFileId, originalFileId: "v1" } as never,
+    );
+  };
+
+  test("takes the superseded versions with the leaf", async () => {
+    const { fileStorage } = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    await store(fileStorage as never, "v1", undefined, false);
+    await store(fileStorage as never, "v2", "v1", true);
+
+    expect(await fileStorage.orphanedAncestorIds(["v2" as never])).toEqual([
+      "v1",
+    ]);
+  });
+
+  test("leaves a split sibling's history alone", async () => {
+    const { fileStorage } = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    // Distinct ids: the fake database outlives the module reset between tests.
+    await store(fileStorage as never, "split-root", undefined, false);
+    await store(fileStorage as never, "split-a", "split-root", true);
+    await store(fileStorage as never, "split-b", "split-root", true);
+
+    // `split-b` still descends from the root, so deleting `split-a` can't strip it.
+    expect(await fileStorage.orphanedAncestorIds(["split-a" as never])).toEqual(
+      [],
+    );
+    // Once both leaves go, the shared ancestor is genuinely unreachable.
+    expect(
+      await fileStorage.orphanedAncestorIds([
+        "split-a" as never,
+        "split-b" as never,
+      ]),
+    ).toEqual(["split-root"]);
+  });
+});
+
+/** Handing dead bytes over is only safe if whoever holds them is told to let go -
+ *  otherwise the viewer renders a document that never loads (an endless spinner). */
+describe("confirmed-unreadable records", () => {
+  test("notifies listeners and refuses to hand the same file out twice", async () => {
+    expectConsole.warn(/could not read its bytes back/);
+    expectConsole.error(/cannot be read/);
+    const { fileStorage, store } = await freshFileStorage();
+    const { onRecordUnreadable } = await import("@app/services/fileStorage");
+    instrumentAdd({ rejectBlobs: false });
+    const id = await store("doomed.pdf");
+
+    const dropped: string[] = [];
+    const unsubscribe = onRecordUnreadable((fileId) => dropped.push(fileId));
+
+    loseBackingStoreOnRead(5);
+    // First read still hands the file over: the probe is out of band.
+    expect(await fileStorage.getStirlingFile(id)).not.toBeNull();
+    await new Promise((resolve) => setTimeout(resolve));
+
+    // The holder is told, so the workbench can drop it instead of spinning.
+    expect(dropped).toEqual([id]);
+    // And a second consumer never gets the same dead bytes.
+    expect(await fileStorage.getStirlingFile(id)).toBeNull();
+
+    unsubscribe();
+  });
+});
+
+/** A readable-blob substitute, for the rescue path: fake-indexeddb never returns
+ *  Blob values, so a healthy legacy blob record is injected the same way a dead
+ *  one is. */
+function substituteHealthyBlobOnRead(reads: number) {
+  let remaining = reads;
+  IDBObjectStore.prototype.get = function (
+    this: IDBObjectStore,
+    key: IDBValidKey | IDBKeyRange,
+  ) {
+    const request = nativeGet.call(this, key as IDBValidKey);
+    let injected = false;
+    return new Proxy(request, {
+      get(target, prop) {
+        const value = Reflect.get(target, prop, target);
+        if (prop !== "result") {
+          return typeof value === "function" ? value.bind(target) : value;
+        }
+        if (!value || injected || remaining === 0) return value;
+        injected = true;
+        remaining--;
+        return {
+          ...(value as object),
+          data: new Blob(["%PDF-1.7 stirling"], { type: "application/pdf" }),
+        };
+      },
+      set(target, prop, value) {
+        Reflect.set(target, prop, value, target);
+        return true;
+      },
+    });
+  } as typeof IDBObjectStore.prototype.get;
+}
+
+/** The library must tell the truth per row: a record whose bytes are gone lists
+ *  as data-lost instead of a file that pretends to open. */
+describe("stub listings — data-lost auditing", () => {
+  test("flags a dead record on the stub once the audit lands", async () => {
+    expectConsole.warn(/could not read its bytes back/);
+    expectConsole.error(/cannot be read/);
+    const { fileStorage, store } = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    const id = await store("husk.pdf");
+
+    loseBackingStoreOnRead(1);
+    // First read schedules the out-of-band audit; unknown is not yet flagged.
+    expect(
+      (await fileStorage.getStirlingFileStub(id))?.dataUnavailable,
+    ).toBeUndefined();
+    await new Promise((resolve) => setTimeout(resolve));
+
+    expect((await fileStorage.getStirlingFileStub(id))?.dataUnavailable).toBe(
+      true,
+    );
+  });
+
+  test("rescues a still-readable legacy blob to a copy on a no-blob browser", async () => {
+    // The durable verdict says this browser loses blob values...
+    localStorage.setItem("stirling.indexeddb.blobValuesUnsupported", "true");
+    const { fileStorage, store } = await freshFileStorage();
+    instrumentAdd({ rejectBlobs: false });
+    instrumentPut();
+    const id = await store("legacy.pdf");
+
+    // ...and a legacy record still holds a READABLE blob: save it while we can.
+    substituteHealthyBlobOnRead(5);
+    await fileStorage.getStirlingFileStub(id);
+    await vi.waitFor(() => expect(putAttempts).toContain("copy"));
+    // Rescued, not condemned: the stub stays openable.
+    expect(
+      (await fileStorage.getStirlingFileStub(id))?.dataUnavailable,
+    ).toBeUndefined();
+  });
+});
+
+/** One hung request inside the TTL bump's readwrite transaction wedged the whole
+ *  store: every later read and write queued behind it forever - the infinite
+ *  "Loading files..." after a Safari reload. Maintenance must not touch
+ *  blob-bodied records on a browser that can't rewrite them anyway. */
+describe("maintenanceMayRewrite", () => {
+  test("keeps maintenance away from blob records on a no-blob browser", async () => {
+    const { maintenanceMayRewrite } = await import("@app/services/fileStorage");
+    const blobRecord = { data: new Blob(["x"]) };
+    const copyRecord = { data: new ArrayBuffer(1) };
+
+    expect(maintenanceMayRewrite(blobRecord, false)).toBe(false);
+    // Copies never hang and their rewrite is accepted - always safe.
+    expect(maintenanceMayRewrite(copyRecord, false)).toBe(true);
+    // On engines that genuinely support blobs (Chrome), nothing changes.
+    expect(maintenanceMayRewrite(blobRecord, true)).toBe(true);
+    expect(maintenanceMayRewrite(copyRecord, true)).toBe(true);
+  });
+});
diff --git a/frontend/editor/src/core/services/fileStorage.ts b/frontend/editor/src/core/services/fileStorage.ts
index 40f62642f0..27b8746604 100644
--- a/frontend/editor/src/core/services/fileStorage.ts
+++ b/frontend/editor/src/core/services/fileStorage.ts
@@ -15,6 +15,7 @@ import {
   indexedDBManager,
   DATABASE_CONFIGS,
 } from "@app/services/indexedDBManager";
+import { alert } from "@app/components/toast";
 
 /**
  * Storage record - single source of truth
@@ -75,15 +76,135 @@ function isBlobValueRejection(error: unknown): boolean {
   return name === "UnknownError" || name === "DataCloneError";
 }
 
+/** This engine loses Blob values, remembered per browser: session-scoped, each
+ *  reload re-decides optimistically and writes more files it will lose. */
+const BLOB_VALUES_UNSUPPORTED_KEY = "stirling.indexeddb.blobValuesUnsupported";
+
+function readBlobValuesSupported(): boolean {
+  try {
+    return localStorage.getItem(BLOB_VALUES_UNSUPPORTED_KEY) !== "true";
+  } catch {
+    // Storage unavailable (private mode): decide fresh each session.
+    return true;
+  }
+}
+
+function persistBlobValuesUnsupported(): void {
+  try {
+    localStorage.setItem(BLOB_VALUES_UNSUPPORTED_KEY, "true");
+  } catch {
+    // Storage unavailable: the session-scoped flag still degrades this session.
+  }
+}
+
+/**
+ * Whether maintenance writes (the thumbnail TTL bump) may re-read/re-write this
+ * record. In WebKit, a `get` touching a blob-bodied record whose backing store is
+ * damaged can HANG rather than error - and one pending request wedges the whole
+ * object store: every later transaction, read or write, queues behind it forever.
+ * That was the infinite "Loading files..." after a reload: the TTL bump's
+ * transaction never completed, so nothing else on the store ever ran. On a
+ * browser whose verdict is "blobs unsupported" the rewrite would be refused
+ * anyway, so blob-bodied records are not worth the risk of touching at all.
+ */
+export function maintenanceMayRewrite(
+  record: { data: ArrayBuffer | Blob },
+  blobValuesSupported: boolean,
+): boolean {
+  return !(record.data instanceof Blob) || blobValuesSupported;
+}
+
+/** WebKit loses backing stores for blobs it accepted, and only a real read shows
+ *  it. One byte is enough: what fails is opening the store, not the length. */
+async function blobReadFailure(data: Blob): Promise<unknown> {
+  try {
+    await data.slice(0, 1).arrayBuffer();
+    return null;
+  } catch (error) {
+    return error ?? new Error("Reading a stored blob's bytes failed");
+  }
+}
+
+/** Notified when a record's bytes are proven unreadable, so whoever is holding the
+ *  file can drop it instead of rendering a document that never arrives. */
+const unreadableListeners = new Set<(fileId: FileId) => void>();
+
+export function onRecordUnreadable(
+  listener: (fileId: FileId) => void,
+): () => void {
+  unreadableListeners.add(listener);
+  return () => unreadableListeners.delete(listener);
+}
+
+/** The probe read itself can hang in WebKit, so anything that awaits it needs a
+ *  deadline. Distinct from a failure: nothing was proven either way. */
+const PROBE_UNANSWERED = { unanswered: true } as const;
+const PROBE_DEADLINE_MS = 3000;
+
+function withProbeDeadline(
+  probe: Promise<unknown>,
+): Promise<unknown | typeof PROBE_UNANSWERED> {
+  return Promise.race([
+    probe,
+    new Promise<typeof PROBE_UNANSWERED>((resolve) =>
+      setTimeout(() => resolve(PROBE_UNANSWERED), PROBE_DEADLINE_MS),
+    ),
+  ]);
+}
+
+/**
+ * The File for a stored record. Re-wrapping a stored blob can cost WebKit the
+ * backing handle, so hand it back untouched when its identity fields match.
+ */
+function fileFromRecord(record: StoredStirlingFileRecord): File {
+  const { data } = record;
+  if (
+    data instanceof File &&
+    data.name === record.name &&
+    data.type === record.type &&
+    data.lastModified === record.lastModified
+  ) {
+    return data;
+  }
+  return new File([data], record.name, {
+    type: record.type,
+    lastModified: record.lastModified,
+  });
+}
+
+/**
+ * Settle on abort, for promises whose settle paths (a cursor tick, a request not
+ * yet issued) never arrive. Call ONCE per transaction - there is one slot.
+ */
+function settleOnAbort(
+  transaction: IDBTransaction,
+  settle: (reason: Error) => void,
+): void {
+  transaction.onabort = () =>
+    settle(
+      transaction.error ??
+        new Error("IndexedDB transaction aborted before it completed"),
+    );
+}
+
 class FileStorageService {
   private readonly dbConfig = DATABASE_CONFIGS.FILES;
   private readonly storeName = "files";
-  /**
-   * Whether this engine accepts Blob/File values in IndexedDB. Optimistic: the
-   * blob path avoids copying multi-GB files into JS memory, so we try it and
-   * remember the answer, rather than pre-emptively degrading everywhere.
-   */
-  private blobValuesSupported = true;
+  /** Whether this engine takes Blob/File values, which avoid copying multi-GB
+   *  files into JS memory. Optimistic; a No outlives the session (see the key). */
+  private blobValuesSupported = readBlobValuesSupported();
+  /** Whether a stored blob's bytes have come back yet. Until they have, each
+   *  store proves it: accepting the write is no evidence the bytes survived. */
+  private blobReadbackVerified = false;
+  /** Ids whose TTL write failed. Without this the swallowed failure repeats a
+   *  whole-file rewrite on every listing. Session-scoped on purpose. */
+  private readonly unwritableRecords = new Set<FileId>();
+  /** Ids already reported as unreadable, so one dead record is surfaced once
+   *  rather than on every read of it. Session-scoped on purpose. */
+  private readonly unreadableRecords = new Set<FileId>();
+  /** Ids whose blob bytes this session has already audited (either way), so
+   *  listings don't re-probe every record on every refresh. */
+  private readonly auditedRecords = new Set<FileId>();
 
   /**
    * Get database connection using centralized manager
@@ -101,7 +222,8 @@ class FileStorageService {
 
   /** Fire-and-forget: bump thumbnailStoredAt (or clear expired thumbnail) for a set of ids. */
   private async bumpThumbnailTTL(ids: FileId[], clear = false): Promise<void> {
-    if (ids.length === 0) return;
+    const targets = ids.filter((id) => !this.unwritableRecords.has(id));
+    if (targets.length === 0) return;
     const db = await this.getDatabase();
     return new Promise((resolve, reject) => {
       const transaction = db.transaction([this.storeName], "readwrite");
@@ -112,7 +234,7 @@ class FileStorageService {
 
       // Issue all gets up front - each onsuccess creates a put before the
       // transaction can auto-commit, keeping it alive until all puts settle.
-      ids.forEach((id) => {
+      targets.forEach((id) => {
         const req = store.get(id);
         req.onsuccess = () => {
           const record = req.result as StoredStirlingFileRecord | undefined;
@@ -123,7 +245,30 @@ class FileStorageService {
           } else {
             record.thumbnailStoredAt = Date.now();
           }
-          store.put(record);
+          // One unwritable record must not take the batch with it: a rejected
+          // put aborts the transaction the other queued gets are still using.
+          try {
+            const put = store.put(record);
+            put.onerror = (event) => {
+              // The write we just swallowed is the one that would have taken
+              // this record out of the expiring set, so stop retrying it.
+              this.unwritableRecords.add(id);
+              this.noteBlobRefusal(put.error);
+              console.warn(
+                `[fileStorage] thumbnail TTL bump skipped for ${id}:`,
+                put.error,
+              );
+              // Swallow it here so the failure doesn't abort the transaction.
+              event.preventDefault();
+              event.stopPropagation();
+            };
+          } catch (error) {
+            this.unwritableRecords.add(id);
+            console.warn(
+              `[fileStorage] thumbnail TTL bump could not be issued for ${id}:`,
+              error,
+            );
+          }
         };
         req.onerror = () => reject(req.error);
       });
@@ -186,18 +331,255 @@ class FileStorageService {
     } catch (error) {
       // Recoverable: re-add as a copy, and stop offering blobs this session.
       // Anything else is the caller's to report.
-      if (!(record.data instanceof Blob) || !isBlobValueRejection(error)) {
+      if (!(record.data instanceof Blob) || !this.noteBlobRefusal(error)) {
         throw error;
       }
-      this.blobValuesSupported = false;
-      console.warn(
-        "IndexedDB rejected a Blob value; falling back to in-memory copies for this session. " +
-          "Very large files may now exhaust renderer memory.",
-        error,
-      );
       record.data = await record.data.arrayBuffer();
       await this.addFileRecord(db, record);
+      return;
     }
+
+    // Committed is not retrievable. Prove the round-trip while the source File is
+    // still in hand; after a reload there is nothing left to repair from.
+    if (record.data instanceof Blob && !this.blobReadbackVerified) {
+      await this.verifyStoredBlobReadable(db, record, stirlingFile);
+    }
+  }
+
+  /** Read one stored blob back, rewriting the record from {@code source} if its
+   *  bytes don't come with it. Runs until one round-trip succeeds. */
+  private async verifyStoredBlobReadable(
+    db: IDBDatabase,
+    record: StoredStirlingFileRecord,
+    source: File,
+  ): Promise<void> {
+    // A record we can't read back at all is the caller's problem, not the probe's.
+    const stored = await this.readRecord(db, record.id).catch(() => undefined);
+    if (!(stored?.data instanceof Blob)) return;
+
+    const failure = await withProbeDeadline(blobReadFailure(stored.data));
+    if (!failure) {
+      this.blobReadbackVerified = true;
+      return;
+    }
+    if (failure === PROBE_UNANSWERED) {
+      // Nothing proven, and an upload must never wait on a probe. Leave the record
+      // as written; the read path reports it if the bytes really are gone.
+      console.warn(
+        `[fileStorage] readability probe for ${record.id} did not answer in ${PROBE_DEADLINE_MS}ms`,
+      );
+      return;
+    }
+
+    this.noteBlobUnreadable(failure);
+    try {
+      record.data = await source.arrayBuffer();
+      await this.putRecord(db, record);
+    } catch (error) {
+      // The record is unusable either way, and the read path reports that to the
+      // user. Don't turn a write that already committed into a failure.
+      console.warn(
+        `[fileStorage] could not rewrite ${record.id} as an in-memory copy:`,
+        error,
+      );
+    }
+  }
+
+  /** Refused a Blob value? Stop offering blobs on this browser. Any write can flip
+   *  this: WebKit refuses per-operation, not per-engine. */
+  private noteBlobRefusal(error: unknown): boolean {
+    if (!isBlobValueRejection(error)) return false;
+    this.disableBlobValues(
+      "IndexedDB rejected a Blob value; falling back to in-memory copies on this browser. " +
+        "Very large files may now exhaust renderer memory.",
+      error,
+    );
+    return true;
+  }
+
+  /** A stored blob whose bytes won't read back means blob values can't be trusted
+   *  on this engine either, even though it accepted the write. */
+  private noteBlobUnreadable(error: unknown): void {
+    this.disableBlobValues(
+      "IndexedDB accepted a Blob value but could not read its bytes back; " +
+        "falling back to in-memory copies on this browser. " +
+        "Very large files may now exhaust renderer memory.",
+      error,
+    );
+  }
+
+  private disableBlobValues(message: string, error: unknown): void {
+    if (!this.blobValuesSupported) return;
+    this.blobValuesSupported = false;
+    persistBlobValuesUnsupported();
+    console.warn(message, error);
+  }
+
+  /**
+   * Audit a blob-backed record's bytes WITHOUT gating anything on the answer.
+   * Awaiting this was a mistake: in Safari the probe read of a lost backing store
+   * can stay pending forever, so it stalled every file open instead of the one
+   * consumer that would have failed anyway.
+   *
+   * Two outcomes, both out of band:
+   * - Bytes gone: mark + report, so the library shows "data lost" instead of a
+   *   file that pretends to open.
+   * - Bytes readable on a browser whose verdict is "blobs unsupported": RESCUE the
+   *   record to an ArrayBuffer copy now, while the bytes still exist. Legacy blob
+   *   records on WebKit are one engine hiccup away from being lost for good.
+   */
+  private reportIfUnreadable(record: StoredStirlingFileRecord): void {
+    if (!(record.data instanceof Blob)) return;
+    if (this.auditedRecords.has(record.id)) return;
+    this.auditedRecords.add(record.id);
+    void blobReadFailure(record.data).then((failure) => {
+      if (!failure) {
+        this.blobReadbackVerified = true;
+        if (!this.blobValuesSupported) void this.rescueBlobRecord(record.id);
+        return;
+      }
+      this.noteBlobUnreadable(failure);
+      this.reportUnreadableRecord(record, failure);
+    });
+  }
+
+  /**
+   * Rewrite one still-readable legacy blob record as an ArrayBuffer copy. Reads
+   * the FULL bytes (the audit only proved the first one) and goes through
+   * {@link updateRecord}'s read-modify-write so a concurrent metadata update
+   * isn't clobbered by a stale snapshot.
+   */
+  private async rescueBlobRecord(fileId: FileId): Promise<void> {
+    try {
+      const db = await this.getDatabase();
+      const record = await this.readRecord(db, fileId);
+      if (!(record?.data instanceof Blob)) return;
+      const bytes = await withProbeDeadline(record.data.arrayBuffer());
+      if (bytes === PROBE_UNANSWERED || !(bytes instanceof ArrayBuffer)) return;
+      record.data = bytes;
+      await this.putRecord(db, record);
+      console.info(
+        `[fileStorage] rescued "${record.name}" (${fileId}) to an in-memory copy before this browser could lose its blob`,
+      );
+    } catch (error) {
+      // Best-effort: a failed rescue leaves the record exactly as it was.
+      console.warn(`[fileStorage] could not rescue ${fileId}:`, error);
+    }
+  }
+
+  /** One console error and one toast per dead record: every consumer of the file
+   *  hits the same record, and the user needs the reason once, not per reader. */
+  private reportUnreadableRecord(
+    record: StoredStirlingFileRecord,
+    failure: unknown,
+  ): void {
+    if (this.unreadableRecords.has(record.id)) return;
+    this.unreadableRecords.add(record.id);
+    // Whoever is holding it needs to let go, or the viewer renders a document
+    // whose bytes never arrive - a spinner with no terminal state.
+    for (const listener of unreadableListeners) listener(record.id);
+    console.error(
+      `[fileStorage] stored data for "${record.name}" (${record.id}) cannot be read; ` +
+        "the browser no longer has the blob's backing store",
+      failure,
+    );
+    alert({
+      alertType: "warning",
+      title: "File data is unavailable",
+      body:
+        `"${record.name}" is saved in this browser but its contents can no longer be read. ` +
+        "Upload the file again to keep working on it.",
+      expandable: false,
+      durationMs: 8000,
+    });
+  }
+
+  /** Read-modify-write one record in one transaction, resolving on COMMIT. Split
+   *  across two promises, the abort guard covers one and the other hangs. */
+  private async updateRecord(
+    fileId: FileId,
+    mutate: (record: StoredStirlingFileRecord) => boolean | void,
+  ): Promise<boolean> {
+    const db = await this.getDatabase();
+    try {
+      return await this.readModifyWrite(db, fileId, mutate);
+    } catch (error) {
+      // The record we read back still carries its Blob body; retry as a copy.
+      if (!this.noteBlobRefusal(error)) throw error;
+      return await this.rewriteRecordAsCopy(db, fileId, mutate);
+    }
+  }
+
+  /** {@link updateRecord}'s happy path: one transaction, resolve on commit. */
+  private readModifyWrite(
+    db: IDBDatabase,
+    fileId: FileId,
+    mutate: (record: StoredStirlingFileRecord) => boolean | void,
+  ): Promise<boolean> {
+    return new Promise((resolve, reject) => {
+      const transaction = db.transaction([this.storeName], "readwrite");
+      let written = false;
+      settleOnAbort(transaction, reject);
+      transaction.onerror = () => reject(transaction.error);
+      transaction.oncomplete = () => resolve(written);
+
+      const store = transaction.objectStore(this.storeName);
+      const getRequest = store.get(fileId);
+      getRequest.onerror = () => reject(getRequest.error);
+      getRequest.onsuccess = () => {
+        const record = getRequest.result as
+          | StoredStirlingFileRecord
+          | undefined;
+        // Nothing to write: let the empty transaction commit and report false.
+        if (!record || mutate(record) === false) return;
+        written = true;
+        store.put(record);
+      };
+    });
+  }
+
+  /** Recovery path: two transactions, because materializing the copy is async
+   *  and a transaction cannot survive an await. Last-write-wins either way. */
+  private async rewriteRecordAsCopy(
+    db: IDBDatabase,
+    fileId: FileId,
+    mutate: (record: StoredStirlingFileRecord) => boolean | void,
+  ): Promise<boolean> {
+    const record = await this.readRecord(db, fileId);
+    if (!record || mutate(record) === false) return false;
+    if (record.data instanceof Blob) {
+      record.data = await record.data.arrayBuffer();
+    }
+    await this.putRecord(db, record);
+    return true;
+  }
+
+  /** One record by id, in its own transaction. */
+  private readRecord(
+    db: IDBDatabase,
+    fileId: FileId,
+  ): Promise<StoredStirlingFileRecord | undefined> {
+    return new Promise((resolve, reject) => {
+      const transaction = db.transaction([this.storeName], "readonly");
+      settleOnAbort(transaction, reject);
+      const request = transaction.objectStore(this.storeName).get(fileId);
+      request.onerror = () => reject(request.error);
+      request.onsuccess = () => resolve(request.result);
+    });
+  }
+
+  /** One `put`, resolving on commit. */
+  private putRecord(
+    db: IDBDatabase,
+    record: StoredStirlingFileRecord,
+  ): Promise<void> {
+    return new Promise((resolve, reject) => {
+      const transaction = db.transaction([this.storeName], "readwrite");
+      settleOnAbort(transaction, reject);
+      transaction.onerror = () => reject(transaction.error);
+      transaction.oncomplete = () => resolve();
+      transaction.objectStore(this.storeName).put(record);
+    });
   }
 
   /** Single `add` of a file record. Rejects with the underlying IDB error. */
@@ -215,6 +597,7 @@ class FileStorageService {
         }
 
         const transaction = db.transaction([this.storeName], "readwrite");
+        settleOnAbort(transaction, reject);
         const store = transaction.objectStore(this.storeName);
 
         const request = store.add(record);
@@ -227,37 +610,21 @@ class FileStorageService {
     });
   }
 
-  /**
-   * Get StirlingFile with full data - for loading into workbench
-   */
+  /** Get StirlingFile with full data - for loading into workbench. Null covers
+   *  both no such record and bytes gone; neither is a file callers can use. */
   async getStirlingFile(id: FileId): Promise<StirlingFile | null> {
+    // Already proven unreadable this session: don't hand the same dead bytes to
+    // another consumer that will spin on them. Session-scoped, so a reload retries.
+    if (this.unreadableRecords.has(id)) return null;
     const db = await this.getDatabase();
+    const record = await this.readRecord(db, id);
+    if (!record) return null;
+    // Reporting only, and NEVER awaited: WebKit can leave a read of a lost backing
+    // store pending forever, and this is the path every file open goes through.
+    this.reportIfUnreadable(record);
 
-    return new Promise((resolve, reject) => {
-      const transaction = db.transaction([this.storeName], "readonly");
-      const store = transaction.objectStore(this.storeName);
-      const request = store.get(id);
-
-      request.onerror = () => reject(request.error);
-      request.onsuccess = () => {
-        const record = request.result as StoredStirlingFileRecord | undefined;
-        if (!record) {
-          resolve(null);
-          return;
-        }
-
-        // Create File from stored data
-        const blob = new Blob([record.data], { type: record.type });
-        const file = new File([blob], record.name, {
-          type: record.type,
-          lastModified: record.lastModified,
-        });
-
-        // Convert to StirlingFile with preserved IDs
-        const stirlingFile = createStirlingFile(file, record.fileId);
-        resolve(stirlingFile);
-      };
-    });
+    // Convert to StirlingFile with preserved IDs
+    return createStirlingFile(fileFromRecord(record), record.fileId);
   }
 
   /**
@@ -278,6 +645,7 @@ class FileStorageService {
 
     return new Promise((resolve, reject) => {
       const transaction = db.transaction([this.storeName], "readonly");
+      settleOnAbort(transaction, reject);
       const store = transaction.objectStore(this.storeName);
       const request = store.get(id);
 
@@ -295,9 +663,13 @@ class FileStorageService {
         // We still gate thumbnailUrl on freshness so stale thumbnails
         // don't leak through this read path.
         const fresh = this.isThumbnailFresh(record);
+        // Out-of-band byte audit, so the library reflects lost data (and rescues
+        // still-readable legacy blobs) instead of listing files that can't open.
+        this.reportIfUnreadable(record);
 
         const stub: StirlingFileStub = {
           id: record.id,
+          dataUnavailable: this.unreadableRecords.has(record.id) || undefined,
           name: record.name,
           type: record.type,
           size: record.size,
@@ -338,6 +710,7 @@ class FileStorageService {
 
     return new Promise((resolve, reject) => {
       const transaction = db.transaction([this.storeName], "readonly");
+      settleOnAbort(transaction, reject);
       const store = transaction.objectStore(this.storeName);
       const request = store.openCursor();
       const stubs: StirlingFileStub[] = [];
@@ -352,12 +725,18 @@ class FileStorageService {
           const record = cursor.value as StoredStirlingFileRecord;
           if (record && record.name && typeof record.size === "number") {
             const fresh = this.isThumbnailFresh(record);
-            if (record.thumbnail) {
+            if (
+              record.thumbnail &&
+              maintenanceMayRewrite(record, this.blobValuesSupported)
+            ) {
               if (fresh) tobump.push(record.id);
               else toexpire.push(record.id);
             }
+            this.reportIfUnreadable(record);
             stubs.push({
               id: record.id,
+              dataUnavailable:
+                this.unreadableRecords.has(record.id) || undefined,
               name: record.name,
               type: record.type,
               size: record.size,
@@ -425,6 +804,7 @@ class FileStorageService {
 
     return new Promise((resolve, reject) => {
       const transaction = db.transaction([this.storeName], "readonly");
+      settleOnAbort(transaction, reject);
       const store = transaction.objectStore(this.storeName);
       const request = store.openCursor();
       const leafStubs: StirlingFileStub[] = [];
@@ -444,12 +824,18 @@ class FileStorageService {
             record.isLeaf !== false
           ) {
             const fresh = this.isThumbnailFresh(record);
-            if (record.thumbnail) {
+            if (
+              record.thumbnail &&
+              maintenanceMayRewrite(record, this.blobValuesSupported)
+            ) {
               if (fresh) tobump.push(record.id);
               else toexpire.push(record.id);
             }
+            this.reportIfUnreadable(record);
             leafStubs.push({
               id: record.id,
+              dataUnavailable:
+                this.unreadableRecords.has(record.id) || undefined,
               name: record.name,
               type: record.type,
               size: record.size,
@@ -579,6 +965,46 @@ class FileStorageService {
     return cleared;
   }
 
+  /**
+   * Superseded versions that nothing else needs once {@code deleting} goes.
+   *
+   * Deleting a file removes one record; its older versions keep their full bytes
+   * and are invisible (listings filter on isLeaf), so they accumulate forever.
+   * Only for user-facing "delete this file" - deleting ONE version from the
+   * history journey must leave the rest of the chain alone.
+   */
+  async orphanedAncestorIds(deleting: FileId[]): Promise<FileId[]> {
+    if (deleting.length === 0) return [];
+    const stubs = await this.getAllStirlingFileStubs();
+    const byId = new Map(stubs.map((s) => [s.id as string, s]));
+    const doomed = new Set(deleting.map(String));
+
+    // Anything a surviving record descends from has to stay: split siblings
+    // share a lineage, so one leaf's delete must not strip another's history.
+    const keep = new Set<string>();
+    for (const stub of stubs) {
+      if (doomed.has(stub.id as string)) continue;
+      let cursor = stub.parentFileId as string | undefined;
+      while (cursor && !keep.has(cursor)) {
+        keep.add(cursor);
+        cursor = byId.get(cursor)?.parentFileId as string | undefined;
+      }
+    }
+
+    const orphans: FileId[] = [];
+    for (const id of deleting) {
+      let cursor = byId.get(String(id))?.parentFileId as string | undefined;
+      while (cursor) {
+        if (!keep.has(cursor) && !doomed.has(cursor) && byId.has(cursor)) {
+          doomed.add(cursor);
+          orphans.push(cursor as FileId);
+        }
+        cursor = byId.get(cursor)?.parentFileId as string | undefined;
+      }
+    }
+    return orphans;
+  }
+
   /**
    * Delete StirlingFile - single operation, no sync issues
    */
@@ -587,11 +1013,12 @@ class FileStorageService {
 
     return new Promise((resolve, reject) => {
       const transaction = db.transaction([this.storeName], "readwrite");
-      const store = transaction.objectStore(this.storeName);
-      const request = store.delete(id);
-
-      request.onerror = () => reject(request.error);
-      request.onsuccess = () => resolve();
+      // On commit, not on the request: callers refresh their list from storage as
+      // soon as this resolves, and an aborted delete would put the row back.
+      settleOnAbort(transaction, reject);
+      transaction.onerror = () => reject(transaction.error);
+      transaction.oncomplete = () => resolve();
+      transaction.objectStore(this.storeName).delete(id);
     });
   }
 
@@ -617,45 +1044,16 @@ class FileStorageService {
    * Update thumbnail for existing file
    */
   async updateThumbnail(id: FileId, thumbnail: string): Promise<boolean> {
-    const db = await this.getDatabase();
-
-    return new Promise((resolve, _reject) => {
-      try {
-        const transaction = db.transaction([this.storeName], "readwrite");
-        const store = transaction.objectStore(this.storeName);
-        const getRequest = store.get(id);
-
-        getRequest.onsuccess = () => {
-          const record = getRequest.result as StoredStirlingFileRecord;
-          if (record) {
-            record.thumbnail = thumbnail;
-            record.thumbnailStoredAt = Date.now();
-            const updateRequest = store.put(record);
-
-            updateRequest.onsuccess = () => {
-              resolve(true);
-            };
-            updateRequest.onerror = () => {
-              console.error("Failed to update thumbnail:", updateRequest.error);
-              resolve(false);
-            };
-          } else {
-            resolve(false);
-          }
-        };
-
-        getRequest.onerror = () => {
-          console.error(
-            "Failed to get file for thumbnail update:",
-            getRequest.error,
-          );
-          resolve(false);
-        };
-      } catch (error) {
-        console.error("Transaction error during thumbnail update:", error);
-        resolve(false);
-      }
-    });
+    // Reports failure as `false` rather than rejecting; callers just need an answer.
+    try {
+      return await this.updateRecord(id, (record) => {
+        record.thumbnail = thumbnail;
+        record.thumbnailStoredAt = Date.now();
+      });
+    } catch (error) {
+      console.error("Failed to update thumbnail:", error);
+      return false;
+    }
   }
 
   /**
@@ -666,6 +1064,7 @@ class FileStorageService {
 
     return new Promise((resolve, reject) => {
       const transaction = db.transaction([this.storeName], "readwrite");
+      settleOnAbort(transaction, reject);
       const store = transaction.objectStore(this.storeName);
       const request = store.clear();
 
@@ -720,24 +1119,16 @@ class FileStorageService {
   async createBlobUrl(id: FileId): Promise<string | null> {
     try {
       const db = await this.getDatabase();
+      const record = await this.readRecord(db, id);
+      if (!record) return null;
 
-      return new Promise((resolve, reject) => {
-        const transaction = db.transaction([this.storeName], "readonly");
-        const store = transaction.objectStore(this.storeName);
-        const request = store.get(id);
-
-        request.onerror = () => reject(request.error);
-        request.onsuccess = () => {
-          const record = request.result as StoredStirlingFileRecord | undefined;
-          if (record) {
-            const blob = new Blob([record.data], { type: record.type });
-            const url = URL.createObjectURL(blob);
-            resolve(url);
-          } else {
-            resolve(null);
-          }
-        };
-      });
+      // Stored blobs are handed straight to createObjectURL — re-wrapping
+      // one can cost WebKit the backing handle. See fileFromRecord.
+      const blob =
+        record.data instanceof Blob
+          ? record.data
+          : new Blob([record.data], { type: record.type });
+      return URL.createObjectURL(blob);
     } catch (error) {
       console.warn(`Failed to create blob URL for ${id}:`, error);
       return null;
@@ -750,32 +1141,9 @@ class FileStorageService {
    */
   async markFileAsProcessed(fileId: FileId): Promise<boolean> {
     try {
-      const db = await this.getDatabase();
-      const transaction = db.transaction([this.storeName], "readwrite");
-      const store = transaction.objectStore(this.storeName);
-
-      const record = await new Promise<StoredStirlingFileRecord | undefined>(
-        (resolve, reject) => {
-          const request = store.get(fileId);
-          request.onsuccess = () => resolve(request.result);
-          request.onerror = () => reject(request.error);
-        },
-      );
-
-      if (!record) {
-        return false; // File not found
-      }
-
-      // Update the isLeaf flag to false
-      record.isLeaf = false;
-
-      await new Promise<void>((resolve, reject) => {
-        const request = store.put(record);
-        request.onsuccess = () => resolve();
-        request.onerror = () => reject(request.error);
+      return await this.updateRecord(fileId, (record) => {
+        record.isLeaf = false;
       });
-
-      return true;
     } catch (error) {
       console.error("Failed to mark file as processed:", error);
       return false;
@@ -835,32 +1203,9 @@ class FileStorageService {
    */
   async markFileAsLeaf(fileId: FileId): Promise<boolean> {
     try {
-      const db = await this.getDatabase();
-      const transaction = db.transaction([this.storeName], "readwrite");
-      const store = transaction.objectStore(this.storeName);
-
-      const record = await new Promise<StoredStirlingFileRecord | undefined>(
-        (resolve, reject) => {
-          const request = store.get(fileId);
-          request.onsuccess = () => resolve(request.result);
-          request.onerror = () => reject(request.error);
-        },
-      );
-
-      if (!record) {
-        return false; // File not found
-      }
-
-      // Update the isLeaf flag to true
-      record.isLeaf = true;
-
-      await new Promise<void>((resolve, reject) => {
-        const request = store.put(record);
-        request.onsuccess = () => resolve();
-        request.onerror = () => reject(request.error);
+      return await this.updateRecord(fileId, (record) => {
+        record.isLeaf = true;
       });
-
-      return true;
     } catch (error) {
       console.error("Failed to mark file as leaf:", error);
       return false;
@@ -870,41 +1215,16 @@ class FileStorageService {
   /**
    * Update metadata fields for a stored file record.
    *
-   * Resolves on transaction.oncomplete, NOT on the individual put's onsuccess,
-   * so callers only receive `true` once the write actually commits. If the
-   * transaction aborts after put() succeeded but before commit, we return false
-   * - the previous behavior incorrectly claimed success in that window.
+   * Returns `true` only once the write commits, never on the put's `onsuccess`.
+   * {@link updateRecord} owns that guarantee for every write in this class.
    */
   async updateFileMetadata(
     fileId: FileId,
     updates: Partial<StoredStirlingFileRecord>,
   ): Promise<boolean> {
     try {
-      const db = await this.getDatabase();
-      return await new Promise<boolean>((resolve, reject) => {
-        const transaction = db.transaction([this.storeName], "readwrite");
-        const store = transaction.objectStore(this.storeName);
-        let recordFound = false;
-
-        const getRequest = store.get(fileId);
-        getRequest.onsuccess = () => {
-          const record = getRequest.result as
-            | StoredStirlingFileRecord
-            | undefined;
-          if (!record) {
-            // Don't commit anything; caller wants false.
-            return;
-          }
-          recordFound = true;
-          const updatedRecord = { ...record, ...updates };
-          store.put(updatedRecord);
-        };
-        getRequest.onerror = () => reject(getRequest.error);
-
-        transaction.oncomplete = () => resolve(recordFound);
-        transaction.onerror = () => reject(transaction.error);
-        transaction.onabort = () =>
-          reject(transaction.error ?? new Error("updateFileMetadata aborted"));
+      return await this.updateRecord(fileId, (record) => {
+        Object.assign(record, updates);
       });
     } catch (error) {
       console.error("Failed to update file metadata:", error);
diff --git a/frontend/editor/src/core/services/httpErrorHandler.ts b/frontend/editor/src/core/services/httpErrorHandler.ts
index ed7108b6a6..55b0a425f9 100644
--- a/frontend/editor/src/core/services/httpErrorHandler.ts
+++ b/frontend/editor/src/core/services/httpErrorHandler.ts
@@ -1,4 +1,4 @@
-// frontend/src/services/httpErrorHandler.ts
+// frontend/editor/src/core/services/httpErrorHandler.ts
 import { alert } from "@app/components/toast";
 import {
   broadcastErroredFiles,
diff --git a/frontend/editor/src/core/services/indexedDBManager.blocked.test.ts b/frontend/editor/src/core/services/indexedDBManager.blocked.test.ts
new file mode 100644
index 0000000000..9031b079bb
--- /dev/null
+++ b/frontend/editor/src/core/services/indexedDBManager.blocked.test.ts
@@ -0,0 +1,79 @@
+import { afterEach, describe, expect, test, vi } from "vitest";
+import "fake-indexeddb/auto";
+import { expectConsole } from "@app/tests/failOnConsole";
+import type { DatabaseConfig } from "@app/services/indexedDBManager";
+
+/**
+ * A blocked open fires `blocked` and then nothing at all - no success, no error -
+ * until the other connection goes away. Unguarded, the open promise never settles
+ * and every caller hangs SILENTLY: the file library spun forever with an empty
+ * console, which is why this kept being reported as unreproducible.
+ */
+
+const config = (name: string, version: number): DatabaseConfig => ({
+  name,
+  version,
+  stores: [{ name: "things", keyPath: "id" }],
+});
+
+/** A raw connection on an older version that never yields, i.e. the other tab. */
+function holdOlderVersion(name: string): Promise<IDBDatabase> {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(name, 1);
+    request.onupgradeneeded = () => {
+      if (!request.result.objectStoreNames.contains("things")) {
+        request.result.createObjectStore("things", { keyPath: "id" });
+      }
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error);
+  });
+}
+
+afterEach(() => {
+  vi.useRealTimers();
+  vi.resetModules();
+});
+
+describe("openDatabase — blocked by another connection", () => {
+  test("rejects with something actionable instead of hanging", async () => {
+    expectConsole.warn(/blocked by another connection/);
+    const { indexedDBManager } = await import("@app/services/indexedDBManager");
+    const held = await holdOlderVersion("blocked-db");
+
+    vi.useFakeTimers();
+    const open = indexedDBManager.openDatabase(config("blocked-db", 2));
+    const settled = vi.fn();
+    void open.then(settled, settled);
+
+    // Still pending before the grace period is up: a tab that yields quickly
+    // must not be failed prematurely.
+    await vi.advanceTimersByTimeAsync(4_000);
+    expect(settled).not.toHaveBeenCalled();
+
+    await vi.advanceTimersByTimeAsync(2_000);
+    await expect(open).rejects.toThrow(/blocked by another connection/);
+
+    held.close();
+  });
+
+  test("dedupes concurrent callers onto one connection", async () => {
+    const { indexedDBManager } = await import("@app/services/indexedDBManager");
+    const spy = vi.spyOn(indexedDB, "open");
+
+    // Racing in the same tick is the case registration-after-await could not
+    // dedupe, and only the first request would ever receive `blocked`.
+    const [a, b, c] = await Promise.all([
+      indexedDBManager.openDatabase(config("shared-db", 1)),
+      indexedDBManager.openDatabase(config("shared-db", 1)),
+      indexedDBManager.openDatabase(config("shared-db", 1)),
+    ]);
+
+    expect(a).toBe(b);
+    expect(b).toBe(c);
+    expect(
+      spy.mock.calls.filter(([name]) => name === "shared-db"),
+    ).toHaveLength(1);
+    spy.mockRestore();
+  });
+});
diff --git a/frontend/editor/src/core/services/indexedDBManager.ts b/frontend/editor/src/core/services/indexedDBManager.ts
index 043b2e4386..dd823a2bd9 100644
--- a/frontend/editor/src/core/services/indexedDBManager.ts
+++ b/frontend/editor/src/core/services/indexedDBManager.ts
@@ -19,6 +19,11 @@ export interface DatabaseConfig {
   }[];
 }
 
+/** How long to wait out another connection before failing an open with something
+ *  the user can act on. Rejecting does NOT cancel the request, so a connection
+ *  that arrives later is closed rather than held. */
+const BLOCKED_GRACE_MS = 5000;
+
 class IndexedDBManager {
   private static instance: IndexedDBManager;
   private databases = new Map<string, IDBDatabase>();
@@ -47,6 +52,26 @@ class IndexedDBManager {
       return existingPromise;
     }
 
+    // Registered BEFORE anything async. A map written after a yield point can't
+    // dedupe callers racing into it in the same tick, so every context that opened
+    // this database during boot got its own connection - and per spec only the
+    // FIRST request ever receives `blocked`, leaving the rest waiting on an event
+    // that never comes.
+    const initPromise = this.openWithRecovery(config);
+    this.initPromises.set(config.name, initPromise);
+
+    try {
+      const db = await initPromise;
+      this.databases.set(config.name, db);
+      return db;
+    } catch (error) {
+      this.initPromises.delete(config.name);
+      throw error;
+    }
+  }
+
+  /** The v6/v7 wipe, kept off {@link openDatabase}'s synchronous registration path. */
+  private async openWithRecovery(config: DatabaseConfig): Promise<IDBDatabase> {
     // SaaS lineage shipped a v6 and a v7 of stirling-pdf-files whose
     // upgrade paths corrupted records (separate cursor walks racing in
     // one versionchange transaction). The SaaS build wipes those
@@ -64,18 +89,7 @@ class IndexedDBManager {
         await this.deleteDatabase(config.name);
       }
     }
-
-    const initPromise = this.performDatabaseInit(config);
-    this.initPromises.set(config.name, initPromise);
-
-    try {
-      const db = await initPromise;
-      this.databases.set(config.name, db);
-      return db;
-    } catch (error) {
-      this.initPromises.delete(config.name);
-      throw error;
-    }
+    return this.performDatabaseInit(config);
   }
 
   private performDatabaseInit(config: DatabaseConfig): Promise<IDBDatabase> {
@@ -83,15 +97,60 @@ class IndexedDBManager {
       console.log(`Opening IndexedDB: ${config.name} v${config.version}`);
       const request = indexedDB.open(config.name, config.version);
 
+      // A blocked upgrade fires `blocked` and then NOTHING - no success, no error -
+      // until the other connection goes away. Unguarded, the promise never settles
+      // and every awaiting caller hangs with nothing in the console.
+      let settled = false;
+      let blockedTimer: ReturnType<typeof setTimeout> | undefined;
+
+      request.onblocked = () => {
+        console.warn(
+          `Opening ${config.name} is blocked by another connection (another tab on an older version?). ` +
+            `Giving up in ${BLOCKED_GRACE_MS}ms if it doesn't yield.`,
+        );
+        blockedTimer = setTimeout(() => {
+          if (settled) return;
+          settled = true;
+          reject(
+            new Error(
+              `Opening ${config.name} was blocked by another connection for ${BLOCKED_GRACE_MS}ms. ` +
+                "Close other tabs of this app and reload.",
+            ),
+          );
+        }, BLOCKED_GRACE_MS);
+      };
+
       request.onerror = () => {
+        clearTimeout(blockedTimer);
+        if (settled) return;
+        settled = true;
         console.error(`Failed to open ${config.name}:`, request.error);
         reject(request.error);
       };
 
       request.onsuccess = () => {
+        clearTimeout(blockedTimer);
         const db = request.result;
+        // We already gave up waiting: close it rather than hold a handle nobody
+        // awaits, or we become the next tab's blocker.
+        if (settled) {
+          db.close();
+          return;
+        }
+        settled = true;
         console.log(`Successfully opened ${config.name}`);
 
+        // Another tab wants a newer schema. Forget BEFORE closing: a cached but
+        // closed handle is worse than none, because every transaction on it throws.
+        db.onversionchange = () => {
+          console.warn(
+            `${config.name}: another tab requested a version change; closing this connection`,
+          );
+          this.databases.delete(config.name);
+          this.initPromises.delete(config.name);
+          db.close();
+        };
+
         // Set up close handler to clean up our references
         db.onclose = () => {
           console.log(`Database ${config.name} closed`);
@@ -329,9 +388,36 @@ class IndexedDBManager {
 
     return new Promise((resolve, reject) => {
       const deleteRequest = indexedDB.deleteDatabase(name);
+      // A delete blocks exactly like an upgrade, and this one is awaited on the
+      // files open path - so an unguarded block hangs the whole storage layer.
+      let settled = false;
+      let blockedTimer: ReturnType<typeof setTimeout> | undefined;
 
-      deleteRequest.onerror = () => reject(deleteRequest.error);
+      deleteRequest.onblocked = () => {
+        console.warn(
+          `Deleting ${name} is blocked by another connection; giving up in ${BLOCKED_GRACE_MS}ms.`,
+        );
+        blockedTimer = setTimeout(() => {
+          if (settled) return;
+          settled = true;
+          reject(
+            new Error(
+              `Deleting ${name} was blocked by another connection for ${BLOCKED_GRACE_MS}ms.`,
+            ),
+          );
+        }, BLOCKED_GRACE_MS);
+      };
+
+      deleteRequest.onerror = () => {
+        clearTimeout(blockedTimer);
+        if (settled) return;
+        settled = true;
+        reject(deleteRequest.error);
+      };
       deleteRequest.onsuccess = () => {
+        clearTimeout(blockedTimer);
+        if (settled) return;
+        settled = true;
         console.log(`Deleted database: ${name}`);
         resolve();
       };
@@ -343,17 +429,32 @@ class IndexedDBManager {
    */
   async getDatabaseVersion(name: string): Promise<number | null> {
     return new Promise((resolve) => {
+      // This probe runs BEFORE the guarded open, and a versionless open can be
+      // delayed indefinitely by another tab mid-versionchange. Unknown after the
+      // grace period beats hanging every storage consumer: the real open that
+      // follows has its own blocked guard and a message the user can act on.
+      const giveUp = setTimeout(() => {
+        console.warn(
+          `Version probe for ${name} did not answer in ${BLOCKED_GRACE_MS}ms; proceeding without it.`,
+        );
+        resolve(null);
+      }, BLOCKED_GRACE_MS);
       const request = indexedDB.open(name);
       request.onsuccess = () => {
+        clearTimeout(giveUp);
         const db = request.result;
         const version = db.version;
         db.close();
         resolve(version);
       };
-      request.onerror = () => resolve(null);
+      request.onerror = () => {
+        clearTimeout(giveUp);
+        resolve(null);
+      };
       request.onupgradeneeded = () => {
         // Cancel the upgrade
         request.transaction?.abort();
+        clearTimeout(giveUp);
         resolve(null);
       };
     });
diff --git a/frontend/editor/src/core/services/navFooterCache.ts b/frontend/editor/src/core/services/navFooterCache.ts
new file mode 100644
index 0000000000..cbde941c81
--- /dev/null
+++ b/frontend/editor/src/core/services/navFooterCache.ts
@@ -0,0 +1,73 @@
+/**
+ * Last-known sidebar-footer state, so the rows are correct at first paint
+ * instead of arriving a request later.
+ *
+ * The footer is mounted by both apps, and the editor and processor are separate
+ * React trees with separate query caches — so without this, every navigation
+ * between them (and every remount inside them) re-ran the fetches and the rows
+ * visibly popped in and shoved each other around. Persisting to storage rather
+ * than to an in-memory cache is what makes it survive that boundary, and a
+ * reload.
+ *
+ * Deliberately stale-then-revalidate: what's stored is only ever what the
+ * backend last said, every reader refetches immediately and overwrites, and
+ * nothing is gated on it — the processor enforces its own access server-side,
+ * and a stale credit figure is replaced within a second of the wallet landing.
+ */
+const CREDITS_KEY = "stirling.navFooter.credits";
+const OTHER_APP_KEY = "stirling.navFooter.otherApp";
+
+/** Figures, or null for a team that sees no meter at all (a paying one). */
+export type CachedCredits = { remaining: number; total: number } | null;
+
+function read(key: string): string | null {
+  try {
+    return localStorage.getItem(key);
+  } catch {
+    // Private mode / storage disabled — behave as a first-ever load.
+    return null;
+  }
+}
+
+function write(key: string, value: string): void {
+  try {
+    localStorage.setItem(key, value);
+  } catch {
+    // Nothing to do: the cache is an optimisation, never a correctness input.
+  }
+}
+
+/** `undefined` when this browser has never seen an answer. */
+export function readCachedCredits(): CachedCredits | undefined {
+  const raw = read(CREDITS_KEY);
+  if (raw === null) return undefined;
+  if (raw === "none") return null;
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (
+      typeof parsed === "object" &&
+      parsed !== null &&
+      typeof (parsed as CachedCredits & object).remaining === "number" &&
+      typeof (parsed as CachedCredits & object).total === "number"
+    ) {
+      return parsed as CachedCredits;
+    }
+  } catch {
+    // Corrupt entry — fall through and treat it as never-seen.
+  }
+  return undefined;
+}
+
+export function writeCachedCredits(credits: CachedCredits): void {
+  write(CREDITS_KEY, credits === null ? "none" : JSON.stringify(credits));
+}
+
+/** `undefined` when this browser has never seen an answer. */
+export function readCachedOtherApp(): boolean | undefined {
+  const raw = read(OTHER_APP_KEY);
+  return raw === null ? undefined : raw === "true";
+}
+
+export function writeCachedOtherApp(canOpen: boolean): void {
+  write(OTHER_APP_KEY, String(canOpen));
+}
diff --git a/frontend/editor/src/core/services/pdfiumInit.test.ts b/frontend/editor/src/core/services/pdfiumInit.test.ts
new file mode 100644
index 0000000000..315c39a662
--- /dev/null
+++ b/frontend/editor/src/core/services/pdfiumInit.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, test, vi } from "vitest";
+
+/**
+ * A WASM instantiate that fails must reject, not hang. `instantiateWasm` reports
+ * success by callback, so a swallowed rejection leaves `init()` pending and takes
+ * every thumbnail, page parse and form read with it - silently.
+ */
+
+const init = vi.hoisted(() => vi.fn());
+vi.mock("@embedpdf/pdfium", () => ({ init }));
+
+const wasmModule = vi.hoisted(() => ({}) as WebAssembly.Module);
+vi.mock("@app/services/wasmPrecompiler", () => ({
+  pdfiumWasmModulePromise: Promise.resolve(wasmModule),
+  startEagerWasmCompilation: () => {},
+  pdfiumWasmUrl: "http://localhost/pdfium.wasm",
+}));
+
+/** emscripten's contract: it calls instantiateWasm and waits to be called back. */
+function emscriptenInit(
+  instantiate: (imports: object, ok: () => void) => void,
+) {
+  return new Promise(() => {
+    instantiate({}, () => {});
+  });
+}
+
+async function loadService() {
+  vi.resetModules();
+  return await import("@app/services/pdfiumService");
+}
+
+describe("pdfium bootstrap", () => {
+  test("rejects when instantiating the pre-compiled module fails", async () => {
+    const failure = new Error("LinkError: import mismatch");
+    vi.spyOn(WebAssembly, "instantiate").mockRejectedValue(failure as never);
+    init.mockImplementation((overrides: Record<string, never>) =>
+      emscriptenInit(
+        overrides.instantiateWasm as unknown as (
+          imports: object,
+          ok: () => void,
+        ) => void,
+      ),
+    );
+
+    const { getPdfiumModule } = await loadService();
+
+    // Before the fix this never settled, so the test timed out.
+    await expect(getPdfiumModule()).rejects.toThrow(/LinkError/);
+  });
+
+  test("a failed load isn't cached, so the next call retries", async () => {
+    const instantiate = vi
+      .spyOn(WebAssembly, "instantiate")
+      .mockRejectedValueOnce(new Error("transient") as never)
+      .mockResolvedValue({} as never);
+    const ready = { PDFiumExt_Init: () => {} };
+    init.mockImplementation(
+      (overrides: Record<string, never>) =>
+        new Promise((resolve) => {
+          const instantiateWasm = overrides.instantiateWasm as unknown as (
+            imports: object,
+            ok: () => void,
+          ) => void;
+          instantiateWasm({}, () => resolve(ready));
+        }),
+    );
+
+    const { getPdfiumModule } = await loadService();
+
+    await expect(getPdfiumModule()).rejects.toThrow(/transient/);
+    await expect(getPdfiumModule()).resolves.toBe(ready);
+    expect(instantiate).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/frontend/editor/src/core/services/pdfiumService.ts b/frontend/editor/src/core/services/pdfiumService.ts
index a9a44c693b..d6cf12a311 100644
--- a/frontend/editor/src/core/services/pdfiumService.ts
+++ b/frontend/editor/src/core/services/pdfiumService.ts
@@ -80,17 +80,24 @@ function wasmUrl(): string {
  * This is the low-level PDFium WASM interface with all C functions wrapped.
  * Prefer `withDocument()` for document-scoped work.
  */
-export async function getPdfiumModule(): Promise<WrappedPdfiumModule> {
-  if (_module) return _module;
-  if (!_initPromise) {
-    // Ensure eager compilation has started if PDF service is requested before idle timeout
-    startEagerWasmCompilation();
+/** Reuses the WASM pre-compiled at boot. Every failure must reach this promise:
+ *  `instantiateWasm` reports success by callback, so a rejection inside it leaves
+ *  `init()` pending forever - and with it every thumbnail, parse and form read. */
+async function initPdfiumModule(): Promise<WrappedPdfiumModule> {
+  // Ensure eager compilation has started if PDF service is requested before idle timeout
+  startEagerWasmCompilation();
 
-    const overrides: PdfiumModuleOverrides = {
-      locateFile: () => wasmUrl(),
-    };
+  const overrides: PdfiumModuleOverrides = { locateFile: () => wasmUrl() };
+  const precompiled = await pdfiumWasmModulePromise;
 
-    // Eagerly reuse pre-compiled WASM module from app boot if available
+  let reportFailure: (error: unknown) => void = () => {};
+  const instantiateFailed = new Promise<never>((_, reject) => {
+    reportFailure = reject;
+  });
+
+  // No pre-compiled module: leave instantiateWasm alone so emscripten fetches the
+  // WASM itself and rejects init() on failure, instead of a fallback that can't.
+  if (precompiled) {
     overrides.instantiateWasm = (
       imports: WebAssembly.Imports,
       successCallback: (
@@ -98,40 +105,34 @@ export async function getPdfiumModule(): Promise<WrappedPdfiumModule> {
         module: WebAssembly.Module,
       ) => void,
     ) => {
-      pdfiumWasmModulePromise
-        .then((wasmModule) => {
-          if (wasmModule) {
-            return WebAssembly.instantiate(wasmModule, imports).then(
-              (instance) => {
-                successCallback(instance, wasmModule);
-              },
-            );
-          } else {
-            throw new Error("No pre-compiled WASM module found");
-          }
-        })
-        .catch((err: unknown) => {
-          console.warn(
-            "Eager WebAssembly instantiation failed, falling back to streaming compilation:",
-            err,
-          );
-          WebAssembly.instantiateStreaming(fetch(wasmUrl()), imports).then(
-            (result) => {
-              successCallback(result.instance, result.module);
-            },
-          );
-        });
+      WebAssembly.instantiate(precompiled, imports)
+        .then((instance) => successCallback(instance, precompiled))
+        .catch(reportFailure);
     };
+  }
 
-    _initPromise = init(overrides as Partial<PdfiumModule>).then((m) => {
-      // Call PDFiumExt_Init to ensure extensions (form fill etc.) are set up
-      try {
-        m.PDFiumExt_Init();
-      } catch {
-        /* already initialized */
-      }
-      _module = m;
-      return m;
+  const m = await Promise.race([
+    init(overrides as Partial<PdfiumModule>),
+    instantiateFailed,
+  ]);
+  // Call PDFiumExt_Init to ensure extensions (form fill etc.) are set up
+  try {
+    m.PDFiumExt_Init();
+  } catch {
+    /* already initialized */
+  }
+  _module = m;
+  return m;
+}
+
+export async function getPdfiumModule(): Promise<WrappedPdfiumModule> {
+  if (_module) return _module;
+  if (!_initPromise) {
+    _initPromise = initPdfiumModule().catch((error: unknown) => {
+      // Don't cache the failure: every PDF feature in the app goes through here,
+      // so a transient WASM fetch would take them all down for the session.
+      _initPromise = null;
+      throw error;
     });
   }
   return _initPromise;
diff --git a/frontend/editor/src/core/services/updateService.ts b/frontend/editor/src/core/services/updateService.ts
index 043c53bc36..8b23d26deb 100644
--- a/frontend/editor/src/core/services/updateService.ts
+++ b/frontend/editor/src/core/services/updateService.ts
@@ -185,7 +185,7 @@ export class UpdateService {
    */
   async getCurrentVersionFromGitHub(): Promise<string> {
     const url =
-      "https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/V2-master/build.gradle";
+      "https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/release/build.gradle";
 
     try {
       const response = await fetch(url);
diff --git a/frontend/editor/src/core/setupTests.ts b/frontend/editor/src/core/setupTests.ts
index 57bcaa76a5..d01c3cb589 100644
--- a/frontend/editor/src/core/setupTests.ts
+++ b/frontend/editor/src/core/setupTests.ts
@@ -2,6 +2,10 @@ import "@testing-library/jest-dom";
 import { vi } from "vitest";
 import { installFailOnConsole } from "@app/tests/failOnConsole";
 
+// jsdom is missing the same APIs WebKit is, so tests must agree with the
+// browser. Same module `src/index.tsx` installs.
+import "@app/utils/engineShims";
+
 installFailOnConsole();
 
 // Mock localStorage for tests
diff --git a/frontend/editor/src/core/tests/convert/ConvertIntegration.test.tsx b/frontend/editor/src/core/tests/convert/ConvertIntegration.test.tsx
index 06f9198f05..5f40cb87ae 100644
--- a/frontend/editor/src/core/tests/convert/ConvertIntegration.test.tsx
+++ b/frontend/editor/src/core/tests/convert/ConvertIntegration.test.tsx
@@ -68,6 +68,8 @@ const mockedApiClient = vi.mocked(apiClient);
 
 // Mock only essential services that are actually called by the tests
 vi.mock("../../services/fileStorage", () => ({
+  // FileContext subscribes to this to drop files whose bytes are unreadable.
+  onRecordUnreadable: () => () => {},
   fileStorage: {
     init: vi.fn().mockResolvedValue(undefined),
     storeFile: vi.fn().mockImplementation((file, thumbnail) => {
@@ -567,8 +569,14 @@ describe("Convert Tool Integration Tests", () => {
         await result.current.executeOperation(parameters, [testFile]);
       });
 
-      // Verify integration: utils validation prevents API call, hook shows error
-      expect(mockedApiClient.post).not.toHaveBeenCalled();
+      // Verify integration: utils validation prevents the conversion call, hook shows
+      // error. Failure reporting posts separately and is not a conversion request.
+      const conversionCalls = vi
+        .mocked(mockedApiClient.post)
+        .mock.calls.filter(
+          ([url]) => !String(url).includes("/file-run-events/"),
+        );
+      expect(conversionCalls).toHaveLength(0);
       expect(result.current.errorMessage).toContain(
         "Unsupported conversion format",
       );
diff --git a/frontend/editor/src/core/tests/convert/ConvertSmartDetectionIntegration.test.tsx b/frontend/editor/src/core/tests/convert/ConvertSmartDetectionIntegration.test.tsx
index 1e1e273de4..aec52300ca 100644
--- a/frontend/editor/src/core/tests/convert/ConvertSmartDetectionIntegration.test.tsx
+++ b/frontend/editor/src/core/tests/convert/ConvertSmartDetectionIntegration.test.tsx
@@ -66,6 +66,8 @@ const mockedApiClient = vi.mocked(apiClient);
 
 // Mock only essential services that are actually called by the tests
 vi.mock("../../services/fileStorage", () => ({
+  // FileContext subscribes to this to drop files whose bytes are unreadable.
+  onRecordUnreadable: () => () => {},
   fileStorage: {
     init: vi.fn().mockResolvedValue(undefined),
     storeFile: vi.fn().mockImplementation((file, thumbnail) => {
diff --git a/frontend/editor/src/core/tests/helpers/api-stubs.ts b/frontend/editor/src/core/tests/helpers/api-stubs.ts
index b1d792699b..d6ebfbe408 100644
--- a/frontend/editor/src/core/tests/helpers/api-stubs.ts
+++ b/frontend/editor/src/core/tests/helpers/api-stubs.ts
@@ -126,6 +126,10 @@ export interface MockAppApiOptions {
     username?: string;
     email?: string;
     roles?: string[];
+    /** Spring role string (e.g. "ROLE_ADMIN") — drives `isAdmin` in the auth seam. */
+    role?: string;
+    /** Portal (Processor) access flag — gates the super search's Processor lanes. */
+    portalAccess?: boolean;
   } | null;
   /** Languages advertised by `/config/app-config`. */
   languages?: string[];
diff --git a/frontend/editor/src/core/tests/live/edge-cases-security.spec.ts b/frontend/editor/src/core/tests/live/edge-cases-security.spec.ts
index 2e308ce3e2..f8021649b4 100644
--- a/frontend/editor/src/core/tests/live/edge-cases-security.spec.ts
+++ b/frontend/editor/src/core/tests/live/edge-cases-security.spec.ts
@@ -12,10 +12,9 @@ test.describe("20. Edge Cases and Security", () => {
     test("should prevent XSS via search input", async ({ page }) => {
       await loginAndSetup(page);
 
-      // Step 1: Open the search box (the tool panel header shows a search
-      // toggle; the field only mounts once it's pressed) and enter the payload
-      await page.getByRole("button", { name: /search tools/i }).click();
-      const searchBox = page.getByPlaceholder(/search|cari/i).first();
+      // Step 1: Enter the payload into the always-mounted super search bar
+      const searchBox = page.locator("#super-search-input");
+      await searchBox.click();
       await searchBox.fill('"><img src=x onerror=alert(1)>');
 
       // Step 2: Verify no script execution or image error handler fires
diff --git a/frontend/editor/src/core/tests/stubbed/compare.spec.ts b/frontend/editor/src/core/tests/stubbed/compare.spec.ts
index 6893721465..c3c6a990a1 100644
--- a/frontend/editor/src/core/tests/stubbed/compare.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/compare.spec.ts
@@ -230,4 +230,7 @@ test.describe("Compare tool slot selection", () => {
       page.locator('[data-testid="compare-slot-comparison"]'),
     ).toHaveAttribute("data-slot-state", "empty");
   });
+
+  // These specs stop at slot state. Actually running a comparison lives in
+  // `engine-capabilities.spec.ts`, which is cross-browser in PR CI.
 });
diff --git a/frontend/editor/src/core/tests/stubbed/engine-capabilities.spec.ts b/frontend/editor/src/core/tests/stubbed/engine-capabilities.spec.ts
new file mode 100644
index 0000000000..6107fb5276
--- /dev/null
+++ b/frontend/editor/src/core/tests/stubbed/engine-capabilities.spec.ts
@@ -0,0 +1,138 @@
+/** Runs on all three engines in PR CI, asserting on evidence that can only exist
+ *  if the engine did the work. Keep small - it is paid for three times per PR. */
+
+import path from "path";
+import type { Page } from "@playwright/test";
+import { test, expect } from "@app/tests/helpers/stub-test-base";
+import { dismissTourTooltip, uploadFiles } from "@app/tests/helpers/ui-helpers";
+
+const FIXTURES_DIR = path.join(import.meta.dirname, "../test-fixtures");
+const SAMPLE_PDF = path.join(FIXTURES_DIR, "sample.pdf");
+const PDF_A = path.join(FIXTURES_DIR, "compare_sample_a.pdf");
+const PDF_B = path.join(FIXTURES_DIR, "compare_sample_b.pdf");
+
+/** A missing global or prototype method always surfaces as one of these.
+ *  Matching the shape keeps benign engine noise out (console-clean.spec.ts). */
+const MISSING_API_ERROR =
+  /is not a function|is not a constructor|undefined is not an object|has no method/i;
+
+/** Collect the "this engine lacks an API we used" errors seen on the page. */
+function recordMissingApiErrors(page: Page): string[] {
+  const errors: string[] = [];
+  page.on("pageerror", (error: Error) => {
+    const text = String(error);
+    if (MISSING_API_ERROR.test(text)) errors.push(text);
+  });
+  return errors;
+}
+
+async function fillCompareSlot(
+  page: Page,
+  role: "base" | "comparison",
+  filePath: string,
+) {
+  await page
+    .getByTestId(`compare-slot-${role}-add-input`)
+    .setInputFiles(filePath);
+  await expect(
+    page.locator(`[data-testid="compare-slot-${role}"]`),
+  ).toHaveAttribute("data-slot-state", "filled", { timeout: 20_000 });
+  // The upload modal's overlay outlives its close transition and eats clicks.
+  await page
+    .locator(".mantine-Modal-overlay")
+    .waitFor({ state: "detached", timeout: 5_000 })
+    .catch(() => {
+      /* already gone */
+    });
+}
+
+test.describe("engine capabilities", { tag: "@engine-capability" }, () => {
+  test("extracts PDF text and completes a comparison", async ({ page }) => {
+    test.setTimeout(120_000);
+    const missingApis = recordMissingApiErrors(page);
+
+    await page.locator('[data-tour="tool-button-compare"]').first().click();
+    await page.waitForSelector('[data-testid="compare-slot-base"]', {
+      timeout: 20_000,
+    });
+
+    await fillCompareSlot(page, "base", PDF_A);
+    await fillCompareSlot(page, "comparison", PDF_B);
+
+    // By test id: `name` matches as a substring, so "Compare" also hits the
+    // tool button that opened this panel.
+    await page.getByTestId("compare-execute").click();
+
+    // Counted results, not headings: an extraction returning nothing still
+    // renders empty panes, which is how the WebKit failure looked like success.
+    const deletions = page.getByText(/Deletions \((\d+)\)/);
+    const additions = page.getByText(/Additions \((\d+)\)/);
+    await expect(deletions).toBeVisible({ timeout: 60_000 });
+    await expect(additions).toBeVisible();
+    expect(await deletions.innerText()).not.toMatch(/\(0\)/);
+    expect(await additions.innerText()).not.toMatch(/\(0\)/);
+
+    expect(missingApis, "no missing-API errors during comparison").toEqual([]);
+  });
+
+  test("rasterises page thumbnails via the PDF engine", async ({ page }) => {
+    test.setTimeout(120_000);
+    const missingApis = recordMissingApiErrors(page);
+
+    await uploadFiles(page, SAMPLE_PDF);
+    await dismissTourTooltip(page);
+
+    // A page thumbnail only exists if the WASM engine loaded, rendered and
+    // encoded. When it fails the grid still renders, just with no <img>.
+    await page.getByText("PDF Multi Tool", { exact: true }).first().click();
+
+    const thumbnail = page
+      .locator("[data-page-id] img[data-original-rotation]")
+      .first();
+    await expect(thumbnail).toBeVisible({ timeout: 60_000 });
+
+    // An empty encode still yields a src; require enough payload to be real.
+    const src = await thumbnail.getAttribute("src");
+    expect(src ?? "").toMatch(/^data:image\//);
+    expect(src?.length ?? 0).toBeGreaterThan(1_000);
+
+    expect(missingApis, "no missing-API errors during thumbnailing").toEqual(
+      [],
+    );
+  });
+
+  test("reads a stored file's bytes back after a reload", async ({ page }) => {
+    test.setTimeout(120_000);
+    const missingApis = recordMissingApiErrors(page);
+
+    await uploadFiles(page, SAMPLE_PDF);
+
+    // Full reload: FileContext rehydrates from IndexedDB, not from memory.
+    await page.reload({ waitUntil: "domcontentloaded" });
+
+    const restored = page.locator(".file-sidebar-file-item").first();
+    await expect(restored).toBeVisible({ timeout: 30_000 });
+
+    // Rendering it is the assertion that matters: the metadata record survives
+    // even when the bytes were never stored, so a filename proves nothing.
+    await restored.hover();
+    await restored
+      .locator(".file-sidebar-eye-btn")
+      .click({ timeout: 15_000, force: true });
+
+    const firstPage = page.locator('[data-page-index="0"]').first();
+    await expect(firstPage).toBeVisible({ timeout: 60_000 });
+
+    // A tile that decoded has non-zero naturalWidth. A blob stored but not
+    // readable back resolves to nothing, and renders as an empty page.
+    const tile = firstPage.locator('img[src^="blob:"]').first();
+    await expect(tile).toBeAttached({ timeout: 30_000 });
+    await expect
+      .poll(() => tile.evaluate((img: HTMLImageElement) => img.naturalWidth), {
+        timeout: 30_000,
+      })
+      .toBeGreaterThan(0);
+
+    expect(missingApis, "no missing-API errors after rehydration").toEqual([]);
+  });
+});
diff --git a/frontend/editor/src/core/tests/stubbed/files-page.spec.ts b/frontend/editor/src/core/tests/stubbed/files-page.spec.ts
index ba33ea3c83..7c365eb1aa 100644
--- a/frontend/editor/src/core/tests/stubbed/files-page.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/files-page.spec.ts
@@ -565,25 +565,6 @@ test.describe("Files page", () => {
   test.describe("Side-rail integration with /files", () => {
     test.use({ autoGoto: false });
 
-    test("Rail Search focuses the central search field, no navigation", async ({
-      page,
-    }) => {
-      await stubStorageApis(page);
-      await seedFiles(page, [
-        { id: "alpha", name: "alpha.pdf", remoteStorageId: null },
-      ]);
-      await gotoFilesPage(page);
-      // Click the search row in the rail.
-      await page.locator(".file-sidebar-search-row").click();
-      // The central search input should be focused.
-      const focused = await page.evaluate(
-        () => document.activeElement?.getAttribute("aria-label") ?? "",
-      );
-      expect(focused).toMatch(/Search/i);
-      // And we must still be on /files (i.e. didn't navigate home).
-      await expect(page).toHaveURL(/\/files/);
-    });
-
     test("Rail New folder button visible on /files", async ({ page }) => {
       await stubStorageApis(page);
       await seedFiles(page, [
diff --git a/frontend/editor/src/core/tests/stubbed/language-localization.spec.ts b/frontend/editor/src/core/tests/stubbed/language-localization.spec.ts
index 30ecc8d779..3e9d8a05ae 100644
--- a/frontend/editor/src/core/tests/stubbed/language-localization.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/language-localization.spec.ts
@@ -54,12 +54,11 @@ test.describe("13. Language / Localization", () => {
         // Step 5: Wait for page reload (language change triggers window.location.reload())
         await page.waitForLoadState("domcontentloaded");
 
-        // Step 6: Verify the UI text is in English. The tool search is a
-        // header toggle, so assert its English label rather than the field,
-        // which only mounts once the toggle is pressed.
-        await expect(
-          page.getByRole("button", { name: /search tools/i }).first(),
-        ).toBeVisible({ timeout: 10000 });
+        // Step 6: Verify the UI text is in English via the always-mounted
+        // super search bar's placeholder.
+        await expect(page.getByPlaceholder(/search/i).first()).toBeVisible({
+          timeout: 10000,
+        });
       }
     });
   });
diff --git a/frontend/editor/src/core/tests/stubbed/main-dashboard.spec.ts b/frontend/editor/src/core/tests/stubbed/main-dashboard.spec.ts
index 4c44c77d98..5fa9037363 100644
--- a/frontend/editor/src/core/tests/stubbed/main-dashboard.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/main-dashboard.spec.ts
@@ -17,14 +17,7 @@ test.describe("2. Main Dashboard / Home Page", () => {
         page.locator('[data-testid="config-button"]').first(),
       ).toBeVisible();
 
-      // Tool search sits behind a header toggle now, so assert the affordance
-      // AND that pressing it actually mounts a usable search field — dropping
-      // the second half would stop covering the input entirely.
-      const searchToggle = page
-        .getByRole("button", { name: /search tools/i })
-        .first();
-      await expect(searchToggle).toBeVisible();
-      await searchToggle.click();
+      // Tool search lives in the global super search bar, always mounted.
       await expect(page.getByPlaceholder(/search/i).first()).toBeVisible();
 
       await expect(
@@ -82,10 +75,8 @@ test.describe("2. Main Dashboard / Home Page", () => {
 
       await page.goto("/editor");
 
-      // Tool search is a header toggle; the field mounts only once pressed.
-      await expect(
-        page.getByRole("button", { name: /search tools/i }).first(),
-      ).toBeVisible();
+      // Tool search lives in the global super search bar, always mounted.
+      await expect(page.getByPlaceholder(/search/i).first()).toBeVisible();
     });
   });
 
diff --git a/frontend/editor/src/core/tests/stubbed/super-search.spec.ts b/frontend/editor/src/core/tests/stubbed/super-search.spec.ts
new file mode 100644
index 0000000000..431a98b421
--- /dev/null
+++ b/frontend/editor/src/core/tests/stubbed/super-search.spec.ts
@@ -0,0 +1,443 @@
+import { test, expect } from "@app/tests/helpers/stub-test-base";
+import { openSettings } from "@app/tests/helpers/ui-helpers";
+import type { Page } from "@playwright/test";
+
+/**
+ * Super search E2E: the bar itself (open, filter, select, show-more, XSS
+ * hygiene) plus the access gating — a user without Processor access must see
+ * no Processor chips, no Processor results, and trigger no entity fetches.
+ *
+ * Portal-lane presence differs by build: `vite dev` ships the portal, the CI
+ * preview build does not. Gate-closed assertions hold in both (closed lanes
+ * look identical to absent ones); gate-open lane assertions skip themselves
+ * when the build ships no portal.
+ */
+
+const INPUT = "#super-search-input";
+
+/**
+ * URLs only the search's Processor entity fetch hits. `/api/v1/policies`
+ * itself is deliberately absent: the editor's policy auto-run also reads it at
+ * boot for every user, so it can't distinguish a search leak.
+ */
+const ENTITY_API_PATTERN =
+  /\/api\/v1\/policies\/overview|\/api\/v1\/sources|\/api\/v1\/proprietary\/ui-data\/admin-settings/;
+
+async function openSearch(page: Page) {
+  const input = page.locator(INPUT);
+  await input.click();
+  await expect(input).toHaveAttribute("aria-expanded", "true");
+  return input;
+}
+
+test.describe("Super search — bar basics", () => {
+  test("Ctrl+K opens the bar and results filter as you type", async ({
+    page,
+  }) => {
+    const input = page.locator(INPUT);
+    // The shortcut listener mounts with the bar — wait for it before pressing.
+    await expect(input).toBeVisible();
+    await page.keyboard.press("Control+KeyK");
+    await expect(input).toBeFocused();
+    await expect(input).toHaveAttribute("aria-expanded", "true");
+
+    await input.fill("merge");
+    await expect(
+      page.getByRole("option", { name: /Merge/ }).first(),
+    ).toBeVisible();
+
+    // A different query replaces the results in place.
+    await input.fill("compress");
+    await expect(
+      page.getByRole("option", { name: /Compress/ }).first(),
+    ).toBeVisible();
+    await expect(page.getByRole("option", { name: /^Merge/ })).toHaveCount(0);
+  });
+
+  test("selecting a tool result opens that tool", async ({ page }) => {
+    const input = await openSearch(page);
+    await input.fill("merge");
+    await page
+      .getByRole("option", { name: /^Merge/ })
+      .first()
+      .click();
+    await page.waitForURL("**/merge**");
+  });
+
+  test("shows the empty state for a query with no matches", async ({
+    page,
+  }) => {
+    const input = await openSearch(page);
+    await input.fill("xyznonexistent123");
+    await expect(page.getByText("No results found")).toBeVisible();
+  });
+
+  test("treats markup in the query as plain text", async ({ page }) => {
+    let dialogFired = false;
+    page.on("dialog", (dialog) => {
+      dialogFired = true;
+      void dialog.dismiss();
+    });
+
+    const input = await openSearch(page);
+    const payload =
+      '<img src=x onerror="window.__xss=1"><script>alert(1)</script>';
+    await input.fill(payload);
+    await expect(input).toHaveValue(payload);
+
+    await expect(page.getByText("No results found")).toBeVisible();
+    expect(dialogFired).toBe(false);
+    expect(
+      await page.evaluate(
+        () => (window as unknown as { __xss?: number }).__xss,
+      ),
+    ).toBeUndefined();
+  });
+
+  test("show more reveals the rest of a large group and collapses again", async ({
+    page,
+  }) => {
+    const input = await openSearch(page);
+    // Broad query — the tools lane alone exceeds the 5-row collapsed slice.
+    // Assertions scope to the Tools group: other groups (docs, entities)
+    // pop in asynchronously, so page-wide option counts are racy.
+    await input.fill("pdf");
+    const tools = page.getByRole("group", { name: "Tools" });
+    await expect(tools.getByRole("option").first()).toBeVisible();
+
+    const collapsedCount = await tools.getByRole("option").count();
+    const showMore = tools.getByRole("button", { name: /Show \d+ more/ });
+    await expect(showMore).toBeVisible();
+    const hidden = Number(
+      (await showMore.innerText()).match(/\d+/)?.[0] ?? "0",
+    );
+    await showMore.click();
+
+    await expect(tools.getByRole("option")).toHaveCount(
+      collapsedCount + hidden,
+    );
+    const showLess = tools.getByRole("button", { name: "Show less" });
+    await expect(showLess).toBeVisible();
+
+    await showLess.click();
+    await expect(tools.getByRole("option")).toHaveCount(collapsedCount);
+  });
+
+  test("selecting a tool from the /files page leaves the file manager", async ({
+    page,
+  }) => {
+    await page.goto("/files");
+    const input = page.locator(INPUT).first();
+    await expect(input).toBeVisible({ timeout: 15000 });
+    await input.click();
+    await input.fill("merge");
+    await page
+      .getByRole("option", { name: /^Merge/ })
+      .first()
+      .click();
+
+    // The selection pins its tool URL via raw history.pushState, which the
+    // router never sees — the sink must leave /files through the router or
+    // the myFiles workbench swallows the selection (and "/" is a role router
+    // on processor-shipping builds, so the exit must target the editor home).
+    await expect(page.locator(".files-page-header-search")).not.toBeVisible({
+      timeout: 5000,
+    });
+    await expect(page).toHaveURL(/\/merge/);
+  });
+
+  test("Ctrl+K inside the settings modal closes it and focuses the bar", async ({
+    page,
+  }) => {
+    const input = page.locator(INPUT);
+    await expect(input).toBeVisible();
+    await openSettings(page);
+
+    // The modal traps focus, so the bar's own shortcut is inert; the modal
+    // cedes: it closes itself and hands focus to the bar.
+    await page.keyboard.press("Control+KeyK");
+    await expect(page.locator(".modal-container")).not.toBeVisible();
+    await expect(input).toBeFocused();
+    await expect(input).toHaveAttribute("aria-expanded", "true");
+
+    // Full loop: a settings result deep-links straight back into the modal.
+    await input.fill("general");
+    await page
+      .getByRole("option", { name: /General/ })
+      .first()
+      .click();
+    await expect(page.locator(".modal-container")).toBeVisible();
+  });
+});
+
+test.describe("Super search — user without Processor access", () => {
+  // Login enabled, signed in as a plain member: no admin role, no portal
+  // access. The Processor gate must stay closed.
+  test.use({
+    stubOptions: {
+      enableLogin: true,
+      user: {
+        id: 33,
+        username: "bob",
+        email: "bob@example.com",
+        role: "ROLE_USER",
+        portalAccess: false,
+      },
+    },
+    seedJwt: true,
+  });
+
+  test("sees no Processor chips, results or entity fetches", async ({
+    page,
+  }) => {
+    const entityRequests: string[] = [];
+    page.on("request", (request) => {
+      if (ENTITY_API_PATTERN.test(request.url())) {
+        entityRequests.push(request.url());
+      }
+    });
+
+    const input = await openSearch(page);
+
+    // Chip row: the editor lanes only. No Processor lanes of any kind.
+    await expect(page.getByRole("button", { name: "Tools" })).toBeVisible();
+    for (const lane of [
+      "Pages",
+      "Users",
+      "Policies",
+      "Pipelines",
+      "Sources",
+      "Docs",
+    ]) {
+      await expect(
+        page.getByRole("button", { name: lane, exact: true }),
+      ).toHaveCount(0);
+    }
+
+    // A query that would hit policies/docs/admin settings when the gate is
+    // open must yield no Processor section for this user.
+    await input.fill("security");
+    await expect(page.getByRole("option").first()).toBeVisible();
+    await expect(
+      page.locator(".super-search-section-label", { hasText: "Processor" }),
+    ).toHaveCount(0);
+
+    // And the search must not have fetched any entity data on their behalf.
+    await page.waitForTimeout(750);
+    expect(entityRequests).toEqual([]);
+  });
+
+  test("sees login-gated settings but no admin settings", async ({ page }) => {
+    const input = await openSearch(page);
+
+    // Positive control — requiresLogin sections are visible to a signed-in
+    // user, proving the settings lane itself works for this account.
+    await input.fill("account");
+    await expect(
+      page.getByRole("option", { name: /Account Settings/ }).first(),
+    ).toBeVisible();
+
+    // Admin-only sections stay hidden (label and content matches alike).
+    await input.fill("endpoints");
+    await expect(page.getByRole("option", { name: /^Endpoints/ })).toHaveCount(
+      0,
+    );
+  });
+});
+
+test.describe("Super search — portal access without admin", () => {
+  // Self-hosted grants portal access beyond admins (team owners, ACL
+  // grantees), but the users roster endpoint is admin-only — the Users lane
+  // must not be offered to a session the endpoint would always refuse.
+  test.use({
+    stubOptions: {
+      enableLogin: true,
+      user: {
+        id: 44,
+        username: "owner",
+        email: "owner@example.com",
+        role: "ROLE_USER",
+        portalAccess: true,
+      },
+    },
+    seedJwt: true,
+  });
+
+  test("sees Processor lanes but no Users chip and no roster fetch", async ({
+    page,
+  }) => {
+    const rosterRequests: string[] = [];
+    page.on("request", (request) => {
+      if (
+        request.url().includes("/api/v1/proprietary/ui-data/admin-settings")
+      ) {
+        rosterRequests.push(request.url());
+      }
+    });
+    for (const [pattern, json] of [
+      ["**/api/v1/policies", []],
+      ["**/api/v1/policies/runs", []],
+      ["**/api/v1/policies/overview", { pipelines: [] }],
+      ["**/api/v1/sources", { sources: [] }],
+    ] as const) {
+      await page.route(pattern, (route) => route.fulfill({ json }));
+    }
+
+    const input = await openSearch(page);
+    const portalShips =
+      (await page.getByRole("button", { name: "Pages", exact: true }).count()) >
+      0;
+    test.skip(!portalShips, "this build ships no portal — no lanes to gate");
+
+    for (const lane of ["Policies", "Pipelines", "Sources"]) {
+      await expect(
+        page.getByRole("button", { name: lane, exact: true }),
+      ).toBeVisible();
+    }
+    await expect(
+      page.getByRole("button", { name: "Users", exact: true }),
+    ).toHaveCount(0);
+
+    // A query that used to fire the doomed roster fetch once per TTL.
+    await input.fill("admin");
+    await expect(page.locator(".super-search-dropdown").first()).toBeVisible();
+    await page.waitForTimeout(1500);
+    expect(rosterRequests).toEqual([]);
+  });
+});
+
+test.describe("Super search — admin with Processor access", () => {
+  test.use({
+    stubOptions: {
+      enableLogin: true,
+      isAdmin: true,
+      user: {
+        id: 1,
+        username: "admin",
+        email: "admin@example.com",
+        role: "ROLE_ADMIN",
+        portalAccess: true,
+      },
+    },
+    seedJwt: true,
+  });
+
+  test("sees Processor lanes and live entity results", async ({ page }) => {
+    // Entity data the gate-open bar fetches, stubbed with one source row.
+    await page.route("**/api/v1/policies", (route) =>
+      route.fulfill({ json: [] }),
+    );
+    await page.route("**/api/v1/policies/runs", (route) =>
+      route.fulfill({ json: [] }),
+    );
+    await page.route("**/api/v1/policies/overview", (route) =>
+      route.fulfill({ json: { pipelines: [] } }),
+    );
+    await page.route("**/api/v1/sources", (route) =>
+      route.fulfill({
+        json: {
+          sources: [{ id: "src-1", name: "Contract Intake", type: "email" }],
+        },
+      }),
+    );
+
+    await openSearch(page);
+
+    // The Processor lanes only exist in builds that ship the portal (dev,
+    // VITE_INCLUDE_PORTAL) — the CI preview build has none to show.
+    const portalShips =
+      (await page.getByRole("button", { name: "Pages", exact: true }).count()) >
+      0;
+    test.skip(!portalShips, "this build ships no portal — no lanes to gate");
+
+    for (const lane of ["Users", "Policies", "Pipelines", "Sources"]) {
+      await expect(
+        page.getByRole("button", { name: lane, exact: true }),
+      ).toBeVisible();
+    }
+
+    const input = page.locator(INPUT);
+    await input.fill("contract intake");
+    await expect(
+      page.getByRole("option", { name: /Contract Intake/ }).first(),
+    ).toBeVisible();
+    await expect(
+      page
+        .locator(".super-search-section-label", { hasText: "Processor" })
+        .first(),
+    ).toBeVisible();
+  });
+});
+
+test.describe("Portal bar — tool results hop into the editor", () => {
+  test.use({
+    stubOptions: {
+      enableLogin: true,
+      isAdmin: true,
+      user: {
+        id: 1,
+        username: "admin",
+        email: "admin@example.com",
+        role: "ROLE_ADMIN",
+        portalAccess: true,
+      },
+    },
+    seedJwt: true,
+    autoGoto: false,
+  });
+
+  test("selecting a tool routes client-side, not via a full page load", async ({
+    page,
+  }) => {
+    for (const [pattern, json] of [
+      ["**/api/v1/policies", []],
+      ["**/api/v1/policies/runs", []],
+      ["**/api/v1/policies/overview", { pipelines: [] }],
+      ["**/api/v1/sources", { sources: [] }],
+      ["**/api/v1/team/my", []],
+    ] as const) {
+      await page.route(pattern, (route) => route.fulfill({ json }));
+    }
+
+    await page.goto("/processor");
+    const input = page.locator("#portal-search-input");
+    // The portal only ships in dev / VITE_INCLUDE_PORTAL builds — on the CI
+    // preview build /processor falls through to the editor and there is no
+    // portal bar to hop from.
+    const portalShips = await input
+      .waitFor({ state: "visible", timeout: 20000 })
+      .then(() => true)
+      .catch(() => false);
+    test.skip(!portalShips, "this build ships no portal — no bar to hop from");
+
+    // A full page load would drop this marker — and on bundled deploys it
+    // would also 401: document GETs carry no Authorization header, so the
+    // backend bounces them to /login even with a live session.
+    await page.evaluate(() => {
+      (window as unknown as { __spaMarker?: boolean }).__spaMarker = true;
+    });
+
+    await input.click();
+    await input.fill("merge");
+    await page
+      .getByRole("option", { name: /^Merge/ })
+      .first()
+      .click();
+
+    await expect(page).toHaveURL(/\/merge/);
+    // Editor mounted: its own search bar replaces the portal's.
+    await expect(page.locator("#super-search-input")).toBeVisible({
+      timeout: 15000,
+    });
+    // The editor's URL-driven tool init must run on this route-swap mount,
+    // not just on a cold page load: the Merge tool panel actually opens.
+    await expect(
+      page.getByRole("button", { name: "Merge", exact: true }),
+    ).toBeVisible({ timeout: 10000 });
+    expect(
+      await page.evaluate(
+        () => (window as unknown as { __spaMarker?: boolean }).__spaMarker,
+      ),
+    ).toBe(true);
+  });
+});
diff --git a/frontend/editor/src/core/tests/stubbed/tool-search.spec.ts b/frontend/editor/src/core/tests/stubbed/tool-search.spec.ts
deleted file mode 100644
index 7dfda74b79..0000000000
--- a/frontend/editor/src/core/tests/stubbed/tool-search.spec.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-import type { Page } from "@playwright/test";
-import { test, expect } from "@app/tests/helpers/stub-test-base";
-
-/**
- * The tool panel header shows a search *toggle*; the field only mounts once
- * it's pressed. Open it and hand back the focused input.
- */
-async function openToolSearch(page: Page) {
-  await page.getByRole("button", { name: /search tools/i }).click();
-  const searchBox = page.getByPlaceholder(/search|cari/i).first();
-  await expect(searchBox).toBeVisible({ timeout: 5000 });
-  return searchBox;
-}
-
-test.describe("3. Tool Search", () => {
-  test.describe("3.1 Search - Happy Path", () => {
-    test("should filter tools in real time based on search input", async ({
-      page,
-    }) => {
-      // Step 1: Open the search box from the header toggle
-      const searchBox = await openToolSearch(page);
-
-      // Step 2: Type "merge"
-      await searchBox.fill("merge");
-
-      // Step 3: Verify search results filter to show relevant tools
-      await expect(
-        page.locator("text=/merge|menggabungkan/i").first(),
-      ).toBeVisible({ timeout: 5000 });
-
-      // Step 5: Clear the search field
-      await searchBox.clear();
-
-      // Step 6: Verify all tools reappear (check for multiple categories)
-      await expect(
-        page.locator("text=/recommended|direkomendasikan/i").first(),
-      ).toBeVisible({ timeout: 5000 });
-    });
-  });
-
-  test.describe("3.2 Search - No Results", () => {
-    test("should handle queries with no matching tools gracefully", async ({
-      page,
-    }) => {
-      // Step 1: Open the search box from the header toggle
-      const searchBox = await openToolSearch(page);
-
-      // Step 2: Type xyznonexistent123
-      await searchBox.fill("xyznonexistent123");
-
-      // Step 3: Verify the search field accepted the input
-      await expect(searchBox).toHaveValue("xyznonexistent123");
-
-      // The app uses fuzzy search with a fallback that shows all tools when nothing
-      // matches, so we verify the search state is active (no "recommended" section)
-      // and the page remains functional without errors.
-      await expect(
-        page.locator("text=/recommended|direkomendasikan/i"),
-      ).toHaveCount(0, { timeout: 5000 });
-
-      // Step 4: Clear the search field
-      await searchBox.clear();
-
-      // Step 5: Verify all tools reappear (recommended section comes back)
-      await expect(
-        page.locator("text=/recommended|direkomendasikan/i").first(),
-      ).toBeVisible({ timeout: 5000 });
-    });
-  });
-
-  test.describe("3.3 Search - Special Characters", () => {
-    test("should sanitize search input against XSS", async ({ page }) => {
-      // Step 1: Type XSS payload into the search box
-      const searchBox = await openToolSearch(page);
-      await searchBox.fill("<script>alert(1)</script>");
-
-      // Step 2: Verify no script execution occurs (no alert dialog)
-      // If an alert appeared, Playwright would throw an unhandled dialog error
-      await page.waitForTimeout(1000);
-
-      // Step 3: Verify the search treats the input as plain text
-      await expect(searchBox).toHaveValue("<script>alert(1)</script>");
-
-      // Step 4: Clear the search field
-      await searchBox.clear();
-    });
-  });
-});
diff --git a/frontend/editor/src/core/theme/colors.css b/frontend/editor/src/core/theme/colors.css
index 3caf240da4..dd3c2aec7c 100644
--- a/frontend/editor/src/core/theme/colors.css
+++ b/frontend/editor/src/core/theme/colors.css
@@ -32,6 +32,9 @@ html[data-app-theme="light"] {
   --c-primary: var(--p-blue-500);
   --c-primary-hover: var(--p-blue-600);
   --c-primary-subtle: color-mix(in srgb, var(--p-blue-500) 10%, transparent);
+  /* Accent used as TEXT (links, toggles): a deeper hue that clears 4.5:1 on
+     light surfaces, where --c-primary itself does not. */
+  --c-accent-text: var(--p-blue-700);
 
   --c-success: var(--p-green-600);
   --c-danger: var(--p-red-600);
@@ -68,6 +71,11 @@ html[data-app-theme="light"] {
     var(--c-success) 10%,
     var(--c-surface)
   );
+  --c-warning-subtle: color-mix(
+    in srgb,
+    var(--c-warning) 10%,
+    var(--c-surface)
+  );
 
   /* ── Decorative / brand / categorical palette ──────────────────────────
      Fixed hues that intentionally do NOT follow the chosen accent: brand
@@ -144,6 +152,8 @@ html[data-app-theme="midnight"] {
   --c-text-muted: var(--p-zinc-200);
   --c-text-subtle: var(--p-zinc-250);
   --c-text-on-primary: var(--p-white);
+  /* Accent used as TEXT on dark surfaces: a lighter step for 4.5:1. */
+  --c-accent-text: var(--p-blue-400);
   --c-btn-solid: var(--c-text);
   --c-btn-inverse: var(--p-ink);
   --c-btn-secondary: var(--p-c-1a1a1d);
diff --git a/frontend/editor/src/core/theme/dimensions.css b/frontend/editor/src/core/theme/dimensions.css
index aa0a1b38cc..554baddcca 100644
--- a/frontend/editor/src/core/theme/dimensions.css
+++ b/frontend/editor/src/core/theme/dimensions.css
@@ -62,6 +62,7 @@
   /* ── Z-index ladder ── */
   --z-dropdown: 25;
   --z-drawer: 50;
+  --z-popover: 150;
   --z-toast: 200;
   /* Fullscreen tool-picker surfaces (editor) */
   --z-fullscreen-icon-svg: 1;
diff --git a/frontend/editor/src/core/tools/formFill/FormFill.tsx b/frontend/editor/src/core/tools/formFill/FormFill.tsx
index 599d586319..5ed9dcd47b 100644
--- a/frontend/editor/src/core/tools/formFill/FormFill.tsx
+++ b/frontend/editor/src/core/tools/formFill/FormFill.tsx
@@ -35,7 +35,7 @@ import {
 } from "@app/tools/formFill/FormFillContext";
 import { useNavigation } from "@app/contexts/NavigationContext";
 import { useViewer } from "@app/contexts/ViewerContext";
-import { useFileState } from "@app/contexts/FileContext";
+import { useAllFiles, useFileState } from "@app/contexts/FileContext";
 import { Skeleton } from "@mantine/core";
 import { isStirlingFile, getFormFillFileId } from "@app/types/fileContext";
 import type { BaseToolProps } from "@app/types/tool";
@@ -124,7 +124,7 @@ const _MODE_TABS: ModeTabDef[] = [
 const FormFill = (_props: BaseToolProps) => {
   const { t } = useTranslation();
   const { selectedTool } = useNavigation();
-  const { selectors, state: fileState } = useFileState();
+  const { state: fileState } = useFileState();
 
   const {
     state: formState,
@@ -178,7 +178,9 @@ const FormFill = (_props: BaseToolProps) => {
   const isDirtyRef = useRef(formState.isDirty);
   isDirtyRef.current = formState.isDirty;
 
-  const activeFiles = selectors.getFiles();
+  // Subscribing read: getFiles() during render doesn't re-run when the workbench
+  // changes, so the panel kept showing the pre-hydration (or pre-version) file.
+  const { files: activeFiles } = useAllFiles();
   const selectedFileIds = fileState.ui.selectedFileIds;
   const currentFile = useMemo(() => {
     if (activeFiles.length === 0) return null;
diff --git a/frontend/editor/src/core/types/fileContext.ts b/frontend/editor/src/core/types/fileContext.ts
index 0d99b3589d..3dc00c306d 100644
--- a/frontend/editor/src/core/types/fileContext.ts
+++ b/frontend/editor/src/core/types/fileContext.ts
@@ -61,6 +61,12 @@ export interface StirlingFileStub extends BaseFileMetadata {
    * unclassified files / non-SaaS builds.
    */
   classificationLabels?: string[];
+  /**
+   * This session proved the stored bytes unreadable (WebKit losing a blob's
+   * backing store). The row renders as "data lost" instead of pretending the
+   * file can open; re-uploading is the only recovery.
+   */
+  dataUnavailable?: boolean;
   // Note: File object stored in provider ref, not in state
 }
 
diff --git a/frontend/editor/src/core/types/superSearch.ts b/frontend/editor/src/core/types/superSearch.ts
new file mode 100644
index 0000000000..3d8e72849f
--- /dev/null
+++ b/frontend/editor/src/core/types/superSearch.ts
@@ -0,0 +1,134 @@
+import type React from "react";
+
+/**
+ * The super search's shared contract: what a results provider returns and the
+ * shapes hosts exchange with the shared rankers. Pure types, kept apart from
+ * the provider implementations so leaf modules (flavor seams, the portal's
+ * entity search) can depend on the contract without importing a provider —
+ * which would be a circular import.
+ */
+
+export type SuperSearchGroupId = "files" | "tools" | "settings" | "processor";
+
+export interface SuperSearchResult {
+  /** Stable unique key across all groups. */
+  key: string;
+  /** Group id — the editor uses SuperSearchGroupId; other hosts use their own. */
+  group: string;
+  title: string;
+  subtitle?: string;
+  /** LocalIcon name (files/settings); tools provide a React node via `icon`. */
+  iconName?: string;
+  icon?: React.ReactNode;
+  score: number;
+  onSelect: () => void | Promise<void>;
+}
+
+export interface SuperSearchGroup {
+  id: string;
+  label: string;
+  /** Optional higher-level section label rendered above consecutive groups. */
+  sectionLabel?: string;
+  results: SuperSearchResult[];
+}
+
+export interface SuperSearchScope {
+  id: string;
+  label: string;
+  aliases?: string[];
+}
+
+export interface UseSuperSearchResult {
+  /** Non-empty groups, in display order. */
+  groups: SuperSearchGroup[];
+  /** All results flattened in display order (for keyboard navigation). */
+  flatResults: SuperSearchResult[];
+  /** True while the My Files store is loading for the first time. */
+  loadingFiles: boolean;
+}
+
+export interface SuperSearchQueryOptions {
+  scopeIds?: readonly string[];
+}
+
+/**
+ * Visibility gates shared by the settings and Processor sources. Hosts pass
+ * `null` while the app config is still loading — the rankers treat that as
+ * "most restrictive" so gated results can appear once config lands but never
+ * flash open before it.
+ */
+export interface SuperSearchGates {
+  isAdmin: boolean;
+  loginEnabled: boolean;
+  portalAccessible?: boolean;
+  /**
+   * Whether no-login mode keeps the read-only admin settings preview
+   * (`system.showSettingsWhenNoLogin`, default true). Mirrors the settings
+   * nav builder's admin gate: `isAdmin || (!loginEnabled && this)`.
+   */
+  showSettingsWhenNoLogin?: boolean;
+  /**
+   * True for a signed-out (anonymous) session. Gates account-bound sections
+   * on hosts where auth state, not the local backend config, is the truth
+   * (SaaS). Hosts whose users are always signed in may omit it.
+   */
+  isAnonymous?: boolean;
+}
+
+/**
+ * The Processor's entity lanes as scope definitions — ids, the portal view
+ * each targets, chip labels and typed-prefix aliases. Both hosts' chip lists
+ * and the portal's entity module derive from this one list, so the chips
+ * can't drift apart; it lives in the types leaf because the editor's chip
+ * list must not import portal code.
+ */
+export interface PortalEntityScopeDef {
+  id:
+    | "portal-users"
+    | "portal-policies"
+    | "portal-pipelines"
+    | "portal-sources";
+  /** Portal view id the scope targets (visibility check vs the page index). */
+  viewId: string;
+  labelKey: string;
+  labelFallback: string;
+  aliases: readonly string[];
+}
+
+/**
+ * The developer-docs scope. Separate from the entity defs above: docs are a
+ * bundled full-text manifest, not a fetched entity list, so they don't ride
+ * the fetch cache — but they get a chip and a results group like the rest.
+ */
+export const PORTAL_DOCS_SCOPE_ID = "portal-docs";
+
+export const PORTAL_ENTITY_SCOPE_DEFS: readonly PortalEntityScopeDef[] = [
+  {
+    id: "portal-users",
+    viewId: "users",
+    labelKey: "portal.nav.users",
+    labelFallback: "Users",
+    aliases: ["user", "users", "member", "members"],
+  },
+  {
+    id: "portal-policies",
+    viewId: "policies",
+    labelKey: "portal.nav.policies",
+    labelFallback: "Policies",
+    aliases: ["policy", "policies"],
+  },
+  {
+    id: "portal-pipelines",
+    viewId: "pipelines",
+    labelKey: "portal.nav.pipelines",
+    labelFallback: "Pipelines",
+    aliases: ["pipeline", "pipelines"],
+  },
+  {
+    id: "portal-sources",
+    viewId: "sources",
+    labelKey: "portal.nav.sources",
+    labelFallback: "Sources",
+    aliases: ["source", "sources"],
+  },
+];
diff --git a/frontend/editor/src/core/ui/Avatar.css b/frontend/editor/src/core/ui/Avatar.css
index 795ebacc19..cdd6c3a096 100644
--- a/frontend/editor/src/core/ui/Avatar.css
+++ b/frontend/editor/src/core/ui/Avatar.css
@@ -46,7 +46,7 @@
   height: 2.5rem;
   font-size: 1rem;
 }
-/* Profile-picture preview: large enough to actually judge the image you uploaded. */
+/* Account-settings hero disc: large enough to judge the picture you uploaded. */
 .sui-avatar--xl {
   width: 4.5rem;
   height: 4.5rem;
diff --git a/frontend/editor/src/core/ui/Avatar.tsx b/frontend/editor/src/core/ui/Avatar.tsx
index 6b2793be42..05baed67c6 100644
--- a/frontend/editor/src/core/ui/Avatar.tsx
+++ b/frontend/editor/src/core/ui/Avatar.tsx
@@ -24,10 +24,12 @@ export interface AvatarProps {
   className?: string;
 }
 
-function initialsOf(name: string): string {
+function avatarInitials(name: string): string {
   const parts = name.trim().split(/\s+/).filter(Boolean);
   if (parts.length === 0) return "?";
-  if (parts.length === 1) return parts[0].slice(0, 2).toUpperCase();
+  // Single word (a username or an email) reads as one letter — two letters of
+  // "admin" ("AD") looks like a different person's initials, not a truncation.
+  if (parts.length === 1) return parts[0].slice(0, 1).toUpperCase();
   return (parts[0][0] + parts[parts.length - 1][0]).toUpperCase();
 }
 
@@ -44,9 +46,12 @@ export function Avatar({
   ariaLabel,
   className,
 }: AvatarProps) {
-  // A signed avatar URL can expire between render and load; fall back rather than show a broken icon.
-  const [failed, setFailed] = useState(false);
-  useEffect(() => setFailed(false), [src]);
+  // A picture URL that 404s (expired signed URL, deleted upload) must not leave
+  // an empty disc — fall back to the same initials the no-picture case shows, so
+  // every surface rendering this identity agrees on what it draws.
+  const [srcFailed, setSrcFailed] = useState(false);
+  useEffect(() => setSrcFailed(false), [src]);
+  const showImage = Boolean(src) && !srcFailed;
 
   const classes = [
     "sui-avatar",
@@ -58,20 +63,19 @@ export function Avatar({
     .filter(Boolean)
     .join(" ");
 
-  const content =
-    src && !failed ? (
-      // The wrapper already carries the accessible name, so the image itself is decorative.
-      <img
-        src={src}
-        alt=""
-        className="sui-avatar__img"
-        onError={() => setFailed(true)}
-      />
-    ) : (
-      <span className="sui-avatar__initials" aria-hidden>
-        {initialsOf(name)}
-      </span>
-    );
+  const content = showImage ? (
+    // The wrapper already carries the accessible name, so the image is decorative.
+    <img
+      src={src}
+      alt=""
+      className="sui-avatar__img"
+      onError={() => setSrcFailed(true)}
+    />
+  ) : (
+    <span className="sui-avatar__initials" aria-hidden>
+      {avatarInitials(name)}
+    </span>
+  );
 
   if (onClick) {
     return (
diff --git a/frontend/editor/src/core/ui/Button.css b/frontend/editor/src/core/ui/Button.css
index 529d97fe16..37d052a96e 100644
--- a/frontend/editor/src/core/ui/Button.css
+++ b/frontend/editor/src/core/ui/Button.css
@@ -15,6 +15,11 @@
   display: none;
 }
 
+/* ---- fat ---- */
+.sui-btn--fat.mantine-Button-root {
+  --button-radius: 0.75rem;
+}
+
 /* ---- shape ---- */
 .sui-btn--circle.mantine-Button-root {
   --button-radius: 50%;
diff --git a/frontend/editor/src/core/ui/Button.stories.tsx b/frontend/editor/src/core/ui/Button.stories.tsx
index 630d14010c..22e6c9464e 100644
--- a/frontend/editor/src/core/ui/Button.stories.tsx
+++ b/frontend/editor/src/core/ui/Button.stories.tsx
@@ -89,6 +89,7 @@ const meta: Meta<typeof Button> = {
       options: ["center", "start", "end", "between"],
     },
     shape: { control: "inline-radio", options: ["default", "circle", "pill"] },
+    fat: { control: "boolean" },
     text: { control: "text" },
   },
 };
@@ -203,6 +204,35 @@ export const Padding: Story = {
   ),
 };
 
+/** `fat` is the chunky CTA treatment: 2.75rem tall, 1.25rem side padding, 0.75rem corners. */
+export const Fat: Story = {
+  render: () => (
+    <div
+      style={{ display: "flex", flexDirection: "column", gap: 16, width: 460 }}
+    >
+      <Wrap>
+        <Button fat leftSection={<Plus />} text="Connect source" />
+        <Button fat variant="secondary" text="Export CSV" />
+      </Wrap>
+      <Wrap>
+        <Button fat variant="tertiary" text="Tertiary" />
+        <Button fat variant="quiet" text="Quiet" />
+        <Button fat accent="premium" leftSection={<Sparkle />} text="Upgrade" />
+        <Button fat accent="danger" text="Delete" />
+      </Wrap>
+      <Wrap>
+        <Button fat loading text="Saving" />
+        <Button fat disabled text="Disabled" />
+        <Button fat leftSection={<Plus />} aria-label="Add" />
+      </Wrap>
+      <Wrap>
+        <Button text="Default" />
+        <Button fat text="Fat" />
+      </Wrap>
+    </div>
+  ),
+};
+
 /** Icons are optional and positional: `leftSection`, `rightSection`, or both. */
 export const WithIcons: Story = {
   render: (args) => (
diff --git a/frontend/editor/src/core/ui/Button.tsx b/frontend/editor/src/core/ui/Button.tsx
index 2f46d5ab75..4b6bf2db85 100644
--- a/frontend/editor/src/core/ui/Button.tsx
+++ b/frontend/editor/src/core/ui/Button.tsx
@@ -42,6 +42,7 @@ type ButtonOwnProps = {
   variant?: ButtonVariant;
   accent?: ButtonAccent;
   size?: ButtonSize;
+  fat?: boolean;
   /** Label size relative to `size`. Defaults to the `size`-derived value. */
   fontSize?: ButtonFontSize;
   /** Padding override for both axes */
@@ -103,6 +104,9 @@ function ButtonGroup({
   );
 }
 
+const FAT_HEIGHT = "2.75rem";
+const FAT_PADDING_X = "lg" satisfies ControlPadding;
+
 const MANTINE_VARIANT: Record<ButtonVariant, string> = {
   primary: "filled",
   secondary: "outline",
@@ -123,6 +127,7 @@ const ButtonRoot = forwardRef<HTMLButtonElement, ButtonProps>(
       variant = "primary",
       accent = "default",
       size = "sm",
+      fat = false,
       fontSize,
       p,
       px,
@@ -161,7 +166,7 @@ const ButtonRoot = forwardRef<HTMLButtonElement, ButtonProps>(
         : undefined;
 
     // px/py override p for their axis; each stays undefined (= size default) if unset.
-    const padX = px ?? p;
+    const padX = px ?? p ?? (fat ? FAT_PADDING_X : undefined);
     const padY = py ?? p;
 
     // Sections flank a label → spread them without requiring justify="between".
@@ -175,6 +180,7 @@ const ButtonRoot = forwardRef<HTMLButtonElement, ButtonProps>(
       `sui-acc-${accent}`,
       `sui-btn--${variant}`,
       iconOnly ? "sui-btn--icon" : "",
+      fat ? "sui-btn--fat" : "",
       shape !== "default" ? `sui-btn--${shape}` : "",
       overflow === "wrap" ? "sui-btn--wrap" : "",
       !hover ? "sui-btn--no-hover" : "",
@@ -238,7 +244,9 @@ const ButtonRoot = forwardRef<HTMLButtonElement, ButtonProps>(
         className={classes}
         style={{
           ...(accentVars as CSSProperties),
-          ...({ "--button-height": CONTROL_HEIGHT[size] } as CSSProperties),
+          ...({
+            "--button-height": fat ? FAT_HEIGHT : CONTROL_HEIGHT[size],
+          } as CSSProperties),
           // Relative label size, scaled off the `size` base (unset → Mantine default).
           ...(fontSize
             ? ({
@@ -253,6 +261,10 @@ const ButtonRoot = forwardRef<HTMLButtonElement, ButtonProps>(
           ...(padY
             ? ({ "--sui-btn-py": CONTROL_PADDING[padY] } as CSSProperties)
             : {}),
+          // mantineTheme writes font-weight inline on every button root, so this must be inline too.
+          ...(fat
+            ? ({ fontWeight: "var(--font-weight-semibold)" } as CSSProperties)
+            : {}),
           // Icon-only: zero the size padding inline so the lone icon centres.
           ...(iconOnly ? ({ "--button-padding-x": "0" } as CSSProperties) : {}),
           ...style,
diff --git a/frontend/editor/src/core/ui/Card.css b/frontend/editor/src/core/ui/Card.css
index fcbefdab5b..62deaa0cf0 100644
--- a/frontend/editor/src/core/ui/Card.css
+++ b/frontend/editor/src/core/ui/Card.css
@@ -1,11 +1,6 @@
 .sui-card {
   position: relative;
-  background: var(--c-surface);
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-md);
   transition:
-    box-shadow var(--motion-fast),
     border-color var(--motion-fast),
     transform var(--motion-fast);
 }
@@ -28,7 +23,6 @@
 }
 .sui-card--interactive:hover {
   border-color: var(--c-border-strong);
-  box-shadow: var(--shadow-lg);
   transform: translateY(-0.0625rem);
 }
 
@@ -43,7 +37,7 @@
   left: 0;
   bottom: 0;
   width: 0.25rem;
-  border-radius: var(--radius-lg) 0 0 var(--radius-lg);
+  border-radius: var(--radius-nav) 0 0 var(--radius-nav);
 }
 .sui-card--accent-default::before {
   background: var(--c-primary);
diff --git a/frontend/editor/src/core/ui/Card.tsx b/frontend/editor/src/core/ui/Card.tsx
index dbdb1a393a..42d4c2d93a 100644
--- a/frontend/editor/src/core/ui/Card.tsx
+++ b/frontend/editor/src/core/ui/Card.tsx
@@ -1,4 +1,5 @@
 import type { HTMLAttributes, ReactNode } from "react";
+import "@app/ui/Surface.css";
 import "@app/ui/Card.css";
 
 /** Subset of the shared accent dial that has a styled strip (see Card.css). */
@@ -18,7 +19,7 @@ export interface CardProps extends HTMLAttributes<HTMLDivElement> {
    * (e.g. a list with row dividers).
    */
   padding?: "none" | "tight" | "default" | "loose";
-  /** Use the lifted surface treatment (taller shadow, hover affordance). */
+  /** Adds the clickable affordance (pointer cursor, hover lift). */
   interactive?: boolean;
   children?: ReactNode;
 }
@@ -40,6 +41,7 @@ export function Card({
     <div
       {...rest}
       className={[
+        "sui-surface",
         "sui-card",
         `sui-card--pad-${padding}`,
         accent ? `sui-card--accent-${accent}` : "",
diff --git a/frontend/editor/src/core/ui/CodeBlock.css b/frontend/editor/src/core/ui/CodeBlock.css
index 76ebea940c..3929c58c66 100644
--- a/frontend/editor/src/core/ui/CodeBlock.css
+++ b/frontend/editor/src/core/ui/CodeBlock.css
@@ -1,10 +1,9 @@
 .sui-code {
   background: var(--code-bg);
   color: var(--code-text);
-  border-radius: var(--radius-lg);
+  border-radius: var(--radius-nav);
   overflow: hidden;
   border: 1px solid var(--code-border);
-  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.15);
 }
 .sui-code__chrome {
   display: flex;
diff --git a/frontend/editor/src/core/ui/Collapsible.css b/frontend/editor/src/core/ui/Collapsible.css
index d0c1308f3b..6f7164dea5 100644
--- a/frontend/editor/src/core/ui/Collapsible.css
+++ b/frontend/editor/src/core/ui/Collapsible.css
@@ -1,6 +1,4 @@
 .sui-collapsible {
-  border: 1px solid var(--c-border-subtle);
-  border-radius: 0.5625rem;
   overflow: hidden;
 }
 
diff --git a/frontend/editor/src/core/ui/Collapsible.tsx b/frontend/editor/src/core/ui/Collapsible.tsx
index 94f1052056..229b2d2ef1 100644
--- a/frontend/editor/src/core/ui/Collapsible.tsx
+++ b/frontend/editor/src/core/ui/Collapsible.tsx
@@ -1,4 +1,5 @@
 import type { ReactNode } from "react";
+import "@app/ui/Surface.css";
 import "@app/ui/Collapsible.css";
 
 export interface CollapsibleProps {
@@ -29,7 +30,9 @@ export function Collapsible({
 }: CollapsibleProps) {
   return (
     <div
-      className={["sui-collapsible", className ?? ""].filter(Boolean).join(" ")}
+      className={["sui-surface", "sui-collapsible", className ?? ""]
+        .filter(Boolean)
+        .join(" ")}
     >
       <button
         type="button"
diff --git a/frontend/editor/src/core/ui/DataTable.css b/frontend/editor/src/core/ui/DataTable.css
new file mode 100644
index 0000000000..c7572efa90
--- /dev/null
+++ b/frontend/editor/src/core/ui/DataTable.css
@@ -0,0 +1,376 @@
+/*
+ * DataTable: the one Stirling table. Appearance is owned entirely here: the
+ * canonical surface, the header/row grammar, the standardized loading / empty /
+ * error states, and every cell KIND (`sui-dtc__*`). Call-sites choose a kind and
+ * supply data; they never style a cell. This is what lets every table look and
+ * behave the same.
+ */
+
+.sui-datatable {
+  width: 100%;
+}
+
+/* The one canonical surface: every table wears it; call-sites don't wrap it. */
+.sui-datatable__frame {
+  border: 1px solid var(--c-border);
+  border-radius: var(--radius-md);
+  background: var(--c-surface);
+  overflow: hidden;
+}
+
+.sui-datatable__toolbar {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  padding: 0.75rem 0.875rem;
+  border-bottom: 1px solid var(--c-border);
+}
+
+.sui-datatable__scroll {
+  width: 100%;
+  overflow-x: auto;
+}
+
+.sui-datatable__table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.8125rem;
+}
+
+.sui-datatable__caption {
+  caption-side: top;
+  text-align: left;
+  padding: 0.625rem 0.875rem;
+  color: var(--c-text-subtle);
+  font-size: 0.75rem;
+}
+
+/* Header */
+.sui-datatable__th {
+  text-align: left;
+  font-weight: 600;
+  color: var(--c-text-subtle);
+  font-size: 0.6875rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  padding: 0.625rem 0.875rem;
+  border-bottom: 1px solid var(--c-border);
+  white-space: nowrap;
+}
+.sui-datatable__th--right {
+  text-align: right;
+}
+.sui-datatable__th--fit {
+  width: 1%;
+}
+/* Accessible-only header text for blank affordance/action columns. */
+.sui-datatable__th-sr {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border: 0;
+}
+
+.sui-datatable__sort {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.25rem;
+  background: none;
+  border: none;
+  padding: 0;
+  margin: 0;
+  cursor: pointer;
+  font: inherit;
+  letter-spacing: inherit;
+  text-transform: inherit;
+  color: inherit;
+}
+.sui-datatable__th--right .sui-datatable__sort {
+  flex-direction: row-reverse;
+}
+.sui-datatable__sort:hover {
+  color: var(--c-text);
+}
+.sui-datatable__sort:focus-visible {
+  outline: 0.125rem solid var(--c-primary);
+  outline-offset: 0.125rem;
+  border-radius: var(--radius-sm);
+}
+.sui-datatable__sort-icon {
+  display: inline-flex;
+  color: var(--c-text-subtle);
+  opacity: 0;
+  transition: opacity var(--motion-fast);
+}
+.sui-datatable__sort:hover .sui-datatable__sort-icon {
+  opacity: 0.5;
+}
+.sui-datatable__sort-icon--asc,
+.sui-datatable__sort-icon--desc {
+  opacity: 1;
+  color: var(--c-primary);
+}
+.sui-datatable__sort-icon--desc svg {
+  transform: rotate(180deg);
+}
+
+/* Body */
+.sui-datatable__td {
+  padding: 0.625rem 0.875rem;
+  color: var(--c-text-muted);
+  border-bottom: 1px solid var(--c-border-subtle);
+  vertical-align: middle;
+}
+.sui-datatable__table tbody tr:last-child .sui-datatable__td {
+  border-bottom: none;
+}
+.sui-datatable__td--right {
+  text-align: right;
+}
+.sui-datatable__td--nowrap {
+  white-space: nowrap;
+}
+.sui-datatable__td--fit {
+  width: 1%;
+  white-space: nowrap;
+}
+
+/* Density (the compact variant) */
+.sui-datatable--compact .sui-datatable__th,
+.sui-datatable--compact .sui-datatable__td {
+  padding: 0.375rem 0.625rem;
+}
+
+/* Interactive rows */
+.sui-datatable__row--interactive {
+  cursor: pointer;
+  transition: background var(--motion-fast);
+}
+.sui-datatable__row--interactive:hover {
+  background: var(--c-hover);
+}
+.sui-datatable__row--interactive:focus-visible {
+  outline: 0.125rem solid var(--c-primary);
+  outline-offset: -0.125rem;
+}
+
+/* Non-actionable rows (e.g. coming-soon): de-emphasized to read as disabled.
+   Muting is done with accessible colours + a faded (non-text) icon rather than
+   row opacity, which would blend text under the WCAG contrast floor. */
+.sui-datatable__row--muted .sui-dtc__entity-name {
+  color: var(--c-text-muted);
+  font-weight: 500;
+}
+.sui-datatable__row--muted .sui-dtc__entity-icon {
+  opacity: 0.4;
+}
+
+.sui-datatable__chevron {
+  display: inline-flex;
+  color: var(--c-text-subtle);
+}
+
+/* Full-width state cell (empty / error) */
+.sui-datatable__state {
+  padding: 2rem;
+  text-align: center;
+  color: var(--c-text-subtle);
+}
+.sui-datatable__state--error {
+  color: var(--c-danger);
+}
+.sui-datatable__state--node {
+  padding: 0;
+}
+
+/*
+ * Cell kinds (sui-dtc__*): the locked cell vocabulary. These absorb the
+ * per-namespace portal-*__ cell styles (mono / muted / cell-stack / name-cell /
+ * caret …) that every table used to re-implement.
+ */
+.sui-dtc__text {
+  color: var(--c-text-muted);
+}
+/* Labeled value ("Category: action"): full-strength text, bold label. */
+.sui-dtc__text--labeled {
+  color: var(--c-text);
+}
+.sui-dtc__text-label {
+  font-weight: 600;
+}
+.sui-dtc__mono {
+  font-family: var(--font-mono);
+  font-size: 0.75rem;
+  color: var(--c-text-muted);
+}
+.sui-dtc__muted {
+  color: var(--c-text-subtle);
+}
+.sui-dtc__num {
+  font-variant-numeric: tabular-nums;
+}
+.sui-dtc__labels {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0.375rem;
+}
+
+/* entity: leading icon + bold name + optional muted note */
+.sui-dtc__entity {
+  display: flex;
+  align-items: center;
+  gap: 0.625rem;
+  min-width: 0;
+}
+.sui-dtc__entity-icon {
+  display: inline-flex;
+  align-items: center;
+  flex: none;
+  color: var(--c-text-muted);
+}
+/* The component sizes bare icons; self-styled marks (Avatar) render as-is. */
+.sui-dtc__entity-icon svg {
+  width: 1.2rem;
+  height: 1.2rem;
+}
+.sui-dtc__entity-body {
+  display: flex;
+  flex-direction: column;
+  gap: 0.1875rem;
+  min-width: 0;
+}
+.sui-dtc__entity-head {
+  display: flex;
+  align-items: baseline;
+  flex-wrap: wrap;
+  gap: 0.25rem;
+}
+.sui-dtc__entity-name {
+  font-weight: 600;
+  color: var(--c-text);
+}
+.sui-dtc__entity-suffix {
+  font-size: 0.75rem;
+  font-weight: 400;
+  color: var(--c-text-subtle);
+}
+.sui-dtc__note {
+  font-size: 0.75rem;
+  color: var(--c-text-subtle);
+}
+
+.sui-dtc__actions {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 0.25rem;
+}
+.sui-dtc__menu-item--danger {
+  color: var(--c-danger);
+}
+
+/* Grouped tables: section header row + per-group "show all" toggle. */
+.sui-datatable__group-cell {
+  padding: 0.5rem 0.875rem;
+  background: var(--c-surface-sunken, var(--c-hover));
+  border-bottom: 1px solid var(--c-border);
+}
+.sui-datatable__table
+  tbody
+  tr.sui-datatable__group:not(:first-child)
+  .sui-datatable__group-cell {
+  border-top: 1px solid var(--c-border);
+}
+.sui-datatable__group-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+}
+.sui-datatable__group-title {
+  display: flex;
+  align-items: baseline;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+}
+.sui-datatable__group-title strong {
+  font-size: 0.8125rem;
+  color: var(--c-text);
+}
+.sui-datatable__group-meta {
+  font-size: 0.75rem;
+  color: var(--c-text-subtle);
+}
+.sui-datatable__group-more {
+  padding: 0.5rem 0.875rem;
+}
+.sui-datatable__show-all {
+  background: none;
+  border: none;
+  padding: 0;
+  cursor: pointer;
+  font: inherit;
+  font-size: 0.75rem;
+  color: var(--c-accent-text);
+}
+.sui-datatable__show-all:hover {
+  text-decoration: underline;
+}
+
+.sui-dtc__progress {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+.sui-dtc__progress-bar {
+  display: block;
+  width: 5rem;
+}
+.sui-dtc__progress-pct {
+  font-variant-numeric: tabular-nums;
+  color: var(--c-text-muted);
+  min-width: 2.5rem;
+}
+
+.sui-dtc__links {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 0.75rem;
+}
+/* Neutral chip-style link (matches the invoice-link look): the colour is not an
+ * accent - the trailing glyph + hover fill carry the affordance. */
+.sui-dtc__link {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.25rem;
+  padding: 0.25rem 0.5rem;
+  border-radius: var(--radius-sm);
+  color: var(--c-text);
+  text-decoration: none;
+  font-weight: 500;
+  border: 1px solid transparent;
+  transition:
+    background var(--motion-fast),
+    border-color var(--motion-fast);
+}
+.sui-dtc__link:hover {
+  background: var(--c-surface-sunken);
+  border-color: var(--c-border);
+}
+.sui-dtc__link:focus-visible {
+  outline: none;
+  border-color: var(--c-primary);
+  background: var(--c-surface-sunken);
+}
+
+.sui-dtc__select {
+  min-width: 13rem;
+}
diff --git a/frontend/editor/src/core/ui/DataTable.stories.tsx b/frontend/editor/src/core/ui/DataTable.stories.tsx
new file mode 100644
index 0000000000..630537ace9
--- /dev/null
+++ b/frontend/editor/src/core/ui/DataTable.stories.tsx
@@ -0,0 +1,262 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Button } from "@app/ui/Button";
+import { column, DataTable, type DataTableColumn } from "@app/ui/DataTable";
+
+interface Region {
+  id: string;
+  name: string;
+  code: string;
+  status: "healthy" | "degraded";
+  docs: number;
+  latency: number;
+  auto: boolean;
+}
+
+const REGIONS: Region[] = [
+  {
+    id: "1",
+    name: "US East",
+    code: "us-east-1",
+    status: "healthy",
+    docs: 12481,
+    latency: 41,
+    auto: true,
+  },
+  {
+    id: "2",
+    name: "US West",
+    code: "us-west-2",
+    status: "healthy",
+    docs: 8210,
+    latency: 63,
+    auto: false,
+  },
+  {
+    id: "3",
+    name: "EU West",
+    code: "eu-west-1",
+    status: "degraded",
+    docs: 3044,
+    latency: 190,
+    auto: true,
+  },
+  {
+    id: "4",
+    name: "AP South",
+    code: "ap-south-1",
+    status: "healthy",
+    docs: 5622,
+    latency: 88,
+    auto: false,
+  },
+];
+
+const tone = (r: Region) => ({
+  tone: r.status === "healthy" ? ("success" as const) : ("warning" as const),
+  label: r.status,
+});
+
+const COLUMNS: DataTableColumn<Region>[] = [
+  column.entity({
+    key: "name",
+    header: "Region",
+    primary: (r) => r.name,
+  }),
+  column.mono({ key: "code", header: "Code", get: (r) => r.code }),
+  column.badge({ key: "status", header: "Status", get: tone }),
+  column.number({
+    key: "docs",
+    header: "Docs 24h",
+    get: (r) => r.docs,
+    format: (n) => n.toLocaleString(),
+  }),
+  column.number({
+    key: "latency",
+    header: "P95",
+    get: (r) => r.latency,
+    format: (n) => `${n} ms`,
+  }),
+];
+
+const SORTABLE_COLUMNS: DataTableColumn<Region>[] = [
+  column.entity({
+    key: "name",
+    header: "Region",
+    primary: (r) => r.name,
+    sortable: true,
+  }),
+  column.mono({
+    key: "code",
+    header: "Code",
+    get: (r) => r.code,
+    sortable: true,
+  }),
+  column.badge({ key: "status", header: "Status", get: tone, sortable: true }),
+  column.number({
+    key: "docs",
+    header: "Docs 24h",
+    get: (r) => r.docs,
+    format: (n) => n.toLocaleString(),
+    sortable: true,
+  }),
+  column.number({
+    key: "latency",
+    header: "P95",
+    get: (r) => r.latency,
+    format: (n) => `${n} ms`,
+    sortable: true,
+  }),
+];
+
+const meta: Meta<typeof DataTable> = {
+  title: "Compound/DataTable",
+  component: DataTable,
+  tags: ["autodocs"],
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof DataTable>;
+
+/** Columns come from the `column` vocabulary; call-sites never style a cell. */
+export const Basic: Story = {
+  render: () => (
+    <DataTable<Region> columns={COLUMNS} rows={REGIONS} rowKey={(r) => r.id} />
+  ),
+};
+
+/** Sorting is opt-in per column (`sortable: true`); click a header. */
+export const Sortable: Story = {
+  render: () => (
+    <DataTable<Region>
+      columns={SORTABLE_COLUMNS}
+      rows={REGIONS}
+      rowKey={(r) => r.id}
+      defaultSort={{ key: "docs", direction: "desc" }}
+    />
+  ),
+};
+
+/** `onRowClick` + a chevron affordance. The line above shows the click land. */
+export const Interactive: Story = {
+  render: () => {
+    function Bound() {
+      const [clicked, setClicked] = useState<Region | null>(null);
+      return (
+        <>
+          <p
+            style={{
+              marginBottom: "0.75rem",
+              fontSize: "0.8125rem",
+              color: "var(--c-text-muted)",
+            }}
+          >
+            {clicked
+              ? `Clicked: ${clicked.name} (${clicked.code})`
+              : "Click a row to fire onRowClick."}
+          </p>
+          <DataTable<Region>
+            columns={COLUMNS}
+            rows={REGIONS}
+            rowKey={(r) => r.id}
+            onRowClick={setClicked}
+            rowAffordance="chevron"
+          />
+        </>
+      );
+    }
+    return <Bound />;
+  },
+};
+
+/** A trailing action column (icon-only kebab), locked to the design system. */
+export const WithActions: Story = {
+  render: () => (
+    <DataTable<Region>
+      columns={[
+        ...COLUMNS,
+        column.actions({
+          key: "actions",
+          get: () => [
+            {
+              label: "Row actions",
+              glyph: "kebab",
+              iconOnly: true,
+              onClick: () => {},
+            },
+          ],
+        }),
+      ]}
+      rows={REGIONS}
+      rowKey={(r) => r.id}
+    />
+  ),
+};
+
+/** First-load skeleton mirrors the real column layout. */
+export const Loading: Story = {
+  render: () => (
+    <DataTable<Region>
+      columns={COLUMNS}
+      rows={[]}
+      rowKey={(r) => r.id}
+      loading
+    />
+  ),
+};
+
+/** Standardized empty slot. */
+export const Empty: Story = {
+  render: () => (
+    <DataTable<Region>
+      columns={COLUMNS}
+      rows={[]}
+      rowKey={(r) => r.id}
+      empty="No regions deployed yet."
+    />
+  ),
+};
+
+/** Standardized error slot (announced as an alert). */
+export const ErrorState: Story = {
+  render: () => (
+    <DataTable<Region>
+      columns={COLUMNS}
+      rows={[]}
+      rowKey={(r) => r.id}
+      error="Couldn't load regions. Try again."
+    />
+  ),
+};
+
+/** Optional toolbar slot above the table, inside the surface. */
+export const WithToolbar: Story = {
+  render: () => (
+    <DataTable<Region>
+      columns={COLUMNS}
+      rows={REGIONS}
+      rowKey={(r) => r.id}
+      toolbar={
+        <>
+          <strong style={{ fontSize: "0.8125rem" }}>Regions</strong>
+          <span style={{ flex: 1 }} />
+          <Button variant="secondary" size="sm">
+            Export
+          </Button>
+        </>
+      }
+    />
+  ),
+};
+
+/** The one look choice: the `compact` variant. */
+export const Compact: Story = {
+  render: () => (
+    <DataTable<Region>
+      columns={COLUMNS}
+      rows={REGIONS}
+      rowKey={(r) => r.id}
+      variant="compact"
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/ui/DataTable.tsx b/frontend/editor/src/core/ui/DataTable.tsx
new file mode 100644
index 0000000000..ccb5578016
--- /dev/null
+++ b/frontend/editor/src/core/ui/DataTable.tsx
@@ -0,0 +1,516 @@
+import { type KeyboardEvent, type ReactNode, useMemo, useState } from "react";
+import {
+  type ColumnDef,
+  createColumnHelper,
+  createSortedRowModel,
+  flexRender,
+  type RowData,
+  rowSortingFeature,
+  sortFn_alphanumeric,
+  sortFn_basic,
+  type SortingState,
+  tableFeatures,
+  useTable,
+} from "@tanstack/react-table";
+import { useTranslation } from "react-i18next";
+import { Skeleton } from "@app/ui/Skeleton";
+import {
+  type CellAction,
+  type DataTableColumn,
+  renderCellActions,
+} from "@app/ui/dataTableColumns";
+import "@app/ui/DataTable.css";
+
+export * from "@app/ui/dataTableColumns";
+
+/** Per-column presentation carried through TanStack's typed `meta` slot. */
+interface ColumnMeta {
+  align: "left" | "right";
+  nowrap: boolean;
+  fit: boolean;
+  /** Visually-hidden header text for blank affordance/action columns, so the
+   *  column still has an accessible name (avoids axe `empty-table-header`). */
+  srHeader?: string;
+}
+
+/**
+ * Feature registry for every DataTable, built once. Sorting is always
+ * registered so any column can opt in; the core row model defaults in.
+ */
+const DATA_TABLE_FEATURES = tableFeatures({
+  rowSortingFeature,
+  sortedRowModel: createSortedRowModel(),
+  columnMeta: {} as ColumnMeta,
+  // Register the comparators the column vocabulary uses. Without this v9 falls
+  // back to a case-sensitive `basic` sort and warns per column.
+  sortFns: { alphanumeric: sortFn_alphanumeric, basic: sortFn_basic },
+});
+type DataTableFeatures = typeof DATA_TABLE_FEATURES;
+
+/** Closed appearance dial — the only look choice a call-site may make. */
+export type DataTableVariant = "default" | "compact";
+
+/**
+ * A collapsible section of rows under a locked header. Group headers are
+ * structured (title + muted meta + optional right-aligned actions), never raw
+ * markup, so grouped tables stay as opinionated as flat ones. Provide `groups`
+ * instead of `rows`.
+ */
+export interface DataTableGroup<T> {
+  key: string;
+  title: string;
+  /** Muted sub-text on the header (e.g. "5 people · led by Dana"). */
+  meta?: string;
+  /** Right-aligned header actions (e.g. "Add to team", a kebab menu). */
+  actions?: CellAction[];
+  rows: T[];
+  /** Collapse rows past this count behind a "Show all N" toggle. */
+  collapseAfter?: number;
+  /** Render the group's rows greyed/disabled (non-actionable, e.g. coming-soon). */
+  muted?: boolean;
+}
+
+export interface DataTableProps<T> {
+  /** Columns built with the `column` vocabulary — never raw JSX. */
+  columns: DataTableColumn<T>[];
+  /** Flat rows. Provide this OR `groups`, not both. */
+  rows?: T[];
+  /** Grouped rows with section headers. Takes precedence over `rows`. */
+  groups?: DataTableGroup<T>[];
+  rowKey: (row: T) => string;
+
+  /** Makes rows interactive (hover + click + keyboard). */
+  onRowClick?: (row: T) => void;
+  /** Per-row interactivity gate, checked only when `onRowClick` is set. */
+  isRowInteractive?: (row: T) => boolean;
+  /** Trailing affordance drawn on interactive rows. */
+  rowAffordance?: "none" | "chevron";
+
+  /** Initial sort, applied to the matching sortable column. */
+  defaultSort?: { key: string; direction?: "asc" | "desc" };
+
+  /** First-load state: renders column-shaped skeleton rows under the header. */
+  loading?: boolean;
+  /** Skeleton row count while loading. Defaults to 6. */
+  skeletonRows?: number;
+  /** Error slot — replaces the rows with an alert message row. */
+  error?: ReactNode;
+  /** Shown when there are no rows (and not loading / no error). Text or a node. */
+  empty?: ReactNode;
+
+  /** Content above the table (filters, search, actions), inside the surface. */
+  toolbar?: ReactNode;
+  /** The only appearance choice. */
+  variant?: DataTableVariant;
+  /** Accessible caption for the table. */
+  caption?: string;
+  /** Labels for a group's "show all / show less" toggle (pass translated).
+   *  `showAll` receives the group's total row count. */
+  collapseLabels?: { showAll: (total: number) => string; showLess: string };
+}
+
+function ChevronGlyph() {
+  return (
+    <svg width="16" height="16" viewBox="0 0 24 24" fill="none" aria-hidden>
+      <path
+        d="m9 6 6 6-6 6"
+        stroke="currentColor"
+        strokeWidth="2"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+      />
+    </svg>
+  );
+}
+
+function SortGlyph() {
+  return (
+    <svg
+      width="10"
+      height="10"
+      viewBox="0 0 24 24"
+      fill="currentColor"
+      aria-hidden
+    >
+      <path d="M12 8 6 15h12z" />
+    </svg>
+  );
+}
+
+const CHEVRON_COLUMN_KEY = "__affordance";
+
+/**
+ * The shared Stirling table. Call-sites supply data + behaviour; the component
+ * owns 100% of the appearance. Columns come from the `column` vocabulary (typed
+ * cell kinds, no raw markup), the surface / density / states are standardized
+ * here, and the only look choice exposed is the closed `variant`. Behaviour -
+ * sorting today, more later - is opt-in per column or via props.
+ */
+export function DataTable<T extends RowData>({
+  columns,
+  rows = [],
+  groups,
+  rowKey,
+  onRowClick,
+  isRowInteractive,
+  rowAffordance = "none",
+  defaultSort,
+  loading = false,
+  skeletonRows = 6,
+  error,
+  empty,
+  toolbar,
+  variant = "default",
+  caption,
+  collapseLabels = {
+    showAll: (n) => `Show all ${n}`,
+    showLess: "Show less",
+  },
+}: DataTableProps<T>) {
+  const { t } = useTranslation();
+  const [sorting, setSorting] = useState<SortingState>(
+    defaultSort
+      ? [{ id: defaultSort.key, desc: defaultSort.direction === "desc" }]
+      : [],
+  );
+  const [openGroups, setOpenGroups] = useState<Set<string>>(new Set());
+  const toggleGroup = (key: string) =>
+    setOpenGroups((prev) => {
+      const next = new Set(prev);
+      if (next.has(key)) next.delete(key);
+      else next.add(key);
+      return next;
+    });
+
+  // The data source is either grouped or flat; TanStack (headers, sorting for
+  // the flat path) is fed the flattened rows.
+  const flatRows = useMemo(
+    () => (groups ? groups.flatMap((g) => g.rows) : rows),
+    [groups, rows],
+  );
+
+  const interactive = Boolean(onRowClick);
+  const showChevron = interactive && rowAffordance === "chevron";
+  // A row that holds its own controls (actions/links/select/caps) can't also be
+  // a `role="button"` (a button may not contain interactive descendants); it
+  // keeps the click as a mouse shortcut, and the inner control is the keyboard path.
+  const rowsContainControls = columns.some((c) => c.interactive);
+
+  const effectiveColumns = useMemo<DataTableColumn<T>[]>(() => {
+    if (!showChevron) return columns;
+    return [
+      ...columns,
+      {
+        key: CHEVRON_COLUMN_KEY,
+        header: "",
+        align: "right",
+        nowrap: true,
+        fit: true,
+        sortable: false,
+        renderCell: (row) =>
+          (isRowInteractive?.(row) ?? true) ? (
+            <span className="sui-datatable__chevron" aria-hidden>
+              <ChevronGlyph />
+            </span>
+          ) : null,
+      },
+    ];
+  }, [columns, showChevron, isRowInteractive]);
+
+  const tanstackColumns = useMemo<ColumnDef<DataTableFeatures, T>[]>(() => {
+    const helper = createColumnHelper<DataTableFeatures, T>();
+    return effectiveColumns.map((c) => {
+      // A blank header (trailing affordance/action columns) still needs an
+      // accessible name for assistive tech.
+      const srHeader = c.header
+        ? undefined
+        : c.key === CHEVRON_COLUMN_KEY
+          ? t("common.open", "Open")
+          : t("common.actions", "Actions");
+      const meta: ColumnMeta = {
+        align: c.align,
+        nowrap: c.nowrap,
+        fit: c.fit,
+        srHeader,
+      };
+      if (c.sortable && c.sortValue) {
+        const sortValue = c.sortValue;
+        return helper.accessor((row: T): unknown => sortValue(row), {
+          id: c.key,
+          header: () => c.header,
+          cell: (ctx) => c.renderCell(ctx.row.original),
+          enableSorting: true,
+          sortUndefined: "last",
+          sortFn: c.sortFn ?? "basic",
+          meta,
+        });
+      }
+      return helper.display({
+        id: c.key,
+        header: () => c.header,
+        cell: (ctx) => c.renderCell(ctx.row.original),
+        meta,
+      });
+    });
+  }, [effectiveColumns, t]);
+
+  const table = useTable({
+    features: DATA_TABLE_FEATURES,
+    data: flatRows,
+    columns: tanstackColumns,
+    state: { sorting },
+    onSortingChange: setSorting,
+    getRowId: (row) => rowKey(row),
+  });
+
+  const colCount = effectiveColumns.length;
+
+  // Shared row wiring so grouped rows behave like flat ones (interactivity +
+  // the affordance column) instead of being a second-class path.
+  const rowProps = (original: T, muted?: boolean) => {
+    const rowInteractive =
+      interactive && (isRowInteractive?.(original) ?? true);
+    // A row that owns the whole interaction takes the button role + keyboard
+    // handling; a row with its own controls keeps just the mouse click.
+    const asButton = rowInteractive && !rowsContainControls;
+    return {
+      className: [
+        "sui-datatable__row",
+        rowInteractive ? "sui-datatable__row--interactive" : "",
+        muted ? "sui-datatable__row--muted" : "",
+      ]
+        .filter(Boolean)
+        .join(" "),
+      onClick: rowInteractive ? () => onRowClick?.(original) : undefined,
+      tabIndex: asButton ? 0 : undefined,
+      role: asButton ? ("button" as const) : undefined,
+      onKeyDown: asButton
+        ? (e: KeyboardEvent<HTMLTableRowElement>) => {
+            if (e.key === "Enter" || e.key === " ") {
+              e.preventDefault();
+              onRowClick?.(original);
+            }
+          }
+        : undefined,
+    };
+  };
+
+  // No rows at all - covers a grouped table whose groups are all empty (or an
+  // empty groups list), which would otherwise render a header-only table.
+  const noRows = groups
+    ? groups.every((g) => g.rows.length === 0)
+    : rows.length === 0;
+
+  let body: ReactNode;
+  if (loading) {
+    body = Array.from({ length: skeletonRows }).map((_, r) => (
+      <tr key={`skeleton-${r}`} className="sui-datatable__row">
+        {effectiveColumns.map((c) => (
+          <td key={c.key} className={cellClass(c.align, c.nowrap, c.fit)}>
+            <Skeleton
+              height="0.75rem"
+              width={c.align === "right" || c.fit ? "40%" : "70%"}
+            />
+          </td>
+        ))}
+      </tr>
+    ));
+  } else if (error != null) {
+    body = (
+      <tr>
+        <td
+          className="sui-datatable__state sui-datatable__state--error"
+          colSpan={colCount}
+          role="alert"
+        >
+          {error}
+        </td>
+      </tr>
+    );
+  } else if (noRows) {
+    const isNode = typeof empty === "object" && empty !== null;
+    body = (
+      <tr>
+        <td
+          className={
+            isNode
+              ? "sui-datatable__state sui-datatable__state--node"
+              : "sui-datatable__state"
+          }
+          colSpan={colCount}
+        >
+          {empty ?? "No data"}
+        </td>
+      </tr>
+    );
+  } else if (groups) {
+    body = groups.flatMap((g) => {
+      const limit = g.collapseAfter ?? Infinity;
+      const open = openGroups.has(g.key);
+      const overflow = g.rows.length > limit;
+      const shown = overflow && !open ? g.rows.slice(0, limit) : g.rows;
+      const header = (
+        <tr key={`group-${g.key}`} className="sui-datatable__group">
+          <td colSpan={colCount} className="sui-datatable__group-cell">
+            <div className="sui-datatable__group-head">
+              <div className="sui-datatable__group-title">
+                <strong>{g.title}</strong>
+                {g.meta && (
+                  <span className="sui-datatable__group-meta">{g.meta}</span>
+                )}
+              </div>
+              {g.actions &&
+                g.actions.length > 0 &&
+                renderCellActions(g.actions)}
+            </div>
+          </td>
+        </tr>
+      );
+      const rowEls = shown.map((row) => (
+        <tr
+          key={rowKey(row)}
+          data-row-key={rowKey(row)}
+          {...rowProps(row, g.muted)}
+        >
+          {effectiveColumns.map((c) => (
+            <td key={c.key} className={cellClass(c.align, c.nowrap, c.fit)}>
+              {c.renderCell(row)}
+            </td>
+          ))}
+        </tr>
+      ));
+      const moreEl = overflow ? (
+        <tr key={`more-${g.key}`}>
+          <td colSpan={colCount} className="sui-datatable__group-more">
+            <button
+              type="button"
+              className="sui-datatable__show-all"
+              onClick={() => toggleGroup(g.key)}
+            >
+              {open
+                ? collapseLabels.showLess
+                : collapseLabels.showAll(g.rows.length)}
+            </button>
+          </td>
+        </tr>
+      ) : null;
+      return moreEl ? [header, ...rowEls, moreEl] : [header, ...rowEls];
+    });
+  } else {
+    body = table.getRowModel().rows.map((row) => (
+      <tr key={row.id} data-row-key={row.id} {...rowProps(row.original)}>
+        {row.getAllCells().map((cell) => {
+          const meta = cell.column.columnDef.meta;
+          return (
+            <td
+              key={cell.id}
+              className={cellClass(
+                meta?.align ?? "left",
+                meta?.nowrap ?? false,
+                meta?.fit ?? false,
+              )}
+            >
+              {flexRender(cell.column.columnDef.cell, cell.getContext())}
+            </td>
+          );
+        })}
+      </tr>
+    ));
+  }
+
+  return (
+    <div className={`sui-datatable sui-datatable--${variant}`}>
+      <div className="sui-datatable__frame">
+        {toolbar && <div className="sui-datatable__toolbar">{toolbar}</div>}
+        <div className="sui-datatable__scroll">
+          <table className="sui-datatable__table">
+            {caption && (
+              <caption className="sui-datatable__caption">{caption}</caption>
+            )}
+            <thead>
+              {table.getHeaderGroups().map((headerGroup) => (
+                <tr key={headerGroup.id}>
+                  {headerGroup.headers.map((header) => {
+                    const meta = header.column.columnDef.meta;
+                    const align = meta?.align ?? "left";
+                    const canSort = header.column.getCanSort();
+                    const sorted = header.column.getIsSorted();
+                    const label = header.isPlaceholder
+                      ? null
+                      : flexRender(
+                          header.column.columnDef.header,
+                          header.getContext(),
+                        );
+                    return (
+                      <th
+                        key={header.id}
+                        scope="col"
+                        className={headerClass(align, meta?.fit ?? false)}
+                        aria-sort={
+                          canSort
+                            ? sorted === "asc"
+                              ? "ascending"
+                              : sorted === "desc"
+                                ? "descending"
+                                : "none"
+                            : undefined
+                        }
+                      >
+                        {canSort ? (
+                          <button
+                            type="button"
+                            className="sui-datatable__sort"
+                            onClick={header.column.getToggleSortingHandler()}
+                          >
+                            {label}
+                            <span
+                              className={`sui-datatable__sort-icon sui-datatable__sort-icon--${sorted || "none"}`}
+                            >
+                              <SortGlyph />
+                            </span>
+                          </button>
+                        ) : meta?.srHeader ? (
+                          <span className="sui-datatable__th-sr">
+                            {meta.srHeader}
+                          </span>
+                        ) : (
+                          label
+                        )}
+                      </th>
+                    );
+                  })}
+                </tr>
+              ))}
+            </thead>
+            <tbody>{body}</tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function cellClass(
+  align: "left" | "right",
+  nowrap: boolean,
+  fit: boolean,
+): string {
+  return [
+    "sui-datatable__td",
+    `sui-datatable__td--${align}`,
+    nowrap ? "sui-datatable__td--nowrap" : "",
+    fit ? "sui-datatable__td--fit" : "",
+  ]
+    .filter(Boolean)
+    .join(" ");
+}
+
+function headerClass(align: "left" | "right", fit: boolean): string {
+  return [
+    "sui-datatable__th",
+    `sui-datatable__th--${align}`,
+    fit ? "sui-datatable__th--fit" : "",
+  ]
+    .filter(Boolean)
+    .join(" ");
+}
diff --git a/frontend/editor/src/core/ui/Dropdown.css b/frontend/editor/src/core/ui/Dropdown.css
index 8b84af29f1..d71026d881 100644
--- a/frontend/editor/src/core/ui/Dropdown.css
+++ b/frontend/editor/src/core/ui/Dropdown.css
@@ -4,28 +4,20 @@
 }
 
 .sui-dd__menu {
-  position: absolute;
-  top: calc(100% + var(--space-1));
+  /* Positioned (fixed, portaled to <body>) entirely by the Menu component. */
   min-width: 12rem;
   padding: var(--space-1);
   background: var(--c-surface);
   border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
   box-shadow: var(--shadow-lg);
-  z-index: var(--z-dropdown);
+  z-index: var(--z-popover);
   animation: fadeInUp var(--motion-enter) both;
   display: flex;
   flex-direction: column;
   gap: 0.0625rem;
 }
 
-.sui-dd__menu--start {
-  left: 0;
-}
-.sui-dd__menu--end {
-  right: 0;
-}
-
 .sui-dd__item {
   display: flex;
   align-items: center;
diff --git a/frontend/editor/src/core/ui/Dropdown.tsx b/frontend/editor/src/core/ui/Dropdown.tsx
index bf481c9ea5..25019d7c3c 100644
--- a/frontend/editor/src/core/ui/Dropdown.tsx
+++ b/frontend/editor/src/core/ui/Dropdown.tsx
@@ -6,12 +6,14 @@ import {
   useContext,
   useEffect,
   useId,
+  useLayoutEffect,
   useMemo,
   useRef,
   useState,
   type ReactElement,
   type ReactNode,
 } from "react";
+import { createPortal } from "react-dom";
 import "@app/ui/Dropdown.css";
 
 type Alignment = "start" | "end";
@@ -20,6 +22,8 @@ interface DropdownContextValue {
   open: boolean;
   setOpen: (open: boolean) => void;
   triggerRef: React.RefObject<HTMLElement | null>;
+  /** The portaled menu element, so click-outside can exclude it. */
+  menuRef: React.RefObject<HTMLDivElement | null>;
   menuId: string;
   align: Alignment;
 }
@@ -68,15 +72,20 @@ function Root({
 
   const triggerRef = useRef<HTMLElement | null>(null);
   const containerRef = useRef<HTMLDivElement | null>(null);
+  const menuRef = useRef<HTMLDivElement | null>(null);
   const menuId = useId();
 
-  // Click-outside + Escape close.
+  // Click-outside + Escape close. The menu is portaled to <body>, so it is not
+  // inside containerRef - check it separately or a click on it would close the
+  // menu before the item's handler runs.
   useEffect(() => {
     if (!open) return;
     function onDocClick(e: MouseEvent) {
+      const target = e.target as Node;
       if (
         containerRef.current &&
-        !containerRef.current.contains(e.target as Node)
+        !containerRef.current.contains(target) &&
+        !(menuRef.current && menuRef.current.contains(target))
       ) {
         setOpen(false);
       }
@@ -96,7 +105,7 @@ function Root({
   }, [open, setOpen]);
 
   const value = useMemo<DropdownContextValue>(
-    () => ({ open, setOpen, triggerRef, menuId, align }),
+    () => ({ open, setOpen, triggerRef, menuRef, menuId, align }),
     [open, setOpen, menuId, align],
   );
 
@@ -150,23 +159,79 @@ export interface DropdownMenuProps {
 }
 
 function Menu({ children, className, width }: DropdownMenuProps) {
-  const { open, menuId, align } = useDropdownCtx();
-  if (!open) return null;
-  const style =
-    width !== undefined
+  const { open, menuId, align, triggerRef, menuRef } = useDropdownCtx();
+  // Fixed position tracked to the trigger. Portaling to <body> keeps the menu
+  // out of any `overflow` ancestor (e.g. a table's horizontal scroll area),
+  // which would otherwise clip it and add a scrollbar.
+  const [pos, setPos] = useState<{
+    top?: number;
+    bottom?: number;
+    left?: number;
+    right?: number;
+    maxHeight: number;
+  } | null>(null);
+
+  useLayoutEffect(() => {
+    if (!open) return;
+    const place = () => {
+      const el = triggerRef.current;
+      if (!el) return;
+      const r = el.getBoundingClientRect();
+      const gap = 4;
+      const margin = 8;
+      const spaceBelow = window.innerHeight - r.bottom - margin;
+      const spaceAbove = r.top - margin;
+      // Flip above when there's more room there, so a trigger near the viewport
+      // bottom doesn't open a fixed menu that runs off-screen and can't scroll.
+      const below = spaceBelow >= spaceAbove;
+      const horizontal =
+        align === "end"
+          ? { right: window.innerWidth - r.right }
+          : { left: r.left };
+      setPos({
+        ...horizontal,
+        ...(below
+          ? { top: r.bottom + gap }
+          : { bottom: window.innerHeight - r.top + gap }),
+        maxHeight: Math.max(0, (below ? spaceBelow : spaceAbove) - gap),
+      });
+    };
+    place();
+    // Track the trigger while scrolling/resizing (capture catches inner scrollers).
+    window.addEventListener("scroll", place, true);
+    window.addEventListener("resize", place);
+    return () => {
+      window.removeEventListener("scroll", place, true);
+      window.removeEventListener("resize", place);
+    };
+  }, [open, align, triggerRef]);
+
+  if (!open || !pos) return null;
+  const style: React.CSSProperties = {
+    position: "fixed",
+    // Explicit auto (not undefined) so the CSS fallback `top`/`left` can't leak
+    // in on the axis this placement isn't pinning.
+    top: pos.top ?? "auto",
+    bottom: pos.bottom ?? "auto",
+    left: pos.left ?? "auto",
+    right: pos.right ?? "auto",
+    maxHeight: pos.maxHeight,
+    overflowY: "auto",
+    ...(width !== undefined
       ? { minWidth: typeof width === "number" ? `${width}px` : width }
-      : undefined;
-  return (
+      : {}),
+  };
+  return createPortal(
     <div
       id={menuId}
       role="menu"
-      className={["sui-dd__menu", `sui-dd__menu--${align}`, className ?? ""]
-        .filter(Boolean)
-        .join(" ")}
+      ref={menuRef}
+      className={["sui-dd__menu", className ?? ""].filter(Boolean).join(" ")}
       style={style}
     >
       {children}
-    </div>
+    </div>,
+    document.body,
   );
 }
 
diff --git a/frontend/editor/src/core/ui/MetricCard.css b/frontend/editor/src/core/ui/MetricCard.css
index 520342c65a..ae61a7abd1 100644
--- a/frontend/editor/src/core/ui/MetricCard.css
+++ b/frontend/editor/src/core/ui/MetricCard.css
@@ -3,12 +3,7 @@
   flex-direction: column;
   gap: 0.5rem;
   padding: 1.125rem 1.25rem;
-  background: var(--c-surface);
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-md);
   transition:
-    box-shadow var(--motion-fast),
     transform var(--motion-fast),
     border-color var(--motion-fast);
   min-width: 10rem;
@@ -37,7 +32,6 @@
 }
 .sui-metric--interactive:hover {
   border-color: var(--c-border-strong);
-  box-shadow: var(--shadow-lg);
   transform: translateY(-0.0625rem);
 }
 .sui-metric--interactive:focus-visible {
diff --git a/frontend/editor/src/core/ui/MetricCard.tsx b/frontend/editor/src/core/ui/MetricCard.tsx
index cd61580095..651a7d4065 100644
--- a/frontend/editor/src/core/ui/MetricCard.tsx
+++ b/frontend/editor/src/core/ui/MetricCard.tsx
@@ -1,4 +1,5 @@
 import type { ReactNode } from "react";
+import "@app/ui/Surface.css";
 import "@app/ui/MetricCard.css";
 
 export type DeltaDirection = "up" | "down" | "flat";
@@ -52,6 +53,7 @@ export function MetricCard({
   const interactive = !!onClick;
 
   const classes = [
+    "sui-surface",
     "sui-metric",
     `sui-metric--${size}`,
     emphasis === "primary" ? "sui-metric--primary" : "",
diff --git a/frontend/editor/src/core/ui/MetricStrip.css b/frontend/editor/src/core/ui/MetricStrip.css
index 8344fe1393..6497d26684 100644
--- a/frontend/editor/src/core/ui/MetricStrip.css
+++ b/frontend/editor/src/core/ui/MetricStrip.css
@@ -21,10 +21,6 @@
   align-items: center;
   gap: 1.75rem;
   padding: 0.625rem 1.25rem;
-  background: var(--c-surface);
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-sm);
 }
 
 .sui-metric-strip__leading {
diff --git a/frontend/editor/src/core/ui/MetricStrip.tsx b/frontend/editor/src/core/ui/MetricStrip.tsx
index b9e2a03bb3..ded2db624a 100644
--- a/frontend/editor/src/core/ui/MetricStrip.tsx
+++ b/frontend/editor/src/core/ui/MetricStrip.tsx
@@ -1,4 +1,5 @@
 import type { ReactNode } from "react";
+import "@app/ui/Surface.css";
 import "@app/ui/MetricStrip.css";
 
 export interface MetricStripProps {
@@ -21,6 +22,7 @@ export function MetricStrip({
   className,
 }: MetricStripProps) {
   const classes = [
+    layout === "row" ? "sui-surface" : "",
     "sui-metric-strip",
     `sui-metric-strip--${layout}`,
     className ?? "",
diff --git a/frontend/editor/src/core/ui/NodeCard.css b/frontend/editor/src/core/ui/NodeCard.css
index 7982e2581a..a7a6d8e781 100644
--- a/frontend/editor/src/core/ui/NodeCard.css
+++ b/frontend/editor/src/core/ui/NodeCard.css
@@ -8,10 +8,6 @@
   display: flex;
   align-items: stretch;
   box-sizing: border-box;
-  background: var(--c-surface);
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-sm);
   transition:
     border-color var(--motion-fast),
     box-shadow var(--motion-fast),
diff --git a/frontend/editor/src/core/ui/NodeCard.tsx b/frontend/editor/src/core/ui/NodeCard.tsx
index 451cc8823b..dd8471fae1 100644
--- a/frontend/editor/src/core/ui/NodeCard.tsx
+++ b/frontend/editor/src/core/ui/NodeCard.tsx
@@ -1,6 +1,7 @@
 import type { HTMLAttributes, MouseEvent, ReactNode, Ref } from "react";
 import { Button } from "@app/ui/Button";
 import { IconBadge, type IconBadgeAccent } from "@app/ui/IconBadge";
+import "@app/ui/Surface.css";
 import "@app/ui/NodeCard.css";
 
 /** Border tone. `selected` (a separate prop) overrides this with the primary ring. */
@@ -53,6 +54,7 @@ export function NodeCard({
       {...rest}
       ref={ref}
       className={[
+        "sui-surface",
         "sui-node-card",
         tone === "warning" ? "sui-node-card--warning" : "",
         selected ? "is-selected" : "",
diff --git a/frontend/editor/src/core/ui/Surface.css b/frontend/editor/src/core/ui/Surface.css
new file mode 100644
index 0000000000..93b7c104c1
--- /dev/null
+++ b/frontend/editor/src/core/ui/Surface.css
@@ -0,0 +1,20 @@
+/* Duplicates `.sui-nav-surface` on purpose: nav chrome may diverge from in-page surfaces. */
+.sui-surface {
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-nav);
+}
+
+:root {
+  --sui-elevation-raised:
+    0 1px 2px rgba(0, 0, 0, 0.04), 0 2px 6px rgba(0, 0, 0, 0.06);
+}
+
+[data-theme="dark"] {
+  --sui-elevation-raised:
+    0 1px 2px rgba(0, 0, 0, 0.45), 0 2px 8px rgba(0, 0, 0, 0.35);
+}
+
+.sui-surface--raised {
+  box-shadow: var(--sui-elevation-raised);
+}
diff --git a/frontend/editor/src/core/ui/Surface.stories.tsx b/frontend/editor/src/core/ui/Surface.stories.tsx
new file mode 100644
index 0000000000..5f9afb09e9
--- /dev/null
+++ b/frontend/editor/src/core/ui/Surface.stories.tsx
@@ -0,0 +1,46 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Surface } from "@app/ui/Surface";
+
+const meta: Meta<typeof Surface> = {
+  title: "Primitives/Surface",
+  component: Surface,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ width: "22rem", background: "var(--c-bg)", padding: 12 }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof Surface>;
+
+/** The box any in-page panel, tile or table container sits in. */
+export const Default: Story = {
+  args: {
+    children: (
+      <div style={{ padding: "1rem" }}>
+        <div style={{ fontSize: 14, fontWeight: 600 }}>Panel title</div>
+        <div style={{ fontSize: 13, color: "var(--c-text-muted)" }}>
+          Same fill, border and radius on every surface.
+        </div>
+      </div>
+    ),
+  },
+};
+
+/** `as` renders a landmark element instead of a div. */
+export const AsSection: Story = {
+  args: {
+    as: "section",
+    "aria-label": "Usage",
+    children: (
+      <div style={{ padding: "0.75rem" }}>
+        <span style={{ fontSize: 13, color: "var(--c-text-muted)" }}>
+          Any content, not just cards.
+        </span>
+      </div>
+    ),
+  },
+};
diff --git a/frontend/editor/src/core/ui/Surface.tsx b/frontend/editor/src/core/ui/Surface.tsx
new file mode 100644
index 0000000000..bbb3be1d7a
--- /dev/null
+++ b/frontend/editor/src/core/ui/Surface.tsx
@@ -0,0 +1,33 @@
+import { forwardRef, type HTMLAttributes } from "react";
+import "@app/ui/Surface.css";
+
+export interface SurfaceProps extends HTMLAttributes<HTMLDivElement> {
+  /** Element to render; `section`/`article`/`aside` when the box is a landmark. */
+  as?: "div" | "section" | "article" | "aside";
+  /** For a surface in front of another surface: same fill, one step of elevation. */
+  raised?: boolean;
+}
+
+/** The standard in-page surface: fill, hairline border, shared radius, no shadow. */
+export const Surface = forwardRef<HTMLDivElement, SurfaceProps>(
+  function Surface(
+    { as: Component = "div", raised = false, className, children, ...rest },
+    ref,
+  ) {
+    return (
+      <Component
+        ref={ref}
+        className={[
+          "sui-surface",
+          raised ? "sui-surface--raised" : "",
+          className ?? "",
+        ]
+          .filter(Boolean)
+          .join(" ")}
+        {...rest}
+      >
+        {children}
+      </Component>
+    );
+  },
+);
diff --git a/frontend/editor/src/core/ui/Table.css b/frontend/editor/src/core/ui/Table.css
deleted file mode 100644
index 3d759c1fcd..0000000000
--- a/frontend/editor/src/core/ui/Table.css
+++ /dev/null
@@ -1,76 +0,0 @@
-.sui-table-wrap {
-  width: 100%;
-  overflow-x: auto;
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-md);
-  background: var(--c-surface);
-}
-
-.sui-table {
-  width: 100%;
-  border-collapse: collapse;
-  font-size: 0.8125rem;
-}
-
-/* Header text kept for assistive tech only, so a column of controls can be named
-   without putting a heading above it. Defined here rather than borrowing a global
-   utility, since the portal loads its own stylesheet. */
-.sui-table__th-sr {
-  position: absolute;
-  width: 1px;
-  height: 1px;
-  padding: 0;
-  margin: -1px;
-  overflow: hidden;
-  clip-path: inset(50%);
-  white-space: nowrap;
-  border: 0;
-}
-
-.sui-table__th {
-  text-align: left;
-  font-weight: 600;
-  color: var(--c-text-subtle);
-  font-size: 0.6875rem;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-  padding: 0.625rem 0.875rem;
-  border-bottom: 1px solid var(--c-border);
-  white-space: nowrap;
-}
-.sui-table__th--right,
-.sui-table__td--right {
-  text-align: right;
-}
-.sui-table__th--center,
-.sui-table__td--center {
-  text-align: center;
-}
-
-.sui-table__td {
-  padding: 0.625rem 0.875rem;
-  color: var(--c-text-muted);
-  border-bottom: 1px solid var(--c-border-subtle);
-  vertical-align: middle;
-}
-.sui-table tbody tr:last-child .sui-table__td {
-  border-bottom: none;
-}
-
-.sui-table__row--interactive {
-  cursor: pointer;
-  transition: background var(--motion-fast);
-}
-.sui-table__row--interactive:hover {
-  background: var(--c-hover);
-}
-.sui-table__row--interactive:focus-visible {
-  outline: 0.125rem solid var(--c-primary);
-  outline-offset: -0.125rem;
-}
-
-.sui-table__empty {
-  padding: 2rem;
-  text-align: center;
-  color: var(--c-text-subtle);
-}
diff --git a/frontend/editor/src/core/ui/Table.stories.tsx b/frontend/editor/src/core/ui/Table.stories.tsx
deleted file mode 100644
index 2e7e0f64f1..0000000000
--- a/frontend/editor/src/core/ui/Table.stories.tsx
+++ /dev/null
@@ -1,109 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { Table, type TableColumn } from "@app/ui/Table";
-import { StatusBadge } from "@app/ui/StatusBadge";
-
-interface Region {
-  id: string;
-  name: string;
-  code: string;
-  status: "healthy" | "degraded";
-  docs: number;
-  latency: string;
-}
-
-const REGIONS: Region[] = [
-  {
-    id: "1",
-    name: "US East",
-    code: "us-east-1",
-    status: "healthy",
-    docs: 12481,
-    latency: "41 ms",
-  },
-  {
-    id: "2",
-    name: "US West",
-    code: "us-west-2",
-    status: "healthy",
-    docs: 8210,
-    latency: "63 ms",
-  },
-  {
-    id: "3",
-    name: "EU West",
-    code: "eu-west-1",
-    status: "degraded",
-    docs: 3044,
-    latency: "190 ms",
-  },
-];
-
-const COLUMNS: TableColumn<Region>[] = [
-  { key: "name", header: "Region", render: (r) => r.name },
-  {
-    key: "code",
-    header: "Code",
-    render: (r) => (
-      <code style={{ fontFamily: "var(--font-mono)" }}>{r.code}</code>
-    ),
-  },
-  {
-    key: "status",
-    header: "Status",
-    render: (r) => (
-      <StatusBadge
-        tone={r.status === "healthy" ? "success" : "warning"}
-        size="sm"
-      >
-        {r.status}
-      </StatusBadge>
-    ),
-  },
-  {
-    key: "docs",
-    header: "Docs 24h",
-    align: "right",
-    render: (r) => r.docs.toLocaleString(),
-  },
-  { key: "latency", header: "P95", align: "right", render: (r) => r.latency },
-];
-
-const meta: Meta<typeof Table> = {
-  title: "Compound/Table",
-  component: Table,
-  tags: ["autodocs"],
-  parameters: { layout: "padded" },
-};
-export default meta;
-type Story = StoryObj<typeof Table>;
-
-/** Presentational table — columns own their cell renderers; pass pre-sorted rows. */
-export const Basic: Story = {
-  render: () => (
-    <Table<Region> columns={COLUMNS} rows={REGIONS} rowKey={(r) => r.id} />
-  ),
-};
-
-/** With `onRowClick`, rows become focusable + hoverable (keyboard: Enter/Space). */
-export const Interactive: Story = {
-  render: () => (
-    <Table<Region>
-      columns={COLUMNS}
-      rows={REGIONS}
-      rowKey={(r) => r.id}
-      onRowClick={() => {}}
-    />
-  ),
-};
-
-/** Empty body slot. */
-export const Empty: Story = {
-  render: () => (
-    <Table<Region>
-      columns={COLUMNS}
-      rows={[]}
-      rowKey={(r) => r.id}
-      empty="No regions deployed yet."
-    />
-  ),
-};
diff --git a/frontend/editor/src/core/ui/Table.tsx b/frontend/editor/src/core/ui/Table.tsx
deleted file mode 100644
index 277362eab8..0000000000
--- a/frontend/editor/src/core/ui/Table.tsx
+++ /dev/null
@@ -1,138 +0,0 @@
-import type { ReactNode } from "react";
-import "@app/ui/Table.css";
-
-export interface TableColumn<T> {
-  /** Stable column id. */
-  key: string;
-  header: ReactNode;
-  /**
-   * Hides the header visually but keeps it for assistive tech. For a trailing column of controls
-   * or chevrons, where a visible heading would be noise but a blank one leaves the cells below it
-   * unlabelled.
-   */
-  headerHidden?: boolean;
-  /** Cell renderer for a row. */
-  render: (row: T) => ReactNode;
-  align?: "left" | "right" | "center";
-  /** Optional fixed/min width (any CSS length). */
-  width?: string;
-}
-
-export interface TableProps<T> {
-  columns: TableColumn<T>[];
-  rows: T[];
-  /** Stable key per row. */
-  rowKey: (row: T) => string;
-  /** Makes rows interactive (hover + click + keyboard). */
-  onRowClick?: (row: T) => void;
-  /**
-   * Per-row gate for interactivity, checked only when {@link onRowClick} is set. A row for which
-   * this returns false is inert: no click/keyboard, and not announced as a button. Defaults to
-   * all rows interactive.
-   */
-  isRowInteractive?: (row: T) => boolean;
-  /**
-   * Set when rows render controls of their own. The row keeps its click as a mouse shortcut but
-   * stops announcing itself as a button, because a button may not contain other controls and a
-   * {@code <tr role="button">} is no longer a row to a screen reader. That row control is then the
-   * keyboard path to the same action, so nothing is lost by leaving the row itself inert.
-   */
-  rowsContainControls?: boolean;
-  /** Rendered in place of the body when there are no rows. */
-  empty?: ReactNode;
-  className?: string;
-}
-
-/**
- * Minimal data table primitive. Columns own their own cell renderers, so the
- * table stays presentational — callers pre-sort/filter and pass the rows they
- * want shown. Rows become focusable buttons-in-disguise when `onRowClick` is
- * set.
- */
-export function Table<T>({
-  columns,
-  rows,
-  rowKey,
-  onRowClick,
-  isRowInteractive,
-  rowsContainControls = false,
-  empty,
-  className,
-}: TableProps<T>) {
-  const interactive = Boolean(onRowClick);
-  return (
-    <div
-      className={["sui-table-wrap", className ?? ""].filter(Boolean).join(" ")}
-    >
-      <table className="sui-table">
-        <thead>
-          <tr>
-            {columns.map((c) => (
-              <th
-                key={c.key}
-                scope="col"
-                className={`sui-table__th sui-table__th--${c.align ?? "left"}`}
-                style={c.width ? { width: c.width } : undefined}
-              >
-                {c.headerHidden ? (
-                  <span className="sui-table__th-sr">{c.header}</span>
-                ) : (
-                  c.header
-                )}
-              </th>
-            ))}
-          </tr>
-        </thead>
-        <tbody>
-          {rows.length === 0 ? (
-            <tr>
-              <td className="sui-table__empty" colSpan={columns.length}>
-                {empty ?? "No data"}
-              </td>
-            </tr>
-          ) : (
-            rows.map((row) => {
-              const rowInteractive =
-                interactive && (isRowInteractive?.(row) ?? true);
-              // Only a row that owns the whole interaction takes the button role and the keyboard
-              // handling that goes with it; see rowsContainControls.
-              const rowIsControl = rowInteractive && !rowsContainControls;
-              return (
-                <tr
-                  key={rowKey(row)}
-                  className={
-                    rowInteractive
-                      ? "sui-table__row sui-table__row--interactive"
-                      : "sui-table__row"
-                  }
-                  onClick={rowInteractive ? () => onRowClick?.(row) : undefined}
-                  tabIndex={rowIsControl ? 0 : undefined}
-                  role={rowIsControl ? "button" : undefined}
-                  onKeyDown={
-                    rowIsControl
-                      ? (e) => {
-                          if (e.key === "Enter" || e.key === " ") {
-                            e.preventDefault();
-                            onRowClick?.(row);
-                          }
-                        }
-                      : undefined
-                  }
-                >
-                  {columns.map((c) => (
-                    <td
-                      key={c.key}
-                      className={`sui-table__td sui-table__td--${c.align ?? "left"}`}
-                    >
-                      {c.render(row)}
-                    </td>
-                  ))}
-                </tr>
-              );
-            })
-          )}
-        </tbody>
-      </table>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/core/ui/Tabs.tsx b/frontend/editor/src/core/ui/Tabs.tsx
index 5c91934c77..2cd3b8193a 100644
--- a/frontend/editor/src/core/ui/Tabs.tsx
+++ b/frontend/editor/src/core/ui/Tabs.tsx
@@ -50,7 +50,7 @@ export function Tabs<K extends string = string>({
       aria-label={ariaLabel}
     >
       {items.map((item) => {
-        const isActive = item.key === activeKey;
+        const isActive = item.key === activeKey && !item.disabled;
         const styleVars =
           isActive && item.accentColor
             ? ({ "--sui-tab-accent": item.accentColor } as React.CSSProperties)
@@ -61,13 +61,17 @@ export function Tabs<K extends string = string>({
             type="button"
             aria-pressed={isActive}
             disabled={item.disabled}
+            aria-disabled={item.disabled || undefined}
             className={
               "sui-tabs__tab" +
               (isActive ? " is-active" : "") +
               (item.disabled ? " is-disabled" : "")
             }
             style={styleVars}
-            onClick={() => onChange(item.key)}
+            onClick={() => {
+              if (item.disabled) return;
+              onChange(item.key);
+            }}
           >
             {item.dotColor && (
               <span
diff --git a/frontend/editor/src/core/ui/dataTableColumns.tsx b/frontend/editor/src/core/ui/dataTableColumns.tsx
new file mode 100644
index 0000000000..df31dc384a
--- /dev/null
+++ b/frontend/editor/src/core/ui/dataTableColumns.tsx
@@ -0,0 +1,569 @@
+import { Fragment, type ReactNode } from "react";
+import { StatusBadge, type StatusTone } from "@app/ui/StatusBadge";
+import { Chip, type ChipAccent } from "@app/ui/Chip";
+import { Button } from "@app/ui/Button";
+import { Dropdown } from "@app/ui/Dropdown";
+import { ProgressBar } from "@app/ui/ProgressBar";
+import { Select, type SelectOption } from "@app/ui/Select";
+
+/**
+ * The column vocabulary for {@link DataTable}. Call-sites pick a cell KIND and
+ * supply the data + semantics; the component owns 100% of the appearance. There
+ * is no raw-JSX / className escape hatch by design; a cell can only look the way
+ * the design system draws its kind, so every table looks and behaves the same.
+ */
+
+type Align = "left" | "right";
+type SortValue = string | number | boolean | null | undefined;
+
+/**
+ * Which built-in comparator sorts a column. Set by the builder from the cell's
+ * data type - `alphanumeric` (case-insensitive, natural: `v2` before `v10`) for
+ * text, `basic` (raw numeric) for numbers. Call-sites never choose this.
+ */
+export type DataTableSortFn = "alphanumeric" | "basic";
+
+/** Opaque, fully-resolved column. Produced only by the {@link column} builders. */
+export interface DataTableColumn<T> {
+  key: string;
+  header: ReactNode;
+  align: Align;
+  /** Prevent wrapping (mono/number values). */
+  nowrap: boolean;
+  /** Shrink the column to its content (actions / affordances). */
+  fit: boolean;
+  sortable: boolean;
+  sortValue?: (row: T) => SortValue;
+  /** Comparator kind, derived from the cell type. Only set when sortable. */
+  sortFn?: DataTableSortFn;
+  /** Cell renders its own interactive control (button/link/select/chip). Rows
+   *  containing one drop their `role="button"` so a button never nests inside a
+   *  button - the control is the keyboard path instead. */
+  interactive?: boolean;
+  /** Internal, design-system-owned renderer. Call-sites never supply this. */
+  renderCell: (row: T) => ReactNode;
+}
+
+/** The only design-system glyph a cell may use (icon-only actions). */
+export type CellGlyph = "kebab";
+
+function KebabGlyph() {
+  return (
+    <svg
+      width="16"
+      height="16"
+      viewBox="0 0 24 24"
+      fill="currentColor"
+      aria-hidden
+    >
+      <circle cx="12" cy="5" r="1.6" />
+      <circle cx="12" cy="12" r="1.6" />
+      <circle cx="12" cy="19" r="1.6" />
+    </svg>
+  );
+}
+
+/** An item in a kebab action menu. */
+export interface CellMenuItem {
+  label: string;
+  tone?: "default" | "danger";
+  disabled?: boolean;
+  onClick: () => void;
+  /** Draw a divider above this item. */
+  dividerBefore?: boolean;
+}
+
+/** A row/group action. A locked button, or a kebab menu when `menu` is set. */
+export interface CellAction {
+  label: string;
+  glyph?: CellGlyph;
+  /** Icon-only (uses `label` as the accessible name). */
+  iconOnly?: boolean;
+  tone?: "default" | "danger";
+  onClick?: () => void;
+  loading?: boolean;
+  disabled?: boolean;
+  /** When set, the button opens this menu instead of firing `onClick`. */
+  menu?: CellMenuItem[];
+}
+
+/** Renders a row of locked action buttons / kebab menus. Shared by the
+ *  `actions` cell kind and grouped-table headers. */
+export function renderCellActions(actions: CellAction[]): ReactNode {
+  return (
+    <div className="sui-dtc__actions" onClick={(e) => e.stopPropagation()}>
+      {actions.map((a) =>
+        a.menu ? (
+          <Dropdown.Root key={a.label}>
+            <Dropdown.Trigger>
+              <Button
+                variant={a.iconOnly ? "tertiary" : "secondary"}
+                size="sm"
+                shape={a.iconOnly ? "circle" : undefined}
+                leftSection={a.glyph ? <KebabGlyph /> : undefined}
+                loading={a.loading}
+                disabled={a.disabled}
+                aria-label={a.iconOnly ? a.label : undefined}
+              >
+                {a.iconOnly ? undefined : a.label}
+              </Button>
+            </Dropdown.Trigger>
+            <Dropdown.Menu width={210}>
+              {a.menu.map((m) => (
+                <Fragment key={m.label}>
+                  {m.dividerBefore && <Dropdown.Divider />}
+                  <Dropdown.Item
+                    onSelect={m.onClick}
+                    disabled={m.disabled}
+                    className={
+                      m.tone === "danger"
+                        ? "sui-dtc__menu-item--danger"
+                        : undefined
+                    }
+                  >
+                    {m.label}
+                  </Dropdown.Item>
+                </Fragment>
+              ))}
+            </Dropdown.Menu>
+          </Dropdown.Root>
+        ) : (
+          <Button
+            key={a.label}
+            variant={a.iconOnly ? "tertiary" : "secondary"}
+            accent={a.tone === "danger" ? "danger" : undefined}
+            size="sm"
+            shape={a.iconOnly ? "circle" : undefined}
+            leftSection={a.glyph ? <KebabGlyph /> : undefined}
+            loading={a.loading}
+            disabled={a.disabled}
+            aria-label={a.iconOnly ? a.label : undefined}
+            onClick={(e) => {
+              e.stopPropagation();
+              a.onClick?.();
+            }}
+          >
+            {a.iconOnly ? undefined : a.label}
+          </Button>
+        ),
+      )}
+    </div>
+  );
+}
+
+/** An external link inside a cell. */
+export interface CellLink {
+  label: string;
+  href: string;
+  ariaLabel?: string;
+}
+
+interface Common {
+  key: string;
+  header: ReactNode;
+  sortable?: boolean;
+}
+
+function base<T>(
+  o: Common,
+  extra: Pick<DataTableColumn<T>, "align" | "nowrap" | "fit" | "renderCell"> & {
+    sortValue?: (row: T) => SortValue;
+    sortFn?: DataTableSortFn;
+    interactive?: boolean;
+  },
+): DataTableColumn<T> {
+  return {
+    key: o.key,
+    header: o.header,
+    align: extra.align,
+    nowrap: extra.nowrap,
+    fit: extra.fit,
+    sortable: !!o.sortable,
+    sortValue: o.sortable ? extra.sortValue : undefined,
+    sortFn: o.sortable ? extra.sortFn : undefined,
+    interactive: extra.interactive,
+    renderCell: extra.renderCell,
+  };
+}
+
+function text<T>(
+  o: Common & {
+    get: (row: T) => string;
+    /** Optional bold label rendered before the value as "Label: value". */
+    label?: (row: T) => string | null | undefined;
+    sortBy?: (row: T) => SortValue;
+  },
+): DataTableColumn<T> {
+  return base<T>(o, {
+    align: "left",
+    nowrap: false,
+    fit: false,
+    sortValue: o.sortBy ?? ((r) => o.get(r)),
+    sortFn: "alphanumeric",
+    renderCell: (r) => {
+      const label = o.label?.(r);
+      return label ? (
+        <span className="sui-dtc__text sui-dtc__text--labeled">
+          <strong className="sui-dtc__text-label">{label}:</strong> {o.get(r)}
+        </span>
+      ) : (
+        <span className="sui-dtc__text">{o.get(r)}</span>
+      );
+    },
+  });
+}
+
+function mono<T>(
+  o: Common & { get: (row: T) => string; sortBy?: (row: T) => SortValue },
+): DataTableColumn<T> {
+  return base<T>(o, {
+    align: "left",
+    nowrap: true,
+    fit: false,
+    sortValue: o.sortBy ?? ((r) => o.get(r)),
+    sortFn: "alphanumeric",
+    renderCell: (r) => <code className="sui-dtc__mono">{o.get(r)}</code>,
+  });
+}
+
+function muted<T>(
+  o: Common & {
+    get: (row: T) => string | null | undefined;
+    placeholder?: string;
+    /** Override the sort key (e.g. an ISO date behind a "3 days ago" label). */
+    sortBy?: (row: T) => SortValue;
+  },
+): DataTableColumn<T> {
+  return base<T>(o, {
+    align: "left",
+    nowrap: false,
+    fit: false,
+    sortValue: o.sortBy ?? ((r) => o.get(r) ?? undefined),
+    sortFn: "alphanumeric",
+    renderCell: (r) => (
+      <span className="sui-dtc__muted">
+        {o.get(r) || (o.placeholder ?? "-")}
+      </span>
+    ),
+  });
+}
+
+function number<T>(
+  o: Common & {
+    get: (row: T) => number | null | undefined;
+    format?: (n: number, row: T) => string;
+    placeholder?: string;
+    /** Override the sort key (e.g. a raw count behind a formatted label). */
+    sortBy?: (row: T) => SortValue;
+  },
+): DataTableColumn<T> {
+  return base<T>(o, {
+    align: "right",
+    nowrap: true,
+    fit: false,
+    sortValue: o.sortBy ?? ((r) => o.get(r) ?? undefined),
+    sortFn: "basic",
+    renderCell: (r) => {
+      const n = o.get(r);
+      if (n == null) {
+        return (
+          <span className="sui-dtc__num sui-dtc__muted">
+            {o.placeholder ?? "-"}
+          </span>
+        );
+      }
+      return (
+        <span className="sui-dtc__num">
+          {o.format ? o.format(n, r) : String(n)}
+        </span>
+      );
+    },
+  });
+}
+
+function badge<T>(
+  o: Common & {
+    get: (row: T) => { tone: StatusTone; label: string };
+    sortBy?: (row: T) => SortValue;
+  },
+): DataTableColumn<T> {
+  return base<T>(o, {
+    align: "left",
+    nowrap: true,
+    fit: false,
+    sortValue: o.sortBy ?? ((r) => o.get(r).label),
+    sortFn: "alphanumeric",
+    renderCell: (r) => {
+      const b = o.get(r);
+      return (
+        <StatusBadge tone={b.tone} size="sm">
+          {b.label}
+        </StatusBadge>
+      );
+    },
+  });
+}
+
+/**
+ * A user-defined label, rendered as a dot-less pill. Use this ONLY for labels
+ * that come from data / the user (e.g. a document's classification). Values from
+ * a fixed set we define (types, environments, providers) are `text`, not pills.
+ */
+export interface CellLabel {
+  label: string;
+  accent?: ChipAccent;
+}
+
+function labels<T>(
+  o: Common & { get: (row: T) => CellLabel[] },
+): DataTableColumn<T> {
+  return base<T>(o, {
+    align: "left",
+    nowrap: false,
+    fit: false,
+    sortValue: (r) => o.get(r)[0]?.label ?? undefined,
+    sortFn: "alphanumeric",
+    renderCell: (r) => (
+      <div className="sui-dtc__labels">
+        {o.get(r).map((l) => (
+          <Chip
+            key={l.label}
+            accent={l.accent ?? "neutral"}
+            size="sm"
+            showDot={false}
+          >
+            {l.label}
+          </Chip>
+        ))}
+      </div>
+    ),
+  });
+}
+
+/**
+ * An interactive capability chip: click to grant, remove to revoke, dashed to
+ * offer adding. A functional cell (it toggles state), distinct from static
+ * `labels`.
+ */
+export interface CellCap {
+  label: string;
+  accent?: ChipAccent;
+  onClick?: () => void;
+  onRemove?: () => void;
+  dashed?: boolean;
+}
+
+function caps<T>(
+  o: Common & { get: (row: T) => CellCap[] },
+): DataTableColumn<T> {
+  return base<T>(o, {
+    align: "left",
+    nowrap: false,
+    fit: false,
+    interactive: true,
+    renderCell: (r) => (
+      <div className="sui-dtc__labels">
+        {o.get(r).map((c) => (
+          <Chip
+            key={c.label}
+            accent={c.accent ?? "neutral"}
+            size="sm"
+            showDot={false}
+            dashed={c.dashed}
+            onClick={c.onClick}
+            onRemove={c.onRemove}
+          >
+            {c.label}
+          </Chip>
+        ))}
+      </div>
+    ),
+  });
+}
+
+function entity<T>(
+  o: Common & {
+    /** Semantic leading icon (component owns its size + colour container). */
+    icon?: (row: T) => ReactNode;
+    primary: (row: T) => string;
+    /** Muted inline suffix after the name, its own node (e.g. "(you)"). */
+    suffix?: (row: T) => string | null | undefined;
+    /** Secondary muted line under the name. */
+    note?: (row: T) => string | null | undefined;
+    sortBy?: (row: T) => SortValue;
+  },
+): DataTableColumn<T> {
+  return base<T>(o, {
+    align: "left",
+    nowrap: false,
+    fit: false,
+    sortValue: o.sortBy ?? ((r) => o.primary(r)),
+    sortFn: "alphanumeric",
+    renderCell: (r) => {
+      const icon = o.icon?.(r);
+      const suffix = o.suffix?.(r);
+      const note = o.note?.(r);
+      return (
+        <div className="sui-dtc__entity">
+          {icon != null && (
+            <span className="sui-dtc__entity-icon" aria-hidden>
+              {icon}
+            </span>
+          )}
+          <div className="sui-dtc__entity-body">
+            <span className="sui-dtc__entity-head">
+              <span className="sui-dtc__entity-name">{o.primary(r)}</span>
+              {suffix && (
+                <span className="sui-dtc__entity-suffix">{suffix}</span>
+              )}
+            </span>
+            {note && <span className="sui-dtc__note">{note}</span>}
+          </div>
+        </div>
+      );
+    },
+  });
+}
+
+function actions<T>(o: {
+  key: string;
+  header?: ReactNode;
+  get: (row: T) => CellAction[];
+}): DataTableColumn<T> {
+  return {
+    key: o.key,
+    header: o.header ?? "",
+    align: "right",
+    nowrap: true,
+    fit: true,
+    sortable: false,
+    interactive: true,
+    renderCell: (r) => renderCellActions(o.get(r)),
+  };
+}
+
+function progress<T>(
+  o: Common & {
+    get: (row: T) => { value: number; label?: string };
+    /** Accessible name for the bar (it has no visible text). Defaults to the
+     *  shown percent; pass a description like "Load for us-east-1" when useful. */
+    ariaLabel?: (row: T) => string;
+  },
+): DataTableColumn<T> {
+  return base<T>(o, {
+    align: "left",
+    nowrap: true,
+    fit: false,
+    sortValue: (r) => o.get(r).value,
+    sortFn: "basic",
+    renderCell: (r) => {
+      const p = o.get(r);
+      const shown = p.label ?? `${Math.round(p.value * 100)}%`;
+      return (
+        <div className="sui-dtc__progress">
+          <span className="sui-dtc__progress-bar">
+            <ProgressBar
+              value={p.value}
+              thresholded
+              height={6}
+              label={o.ariaLabel?.(r) ?? shown}
+            />
+          </span>
+          <span className="sui-dtc__progress-pct">{shown}</span>
+        </div>
+      );
+    },
+  });
+}
+
+function links<T>(o: {
+  key: string;
+  header?: ReactNode;
+  get: (row: T) => CellLink[];
+}): DataTableColumn<T> {
+  return {
+    key: o.key,
+    header: o.header ?? "",
+    align: "right",
+    nowrap: true,
+    fit: true,
+    sortable: false,
+    interactive: true,
+    renderCell: (r) => (
+      <div className="sui-dtc__links">
+        {o.get(r).map((l) => (
+          <a
+            key={l.label}
+            className="sui-dtc__link"
+            href={l.href}
+            target="_blank"
+            rel="noopener noreferrer"
+            aria-label={l.ariaLabel}
+          >
+            {l.label}
+          </a>
+        ))}
+      </div>
+    ),
+  };
+}
+
+function select<T>(o: {
+  key: string;
+  header: ReactNode;
+  get: (row: T) => {
+    value?: string | null;
+    defaultValue?: string;
+    options: SelectOption[];
+    ariaLabel?: string;
+    disabled?: boolean;
+  };
+  /** Omit for an uncontrolled select (local UI state only). */
+  onChange?: (row: T, value: string | null) => void;
+}): DataTableColumn<T> {
+  return {
+    key: o.key,
+    header: o.header,
+    align: "left",
+    nowrap: true,
+    fit: false,
+    sortable: false,
+    interactive: true,
+    renderCell: (r) => {
+      const s = o.get(r);
+      const change = o.onChange;
+      return (
+        <div className="sui-dtc__select">
+          <Select
+            options={s.options}
+            value={s.value}
+            defaultValue={s.defaultValue}
+            onChange={change ? (v) => change(r, v) : undefined}
+            aria-label={s.ariaLabel}
+            disabled={s.disabled}
+            inputSize="sm"
+          />
+        </div>
+      );
+    },
+  };
+}
+
+/**
+ * The DataTable column vocabulary. Each builder produces a locked-appearance
+ * column; call-sites choose the kind + supply data, never styling.
+ */
+export const column = {
+  text,
+  mono,
+  muted,
+  number,
+  badge,
+  labels,
+  caps,
+  entity,
+  actions,
+  progress,
+  links,
+  select,
+};
diff --git a/frontend/editor/src/core/ui/index.ts b/frontend/editor/src/core/ui/index.ts
index b3e2ca6ac0..dcf0e9265f 100644
--- a/frontend/editor/src/core/ui/index.ts
+++ b/frontend/editor/src/core/ui/index.ts
@@ -11,6 +11,7 @@ export * from "@app/ui/MetricCard";
 export * from "@app/ui/NodeCard";
 export * from "@app/ui/NavItem";
 export * from "@app/ui/NavSurface";
+export * from "@app/ui/Surface";
 export * from "@app/ui/PanelHeader";
 export * from "@app/ui/CodeBlock";
 export * from "@app/ui/SectionDivider";
@@ -39,7 +40,7 @@ export * from "@app/ui/Collapsible";
 export * from "@app/ui/Tabs";
 export * from "@app/ui/Dropdown";
 export * from "@app/ui/Drawer";
-export * from "@app/ui/Table";
+export * from "@app/ui/DataTable";
 
 // Forms
 export * from "@app/ui/FormField";
diff --git a/frontend/editor/src/core/utils/canvasImageEncoding.test.ts b/frontend/editor/src/core/utils/canvasImageEncoding.test.ts
new file mode 100644
index 0000000000..4e94909d53
--- /dev/null
+++ b/frontend/editor/src/core/utils/canvasImageEncoding.test.ts
@@ -0,0 +1,91 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  lossyEncodeOptions,
+  resetCanvasEncodingProbe,
+} from "@app/utils/canvasImageEncoding";
+
+/** An engine that can't encode a format returns PNG instead of throwing, so
+ *  only the returned Blob's `type` reveals what happened. */
+
+/** Stand in for OffscreenCanvas, honouring only the given MIME types. */
+function stubOffscreenCanvas(honoured: string[]): void {
+  class FakeOffscreenCanvas {
+    constructor(
+      public width: number,
+      public height: number,
+    ) {}
+
+    getContext() {
+      return { fillStyle: "", fillRect: () => {} };
+    }
+
+    convertToBlob({ type }: { type: string }) {
+      // Per spec: an unsupported type silently serialises as PNG.
+      const actual = honoured.includes(type) ? type : "image/png";
+      return Promise.resolve(new Blob([new Uint8Array([0])], { type: actual }));
+    }
+  }
+  vi.stubGlobal("OffscreenCanvas", FakeOffscreenCanvas);
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  resetCanvasEncodingProbe();
+});
+
+describe("lossyEncodeOptions", () => {
+  it("uses WebP when the engine really encodes it", async () => {
+    stubOffscreenCanvas(["image/webp", "image/jpeg", "image/png"]);
+    await expect(lossyEncodeOptions()).resolves.toEqual({
+      type: "image/webp",
+      quality: 0.85,
+    });
+  });
+
+  it("falls back to JPEG when a WebP request silently yields PNG", async () => {
+    // WebKit's actual behaviour: no WebP encoder, no error either.
+    stubOffscreenCanvas(["image/jpeg", "image/png"]);
+    await expect(lossyEncodeOptions()).resolves.toEqual({
+      type: "image/jpeg",
+      quality: 0.85,
+    });
+  });
+
+  it("falls back to PNG when no lossy format is honoured", async () => {
+    stubOffscreenCanvas(["image/png"]);
+    await expect(lossyEncodeOptions()).resolves.toEqual({
+      type: "image/png",
+      quality: 0.85,
+    });
+  });
+
+  it("passes the caller's quality through", async () => {
+    stubOffscreenCanvas(["image/webp", "image/png"]);
+    await expect(lossyEncodeOptions(0.5)).resolves.toEqual({
+      type: "image/webp",
+      quality: 0.5,
+    });
+  });
+
+  it("probes once and reuses the answer", async () => {
+    stubOffscreenCanvas(["image/webp", "image/png"]);
+    const spy = vi.spyOn(
+      (globalThis as unknown as { OffscreenCanvas: { prototype: object } })
+        .OffscreenCanvas.prototype as { convertToBlob: () => unknown },
+      "convertToBlob",
+    );
+    await lossyEncodeOptions();
+    const afterFirst = spy.mock.calls.length;
+    await lossyEncodeOptions();
+    expect(spy.mock.calls.length).toBe(afterFirst);
+  });
+
+  it("returns PNG where there is no OffscreenCanvas at all", async () => {
+    vi.stubGlobal("OffscreenCanvas", undefined);
+    await expect(lossyEncodeOptions()).resolves.toEqual({
+      type: "image/png",
+      quality: 0.85,
+    });
+  });
+});
diff --git a/frontend/editor/src/core/utils/canvasImageEncoding.ts b/frontend/editor/src/core/utils/canvasImageEncoding.ts
new file mode 100644
index 0000000000..45de65bebf
--- /dev/null
+++ b/frontend/editor/src/core/utils/canvasImageEncoding.ts
@@ -0,0 +1,45 @@
+/** `convertToBlob` silently serialises to PNG for a format it can't encode
+ *  (WebKit, WebP), so only the returned `type` reveals it. Probe once per realm. */
+
+/** Candidates in preference order, best compression first. PNG always works. */
+const LOSSY_CANDIDATES = ["image/webp", "image/jpeg"] as const;
+const PNG_TYPE = "image/png";
+
+let probe: Promise<string> | null = null;
+
+async function honoursType(type: string, quality: number): Promise<boolean> {
+  try {
+    const canvas = new OffscreenCanvas(2, 2);
+    const ctx = canvas.getContext("2d");
+    if (!ctx) return false;
+    // JPEG has no alpha, and the pixels are thrown away either way.
+    ctx.fillStyle = "#000000";
+    ctx.fillRect(0, 0, 2, 2);
+    const blob = await canvas.convertToBlob({ type, quality });
+    return blob.type === type;
+  } catch {
+    return false;
+  }
+}
+
+async function detectLossyType(quality: number): Promise<string> {
+  if (typeof OffscreenCanvas === "undefined") return PNG_TYPE;
+  for (const candidate of LOSSY_CANDIDATES) {
+    if (await honoursType(candidate, quality)) return candidate;
+  }
+  return PNG_TYPE;
+}
+
+/** Encode options for a page raster: the best lossy format this engine really
+ *  supports, PNG only if it supports none. `quality` is ignored by PNG. */
+export function lossyEncodeOptions(
+  quality = 0.85,
+): Promise<ImageEncodeOptions> {
+  probe ??= detectLossyType(quality);
+  return probe.then((type) => ({ type, quality }));
+}
+
+/** Reset the cached probe. Tests only. */
+export function resetCanvasEncodingProbe(): void {
+  probe = null;
+}
diff --git a/frontend/editor/src/core/utils/engineShims.ts b/frontend/editor/src/core/utils/engineShims.ts
new file mode 100644
index 0000000000..603c88f969
--- /dev/null
+++ b/frontend/editor/src/core/utils/engineShims.ts
@@ -0,0 +1,4 @@
+// Browser APIs the app is entitled to assume exist, stood in where an engine
+// omits them. Import once, first, before anything that might use them.
+import "@app/utils/patchReadableStreamAsyncIterator";
+import "@app/utils/patchRequestIdleCallback";
diff --git a/frontend/editor/src/core/utils/externalUrl.test.ts b/frontend/editor/src/core/utils/externalUrl.test.ts
new file mode 100644
index 0000000000..c59a1c5926
--- /dev/null
+++ b/frontend/editor/src/core/utils/externalUrl.test.ts
@@ -0,0 +1,45 @@
+import { describe, expect, test } from "vitest";
+import { getExternalHref, toSafeExternalUrl } from "@app/utils/externalUrl";
+
+describe("externalUrl", () => {
+  test("accepts http/https/mailto URLs", () => {
+    expect(toSafeExternalUrl("https://example.com/test")?.href).toBe(
+      "https://example.com/test",
+    );
+    expect(toSafeExternalUrl("http://example.com/test")?.href).toBe(
+      "http://example.com/test",
+    );
+    expect(toSafeExternalUrl("mailto:test@example.com")?.href).toBe(
+      "mailto:test@example.com",
+    );
+  });
+
+  test("rejects unsafe protocols", () => {
+    expect(toSafeExternalUrl("javascript:alert(1)")).toBeNull();
+    expect(toSafeExternalUrl("file:///etc/passwd")).toBeNull();
+    expect(toSafeExternalUrl("ftp://example.com")).toBeNull();
+    expect(
+      toSafeExternalUrl("data:text/html,<script>alert(1)</script>"),
+    ).toBeNull();
+    expect(toSafeExternalUrl("vbscript:msgbox(1)")).toBeNull();
+  });
+
+  test("rejects unparseable input instead of opening it blind", () => {
+    expect(toSafeExternalUrl("")).toBeNull();
+    expect(toSafeExternalUrl("http://[")).toBeNull();
+  });
+
+  test("is not fooled by casing or leading whitespace", () => {
+    expect(toSafeExternalUrl("JavaScript:alert(1)")).toBeNull();
+    expect(toSafeExternalUrl("  javascript:alert(1)")).toBeNull();
+    expect(toSafeExternalUrl("HTTPS://example.com")?.protocol).toBe("https:");
+  });
+
+  test("normalizes relative URLs against current origin", () => {
+    expect(getExternalHref("/docs/help")?.endsWith("/docs/help")).toBe(true);
+  });
+
+  test("getExternalHref returns null for blocked URLs", () => {
+    expect(getExternalHref("javascript:alert(1)")).toBeNull();
+  });
+});
diff --git a/frontend/editor/src/core/utils/externalUrl.ts b/frontend/editor/src/core/utils/externalUrl.ts
new file mode 100644
index 0000000000..cf8638b5a1
--- /dev/null
+++ b/frontend/editor/src/core/utils/externalUrl.ts
@@ -0,0 +1,32 @@
+/**
+ * Sanitisation for URLs that come out of a PDF (link annotations, bookmark
+ * actions). PDF-supplied URIs are untrusted input, so everything that opens one
+ * funnels through here first and drops anything outside the allowlist.
+ *
+ * Pure helpers only — opening the URL is a platform concern and lives behind
+ * the @app/platform/openExternalTab seam.
+ */
+const ALLOWED_EXTERNAL_PROTOCOLS = new Set(["http:", "https:", "mailto:"]);
+
+function getExternalUrlBase(): string | undefined {
+  // Relative URIs resolve against the app's own location, matching how the
+  // viewer has always treated them. No DOM => absolute URLs only.
+  return typeof window !== "undefined" ? window.location?.href : undefined;
+}
+
+/** Parses `rawUrl` and returns it only if its protocol is on the allowlist. */
+export function toSafeExternalUrl(rawUrl: string): URL | null {
+  // An empty URI would otherwise resolve to the app's own page via the base.
+  if (!rawUrl?.trim()) return null;
+  try {
+    const parsed = new URL(rawUrl, getExternalUrlBase());
+    return ALLOWED_EXTERNAL_PROTOCOLS.has(parsed.protocol) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Normalised href for a safe external URL, or null if it is not safe to open. */
+export function getExternalHref(rawUrl: string): string | null {
+  return toSafeExternalUrl(rawUrl)?.href ?? null;
+}
diff --git a/frontend/editor/src/core/utils/fuzzySearch.ts b/frontend/editor/src/core/utils/fuzzySearch.ts
index 49e4a11e56..5354fc091f 100644
--- a/frontend/editor/src/core/utils/fuzzySearch.ts
+++ b/frontend/editor/src/core/utils/fuzzySearch.ts
@@ -81,9 +81,14 @@ export function scoreMatch(queryRaw: string, targetRaw: string): number {
   return best;
 }
 
+/** Lowest score any fuzzy match can pass with (see minScoreForQuery). Rankers
+ * that mix fuzzy results with fixed-score entries key off this to stay below
+ * every real match. */
+export const FUZZY_MIN_SCORE = 30;
+
 export function minScoreForQuery(query: string): number {
   const len = normalizeText(query).length;
-  return len <= 3 ? 40 : 30;
+  return len <= 3 ? 40 : FUZZY_MIN_SCORE;
 }
 
 // Decide if a target matches a query based on a threshold
diff --git a/frontend/editor/src/core/utils/patchReadableStreamAsyncIterator.test.ts b/frontend/editor/src/core/utils/patchReadableStreamAsyncIterator.test.ts
new file mode 100644
index 0000000000..d9db1fe62d
--- /dev/null
+++ b/frontend/editor/src/core/utils/patchReadableStreamAsyncIterator.test.ts
@@ -0,0 +1,93 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { patchReadableStreamAsyncIterator } from "@app/utils/patchReadableStreamAsyncIterator";
+
+/** Node implements the API, so remove it to exercise the shim, then restore. */
+const KEY: PropertyKey = Symbol.asyncIterator;
+const proto: object = ReadableStream.prototype;
+let native: PropertyDescriptor | undefined;
+
+beforeEach(() => {
+  native = Object.getOwnPropertyDescriptor(proto, KEY);
+  Reflect.deleteProperty(proto, KEY);
+  patchReadableStreamAsyncIterator();
+});
+
+afterEach(() => {
+  if (native) Object.defineProperty(proto, KEY, native);
+});
+
+function streamOf(...chunks: number[]): ReadableStream<number> {
+  return new ReadableStream<number>({
+    start(controller) {
+      chunks.forEach((c) => controller.enqueue(c));
+      controller.close();
+    },
+  });
+}
+
+function failingStream(error: Error): ReadableStream<number> {
+  return new ReadableStream<number>({
+    start(controller) {
+      controller.enqueue(1);
+      controller.error(error);
+    },
+  });
+}
+
+describe("patchReadableStreamAsyncIterator", () => {
+  it("drains a stream with for await, then unlocks it", async () => {
+    const stream = streamOf(1, 2, 3);
+    const seen: number[] = [];
+    for await (const chunk of stream) seen.push(chunk);
+
+    expect(seen).toEqual([1, 2, 3]);
+    expect(stream.locked).toBe(false);
+  });
+
+  // The reader must be released in the read's error steps. `for await` does not
+  // call `return()` when `next()` rejects, so nothing else would ever unlock it.
+  it("releases the lock when the stream errors mid-read", async () => {
+    const boom = new Error("boom");
+    const stream = failingStream(boom);
+
+    await expect(
+      (async () => {
+        for await (const _ of stream) {
+          /* drain until it throws */
+        }
+      })(),
+    ).rejects.toThrow("boom");
+
+    expect(stream.locked).toBe(false);
+  });
+
+  it("cancels and unlocks when the consumer breaks early", async () => {
+    const stream = streamOf(1, 2, 3);
+    for await (const chunk of stream) {
+      expect(chunk).toBe(1);
+      break;
+    }
+    expect(stream.locked).toBe(false);
+  });
+
+  // Native short-circuits once finished; throwing "reader owned by no readable
+  // stream" would break Array.fromAsync and defensive `return()` in a finally.
+  it("keeps reporting done after the stream is drained", async () => {
+    const iterator = streamOf(1)[Symbol.asyncIterator]();
+    await iterator.next();
+
+    await expect(iterator.next()).resolves.toEqual({
+      done: true,
+      value: undefined,
+    });
+    await expect(iterator.return?.()).resolves.toMatchObject({ done: true });
+  });
+
+  it("leaves a real implementation alone", () => {
+    if (native) Object.defineProperty(proto, KEY, native);
+    const before = Object.getOwnPropertyDescriptor(proto, KEY);
+    patchReadableStreamAsyncIterator();
+    expect(Object.getOwnPropertyDescriptor(proto, KEY)).toEqual(before);
+  });
+});
diff --git a/frontend/editor/src/core/utils/patchReadableStreamAsyncIterator.ts b/frontend/editor/src/core/utils/patchReadableStreamAsyncIterator.ts
new file mode 100644
index 0000000000..2aef7c6ce7
--- /dev/null
+++ b/frontend/editor/src/core/utils/patchReadableStreamAsyncIterator.ts
@@ -0,0 +1,58 @@
+// WebKit ships no `ReadableStream[Symbol.asyncIterator]`, and pdf.js reads its
+// text stream with `for await`, so all text extraction threw on Safari.
+
+export function patchReadableStreamAsyncIterator(): void {
+  if (typeof ReadableStream === "undefined") return;
+  if (Symbol.asyncIterator in ReadableStream.prototype) return;
+
+  Object.defineProperty(ReadableStream.prototype, Symbol.asyncIterator, {
+    writable: true,
+    configurable: true,
+    value: function <T>(this: ReadableStream<T>): AsyncIterableIterator<T> {
+      const reader = this.getReader();
+      // Releasing must be idempotent and must NOT happen after a successful
+      // read - the next `read()` on a released reader throws.
+      let finished = false;
+      const release = () => {
+        if (finished) return;
+        finished = true;
+        reader.releaseLock();
+      };
+      return {
+        async next(): Promise<IteratorResult<T>> {
+          // Spec short-circuits once finished; throwing here would break any
+          // consumer that calls `next()` or `return()` defensively.
+          if (finished) return { done: true, value: undefined };
+          try {
+            const { done, value } = await reader.read();
+            if (done) {
+              release();
+              return { done: true, value: undefined };
+            }
+            return { done: false, value };
+          } catch (error) {
+            // The spec releases the reader in the read request's error steps.
+            // Without this an errored stream stays locked for good: `for await`
+            // does not call `return()` when `next()` rejects.
+            release();
+            throw error;
+          }
+        },
+        async return(value?: unknown): Promise<IteratorResult<T>> {
+          if (finished) return { done: true, value: value as T };
+          try {
+            await reader.cancel();
+          } finally {
+            release();
+          }
+          return { done: true, value: value as T };
+        },
+        [Symbol.asyncIterator]() {
+          return this;
+        },
+      };
+    },
+  });
+}
+
+patchReadableStreamAsyncIterator();
diff --git a/frontend/editor/src/core/utils/patchRequestIdleCallback.test.ts b/frontend/editor/src/core/utils/patchRequestIdleCallback.test.ts
new file mode 100644
index 0000000000..dcd0dc722e
--- /dev/null
+++ b/frontend/editor/src/core/utils/patchRequestIdleCallback.test.ts
@@ -0,0 +1,92 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { patchRequestIdleCallback } from "@app/utils/patchRequestIdleCallback";
+
+/** Two things must hold: it stands in where the API is absent, and it never
+ *  displaces a real implementation. */
+
+type IdleGlobals = {
+  requestIdleCallback?: unknown;
+  cancelIdleCallback?: unknown;
+};
+
+const globals = globalThis as IdleGlobals;
+
+let saved: IdleGlobals;
+
+beforeEach(() => {
+  vi.useFakeTimers();
+  saved = {
+    requestIdleCallback: globals.requestIdleCallback,
+    cancelIdleCallback: globals.cancelIdleCallback,
+  };
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+  globals.requestIdleCallback = saved.requestIdleCallback;
+  globals.cancelIdleCallback = saved.cancelIdleCallback;
+});
+
+describe("patchRequestIdleCallback", () => {
+  it("stands in where the engine has no requestIdleCallback", () => {
+    delete globals.requestIdleCallback;
+    delete globals.cancelIdleCallback;
+    patchRequestIdleCallback();
+
+    const task = vi.fn();
+    requestIdleCallback(task);
+
+    // Asynchronous: never runs on the caller's own turn.
+    expect(task).not.toHaveBeenCalled();
+    // With no deadline given, it yields briefly and then runs.
+    vi.advanceTimersByTime(200);
+    expect(task).toHaveBeenCalledTimes(1);
+
+    const deadline = task.mock.calls[0][0] as IdleDeadline;
+    expect(deadline.didTimeout).toBe(false);
+    expect(deadline.timeRemaining()).toBeGreaterThan(0);
+  });
+
+  it("never runs later than the deadline the caller asked for", () => {
+    delete globals.requestIdleCallback;
+    patchRequestIdleCallback();
+
+    const task = vi.fn();
+    requestIdleCallback(task, { timeout: 50 });
+    vi.advanceTimersByTime(50);
+    expect(task).toHaveBeenCalledTimes(1);
+  });
+
+  // `src/index.tsx` asks for 2000ms so the pdfium WASM compile doesn't land on
+  // top of the app's first renders.
+  it("does not run background work earlier than the caller allowed for", () => {
+    delete globals.requestIdleCallback;
+    patchRequestIdleCallback();
+
+    const task = vi.fn();
+    requestIdleCallback(task, { timeout: 2000 });
+    vi.advanceTimersByTime(1999);
+    expect(task).not.toHaveBeenCalled();
+    vi.advanceTimersByTime(1);
+    expect(task).toHaveBeenCalledTimes(1);
+  });
+
+  it("cancels a scheduled task by handle", () => {
+    delete globals.requestIdleCallback;
+    delete globals.cancelIdleCallback;
+    patchRequestIdleCallback();
+
+    const task = vi.fn();
+    cancelIdleCallback(requestIdleCallback(task));
+    vi.advanceTimersByTime(1000);
+    expect(task).not.toHaveBeenCalled();
+  });
+
+  it("leaves a real implementation alone", () => {
+    const native = vi.fn();
+    globals.requestIdleCallback = native;
+    patchRequestIdleCallback();
+    expect(globals.requestIdleCallback).toBe(native);
+  });
+});
diff --git a/frontend/editor/src/core/utils/patchRequestIdleCallback.ts b/frontend/editor/src/core/utils/patchRequestIdleCallback.ts
new file mode 100644
index 0000000000..899af7c14c
--- /dev/null
+++ b/frontend/editor/src/core/utils/patchRequestIdleCallback.ts
@@ -0,0 +1,37 @@
+// WebKit ships no `requestIdleCallback`. The shim honours the async/deadline/
+// cancel contract, not the *idle* part, and is window-only like the real API.
+
+/** Short delay before running, so the current turn's work drains first. */
+const YIELD_MS = 200;
+
+/** Idle-deadline shape for the timer stand-in. A small positive budget keeps a
+ *  `while (timeRemaining() > 0)` loop doing one chunk rather than spinning. */
+function makeDeadline(): IdleDeadline {
+  return { didTimeout: false, timeRemaining: () => 1 };
+}
+
+export function patchRequestIdleCallback(): void {
+  if (typeof globalThis === "undefined") return;
+  const target = globalThis as typeof globalThis & {
+    requestIdleCallback?: typeof requestIdleCallback;
+    cancelIdleCallback?: typeof cancelIdleCallback;
+  };
+  if (typeof target.requestIdleCallback === "function") return;
+
+  target.requestIdleCallback = (
+    callback: IdleRequestCallback,
+    options?: IdleRequestOptions,
+  ): number =>
+    setTimeout(
+      () => callback(makeDeadline()),
+      // Honour the caller's deadline: `timeout` is them saying how long this may
+      // wait, so firing earlier lands background work on top of startup.
+      options?.timeout ?? YIELD_MS,
+    ) as unknown as number;
+
+  target.cancelIdleCallback = (handle: number): void => {
+    clearTimeout(handle);
+  };
+}
+
+patchRequestIdleCallback();
diff --git a/frontend/editor/src/core/utils/safeNavigation.ts b/frontend/editor/src/core/utils/safeNavigation.ts
new file mode 100644
index 0000000000..ca19bc32cc
--- /dev/null
+++ b/frontend/editor/src/core/utils/safeNavigation.ts
@@ -0,0 +1,39 @@
+/**
+ * Guarded client-side navigation for URLs that arrive as data (tool registry
+ * links, search index entries, flavor config) rather than literals. The
+ * values are trusted today, but funnelling them through a scheme allowlist
+ * means a poisoned or mistyped entry (`javascript:…`) can never become a
+ * script-execution sink.
+ */
+
+const SAFE_PROTOCOLS = new Set(["http:", "https:"]);
+
+/** The URL resolved against the current origin, or null if unparseable or a
+ * non-web scheme (javascript:, data:, …). */
+export function toSafeWebUrl(url: string): URL | null {
+  let parsed: URL;
+  try {
+    parsed = new URL(url, window.location.origin);
+  } catch {
+    return null;
+  }
+  return SAFE_PROTOCOLS.has(parsed.protocol) ? parsed : null;
+}
+
+/** window.open in a new tab, dropped silently for non-web schemes. */
+export function openExternalUrl(url: string): void {
+  const safe = toSafeWebUrl(url);
+  if (safe) window.open(safe.href, "_blank", "noopener,noreferrer");
+}
+
+/**
+ * Full-page navigation (window.location), dropped for non-web schemes. The
+ * guard is scheme-only: cross-origin http(s) targets pass by design (a
+ * separately-hosted editor is configured build-time via VITE_EDITOR_URL), so
+ * callers must pass build/config values — never user-supplied input, which
+ * could redirect anywhere on the web.
+ */
+export function assignLocation(url: string): void {
+  const safe = toSafeWebUrl(url);
+  if (safe) window.location.assign(safe.href);
+}
diff --git a/frontend/editor/src/core/utils/thumbnailUtils.ts b/frontend/editor/src/core/utils/thumbnailUtils.ts
index b356b26db9..00f047bd6d 100644
--- a/frontend/editor/src/core/utils/thumbnailUtils.ts
+++ b/frontend/editor/src/core/utils/thumbnailUtils.ts
@@ -31,6 +31,12 @@ export function calculateScaleFromFileSize(fileSize: number): number {
 /** PDFium error code 4 = password required (encrypted PDF). */
 const PDFIUM_ERR_PASSWORD = 4;
 
+/** Callers still get a placeholder, but log the cause: an empty thumbnail is
+ *  indistinguishable from "no raster preview", so an outage hides as a nicety. */
+function reportThumbnailFailure(file: File, error: unknown): void {
+  console.warn(`Thumbnail generation failed for ${file.name}:`, error);
+}
+
 /** PDFs at or above this size never get a full-buffer client-side parse
  * (renderer OOM) - only the linearized-prefix attempt below. */
 export const LARGE_PDF_PARSE_LIMIT = 100 * 1024 * 1024;
@@ -262,7 +268,7 @@ export async function generateThumbnailForFile(file: File): Promise<string> {
         const fullArrayBuffer = await file.arrayBuffer();
         return await generatePDFThumbnail(fullArrayBuffer, scale);
       } catch (error) {
-        console.warn(`PDF processing failed for ${file.name}:`, error);
+        reportThumbnailFailure(file, error);
         return "";
       }
     }
@@ -314,7 +320,8 @@ export async function generateThumbnailWithMetadata(
         pageRotations: result.pageRotations,
         pageDimensions: result.pageDimensions,
       };
-    } catch {
+    } catch (error) {
+      reportThumbnailFailure(file, error);
       return { thumbnail: "", pageCount: 0 };
     }
   }
@@ -344,7 +351,8 @@ export async function generateThumbnailWithMetadata(
       pageRotations: result.pageRotations,
       pageDimensions: result.pageDimensions,
     };
-  } catch {
+  } catch (error) {
+    reportThumbnailFailure(file, error);
     return { thumbnail: "", pageCount: 1 };
   }
 }
@@ -389,7 +397,8 @@ export async function generateThumbnailPairWithMetadata(file: File): Promise<{
       unrotated: toPublic(pair.unrotated),
       rotated: toPublic(pair.rotated),
     };
-  } catch {
+  } catch (error) {
+    reportThumbnailFailure(file, error);
     return {
       unrotated: { thumbnail: "", pageCount: 0 },
       rotated: { thumbnail: "", pageCount: 0 },
diff --git a/frontend/editor/src/core/workers/pixelCompareWorker.ts b/frontend/editor/src/core/workers/pixelCompareWorker.ts
index c1390391ba..cc0e85a164 100644
--- a/frontend/editor/src/core/workers/pixelCompareWorker.ts
+++ b/frontend/editor/src/core/workers/pixelCompareWorker.ts
@@ -14,6 +14,7 @@ import type {
   PixelCompareWorkerResponse,
   PixelCompareWorkerWarnings,
 } from "@app/types/compare";
+import { lossyEncodeOptions } from "@app/utils/canvasImageEncoding";
 
 declare const self: DedicatedWorkerGlobalScope;
 
@@ -155,7 +156,7 @@ const renderPageToBitmap = async (
   return { imageData, bitmap };
 };
 
-const ENCODE_OPTS: ImageEncodeOptions = { type: "image/webp", quality: 0.85 };
+const ENCODE_QUALITY = 0.85;
 
 const bitmapToBlob = async (
   bitmap: ImageBitmap,
@@ -168,7 +169,7 @@ const bitmapToBlob = async (
   if (!ctx) throw new Error(errorStrings.canvasContextUnavailable);
   ctx.drawImage(bitmap, 0, 0);
   bitmap.close();
-  return await canvas.convertToBlob(ENCODE_OPTS);
+  return await canvas.convertToBlob(await lossyEncodeOptions(ENCODE_QUALITY));
 };
 
 const diffDataToBlob = async (
@@ -183,7 +184,7 @@ const diffDataToBlob = async (
   ctx.fillStyle = "#ffffff";
   ctx.fillRect(0, 0, width, height);
   ctx.putImageData(diff, 0, 0);
-  return await canvas.convertToBlob(ENCODE_OPTS);
+  return await canvas.convertToBlob(await lossyEncodeOptions(ENCODE_QUALITY));
 };
 
 interface PageTotals {
diff --git a/frontend/editor/src/desktop/components/shared/DefaultAppBanner.tsx b/frontend/editor/src/desktop/components/shared/DefaultAppBanner.tsx
index 1b24cd4675..5ba92c2782 100644
--- a/frontend/editor/src/desktop/components/shared/DefaultAppBanner.tsx
+++ b/frontend/editor/src/desktop/components/shared/DefaultAppBanner.tsx
@@ -1,6 +1,6 @@
 import React, { useState } from "react";
 import { useTranslation } from "react-i18next";
-import { InfoBanner } from "@app/components/shared/InfoBanner";
+import { AppBanner } from "@app/components/shared/AppBanner";
 import { useDefaultApp } from "@app/hooks/useDefaultApp";
 
 export const DefaultAppBanner: React.FC = () => {
@@ -15,7 +15,7 @@ export const DefaultAppBanner: React.FC = () => {
   const [sessionDismissed, setSessionDismissed] = useState(false);
 
   return (
-    <InfoBanner
+    <AppBanner
       icon="picture-as-pdf-rounded"
       message={t(
         "defaultApp.prompt.message",
diff --git a/frontend/editor/src/desktop/data/processorEntitySearch.ts b/frontend/editor/src/desktop/data/processorEntitySearch.ts
new file mode 100644
index 0000000000..24f752492e
--- /dev/null
+++ b/frontend/editor/src/desktop/data/processorEntitySearch.ts
@@ -0,0 +1,6 @@
+/**
+ * Desktop inherits proprietary's app but must NOT ship the portal (see the
+ * admin-route seam) — shadow the entity search back to core's empty stub so
+ * the super search never fetches or offers Processor entities on desktop.
+ */
+export { useProcessorEntityGroups } from "@core/data/processorEntitySearch";
diff --git a/frontend/editor/src/desktop/data/processorSearchIndex.ts b/frontend/editor/src/desktop/data/processorSearchIndex.ts
new file mode 100644
index 0000000000..56cfb84a0d
--- /dev/null
+++ b/frontend/editor/src/desktop/data/processorSearchIndex.ts
@@ -0,0 +1,10 @@
+/**
+ * Desktop inherits proprietary's app but must NOT ship the portal (see the
+ * admin-route seam) — shadow the index back to core's empty list so the super
+ * search never offers Processor destinations that don't exist on desktop.
+ */
+export type { ProcessorSearchEntry } from "@core/data/processorSearchIndex";
+export {
+  PROCESSOR_SEARCH_INDEX,
+  isPortalEntityScopeAccessible,
+} from "@core/data/processorSearchIndex";
diff --git a/frontend/editor/src/desktop/data/settingsSectionRegistry.ts b/frontend/editor/src/desktop/data/settingsSectionRegistry.ts
new file mode 100644
index 0000000000..dc55c927be
--- /dev/null
+++ b/frontend/editor/src/desktop/data/settingsSectionRegistry.ts
@@ -0,0 +1,50 @@
+import { type SettingsSectionEntry } from "@core/data/settingsSectionRegistry";
+
+export type { SettingsSectionEntry };
+
+/**
+ * Desktop settings sections. The desktop modal reflows heavily by connection
+ * mode (`configNavSections`): local mode shows only Preferences + Connection
+ * Mode + Legal, while SaaS mode swaps in the cloud Plan/Team sections and hides
+ * the self-hosted admin area. To stay safe across both modes without threading
+ * the (async) connection state into the always-mounted search, this lists only
+ * the sections guaranteed to render in every desktop mode.
+ *
+ * Cloud Plan/Team search on desktop-SaaS is a deliberate Tier-0 gap, not a
+ * regression — better to omit them than to deep-link to a dead tab in local
+ * mode.
+ */
+export const SETTINGS_SECTION_REGISTRY: SettingsSectionEntry[] = [
+  {
+    key: "general",
+    labelKey: "settings.general.title",
+    labelFallback: "General",
+    keywords: ["theme", "language", "appearance", "preferences", "startup"],
+    groupLabelKey: "settings.preferences.title",
+    groupLabelFallback: "Preferences",
+  },
+  {
+    key: "hotkeys",
+    labelKey: "settings.hotkeys.title",
+    labelFallback: "Keyboard Shortcuts",
+    keywords: ["hotkey", "shortcut", "keybinding", "keyboard"],
+    groupLabelKey: "settings.preferences.title",
+    groupLabelFallback: "Preferences",
+  },
+  {
+    key: "connectionMode",
+    labelKey: "settings.connection.title",
+    labelFallback: "Connection Mode",
+    keywords: ["connection", "local", "cloud", "server", "sign in"],
+    groupLabelKey: "settings.connection.title",
+    groupLabelFallback: "Connection Mode",
+  },
+  {
+    key: "legal",
+    labelKey: "settings.legal.label",
+    labelFallback: "Legal",
+    keywords: ["legal", "terms", "privacy", "licenses"],
+    groupLabelKey: "settings.legal.title",
+    groupLabelFallback: "Legal",
+  },
+];
diff --git a/frontend/editor/src/desktop/platform/openExternalTab.test.ts b/frontend/editor/src/desktop/platform/openExternalTab.test.ts
new file mode 100644
index 0000000000..e45ee1bf47
--- /dev/null
+++ b/frontend/editor/src/desktop/platform/openExternalTab.test.ts
@@ -0,0 +1,43 @@
+import { afterEach, describe, expect, test, vi } from "vitest";
+
+const shellOpenMock = vi.fn();
+
+vi.mock("@tauri-apps/plugin-shell", () => ({
+  open: (url: string) => shellOpenMock(url),
+}));
+
+import { openExternalTab } from "@app/platform/openExternalTab";
+import { expectConsole } from "@app/tests/failOnConsole";
+
+describe("openExternalTab (desktop/Tauri)", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+    shellOpenMock.mockReset();
+  });
+
+  // Regression for #6272: window.open traps the link inside the Tauri webview,
+  // so a PDF link opened a blank in-app window instead of the user's browser.
+  test("hands the URL to the OS instead of the webview", async () => {
+    const openSpy = vi
+      .spyOn(window, "open")
+      .mockImplementation(() => null as Window | null);
+
+    await openExternalTab("https://example.com/");
+
+    expect(shellOpenMock).toHaveBeenCalledWith("https://example.com/");
+    expect(openSpy).not.toHaveBeenCalled();
+  });
+
+  // Worse than the web case: an unvalidated scheme here reaches an OS handler
+  // rather than staying inside a browser.
+  test.each(["javascript:alert(1)", "file:///etc/passwd", "ftp://example.com"])(
+    "refuses to hand %s to the OS",
+    async (url) => {
+      expectConsole.warn(/Refused to open unsafe URL/);
+
+      await openExternalTab(url);
+
+      expect(shellOpenMock).not.toHaveBeenCalled();
+    },
+  );
+});
diff --git a/frontend/editor/src/desktop/platform/openExternalTab.ts b/frontend/editor/src/desktop/platform/openExternalTab.ts
new file mode 100644
index 0000000000..e7a4b5865b
--- /dev/null
+++ b/frontend/editor/src/desktop/platform/openExternalTab.ts
@@ -0,0 +1,24 @@
+/**
+ * desktop (Tauri) implementation of the @app/platform/openExternalTab seam.
+ *
+ * window.open would trap the URL inside our own webview, so hand it to the OS.
+ * Delegates to the openExternal seam rather than calling the Tauri shell plugin
+ * again — on desktop "new tab" and "system browser" are the same action.
+ *
+ * Re-checks the URL for the same reason the core impl does, and more so: here it
+ * reaches an OS handler, so an unvalidated scheme is not confined to a browser.
+ */
+import { openExternal } from "@app/platform/openExternal";
+import type { OpenExternalTab } from "@core/platform/openExternalTab";
+import { getExternalHref } from "@core/utils/externalUrl";
+
+export const openExternalTab: OpenExternalTab = async (
+  url: string,
+): Promise<void> => {
+  const safeHref = getExternalHref(url);
+  if (!safeHref) {
+    console.warn("[openExternalTab] Refused to open unsafe URL:", url);
+    return;
+  }
+  await openExternal(safeHref);
+};
diff --git a/frontend/editor/src/index.tsx b/frontend/editor/src/index.tsx
index d66f092bab..1d05928f60 100644
--- a/frontend/editor/src/index.tsx
+++ b/frontend/editor/src/index.tsx
@@ -3,6 +3,9 @@
 // (Edge / Google Translate / extensions) from crashing the app via
 // parent-mismatch DOMExceptions. See the module for details.
 import "@app/utils/patchDomForTranslators";
+// WebKit is missing several APIs the app assumes (ReadableStream async
+// iteration, which pdf.js needs for all text extraction; requestIdleCallback).
+import "@app/utils/engineShims";
 import "@mantine/core/styles.css";
 import "@mantine/dates/styles.css";
 import "../vite-env.d.ts"; // oxlint-disable-line no-restricted-imports -- Outside app paths
@@ -21,13 +24,8 @@ import { startEagerWasmCompilation } from "@app/services/wasmPrecompiler";
 applyDevWorktreeLabel();
 
 if (typeof window !== "undefined") {
-  const scheduleCompilation = () => {
-    if (typeof requestIdleCallback === "function") {
-      requestIdleCallback(() => startEagerWasmCompilation(), { timeout: 2000 });
-    } else {
-      setTimeout(startEagerWasmCompilation, 1000);
-    }
-  };
+  const scheduleCompilation = () =>
+    requestIdleCallback(() => startEagerWasmCompilation(), { timeout: 2000 });
 
   if (document.readyState === "complete") {
     scheduleCompilation();
diff --git a/frontend/editor/src/portal-saas/hooks/useFreeCreditsSummary.ts b/frontend/editor/src/portal-saas/hooks/useFreeCreditsSummary.ts
new file mode 100644
index 0000000000..8f7a16ca90
--- /dev/null
+++ b/frontend/editor/src/portal-saas/hooks/useFreeCreditsSummary.ts
@@ -0,0 +1,7 @@
+/**
+ * SaaS has no link concept — the signed-in account IS the SaaS account, and the
+ * editor's cloud wallet hook is already in this build's {@code @app/*} cascade.
+ * Delegating to it means the processor footer and the editor footer share one
+ * wallet fetch and can't disagree, so there is nothing portal-specific to do.
+ */
+export { useFreeCreditsSummary } from "@app/hooks/useFreeCreditsSummary";
diff --git a/frontend/editor/src/portal-saas/hooks/useOpenPlan.ts b/frontend/editor/src/portal-saas/hooks/useOpenPlan.ts
new file mode 100644
index 0000000000..ce12e843b3
--- /dev/null
+++ b/frontend/editor/src/portal-saas/hooks/useOpenPlan.ts
@@ -0,0 +1,11 @@
+import { useCallback } from "react";
+import { useUI } from "@portal/contexts/UIContext";
+
+/**
+ * SaaS processor: the settings modal it hosts carries the same Plan section the
+ * editor opens, so the footer's credits row lands both apps in one place.
+ */
+export function useOpenPlan(): (() => void) | null {
+  const { openSettings } = useUI();
+  return useCallback(() => openSettings("plan"), [openSettings]);
+}
diff --git a/frontend/editor/src/portal/MOCKS.md b/frontend/editor/src/portal/MOCKS.md
index 6d66b969ee..3e8f225ae9 100644
--- a/frontend/editor/src/portal/MOCKS.md
+++ b/frontend/editor/src/portal/MOCKS.md
@@ -64,12 +64,9 @@ non-2xx). Views consume via `useAsync()` + `useSectionFlags()` (`hooks/useAsync.
 | Policies | `GET/POST /api/v1/policies` · `GET/DELETE /api/v1/policies/{id}` · `POST /api/v1/policies/{id}/run` | — | `fetchPolicies` · `savePolicy` · `deletePolicy` · `runPolicy` | `PoliciesResponse` · `Policy` |
 | Sources | `GET /v1/sources` | `tier` | `fetchSources` | `SourcesResponse` |
 | Components | `GET /v1/components` | `tier` | `fetchComponents` | `ComponentsResponse` |
-| Infrastructure | `GET /v1/infrastructure/deployments` | `tier` | `fetchDeployments` | `DeploymentsResponse` |
-| Infrastructure | `GET /v1/infrastructure/api-keys` | `tier` | `fetchApiKeys` | `ApiKey[]` |
-| Infrastructure | `GET /v1/infrastructure/security` | `tier` | `fetchSecurity` | `SecurityConfig` |
-| Infrastructure | `GET /v1/infrastructure/models` | `tier` | `fetchModels` | `ModelsResponse` |
-| Infrastructure | `GET /v1/infrastructure/storage` | `tier` | `fetchStorage` | `StorageConfig` |
-| Infrastructure | `GET /v1/infrastructure/audit-log` | `tier` | `fetchAuditLog` | `AuditLogResponse` |
+| Infrastructure | `GET/POST /api/v1/proprietary/ui-data/infrastructure/api-keys` · `DELETE …/api-keys/{id}` | — | `fetchApiKeys` · `createApiKey` · `revokeApiKey` | `ApiKeysResponse` · `CreatedApiKey` |
+| Infrastructure | `GET /api/v1/proprietary/ui-data/infrastructure/audit-log` | `tier` | `fetchAuditLog` | `AuditLogResponse` |
+| Infrastructure | `GET /api/v1/proprietary/ui-data/audit-export` | `format`, `fields` | `exportAuditLog` | CSV/JSON blob |
 | Usage & Billing | `GET /v1/billing/usage` | — | `fetchBillingUsage` | `UsageSeriesResponse` |
 | Usage & Billing | `GET /v1/billing/summary` | `tier` | `fetchBillingSummary` | `BillingSummary` |
 | Usage & Billing | `GET /v1/billing/plans` | — | `fetchPlanOptions` | `PlanOption[]` |
diff --git a/frontend/editor/src/portal/api/documents.ts b/frontend/editor/src/portal/api/documents.ts
index 9e75f40ec7..6339f25222 100644
--- a/frontend/editor/src/portal/api/documents.ts
+++ b/frontend/editor/src/portal/api/documents.ts
@@ -95,12 +95,6 @@ export const DOCUMENT_STATUS_TONE: Record<DocumentStatus, StatusTone> = {
   error: "danger",
 };
 
-export const PRODUCT_CHIP_TONE: Record<ProductType, ChipAccent> = {
-  API: "brand",
-  Editor: "success",
-  Automation: "warning",
-};
-
 /** Classification chip accent: danger when unclassified, warning when it needs a look. */
 export function classificationTone(doc: ReviewDocument): ChipAccent {
   if (doc.classification === "Unclassified") return "danger";
diff --git a/frontend/editor/src/portal/api/fileRunEvents.ts b/frontend/editor/src/portal/api/fileRunEvents.ts
index 8b52c7d3fc..768618132e 100644
--- a/frontend/editor/src/portal/api/fileRunEvents.ts
+++ b/frontend/editor/src/portal/api/fileRunEvents.ts
@@ -35,7 +35,9 @@ export type FileRunEventStatus =
   | "NEW"
   | "ACKNOWLEDGED"
   | "DISMISSED"
-  | "RESOLVED";
+  | "RESOLVED"
+  /** Its document was deleted from the owner's editor, so there is nothing left to act on. */
+  | "FILE_REMOVED";
 
 /**
  * One button as offered for one row. `id` is a plain string rather than a union
@@ -64,6 +66,8 @@ export interface FileRunEvent {
   detail: string | null;
   policyId: string | null;
   runId: string | null;
+  /** Which folder, bucket or webhook fed the run. Null when a user supplied the file. */
+  sourceId: string | null;
   /**
    * Opaque reference, never a name. Only the owner's own client can resolve it to
    * something readable, from its local file store.
diff --git a/frontend/editor/src/portal/api/infrastructure.ts b/frontend/editor/src/portal/api/infrastructure.ts
index 52a54179a5..afd059a1ef 100644
--- a/frontend/editor/src/portal/api/infrastructure.ts
+++ b/frontend/editor/src/portal/api/infrastructure.ts
@@ -1,44 +1,6 @@
 import { apiClient } from "@portal/api/http";
 import type { Tier } from "@portal/contexts/TierContext";
 
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Deployments                                                              */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-export type RegionStatus = "healthy" | "degraded" | "down";
-
-export interface DeploymentRegion {
-  name: string;
-  code: string;
-  /** Median request latency, ms. */
-  latencyMs: number;
-  /** Current load as a fraction of provisioned capacity (0–1). */
-  load: number;
-  status: RegionStatus;
-  /** Deployed Stirling engine version. */
-  version: string;
-  /** 30-day uptime as a fraction (0–1). */
-  uptime: number;
-  /** Running instance count. */
-  instances: number;
-  /** Sustained throughput, docs/min. */
-  throughput: number;
-  /** P99 latency, ms. */
-  p99Ms: number;
-}
-
-export type DeploymentStatus = "live" | "rolling" | "rolled-back" | "queued";
-
-export interface RecentDeployment {
-  id: string;
-  version: string;
-  environment: "production" | "staging" | "canary";
-  product: string;
-  status: DeploymentStatus;
-  deployedBy: string;
-  timestamp: string;
-}
-
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  API Keys                                                                 */
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -72,105 +34,6 @@ export interface CreatedApiKey {
   secret: string;
 }
 
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Security                                                                 */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-export type AccessPolicy = "stirling" | "byok" | "hyok";
-export type DataResidency = "us" | "eu" | "apac";
-export type CertStatus = "certified" | "in-progress" | "not-started";
-
-export interface ComplianceCert {
-  id: string;
-  name: string;
-  status: CertStatus;
-  detail: string;
-}
-
-export interface IpAllowEntry {
-  id: string;
-  label: string;
-  cidr: string;
-  addedBy: string;
-  added: string;
-}
-
-/**
- * Where encryption keys live. Mirrors the {@link AccessPolicy} posture but is
- * surfaced separately because the key *custody model* (who can decrypt) is the
- * detail security teams scrutinise:
- *   - `managed` — Stirling-owned KMS keys; zero key ops on the customer side.
- *   - `byok` — customer key, but Stirling can use it to decrypt while processing.
- *   - `hyok` — key never leaves the customer KMS; Stirling holds only ciphertext.
- */
-export type KeyMode = "managed" | "byok" | "hyok";
-
-export interface KeyManagement {
-  mode: KeyMode;
-  /** Human-readable provider, e.g. "Stirling KMS" or "AWS KMS (customer)". */
-  provider: string;
-  /** ARN-style identifier for the active key. */
-  keyId: string;
-  /** Encryption algorithm in force. */
-  algorithm: string;
-  /** Relative last-rotation time, e.g. "32 days ago". */
-  lastRotated: string;
-  /** Rotation cadence summary, e.g. "Automatic · every 90 days". */
-  rotationPolicy: string;
-  /**
-   * Whether the customer may switch key custody (BYOK/HYOK). Stirling-managed
-   * tiers see the posture but cannot change provider — only enterprise can.
-   */
-  customerManaged: boolean;
-}
-
-export type AttestationStatus = "attested" | "in-scope" | "not-applicable";
-
-export interface ComplianceAttestation {
-  id: string;
-  name: string;
-  /** Framework family / short descriptor shown under the name. */
-  framework: string;
-  status: AttestationStatus;
-  /** Coverage or audit detail, e.g. "Type II · audited Apr 2026". */
-  detail: string;
-  /** Stub link to the downloadable report; null when none is available. */
-  reportUrl: string | null;
-}
-
-export interface SecurityConfig {
-  accessPolicy: AccessPolicy;
-  dataResidency: DataResidency;
-  certs: ComplianceCert[];
-  ipAllowlist: IpAllowEntry[];
-  keyManagement: KeyManagement;
-  attestations: ComplianceAttestation[];
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Storage                                                                  */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-export type RetentionWindow = "30" | "60" | "90" | "180" | "never";
-
-export interface StorageProvider {
-  id: string;
-  name: string;
-  kind: "stirling" | "s3" | "azure";
-  connected: boolean;
-  detail: string;
-  usedGb: number;
-}
-
-export interface StorageConfig {
-  /** Total used storage, GB. */
-  usedGb: number;
-  /** Quota ceiling, GB. */
-  quotaGb: number;
-  retention: RetentionWindow;
-  providers: StorageProvider[];
-}
-
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  Audit Logs                                                               */
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -211,83 +74,12 @@ export interface AuditLogResponse {
   fullServer: boolean;
 }
 
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Models                                                                   */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-export type ModelProvider = "stirling" | "openai" | "anthropic" | "on-prem";
-export type ModelType = "extraction" | "classification" | "ocr" | "llm";
-export type ModelStatus = "active" | "degraded" | "disabled";
-
-/** Whether a model's cost is billed per 1k documents or per individual call. */
-export type ModelCostUnit = "per-1k-docs" | "per-call";
-
-export interface ModelEntry {
-  id: string;
-  name: string;
-  provider: ModelProvider;
-  type: ModelType;
-  status: ModelStatus;
-  /** Median inference latency, ms. */
-  latencyMs: number;
-  /** Cost in USD for the model's billing unit (see {@link costUnit}). */
-  cost: number;
-  costUnit: ModelCostUnit;
-  version: string;
-  /** Share of capacity this model is currently absorbing (0–1). */
-  load: number;
-  /** True for customer-registered bring-your-own / on-prem models. */
-  managed: boolean;
-}
-
-/** A binding from a processing operation (optionally a doc-type) to a model. */
-export interface RoutingRule {
-  id: string;
-  /** The operation or pipeline stage this rule governs. */
-  operation: string;
-  /** Doc-type scope, or "All document types" for a catch-all. */
-  docType: string;
-  /** id of the {@link ModelEntry} this operation routes to. */
-  modelId: string;
-  modelName: string;
-  /** Marks the fallback rule applied when no narrower rule matches. */
-  isDefault: boolean;
-}
-
-export interface ModelsSummary {
-  activeModels: number;
-  /** Capacity-weighted average latency across active models, ms. */
-  avgLatencyMs: number;
-  /** Projected monthly model spend, USD. */
-  monthlySpend: number;
-}
-
-export interface ModelsResponse {
-  summary: ModelsSummary;
-  models: ModelEntry[];
-  routing: RoutingRule[];
-}
-
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  Endpoints                                                                */
 /* ──────────────────────────────────────────────────────────────────────── */
 
-export interface DeploymentsResponse {
-  regions: DeploymentRegion[];
-  recent: RecentDeployment[];
-}
-
 const q = (tier: Tier) => `?tier=${encodeURIComponent(tier)}`;
 
-/** GET /v1/infrastructure/deployments?tier=… */
-export async function fetchDeployments(
-  tier: Tier,
-): Promise<DeploymentsResponse> {
-  return apiClient.local.json<DeploymentsResponse>(
-    `/v1/infrastructure/deployments${q(tier)}`,
-  );
-}
-
 const API_KEYS_PATH = "/api/v1/proprietary/ui-data/infrastructure/api-keys";
 
 // Always this instance's own backend: a key authenticates the instance that issued it, so a
@@ -314,27 +106,6 @@ export async function revokeApiKey(id: string): Promise<void> {
   await apiClient.local.json<void>(path, { method: "DELETE" });
 }
 
-/** GET /v1/infrastructure/security?tier=… */
-export async function fetchSecurity(tier: Tier): Promise<SecurityConfig> {
-  return apiClient.local.json<SecurityConfig>(
-    `/v1/infrastructure/security${q(tier)}`,
-  );
-}
-
-/** GET /v1/infrastructure/models?tier=… */
-export async function fetchModels(tier: Tier): Promise<ModelsResponse> {
-  return apiClient.local.json<ModelsResponse>(
-    `/v1/infrastructure/models${q(tier)}`,
-  );
-}
-
-/** GET /v1/infrastructure/storage?tier=… */
-export async function fetchStorage(tier: Tier): Promise<StorageConfig> {
-  return apiClient.local.json<StorageConfig>(
-    `/v1/infrastructure/storage${q(tier)}`,
-  );
-}
-
 /** GET the audit log; SaaS or local, backend-scoped (admin → server, SaaS lead → team). */
 export async function fetchAuditLog(tier: Tier): Promise<AuditLogResponse> {
   const path = `/api/v1/proprietary/ui-data/infrastructure/audit-log${q(tier)}`;
diff --git a/frontend/editor/src/portal/api/search.ts b/frontend/editor/src/portal/api/search.ts
deleted file mode 100644
index d3fc672577..0000000000
--- a/frontend/editor/src/portal/api/search.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { apiClient } from "@portal/api/http";
-
-export interface QuickAction {
-  group: "Jump to" | "Create" | "Theme";
-  label: string;
-  /** Keyboard hint shown to the right. */
-  hint: string;
-}
-
-/** GET /v1/search/quick-actions */
-export async function fetchQuickActions(): Promise<QuickAction[]> {
-  return apiClient.local.json<QuickAction[]>("/v1/search/quick-actions");
-}
diff --git a/frontend/editor/src/portal/api/usersCapabilities.ts b/frontend/editor/src/portal/api/usersCapabilities.ts
index dcea5487ec..01f68ae283 100644
--- a/frontend/editor/src/portal/api/usersCapabilities.ts
+++ b/frontend/editor/src/portal/api/usersCapabilities.ts
@@ -56,4 +56,12 @@ export interface UsersCapabilities {
   manageGrants: boolean;
   /** Whether "remove" takes the member out of the whole org or just the team. */
   removeScope: "org" | "team";
+  /**
+   * Listing the roster needs the org-admin role. Self-hosted reads the
+   * admin-only endpoints (`@PreAuthorize(hasRole('ADMIN'))`), which refuse
+   * the non-admin sessions portal access also admits (team owners, ACL
+   * grantees). SaaS lists through the team-leader endpoints, which every
+   * portal-eligible session can call.
+   */
+  listingRequiresAdmin: boolean;
 }
diff --git a/frontend/editor/src/portal/components/AppShell.css b/frontend/editor/src/portal/components/AppShell.css
index 1657b56bdf..d3f1332969 100644
--- a/frontend/editor/src/portal/components/AppShell.css
+++ b/frontend/editor/src/portal/components/AppShell.css
@@ -42,8 +42,8 @@
   align-items: center;
   gap: 0.375rem;
   padding: 0 0.625rem;
-  background: var(--color-sidebar-bg);
-  border-bottom: 1px solid var(--color-sidebar-border);
+  background: var(--c-bg-raised);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-shell__topbar-wordmark {
diff --git a/frontend/editor/src/portal/components/AppShell.stories.tsx b/frontend/editor/src/portal/components/AppShell.stories.tsx
index 1df98c3197..a15488c48b 100644
--- a/frontend/editor/src/portal/components/AppShell.stories.tsx
+++ b/frontend/editor/src/portal/components/AppShell.stories.tsx
@@ -1,4 +1,5 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
 import { AppShell } from "@portal/components/AppShell";
 import { Home } from "@portal/views/Home";
 
@@ -12,6 +13,14 @@ const meta: Meta<typeof AppShell> = {
   title: "Portal/Shell/AppShell",
   component: AppShell,
   parameters: { layout: "fullscreen" },
+  decorators: [
+    // The shell hosts the portal search bar, which reads the tool registry.
+    (Story) => (
+      <ToolRegistryProvider>
+        <Story />
+      </ToolRegistryProvider>
+    ),
+  ],
 };
 export default meta;
 type Story = StoryObj<typeof AppShell>;
diff --git a/frontend/editor/src/portal/components/AppShell.tsx b/frontend/editor/src/portal/components/AppShell.tsx
index 77c8f90686..1811fa02c4 100644
--- a/frontend/editor/src/portal/components/AppShell.tsx
+++ b/frontend/editor/src/portal/components/AppShell.tsx
@@ -3,6 +3,7 @@ import { useTranslation } from "react-i18next";
 import { useLocation } from "react-router-dom";
 import { ActionIcon } from "@app/ui";
 import { Sidebar } from "@portal/components/Sidebar";
+import { PortalSearchBar } from "@portal/components/PortalSearchBar";
 import { useUI } from "@portal/contexts/UIContext";
 import { MenuIcon, SearchIcon } from "@portal/components/icons";
 import { Logo } from "@app/ui/Logo";
@@ -10,12 +11,12 @@ import "@portal/components/AppShell.css";
 
 /**
  * Compact header shown only under the mobile breakpoint (CSS-hidden on
- * desktop): hamburger opens the sidebar drawer, search opens the palette
- * (there's no ⌘K on a phone).
+ * desktop): hamburger opens the sidebar drawer, search focuses the global
+ * search bar below (there's no ⌘K on a phone).
  */
 function MobileTopbar() {
   const { t } = useTranslation();
-  const { mobileNavOpen, toggleMobileNav, openSearch } = useUI();
+  const { mobileNavOpen, toggleMobileNav, closeMobileNav } = useUI();
   return (
     <header className="portal-shell__topbar">
       <ActionIcon
@@ -37,7 +38,10 @@ function MobileTopbar() {
         variant="tertiary"
         size="lg"
         aria-label={t("portal.shell.topbar.search")}
-        onClick={openSearch}
+        onClick={() => {
+          closeMobileNav();
+          document.getElementById("portal-search-input")?.focus();
+        }}
       >
         <SearchIcon size={19} />
       </ActionIcon>
@@ -47,9 +51,10 @@ function MobileTopbar() {
 
 /**
  * Two-column layout: fixed-width sidebar on the left, a scrolling main column on
- * the right. Under the mobile breakpoint the sidebar becomes an off-canvas
- * drawer behind a scrim, opened from the topbar hamburger. The Sidebar reads
- * its state from context, so this shell stays prop-free.
+ * the right (topped by the global search bar). Under the mobile breakpoint the
+ * sidebar becomes an off-canvas drawer behind a scrim, opened from the topbar
+ * hamburger. The Sidebar reads its state from context, so this shell stays
+ * prop-free.
  */
 export function AppShell({ children }: { children: ReactNode }) {
   const { mobileNavOpen, closeMobileNav } = useUI();
@@ -83,6 +88,7 @@ export function AppShell({ children }: { children: ReactNode }) {
       )}
       <div className="portal-shell__main">
         <MobileTopbar />
+        <PortalSearchBar />
         <main className="portal-shell__view">{children}</main>
       </div>
     </div>
diff --git a/frontend/editor/src/portal/components/BrandMarks.tsx b/frontend/editor/src/portal/components/BrandMarks.tsx
index 7c381650d3..afa6de8d65 100644
--- a/frontend/editor/src/portal/components/BrandMarks.tsx
+++ b/frontend/editor/src/portal/components/BrandMarks.tsx
@@ -188,6 +188,21 @@ const BRAND: Record<string, (p: MarkProps) => ReactNode> = {
       <circle cx="12" cy="12" r="2.6" fill="#FF4F00" />
     </Fill>
   ),
+  n8n: (p) => (
+    <Fill {...p}>
+      <g stroke="#EA4B71" strokeWidth="1.6" fill="none" strokeLinecap="round">
+        <path d="M3.6 12h5.2" />
+        <path d="M13.2 12h1.2c1.1 0 1.5-.8 2-1.7s.9-1.7 2-1.7h1" />
+        <path d="M13.2 12h1.2c1.1 0 1.5.8 2 1.7s.9 1.7 2 1.7h1" />
+      </g>
+      <g fill="#EA4B71">
+        <circle cx="2.6" cy="12" r="1.7" />
+        <circle cx="11" cy="12" r="2.4" />
+        <circle cx="20.6" cy="8.6" r="1.7" />
+        <circle cx="20.6" cy="15.4" r="1.7" />
+      </g>
+    </Fill>
+  ),
   jira: (p) => (
     <Fill {...p}>
       <path
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.css b/frontend/editor/src/portal/components/EditorStatusCard.css
index 692d08adc3..53581828e7 100644
--- a/frontend/editor/src/portal/components/EditorStatusCard.css
+++ b/frontend/editor/src/portal/components/EditorStatusCard.css
@@ -3,10 +3,6 @@
 /* ──────────────────────────────────────────────────────────────────────── */
 
 .portal-editor-hero {
-  border-radius: var(--radius-xl);
-  border: 1px solid var(--c-border);
-  background: var(--c-surface);
-  box-shadow: var(--shadow-sm);
   overflow: hidden;
 }
 
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.tsx b/frontend/editor/src/portal/components/EditorStatusCard.tsx
index b506a0a366..e4918ed859 100644
--- a/frontend/editor/src/portal/components/EditorStatusCard.tsx
+++ b/frontend/editor/src/portal/components/EditorStatusCard.tsx
@@ -10,6 +10,7 @@ import {
 } from "@portal/queries/infrastructure";
 import { type EditorInstance } from "@portal/api/editorDeploy";
 import { DownloadEditorModal } from "@portal/components/DownloadEditorModal";
+import "@portal/theme/surface.css";
 import "@portal/components/EditorStatusCard.css";
 
 /** The Stirling brand mark, drawn at the hero size. Decorative. */
@@ -120,7 +121,7 @@ export function EditorStatusCard({ footer }: EditorStatusCardProps) {
 
   return (
     <section
-      className="portal-editor-hero"
+      className="portal-surface portal-editor-hero"
       aria-label={t("portal.home.editor.name")}
     >
       <div className="portal-editor-hero__row">
diff --git a/frontend/editor/src/portal/components/HomeHero.tsx b/frontend/editor/src/portal/components/HomeHero.tsx
index e81d42dfef..954eac9908 100644
--- a/frontend/editor/src/portal/components/HomeHero.tsx
+++ b/frontend/editor/src/portal/components/HomeHero.tsx
@@ -31,7 +31,7 @@ export function HomeHero() {
       {procurement.loading ? (
         // Hold the rail's shape rather than committing to a footer: branching before the snapshot
         // lands paints the no-deal rail first, flashing on every refresh of an active deal.
-        <section className="portal-editor-hero" aria-busy>
+        <section className="portal-surface portal-editor-hero" aria-busy>
           <div className="portal-editor-hero__row">
             <Skeleton width="2rem" height="2rem" />
             <Skeleton width="12rem" height="1rem" />
diff --git a/frontend/editor/src/portal/components/PortalChrome.tsx b/frontend/editor/src/portal/components/PortalChrome.tsx
index 1262c84b8e..87afd094cc 100644
--- a/frontend/editor/src/portal/components/PortalChrome.tsx
+++ b/frontend/editor/src/portal/components/PortalChrome.tsx
@@ -1,39 +1,11 @@
-import { useEffect } from "react";
 import { useLocation } from "react-router-dom";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
 import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
 import { ErrorBoundary } from "@portal/components/ErrorBoundary";
-import { useUI } from "@portal/contexts/UIContext";
 import { AppShell } from "@portal/components/AppShell";
-import { SearchModal } from "@portal/components/SearchModal";
 import { PortalSettingsHost } from "@portal/components/PortalSettingsHost";
 import { ViewRouter } from "@portal/ViewRouter";
 
-/**
- * Global keyboard shortcuts. Lives below the UIProvider so it can dispatch into
- * the overlay state. Currently just ⌘K / Ctrl+K to toggle the search palette.
- */
-function GlobalShortcuts() {
-  const { toggleSearch, closeSearch } = useUI();
-
-  useEffect(() => {
-    function onKey(e: KeyboardEvent) {
-      const isCmdK = (e.metaKey || e.ctrlKey) && e.key.toLowerCase() === "k";
-      if (isCmdK) {
-        e.preventDefault();
-        toggleSearch();
-        return;
-      }
-      if (e.key === "Escape") {
-        closeSearch();
-      }
-    }
-    document.addEventListener("keydown", onKey);
-    return () => document.removeEventListener("keydown", onKey);
-  }, [toggleSearch, closeSearch]);
-
-  return null;
-}
-
 /**
  * The routed view, wrapped in an error boundary so a single view crashing can't
  * white-screen the portal (the shell + nav stay alive). Keyed by route so
@@ -49,24 +21,24 @@ function RoutedContent() {
 }
 
 /**
- * The flavor-agnostic portal chrome: the shell (sidebar + header + routed view)
- * plus the global overlays that every flavor shares. Requires only the Tier and
- * UI contexts above it — both flavors provide those. Flavor-specific overlays
- * (e.g. the self-hosted account-link modal) are mounted by PortalProviders, not
- * here.
+ * The flavor-agnostic portal chrome: the shell (sidebar + search bar + routed
+ * view) plus the global overlays that every flavor shares. Requires only the
+ * Tier and UI contexts above it — both flavors provide those. Flavor-specific
+ * overlays (e.g. the self-hosted account-link modal) are mounted by
+ * PortalProviders, not here.
  */
 export function PortalChrome() {
   return (
-    <>
-      <GlobalShortcuts />
+    // One app-config instance for every portal consumer (search gates, the
+    // settings modal) so they can't fetch twice or disagree.
+    <AppConfigProvider bootstrapMode="non-blocking">
       {/* The pipeline builder reads the tool registry to list and configure operations. */}
       <ToolRegistryProvider>
         <AppShell>
           <RoutedContent />
         </AppShell>
       </ToolRegistryProvider>
-      <SearchModal />
       <PortalSettingsHost />
-    </>
+    </AppConfigProvider>
   );
 }
diff --git a/frontend/editor/src/portal/components/PortalSearchBar.css b/frontend/editor/src/portal/components/PortalSearchBar.css
new file mode 100644
index 0000000000..cf1d9971c7
--- /dev/null
+++ b/frontend/editor/src/portal/components/PortalSearchBar.css
@@ -0,0 +1,30 @@
+/* Slim strip at the top of the main column hosting the shared search bar.
+   Deliberately unpainted: only the input itself shows, on the page ground. */
+.portal-searchbar {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0.22rem 1rem;
+  flex-shrink: 0;
+}
+
+.portal-searchbar .super-search {
+  flex: 0 1 24rem;
+  width: min(100%, 24rem);
+  max-width: 24rem;
+}
+
+.portal-searchbar .super-search input {
+  background-color: transparent;
+  padding-top: 4px;
+  padding-bottom: 4px;
+  font-size: 12.5px;
+}
+
+/* The dropdown is portalled to <body>, so it can't inherit portal styling by
+   nesting — this class (passed via dropdownClassName) is the portal's hook.
+   Colours come from the shared semantic tokens; only the roomier padding
+   differs from the editor dropdown. */
+.portal-search-dropdown.super-search-dropdown {
+  padding: 0.5rem;
+}
diff --git a/frontend/editor/src/portal/components/PortalSearchBar.tsx b/frontend/editor/src/portal/components/PortalSearchBar.tsx
new file mode 100644
index 0000000000..5913c43ecc
--- /dev/null
+++ b/frontend/editor/src/portal/components/PortalSearchBar.tsx
@@ -0,0 +1,29 @@
+import SuperSearch from "@app/components/shared/superSearch/SuperSearch";
+import {
+  usePortalSearchResults,
+  usePortalSearchScopes,
+} from "@portal/hooks/usePortalSearchResults";
+import "@portal/components/PortalSearchBar.css";
+
+/**
+ * The portal face of the global super search — the same bar the editor's
+ * workbench shows, fed by the portal-wired results provider. Cmd/Ctrl+K
+ * focuses it (the bar registers its own shortcut). App config (the
+ * admin/login gates) comes from PortalChrome's shared provider. The distinct
+ * input id keeps this instance clear of the editor bar's stable id, which
+ * external focus helpers target.
+ */
+export function PortalSearchBar() {
+  const scopes = usePortalSearchScopes();
+
+  return (
+    <div className="portal-searchbar">
+      <SuperSearch
+        useResults={usePortalSearchResults}
+        inputId="portal-search-input"
+        scopes={scopes}
+        dropdownClassName="portal-search-dropdown"
+      />
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/PortalSettingsHost.tsx b/frontend/editor/src/portal/components/PortalSettingsHost.tsx
index 954faeb848..0aec29dd14 100644
--- a/frontend/editor/src/portal/components/PortalSettingsHost.tsx
+++ b/frontend/editor/src/portal/components/PortalSettingsHost.tsx
@@ -13,22 +13,38 @@ import {
 import { accountLinkSettings } from "@portal/components/settings/accountLinkSettings";
 import { useUI } from "@portal/contexts/UIContext";
 
+/**
+ * Settings sections the portal cannot host. Shared with the portal's search
+ * provider so these never surface as search results either.
+ *
+ * TODO: opening Keyboard Shortcuts in the portal white-screens the app (the
+ * section expects editor-only context). Hidden here as a stopgap; fix the
+ * section properly and drop this.
+ */
+export const PORTAL_HIDDEN_SECTION_KEYS: NavKey[] = ["hotkeys"];
+
 /**
  * Mounts the editor's settings modal (the app-wide settings surface) inside the
  * portal. The portal deliberately lives outside the editor's AppProviders, so
- * this host supplies the contexts the settings tree needs: app config, user
- * preferences, the session provider the account sections read (flavor-resolved:
- * Spring on self-hosted, Supabase on SaaS — same underlying session the portal
- * is already signed in with), and the editor ThemeProvider (which also carries
- * the Mantine theme + toasts the sections expect). URL sync is off — the portal
- * owns its own route subtree, so the modal keeps its section purely in state.
+ * this host supplies the contexts the settings tree needs: user preferences,
+ * the session provider the account sections read (flavor-resolved: Spring on
+ * self-hosted, Supabase on SaaS — same underlying session the portal is
+ * already signed in with), and the editor ThemeProvider (which also carries
+ * the Mantine theme + toasts the sections expect). App config comes from
+ * PortalChrome's shared provider. URL sync is off — the portal owns its own
+ * route subtree, so the modal keeps its section purely in state.
  *
  * Everything (providers included) mounts on first open and stays mounted, so
  * the editor theme wiring never runs for portal sessions that never open
  * settings.
  */
 export function PortalSettingsHost() {
-  const { settingsOpen, settingsInitialSection, closeSettings } = useUI();
+  const {
+    settingsOpen,
+    settingsInitialSection,
+    settingsInitialFocus,
+    closeSettings,
+  } = useUI();
   const { t } = useTranslation();
   const [everOpened, setEverOpened] = useState(false);
 
@@ -74,11 +90,9 @@ export function PortalSettingsHost() {
               onClose={closeSettings}
               urlSync={false}
               initialSection={initialSection}
+              initialFocus={settingsInitialFocus}
               extraSections={extraSections}
-              // TODO: opening Keyboard Shortcuts in the portal white-screens
-              // the app (the section expects editor-only context). Hidden here
-              // as a stopgap; fix the section properly and drop this.
-              hiddenSectionKeys={["hotkeys"]}
+              hiddenSectionKeys={PORTAL_HIDDEN_SECTION_KEYS}
             />
           </ThemeProvider>
         </PreferencesProvider>
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.css b/frontend/editor/src/portal/components/ProcessorFlow.css
index e24b4d7f3c..e1e61d819e 100644
--- a/frontend/editor/src/portal/components/ProcessorFlow.css
+++ b/frontend/editor/src/portal/components/ProcessorFlow.css
@@ -121,9 +121,10 @@
   height: auto;
   width: 100%;
   text-align: left;
-  background: var(--c-bg);
+  background: var(--c-surface);
   border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
+  box-shadow: var(--sui-elevation-raised);
   transition:
     background var(--motion-fast),
     border-color var(--motion-fast);
@@ -148,6 +149,7 @@
 .portal-pf__node--soon {
   background: transparent;
   border-style: dashed;
+  box-shadow: none;
   /* The dashed border and muted ink mark this as not-yet-available; fading the
      whole node with opacity would drop its label below the contrast floor. */
   color: var(--c-text-muted);
@@ -202,15 +204,16 @@
 }
 
 /* ── Policies card (core) ───────────────────────────────────────────────────── */
+/* Same secondary-surface treatment as the nodes it sits between. */
 .portal-pf__policies {
   align-self: center;
   flex: none;
   width: 18rem;
   padding: 0.75rem;
-  background: var(--c-bg);
+  background: var(--c-surface);
   border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-sm);
+  border-radius: var(--radius-md);
+  box-shadow: var(--sui-elevation-raised);
 }
 
 .portal-pf__policies-head {
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.tsx b/frontend/editor/src/portal/components/ProcessorFlow.tsx
index ad1f604a6a..b4aa34a8f2 100644
--- a/frontend/editor/src/portal/components/ProcessorFlow.tsx
+++ b/frontend/editor/src/portal/components/ProcessorFlow.tsx
@@ -2,6 +2,7 @@ import { useState } from "react";
 import { useNavigate } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { Card, SegmentedControl, Skeleton, StatusBadge } from "@app/ui";
+import "@app/ui/Surface.css";
 import {
   useView,
   VIEW_PATHS,
diff --git a/frontend/editor/src/portal/components/SearchModal.css b/frontend/editor/src/portal/components/SearchModal.css
deleted file mode 100644
index 501cfd140a..0000000000
--- a/frontend/editor/src/portal/components/SearchModal.css
+++ /dev/null
@@ -1,70 +0,0 @@
-.portal-search__input-row {
-  display: flex;
-  align-items: center;
-  gap: 0.625rem;
-  padding: 0.25rem 0.25rem 0.75rem;
-  border-bottom: 1px solid var(--c-border-subtle);
-  color: var(--c-text-subtle);
-}
-
-.portal-search__input {
-  flex: 1 1 auto;
-  font: inherit;
-  font-size: 0.9375rem;
-  background: transparent;
-  border: none;
-  outline: none;
-  color: var(--c-text);
-}
-
-.portal-search__input::placeholder {
-  color: var(--color-text-placeholder);
-}
-
-.portal-search__esc {
-  font-family: var(--font-mono);
-  font-size: 0.6875rem;
-  padding: 0.0625rem 0.375rem;
-  border-radius: var(--radius-xs);
-  background: var(--c-surface-sunken);
-  color: var(--c-text-subtle);
-}
-
-.portal-search__results {
-  padding-top: 0.75rem;
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-  max-height: 24rem;
-  overflow-y: auto;
-}
-
-.portal-search__group-label {
-  font-size: 0.6875rem;
-  text-transform: uppercase;
-  letter-spacing: 0.06em;
-  color: var(--color-section-label);
-  padding: 0 0.5rem 0.375rem;
-}
-
-.portal-search__item {
-  width: 100%;
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  padding: 0.5rem 0.625rem;
-  border-radius: var(--radius-sm);
-  color: var(--c-text-muted);
-  font-size: 0.8125rem;
-  text-align: left;
-}
-
-.portal-search__item:hover {
-  background: var(--c-hover);
-}
-
-.portal-search__item-hint {
-  font-family: var(--font-mono);
-  font-size: 0.6875rem;
-  color: var(--c-text-subtle);
-}
diff --git a/frontend/editor/src/portal/components/SearchModal.stories.tsx b/frontend/editor/src/portal/components/SearchModal.stories.tsx
deleted file mode 100644
index 892c99c3ae..0000000000
--- a/frontend/editor/src/portal/components/SearchModal.stories.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { useEffect } from "react";
-import { http, HttpResponse } from "msw";
-import { SearchModal } from "@portal/components/SearchModal";
-import { useUI } from "@portal/contexts/UIContext";
-
-function ForceOpen() {
-  const { openSearch } = useUI();
-  useEffect(() => {
-    openSearch();
-  }, [openSearch]);
-  return null;
-}
-
-const meta: Meta<typeof SearchModal> = {
-  title: "Portal/Header/SearchModal",
-  component: SearchModal,
-  parameters: { layout: "fullscreen" },
-  decorators: [
-    (S) => (
-      <div style={{ minHeight: "100vh", background: "var(--c-bg)" }}>
-        <ForceOpen />
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof SearchModal>;
-
-export const Default: Story = {};
-
-export const EmptyCatalogue: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/search/quick-actions", () => HttpResponse.json([])),
-      ],
-    },
-  },
-};
diff --git a/frontend/editor/src/portal/components/SearchModal.tsx b/frontend/editor/src/portal/components/SearchModal.tsx
deleted file mode 100644
index 6aac7e99d4..0000000000
--- a/frontend/editor/src/portal/components/SearchModal.tsx
+++ /dev/null
@@ -1,125 +0,0 @@
-import { useEffect, useMemo, useRef, useState } from "react";
-import { Button, EmptyState, Modal, Skeleton } from "@app/ui";
-import { useTranslation } from "react-i18next";
-import { useUI } from "@portal/contexts/UIContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import { fetchQuickActions, type QuickAction } from "@portal/api/search";
-import { SearchIcon } from "@portal/components/icons";
-import "@portal/components/SearchModal.css";
-
-export function SearchModal() {
-  const { t } = useTranslation();
-  const { searchOpen, closeSearch } = useUI();
-  const inputRef = useRef<HTMLInputElement | null>(null);
-  const [query, setQuery] = useState("");
-  const state = useAsync<QuickAction[]>(() => fetchQuickActions(), []);
-  const { data: actions } = state;
-  const { isLoading } = useSectionFlags(state);
-
-  useEffect(() => {
-    if (searchOpen) {
-      setQuery("");
-      const t = setTimeout(() => inputRef.current?.focus(), 0);
-      return () => clearTimeout(t);
-    }
-    return undefined;
-  }, [searchOpen]);
-
-  const filtered = useMemo(() => {
-    if (!actions) return [] as QuickAction[];
-    if (!query.trim()) return actions;
-    const needle = query.trim().toLowerCase();
-    return actions.filter((item) => item.label.toLowerCase().includes(needle));
-  }, [actions, query]);
-
-  const groups = useMemo(
-    () =>
-      filtered.reduce<Record<string, QuickAction[]>>((acc, item) => {
-        if (!acc[item.group]) acc[item.group] = [];
-        acc[item.group].push(item);
-        return acc;
-      }, {}),
-    [filtered],
-  );
-
-  const groupKeys = Object.keys(groups);
-  const isEmpty = !isLoading && groupKeys.length === 0;
-
-  return (
-    <Modal
-      open={searchOpen}
-      onClose={closeSearch}
-      width="lg"
-      ariaLabel={t("portal.search.ariaLabel")}
-    >
-      <div className="portal-search">
-        <div className="portal-search__input-row">
-          <SearchIcon size={16} />
-          <input
-            ref={inputRef}
-            value={query}
-            onChange={(e) => setQuery(e.target.value)}
-            placeholder={t("portal.search.placeholder")}
-            aria-label={t("portal.search.ariaLabel")}
-            className="portal-search__input"
-            autoComplete="off"
-            spellCheck={false}
-          />
-          <span className="portal-search__esc" aria-hidden>
-            ESC
-          </span>
-        </div>
-
-        <div className="portal-search__results">
-          {isLoading && (
-            <div className="portal-search__loading">
-              <Skeleton height="1rem" width="40%" />
-              <Skeleton height="0.875rem" />
-              <Skeleton height="0.875rem" width="80%" />
-              <Skeleton height="0.875rem" width="65%" />
-            </div>
-          )}
-          {isEmpty && (
-            <EmptyState
-              size="compact"
-              title={
-                query.trim()
-                  ? t("portal.search.empty.noMatches", { query: query.trim() })
-                  : t("portal.search.empty.noActionsTitle")
-              }
-              description={
-                query.trim()
-                  ? t("portal.search.empty.noMatchesDescription")
-                  : t("portal.search.empty.noActionsDescription")
-              }
-            />
-          )}
-          {!isLoading &&
-            !isEmpty &&
-            Object.entries(groups).map(([group, items]) => (
-              <div key={group} className="portal-search__group">
-                <div className="portal-search__group-label">{group}</div>
-                {items.map((item) => (
-                  <Button
-                    key={item.label}
-                    variant="tertiary"
-                    justify="start"
-                    fullWidth
-                    className="portal-search__item"
-                    onClick={closeSearch}
-                  >
-                    <span className="portal-search__item-label">
-                      {item.label}
-                    </span>
-                    <span className="portal-search__item-hint">
-                      {item.hint}
-                    </span>
-                  </Button>
-                ))}
-              </div>
-            ))}
-        </div>
-      </div>
-    </Modal>
-  );
-}
diff --git a/frontend/editor/src/portal/components/Sidebar.css b/frontend/editor/src/portal/components/Sidebar.css
index dfb533f8ab..48b54b177d 100644
--- a/frontend/editor/src/portal/components/Sidebar.css
+++ b/frontend/editor/src/portal/components/Sidebar.css
@@ -123,8 +123,6 @@
 }
 .portal-sidebar[data-collapsed] .portal-sidebar__footer {
   margin-inline: 0.375rem;
-  padding-inline: 0;
-  align-items: center;
 }
 
 .portal-sidebar__logo {
@@ -179,10 +177,8 @@
   gap: 0.125rem;
 }
 
+/* The shared <NavFooter> brings its own boxes, padding and gap; the sidebar
+   only positions it. */
 .portal-sidebar__footer {
   margin: 0 0.625rem 0.75rem;
-  padding: 0.5rem 0.375rem;
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
 }
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index ebf91c636e..8ce7008d67 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -2,6 +2,10 @@ import { useMediaQuery } from "@mantine/hooks";
 import { Tooltip } from "@mantine/core";
 import { ActionIcon, NavItem, NavSurface } from "@app/ui";
 import { BrandSwitcher } from "@app/components/shared/BrandSwitcher";
+import { NavFooter } from "@app/components/shared/navFooter/NavFooter";
+import { useAccountIdentity } from "@app/hooks/useAccountIdentity";
+import { useFreeCreditsSummary } from "@portal/hooks/useFreeCreditsSummary";
+import { useOpenPlan } from "@portal/hooks/useOpenPlan";
 import { SidebarToggleIcon } from "@app/components/shared/SidebarToggleIcon";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
@@ -10,7 +14,7 @@ import { useUI } from "@portal/contexts/UIContext";
 import { LinkAccountFooterItem } from "@portal/components/LinkAccountFooterItem";
 import { EDITOR_URL, EDITOR_IS_SAME_APP } from "@portal/auth/editorUrl";
 import { EDITOR_BASENAME } from "@app/routes/editorBasename";
-import { CloseIcon, SettingsIcon } from "@portal/components/icons";
+import { CloseIcon } from "@portal/components/icons";
 import {
   GROUP_PROCESSOR,
   GROUP_PLATFORM,
@@ -41,6 +45,9 @@ export function Sidebar() {
   const isMobile = useMediaQuery(MOBILE_QUERY, false, {
     getInitialValueInEffect: false,
   });
+  const { displayName, profilePictureUrl } = useAccountIdentity();
+  const credits = useFreeCreditsSummary();
+  const openPlan = useOpenPlan();
 
   // Collapse is a desktop-only affordance: on mobile the sidebar is an
   // off-canvas drawer, so the icon-rail state never applies there.
@@ -146,15 +153,17 @@ export function Sidebar() {
         ))}
       </nav>
 
-      <NavSurface className="portal-sidebar__footer">
-        <LinkAccountFooterItem />
-        <NavItem
-          id="settings"
-          label={t("portal.nav.settings")}
-          icon={<SettingsIcon />}
-          onClick={() => openSettings()}
-        />
-      </NavSurface>
+      <NavFooter
+        className="portal-sidebar__footer"
+        displayName={displayName}
+        profilePictureUrl={profilePictureUrl}
+        onOpenSettings={openSettings}
+        credits={credits}
+        onOpenPlan={openPlan ?? undefined}
+        otherApp={{ app: "editor", onOpen: goToEditor }}
+        accountExtras={<LinkAccountFooterItem />}
+        collapsed={collapsed}
+      />
     </aside>
   );
 }
diff --git a/frontend/editor/src/portal/components/account-link/LinkedInstancesTable.tsx b/frontend/editor/src/portal/components/account-link/LinkedInstancesTable.tsx
index 921de50853..910ce957dd 100644
--- a/frontend/editor/src/portal/components/account-link/LinkedInstancesTable.tsx
+++ b/frontend/editor/src/portal/components/account-link/LinkedInstancesTable.tsx
@@ -1,13 +1,6 @@
 import { useTranslation } from "react-i18next";
 import type { TFunction } from "i18next";
-import {
-  Button,
-  Card,
-  EmptyState,
-  StatusBadge,
-  Table,
-  type TableColumn,
-} from "@app/ui";
+import { column, DataTable, type DataTableColumn, EmptyState } from "@app/ui";
 import type { LinkedInstanceRow } from "@portal/api/link";
 
 interface Props {
@@ -45,78 +38,67 @@ export function LinkedInstancesTable({
   revokingId,
 }: Props) {
   const { t } = useTranslation();
-  const cols: TableColumn<LinkedInstanceRow>[] = [
-    {
+  const cols: DataTableColumn<LinkedInstanceRow>[] = [
+    column.entity({
       key: "name",
       header: t("portal.accountLink.instances.columns.instance", "Instance"),
-      render: (i) => (
-        <div className="portal-link__cell-stack">
-          <span className="portal-link__cell-strong">
-            {i.name ??
-              t("portal.accountLink.instances.unnamed", "Unnamed instance")}
-          </span>
-          <code className="portal-link__device-id">{i.deviceId}</code>
-        </div>
-      ),
-    },
-    {
+      sortable: true,
+      primary: (i) =>
+        i.name ?? t("portal.accountLink.instances.unnamed", "Unnamed instance"),
+      note: (i) => i.deviceId,
+    }),
+    column.badge({
       key: "status",
       header: t("portal.accountLink.instances.columns.status", "Status"),
-      render: (i) =>
-        i.revoked ? (
-          <StatusBadge tone="danger" size="sm">
-            {t("portal.accountLink.instances.revoked", "Revoked")}
-          </StatusBadge>
-        ) : (
-          <StatusBadge tone="success" size="sm">
-            {t("portal.accountLink.instances.active", "Active")}
-          </StatusBadge>
-        ),
-    },
-    {
+      sortable: true,
+      get: (i) =>
+        i.revoked
+          ? {
+              tone: "danger",
+              label: t("portal.accountLink.instances.revoked", "Revoked"),
+            }
+          : {
+              tone: "success",
+              label: t("portal.accountLink.instances.active", "Active"),
+            },
+    }),
+    column.muted({
       key: "lastSeen",
       header: t("portal.accountLink.instances.columns.lastSeen", "Last seen"),
-      render: (i) => (
-        <span className="portal-link__muted">
-          {relativeTime(i.lastSeenAt, t)}
-        </span>
-      ),
-    },
-    {
+      sortable: true,
+      // Sort on the real ISO timestamp, not the "3d ago" label.
+      sortBy: (i) => i.lastSeenAt ?? undefined,
+      get: (i) => relativeTime(i.lastSeenAt, t),
+    }),
+    column.muted({
       key: "created",
       header: t("portal.accountLink.instances.columns.linked", "Linked"),
-      render: (i) => (
-        <span className="portal-link__muted">
-          {relativeTime(i.createdAt, t)}
-        </span>
-      ),
-    },
-    {
+      sortable: true,
+      sortBy: (i) => i.createdAt ?? undefined,
+      get: (i) => relativeTime(i.createdAt, t),
+    }),
+    column.actions({
       key: "actions",
-      header: (
-        <span className="sr-only">
-          {t("portal.accountLink.instances.columns.actions", "Actions")}
-        </span>
-      ),
-      align: "right",
-      render: (i) =>
-        i.revoked ? null : (
-          <Button
-            variant="secondary"
-            accent="danger"
-            size="sm"
-            loading={revokingId === i.instanceId}
-            onClick={() => onRevoke(i)}
-          >
-            {t("portal.accountLink.instances.revoke", "Revoke")}
-          </Button>
-        ),
-    },
+      get: (i) =>
+        i.revoked
+          ? []
+          : [
+              {
+                label: t("portal.accountLink.instances.revoke", "Revoke"),
+                tone: "danger",
+                loading: revokingId === i.instanceId,
+                onClick: () => onRevoke(i),
+              },
+            ],
+    }),
   ];
 
   return (
-    <Card padding="none">
-      {instances.length === 0 ? (
+    <DataTable<LinkedInstanceRow>
+      columns={cols}
+      rows={instances}
+      rowKey={(i) => String(i.instanceId)}
+      empty={
         <EmptyState
           size="compact"
           title={t(
@@ -128,13 +110,7 @@ export function LinkedInstancesTable({
             "Link this org's account, then register your self-hosted instances to see them here.",
           )}
         />
-      ) : (
-        <Table
-          columns={cols}
-          rows={instances}
-          rowKey={(i) => String(i.instanceId)}
-        />
-      )}
-    </Card>
+      }
+    />
   );
 }
diff --git a/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx b/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx
index 7d322a7be6..3ed7706e80 100644
--- a/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx
+++ b/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx
@@ -34,6 +34,7 @@ import {
   type LatestBundleQuote,
 } from "@portal/billing/stripe";
 import { PrepayModalHeader } from "@portal/components/billing/PrepayModalHeader";
+import "@portal/theme/surface.css";
 
 /**
  * Prepaid-bundle purchase modal for the Processor billing page — "12 months for
@@ -1166,7 +1167,7 @@ function CalculatorStep({
       </div>
 
       {/* Finer settings as progressive-disclosure rows — a "Change" blooms the card picker. */}
-      <div className="portal-billing__bundle-rows">
+      <div className="portal-surface portal-billing__bundle-rows">
         {rows.map((row) => {
           const open = expanded === row.id;
           return (
diff --git a/frontend/editor/src/portal/components/billing/CardPlaceholder.tsx b/frontend/editor/src/portal/components/billing/CardPlaceholder.tsx
index af1cd78b1b..6678b20bd1 100644
--- a/frontend/editor/src/portal/components/billing/CardPlaceholder.tsx
+++ b/frontend/editor/src/portal/components/billing/CardPlaceholder.tsx
@@ -1,5 +1,6 @@
 import { useTranslation } from "react-i18next";
 import { LockIcon } from "@portal/components/icons";
+import "@portal/theme/surface.css";
 
 /**
  * Card-form stand-in shown on the checkout payment step when no Stripe publishable key is configured
@@ -9,7 +10,7 @@ import { LockIcon } from "@portal/components/icons";
 export function CardPlaceholder() {
   const { t } = useTranslation();
   return (
-    <div className="portal-billing__card-placeholder">
+    <div className="portal-surface portal-billing__card-placeholder">
       <div className="portal-billing__card-placeholder-head">
         <span>{t("portal.billing.checkout.card.label", "Card details")}</span>
         <span className="portal-billing__card-placeholder-badge">Stripe</span>
diff --git a/frontend/editor/src/portal/components/billing/InvoicesList.tsx b/frontend/editor/src/portal/components/billing/InvoicesList.tsx
index 8e4c8a8540..3ad8da9c2c 100644
--- a/frontend/editor/src/portal/components/billing/InvoicesList.tsx
+++ b/frontend/editor/src/portal/components/billing/InvoicesList.tsx
@@ -3,11 +3,12 @@ import { useTranslation } from "react-i18next";
 import {
   Button,
   Card,
+  type CellLink,
+  column,
+  DataTable,
+  type DataTableColumn,
   EmptyState,
   Skeleton,
-  StatusBadge,
-  Table,
-  type TableColumn,
 } from "@app/ui";
 import { formatMinor, formatPeriodDate } from "@app/billing";
 import { fetchInvoices, type Invoice } from "@portal/api/billing";
@@ -80,96 +81,78 @@ export function InvoicesList() {
   //   Date · Amount · Status · Description (product name) · Actions
   // The monospace invoice id is dropped — users care about "what was it for",
   // not the internal id.
-  const columns: TableColumn<Invoice>[] = [
-    {
+  const columns: DataTableColumn<Invoice>[] = [
+    column.text({
       key: "date",
       header: t("portal.billing.invoices.columnDate", "Date"),
-      render: (inv) =>
-        inv.createdAt ? formatPeriodDate(inv.createdAt, { year: true }) : "—",
-    },
-    {
+      sortable: true,
+      // Sort chronologically on the raw ISO timestamp, not the formatted label.
+      sortBy: (inv) => inv.createdAt ?? undefined,
+      get: (inv) =>
+        inv.createdAt ? formatPeriodDate(inv.createdAt, { year: true }) : "-",
+    }),
+    column.number({
       key: "pdfs",
       header: t(
         "portal.billing.invoices.columnPdfsProcessed",
         "PDFs processed",
       ),
-      align: "right",
-      // Billed units on the invoice's metered line item; "—" when the
+      sortable: true,
+      // Billed units on the invoice's metered line item; blank when the
       // line-item table isn't synced into the Stripe mirror.
-      render: (inv) =>
-        inv.pdfsProcessed == null ? "—" : inv.pdfsProcessed.toLocaleString(),
-    },
-    {
+      get: (inv) => inv.pdfsProcessed,
+      format: (n) => n.toLocaleString(),
+    }),
+    column.number({
       key: "amount",
       header: t("portal.billing.invoices.columnAmount", "Amount"),
-      align: "right",
-      render: (inv) =>
-        inv.totalMinor == null
-          ? "—"
-          : formatMinor(inv.totalMinor, inv.currency),
-    },
-    {
+      sortable: true,
+      get: (inv) => inv.totalMinor,
+      format: (n, inv) => formatMinor(n, inv.currency),
+    }),
+    column.badge({
       key: "status",
       header: t("portal.billing.invoices.columnStatus", "Status"),
-      render: (inv) => (
-        <StatusBadge tone={statusTone(inv.status)} size="sm">
-          {inv.status}
-        </StatusBadge>
-      ),
-    },
-    {
+      sortable: true,
+      get: (inv) => ({ tone: statusTone(inv.status), label: inv.status }),
+    }),
+    column.text({
       key: "description",
       header: t("portal.billing.invoices.columnDescription", "Description"),
-      render: (inv) => (
-        <span className="portal-billing__invoice-desc">
-          {inv.description ??
-            t("portal.billing.invoices.descriptionFallback", "Invoice")}
-        </span>
-      ),
-    },
-    {
+      sortable: true,
+      get: (inv) =>
+        inv.description ??
+        t("portal.billing.invoices.descriptionFallback", "Invoice"),
+    }),
+    column.links({
       key: "actions",
-      header: "",
-      align: "right",
-      render: (inv) => (
-        <div className="portal-billing__invoice-actions">
-          {inv.hostedInvoiceUrl && (
-            <a
-              className="portal-billing__invoice-link"
-              href={inv.hostedInvoiceUrl}
-              target="_blank"
-              rel="noopener noreferrer"
-              aria-label={t(
-                "portal.billing.invoices.viewAriaLabel",
-                "View invoice {{number}} in Stripe",
-                {
-                  number: inv.number ?? inv.id,
-                },
-              )}
-            >
-              {t("portal.billing.invoices.viewLink", "View ↗")}
-            </a>
-          )}
-          {inv.invoicePdf && (
-            <a
-              className="portal-billing__invoice-link"
-              href={inv.invoicePdf}
-              target="_blank"
-              rel="noopener noreferrer"
-              aria-label={t(
-                "portal.billing.invoices.downloadAriaLabel",
-                "Download invoice {{number}} as PDF",
-                {
-                  number: inv.number ?? inv.id,
-                },
-              )}
-            >
-              {t("portal.billing.invoices.pdfLink", "PDF ↓")}
-            </a>
-          )}
-        </div>
-      ),
-    },
+      get: (inv) => {
+        const out: CellLink[] = [];
+        if (inv.hostedInvoiceUrl) {
+          out.push({
+            label: t("portal.billing.invoices.viewLink", "View ↗"),
+            href: inv.hostedInvoiceUrl,
+            ariaLabel: t(
+              "portal.billing.invoices.viewAriaLabel",
+              "View invoice {{number}} in Stripe",
+              { number: inv.number ?? inv.id },
+            ),
+          });
+        }
+        if (inv.invoicePdf) {
+          out.push({
+            label: t("portal.billing.invoices.pdfLink", "PDF ↓"),
+            href: inv.invoicePdf,
+            ariaLabel: t(
+              "portal.billing.invoices.downloadAriaLabel",
+              "Download invoice {{number}} as PDF",
+              { number: inv.number ?? inv.id },
+            ),
+          });
+        }
+        return out;
+      },
+    }),
   ];
 
   return (
@@ -209,11 +192,11 @@ export function InvoicesList() {
 
       {invoices !== null && invoices.length > 0 && (
         <>
-          <Table
-            className="portal-billing__flush-table"
+          <DataTable
             columns={columns}
             rows={visibleRows}
             rowKey={(inv) => inv.id}
+            defaultSort={{ key: "date", direction: "desc" }}
           />
           {hasMore && (
             <div className="portal-billing__invoice-footer">
diff --git a/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx b/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx
index c7ab0e8704..6ea4d8d336 100644
--- a/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx
+++ b/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx
@@ -1,6 +1,6 @@
 import { useTranslation } from "react-i18next";
 import { Button, Card } from "@app/ui";
-import { formatPeriodDate, MeterBar, meterState } from "@app/billing";
+import { formatPeriodDate, MeterBar, remainingMeter } from "@app/billing";
 import type { Wallet } from "@portal/api/billing";
 
 /**
@@ -10,8 +10,8 @@ import type { Wallet } from "@portal/api/billing";
  *   - No bundle → a slim "Get 12 months for the price of 10" offer nudge with a
  *     "Review offer" CTA (the demo's commit-nudge card), shown only when a buyer
  *     ({@code onBuy}, leader) is present.
- *   - Bundle held → the capacity meter (fills as the pool is drawn down, so it
- *     warns as capacity runs low) plus a "Top up" action for the leader.
+ *   - Bundle held → the capacity meter (drains towards empty as the pool is drawn
+ *     down, so it warns as capacity runs low) plus a "Top up" action for the leader.
  *
  * Prepaid is consumed before metered billing and sits outside the spend limit, so
  * it reads as its own dimension. Buying/topping up opens {@code BundleCheckoutModal}
@@ -55,8 +55,7 @@ export function PrepaidCapacityCard({
 
   const remaining = wallet.prepaidUnitsRemaining;
   const total = wallet.prepaidUnitsTotal;
-  const used = Math.max(0, total - remaining);
-  const { state, pct } = meterState(used, total);
+  const { state, pct } = remainingMeter(remaining, total);
   const stateLabel =
     state === "DEGRADED"
       ? t("portal.billing.prepaid.state.exhausted", "Used up")
diff --git a/frontend/editor/src/portal/components/billing/WalletMeter.tsx b/frontend/editor/src/portal/components/billing/WalletMeter.tsx
index c8be188390..9558960e89 100644
--- a/frontend/editor/src/portal/components/billing/WalletMeter.tsx
+++ b/frontend/editor/src/portal/components/billing/WalletMeter.tsx
@@ -1,7 +1,7 @@
 import type { ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 import { Card } from "@app/ui";
-import { formatMinor, MeterBar, meterState } from "@app/billing";
+import { formatMinor, MeterBar, remainingMeter } from "@app/billing";
 import type { Wallet } from "@portal/api/billing";
 import type { LocalUsage } from "@portal/api/link";
 
@@ -15,8 +15,10 @@ interface Props {
 }
 
 /**
- * The free Processor-trial meter — "X / N free PDFs used" against the one-time
- * grant. Uses the shared {@link MeterBar} (same `paygf-meter` structure as the
+ * The free Processor-trial meter — "X of N free PDFs left" against the one-time
+ * grant, with what has been used alongside as the status badge. The bar shows what
+ * is left, so it drains towards empty as the grant is spent.
+ * Uses the shared {@link MeterBar} (same `paygf-meter` structure as the
  * cloud plan page). The subscribed spend-vs-cap meter is a separate surface
  * ({@code SpendLimitCard}); this card is only the free face.
  *
@@ -30,7 +32,7 @@ export function WalletMeter({ wallet, unsynced, action }: Props) {
   const pending = unsynced?.totalUnsyncedUnits ?? 0;
   const used = wallet.billableUsed + pending;
   const remaining = Math.max(0, wallet.freeRemaining - pending);
-  const { state, pct } = meterState(used, wallet.freeAllowance);
+  const { state, pct } = remainingMeter(remaining, wallet.freeAllowance);
   const rate =
     wallet.pricePerDocMinor != null && wallet.pricePerDocMinor > 0
       ? wallet.pricePerDocMinor
@@ -76,11 +78,14 @@ export function WalletMeter({ wallet, unsynced, action }: Props) {
         <MeterBar
           state={state}
           pct={pct}
-          barLabel={t("portal.billing.walletMeter.barAria", "Free PDFs used")}
-          figure={used.toLocaleString()}
+          barLabel={t(
+            "portal.billing.walletMeter.barAria",
+            "Free PDFs remaining",
+          )}
+          figure={remaining.toLocaleString()}
           capSuffix={t(
             "portal.billing.walletMeter.capSuffix",
-            "of {{allowance}} free PDFs used",
+            "of {{allowance}} free PDFs left",
             {
               count: wallet.freeAllowance,
               allowance: wallet.freeAllowance.toLocaleString(),
@@ -88,11 +93,8 @@ export function WalletMeter({ wallet, unsynced, action }: Props) {
           )}
           statusLabel={t(
             "portal.billing.walletMeter.statusLabel",
-            "{{remaining}} left",
-            {
-              count: remaining,
-              remaining: remaining.toLocaleString(),
-            },
+            "{{used}} used",
+            { count: used, used: used.toLocaleString() },
           )}
         />
       </div>
diff --git a/frontend/editor/src/portal/components/billing/billing.css b/frontend/editor/src/portal/components/billing/billing.css
index 113b660a7c..c1b27720df 100644
--- a/frontend/editor/src/portal/components/billing/billing.css
+++ b/frontend/editor/src/portal/components/billing/billing.css
@@ -1198,9 +1198,6 @@
   flex-direction: column;
   gap: 0.5rem;
   padding: 1rem;
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-md);
-  background: var(--c-surface);
 }
 .portal-billing__card-placeholder-head {
   display: flex;
@@ -1333,8 +1330,6 @@
 
 /* Progressive-disclosure finer settings: summary rows that bloom a card picker. */
 .portal-billing__bundle-rows {
-  border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-md);
   overflow: hidden;
 }
 .portal-billing__bundle-row + .portal-billing__bundle-row {
diff --git a/frontend/editor/src/portal/components/docs/DocsNav.tsx b/frontend/editor/src/portal/components/docs/DocsNav.tsx
index 1063d5e98f..2f6258fca9 100644
--- a/frontend/editor/src/portal/components/docs/DocsNav.tsx
+++ b/frontend/editor/src/portal/components/docs/DocsNav.tsx
@@ -8,7 +8,8 @@ import type { DocsNavSection } from "@portal/api/docs";
  * path ("functionality/security" is a child of "functionality"), so sub-sections
  * nest under their parent. The root "Overview" section is static (always open, no
  * toggle); every other section collapses, and only the branch leading to the
- * active doc opens by default. (Search lives in DocsSearch above this.)
+ * active doc opens by default. (Full-text docs search lives in the global
+ * super search.)
  */
 
 // Matches the generator's ROOT_SECTION_ID: the intro section is never collapsible.
diff --git a/frontend/editor/src/portal/components/docs/DocsSearch.tsx b/frontend/editor/src/portal/components/docs/DocsSearch.tsx
deleted file mode 100644
index 49bdb3101f..0000000000
--- a/frontend/editor/src/portal/components/docs/DocsSearch.tsx
+++ /dev/null
@@ -1,137 +0,0 @@
-import { useEffect, useRef, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Button } from "@app/ui";
-import type { SearchResult, Segment } from "@portal/docs/search";
-
-/** Render highlighted segments, wrapping matched runs in <mark>. */
-function Highlighted({ segments }: { segments: Segment[] }) {
-  return (
-    <>
-      {segments.map((s, i) =>
-        s.hit ? (
-          <mark key={i} className="portal-docs__hl">
-            {s.text}
-          </mark>
-        ) : (
-          <span key={i}>{s.text}</span>
-        ),
-      )}
-    </>
-  );
-}
-
-/**
- * Docs search box + results. While a query is active it shows a ranked list of
- * matching docs — each with its section, a highlighted title, and a content
- * snippet — that navigates on click (or Enter). Arrow keys move the selection.
- */
-export function DocsSearch({
-  query,
-  onQueryChange,
-  results,
-  onSelect,
-}: {
-  query: string;
-  onQueryChange: (q: string) => void;
-  results: SearchResult[];
-  onSelect: (docId: string) => void;
-}) {
-  const { t } = useTranslation();
-  // -1 = nothing pre-selected; arrow keys drive this, the mouse uses CSS :hover.
-  const [activeIndex, setActiveIndex] = useState(-1);
-  const listRef = useRef<HTMLUListElement>(null);
-  const hasQuery = query.trim().length > 0;
-
-  useEffect(() => setActiveIndex(-1), [query]);
-
-  useEffect(() => {
-    listRef.current
-      ?.querySelector<HTMLElement>('[data-active="true"]')
-      ?.scrollIntoView?.({ block: "nearest" });
-  }, [activeIndex]);
-
-  const onKeyDown = (e: React.KeyboardEvent<HTMLInputElement>) => {
-    if (e.key === "Escape") {
-      onQueryChange("");
-      return;
-    }
-    if (!results.length) return;
-    if (e.key === "ArrowDown") {
-      e.preventDefault();
-      setActiveIndex((i) => Math.min(i + 1, results.length - 1));
-    } else if (e.key === "ArrowUp") {
-      e.preventDefault();
-      setActiveIndex((i) => Math.max(i - 1, 0));
-    } else if (e.key === "Enter") {
-      e.preventDefault();
-      const hit = results[activeIndex >= 0 ? activeIndex : 0];
-      if (hit) onSelect(hit.id);
-    }
-  };
-
-  return (
-    <div className="portal-docs__search">
-      <div className="portal-docs__search-box">
-        <span className="portal-docs__search-icon" aria-hidden>
-          ⌕
-        </span>
-        <input
-          type="search"
-          className="portal-docs__search-input"
-          placeholder={t("portal.docs.search.placeholder")}
-          value={query}
-          onChange={(e) => onQueryChange(e.target.value)}
-          onKeyDown={onKeyDown}
-          aria-label={t("portal.docs.search.placeholder")}
-        />
-      </div>
-
-      {hasQuery && (
-        <div className="portal-docs__results">
-          {results.length === 0 ? (
-            <p className="portal-docs__nav-empty">
-              {t("portal.docs.search.empty")}
-            </p>
-          ) : (
-            <>
-              <div className="portal-docs__results-count">
-                {t("portal.docs.search.results", { count: results.length })}
-              </div>
-              <ul ref={listRef} className="portal-docs__results-list">
-                {results.map((r, i) => (
-                  <li key={r.id}>
-                    <Button
-                      variant="tertiary"
-                      fullWidth
-                      justify="start"
-                      className={
-                        "portal-docs__result" +
-                        (i === activeIndex ? " is-active" : "")
-                      }
-                      data-active={i === activeIndex}
-                      onClick={() => onSelect(r.id)}
-                    >
-                      <span className="portal-docs__result-body">
-                        <span className="portal-docs__result-head">
-                          <span className="portal-docs__result-title">
-                            <Highlighted segments={r.titleSegments} />
-                          </span>
-                          <span className="portal-docs__result-section">
-                            {r.sectionLabel}
-                          </span>
-                        </span>
-                        <span className="portal-docs__result-snippet">
-                          <Highlighted segments={r.snippet} />
-                        </span>
-                      </span>
-                    </Button>
-                  </li>
-                ))}
-              </ul>
-            </>
-          )}
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/docs/EndpointReferenceSection.tsx b/frontend/editor/src/portal/components/docs/EndpointReferenceSection.tsx
index 930e523886..55b1c47f51 100644
--- a/frontend/editor/src/portal/components/docs/EndpointReferenceSection.tsx
+++ b/frontend/editor/src/portal/components/docs/EndpointReferenceSection.tsx
@@ -3,6 +3,7 @@ import { useTranslation } from "react-i18next";
 import { MethodBadge, Tabs, type HttpMethod, type TabItem } from "@app/ui";
 import { VERTICALS, ALL_ENDPOINTS } from "@portal/data/endpoints";
 import { DocsSection } from "@portal/components/docs/DocsSection";
+import "@portal/theme/surface.css";
 
 type VerticalFilter = "all" | (typeof VERTICALS)[number]["key"];
 
@@ -46,7 +47,10 @@ export function EndpointReferenceSection() {
       />
       <div className="portal-docs__endpoints">
         {shown.map((v) => (
-          <div key={v.key} className="portal-docs__endpoint-group">
+          <div
+            key={v.key}
+            className="portal-surface portal-docs__endpoint-group"
+          >
             <div className="portal-docs__endpoint-grouphead">
               <span
                 className="portal-docs__endpoint-dot"
diff --git a/frontend/editor/src/portal/components/documents/DocumentExtractions.stories.tsx b/frontend/editor/src/portal/components/documents/DocumentExtractions.stories.tsx
index d96ef55a1f..1f8f6691dd 100644
--- a/frontend/editor/src/portal/components/documents/DocumentExtractions.stories.tsx
+++ b/frontend/editor/src/portal/components/documents/DocumentExtractions.stories.tsx
@@ -1,11 +1,32 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { Extraction } from "@portal/api/documents";
 import { documentsFor } from "@portal/mocks/documents";
 import { DocumentExtractions } from "@portal/components/documents/DocumentExtractions";
 import "@portal/views/Documents.css";
 
 const ALL = documentsFor("enterprise");
-const NON_SENSITIVE = ALL.find((d) => !d.sensitive)!;
-const SENSITIVE = ALL.find((d) => d.sensitive)!;
+
+// The mock documents ship without extractions, so seed a realistic set here -
+// a spread of confidence levels so the table (and its confidence sort) is
+// actually reviewable.
+const EXTRACTIONS: Extraction[] = [
+  { field: "Counterparty", value: "Acme Services LLC", confidence: 0.98 },
+  { field: "Effective date", value: "2026-01-14", confidence: 0.94 },
+  { field: "Contract value", value: "$248,000.00", confidence: 0.87 },
+  { field: "Governing law", value: "Delaware", confidence: 0.72 },
+  { field: "Auto-renewal", value: "Yes (12 months)", confidence: 0.55 },
+];
+
+const NON_SENSITIVE = {
+  ...ALL.find((d) => !d.sensitive)!,
+  extractions: EXTRACTIONS,
+  fieldsExtracted: EXTRACTIONS.length,
+};
+const SENSITIVE = {
+  ...ALL.find((d) => d.sensitive)!,
+  extractions: EXTRACTIONS,
+  fieldsExtracted: EXTRACTIONS.length,
+};
 
 const meta: Meta<typeof DocumentExtractions> = {
   title: "Portal/Documents/DocumentExtractions",
@@ -23,7 +44,7 @@ const meta: Meta<typeof DocumentExtractions> = {
 export default meta;
 type Story = StoryObj<typeof DocumentExtractions>;
 
-/** No extraction data exists yet - the table shows its empty state. */
+/** Extracted fields with a mix of confidence levels; click a header to sort. */
 export const Default: Story = {};
 
 /** Sensitive doc with no active grant — content stays masked. */
@@ -35,3 +56,10 @@ export const Masked: Story = {
 export const Unlocked: Story = {
   args: { doc: SENSITIVE, unlocked: true },
 };
+
+/** No extraction data yet — the empty state. */
+export const Empty: Story = {
+  args: {
+    doc: { ...NON_SENSITIVE, extractions: [], fieldsExtracted: 0 },
+  },
+};
diff --git a/frontend/editor/src/portal/components/documents/DocumentExtractions.tsx b/frontend/editor/src/portal/components/documents/DocumentExtractions.tsx
index 3c6de80c93..646498156d 100644
--- a/frontend/editor/src/portal/components/documents/DocumentExtractions.tsx
+++ b/frontend/editor/src/portal/components/documents/DocumentExtractions.tsx
@@ -1,6 +1,6 @@
 import { useTranslation } from "react-i18next";
 import LockRounded from "@mui/icons-material/LockRounded";
-import { StatusBadge, Table, type TableColumn } from "@app/ui";
+import { column, DataTable, type DataTableColumn } from "@app/ui";
 import { type Extraction, type ReviewDocument } from "@portal/api/documents";
 import {
   confidencePct,
@@ -24,32 +24,30 @@ export function DocumentExtractions({
 }: DocumentExtractionsProps) {
   const { t } = useTranslation();
 
-  const cols: TableColumn<Extraction>[] = [
-    {
+  const cols: DataTableColumn<Extraction>[] = [
+    column.text({
       key: "field",
       header: t("portal.documents.extractions.columns.field"),
-      render: (e) => <span className="portal-documents__field">{e.field}</span>,
-    },
-    {
+      sortable: true,
+      get: (e) => e.field,
+    }),
+    column.mono({
       key: "value",
       header: t("portal.documents.extractions.columns.value"),
-      render: (e) => <span className="portal-documents__mono">{e.value}</span>,
-    },
-    {
+      get: (e) => e.value,
+    }),
+    column.badge({
       key: "confidence",
       header: t("portal.documents.extractions.columns.confidence"),
-      align: "right",
-      width: "7rem",
-      render: (e) => (
-        <StatusBadge
-          tone={confidenceTone(e.confidence)}
-          size="sm"
-          showDot={false}
-        >
-          {confidencePct(e.confidence)}
-        </StatusBadge>
-      ),
-    },
+      sortable: true,
+      // Sort on the whole-percent integer, not the "92%" label (keeps decimals
+      // out of the natural-sort comparator).
+      sortBy: (e) => Math.round(e.confidence * 100),
+      get: (e) => ({
+        tone: confidenceTone(e.confidence),
+        label: confidencePct(e.confidence),
+      }),
+    }),
   ];
 
   if (doc.sensitive && !unlocked) {
@@ -66,7 +64,7 @@ export function DocumentExtractions({
   }
 
   return (
-    <Table<Extraction>
+    <DataTable<Extraction>
       columns={cols}
       rows={doc.extractions}
       rowKey={(e) => e.field}
diff --git a/frontend/editor/src/portal/components/documents/ReviewQueue.test.tsx b/frontend/editor/src/portal/components/documents/ReviewQueue.test.tsx
index ee8b0e8073..f01c6f482d 100644
--- a/frontend/editor/src/portal/components/documents/ReviewQueue.test.tsx
+++ b/frontend/editor/src/portal/components/documents/ReviewQueue.test.tsx
@@ -1,13 +1,16 @@
-import { describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 import {
+  fireEvent,
   render as baseRender,
   screen,
   type RenderResult,
 } from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
 import { MemoryRouter } from "react-router-dom";
 import type { ReactElement } from "react";
 import type { ReviewDocument } from "@portal/api/documents";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
+import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
+import { UIProvider } from "@portal/contexts/UIContext";
 import { ReviewQueue } from "@portal/components/documents/ReviewQueue";
 
 // Deterministic i18n: keys returned verbatim.
@@ -18,6 +21,12 @@ vi.mock("react-i18next", () => ({
   }),
 }));
 
+const navigate = vi.fn();
+vi.mock("react-router-dom", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-router-dom")>();
+  return { ...actual, useNavigate: () => navigate };
+});
+
 // Isolate ReviewQueue's own branching: stub the heavy children so the test
 // doesn't need TierProvider (DocumentDrawer → useTier) or the real table body.
 vi.mock("@portal/components/documents/DocumentDrawer", () => ({
@@ -30,7 +39,9 @@ vi.mock("@portal/components/documents/ReviewQueueTable", () => ({
 const render = (ui: ReactElement): RenderResult =>
   baseRender(
     <MemoryRouter>
-      <MantineProvider>{ui}</MantineProvider>
+      <PortalTestProviders>
+        <UIProvider>{ui}</UIProvider>
+      </PortalTestProviders>
     </MemoryRouter>,
   );
 
@@ -56,6 +67,10 @@ const DOC: ReviewDocument = {
 };
 
 describe("ReviewQueue", () => {
+  beforeEach(() => {
+    navigate.mockReset();
+  });
+
   it("hides the filter toolbar and shows CTAs when there are no documents", () => {
     render(<ReviewQueue documents={[]} loading={false} />);
 
@@ -76,6 +91,31 @@ describe("ReviewQueue", () => {
     ).not.toBeInTheDocument();
   });
 
+  it("opens the connect-a-source modal in place instead of navigating", async () => {
+    render(<ReviewQueue documents={[]} loading={false} />);
+
+    fireEvent.click(
+      screen.getByText("portal.documents.queue.empty.connectSource"),
+    );
+
+    expect(
+      await screen.findByText("portal.sources.types.folder.label"),
+    ).toBeInTheDocument();
+    expect(navigate).not.toHaveBeenCalled();
+  });
+
+  it("still navigates to the pipeline builder from the other empty-state CTA", () => {
+    render(<ReviewQueue documents={[]} loading={false} />);
+
+    fireEvent.click(
+      screen.getByText("portal.documents.queue.empty.createPipeline"),
+    );
+
+    expect(navigate).toHaveBeenCalledWith(
+      `${toPortalPath(VIEW_PATHS.pipelines)}/new`,
+    );
+  });
+
   it("shows the filter toolbar when documents exist", () => {
     render(<ReviewQueue documents={[DOC]} loading={false} />);
 
diff --git a/frontend/editor/src/portal/components/documents/ReviewQueue.tsx b/frontend/editor/src/portal/components/documents/ReviewQueue.tsx
index 2200237cf6..486e770364 100644
--- a/frontend/editor/src/portal/components/documents/ReviewQueue.tsx
+++ b/frontend/editor/src/portal/components/documents/ReviewQueue.tsx
@@ -15,6 +15,7 @@ import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { DocumentsIcon } from "@portal/components/icons";
 import { ReviewQueueTable } from "@portal/components/documents/ReviewQueueTable";
 import { DocumentDrawer } from "@portal/components/documents/DocumentDrawer";
+import { SourceModal } from "@portal/components/sources/SourceModal";
 
 type QueueFilter = "all" | "flagged" | "processed" | "in-review";
 
@@ -55,6 +56,7 @@ export function ReviewQueue({ documents, loading }: ReviewQueueProps) {
   const [filter, setFilter] = useState<QueueFilter>("all");
   const [query, setQuery] = useState("");
   const [selectedId, setSelectedId] = useState<string | null>(null);
+  const [connectSourceOpen, setConnectSourceOpen] = useState(false);
 
   const searched = useMemo(() => {
     const q = query.trim().toLowerCase();
@@ -156,9 +158,7 @@ export function ReviewQueue({ documents, loading }: ReviewQueueProps) {
               </Button>
               <Button
                 variant="secondary"
-                onClick={() =>
-                  navigate(`${toPortalPath(VIEW_PATHS.sources)}/new`)
-                }
+                onClick={() => setConnectSourceOpen(true)}
               >
                 {t("portal.documents.queue.empty.connectSource")}
               </Button>
@@ -175,6 +175,12 @@ export function ReviewQueue({ documents, loading }: ReviewQueueProps) {
       )}
 
       <DocumentDrawer doc={selected} onClose={() => setSelectedId(null)} />
+
+      <SourceModal
+        open={connectSourceOpen}
+        sourceId={null}
+        onClose={() => setConnectSourceOpen(false)}
+      />
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/components/documents/ReviewQueueTable.tsx b/frontend/editor/src/portal/components/documents/ReviewQueueTable.tsx
index e63ea925c4..26befa90b9 100644
--- a/frontend/editor/src/portal/components/documents/ReviewQueueTable.tsx
+++ b/frontend/editor/src/portal/components/documents/ReviewQueueTable.tsx
@@ -1,12 +1,15 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import LockRounded from "@mui/icons-material/LockRounded";
-import { Button, Chip, StatusBadge, Table, type TableColumn } from "@app/ui";
+import {
+  type CellLabel,
+  column,
+  DataTable,
+  type DataTableColumn,
+} from "@app/ui";
 import {
   classificationTone,
   DOCUMENT_STATUS_LABEL,
   DOCUMENT_STATUS_TONE,
-  PRODUCT_CHIP_TONE,
   type ReviewDocument,
 } from "@portal/api/documents";
 
@@ -15,160 +18,105 @@ interface ReviewQueueTableProps {
   onRowClick: (doc: ReviewDocument) => void;
 }
 
-function BoltIcon() {
-  return (
-    <svg
-      width="10"
-      height="10"
-      viewBox="0 0 24 24"
-      fill="currentColor"
-      aria-hidden
-    >
-      <path d="M13 2 4 14h6l-1 8 9-12h-6l1-8z" />
-    </svg>
-  );
-}
-
-function KebabIcon() {
-  return (
-    <svg
-      width="16"
-      height="16"
-      viewBox="0 0 24 24"
-      fill="currentColor"
-      aria-hidden
-    >
-      <circle cx="12" cy="5" r="1.6" />
-      <circle cx="12" cy="12" r="1.6" />
-      <circle cx="12" cy="19" r="1.6" />
-    </svg>
-  );
-}
-
 /** The document stream - one row per document your org has processed. */
 export function ReviewQueueTable({
   documents,
   onRowClick,
 }: ReviewQueueTableProps) {
   const { t } = useTranslation();
-  const columns = useMemo<TableColumn<ReviewDocument>[]>(
+  const columns = useMemo<DataTableColumn<ReviewDocument>[]>(
     () => [
-      {
+      column.entity({
         key: "document",
         header: t("portal.documents.table.columns.document"),
-        render: (d) => (
-          <div className="portal-documents__doc-cell">
-            <div className="portal-documents__doc-head">
-              <span className="portal-documents__name">{d.name}</span>
-              {d.classification && (
-                <Chip accent={classificationTone(d)} size="sm">
-                  {d.classification}
-                </Chip>
-              )}
-              {d.auto && (
-                <Chip accent="success" size="sm" leadingIcon={<BoltIcon />}>
-                  {t("portal.documents.table.auto")}
-                </Chip>
-              )}
-              {d.sensitive && (
-                // role="img" so the label is allowed and the icon reads as one thing: aria-label
-                // is ignored on a bare span, leaving the padlock silent.
-                <span
-                  className="portal-documents__lock"
-                  role="img"
-                  title={t("portal.documents.table.sensitiveTitle")}
-                  aria-label={t("portal.documents.table.sensitiveLabel")}
-                >
-                  <LockRounded style={{ fontSize: "0.95rem" }} />
-                </span>
-              )}
-            </div>
-            {d.note && <span className="portal-documents__note">{d.note}</span>}
-          </div>
-        ),
-      },
-      {
+        sortable: true,
+        primary: (d) => d.name,
+        note: (d) => d.note,
+      }),
+      column.labels({
+        key: "labels",
+        header: t("portal.documents.table.columns.labels", "Labels"),
+        get: (d) => {
+          const out: CellLabel[] = [];
+          if (d.classification) {
+            out.push({
+              label: d.classification,
+              accent: classificationTone(d),
+            });
+          }
+          if (d.auto) {
+            out.push({
+              label: t("portal.documents.table.auto"),
+              accent: "success",
+            });
+          }
+          if (d.sensitive) {
+            out.push({
+              label: t("portal.documents.table.sensitiveLabel"),
+              accent: "warning",
+            });
+          }
+          return out;
+        },
+      }),
+      column.text({
         key: "product",
         header: t("portal.documents.table.columns.product"),
-        width: "7rem",
-        render: (d) => (
-          <Chip accent={PRODUCT_CHIP_TONE[d.product]} size="sm" showDot={false}>
-            {d.product}
-          </Chip>
-        ),
-      },
-      {
+        sortable: true,
+        get: (d) => d.product,
+      }),
+      column.text({
         key: "action",
         header: t("portal.documents.table.columns.action"),
-        width: "12rem",
-        render: (d) =>
-          d.product === "Editor" || !d.action ? (
-            <span className="portal-documents__editor-action">
-              {t("portal.documents.table.editorAction")}
-            </span>
-          ) : (
-            <span className="portal-documents__action">{d.action}</span>
-          ),
-      },
-      {
+        sortable: true,
+        get: (d) =>
+          d.product === "Editor" || !d.action
+            ? t("portal.documents.table.editorAction")
+            : d.action,
+      }),
+      column.muted({
         key: "user",
         header: t("portal.documents.table.columns.user"),
-        width: "8rem",
-        render: (d) => (
-          <span className="portal-documents__muted">{d.user || "-"}</span>
-        ),
-      },
-      {
+        sortable: true,
+        get: (d) => d.user,
+      }),
+      column.badge({
         key: "status",
         header: t("portal.documents.table.columns.status"),
-        width: "10rem",
-        render: (d) => (
-          <StatusBadge tone={DOCUMENT_STATUS_TONE[d.status]} size="sm">
-            {t(DOCUMENT_STATUS_LABEL[d.status])}
-            {d.status === "in-review" && d.reviewer ? ` · ${d.reviewer}` : ""}
-          </StatusBadge>
-        ),
-      },
-      {
+        sortable: true,
+        get: (d) => ({
+          tone: DOCUMENT_STATUS_TONE[d.status],
+          label:
+            t(DOCUMENT_STATUS_LABEL[d.status]) +
+            (d.status === "in-review" && d.reviewer ? ` · ${d.reviewer}` : ""),
+        }),
+      }),
+      column.muted({
         key: "time",
         header: t("portal.documents.table.columns.time"),
-        width: "7rem",
-        render: (d) => (
-          <span className="portal-documents__muted">{d.time}</span>
-        ),
-      },
-      {
+        get: (d) => d.time,
+      }),
+      column.actions({
         key: "actions",
-        header: t("portal.documents.table.columns.actions"),
-        headerHidden: true,
-        width: "3rem",
-        render: (d) => (
-          <Button
-            variant="quiet"
-            size="sm"
-            shape="circle"
-            leftSection={<KebabIcon />}
-            aria-label={t("portal.documents.table.rowActions")}
-            onClick={(e) => {
-              e.stopPropagation();
-              onRowClick(d);
-            }}
-          />
-        ),
-      },
+        get: (d) => [
+          {
+            label: t("portal.documents.table.rowActions"),
+            glyph: "kebab",
+            iconOnly: true,
+            onClick: () => onRowClick(d),
+          },
+        ],
+      }),
     ],
     [t, onRowClick],
   );
 
   return (
-    <Table<ReviewDocument>
-      className="portal-documents__table"
+    <DataTable<ReviewDocument>
       columns={columns}
       rows={documents}
       rowKey={(d) => d.id}
       onRowClick={onRowClick}
-      // Every row carries its own actions button, which opens the same document.
-      rowsContainControls
       empty={t("portal.documents.table.empty")}
     />
   );
diff --git a/frontend/editor/src/portal/components/editor-admin/InstanceHealthTable.tsx b/frontend/editor/src/portal/components/editor-admin/InstanceHealthTable.tsx
index a61193f17a..28a220eb81 100644
--- a/frontend/editor/src/portal/components/editor-admin/InstanceHealthTable.tsx
+++ b/frontend/editor/src/portal/components/editor-admin/InstanceHealthTable.tsx
@@ -1,17 +1,8 @@
 import { useTranslation } from "react-i18next";
-import {
-  Card,
-  Chip,
-  type ChipAccent,
-  EmptyState,
-  StatusBadge,
-  Table,
-  type TableColumn,
-} from "@app/ui";
+import { column, DataTable, type DataTableColumn, EmptyState } from "@app/ui";
 import {
   INSTANCE_STATUS_LABEL,
   INSTANCE_STATUS_TONE,
-  TARGET_META,
   type EditorInstance,
 } from "@portal/api/editorDeploy";
 
@@ -22,13 +13,6 @@ const TARGET_LABEL: Record<EditorInstance["target"], string> = {
   kubernetes: "K8s",
 };
 
-/** Map the target palette tone onto the shared Chip accent set. */
-const TARGET_CHIP_ACCENT: Record<"neutral" | "blue" | "purple", ChipAccent> = {
-  neutral: "neutral",
-  blue: "default",
-  purple: "premium",
-};
-
 interface Props {
   instances: EditorInstance[];
 }
@@ -37,69 +21,65 @@ interface Props {
 export function InstanceHealthTable({ instances }: Props) {
   const { t } = useTranslation();
 
-  const cols: TableColumn<EditorInstance>[] = [
-    {
+  const cols: DataTableColumn<EditorInstance>[] = [
+    column.entity({
       key: "host",
       header: t("portal.editorAdmin.health.columns.host"),
-      render: (i) => (
-        <div className="portal-editor__cell-stack">
-          <span className="portal-editor__cell-strong">{i.host}</span>
-          <span className="portal-editor__cell-muted">
-            <Chip
-              size="sm"
-              accent={TARGET_CHIP_ACCENT[TARGET_META[i.target].tone]}
-            >
-              {TARGET_LABEL[i.target]}
-            </Chip>
-          </span>
-        </div>
-      ),
-    },
-    {
+      sortable: true,
+      primary: (i) => i.host,
+    }),
+    column.text({
+      key: "target",
+      header: t("portal.editorAdmin.health.columns.target", "Target"),
+      sortable: true,
+      get: (i) => TARGET_LABEL[i.target],
+    }),
+    column.mono({
       key: "version",
       header: t("portal.editorAdmin.health.columns.version"),
-      render: (i) => <code className="portal-editor__mono">{i.version}</code>,
-    },
-    {
+      sortable: true,
+      get: (i) => i.version,
+    }),
+    column.mono({
       key: "region",
       header: t("portal.editorAdmin.health.columns.region"),
-      render: (i) => <span className="portal-editor__mono">{i.region}</span>,
-    },
-    {
+      sortable: true,
+      get: (i) => i.region,
+    }),
+    column.badge({
       key: "status",
       header: t("portal.editorAdmin.health.columns.status"),
-      render: (i) => (
-        <StatusBadge tone={INSTANCE_STATUS_TONE[i.status]} size="sm">
-          {t(INSTANCE_STATUS_LABEL[i.status])}
-        </StatusBadge>
-      ),
-    },
-    {
+      sortable: true,
+      get: (i) => ({
+        tone: INSTANCE_STATUS_TONE[i.status],
+        label: t(INSTANCE_STATUS_LABEL[i.status]),
+      }),
+    }),
+    column.muted({
       key: "lastSeen",
       header: t("portal.editorAdmin.health.columns.lastSeen"),
-      render: (i) => <span className="portal-editor__muted">{i.lastSeen}</span>,
-    },
-    {
+      get: (i) => i.lastSeen,
+    }),
+    column.number({
       key: "activeUsers",
       header: t("portal.editorAdmin.health.columns.activeUsers"),
-      align: "right",
-      render: (i) => (
-        <span className="portal-editor__mono">{i.activeUsers}</span>
-      ),
-    },
+      sortable: true,
+      get: (i) => i.activeUsers,
+    }),
   ];
 
   return (
-    <Card padding="none">
-      {instances.length === 0 ? (
+    <DataTable<EditorInstance>
+      columns={cols}
+      rows={instances}
+      rowKey={(i) => i.id}
+      empty={
         <EmptyState
           size="compact"
           title={t("portal.editorAdmin.health.empty.title")}
           description={t("portal.editorAdmin.health.empty.description")}
         />
-      ) : (
-        <Table columns={cols} rows={instances} rowKey={(i) => i.id} />
-      )}
-    </Card>
+      }
+    />
   );
 }
diff --git a/frontend/editor/src/portal/components/failures/FailureActionButtons.test.tsx b/frontend/editor/src/portal/components/failures/FailureActionButtons.test.tsx
index 7982eb15ce..2409a03ec9 100644
--- a/frontend/editor/src/portal/components/failures/FailureActionButtons.test.tsx
+++ b/frontend/editor/src/portal/components/failures/FailureActionButtons.test.tsx
@@ -70,6 +70,7 @@ function event(actions: FailureActionOffer[]): FileRunEvent {
     detail: "boom",
     policyId: "p1",
     runId: "r1",
+    sourceId: null,
     fileId: "f-1",
     actor: "someone@example.com",
     occurrences: 1,
diff --git a/frontend/editor/src/portal/components/failures/FileRunEventList.test.tsx b/frontend/editor/src/portal/components/failures/FileRunEventList.test.tsx
index 1458a1d64d..9ec3af6842 100644
--- a/frontend/editor/src/portal/components/failures/FileRunEventList.test.tsx
+++ b/frontend/editor/src/portal/components/failures/FileRunEventList.test.tsx
@@ -21,7 +21,14 @@ vi.mock("react-i18next", () => ({
   useTranslation: () => ({
     // Faithful to i18next: a known key resolves, an unknown key falls back to
     // defaultValue. That is what exercises the server-key-then-generic chain.
-    t: (key: string, options?: { defaultValue?: string } | string) => {
+    // i18next's real signature: t(key, options) or t(key, defaultValue, options).
+    t: (
+      key: string,
+      second?: { defaultValue?: string } | string,
+      third?: Record<string, unknown>,
+    ) => {
+      const options = typeof second === "string" ? third : second;
+      const fallback = typeof second === "string" ? second : undefined;
       const known: Record<string, string> = {
         "portal.failures.kind.inputPasswordProtected.title":
           "Password-protected document",
@@ -30,11 +37,20 @@ vi.mock("react-i18next", () => ({
         "portal.failures.occurrences": "occurrences",
         "portal.failures.runReference": "Run r1",
         "portal.failures.stage.input": "Input",
+        "portal.failures.origin.tool": "Tool run",
+        "portal.failures.origin.policy": "Policy",
       };
+      if (key === "portal.failures.fromSource") {
+        return `From source ${(options as { source?: string })?.source ?? ""}`;
+      }
+      if (key === "portal.failures.reportedBy") {
+        return `Hit by ${(options as { actor?: string })?.actor ?? ""}`;
+      }
       if (known[key]) return known[key];
-      if (typeof options === "string") return options;
-      if (options?.defaultValue) return options.defaultValue;
-      return key;
+      if ((options as { defaultValue?: string })?.defaultValue) {
+        return (options as { defaultValue: string }).defaultValue;
+      }
+      return fallback ?? key;
     },
   }),
 }));
@@ -61,6 +77,7 @@ function event(overrides: Partial<FileRunEvent> = {}): FileRunEvent {
     detail: "The PDF Document is passworded",
     policyId: "p1",
     runId: "r1",
+    sourceId: null,
     fileId: "f-1",
     actor: "dana@example.com",
     occurrences: 1,
@@ -102,6 +119,29 @@ describe("FileRunEventList", () => {
     expect(screen.getByText("The PDF Document is passworded")).toBeTruthy();
   });
 
+  it("names the person whose editor hit it, and marks it a tool run", async () => {
+    // The point of reporting editor failures: a reviewer needs the person, since a
+    // run reference means nothing for a failure that never had a run.
+    fetchFileRunEvents.mockResolvedValue([
+      event({ origin: "TOOL", actor: "dana@example.com", runId: null }),
+    ]);
+
+    render(<FileRunEventList />);
+
+    expect(await screen.findByText("Tool run")).toBeTruthy();
+    expect(screen.getByText("Hit by dana@example.com")).toBeTruthy();
+  });
+
+  it("names the source when no user was involved, since that is the only attribution", async () => {
+    fetchFileRunEvents.mockResolvedValue([
+      event({ origin: "POLICY", actor: null, sourceId: "src-s3-invoices" }),
+    ]);
+
+    render(<FileRunEventList />);
+
+    expect(await screen.findByText("From source src-s3-invoices")).toBeTruthy();
+  });
+
   it("shows the occurrence count only once a failure has repeated", async () => {
     fetchFileRunEvents.mockResolvedValue([event({ occurrences: 1 })]);
     const { unmount } = render(<FileRunEventList />);
diff --git a/frontend/editor/src/portal/components/failures/FileRunEventList.tsx b/frontend/editor/src/portal/components/failures/FileRunEventList.tsx
index 9b68c53b4c..2330546655 100644
--- a/frontend/editor/src/portal/components/failures/FileRunEventList.tsx
+++ b/frontend/editor/src/portal/components/failures/FileRunEventList.tsx
@@ -7,6 +7,7 @@ import {
   useFileRunEventActions,
 } from "@portal/queries/fileRunEvents";
 import { FailureActionButtons } from "@portal/components/failures/FailureActionButtons";
+import "@portal/theme/surface.css";
 
 /**
  * Recorded policy and pipeline failures, with the triage actions the server offered
@@ -28,6 +29,7 @@ export function FileRunEventList() {
   const { apply, refresh } = useFileRunEventActions();
   const [busy, setBusy] = useState<{ id: string; action: string } | null>(null);
   const [showJson, setShowJson] = useState(false);
+  const [clearing, setClearing] = useState(false);
 
   // A build without the proprietary module has no such route, and a caller who is
   // not a team leader gets a 403. Both mean there is nothing to show.
@@ -42,19 +44,57 @@ export function FileRunEventList() {
     }
   };
 
+  // Empties the queue so a test run starts from nothing. Sequential rather than
+  // concurrent: dismissing is cheap, and one request at a time keeps the failure
+  // obvious if the endpoint refuses one of them.
+  const dismissAll = async () => {
+    setClearing(true);
+    try {
+      for (const event of events ?? []) {
+        const dismiss = event.actions.find(
+          (action) => action.id === "DISMISS" && action.enabled,
+        );
+        if (dismiss) {
+          await apply(event.id, "DISMISS");
+        }
+      }
+    } finally {
+      setClearing(false);
+      await refresh();
+    }
+  };
+
   // Dev-only inspector for hand-checking classification against real uploads.
   // Vite folds `import.meta.env.DEV` to false, so builds drop this entirely.
   const debugPanel = !import.meta.env.DEV ? null : (
     <div className="portal-failures__debug">
       <Button variant="secondary" size="sm" onClick={() => void refresh()}>
-        Refresh failures
+        {t("portal.failures.debug.refresh", "Refresh failures")}
+      </Button>
+      <Button
+        variant="secondary"
+        size="sm"
+        disabled={clearing || (events?.length ?? 0) === 0}
+        onClick={() => void dismissAll()}
+      >
+        {clearing
+          ? t("portal.failures.debug.dismissing", "Dismissing...")
+          : t("portal.failures.debug.dismissAll", "Dismiss all ({{total}})", {
+              total: events?.length ?? 0,
+            })}
       </Button>
       <Button
         variant="secondary"
         size="sm"
         onClick={() => setShowJson((shown) => !shown)}
       >
-        {showJson ? "Hide" : "Show"} raw JSON ({events?.length ?? 0})
+        {showJson
+          ? t("portal.failures.debug.hideJson", "Hide raw JSON ({{total}})", {
+              total: events?.length ?? 0,
+            })
+          : t("portal.failures.debug.showJson", "Show raw JSON ({{total}})", {
+              total: events?.length ?? 0,
+            })}
       </Button>
       <Button
         variant="secondary"
@@ -65,7 +105,7 @@ export function FileRunEventList() {
           )
         }
       >
-        Copy JSON
+        {t("portal.failures.debug.copyJson", "Copy JSON")}
       </Button>
       {showJson && (
         <pre className="portal-failures__debug-json">
@@ -137,7 +177,7 @@ function FailureBody({
   return (
     <ul className="portal-failures__list">
       {events.map((event) => (
-        <li key={event.id} className="portal-failures__row">
+        <li key={event.id} className="portal-surface portal-failures__row">
           <div className="portal-failures__meta">
             <StatusBadge tone={SEVERITY_TONE[event.severity]}>
               {t(
@@ -157,8 +197,32 @@ function FailureBody({
                 })}
               </span>
             )}
+            <span className="portal-failures__origin">
+              {t(
+                `portal.failures.origin.${event.origin.toLowerCase()}`,
+                event.origin,
+              )}
+            </span>
           </div>
 
+          {/* Who or what it came from. An unattended file has no user, so the source
+            is the only attribution there is. */}
+          {event.actor ? (
+            <div className="portal-failures__actor">
+              {t("portal.failures.reportedBy", "Hit by {{actor}}", {
+                actor: event.actor,
+              })}
+            </div>
+          ) : (
+            event.sourceId && (
+              <div className="portal-failures__actor">
+                {t("portal.failures.fromSource", "From source {{source}}", {
+                  source: event.sourceId,
+                })}
+              </div>
+            )
+          )}
+
           {/* A reference, not a name. The record deliberately holds no document
             identity, so a reviewer sees which run failed, never which file. */}
           {event.runId && (
diff --git a/frontend/editor/src/portal/components/failures/failures.css b/frontend/editor/src/portal/components/failures/failures.css
index 0ac874dabc..9e43361e43 100644
--- a/frontend/editor/src/portal/components/failures/failures.css
+++ b/frontend/editor/src/portal/components/failures/failures.css
@@ -36,9 +36,6 @@
 }
 
 .portal-failures__row {
-  border: 1px solid var(--c-border);
-  border-radius: 8px;
-  background: var(--c-surface);
   padding: 0.8rem 0.95rem;
 }
 
@@ -68,6 +65,19 @@
 
 /* The raw failure message. Monospace because for an unclassified failure this is
    a stack-trace-ish diagnostic, not prose. */
+.portal-failures__origin {
+  font-size: 0.75rem;
+  color: var(--c-text-subtle);
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-sm, 0.25rem);
+  padding: 0 0.35rem;
+}
+
+.portal-failures__actor {
+  font-size: 0.8125rem;
+  color: var(--c-text-muted);
+}
+
 .portal-failures__detail {
   font-family: var(--font-mono, ui-monospace, monospace);
   font-size: 0.76rem;
diff --git a/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx
index 6a2817d12d..a826e18caa 100644
--- a/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx
@@ -52,6 +52,7 @@ export function ApiKeysTab() {
           sub={t("portal.infrastructure.apiKeys.subheading")}
         />
         <Button
+          variant="secondary"
           size="sm"
           onClick={() => setModalOpen(true)}
           leftSection={<span aria-hidden>+</span>}
diff --git a/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx b/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx
index da9831ec4c..71ae52ac8b 100644
--- a/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx
@@ -2,15 +2,14 @@ import { useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
   Button,
-  Card,
+  column,
+  DataTable,
+  type DataTableColumn,
   EmptyState,
   MetricCard,
   MetricStrip,
-  StatusBadge,
-  Table,
   Tabs,
   type TabItem,
-  type TableColumn,
 } from "@app/ui";
 import { useTier } from "@portal/contexts/TierContext";
 import { useSectionFlags } from "@portal/hooks/useAsync";
@@ -22,10 +21,8 @@ import {
 } from "@portal/api/infrastructure";
 import { AuditExportModal } from "@portal/components/infrastructure/AuditExportModal";
 import { SectionHeader } from "@portal/components/infrastructure/SectionHeader";
-import { TableSkeleton } from "@portal/components/infrastructure/TableSkeleton";
 import {
   AUDIT_CAT_LABEL,
-  AUDIT_CAT_TONE,
   AUDIT_STATUS_LABEL,
   AUDIT_TONE,
 } from "@portal/components/infrastructure/infraFormat";
@@ -57,55 +54,52 @@ export function AuditTab() {
     },
   ];
 
-  const cols: TableColumn<AuditEvent>[] = [
-    {
+  const cols: DataTableColumn<AuditEvent>[] = [
+    column.mono({
       key: "timestamp",
       header: t("portal.infrastructure.audit.columns.timestamp"),
-      render: (e) => <span className="portal-infra__mono">{e.timestamp}</span>,
-    },
-    {
+      sortable: true,
+      get: (e) => e.timestamp,
+    }),
+    column.text({
       key: "event",
       header: t("portal.infrastructure.audit.columns.event"),
-      render: (e) => (
-        <div className="portal-infra__event">
-          <StatusBadge tone={AUDIT_CAT_TONE[e.category]} size="sm">
-            {t(AUDIT_CAT_LABEL[e.category])}
-          </StatusBadge>
-          <span>{e.action}</span>
-        </div>
-      ),
-    },
-    {
+      sortable: true,
+      // "Category: action" on one line - the category as a bold label, no
+      // status-coloured dot. Colour is reserved for the Status column, where it
+      // actually signals an outcome.
+      label: (e) => t(AUDIT_CAT_LABEL[e.category]),
+      get: (e) => e.action,
+    }),
+    column.mono({
       key: "actor",
       header: t("portal.infrastructure.audit.columns.actor"),
-      render: (e) => <span className="portal-infra__mono">{e.actor}</span>,
-    },
-    {
+      sortable: true,
+      get: (e) => e.actor,
+    }),
+    column.text({
       key: "target",
       header: t("portal.infrastructure.audit.columns.target"),
-      render: (e) => e.target,
-    },
-    {
+      sortable: true,
+      get: (e) => e.target,
+    }),
+    column.badge({
       key: "status",
       header: t("portal.infrastructure.audit.columns.status"),
-      render: (e) => (
-        <StatusBadge tone={AUDIT_TONE[e.status]} size="sm">
-          {t(AUDIT_STATUS_LABEL[e.status])}
-        </StatusBadge>
-      ),
-    },
-    {
+      sortable: true,
+      get: (e) => ({
+        tone: AUDIT_TONE[e.status],
+        label: t(AUDIT_STATUS_LABEL[e.status]),
+      }),
+    }),
+    column.number({
       key: "latency",
       header: t("portal.infrastructure.audit.columns.latency"),
-      align: "right",
-      render: (e) => (
-        <span className="portal-infra__mono">
-          {t("portal.infrastructure.audit.latencyValue", {
-            value: e.latencyMs,
-          })}
-        </span>
-      ),
-    },
+      sortable: true,
+      get: (e) => e.latencyMs,
+      format: (n) =>
+        t("portal.infrastructure.audit.latencyValue", { value: n }),
+    }),
   ];
 
   const state = useAuditLog(tier);
@@ -171,31 +165,31 @@ export function AuditTab() {
         />
       )}
 
-      <Card padding="none">
-        {isLoading && <TableSkeleton rows={6} cols={6} />}
-        {!isLoading && forbidden && (
-          <EmptyState
-            size="compact"
-            title={t("portal.infrastructure.audit.forbidden.title")}
-            description={t("portal.infrastructure.audit.forbidden.description")}
-          />
-        )}
-        {!isLoading && !forbidden && isEmpty && (
-          <EmptyState
-            size="compact"
-            title={t("portal.infrastructure.audit.empty.title")}
-            description={t("portal.infrastructure.audit.empty.description")}
-          />
-        )}
-        {!isEmpty && data && (
-          <Table
-            columns={cols}
-            rows={rows}
-            rowKey={(e) => e.id}
-            empty={t("portal.infrastructure.audit.noEventsInCategory")}
-          />
-        )}
-      </Card>
+      <DataTable
+        columns={cols}
+        rows={rows}
+        rowKey={(e) => e.id}
+        loading={isLoading}
+        empty={
+          forbidden ? (
+            <EmptyState
+              size="compact"
+              title={t("portal.infrastructure.audit.forbidden.title")}
+              description={t(
+                "portal.infrastructure.audit.forbidden.description",
+              )}
+            />
+          ) : isEmpty ? (
+            <EmptyState
+              size="compact"
+              title={t("portal.infrastructure.audit.empty.title")}
+              description={t("portal.infrastructure.audit.empty.description")}
+            />
+          ) : (
+            t("portal.infrastructure.audit.noEventsInCategory")
+          )
+        }
+      />
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.stories.tsx b/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.stories.tsx
deleted file mode 100644
index de559bd344..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.stories.tsx
+++ /dev/null
@@ -1,46 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { http, HttpResponse, delay } from "msw";
-import { DeploymentsTab } from "@portal/components/infrastructure/DeploymentsTab";
-import "@portal/views/Infrastructure.css";
-
-const meta: Meta<typeof DeploymentsTab> = {
-  title: "Portal/Infrastructure/DeploymentsTab",
-  component: DeploymentsTab,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "72rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof DeploymentsTab>;
-
-export const Default: Story = {};
-
-export const Loading: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/infrastructure/deployments", async () => {
-          await delay("infinite");
-          return HttpResponse.json({ regions: [], recent: [] });
-        }),
-      ],
-    },
-  },
-};
-
-export const Empty: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/infrastructure/deployments", () =>
-          HttpResponse.json({ regions: [], recent: [] }),
-        ),
-      ],
-    },
-  },
-};
diff --git a/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.tsx b/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.tsx
deleted file mode 100644
index 41a9b5c561..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/DeploymentsTab.tsx
+++ /dev/null
@@ -1,233 +0,0 @@
-import { useTranslation } from "react-i18next";
-import {
-  Card,
-  Chip,
-  EmptyState,
-  ProgressBar,
-  StatusBadge,
-  Table,
-  type TableColumn,
-} from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import {
-  fetchDeployments,
-  type DeploymentsResponse,
-  type DeploymentRegion,
-  type RecentDeployment,
-} from "@portal/api/infrastructure";
-import { SectionHeader } from "@portal/components/infrastructure/SectionHeader";
-import { TableSkeleton } from "@portal/components/infrastructure/TableSkeleton";
-import {
-  DEPLOY_LABEL,
-  DEPLOY_TONE,
-  pct,
-  REGION_LABEL,
-  REGION_TONE,
-} from "@portal/components/infrastructure/infraFormat";
-
-export function DeploymentsTab() {
-  const { t } = useTranslation();
-  const { tier } = useTier();
-  const state = useAsync<DeploymentsResponse>(
-    () => fetchDeployments(tier),
-    [tier],
-  );
-  const { data } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
-
-  const regionCols: TableColumn<DeploymentRegion>[] = [
-    {
-      key: "name",
-      header: t("portal.infrastructure.deployments.regionColumns.region"),
-      render: (r) => (
-        <div className="portal-infra__cell-stack">
-          <span className="portal-infra__cell-strong">{r.name}</span>
-          <code className="portal-infra__cell-code">{r.code}</code>
-        </div>
-      ),
-    },
-    {
-      key: "latency",
-      header: t("portal.infrastructure.deployments.regionColumns.latency"),
-      align: "right",
-      render: (r) => (
-        <span className="portal-infra__mono">
-          {t("portal.infrastructure.deployments.msValue", {
-            value: r.latencyMs,
-          })}
-        </span>
-      ),
-    },
-    {
-      key: "load",
-      header: t("portal.infrastructure.deployments.regionColumns.load"),
-      width: "9rem",
-      render: (r) => (
-        <div className="portal-infra__load">
-          <ProgressBar
-            value={r.load}
-            thresholded
-            height={6}
-            label={t("portal.infrastructure.deployments.loadAria", {
-              name: r.name,
-            })}
-          />
-          <span className="portal-infra__load-pct">{pct(r.load)}</span>
-        </div>
-      ),
-    },
-    {
-      key: "status",
-      header: t("portal.infrastructure.deployments.regionColumns.status"),
-      render: (r) => (
-        <StatusBadge tone={REGION_TONE[r.status]} size="sm">
-          {t(REGION_LABEL[r.status])}
-        </StatusBadge>
-      ),
-    },
-    {
-      key: "version",
-      header: t("portal.infrastructure.deployments.regionColumns.version"),
-      render: (r) => (
-        <code className="portal-infra__cell-code">{r.version}</code>
-      ),
-    },
-    {
-      key: "uptime",
-      header: t("portal.infrastructure.deployments.regionColumns.uptime"),
-      align: "right",
-      render: (r) => (
-        <span className="portal-infra__mono">{pct(r.uptime, 3)}</span>
-      ),
-    },
-    {
-      key: "instances",
-      header: t("portal.infrastructure.deployments.regionColumns.instances"),
-      align: "right",
-      render: (r) => <span className="portal-infra__mono">{r.instances}</span>,
-    },
-    {
-      key: "throughput",
-      header: t("portal.infrastructure.deployments.regionColumns.throughput"),
-      align: "right",
-      render: (r) => (
-        <span className="portal-infra__mono">
-          {t("portal.infrastructure.deployments.throughputValue", {
-            value: r.throughput.toLocaleString(),
-          })}
-        </span>
-      ),
-    },
-    {
-      key: "p99",
-      header: t("portal.infrastructure.deployments.regionColumns.p99"),
-      align: "right",
-      render: (r) => (
-        <span className="portal-infra__mono">
-          {t("portal.infrastructure.deployments.msValue", { value: r.p99Ms })}
-        </span>
-      ),
-    },
-  ];
-
-  const deployCols: TableColumn<RecentDeployment>[] = [
-    {
-      key: "version",
-      header: t("portal.infrastructure.deployments.deployColumns.version"),
-      render: (d) => (
-        <code className="portal-infra__cell-code">{d.version}</code>
-      ),
-    },
-    {
-      key: "environment",
-      header: t("portal.infrastructure.deployments.deployColumns.environment"),
-      render: (d) => (
-        <Chip
-          accent={
-            d.environment === "production"
-              ? "default"
-              : d.environment === "canary"
-                ? "premium"
-                : "neutral"
-          }
-          size="sm"
-        >
-          {d.environment}
-        </Chip>
-      ),
-    },
-    {
-      key: "product",
-      header: t("portal.infrastructure.deployments.deployColumns.product"),
-      render: (d) => d.product,
-    },
-    {
-      key: "status",
-      header: t("portal.infrastructure.deployments.deployColumns.status"),
-      render: (d) => (
-        <StatusBadge tone={DEPLOY_TONE[d.status]} size="sm">
-          {t(DEPLOY_LABEL[d.status])}
-        </StatusBadge>
-      ),
-    },
-    {
-      key: "deployedBy",
-      header: t("portal.infrastructure.deployments.deployColumns.deployedBy"),
-      render: (d) => <span className="portal-infra__mono">{d.deployedBy}</span>,
-    },
-    {
-      key: "timestamp",
-      header: t("portal.infrastructure.deployments.deployColumns.when"),
-      align: "right",
-      render: (d) => <span className="portal-infra__muted">{d.timestamp}</span>,
-    },
-  ];
-
-  return (
-    <div className="portal-infra__stack">
-      <section>
-        <SectionHeader
-          title={t("portal.infrastructure.deployments.regions.heading")}
-          sub={t("portal.infrastructure.deployments.regions.subheading")}
-        />
-        <Card padding="none">
-          {isLoading && <TableSkeleton rows={3} cols={9} />}
-          {isEmpty && (
-            <EmptyState
-              size="compact"
-              title={t("portal.infrastructure.deployments.regions.empty.title")}
-              description={t(
-                "portal.infrastructure.deployments.regions.empty.description",
-              )}
-            />
-          )}
-          {!isEmpty && data && data.regions.length > 0 && (
-            <Table
-              columns={regionCols}
-              rows={data.regions}
-              rowKey={(r) => r.code}
-            />
-          )}
-        </Card>
-      </section>
-
-      <section>
-        <SectionHeader
-          title={t("portal.infrastructure.deployments.recent.heading")}
-          sub={t("portal.infrastructure.deployments.recent.subheading")}
-        />
-        <Card padding="none">
-          {isLoading && <TableSkeleton rows={4} cols={6} />}
-          {data && data.recent.length > 0 && (
-            <Table
-              columns={deployCols}
-              rows={data.recent}
-              rowKey={(d) => d.id}
-            />
-          )}
-        </Card>
-      </section>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/infrastructure/ModelsTab.stories.tsx b/frontend/editor/src/portal/components/infrastructure/ModelsTab.stories.tsx
deleted file mode 100644
index c69fd63988..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/ModelsTab.stories.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { ModelsTab } from "@portal/components/infrastructure/ModelsTab";
-import "@portal/views/Infrastructure.css";
-
-// Data is served by the registered MSW infrastructure handler; the tier global
-// (toolbar) drives which catalogue + routing slice each story renders.
-const meta = {
-  title: "Infrastructure/ModelsTab",
-  component: ModelsTab,
-  parameters: { layout: "padded" },
-} satisfies Meta<typeof ModelsTab>;
-
-export default meta;
-
-type Story = StoryObj<typeof meta>;
-
-/** Pro: full managed catalogue plus routing control. */
-export const Pro: Story = {
-  globals: { tier: "pro" },
-};
-
-/** Free: two managed models, no routing (upgrade nudge). */
-export const Free: Story = {
-  globals: { tier: "free" },
-};
-
-/** Enterprise: adds bring-your-own / on-prem models and per-region pinning. */
-export const Enterprise: Story = {
-  globals: { tier: "enterprise" },
-};
diff --git a/frontend/editor/src/portal/components/infrastructure/ModelsTab.tsx b/frontend/editor/src/portal/components/infrastructure/ModelsTab.tsx
deleted file mode 100644
index 505f41ac24..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/ModelsTab.tsx
+++ /dev/null
@@ -1,272 +0,0 @@
-import { useTranslation } from "react-i18next";
-import {
-  Banner,
-  Card,
-  Chip,
-  EmptyState,
-  MetricCard,
-  MetricStrip,
-  ProgressBar,
-  Select,
-  StatusBadge,
-  Table,
-  type SelectOption,
-  type TableColumn,
-} from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import {
-  fetchModels,
-  type ModelEntry,
-  type ModelsResponse,
-  type RoutingRule,
-} from "@portal/api/infrastructure";
-import { SectionHeader } from "@portal/components/infrastructure/SectionHeader";
-import { TableSkeleton } from "@portal/components/infrastructure/TableSkeleton";
-import {
-  MODEL_LABEL,
-  MODEL_PROVIDER_LABEL,
-  MODEL_TONE,
-  MODEL_TYPE_LABEL,
-  MODEL_TYPE_TONE,
-  modelCost,
-  pct,
-} from "@portal/components/infrastructure/infraFormat";
-
-export function ModelsTab() {
-  const { t } = useTranslation();
-  const { tier } = useTier();
-  const state = useAsync<ModelsResponse>(() => fetchModels(tier), [tier]);
-  const { data } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
-
-  const modelCols: TableColumn<ModelEntry>[] = [
-    {
-      key: "name",
-      header: t("portal.infrastructure.models.columns.model"),
-      render: (m) => (
-        <div className="portal-infra__cell-stack">
-          <span className="portal-infra__cell-strong">{m.name}</span>
-          <Chip accent="neutral" size="sm">
-            {MODEL_PROVIDER_LABEL[m.provider]}
-          </Chip>
-        </div>
-      ),
-    },
-    {
-      key: "type",
-      header: t("portal.infrastructure.models.columns.type"),
-      render: (m) => (
-        <Chip accent={MODEL_TYPE_TONE[m.type]} size="sm">
-          {t(MODEL_TYPE_LABEL[m.type])}
-        </Chip>
-      ),
-    },
-    {
-      key: "status",
-      header: t("portal.infrastructure.models.columns.status"),
-      render: (m) => (
-        <StatusBadge tone={MODEL_TONE[m.status]} size="sm">
-          {t(MODEL_LABEL[m.status])}
-        </StatusBadge>
-      ),
-    },
-    {
-      key: "load",
-      header: t("portal.infrastructure.models.columns.load"),
-      width: "9rem",
-      render: (m) => (
-        <div className="portal-infra__load">
-          <ProgressBar
-            value={m.load}
-            thresholded
-            height={6}
-            label={t("portal.infrastructure.models.loadAria", { name: m.name })}
-          />
-          <span className="portal-infra__load-pct">{pct(m.load)}</span>
-        </div>
-      ),
-    },
-    {
-      key: "latency",
-      header: t("portal.infrastructure.models.columns.latency"),
-      align: "right",
-      render: (m) => (
-        <span className="portal-infra__mono">
-          {t("portal.infrastructure.models.msValue", { value: m.latencyMs })}
-        </span>
-      ),
-    },
-    {
-      key: "cost",
-      header: t("portal.infrastructure.models.columns.cost"),
-      align: "right",
-      render: (m) => (
-        <span className="portal-infra__mono">
-          {modelCost(t, m.cost, m.costUnit)}
-        </span>
-      ),
-    },
-    {
-      key: "version",
-      header: t("portal.infrastructure.models.columns.version"),
-      render: (m) => (
-        <code className="portal-infra__cell-code">{m.version}</code>
-      ),
-    },
-  ];
-
-  // Free has no routing control: the catalogue is read-only and the routing
-  // table is replaced by an upgrade nudge.
-  const canRoute = tier !== "free";
-
-  // Routing overrides are interactive but unbacked — assigning a model just
-  // moves local UI state until the routing endpoint exists.
-  // TODO(backend): PUT /v1/infrastructure/models/routing { rules }
-  const modelOptions: SelectOption[] =
-    data?.models
-      .filter((m) => m.status !== "disabled")
-      .map((m) => ({ value: m.id, label: m.name })) ?? [];
-
-  const routingCols: TableColumn<RoutingRule>[] = [
-    {
-      key: "operation",
-      header: t("portal.infrastructure.models.routingColumns.operation"),
-      render: (r) => (
-        <div className="portal-infra__cell-stack">
-          <span className="portal-infra__cell-strong">{r.operation}</span>
-          {r.isDefault && (
-            <Chip accent="default" size="sm">
-              {t("portal.infrastructure.models.routingColumns.default")}
-            </Chip>
-          )}
-        </div>
-      ),
-    },
-    {
-      key: "docType",
-      header: t("portal.infrastructure.models.routingColumns.docType"),
-      render: (r) => r.docType,
-    },
-    {
-      key: "modelId",
-      header: t("portal.infrastructure.models.routingColumns.routedTo"),
-      width: "16rem",
-      render: (r) => (
-        <Select
-          inputSize="sm"
-          options={modelOptions}
-          defaultValue={r.modelId}
-          aria-label={t(
-            "portal.infrastructure.models.routingColumns.modelForAria",
-            {
-              operation: r.operation,
-            },
-          )}
-        />
-      ),
-    },
-  ];
-
-  return (
-    <div className="portal-infra__stack">
-      <SectionHeader
-        title={t("portal.infrastructure.models.heading")}
-        sub={t("portal.infrastructure.models.subheading")}
-      />
-
-      {data && (
-        <MetricStrip layout="row">
-          <MetricCard
-            label={t("portal.infrastructure.models.metrics.activeModels")}
-            value={data.summary.activeModels}
-          />
-          <MetricCard
-            label={t("portal.infrastructure.models.metrics.avgLatency")}
-            value={t("portal.infrastructure.models.msValue", {
-              value: data.summary.avgLatencyMs,
-            })}
-          />
-          <MetricCard
-            label={t("portal.infrastructure.models.metrics.monthlySpend")}
-            value={
-              data.summary.monthlySpend > 0
-                ? `$${data.summary.monthlySpend.toLocaleString()}`
-                : t("portal.infrastructure.models.metrics.included")
-            }
-          />
-        </MetricStrip>
-      )}
-
-      <section>
-        <SectionHeader
-          title={t("portal.infrastructure.models.catalogue.heading")}
-          sub={
-            tier === "enterprise"
-              ? t("portal.infrastructure.models.catalogue.subEnterprise")
-              : t("portal.infrastructure.models.catalogue.sub")
-          }
-        />
-        <Card padding="none">
-          {isLoading && <TableSkeleton rows={4} cols={7} />}
-          {isEmpty && (
-            <EmptyState
-              size="compact"
-              title={t("portal.infrastructure.models.catalogue.empty.title")}
-              description={t(
-                "portal.infrastructure.models.catalogue.empty.description",
-              )}
-            />
-          )}
-          {!isEmpty && data && data.models.length > 0 && (
-            <Table
-              columns={modelCols}
-              rows={data.models}
-              rowKey={(m) => m.id}
-            />
-          )}
-        </Card>
-      </section>
-
-      {tier === "enterprise" && (
-        <Banner
-          tone="info"
-          title={t("portal.infrastructure.models.byom.title")}
-          description={t("portal.infrastructure.models.byom.description")}
-        />
-      )}
-
-      <section>
-        <SectionHeader
-          title={t("portal.infrastructure.models.routing.heading")}
-          sub={
-            canRoute
-              ? t("portal.infrastructure.models.routing.sub")
-              : t("portal.infrastructure.models.routing.subLocked")
-          }
-        />
-        {canRoute ? (
-          <Card padding="none">
-            {isLoading && <TableSkeleton rows={4} cols={3} />}
-            {!isEmpty && data && (
-              <Table
-                columns={routingCols}
-                rows={data.routing}
-                rowKey={(r) => r.id}
-                empty={t("portal.infrastructure.models.routing.empty")}
-              />
-            )}
-          </Card>
-        ) : (
-          <Banner
-            tone="info"
-            title={t("portal.infrastructure.models.routing.lockedBanner.title")}
-            description={t(
-              "portal.infrastructure.models.routing.lockedBanner.description",
-            )}
-          />
-        )}
-      </section>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/infrastructure/SecurityTab.stories.tsx b/frontend/editor/src/portal/components/infrastructure/SecurityTab.stories.tsx
deleted file mode 100644
index 324c841043..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/SecurityTab.stories.tsx
+++ /dev/null
@@ -1,58 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { http, HttpResponse, delay } from "msw";
-import { SecurityTab } from "@portal/components/infrastructure/SecurityTab";
-import "@portal/views/Infrastructure.css";
-
-const meta: Meta<typeof SecurityTab> = {
-  title: "Portal/Infrastructure/SecurityTab",
-  component: SecurityTab,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "72rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof SecurityTab>;
-
-export const Default: Story = {};
-
-// Enterprise unlocks HYOK key custody (with a live rotate affordance) and the
-// full attested compliance set, including PCI in-scope.
-export const Enterprise: Story = {
-  globals: { tier: "enterprise" },
-};
-
-// Free runs on Stirling-managed keys (rotate disabled, upgrade nudge) and a
-// trimmed attestation set with HIPAA/PCI not-applicable.
-export const Free: Story = {
-  globals: { tier: "free" },
-};
-
-export const Loading: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/infrastructure/security", async () => {
-          await delay("infinite");
-          return HttpResponse.json(null);
-        }),
-      ],
-    },
-  },
-};
-
-export const Unavailable: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/infrastructure/security", () =>
-          HttpResponse.json(null, { status: 503 }),
-        ),
-      ],
-    },
-  },
-};
diff --git a/frontend/editor/src/portal/components/infrastructure/SecurityTab.tsx b/frontend/editor/src/portal/components/infrastructure/SecurityTab.tsx
deleted file mode 100644
index ccc1b1d3c5..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/SecurityTab.tsx
+++ /dev/null
@@ -1,342 +0,0 @@
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import {
-  Banner,
-  Button,
-  Card,
-  Chip,
-  EmptyState,
-  RadioGroup,
-  Skeleton,
-  StatusBadge,
-  Table,
-  type RadioOption,
-  type TableColumn,
-} from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import {
-  fetchSecurity,
-  type AccessPolicy,
-  type DataResidency,
-  type SecurityConfig,
-} from "@portal/api/infrastructure";
-import { SectionHeader } from "@portal/components/infrastructure/SectionHeader";
-import {
-  ATTESTATION_LABEL,
-  ATTESTATION_TONE,
-  CERT_LABEL,
-  CERT_TONE,
-  KEY_MODE_LABEL,
-  KEY_MODE_TONE,
-} from "@portal/components/infrastructure/infraFormat";
-
-export function SecurityTab() {
-  const { t } = useTranslation();
-  const { tier } = useTier();
-  const state = useAsync<SecurityConfig>(() => fetchSecurity(tier), [tier]);
-  const { data } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
-
-  const ACCESS_OPTS: RadioOption<AccessPolicy>[] = [
-    {
-      value: "stirling",
-      label: t("portal.infrastructure.security.access.stirling.label"),
-      description: t(
-        "portal.infrastructure.security.access.stirling.description",
-      ),
-    },
-    {
-      value: "byok",
-      label: t("portal.infrastructure.security.access.byok.label"),
-      description: t("portal.infrastructure.security.access.byok.description"),
-    },
-    {
-      value: "hyok",
-      label: t("portal.infrastructure.security.access.hyok.label"),
-      description: t("portal.infrastructure.security.access.hyok.description"),
-    },
-  ];
-
-  const RESIDENCY_OPTS: RadioOption<DataResidency>[] = [
-    {
-      value: "us",
-      label: t("portal.infrastructure.security.residency.us.label"),
-      description: t("portal.infrastructure.security.residency.us.description"),
-    },
-    {
-      value: "eu",
-      label: t("portal.infrastructure.security.residency.eu.label"),
-      description: t("portal.infrastructure.security.residency.eu.description"),
-    },
-    {
-      value: "apac",
-      label: t("portal.infrastructure.security.residency.apac.label"),
-      description: t(
-        "portal.infrastructure.security.residency.apac.description",
-      ),
-    },
-  ];
-
-  const ipCols: TableColumn<SecurityConfig["ipAllowlist"][number]>[] = [
-    {
-      key: "label",
-      header: t("portal.infrastructure.security.ipColumns.label"),
-      render: (e) => e.label,
-    },
-    {
-      key: "cidr",
-      header: t("portal.infrastructure.security.ipColumns.cidr"),
-      render: (e) => <code className="portal-infra__cell-code">{e.cidr}</code>,
-    },
-    {
-      key: "addedBy",
-      header: t("portal.infrastructure.security.ipColumns.addedBy"),
-      render: (e) => <span className="portal-infra__mono">{e.addedBy}</span>,
-    },
-    {
-      key: "added",
-      header: t("portal.infrastructure.security.ipColumns.added"),
-      align: "right",
-      render: (e) => <span className="portal-infra__muted">{e.added}</span>,
-    },
-  ];
-
-  // Local mirrors so the radios are interactive without a backend round-trip,
-  // seeded from the fetched config once it lands.
-  // TODO(backend): PATCH /v1/infrastructure/security { accessPolicy, dataResidency }
-  const [access, setAccess] = useState<AccessPolicy | null>(null);
-  const [residency, setResidency] = useState<DataResidency | null>(null);
-
-  const accessValue = access ?? data?.accessPolicy ?? "stirling";
-  const residencyValue = residency ?? data?.dataResidency ?? "us";
-
-  if (isLoading) {
-    return (
-      <div className="portal-infra__stack" aria-hidden>
-        <Skeleton height="11rem" />
-        <Skeleton height="7rem" />
-      </div>
-    );
-  }
-
-  if (isEmpty || !data) {
-    return (
-      <EmptyState
-        size="compact"
-        title={t("portal.infrastructure.security.empty.title")}
-        description={t("portal.infrastructure.security.empty.description")}
-      />
-    );
-  }
-
-  return (
-    <div className="portal-infra__stack">
-      <section className="portal-infra__split">
-        <Card padding="loose">
-          <SectionHeader
-            title={t("portal.infrastructure.security.accessPolicy.heading")}
-            sub={t("portal.infrastructure.security.accessPolicy.subheading")}
-          />
-          <RadioGroup
-            name="access-policy"
-            value={accessValue}
-            onChange={setAccess}
-            options={ACCESS_OPTS}
-          />
-          {accessValue === "hyok" && (
-            <Banner
-              tone="success"
-              className="portal-infra__banner"
-              title={t("portal.infrastructure.security.hyokBanner.title")}
-              description={t(
-                "portal.infrastructure.security.hyokBanner.description",
-              )}
-            />
-          )}
-        </Card>
-
-        <Card padding="loose">
-          <SectionHeader
-            title={t("portal.infrastructure.security.residencyHeader.heading")}
-            sub={t("portal.infrastructure.security.residencyHeader.subheading")}
-          />
-          <RadioGroup
-            name="data-residency"
-            value={residencyValue}
-            onChange={setResidency}
-            options={RESIDENCY_OPTS}
-          />
-        </Card>
-      </section>
-
-      <section>
-        <SectionHeader
-          title={t("portal.infrastructure.security.keyManagement.heading")}
-          sub={t("portal.infrastructure.security.keyManagement.subheading")}
-        />
-        <Card padding="loose" className="portal-infra__keymgmt">
-          <div className="portal-infra__keymgmt-head">
-            <div className="portal-infra__keymgmt-title">
-              <span className="portal-infra__cell-strong">
-                {data.keyManagement.provider}
-              </span>
-              <StatusBadge
-                tone={KEY_MODE_TONE[data.keyManagement.mode]}
-                size="sm"
-              >
-                {KEY_MODE_LABEL[data.keyManagement.mode]}
-              </StatusBadge>
-            </div>
-            {/* Rotation is a privileged backend action; disabled where Stirling
-                holds the keys (managed tiers can't rotate customer keys). */}
-            <Button
-              variant="secondary"
-              size="sm"
-              disabled={!data.keyManagement.customerManaged}
-              onClick={() => {
-                // TODO(backend): POST /v1/infrastructure/security/keys/rotate
-              }}
-            >
-              {t("portal.infrastructure.security.keyManagement.rotateKey")}
-            </Button>
-          </div>
-
-          <dl className="portal-infra__kv">
-            <div className="portal-infra__kv-wide">
-              <dt>{t("portal.infrastructure.security.keyManagement.keyId")}</dt>
-              <dd>
-                <code className="portal-infra__cell-code">
-                  {data.keyManagement.keyId}
-                </code>
-              </dd>
-            </div>
-            <div>
-              <dt>
-                {t("portal.infrastructure.security.keyManagement.algorithm")}
-              </dt>
-              <dd className="portal-infra__mono">
-                {data.keyManagement.algorithm}
-              </dd>
-            </div>
-            <div>
-              <dt>
-                {t("portal.infrastructure.security.keyManagement.lastRotated")}
-              </dt>
-              <dd>{data.keyManagement.lastRotated}</dd>
-            </div>
-            <div>
-              <dt>
-                {t(
-                  "portal.infrastructure.security.keyManagement.rotationPolicy",
-                )}
-              </dt>
-              <dd>{data.keyManagement.rotationPolicy}</dd>
-            </div>
-          </dl>
-
-          {!data.keyManagement.customerManaged && (
-            <Banner
-              tone="info"
-              className="portal-infra__banner"
-              title={t("portal.infrastructure.security.managedBanner.title")}
-              description={t(
-                "portal.infrastructure.security.managedBanner.description",
-              )}
-            />
-          )}
-        </Card>
-      </section>
-
-      <section>
-        <SectionHeader
-          title={t("portal.infrastructure.security.compliance.heading")}
-          sub={t("portal.infrastructure.security.compliance.subheading")}
-        />
-        <div className="portal-infra__certs">
-          {data.certs.map((c) => (
-            <Card key={c.id} padding="default" className="portal-infra__cert">
-              <div className="portal-infra__cert-head">
-                <span className="portal-infra__cell-strong">{c.name}</span>
-                <StatusBadge tone={CERT_TONE[c.status]} size="sm">
-                  {t(CERT_LABEL[c.status])}
-                </StatusBadge>
-              </div>
-              <p className="portal-infra__cert-detail">{c.detail}</p>
-            </Card>
-          ))}
-        </div>
-      </section>
-
-      <section>
-        <SectionHeader
-          title={t("portal.infrastructure.security.attestations.heading")}
-          sub={t("portal.infrastructure.security.attestations.subheading")}
-        />
-        <div className="portal-infra__attestations">
-          {data.attestations.map((a) => (
-            <Card
-              key={a.id}
-              padding="default"
-              className="portal-infra__attestation"
-            >
-              <div className="portal-infra__cert-head">
-                <span className="portal-infra__cell-strong">{a.name}</span>
-                <StatusBadge tone={ATTESTATION_TONE[a.status]} size="sm">
-                  {t(ATTESTATION_LABEL[a.status])}
-                </StatusBadge>
-              </div>
-              <Chip size="sm">{a.framework}</Chip>
-              <p className="portal-infra__cert-detail">{a.detail}</p>
-              {a.reportUrl ? (
-                <a
-                  className="portal-infra__attestation-link"
-                  href={a.reportUrl}
-                  // TODO(backend): GET /v1/infrastructure/security/reports/:id
-                  onClick={(e) => e.preventDefault()}
-                >
-                  {t("portal.infrastructure.security.attestations.viewReport")}
-                </a>
-              ) : (
-                <span className="portal-infra__muted">
-                  {t("portal.infrastructure.security.attestations.noReport")}
-                </span>
-              )}
-            </Card>
-          ))}
-        </div>
-      </section>
-
-      <section>
-        <SectionHeader
-          title={t("portal.infrastructure.security.ipAllowlist.heading")}
-          sub={
-            tier === "free"
-              ? t("portal.infrastructure.security.ipAllowlist.subLocked")
-              : t("portal.infrastructure.security.ipAllowlist.sub")
-          }
-        />
-        {tier === "free" ? (
-          <Banner
-            tone="info"
-            title={t(
-              "portal.infrastructure.security.ipAllowlist.lockedBanner.title",
-            )}
-            description={t(
-              "portal.infrastructure.security.ipAllowlist.lockedBanner.description",
-            )}
-          />
-        ) : (
-          <Card padding="none">
-            <Table
-              columns={ipCols}
-              rows={data.ipAllowlist}
-              rowKey={(e) => e.id}
-              empty={t("portal.infrastructure.security.ipAllowlist.empty")}
-            />
-          </Card>
-        )}
-      </section>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/infrastructure/StorageTab.stories.tsx b/frontend/editor/src/portal/components/infrastructure/StorageTab.stories.tsx
deleted file mode 100644
index 57bcdbff79..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/StorageTab.stories.tsx
+++ /dev/null
@@ -1,80 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { http, HttpResponse, delay } from "msw";
-import { StorageTab } from "@portal/components/infrastructure/StorageTab";
-import type { StorageConfig } from "@portal/api/infrastructure";
-import "@portal/views/Infrastructure.css";
-
-const meta: Meta<typeof StorageTab> = {
-  title: "Portal/Infrastructure/StorageTab",
-  component: StorageTab,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "72rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof StorageTab>;
-
-export const Default: Story = {};
-
-const OVER_CAP: StorageConfig = {
-  usedGb: 1920,
-  quotaGb: 2000,
-  retention: "180",
-  providers: [
-    {
-      id: "stirling",
-      name: "Stirling Cloud",
-      kind: "stirling",
-      connected: true,
-      detail: "Primary vault · us-east-1",
-      usedGb: 1532,
-    },
-    {
-      id: "s3",
-      name: "Amazon S3",
-      kind: "s3",
-      connected: true,
-      detail: "s3://acme-prod-archive · WORM",
-      usedGb: 388,
-    },
-    {
-      id: "azure",
-      name: "Azure Blob",
-      kind: "azure",
-      connected: false,
-      detail: "Not connected",
-      usedGb: 0,
-    },
-  ],
-};
-
-// Quota nearly exhausted — exercises the danger threshold on the usage bar.
-export const OverThreshold: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/infrastructure/storage", () =>
-          HttpResponse.json(OVER_CAP),
-        ),
-      ],
-    },
-  },
-};
-
-export const Loading: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/infrastructure/storage", async () => {
-          await delay("infinite");
-          return HttpResponse.json(null);
-        }),
-      ],
-    },
-  },
-};
diff --git a/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx b/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
deleted file mode 100644
index 49033345e1..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
+++ /dev/null
@@ -1,244 +0,0 @@
-import { useState, type ComponentType, type CSSProperties } from "react";
-import { useTranslation } from "react-i18next";
-import ArrowForwardRounded from "@mui/icons-material/ArrowForwardRounded";
-import CloudRounded from "@mui/icons-material/CloudRounded";
-import StorageRounded from "@mui/icons-material/StorageRounded";
-import {
-  Button,
-  Card,
-  EmptyState,
-  FormField,
-  ProgressBar,
-  Select,
-  Skeleton,
-  StatusBadge,
-} from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import {
-  fetchStorage,
-  type RetentionWindow,
-  type StorageConfig,
-} from "@portal/api/infrastructure";
-import { SectionHeader } from "@portal/components/infrastructure/SectionHeader";
-import { pct } from "@portal/components/infrastructure/infraFormat";
-
-const PROVIDER_ICON: Record<
-  StorageConfig["providers"][number]["kind"],
-  ComponentType<{ style?: CSSProperties }>
-> = {
-  stirling: StorageRounded,
-  s3: CloudRounded,
-  azure: CloudRounded,
-};
-
-/** Storage fills past this fraction of quota are surfaced in red. */
-const USAGE_DANGER_FRAC = 0.8;
-
-export function StorageTab() {
-  const { t } = useTranslation();
-  const { tier } = useTier();
-  const state = useAsync<StorageConfig>(() => fetchStorage(tier), [tier]);
-  const { data } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
-
-  const RETENTION_OPTS = [
-    {
-      value: "30",
-      label: t("portal.infrastructure.storage.retentionOption.days", {
-        count: 30,
-      }),
-    },
-    {
-      value: "60",
-      label: t("portal.infrastructure.storage.retentionOption.days", {
-        count: 60,
-      }),
-    },
-    {
-      value: "90",
-      label: t("portal.infrastructure.storage.retentionOption.days", {
-        count: 90,
-      }),
-    },
-    {
-      value: "180",
-      label: t("portal.infrastructure.storage.retentionOption.days", {
-        count: 180,
-      }),
-    },
-    {
-      value: "never",
-      label: t("portal.infrastructure.storage.retentionOption.never"),
-    },
-  ];
-
-  // TODO(backend): PATCH /v1/infrastructure/storage { retention }
-  const [retention, setRetention] = useState<RetentionWindow | null>(null);
-  const retentionValue = retention ?? data?.retention ?? "90";
-
-  if (isLoading) {
-    return (
-      <div className="portal-infra__stack" aria-hidden>
-        <Skeleton height="6rem" />
-        <Skeleton height="9rem" />
-      </div>
-    );
-  }
-
-  if (isEmpty || !data) {
-    return (
-      <EmptyState
-        size="compact"
-        title={t("portal.infrastructure.storage.empty.title")}
-        description={t("portal.infrastructure.storage.empty.description")}
-      />
-    );
-  }
-
-  const usedFrac = data.quotaGb > 0 ? data.usedGb / data.quotaGb : 0;
-  const overThreshold = usedFrac > USAGE_DANGER_FRAC;
-
-  return (
-    <div className="portal-infra__stack">
-      <section>
-        <SectionHeader
-          title={t("portal.infrastructure.storage.totalUsage.heading")}
-          sub={t("portal.infrastructure.storage.totalUsage.subheading")}
-        />
-        <Card padding="loose">
-          <div className="portal-infra__usage-head">
-            <span className="portal-infra__usage-value">
-              {t("portal.infrastructure.storage.gbValue", {
-                value: data.usedGb.toLocaleString(),
-              })}
-              <span className="portal-infra__muted">
-                {" "}
-                /{" "}
-                {t("portal.infrastructure.storage.gbValue", {
-                  value: data.quotaGb.toLocaleString(),
-                })}
-              </span>
-            </span>
-            <StatusBadge tone={overThreshold ? "danger" : "success"} size="sm">
-              {t("portal.infrastructure.storage.percentUsed", {
-                value: pct(usedFrac),
-              })}
-            </StatusBadge>
-          </div>
-          <ProgressBar
-            value={usedFrac}
-            height={10}
-            color={
-              overThreshold
-                ? "linear-gradient(90deg, var(--color-red), color-mix(in srgb, var(--color-red) 70%, white))"
-                : "linear-gradient(90deg, var(--color-green), color-mix(in srgb, var(--color-green) 70%, white))"
-            }
-            label={t("portal.infrastructure.storage.totalUsage.progressLabel")}
-          />
-        </Card>
-      </section>
-
-      <section className="portal-infra__split">
-        <Card padding="loose">
-          <SectionHeader
-            title={t("portal.infrastructure.storage.providers.heading")}
-            sub={t("portal.infrastructure.storage.providers.subheading")}
-          />
-          <ul className="portal-infra__providers">
-            {data.providers.map((p) => {
-              const ProviderIcon = PROVIDER_ICON[p.kind];
-              return (
-                <li key={p.id} className="portal-infra__provider">
-                  <span className="portal-infra__provider-glyph" aria-hidden>
-                    <ProviderIcon style={{ fontSize: "1.2rem" }} />
-                  </span>
-                  <span className="portal-infra__provider-text">
-                    <span className="portal-infra__cell-strong">{p.name}</span>
-                    <span className="portal-infra__muted">{p.detail}</span>
-                  </span>
-                  {p.connected ? (
-                    <span className="portal-infra__provider-meta">
-                      <span className="portal-infra__mono">
-                        {t("portal.infrastructure.storage.gbValue", {
-                          value: p.usedGb,
-                        })}
-                      </span>
-                      <StatusBadge tone="success" size="sm">
-                        {t("portal.infrastructure.storage.providers.connected")}
-                      </StatusBadge>
-                    </span>
-                  ) : (
-                    // TODO(backend): launch the provider OAuth/credential flow,
-                    // then POST /v1/infrastructure/storage/providers/{id}/connect
-                    <Button variant="secondary" size="sm">
-                      {t("portal.infrastructure.storage.providers.connect")}
-                    </Button>
-                  )}
-                </li>
-              );
-            })}
-          </ul>
-        </Card>
-
-        <Card padding="loose">
-          <SectionHeader
-            title={t("portal.infrastructure.storage.retention.heading")}
-            sub={t("portal.infrastructure.storage.retention.subheading")}
-          />
-          <FormField
-            label={t("portal.infrastructure.storage.retention.windowLabel")}
-          >
-            <Select
-              options={RETENTION_OPTS}
-              value={retentionValue}
-              onChange={(value) =>
-                setRetention((value ?? "") as RetentionWindow)
-              }
-            />
-          </FormField>
-
-          <div className="portal-infra__lifecycle">
-            <div className="portal-infra__lifecycle-stage is-active">
-              <span className="portal-infra__lifecycle-dot" />
-              <span className="portal-infra__lifecycle-label">
-                {t("portal.infrastructure.storage.lifecycle.active")}
-              </span>
-              <span className="portal-infra__muted">
-                {t("portal.infrastructure.storage.lifecycle.activeRange", {
-                  value: retentionValue === "never" ? "∞" : retentionValue,
-                })}
-              </span>
-            </div>
-            <span className="portal-infra__lifecycle-arrow" aria-hidden>
-              <ArrowForwardRounded style={{ fontSize: "1.2rem" }} />
-            </span>
-            <div className="portal-infra__lifecycle-stage">
-              <span className="portal-infra__lifecycle-dot" />
-              <span className="portal-infra__lifecycle-label">
-                {t("portal.infrastructure.storage.lifecycle.archived")}
-              </span>
-              <span className="portal-infra__muted">
-                {t("portal.infrastructure.storage.lifecycle.coldStorage")}
-              </span>
-            </div>
-            <span className="portal-infra__lifecycle-arrow" aria-hidden>
-              <ArrowForwardRounded style={{ fontSize: "1.2rem" }} />
-            </span>
-            <div className="portal-infra__lifecycle-stage">
-              <span className="portal-infra__lifecycle-dot" />
-              <span className="portal-infra__lifecycle-label">
-                {t("portal.infrastructure.storage.lifecycle.deleted")}
-              </span>
-              <span className="portal-infra__muted">
-                {retentionValue === "never"
-                  ? t("portal.infrastructure.storage.lifecycle.never")
-                  : t("portal.infrastructure.storage.lifecycle.purged")}
-              </span>
-            </div>
-          </div>
-        </Card>
-      </section>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/infrastructure/TableSkeleton.stories.tsx b/frontend/editor/src/portal/components/infrastructure/TableSkeleton.stories.tsx
deleted file mode 100644
index 6fb71e69d6..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/TableSkeleton.stories.tsx
+++ /dev/null
@@ -1,23 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { Card } from "@app/ui";
-import { TableSkeleton } from "@portal/components/infrastructure/TableSkeleton";
-import "@portal/views/Infrastructure.css";
-
-const meta: Meta<typeof TableSkeleton> = {
-  title: "Portal/Infrastructure/TableSkeleton",
-  component: TableSkeleton,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <Card padding="none" style={{ maxWidth: "60rem" }}>
-        <S />
-      </Card>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof TableSkeleton>;
-
-export const Regions: Story = { args: { rows: 3, cols: 9 } };
-
-export const AuditLog: Story = { args: { rows: 6, cols: 6 } };
diff --git a/frontend/editor/src/portal/components/infrastructure/TableSkeleton.tsx b/frontend/editor/src/portal/components/infrastructure/TableSkeleton.tsx
deleted file mode 100644
index 6673733adc..0000000000
--- a/frontend/editor/src/portal/components/infrastructure/TableSkeleton.tsx
+++ /dev/null
@@ -1,16 +0,0 @@
-import { Skeleton } from "@app/ui";
-
-/** Placeholder grid shown inside a table card while rows are loading. */
-export function TableSkeleton({ rows, cols }: { rows: number; cols: number }) {
-  return (
-    <div className="portal-infra__table-skel" aria-hidden>
-      {Array.from({ length: rows }).map((_, r) => (
-        <div key={r} className="portal-infra__table-skel-row">
-          {Array.from({ length: cols }).map((_, c) => (
-            <Skeleton key={c} height="0.75rem" />
-          ))}
-        </div>
-      ))}
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/infrastructure/infraFormat.ts b/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
index 6e4cf31a77..ba92032fea 100644
--- a/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
+++ b/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
@@ -1,105 +1,21 @@
-import type { TFunction } from "i18next";
-import type { ChipAccent, StatusTone } from "@app/ui";
+import type { StatusTone } from "@app/ui";
 import type {
   ApiKeyStatus,
-  AttestationStatus,
   AuditCategory,
   AuditStatus,
-  CertStatus,
-  DeploymentStatus,
-  KeyMode,
-  ModelCostUnit,
-  ModelProvider,
-  ModelStatus,
-  ModelType,
-  RegionStatus,
 } from "@portal/api/infrastructure";
 
-/** Format a 0–1 fraction as a percentage string. */
-export function pct(n: number, digits = 0): string {
-  return `${(n * 100).toFixed(digits)}%`;
-}
-
-/** Capitalise the first letter of a lower-case status word. */
-export function titleCase(word: string): string {
-  return word[0].toUpperCase() + word.slice(1);
-}
-
-export const REGION_TONE: Record<RegionStatus, StatusTone> = {
-  healthy: "success",
-  degraded: "warning",
-  down: "danger",
-};
-
-// Label maps hold i18n keys, resolved via t(MAP[value]) at the render sites.
-export const REGION_LABEL: Record<RegionStatus, string> = {
-  healthy: "portal.infrastructure.regionLabel.healthy",
-  degraded: "portal.infrastructure.regionLabel.degraded",
-  down: "portal.infrastructure.regionLabel.down",
-};
-
-export const DEPLOY_TONE: Record<DeploymentStatus, StatusTone> = {
-  live: "success",
-  rolling: "info",
-  "rolled-back": "warning",
-  queued: "neutral",
-};
-
-export const DEPLOY_LABEL: Record<DeploymentStatus, string> = {
-  live: "portal.infrastructure.deployLabel.live",
-  rolling: "portal.infrastructure.deployLabel.rolling",
-  "rolled-back": "portal.infrastructure.deployLabel.rolledBack",
-  queued: "portal.infrastructure.deployLabel.queued",
-};
-
 export const KEY_TONE: Record<ApiKeyStatus, StatusTone> = {
   active: "success",
   revoked: "danger",
 };
 
+// Label maps hold i18n keys, resolved via t(MAP[value]) at the render sites.
 export const KEY_LABEL: Record<ApiKeyStatus, string> = {
   active: "portal.infrastructure.keyLabel.active",
   revoked: "portal.infrastructure.keyLabel.revoked",
 };
 
-export const CERT_TONE: Record<CertStatus, StatusTone> = {
-  certified: "success",
-  "in-progress": "warning",
-  "not-started": "neutral",
-};
-
-export const CERT_LABEL: Record<CertStatus, string> = {
-  certified: "portal.infrastructure.certLabel.certified",
-  "in-progress": "portal.infrastructure.certLabel.inProgress",
-  "not-started": "portal.infrastructure.certLabel.notStarted",
-};
-
-// Brand/acronym key-management modes are not localised.
-export const KEY_MODE_LABEL: Record<KeyMode, string> = {
-  managed: "Stirling-managed",
-  byok: "BYOK",
-  hyok: "HYOK",
-};
-
-export const KEY_MODE_TONE: Record<KeyMode, StatusTone> = {
-  managed: "info",
-  byok: "purple",
-  // HYOK is the strongest posture (Stirling never sees plaintext) → success.
-  hyok: "success",
-};
-
-export const ATTESTATION_LABEL: Record<AttestationStatus, string> = {
-  attested: "portal.infrastructure.attestationLabel.attested",
-  "in-scope": "portal.infrastructure.attestationLabel.inScope",
-  "not-applicable": "portal.infrastructure.attestationLabel.notApplicable",
-};
-
-export const ATTESTATION_TONE: Record<AttestationStatus, StatusTone> = {
-  attested: "success",
-  "in-scope": "warning",
-  "not-applicable": "neutral",
-};
-
 export const AUDIT_TONE: Record<AuditStatus, StatusTone> = {
   success: "success",
   warning: "warning",
@@ -123,59 +39,3 @@ export const AUDIT_CAT_LABEL: Record<AuditCategory, string> = {
   processing: "portal.infrastructure.auditCatLabel.processing",
   security: "portal.infrastructure.auditCatLabel.security",
 };
-
-export const AUDIT_CAT_TONE: Record<AuditCategory, StatusTone> = {
-  auth: "info",
-  config: "neutral",
-  elevation: "purple",
-  policy: "purple",
-  processing: "success",
-  security: "warning",
-};
-
-export const MODEL_TONE: Record<ModelStatus, StatusTone> = {
-  active: "success",
-  degraded: "warning",
-  disabled: "neutral",
-};
-
-export const MODEL_LABEL: Record<ModelStatus, string> = {
-  active: "portal.infrastructure.modelLabel.active",
-  degraded: "portal.infrastructure.modelLabel.degraded",
-  disabled: "portal.infrastructure.modelLabel.disabled",
-};
-
-export const MODEL_TYPE_LABEL: Record<ModelType, string> = {
-  extraction: "portal.infrastructure.modelTypeLabel.extraction",
-  classification: "portal.infrastructure.modelTypeLabel.classification",
-  ocr: "portal.infrastructure.modelTypeLabel.ocr",
-  llm: "portal.infrastructure.modelTypeLabel.llm",
-};
-
-export const MODEL_TYPE_TONE: Record<ModelType, ChipAccent> = {
-  extraction: "default",
-  classification: "premium",
-  ocr: "success",
-  llm: "warning",
-};
-
-// Provider names are proper nouns, not localised.
-export const MODEL_PROVIDER_LABEL: Record<ModelProvider, string> = {
-  stirling: "Stirling",
-  openai: "OpenAI",
-  anthropic: "Anthropic",
-  "on-prem": "On-prem",
-};
-
-/** Render a model's cost with the unit it's billed against. */
-export function modelCost(
-  t: TFunction,
-  cost: number,
-  unit: ModelCostUnit,
-): string {
-  if (cost === 0) return t("portal.infrastructure.models.metrics.included");
-  const price = `$${cost.toFixed(unit === "per-call" ? 3 : 2)}`;
-  return unit === "per-call"
-    ? t("portal.infrastructure.models.cost.perCall", { price })
-    : t("portal.infrastructure.models.cost.perThousand", { price });
-}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineBlockerTooltip.css b/frontend/editor/src/portal/components/pipelines/PipelineBlockerTooltip.css
new file mode 100644
index 0000000000..c0779b9aeb
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineBlockerTooltip.css
@@ -0,0 +1,22 @@
+/**
+ * The "why is this disabled" list, inside a save/create button's tooltip. Left-aligned (a bulleted
+ * list reads oddly centred) and inheriting the tooltip's own colours.
+ */
+
+.portal-pipeline-blockers {
+  text-align: left;
+}
+
+.portal-pipeline-blockers__heading {
+  margin: 0 0 0.25rem;
+  font-weight: 600;
+}
+
+.portal-pipeline-blockers ul {
+  margin: 0;
+  padding-left: 1.1rem;
+}
+
+.portal-pipeline-blockers li {
+  margin: 0.125rem 0;
+}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineBlockerTooltip.tsx b/frontend/editor/src/portal/components/pipelines/PipelineBlockerTooltip.tsx
new file mode 100644
index 0000000000..adba6ecd26
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineBlockerTooltip.tsx
@@ -0,0 +1,48 @@
+import type { ReactElement } from "react";
+import { Tooltip } from "@mantine/core";
+import "@portal/components/pipelines/PipelineBlockerTooltip.css";
+
+export interface PipelineBlockerTooltipProps {
+  /** Short line above the list, e.g. "To create this pipeline:" / "To save your changes:". */
+  heading: string;
+  /** Everything still owed before the action is possible; empty means the action is allowed. */
+  blockers: string[];
+  /** The disabled control (wrapped so its hover still reaches the tooltip - see below). */
+  children: ReactElement;
+}
+
+/**
+ * Explains why a disabled save/create control can't be used yet, by listing what is still owed.
+ *
+ * A disabled button swallows its own pointer events, so the caller must pass a NON-disabled wrapper
+ * (a span/div around the button) as the child - that wrapper is what the pointer lands on. The
+ * tooltip hides itself when there is nothing to list (the action is allowed, or it is only
+ * mid-save), so callers can wire it unconditionally.
+ */
+export function PipelineBlockerTooltip({
+  heading,
+  blockers,
+  children,
+}: PipelineBlockerTooltipProps) {
+  return (
+    <Tooltip
+      label={
+        <div className="portal-pipeline-blockers">
+          <p className="portal-pipeline-blockers__heading">{heading}</p>
+          <ul>
+            {blockers.map((blocker) => (
+              <li key={blocker}>{blocker}</li>
+            ))}
+          </ul>
+        </div>
+      }
+      disabled={blockers.length === 0}
+      position="bottom-end"
+      withinPortal
+      multiline
+      w={280}
+    >
+      {children}
+    </Tooltip>
+  );
+}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.css b/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.css
new file mode 100644
index 0000000000..d3e5e4827c
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.css
@@ -0,0 +1,47 @@
+/**
+ * Create mode's toolbar: name on the left, commit actions on the right - the same shape as the edit
+ * header, so the two modes feel like one page.
+ */
+
+.portal-pipeline-create-header {
+  display: flex;
+  align-items: center;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+
+/* Sized to a name, not the width of the page: a title-length field reads as a title, where the old
+   full-bleed input read as a search bar. It gives a little on narrow viewports but never grows to
+   fill the row - the actions on the right anchor the far end instead. */
+.portal-pipeline-create-header__name {
+  flex: 0 1 22rem;
+  min-width: 12rem;
+}
+
+.portal-pipeline-create-header__name input {
+  font-size: 1rem;
+  font-weight: 500;
+}
+
+/* Pinned to the right, mirroring the edit header. Buttons hold their width and the row wraps rather
+   than clipping. */
+.portal-pipeline-create-header__actions {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  margin-left: auto;
+  flex: none;
+}
+
+/* The create buttons hold their width, so their labels never squash. */
+.portal-pipeline-create-header .sui-btn {
+  flex: none;
+  white-space: nowrap;
+}
+
+/* The two create buttons share one tooltip target, so they sit in their own inline group. */
+.portal-pipeline-create-header__create {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
+}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.stories.tsx b/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.stories.tsx
new file mode 100644
index 0000000000..b9717c0848
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.stories.tsx
@@ -0,0 +1,52 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PipelineCreateHeader } from "@portal/components/pipelines/PipelineCreateHeader";
+
+const meta: Meta<typeof PipelineCreateHeader> = {
+  title: "Portal/Pipelines/PipelineCreateHeader",
+  component: PipelineCreateHeader,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof PipelineCreateHeader>;
+
+const noop = () => {};
+
+/**
+ * The name is live, so the toolbar can be seen as it is filled in. Until it is named (a stand-in for
+ * the app's full validity check) the create buttons are disabled and carry a tooltip of what's owed.
+ */
+function Playground({ initialName }: { initialName: string }) {
+  const [name, setName] = useState(initialName);
+  const blockers =
+    name.trim() === ""
+      ? [
+          "Give the pipeline a name",
+          "Choose an input source",
+          "Choose a destination",
+        ]
+      : [];
+  return (
+    <PipelineCreateHeader
+      name={name}
+      onNameChange={setName}
+      canSave={blockers.length === 0}
+      blockers={blockers}
+      saving={false}
+      pendingCreateEnabled={null}
+      onCreate={noop}
+      onCreatePaused={noop}
+      onBack={noop}
+    />
+  );
+}
+
+/** A new pipeline: create is disabled, and hovering it lists what's still needed. */
+export const New: Story = {
+  render: () => <Playground initialName="" />,
+};
+
+/** Named: the create actions become available. */
+export const Named: Story = {
+  render: () => <Playground initialName="Claims redaction" />,
+};
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.test.tsx b/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.test.tsx
new file mode 100644
index 0000000000..c2f1826136
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.test.tsx
@@ -0,0 +1,86 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+} from "@testing-library/react";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
+import {
+  PipelineCreateHeader,
+  type PipelineCreateHeaderProps,
+} from "@portal/components/pipelines/PipelineCreateHeader";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: PortalTestProviders });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({ t: (key: string) => key }),
+}));
+
+function renderHeader(overrides: Partial<PipelineCreateHeaderProps> = {}) {
+  const handlers = {
+    onNameChange: vi.fn(),
+    onCreate: vi.fn(),
+    onCreatePaused: vi.fn(),
+    onBack: vi.fn(),
+  };
+  render(
+    <PipelineCreateHeader
+      name="Claims redaction"
+      canSave
+      blockers={[]}
+      saving={false}
+      pendingCreateEnabled={null}
+      {...handlers}
+      {...overrides}
+    />,
+  );
+  return handlers;
+}
+
+describe("PipelineCreateHeader", () => {
+  it("edits the pipeline's name", () => {
+    const handlers = renderHeader();
+    fireEvent.change(
+      screen.getByRole("textbox", { name: "portal.pipelines.composer.name" }),
+      { target: { value: "Renamed" } },
+    );
+    expect(handlers.onNameChange).toHaveBeenCalledWith("Renamed");
+  });
+
+  it("creates the pipeline, live or paused, and backs out", () => {
+    const handlers = renderHeader();
+    fireEvent.click(screen.getByText("portal.pipelines.composer.create"));
+    expect(handlers.onCreate).toHaveBeenCalled();
+    fireEvent.click(screen.getByText("portal.pipelines.composer.createPaused"));
+    expect(handlers.onCreatePaused).toHaveBeenCalled();
+    fireEvent.click(screen.getByLabelText("portal.pipelines.builder.back"));
+    expect(handlers.onBack).toHaveBeenCalled();
+  });
+
+  it("blocks both create actions until the pipeline is valid", () => {
+    renderHeader({ canSave: false, blockers: ["Choose a destination"] });
+    expect(
+      screen.getByText("portal.pipelines.composer.create").closest("button"),
+    ).toBeDisabled();
+    expect(
+      screen
+        .getByText("portal.pipelines.composer.createPaused")
+        .closest("button"),
+    ).toBeDisabled();
+  });
+
+  it("explains, on hover, why the create buttons are disabled", async () => {
+    renderHeader({
+      canSave: false,
+      blockers: ["Give the pipeline a name", "Choose a destination"],
+    });
+    const group = document.querySelector(
+      ".portal-pipeline-create-header__create",
+    ) as HTMLElement;
+    fireEvent.pointerEnter(group);
+    fireEvent.mouseEnter(group);
+    expect(await screen.findByText("Choose a destination")).toBeInTheDocument();
+    expect(screen.getByText("Give the pipeline a name")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.tsx b/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.tsx
new file mode 100644
index 0000000000..b4e3fa7951
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineCreateHeader.tsx
@@ -0,0 +1,90 @@
+import { useTranslation } from "react-i18next";
+import ArrowBackRoundedIcon from "@mui/icons-material/ArrowBackRounded";
+import { ActionIcon, Button, Input } from "@app/ui";
+import { PipelineBlockerTooltip } from "@portal/components/pipelines/PipelineBlockerTooltip";
+import "@portal/components/pipelines/PipelineCreateHeader.css";
+
+export interface PipelineCreateHeaderProps {
+  name: string;
+  onNameChange: (name: string) => void;
+
+  canSave: boolean;
+  /** Everything still owed before the pipeline can be created, shown on the disabled create button. */
+  blockers: string[];
+  saving: boolean;
+  /** Which create action is mid-save, so only the button that was clicked shows its spinner. */
+  pendingCreateEnabled: boolean | null;
+  onCreate: () => void;
+  onCreatePaused: () => void;
+  onBack: () => void;
+}
+
+/**
+ * The create-mode toolbar. Mirrors the edit header's shape - a back arrow and the name on the left,
+ * actions on the right - so the two modes read as the same page in two states rather than two
+ * different screens. The right commits the pipeline live or paused; while it can't yet, the disabled
+ * create buttons carry a tooltip listing exactly what is still owed, so "disabled" is never a dead end.
+ */
+export function PipelineCreateHeader({
+  name,
+  onNameChange,
+  canSave,
+  blockers,
+  saving,
+  pendingCreateEnabled,
+  onCreate,
+  onCreatePaused,
+  onBack,
+}: PipelineCreateHeaderProps) {
+  const { t } = useTranslation();
+
+  return (
+    <section className="portal-pipeline-create-header">
+      <ActionIcon
+        variant="quiet"
+        size="sm"
+        onClick={onBack}
+        aria-label={t("portal.pipelines.builder.back")}
+      >
+        <ArrowBackRoundedIcon style={{ fontSize: "1.25rem" }} />
+      </ActionIcon>
+
+      <Input
+        className="portal-pipeline-create-header__name"
+        value={name}
+        placeholder={t("portal.pipelines.composer.namePlaceholder")}
+        aria-label={t("portal.pipelines.composer.name")}
+        onChange={(e) => onNameChange(e.target.value)}
+      />
+
+      <div className="portal-pipeline-create-header__actions">
+        {/* The pair share one tooltip target because a disabled button swallows its own hover - the
+            wrapper is what the pointer lands on. */}
+        <PipelineBlockerTooltip
+          heading={t("portal.pipelines.builder.blocker.heading")}
+          blockers={blockers}
+        >
+          <div className="portal-pipeline-create-header__create">
+            <Button
+              variant="secondary"
+              size="sm"
+              loading={saving && pendingCreateEnabled === false}
+              disabled={!canSave}
+              onClick={onCreatePaused}
+            >
+              {t("portal.pipelines.composer.createPaused")}
+            </Button>
+            <Button
+              size="sm"
+              loading={saving && pendingCreateEnabled === true}
+              disabled={!canSave}
+              onClick={onCreate}
+            >
+              {t("portal.pipelines.composer.create")}
+            </Button>
+          </div>
+        </PipelineBlockerTooltip>
+      </div>
+    </section>
+  );
+}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.css b/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.css
new file mode 100644
index 0000000000..a83d3ff6ae
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.css
@@ -0,0 +1,67 @@
+/**
+ * Edit mode's toolbar: identity on the left, operational actions on the right.
+ */
+
+.portal-pipeline-edit-header {
+  display: flex;
+  align-items: center;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+
+.portal-pipeline-edit-header__identity {
+  display: flex;
+  align-items: center;
+  gap: 0.375rem;
+  min-width: 0;
+  flex: 1 1 16rem;
+}
+
+/* The name is the page's title. It takes the room the identity row leaves and truncates rather than
+   wrapping, so a long name never pushes the pencil out of reach. */
+.portal-pipeline-edit-header__title {
+  margin: 0;
+  font-size: 1.125rem;
+  font-weight: 600;
+  color: var(--c-text);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  min-width: 0;
+}
+
+.portal-pipeline-edit-header__name-input {
+  flex: 1 1 16rem;
+  min-width: 12rem;
+}
+
+.portal-pipeline-edit-header__name-input input {
+  font-size: 1.125rem;
+  font-weight: 600;
+}
+
+/* Never let the labels squash: buttons hold their width and the row wraps instead of clipping. */
+.portal-pipeline-edit-header__actions {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex: none;
+}
+
+.portal-pipeline-edit-header__actions .sui-btn {
+  flex: none;
+  white-space: nowrap;
+}
+
+/* Save is wrapped so its disabled hover reaches the blocker tooltip; the wrapper must not shrink. */
+.portal-pipeline-edit-header__save {
+  display: inline-flex;
+  flex: none;
+}
+
+/* Destructive item in the overflow tray: red label and icon, so it reads as the exception among
+   the neutral entries above it. */
+.portal-pipeline-edit-header__delete-item .sui-dd__item-label,
+.portal-pipeline-edit-header__delete-item .sui-dd__item-leading {
+  color: var(--c-danger);
+}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.stories.tsx b/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.stories.tsx
new file mode 100644
index 0000000000..538024e933
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.stories.tsx
@@ -0,0 +1,71 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PipelineEditHeader } from "@portal/components/pipelines/PipelineEditHeader";
+
+const meta: Meta<typeof PipelineEditHeader> = {
+  title: "Portal/Pipelines/PipelineEditHeader",
+  component: PipelineEditHeader,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof PipelineEditHeader>;
+
+const noop = () => {};
+
+/** The name and the pause/activate state are live, so both can be exercised. */
+function Playground({
+  initialName,
+  initialEnabled = true,
+  canSave = true,
+  blockers = [],
+}: {
+  initialName: string;
+  initialEnabled?: boolean;
+  canSave?: boolean;
+  blockers?: string[];
+}) {
+  const [name, setName] = useState(initialName);
+  const [enabled, setEnabled] = useState(initialEnabled);
+  return (
+    <PipelineEditHeader
+      name={name}
+      onNameChange={setName}
+      enabled={enabled}
+      onTogglePause={() => setEnabled((e) => !e)}
+      togglingEnabled={false}
+      onBack={noop}
+      canSave={canSave}
+      blockers={blockers}
+      saving={false}
+      onSave={noop}
+      onRun={noop}
+      running={false}
+      onReprocess={noop}
+      reprocessing={false}
+      onDelete={noop}
+    />
+  );
+}
+
+/** A live pipeline: the toggle offers to pause it. */
+export const Active: Story = {
+  render: () => <Playground initialName="Claims redaction" />,
+};
+
+/** A paused pipeline: the toggle offers to activate it. */
+export const Paused: Story = {
+  render: () => (
+    <Playground initialName="Claims redaction" initialEnabled={false} />
+  ),
+};
+
+/** Edits that cannot yet be saved: Save is disabled and hovering it lists what's still needed. */
+export const CannotSave: Story = {
+  render: () => (
+    <Playground
+      initialName="Claims redaction"
+      canSave={false}
+      blockers={["Choose a destination", "Finish setting up: Redact"]}
+    />
+  ),
+};
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.test.tsx b/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.test.tsx
new file mode 100644
index 0000000000..e216dbb292
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.test.tsx
@@ -0,0 +1,156 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+} from "@testing-library/react";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
+import {
+  PipelineEditHeader,
+  type PipelineEditHeaderProps,
+} from "@portal/components/pipelines/PipelineEditHeader";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: PortalTestProviders });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({ t: (key: string) => key }),
+}));
+
+function renderHeader(overrides: Partial<PipelineEditHeaderProps> = {}) {
+  const handlers = {
+    onNameChange: vi.fn(),
+    onTogglePause: vi.fn(),
+    onBack: vi.fn(),
+    onSave: vi.fn(),
+    onRun: vi.fn(),
+    onReprocess: vi.fn(),
+    onDelete: vi.fn(),
+  };
+  render(
+    <PipelineEditHeader
+      name="Claims redaction"
+      enabled
+      togglingEnabled={false}
+      canSave
+      blockers={[]}
+      saving={false}
+      running={false}
+      reprocessing={false}
+      {...handlers}
+      {...overrides}
+    />,
+  );
+  return handlers;
+}
+
+describe("PipelineEditHeader", () => {
+  it("shows the name as the title and renames it in place", () => {
+    const handlers = renderHeader();
+    expect(screen.getByText("Claims redaction")).toBeInTheDocument();
+
+    fireEvent.click(screen.getByLabelText("portal.pipelines.builder.rename"));
+    const input = screen.getByRole("textbox", {
+      name: "portal.pipelines.composer.name",
+    });
+    fireEvent.change(input, { target: { value: "Renamed" } });
+    fireEvent.keyDown(input, { key: "Enter" });
+    expect(handlers.onNameChange).toHaveBeenCalledWith("Renamed");
+  });
+
+  it("abandons a rename on Escape, keeping the old name", () => {
+    const handlers = renderHeader();
+    fireEvent.click(screen.getByLabelText("portal.pipelines.builder.rename"));
+    const input = screen.getByRole("textbox", {
+      name: "portal.pipelines.composer.name",
+    });
+    fireEvent.change(input, { target: { value: "Discarded" } });
+    fireEvent.keyDown(input, { key: "Escape" });
+    // Escape must not commit, even via the blur that unmounting the field fires in a real browser.
+    fireEvent.blur(input);
+    expect(handlers.onNameChange).not.toHaveBeenCalled();
+    expect(screen.getByText("Claims redaction")).toBeInTheDocument();
+  });
+
+  it("commits a rename when focus leaves the field", () => {
+    const handlers = renderHeader();
+    fireEvent.click(screen.getByLabelText("portal.pipelines.builder.rename"));
+    const input = screen.getByRole("textbox", {
+      name: "portal.pipelines.composer.name",
+    });
+    fireEvent.change(input, { target: { value: "Renamed" } });
+    fireEvent.blur(input);
+    expect(handlers.onNameChange).toHaveBeenCalledWith("Renamed");
+  });
+
+  it("offers to pause a live pipeline and to activate a paused one", () => {
+    const handlers = renderHeader();
+    fireEvent.click(screen.getByText("portal.pipelines.builder.pause"));
+    expect(handlers.onTogglePause).toHaveBeenCalled();
+
+    renderHeader({ enabled: false });
+    expect(
+      screen.getByText("portal.pipelines.builder.activate"),
+    ).toBeInTheDocument();
+  });
+
+  it("runs the saved pipeline from the row", () => {
+    const handlers = renderHeader();
+    fireEvent.click(screen.getByText("portal.pipelines.detail.run"));
+    expect(handlers.onRun).toHaveBeenCalled();
+  });
+
+  it("keeps clear-history and delete behind the overflow tray", () => {
+    const handlers = renderHeader();
+    // Not in the row itself...
+    expect(
+      screen.queryByText("portal.pipelines.detail.clearHistory"),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText("portal.pipelines.detail.delete"),
+    ).not.toBeInTheDocument();
+
+    fireEvent.click(
+      screen.getByLabelText("portal.pipelines.builder.moreActions"),
+    );
+    fireEvent.click(screen.getByText("portal.pipelines.detail.clearHistory"));
+    expect(handlers.onReprocess).toHaveBeenCalled();
+
+    fireEvent.click(
+      screen.getByLabelText("portal.pipelines.builder.moreActions"),
+    );
+    fireEvent.click(screen.getByText("portal.pipelines.detail.delete"));
+    expect(handlers.onDelete).toHaveBeenCalled();
+  });
+
+  it("blocks saving until the edits are valid", () => {
+    renderHeader({ canSave: false });
+    expect(
+      screen.getByText("portal.pipelines.composer.save").closest("button"),
+    ).toBeDisabled();
+  });
+
+  it("cannot pause while a save is committing", () => {
+    renderHeader({ saving: true });
+    expect(
+      screen.getByText("portal.pipelines.builder.pause").closest("button"),
+    ).toBeDisabled();
+  });
+
+  it("cannot save while a pause is committing", () => {
+    renderHeader({ togglingEnabled: true });
+    expect(
+      screen.getByText("portal.pipelines.composer.save").closest("button"),
+    ).toBeDisabled();
+  });
+
+  it("explains, on hover, why Save is disabled", async () => {
+    renderHeader({ canSave: false, blockers: ["Choose a destination"] });
+    const save = document.querySelector(
+      ".portal-pipeline-edit-header__save",
+    ) as HTMLElement;
+    fireEvent.pointerEnter(save);
+    fireEvent.mouseEnter(save);
+    expect(await screen.findByText("Choose a destination")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.tsx b/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.tsx
new file mode 100644
index 0000000000..7ee2fbd173
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineEditHeader.tsx
@@ -0,0 +1,235 @@
+import { useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import ArrowBackRoundedIcon from "@mui/icons-material/ArrowBackRounded";
+import EditOutlinedIcon from "@mui/icons-material/EditOutlined";
+import PlayArrowRoundedIcon from "@mui/icons-material/PlayArrowRounded";
+import PauseRoundedIcon from "@mui/icons-material/PauseRounded";
+import PowerSettingsNewRoundedIcon from "@mui/icons-material/PowerSettingsNewRounded";
+import ReplayRoundedIcon from "@mui/icons-material/ReplayRounded";
+import DeleteOutlineRoundedIcon from "@mui/icons-material/DeleteOutlineRounded";
+import MoreHorizRoundedIcon from "@mui/icons-material/MoreHorizRounded";
+import { ActionIcon, Button, Dropdown, Input } from "@app/ui";
+import { PipelineBlockerTooltip } from "@portal/components/pipelines/PipelineBlockerTooltip";
+import "@portal/components/pipelines/PipelineEditHeader.css";
+
+export interface PipelineEditHeaderProps {
+  name: string;
+  onNameChange: (name: string) => void;
+
+  /** The pipeline's live state. Toggling it takes effect immediately, not on save. */
+  enabled: boolean;
+  onTogglePause: () => void;
+  togglingEnabled: boolean;
+
+  onBack: () => void;
+
+  canSave: boolean;
+  /** Everything still owed before the edits can be saved, shown on the disabled Save button. */
+  blockers: string[];
+  saving: boolean;
+  onSave: () => void;
+
+  /** Run the saved pipeline against its real input, delivering to its real destination. */
+  onRun: () => void;
+  running: boolean;
+  /** Reprocess everything in the sources: clears the processed record, then runs at once. */
+  onReprocess: () => void;
+  reprocessing: boolean;
+  onDelete: () => void;
+}
+
+/**
+ * Edit mode's toolbar over an existing, live pipeline. The left is what it *is* - a back arrow, its
+ * name as the page title, a pencil to rename in place. The right is what you can *do to it*: pause
+ * or activate it (an operational toggle that acts at once, matching the Policies vocabulary), run it
+ * now, and - behind an overflow, since they are rare or destructive - reprocess its sources or delete
+ * it. Saving the chain edits is the primary action, on the far right. (Reading the definition is an
+ * inspect action, so it lives in the graph toolbar beside Test, not here.)
+ */
+export function PipelineEditHeader({
+  name,
+  onNameChange,
+  enabled,
+  onTogglePause,
+  togglingEnabled,
+  onBack,
+  canSave,
+  blockers,
+  saving,
+  onSave,
+  onRun,
+  running,
+  onReprocess,
+  reprocessing,
+  onDelete,
+}: PipelineEditHeaderProps) {
+  const { t } = useTranslation();
+  const [renaming, setRenaming] = useState(false);
+  const [draft, setDraft] = useState(name);
+  const inputRef = useRef<HTMLInputElement>(null);
+  // Enter and Escape both end the rename, which unmounts the input - and unmounting a focused input
+  // fires blur in a real browser (jsdom does not). Without this guard that blur would re-run the
+  // commit, so Escape would save the very draft it was meant to discard. The key handler sets this so
+  // the trailing blur is ignored; a plain click-away leaves it false and blur commits as normal.
+  const keyHandledRef = useRef(false);
+
+  useEffect(() => {
+    if (renaming) inputRef.current?.select();
+  }, [renaming]);
+
+  function startRename() {
+    keyHandledRef.current = false;
+    setDraft(name);
+    setRenaming(true);
+  }
+
+  // End the rename, committing the draft only when asked and only if non-empty (an all-whitespace
+  // rename would leave the pipeline titleless).
+  function finishRename(commit: boolean) {
+    keyHandledRef.current = true;
+    if (commit) {
+      const next = draft.trim();
+      if (next) onNameChange(next);
+    }
+    setRenaming(false);
+  }
+
+  // Clicking away commits; the unmount-triggered blur that follows a key press does not (the key
+  // already decided the outcome).
+  function handleBlur() {
+    if (keyHandledRef.current) {
+      keyHandledRef.current = false;
+      return;
+    }
+    finishRename(true);
+  }
+
+  return (
+    <section className="portal-pipeline-edit-header">
+      <div className="portal-pipeline-edit-header__identity">
+        <ActionIcon
+          variant="quiet"
+          size="sm"
+          onClick={onBack}
+          aria-label={t("portal.pipelines.builder.back")}
+        >
+          <ArrowBackRoundedIcon style={{ fontSize: "1.25rem" }} />
+        </ActionIcon>
+
+        {renaming ? (
+          <Input
+            ref={inputRef}
+            className="portal-pipeline-edit-header__name-input"
+            value={draft}
+            aria-label={t("portal.pipelines.composer.name")}
+            onChange={(e) => setDraft(e.target.value)}
+            onBlur={handleBlur}
+            onKeyDown={(e) => {
+              if (e.key === "Enter") finishRename(true);
+              if (e.key === "Escape") finishRename(false);
+            }}
+          />
+        ) : (
+          <>
+            <h1 className="portal-pipeline-edit-header__title">{name}</h1>
+            <ActionIcon
+              variant="quiet"
+              size="sm"
+              onClick={startRename}
+              aria-label={t("portal.pipelines.builder.rename")}
+            >
+              <EditOutlinedIcon style={{ fontSize: "1rem" }} />
+            </ActionIcon>
+          </>
+        )}
+      </div>
+
+      <div className="portal-pipeline-edit-header__actions">
+        {/* Pause and Save both write the whole policy, so they are mutually exclusive: neither can
+            start while the other is committing, or the two writes race and the loser's version wins. */}
+        <Button
+          variant="secondary"
+          size="sm"
+          loading={togglingEnabled}
+          disabled={saving}
+          onClick={onTogglePause}
+          leftSection={
+            enabled ? (
+              <PauseRoundedIcon style={{ fontSize: "1.125rem" }} />
+            ) : (
+              <PowerSettingsNewRoundedIcon style={{ fontSize: "1.125rem" }} />
+            )
+          }
+        >
+          {enabled
+            ? t("portal.pipelines.builder.pause")
+            : t("portal.pipelines.builder.activate")}
+        </Button>
+
+        {/* Run and Reprocess both start a run, so only one at a time: each is disabled while the
+            other is in flight, matching the handler guards (a click otherwise silently no-ops). */}
+        <Button
+          variant="secondary"
+          size="sm"
+          loading={running}
+          disabled={reprocessing}
+          onClick={onRun}
+          leftSection={
+            <PlayArrowRoundedIcon style={{ fontSize: "1.125rem" }} />
+          }
+        >
+          {t("portal.pipelines.detail.run")}
+        </Button>
+
+        {/* Rare and destructive actions kept off the row so they do not compete with running. */}
+        <Dropdown.Root align="end">
+          <Dropdown.Trigger>
+            <ActionIcon
+              variant="tertiary"
+              size="sm"
+              aria-label={t("portal.pipelines.builder.moreActions")}
+            >
+              <MoreHorizRoundedIcon style={{ fontSize: "1.125rem" }} />
+            </ActionIcon>
+          </Dropdown.Trigger>
+          <Dropdown.Menu>
+            <Dropdown.Item
+              onSelect={onReprocess}
+              disabled={reprocessing || running}
+              leading={<ReplayRoundedIcon style={{ fontSize: "1.125rem" }} />}
+            >
+              {t("portal.pipelines.detail.clearHistory")}
+            </Dropdown.Item>
+            <Dropdown.Divider />
+            <Dropdown.Item
+              onSelect={onDelete}
+              className="portal-pipeline-edit-header__delete-item"
+              leading={
+                <DeleteOutlineRoundedIcon style={{ fontSize: "1.125rem" }} />
+              }
+            >
+              {t("portal.pipelines.detail.delete")}
+            </Dropdown.Item>
+          </Dropdown.Menu>
+        </Dropdown.Root>
+
+        {/* Wrapped in a span so the disabled button's hover still reaches the tooltip. */}
+        <PipelineBlockerTooltip
+          heading={t("portal.pipelines.builder.blocker.saveHeading")}
+          blockers={blockers}
+        >
+          <span className="portal-pipeline-edit-header__save">
+            <Button
+              size="sm"
+              onClick={onSave}
+              loading={saving}
+              disabled={!canSave || togglingEnabled}
+            >
+              {t("portal.pipelines.composer.save")}
+            </Button>
+          </span>
+        </PipelineBlockerTooltip>
+      </div>
+    </section>
+  );
+}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.css b/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.css
new file mode 100644
index 0000000000..9dc2d53bec
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.css
@@ -0,0 +1,48 @@
+/**
+ * The test control and the last run's outcome, directly above the graph.
+ */
+
+.portal-pipeline-toolbar {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+
+/* Reading the definition sits at the far end of the bar, opposite Test. */
+.portal-pipeline-toolbar__definition {
+  margin-left: auto;
+}
+
+/* The last test run's outcome, beside the button that started it. Whole-pipeline, because the
+   backend reports one flat file list plus the step it stopped at - nothing per node to attach. */
+.portal-pipeline-toolbar__result {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+}
+
+.portal-pipeline-toolbar__result-status {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.8125rem;
+  color: var(--c-text);
+}
+
+.portal-pipeline-toolbar__result-icon.is-ok {
+  color: var(--c-success);
+}
+
+.portal-pipeline-toolbar__result-icon.is-bad {
+  color: var(--c-danger);
+}
+
+/* Why the run failed, shown inline in the strip. Neutral text (the icon already carries the tone);
+   it may wrap to keep a long backend message readable rather than clipping it. */
+.portal-pipeline-toolbar__result-error {
+  font-size: 0.8125rem;
+  color: var(--c-text-muted);
+  min-width: 0;
+}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.stories.tsx b/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.stories.tsx
new file mode 100644
index 0000000000..359aa9bfa1
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.stories.tsx
@@ -0,0 +1,54 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PipelineGraphToolbar } from "@portal/components/pipelines/PipelineGraphToolbar";
+
+const meta: Meta<typeof PipelineGraphToolbar> = {
+  title: "Portal/Pipelines/PipelineGraphToolbar",
+  component: PipelineGraphToolbar,
+  parameters: { layout: "padded" },
+  args: {
+    stepCount: 2,
+    testing: false,
+    runResult: null,
+    onTest: () => {},
+    onDownloadOutput: () => {},
+    onViewDefinition: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof PipelineGraphToolbar>;
+
+/** Idle: just the test control. */
+export const Idle: Story = {};
+
+/** A chain with no steps cannot be tested. */
+export const NoSteps: Story = { args: { stepCount: 0 } };
+
+/** Mid test-run. */
+export const Testing: Story = { args: { testing: true } };
+
+/** After a completed run: the outcome and its files sit beside the button. */
+export const Completed: Story = {
+  args: {
+    runResult: {
+      status: "completed",
+      completedSteps: 3,
+      stepCount: 3,
+      outputs: [
+        { fileId: "f1", fileName: "claim-redacted.pdf" },
+        { fileId: "f2", fileName: null },
+      ],
+    },
+  },
+};
+
+/** A failed run: the summary and the failure reason. */
+export const Failed: Story = {
+  args: {
+    runResult: {
+      status: "failed",
+      completedSteps: 1,
+      stepCount: 3,
+      error: "OCR failed: unreadable page",
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.test.tsx b/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.test.tsx
new file mode 100644
index 0000000000..4aafb27766
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.test.tsx
@@ -0,0 +1,103 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+} from "@testing-library/react";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
+import {
+  PipelineGraphToolbar,
+  type PipelineGraphToolbarProps,
+} from "@portal/components/pipelines/PipelineGraphToolbar";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: PortalTestProviders });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({ t: (key: string) => key }),
+}));
+
+function renderToolbar(overrides: Partial<PipelineGraphToolbarProps> = {}) {
+  const handlers = {
+    onTest: vi.fn(),
+    onDownloadOutput: vi.fn(),
+    onViewDefinition: vi.fn(),
+  };
+  render(
+    <PipelineGraphToolbar
+      stepCount={2}
+      testing={false}
+      runResult={null}
+      {...handlers}
+      {...overrides}
+    />,
+  );
+  return handlers;
+}
+
+describe("PipelineGraphToolbar", () => {
+  it("hands the chosen file to the test run", () => {
+    const handlers = renderToolbar();
+    const file = new File(["x"], "claim.pdf", { type: "application/pdf" });
+    const input =
+      document.querySelector<HTMLInputElement>('input[type="file"]');
+    expect(input).not.toBeNull();
+    fireEvent.change(input as HTMLInputElement, { target: { files: [file] } });
+    expect(handlers.onTest).toHaveBeenCalledWith(file);
+  });
+
+  it("will not offer a test run on a chain with no steps", () => {
+    renderToolbar({ stepCount: 0 });
+    expect(
+      screen.getByText("portal.pipelines.builder.testRun").closest("button"),
+    ).toBeDisabled();
+  });
+
+  it("opens the definition from its icon", () => {
+    const handlers = renderToolbar();
+    fireEvent.click(
+      screen.getByLabelText("portal.pipelines.builder.viewDefinition"),
+    );
+    expect(handlers.onViewDefinition).toHaveBeenCalled();
+  });
+
+  it("shows no result strip until a test has been run", () => {
+    renderToolbar();
+    expect(
+      screen.queryByText(/portal.pipelines.inspector.status/),
+    ).not.toBeInTheDocument();
+  });
+
+  it("shows why a test run failed, not only that it did", () => {
+    renderToolbar({
+      runResult: {
+        status: "failed",
+        completedSteps: 1,
+        stepCount: 3,
+        error: "OCR failed: unreadable page",
+      },
+    });
+    expect(screen.getByText("OCR failed: unreadable page")).toBeInTheDocument();
+  });
+
+  it("reports a finished run and downloads the file clicked", () => {
+    const handlers = renderToolbar({
+      runResult: {
+        status: "completed",
+        completedSteps: 2,
+        stepCount: 2,
+        outputs: [
+          { fileId: "f1", fileName: "claim.pdf" },
+          { fileId: "f2", fileName: null },
+        ],
+      },
+    });
+    fireEvent.click(screen.getByText("claim.pdf"));
+    expect(handlers.onDownloadOutput).toHaveBeenCalledWith({
+      fileId: "f1",
+      fileName: "claim.pdf",
+    });
+    // A file the backend did not name still has to be reachable.
+    expect(screen.getByText("f2")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.tsx b/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.tsx
new file mode 100644
index 0000000000..30513f6a83
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineGraphToolbar.tsx
@@ -0,0 +1,147 @@
+import { useTranslation } from "react-i18next";
+import { Tooltip } from "@mantine/core";
+import ScienceOutlinedIcon from "@mui/icons-material/ScienceOutlined";
+import CheckCircleOutlineRoundedIcon from "@mui/icons-material/CheckCircleOutlineRounded";
+import DownloadRoundedIcon from "@mui/icons-material/DownloadRounded";
+import ErrorOutlineRoundedIcon from "@mui/icons-material/ErrorOutlineRounded";
+import CodeRoundedIcon from "@mui/icons-material/CodeRounded";
+import { ActionIcon, Button, FilePicker, Spinner } from "@app/ui";
+import { type RunOutputFile } from "@portal/api/pipelines";
+import "@portal/components/pipelines/PipelineGraphToolbar.css";
+
+/**
+ * A test run's outcome. Whole-pipeline, not per-node: the backend reports one flat list of files
+ * plus the step it stopped at, so there is no per-node output to attach to a node.
+ */
+export interface RunResultSummary {
+  status: "running" | "completed" | "failed";
+  completedSteps: number;
+  stepCount: number;
+  error?: string | null;
+  outputs?: RunOutputFile[];
+}
+
+export interface PipelineGraphToolbarProps {
+  /** How many steps the chain has, so an empty pipeline cannot offer a test that does nothing. */
+  stepCount: number;
+  /** Run the steps as they stand against one uploaded file, without saving or delivering. */
+  onTest: (file: File) => void;
+  testing: boolean;
+  /** The last test run in this session, or null if there has not been one. */
+  runResult: RunResultSummary | null;
+  onDownloadOutput: (output: RunOutputFile) => void;
+  /** Opens the definition (JSON + cURL) - an inspect action, sibling to Test, hence its home here. */
+  onViewDefinition: () => void;
+}
+
+/**
+ * The graph's own toolbar, above the canvas in both create and edit. It gathers the two ways to
+ * *inspect* what you are building - testing the chain against one file, and reading its definition -
+ * as opposed to committing (Save/Create) or operating on the live pipeline (Run now). A test run's
+ * progress shows on the graph's nodes, so the strip that summarises it belongs next to the graph too.
+ */
+export function PipelineGraphToolbar({
+  stepCount,
+  onTest,
+  testing,
+  runResult,
+  onDownloadOutput,
+  onViewDefinition,
+}: PipelineGraphToolbarProps) {
+  const { t } = useTranslation();
+
+  return (
+    <div className="portal-pipeline-toolbar">
+      <FilePicker
+        variant="secondary"
+        size="sm"
+        accept="application/pdf"
+        loading={testing}
+        // A chain with no steps would hand the file straight back, reading as a silent no-op.
+        disabled={stepCount === 0}
+        onChange={(file) => file && onTest(file)}
+        leftSection={<ScienceOutlinedIcon style={{ fontSize: "1.125rem" }} />}
+      >
+        {t("portal.pipelines.builder.testRun")}
+      </FilePicker>
+
+      {runResult && (
+        <RunResultStrip result={runResult} onDownload={onDownloadOutput} />
+      )}
+
+      {/* The graph is the visual definition; reading it as JSON/cURL sits at the far end of its bar. */}
+      <Tooltip
+        label={t("portal.pipelines.builder.viewDefinition")}
+        position="bottom"
+        withinPortal
+      >
+        <ActionIcon
+          variant="tertiary"
+          size="sm"
+          className="portal-pipeline-toolbar__definition"
+          onClick={onViewDefinition}
+          aria-label={t("portal.pipelines.builder.viewDefinition")}
+        >
+          <CodeRoundedIcon style={{ fontSize: "1.125rem" }} />
+        </ActionIcon>
+      </Tooltip>
+    </div>
+  );
+}
+
+interface RunResultStripProps {
+  result: RunResultSummary;
+  onDownload: (output: RunOutputFile) => void;
+}
+
+/** What the last test run did, beside the button that started it. */
+function RunResultStrip({ result, onDownload }: RunResultStripProps) {
+  const { t } = useTranslation();
+  const outputs = result.outputs ?? [];
+
+  return (
+    <div className="portal-pipeline-toolbar__result">
+      <div className="portal-pipeline-toolbar__result-status">
+        {result.status === "running" && <Spinner size="sm" />}
+        {result.status === "completed" && (
+          <CheckCircleOutlineRoundedIcon
+            className="portal-pipeline-toolbar__result-icon is-ok"
+            style={{ fontSize: "1.25rem" }}
+          />
+        )}
+        {result.status === "failed" && (
+          <ErrorOutlineRoundedIcon
+            className="portal-pipeline-toolbar__result-icon is-bad"
+            style={{ fontSize: "1.25rem" }}
+          />
+        )}
+        <span>
+          {t(`portal.pipelines.inspector.status.${result.status}`, {
+            done: result.completedSteps,
+            count: result.stepCount,
+          })}
+        </span>
+      </div>
+
+      {/* The reason it failed, where the failure is announced - not only on the node, which the user
+          has to know to click. */}
+      {result.status === "failed" && result.error && (
+        <span className="portal-pipeline-toolbar__result-error">
+          {result.error}
+        </span>
+      )}
+
+      {outputs.map((output) => (
+        <Button
+          key={output.fileId}
+          variant="tertiary"
+          size="sm"
+          onClick={() => onDownload(output)}
+          leftSection={<DownloadRoundedIcon style={{ fontSize: "1.125rem" }} />}
+        >
+          {output.fileName ?? output.fileId}
+        </Button>
+      ))}
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineHeader.css b/frontend/editor/src/portal/components/pipelines/PipelineHeader.css
deleted file mode 100644
index f559e42795..0000000000
--- a/frontend/editor/src/portal/components/pipelines/PipelineHeader.css
+++ /dev/null
@@ -1,133 +0,0 @@
-/**
- * The builder's opening section: identity above the rule, actions below it.
- */
-
-.portal-pipeline-header {
-  display: flex;
-  flex-direction: column;
-  gap: 0.875rem;
-  padding: 1.125rem;
-  background: var(--c-surface);
-  border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-lg);
-}
-
-/* Leaving the page and saving it are the same kind of decision, so they share a row - and the back
-   link is short, so the save pair always has room beside it. */
-.portal-pipeline-header__top {
-  display: flex;
-  align-items: center;
-  gap: 1rem;
-  flex-wrap: wrap;
-}
-
-/* The back link is the shared Button restyled to a plain link, so re-assert that over the
-   design-system base (which imposes a fixed height, its own padding and an accent colour). */
-.portal-pipeline-header__back.sui-btn {
-  height: auto;
-  min-height: 0;
-  padding: 0;
-  font-size: 0.8125rem;
-  font-weight: 400;
-  color: var(--c-text-muted);
-}
-
-.portal-pipeline-header__back.sui-btn:hover {
-  background: none;
-  color: var(--c-text);
-}
-
-.portal-pipeline-header__identity {
-  display: flex;
-  align-items: center;
-  gap: 1.25rem;
-  flex-wrap: wrap;
-}
-
-/* The shared Checkbox aligns its box to the top of the first text line, with a nudge tuned for its
-   own font size - that is for the label-plus-description case. This one is a single line, so centre
-   the box on it and leave the component's sizing alone (overriding the font size shifts the line
-   box and leaves the tick floating high). */
-.portal-pipeline-header__enabled.sui-check {
-  flex: none;
-  align-items: center;
-}
-
-.portal-pipeline-header__enabled.sui-check .sui-check__box {
-  margin-top: 0;
-}
-
-/* The name is the page's title, so it takes the room and reads at title size. */
-.portal-pipeline-header__name {
-  flex: 1 1 16rem;
-  min-width: 12rem;
-}
-
-.portal-pipeline-header__name input {
-  font-size: 1rem;
-  font-weight: 500;
-}
-
-/* Never let the labels squash: buttons hold their width and the row wraps instead of clipping. */
-.portal-pipeline-header__save {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  margin-left: auto;
-  flex: none;
-}
-
-.portal-pipeline-header__save .sui-btn {
-  flex: none;
-  white-space: nowrap;
-}
-
-/* Operational actions: what you can do to this pipeline, kept off the identity row. */
-.portal-pipeline-header__actions {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  flex-wrap: wrap;
-  padding-top: 0.875rem;
-  border-top: 1px solid var(--c-border-subtle);
-}
-
-/* Destructive, so it sits away from the rest rather than next in line. */
-.portal-pipeline-header__delete.sui-btn {
-  margin-left: auto;
-}
-
-/* The last test run's outcome, beside the button that started it. Whole-pipeline, because the
-   backend reports one flat file list plus the step it stopped at - nothing per node to attach. */
-.portal-pipeline-header__result {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  flex-wrap: wrap;
-  padding-top: 0.875rem;
-  border-top: 1px solid var(--c-border-subtle);
-}
-
-.portal-pipeline-header__result-status {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  font-size: 0.8125rem;
-  color: var(--c-text);
-}
-
-.portal-pipeline-header__result-icon.is-ok {
-  color: var(--c-success);
-}
-
-.portal-pipeline-header__result-icon.is-bad {
-  color: var(--c-danger);
-}
-
-/* Why the run failed, shown inline in the strip. Neutral text (the icon already carries the tone);
-   it may wrap to keep a long backend message readable rather than clipping it. */
-.portal-pipeline-header__result-error {
-  font-size: 0.8125rem;
-  color: var(--c-text-muted);
-  min-width: 0;
-}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineHeader.stories.tsx b/frontend/editor/src/portal/components/pipelines/PipelineHeader.stories.tsx
deleted file mode 100644
index 41c73a5ade..0000000000
--- a/frontend/editor/src/portal/components/pipelines/PipelineHeader.stories.tsx
+++ /dev/null
@@ -1,118 +0,0 @@
-import { useState } from "react";
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import {
-  PipelineHeader,
-  type RunResultSummary,
-} from "@portal/components/pipelines/PipelineHeader";
-
-const meta: Meta<typeof PipelineHeader> = {
-  title: "Portal/Pipelines/PipelineHeader",
-  component: PipelineHeader,
-  parameters: { layout: "padded" },
-};
-export default meta;
-type Story = StoryObj<typeof PipelineHeader>;
-
-const noop = () => {};
-
-/** The name and the enabled switch are live, so the section can be seen in both states. */
-function Playground({
-  initialName,
-  isEdit,
-  initialEnabled = true,
-  runResult = null,
-  ...rest
-}: {
-  initialName: string;
-  isEdit: boolean;
-  initialEnabled?: boolean;
-  runResult?: RunResultSummary | null;
-  saving?: boolean;
-  testing?: boolean;
-  running?: boolean;
-  canSave?: boolean;
-  stepCount?: number;
-}) {
-  const [name, setName] = useState(initialName);
-  const [enabled, setEnabled] = useState(initialEnabled);
-  return (
-    <PipelineHeader
-      name={name}
-      onNameChange={setName}
-      enabled={enabled}
-      onEnabledChange={setEnabled}
-      isEdit={isEdit}
-      stepCount={rest.stepCount ?? 2}
-      canSave={rest.canSave ?? true}
-      saving={rest.saving ?? false}
-      onSave={noop}
-      onCancel={noop}
-      onBack={noop}
-      onTest={noop}
-      testing={rest.testing ?? false}
-      onRun={noop}
-      running={rest.running ?? false}
-      onClearHistory={noop}
-      clearingHistory={false}
-      onDelete={noop}
-      onViewDefinition={noop}
-      runResult={runResult}
-      onDownloadOutput={noop}
-    />
-  );
-}
-
-/** An existing pipeline: everything is available. */
-export const Editing: Story = {
-  render: () => <Playground initialName="Claims redaction" isEdit />,
-};
-
-/**
- * A pipeline that has never been saved. It can still be tested against a file, but there is
- * nothing yet to run on a schedule, clear history for, or delete.
- */
-export const New: Story = {
-  render: () => <Playground initialName="" isEdit={false} canSave={false} />,
-};
-
-/** Paused: the pipeline exists but its trigger will not fire. */
-export const Paused: Story = {
-  render: () => (
-    <Playground initialName="Claims redaction" isEdit initialEnabled={false} />
-  ),
-};
-
-/** Mid test-run: the picker shows its own progress while the graph shows the steps. */
-export const Testing: Story = {
-  render: () => <Playground initialName="Claims redaction" isEdit testing />,
-};
-
-/** After a test run: the outcome and its files sit beside the button that started them. */
-export const WithRunResult: Story = {
-  render: () => (
-    <Playground
-      initialName="Claims redaction"
-      isEdit
-      runResult={{
-        status: "completed",
-        completedSteps: 3,
-        stepCount: 3,
-        outputs: [
-          { fileId: "f1", fileName: "claim-redacted.pdf" },
-          { fileId: "f2", fileName: null },
-        ],
-      }}
-    />
-  ),
-};
-
-/** A failed run: the summary is here, the failing step's own message is on its node. */
-export const WithFailedRun: Story = {
-  render: () => (
-    <Playground
-      initialName="Claims redaction"
-      isEdit
-      runResult={{ status: "failed", completedSteps: 1, stepCount: 3 }}
-    />
-  ),
-};
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineHeader.test.tsx b/frontend/editor/src/portal/components/pipelines/PipelineHeader.test.tsx
deleted file mode 100644
index 2c5552be07..0000000000
--- a/frontend/editor/src/portal/components/pipelines/PipelineHeader.test.tsx
+++ /dev/null
@@ -1,200 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import {
-  fireEvent,
-  render as baseRender,
-  screen,
-} from "@testing-library/react";
-import { PortalTestProviders } from "@portal/test/TestQueryProvider";
-import {
-  PipelineHeader,
-  type PipelineHeaderProps,
-} from "@portal/components/pipelines/PipelineHeader";
-
-const render = (ui: Parameters<typeof baseRender>[0]) =>
-  baseRender(ui, { wrapper: PortalTestProviders });
-
-vi.mock("react-i18next", () => ({
-  useTranslation: () => ({ t: (key: string) => key }),
-}));
-
-function renderHeader(overrides: Partial<PipelineHeaderProps> = {}) {
-  const handlers = {
-    onNameChange: vi.fn(),
-    onEnabledChange: vi.fn(),
-    onSave: vi.fn(),
-    onCancel: vi.fn(),
-    onBack: vi.fn(),
-    onTest: vi.fn(),
-    onRun: vi.fn(),
-    onClearHistory: vi.fn(),
-    onDelete: vi.fn(),
-    onViewDefinition: vi.fn(),
-    onDownloadOutput: vi.fn(),
-  };
-  render(
-    <PipelineHeader
-      name="Claims redaction"
-      enabled
-      isEdit
-      stepCount={2}
-      canSave
-      saving={false}
-      testing={false}
-      running={false}
-      clearingHistory={false}
-      runResult={null}
-      {...handlers}
-      {...overrides}
-    />,
-  );
-  return handlers;
-}
-
-describe("PipelineHeader", () => {
-  it("edits the pipeline's name and enabled state", () => {
-    const handlers = renderHeader();
-    fireEvent.change(
-      screen.getByRole("textbox", { name: "portal.pipelines.composer.name" }),
-      { target: { value: "Renamed" } },
-    );
-    expect(handlers.onNameChange).toHaveBeenCalledWith("Renamed");
-
-    fireEvent.click(screen.getByRole("checkbox"));
-    expect(handlers.onEnabledChange).toHaveBeenCalledWith(false);
-  });
-
-  it("offers run, clear history and delete only once the pipeline exists", () => {
-    renderHeader({ isEdit: false });
-    expect(
-      screen.queryByText("portal.pipelines.detail.run"),
-    ).not.toBeInTheDocument();
-    expect(
-      screen.queryByText("portal.pipelines.detail.delete"),
-    ).not.toBeInTheDocument();
-    // A test run needs no saved record, so it stays: it is how you check the steps as you build.
-    expect(
-      screen.getByText("portal.pipelines.builder.testRun"),
-    ).toBeInTheDocument();
-  });
-
-  it("labels the save action for what it will do", () => {
-    renderHeader({ isEdit: false });
-    expect(
-      screen.getByText("portal.pipelines.composer.create"),
-    ).toBeInTheDocument();
-    expect(
-      screen.queryByText("portal.pipelines.composer.save"),
-    ).not.toBeInTheDocument();
-  });
-
-  it("blocks saving until the pipeline is valid", () => {
-    renderHeader({ canSave: false });
-    expect(
-      screen.getByText("portal.pipelines.composer.save").closest("button"),
-    ).toBeDisabled();
-  });
-
-  it("hands the chosen file to the test run", () => {
-    const handlers = renderHeader();
-    const file = new File(["x"], "claim.pdf", { type: "application/pdf" });
-    const input =
-      document.querySelector<HTMLInputElement>('input[type="file"]');
-    expect(input).not.toBeNull();
-    fireEvent.change(input as HTMLInputElement, { target: { files: [file] } });
-    expect(handlers.onTest).toHaveBeenCalledWith(file);
-  });
-
-  it("will not offer a test run on a chain with no steps", () => {
-    renderHeader({ stepCount: 0 });
-    expect(
-      screen.getByText("portal.pipelines.builder.testRun").closest("button"),
-    ).toBeDisabled();
-  });
-
-  it("shows why a test run failed, not only that it did", () => {
-    renderHeader({
-      runResult: {
-        status: "failed",
-        completedSteps: 1,
-        stepCount: 3,
-        error: "OCR failed: unreadable page",
-      },
-    });
-    expect(screen.getByText("OCR failed: unreadable page")).toBeInTheDocument();
-  });
-
-  it("runs and deletes from the row, clears history from the tray", () => {
-    const handlers = renderHeader();
-    fireEvent.click(screen.getByText("portal.pipelines.detail.run"));
-    expect(handlers.onRun).toHaveBeenCalled();
-    fireEvent.click(screen.getByText("portal.pipelines.detail.delete"));
-    expect(handlers.onDelete).toHaveBeenCalled();
-
-    fireEvent.click(
-      screen.getByLabelText("portal.pipelines.builder.moreActions"),
-    );
-    fireEvent.click(screen.getByText("portal.pipelines.detail.clearHistory"));
-    expect(handlers.onClearHistory).toHaveBeenCalled();
-  });
-
-  it("leaves the page through cancel and back", () => {
-    const handlers = renderHeader();
-    fireEvent.click(screen.getByText("portal.pipelines.composer.cancel"));
-    expect(handlers.onCancel).toHaveBeenCalled();
-    fireEvent.click(screen.getByText("portal.pipelines.builder.back"));
-    expect(handlers.onBack).toHaveBeenCalled();
-  });
-
-  it("keeps the occasional actions out of the row, behind a tray", () => {
-    renderHeader();
-    // Running and testing earn a button each; reading the definition and wiping history do not.
-    expect(
-      screen.queryByText("portal.pipelines.builder.viewDefinition"),
-    ).not.toBeInTheDocument();
-    expect(
-      screen.queryByText("portal.pipelines.detail.clearHistory"),
-    ).not.toBeInTheDocument();
-    expect(
-      screen.getByLabelText("portal.pipelines.builder.moreActions"),
-    ).toBeInTheDocument();
-  });
-
-  it("opens the definition from the tray", () => {
-    const handlers = renderHeader();
-    fireEvent.click(
-      screen.getByLabelText("portal.pipelines.builder.moreActions"),
-    );
-    fireEvent.click(
-      screen.getByText("portal.pipelines.builder.viewDefinition"),
-    );
-    expect(handlers.onViewDefinition).toHaveBeenCalled();
-  });
-
-  it("shows no run strip until a test has been run", () => {
-    renderHeader();
-    expect(
-      screen.queryByText(/portal.pipelines.inspector.status/),
-    ).not.toBeInTheDocument();
-  });
-
-  it("reports a finished run and downloads the file clicked", () => {
-    const handlers = renderHeader({
-      runResult: {
-        status: "completed",
-        completedSteps: 2,
-        stepCount: 2,
-        outputs: [
-          { fileId: "f1", fileName: "claim.pdf" },
-          { fileId: "f2", fileName: null },
-        ],
-      },
-    });
-    fireEvent.click(screen.getByText("claim.pdf"));
-    expect(handlers.onDownloadOutput).toHaveBeenCalledWith({
-      fileId: "f1",
-      fileName: "claim.pdf",
-    });
-    // A file the backend did not name still has to be reachable.
-    expect(screen.getByText("f2")).toBeInTheDocument();
-  });
-});
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineHeader.tsx b/frontend/editor/src/portal/components/pipelines/PipelineHeader.tsx
deleted file mode 100644
index 25bfbd044f..0000000000
--- a/frontend/editor/src/portal/components/pipelines/PipelineHeader.tsx
+++ /dev/null
@@ -1,301 +0,0 @@
-import { useTranslation } from "react-i18next";
-import ArrowBackRoundedIcon from "@mui/icons-material/ArrowBackRounded";
-import DeleteOutlineRoundedIcon from "@mui/icons-material/DeleteOutlineRounded";
-import HistoryRoundedIcon from "@mui/icons-material/HistoryRounded";
-import PlayArrowRoundedIcon from "@mui/icons-material/PlayArrowRounded";
-import ScienceOutlinedIcon from "@mui/icons-material/ScienceOutlined";
-import CodeRoundedIcon from "@mui/icons-material/CodeRounded";
-import MoreHorizRoundedIcon from "@mui/icons-material/MoreHorizRounded";
-import CheckCircleOutlineRoundedIcon from "@mui/icons-material/CheckCircleOutlineRounded";
-import DownloadRoundedIcon from "@mui/icons-material/DownloadRounded";
-import ErrorOutlineRoundedIcon from "@mui/icons-material/ErrorOutlineRounded";
-import {
-  ActionIcon,
-  Button,
-  Checkbox,
-  Dropdown,
-  FilePicker,
-  Input,
-  Spinner,
-} from "@app/ui";
-import "@portal/components/pipelines/PipelineHeader.css";
-
-/** One file a test run produced, downloadable from the result strip. */
-export interface RunOutputFile {
-  fileId: string;
-  fileName: string | null;
-}
-
-/**
- * A test run's outcome. Whole-pipeline, not per-node: the backend reports one flat list of files
- * plus the step it stopped at, so there is no per-node output to attach to a node.
- */
-export interface RunResultSummary {
-  status: "running" | "completed" | "failed";
-  completedSteps: number;
-  stepCount: number;
-  error?: string | null;
-  outputs?: RunOutputFile[];
-}
-
-export interface PipelineHeaderProps {
-  name: string;
-  onNameChange: (name: string) => void;
-  enabled: boolean;
-  onEnabledChange: (enabled: boolean) => void;
-  /** False for a pipeline that has never been saved: it cannot yet be run, cleared or deleted. */
-  isEdit: boolean;
-  /** How many steps the chain has, so an empty pipeline cannot offer a test that does nothing. */
-  stepCount: number;
-
-  canSave: boolean;
-  saving: boolean;
-  onSave: () => void;
-  onCancel: () => void;
-  onBack: () => void;
-
-  /** Run the steps as they stand against one uploaded file, without saving or delivering. */
-  onTest: (file: File) => void;
-  testing: boolean;
-  /** Run the saved pipeline against its real input, delivering to its real destination. */
-  onRun: () => void;
-  running: boolean;
-  onClearHistory: () => void;
-  clearingHistory: boolean;
-  onDelete: () => void;
-
-  /** Opens the definition (JSON + cURL), which is pipeline-scoped like the rest of this row. */
-  onViewDefinition: () => void;
-  /** The last test run in this session, or null if there has not been one. */
-  runResult: RunResultSummary | null;
-  onDownloadOutput: (output: RunOutputFile) => void;
-}
-
-/**
- * The pipeline's identity and its whole-pipeline actions, at the top of the builder.
- *
- * Split in two so neither half gets lost in a single crowded row: what the pipeline *is* (name,
- * whether it is live) sits with the actions that leave the page, and what you can *do to it* sits
- * below the rule. A test run is part of building, so it lives here rather than off in a corner -
- * its progress shows on the graph's nodes and its results in the inspector.
- */
-export function PipelineHeader({
-  name,
-  onNameChange,
-  enabled,
-  onEnabledChange,
-  isEdit,
-  stepCount,
-  canSave,
-  saving,
-  onSave,
-  onCancel,
-  onBack,
-  onTest,
-  testing,
-  onRun,
-  running,
-  onClearHistory,
-  clearingHistory,
-  onDelete,
-  onViewDefinition,
-  runResult,
-  onDownloadOutput,
-}: PipelineHeaderProps) {
-  const { t } = useTranslation();
-
-  return (
-    <section className="portal-pipeline-header">
-      <div className="portal-pipeline-header__top">
-        <Button
-          variant="quiet"
-          size="sm"
-          className="portal-pipeline-header__back"
-          onClick={onBack}
-          leftSection={
-            <ArrowBackRoundedIcon style={{ fontSize: "1.125rem" }} />
-          }
-        >
-          {t("portal.pipelines.builder.back")}
-        </Button>
-        <div className="portal-pipeline-header__save">
-          <Button
-            variant="tertiary"
-            size="sm"
-            onClick={onCancel}
-            disabled={saving}
-          >
-            {t("portal.pipelines.composer.cancel")}
-          </Button>
-          <Button
-            size="sm"
-            onClick={onSave}
-            loading={saving}
-            disabled={!canSave}
-          >
-            {isEdit
-              ? t("portal.pipelines.composer.save")
-              : t("portal.pipelines.composer.create")}
-          </Button>
-        </div>
-      </div>
-
-      <div className="portal-pipeline-header__identity">
-        <Input
-          className="portal-pipeline-header__name"
-          value={name}
-          placeholder={t("portal.pipelines.composer.namePlaceholder")}
-          aria-label={t("portal.pipelines.composer.name")}
-          onChange={(e) => onNameChange(e.target.value)}
-        />
-        {/* A checkbox, not a switch: this is a form value that takes effect on save, and a switch
-            would imply it applies the moment it is flipped. No description - a second line beside
-            the single-line name field leaves the row ragged. */}
-        <Checkbox
-          className="portal-pipeline-header__enabled"
-          checked={enabled}
-          onChange={(e) => onEnabledChange(e.target.checked)}
-          label={t("portal.pipelines.builder.enabled")}
-        />
-      </div>
-
-      <div className="portal-pipeline-header__actions">
-        <FilePicker
-          variant="secondary"
-          size="sm"
-          accept="application/pdf"
-          loading={testing}
-          // A chain with no steps would hand the file straight back, reading as a silent no-op.
-          disabled={stepCount === 0}
-          onChange={(file) => file && onTest(file)}
-          leftSection={<ScienceOutlinedIcon style={{ fontSize: "1.125rem" }} />}
-        >
-          {t("portal.pipelines.builder.testRun")}
-        </FilePicker>
-
-        {isEdit && (
-          <Button
-            variant="secondary"
-            size="sm"
-            loading={running}
-            onClick={onRun}
-            leftSection={
-              <PlayArrowRoundedIcon style={{ fontSize: "1.125rem" }} />
-            }
-          >
-            {t("portal.pipelines.detail.run")}
-          </Button>
-        )}
-
-        {/* Occasional things - reading the definition, wiping the processed history - kept behind a
-            tray so they do not compete with running and testing, which is what this row is for. */}
-        <Dropdown.Root align="start">
-          <Dropdown.Trigger>
-            <ActionIcon
-              variant="secondary"
-              size="sm"
-              aria-label={t("portal.pipelines.builder.moreActions")}
-            >
-              <MoreHorizRoundedIcon style={{ fontSize: "1.125rem" }} />
-            </ActionIcon>
-          </Dropdown.Trigger>
-          <Dropdown.Menu>
-            <Dropdown.Item
-              onSelect={onViewDefinition}
-              leading={<CodeRoundedIcon style={{ fontSize: "1.125rem" }} />}
-            >
-              {t("portal.pipelines.builder.viewDefinition")}
-            </Dropdown.Item>
-            {isEdit && (
-              <Dropdown.Item
-                onSelect={onClearHistory}
-                disabled={clearingHistory}
-                leading={
-                  <HistoryRoundedIcon style={{ fontSize: "1.125rem" }} />
-                }
-              >
-                {t("portal.pipelines.detail.clearHistory")}
-              </Dropdown.Item>
-            )}
-          </Dropdown.Menu>
-        </Dropdown.Root>
-
-        {isEdit && (
-          <Button
-            variant="tertiary"
-            size="sm"
-            accent="danger"
-            className="portal-pipeline-header__delete"
-            onClick={onDelete}
-            leftSection={
-              <DeleteOutlineRoundedIcon style={{ fontSize: "1.125rem" }} />
-            }
-          >
-            {t("portal.pipelines.detail.delete")}
-          </Button>
-        )}
-      </div>
-
-      {runResult && (
-        <RunResultStrip result={runResult} onDownload={onDownloadOutput} />
-      )}
-    </section>
-  );
-}
-
-interface RunResultStripProps {
-  result: RunResultSummary;
-  onDownload: (output: RunOutputFile) => void;
-}
-
-/** What the last test run did, beside the button that started it. */
-function RunResultStrip({ result, onDownload }: RunResultStripProps) {
-  const { t } = useTranslation();
-  const outputs = result.outputs ?? [];
-
-  return (
-    <div className="portal-pipeline-header__result">
-      <div className="portal-pipeline-header__result-status">
-        {result.status === "running" && <Spinner size="sm" />}
-        {result.status === "completed" && (
-          <CheckCircleOutlineRoundedIcon
-            className="portal-pipeline-header__result-icon is-ok"
-            style={{ fontSize: "1.25rem" }}
-          />
-        )}
-        {result.status === "failed" && (
-          <ErrorOutlineRoundedIcon
-            className="portal-pipeline-header__result-icon is-bad"
-            style={{ fontSize: "1.25rem" }}
-          />
-        )}
-        <span>
-          {t(`portal.pipelines.inspector.status.${result.status}`, {
-            done: result.completedSteps,
-            count: result.stepCount,
-          })}
-        </span>
-      </div>
-
-      {/* The reason it failed, where the failure is announced - not only on the node, which the user
-          has to know to click. */}
-      {result.status === "failed" && result.error && (
-        <span className="portal-pipeline-header__result-error">
-          {result.error}
-        </span>
-      )}
-
-      {outputs.map((output) => (
-        <Button
-          key={output.fileId}
-          variant="tertiary"
-          size="sm"
-          onClick={() => onDownload(output)}
-          leftSection={<DownloadRoundedIcon style={{ fontSize: "1.125rem" }} />}
-        >
-          {output.fileName ?? output.fileId}
-        </Button>
-      ))}
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineInspector.css b/frontend/editor/src/portal/components/pipelines/PipelineInspector.css
index 0fc50597e8..b5aeaff6fc 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelineInspector.css
+++ b/frontend/editor/src/portal/components/pipelines/PipelineInspector.css
@@ -7,9 +7,6 @@
   flex-direction: column;
   gap: 0.875rem;
   padding: 1.125rem;
-  background: var(--c-surface);
-  border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-lg);
   /* The builder caps its columns so the page itself does not scroll, which means a settings form
      taller than the viewport has to scroll in here - otherwise its lower half is unreachable. */
   max-height: 100%;
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineInspector.tsx b/frontend/editor/src/portal/components/pipelines/PipelineInspector.tsx
index 49fccf7e9b..cac71b5790 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelineInspector.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelineInspector.tsx
@@ -2,6 +2,7 @@ import type { ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 import TuneRoundedIcon from "@mui/icons-material/TuneRounded";
 import { Banner, EmptyState } from "@app/ui";
+import "@portal/theme/surface.css";
 import "@portal/components/pipelines/PipelineInspector.css";
 
 export interface PipelineInspectorProps {
@@ -40,7 +41,7 @@ export function PipelineInspector({
 
   if (message) {
     return (
-      <aside className="portal-inspector">
+      <aside className="portal-surface portal-inspector">
         <EmptyState
           size="compact"
           title={message}
@@ -52,7 +53,7 @@ export function PipelineInspector({
 
   if (!children) {
     return (
-      <aside className="portal-inspector">
+      <aside className="portal-surface portal-inspector">
         <EmptyState
           size="compact"
           title={t("portal.pipelines.inspector.noSelectionTitle")}
@@ -63,7 +64,7 @@ export function PipelineInspector({
   }
 
   return (
-    <aside className="portal-inspector">
+    <aside className="portal-surface portal-inspector">
       {/* The title stays put while the settings scroll: it names the node being edited, which is
           what makes a long form legible. */}
       <div className="portal-inspector__title">
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.test.tsx b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.test.tsx
index 946e24b810..55a52b496e 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.test.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.test.tsx
@@ -1,10 +1,23 @@
 import { describe, expect, it, vi } from "vitest";
-import { useEffect, useState } from "react";
-import { render, screen } from "@testing-library/react";
+import {
+  Component,
+  Suspense,
+  useEffect,
+  useState,
+  type ComponentType,
+  type ReactNode,
+} from "react";
+import { render, renderHook, screen, waitFor } from "@testing-library/react";
 import { PortalTestProviders } from "@portal/test/TestQueryProvider";
+import { useTranslatedToolCatalog } from "@app/data/useTranslatedToolRegistry";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { SidebarProvider } from "@app/contexts/SidebarContext";
 import { Tooltip } from "@app/components/shared/Tooltip";
 import type { ToolRegistry } from "@app/data/toolsTaxonomy";
-import type { WorkingToolStep } from "@app/hooks/tools/shared/toolAutomation";
+import {
+  getExecutableTools,
+  type WorkingToolStep,
+} from "@app/hooks/tools/shared/toolAutomation";
 import {
   asRegistryConfig,
   type ErasedToolParams,
@@ -13,6 +26,10 @@ import {
 import ConvertSettings from "@app/components/tools/convert/ConvertSettings";
 import { convertOperationConfig } from "@app/hooks/tools/convert/useConvertOperation";
 import { defaultParameters as convertDefaults } from "@app/hooks/tools/convert/useConvertParameters";
+import ChangeMetadataSingleStep from "@app/components/tools/changeMetadata/ChangeMetadataSingleStep";
+import { defaultParameters as changeMetadataDefaults } from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
+import OverlayPdfsSettings from "@app/components/tools/overlayPdfs/OverlayPdfsSettings";
+import { defaultParameters as overlayDefaults } from "@app/hooks/tools/overlayPdfs/useOverlayPdfsParameters";
 import { PipelineStepSettings } from "@portal/components/pipelines/PipelineStepSettings";
 
 // Override only useTranslation; keep the rest of react-i18next (initReactI18next et al.) real, so
@@ -21,6 +38,7 @@ vi.mock("react-i18next", async (importOriginal) => ({
   ...(await importOriginal<typeof import("react-i18next")>()),
   useTranslation: () => ({
     t: (key: string, fallback?: string) => fallback ?? key,
+    i18n: { language: "en-US", changeLanguage: vi.fn() },
   }),
 }));
 
@@ -63,6 +81,32 @@ const convertRegistry = {
   },
 } as unknown as Partial<ToolRegistry>;
 
+// The real Change Metadata automation settings. Its editor variant auto-prefills the
+// form from the open document via useViewer; that path is now gated on a ViewerProvider
+// so it renders here (the portal mounts none) instead of crashing on useViewer.
+const changeMetadataStep = {
+  support: "editable",
+  toolId: "changeMetadata",
+  params: changeMetadataDefaults,
+} as unknown as WorkingToolStep;
+
+const changeMetadataRegistry = {
+  changeMetadata: { automationSettings: ChangeMetadataSingleStep },
+} as unknown as Partial<ToolRegistry>;
+
+// The real Overlay PDFs automation settings. Its overlay-file picker uses the
+// editor FilesModal when present; that read is now optional so the portal (which
+// mounts no FilesModalProvider) renders a plain file input instead of crashing.
+const overlayStep = {
+  support: "editable",
+  toolId: "overlayPdfs",
+  params: overlayDefaults,
+} as unknown as WorkingToolStep;
+
+const overlayRegistry = {
+  overlayPdfs: { automationSettings: OverlayPdfsSettings },
+} as unknown as Partial<ToolRegistry>;
+
 describe("PipelineStepSettings", () => {
   it("renders reused editor tool settings (which use the shared Tooltip) without app-wide Preferences/Sidebar providers", () => {
     expect(() =>
@@ -94,6 +138,36 @@ describe("PipelineStepSettings", () => {
     expect(screen.getByText(/Convert from/)).toBeInTheDocument();
   });
 
+  it("renders the Change Metadata tool's fields in the portal, with no ViewerProvider mounted", () => {
+    expect(() =>
+      render(
+        <PortalTestProviders>
+          <PipelineStepSettings
+            step={changeMetadataStep}
+            registry={changeMetadataRegistry}
+            onChange={() => {}}
+          />
+        </PortalTestProviders>,
+      ),
+    ).not.toThrow();
+    expect(screen.getByText("Standard Metadata")).toBeInTheDocument();
+  });
+
+  it("renders the Overlay PDFs tool's fields in the portal, with no FilesModalProvider mounted", () => {
+    expect(() =>
+      render(
+        <PortalTestProviders>
+          <PipelineStepSettings
+            step={overlayStep}
+            registry={overlayRegistry}
+            onChange={() => {}}
+          />
+        </PortalTestProviders>,
+      ),
+    ).not.toThrow();
+    expect(screen.getByText("Overlay Mode")).toBeInTheDocument();
+  });
+
   // Reproduces the convert-in-pipeline bug: picking a source format fires several onParameterChange
   // calls in one tick (set fromExtension, auto-target, reset options). If each rebuilt from the
   // step snapshot captured at render they'd clobber each other and the earlier field would be lost.
@@ -148,3 +222,91 @@ describe("PipelineStepSettings", () => {
     });
   });
 });
+
+// Records a render crash and swallows it (renders nothing), so one broken tool is attributed by id
+// instead of aborting the whole sweep - mirroring the portal's own ErrorBoundary around the builder.
+class CaptureBoundary extends Component<
+  { onError: (error: Error) => void; children: ReactNode },
+  { failed: boolean }
+> {
+  state = { failed: false };
+  static getDerivedStateFromError() {
+    return { failed: true };
+  }
+  componentDidCatch(error: Error) {
+    this.props.onError(error);
+  }
+  render() {
+    return this.state.failed ? null : this.props.children;
+  }
+}
+
+// Automated version of the manual "add every tool" sweep: render each tool's real automation
+// settings in a portal-only context (the same Preferences + Sidebar + Suspense wrappers
+// PipelineStepSettings uses, and NO editor providers) and fail listing any that throw. This is the
+// guard that would have caught Change Metadata (useViewer) and Overlay PDFs (useFilesModalContext).
+describe("PipelineStepSettings: every tool's settings render in the portal", () => {
+  it("renders each tool's automation settings without throwing", async () => {
+    const { result } = renderHook(() => useTranslatedToolCatalog());
+    const catalog = result.current.allTools;
+    // getExecutableTools is exactly what PipelineBuilder feeds its "Add a tool" picker, so this
+    // sweeps precisely the tools a user can add. Narrow to "editable" (renders a settings
+    // component); "noSettings"/"unsupported" steps show a Banner instead and can't crash.
+    const editableTools = getExecutableTools(catalog)
+      .filter((tool) => tool.support === "editable")
+      .map((tool) => [tool.toolId, catalog[tool.toolId]] as const)
+      .filter(([, entry]) => Boolean(entry?.automationSettings));
+    // Guard against the filter silently matching nothing (e.g. a registry-shape change).
+    expect(editableTools.length).toBeGreaterThan(10);
+
+    const failures: { toolId: string; message: string }[] = [];
+
+    for (const [toolId, entry] of editableTools) {
+      const Settings = entry.automationSettings as ComponentType<
+        ToolAutomationSettingsProps<ErasedToolParams>
+      >;
+      const params = (entry.operationConfig?.defaultParameters ??
+        {}) as ErasedToolParams;
+
+      const caught: { error: Error | null } = { error: null };
+      // The sentinel sibling commits only once the lazy Settings actually renders, so we wait for a
+      // real render (or a caught throw) - not just the providers' wrapper DOM.
+      const { unmount } = render(
+        <PortalTestProviders>
+          <PreferencesProvider>
+            <SidebarProvider>
+              <CaptureBoundary
+                onError={(error) => {
+                  caught.error = error;
+                }}
+              >
+                <Suspense fallback={null}>
+                  <Settings
+                    parameters={params}
+                    onParameterChange={() => {}}
+                    disabled={false}
+                  />
+                  <span data-testid={`rendered-${toolId}`} />
+                </Suspense>
+              </CaptureBoundary>
+            </SidebarProvider>
+          </PreferencesProvider>
+        </PortalTestProviders>,
+      );
+
+      await waitFor(() =>
+        expect(
+          caught.error !== null ||
+            screen.queryByTestId(`rendered-${toolId}`) !== null,
+        ).toBe(true),
+      );
+
+      if (caught.error) {
+        failures.push({ toolId, message: caught.error.message });
+      }
+      unmount();
+    }
+
+    expect(failures).toEqual([]);
+  }, 30000);
+});
diff --git a/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx b/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx
index ec68e061e7..3e52e6ca0d 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelinesTable.tsx
@@ -1,13 +1,11 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
 import AccountTreeRounded from "@mui/icons-material/AccountTreeRounded";
-import ChevronRightRoundedIcon from "@mui/icons-material/ChevronRightRounded";
 import {
-  Chip,
-  StatusBadge,
+  column,
+  DataTable,
+  type DataTableColumn,
   type StatusTone,
-  Table,
-  type TableColumn,
 } from "@app/ui";
 import type { PipelineStatus, PipelineView } from "@portal/api/pipelines";
 
@@ -24,87 +22,56 @@ interface PipelinesTableProps {
 
 export function PipelinesTable({ pipelines, onRowClick }: PipelinesTableProps) {
   const { t } = useTranslation();
-  const columns = useMemo<TableColumn<PipelineView>[]>(
+  const columns = useMemo<DataTableColumn<PipelineView>[]>(
     () => [
-      {
+      column.entity({
         key: "name",
         header: t("portal.pipelines.table.name"),
-        render: (p) => (
-          <div className="portal-pipelines__name-cell">
-            <span className="portal-pipelines__pipe-dot" aria-hidden>
-              <AccountTreeRounded style={{ fontSize: "1.2rem" }} />
-            </span>
-            <div className="portal-pipelines__name-text">
-              <strong>{p.name}</strong>
-              <Chip accent="neutral" size="sm">
-                {t(`portal.pipelines.trigger.${p.trigger}`, {
-                  defaultValue: p.trigger,
-                })}
-              </Chip>
-            </div>
-          </div>
-        ),
-      },
-      {
+        sortable: true,
+        icon: () => <AccountTreeRounded />,
+        primary: (p) => p.name,
+      }),
+      column.text({
+        key: "trigger",
+        header: t("portal.pipelines.table.trigger", "Trigger"),
+        sortable: true,
+        get: (p) =>
+          t(`portal.pipelines.trigger.${p.trigger}`, {
+            defaultValue: p.trigger,
+          }),
+      }),
+      column.badge({
         key: "status",
         header: t("portal.pipelines.table.status"),
-        render: (p) => (
-          <StatusBadge tone={STATUS_TONE[p.status]} size="sm">
-            {t(`portal.pipelines.status.${p.status}`)}
-          </StatusBadge>
-        ),
-      },
-      {
+        sortable: true,
+        get: (p) => ({
+          tone: STATUS_TONE[p.status],
+          label: t(`portal.pipelines.status.${p.status}`),
+        }),
+      }),
+      column.number({
         key: "steps",
         header: t("portal.pipelines.table.steps"),
-        align: "right",
-        render: (p) => (
-          <span
-            className={
-              p.steps.length === 0 ? "portal-pipelines__muted" : undefined
-            }
-          >
-            {p.steps.length}
-          </span>
-        ),
-      },
-      {
+        sortable: true,
+        get: (p) => p.steps.length,
+      }),
+      column.number({
         key: "sources",
         header: t("portal.pipelines.table.sources"),
-        align: "right",
-        render: (p) => (
-          <span
-            className={
-              p.sources.length === 0 ? "portal-pipelines__muted" : undefined
-            }
-          >
-            {p.sources.length}
-          </span>
-        ),
-      },
-      {
-        key: "open",
-        header: t("portal.pipelines.table.open"),
-        headerHidden: true,
-        align: "right",
-        width: "2.5rem",
-        render: () => (
-          <span className="portal-pipelines__caret" aria-hidden>
-            <ChevronRightRoundedIcon style={{ fontSize: "1.25rem" }} />
-          </span>
-        ),
-      },
+        sortable: true,
+        get: (p) => p.sources.length,
+      }),
     ],
     [t],
   );
 
   return (
-    <Table<PipelineView>
-      className="portal-pipelines__table"
+    <DataTable<PipelineView>
       columns={columns}
       rows={pipelines}
       rowKey={(p) => p.id}
       onRowClick={onRowClick}
+      rowAffordance="chevron"
     />
   );
 }
diff --git a/frontend/editor/src/portal/components/pipelines/graph/PipelineGraph.css b/frontend/editor/src/portal/components/pipelines/graph/PipelineGraph.css
index c9aff67012..19fac1d0b1 100644
--- a/frontend/editor/src/portal/components/pipelines/graph/PipelineGraph.css
+++ b/frontend/editor/src/portal/components/pipelines/graph/PipelineGraph.css
@@ -19,7 +19,7 @@
      the cards in light. */
   background: var(--c-surface-sunken);
   border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-lg);
+  border-radius: var(--radius-nav);
 }
 
 /* Sits beside the wire it is describing. Absolute, so appearing mid-drag moves nothing. */
diff --git a/frontend/editor/src/portal/components/policies/PolicyCatalogueTable.tsx b/frontend/editor/src/portal/components/policies/PolicyCatalogueTable.tsx
index e2c8dc6b85..ae564ab1eb 100644
--- a/frontend/editor/src/portal/components/policies/PolicyCatalogueTable.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicyCatalogueTable.tsx
@@ -1,9 +1,8 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import { Button, Chip, StatusBadge, Table, type TableColumn } from "@app/ui";
+import { column, DataTable, type DataTableColumn } from "@app/ui";
 import type { CatalogueEntry } from "@portal/api/policies";
-import { PolicyCategoryBadge } from "@portal/components/policies/PolicyCategoryIcon";
-import "@portal/views/Policies.css";
+import { policyCategoryIcon } from "@app/components/policies/policyCategoryIcon";
 
 interface PolicyCatalogueTableProps {
   entries: CatalogueEntry[];
@@ -15,10 +14,9 @@ interface PolicyCatalogueTableProps {
 }
 
 /**
- * The policy catalogue as a proper data table (Policy / Enforces / Applies to /
- * Docs / Status), replacing the stacked full-width cards that read as "blocky".
- * Same shared Table + StatusBadge + Chip primitives the Sources, Documents and
- * Home policy tables use, so every list page in the portal now reads alike.
+ * The policy catalogue as a data table (Policy / Enforces / Applies to / Docs /
+ * Status). The status column resolves per row to a state badge, an info chip
+ * (coming soon / requires AI), or a "Set up" call to action.
  */
 export function PolicyCatalogueTable({
   entries,
@@ -28,109 +26,81 @@ export function PolicyCatalogueTable({
 }: PolicyCatalogueTableProps) {
   const { t } = useTranslation();
 
-  const columns = useMemo<TableColumn<CatalogueEntry>[]>(
+  const columns = useMemo<DataTableColumn<CatalogueEntry>[]>(
     () => [
-      {
+      column.entity({
         key: "policy",
         header: t("portal.policies.table.policy", "Policy"),
-        render: (entry) => (
-          <div className="portal-policies__cell">
-            <PolicyCategoryBadge category={entry.category} />
-            <strong className="portal-policies__cell-name">
-              {t(entry.category.label)}
-            </strong>
-          </div>
-        ),
-      },
-      {
+        sortable: true,
+        icon: (entry) => policyCategoryIcon(entry.category.id),
+        primary: (entry) => t(entry.category.label),
+      }),
+      column.text({
         key: "enforces",
         header: t("portal.policies.table.enforces", "Enforces"),
-        render: (entry) => (
-          <div className="portal-policies__rulechips">
-            {entry.config.rules.map((r) => (
-              <Chip key={r} accent="neutral" size="sm">
-                {t(r)}
-              </Chip>
-            ))}
-          </div>
-        ),
-      },
-      {
+        get: (entry) => entry.config.rules.map((r) => t(r)).join(", "),
+      }),
+      column.muted({
         key: "scope",
         header: t("portal.policies.table.appliesTo", "Applies to"),
-        render: (entry) => (
-          <span className="portal-policies__muted">
-            {t(entry.config.scopeLabel)}
-          </span>
-        ),
-      },
-      {
+        sortable: true,
+        get: (entry) => t(entry.config.scopeLabel),
+      }),
+      column.number({
         key: "docs",
         header: t("portal.policies.table.docs", "Docs enforced"),
-        align: "right",
-        width: "8rem",
-        render: (entry) => (
-          <span className="portal-policies__docs">
-            {entry.policy ? entry.policy.stats.enforced.toLocaleString() : "—"}
-          </span>
-        ),
-      },
-      {
+        sortable: true,
+        get: (entry) => (entry.policy ? entry.policy.stats.enforced : null),
+        format: (n) => n.toLocaleString(),
+      }),
+      column.badge({
         key: "status",
         header: t("portal.policies.table.status", "Status"),
-        align: "right",
-        width: "8.5rem",
-        render: (entry) => {
+        sortable: true,
+        // Every state reads as one badge; the "set up" affordance is the row
+        // itself (click + chevron), so there's no bespoke button in the cell.
+        get: (entry) => {
           if (entry.category.comingSoon) {
-            // One consistent neutral chip for every "Upgrade to Enterprise" —
-            // the same action should read the same on every row.
-            return (
-              <Chip accent="neutral" size="sm">
-                {t("portal.policies.card.comingSoon")}
-              </Chip>
-            );
+            return {
+              tone: "neutral",
+              label: t("portal.policies.card.comingSoon"),
+            };
           }
           if (isLocked?.(entry)) {
-            return (
-              <Chip accent="neutral" size="sm">
-                {lockedLabel ?? t("portal.policies.card.requiresAiEngine")}
-              </Chip>
-            );
+            return {
+              tone: "neutral",
+              label: lockedLabel ?? t("portal.policies.card.requiresAiEngine"),
+            };
           }
           if (entry.policy) {
             const paused = entry.policy.state.status === "paused";
-            return (
-              <StatusBadge tone={paused ? "warning" : "success"} size="sm">
-                {paused
-                  ? t("portal.policies.status.paused")
-                  : t("portal.policies.status.active")}
-              </StatusBadge>
-            );
+            return {
+              tone: paused ? "warning" : "success",
+              label: paused
+                ? t("portal.policies.status.paused")
+                : t("portal.policies.status.active"),
+            };
           }
-          return (
-            <Button size="sm" variant="secondary" onClick={() => onOpen(entry)}>
-              {t("portal.policySummary.action.setUp")}
-            </Button>
-          );
+          return {
+            tone: "neutral",
+            label: t("portal.policySummary.action.setUp"),
+          };
         },
-      },
+      }),
     ],
     [t, onOpen, isLocked, lockedLabel],
   );
 
   return (
-    <Table<CatalogueEntry>
-      className="portal-policies__table"
+    <DataTable<CatalogueEntry>
       columns={columns}
       rows={entries}
       rowKey={(e) => e.category.id}
-      onRowClick={(entry) =>
-        entry.category.comingSoon || isLocked?.(entry)
-          ? undefined
-          : onOpen(entry)
+      onRowClick={onOpen}
+      isRowInteractive={(e) =>
+        !(e.category.comingSoon || (isLocked?.(e) ?? false))
       }
-      // A category with no policy yet renders a "set up" button, which opens the same thing.
-      rowsContainControls
+      rowAffordance="chevron"
     />
   );
 }
diff --git a/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx
index 76869bb77a..8be82aaaeb 100644
--- a/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx
@@ -10,6 +10,8 @@ import {
   type ConnectionCategory,
 } from "@portal/components/sources/connectionTypes";
 import { BrandMark } from "@portal/components/BrandMarks";
+import "@portal/theme/surface.css";
+import "@portal/components/sources/connections.css";
 import {
   STEP_OPERATIONS,
   buildStepParameters,
@@ -258,7 +260,7 @@ function OperationGrid({
             key={op.id}
             type="button"
             className={
-              "portal-conn-picker__card" +
+              "portal-surface portal-conn-picker__card" +
               (op.custom ? " portal-conn-picker__card--advanced" : "")
             }
             onClick={() => onPick(op)}
diff --git a/frontend/editor/src/portal/components/policies/stepOperations.test.ts b/frontend/editor/src/portal/components/policies/stepOperations.test.ts
index 3c2dd1c29c..beedf4b1bb 100644
--- a/frontend/editor/src/portal/components/policies/stepOperations.test.ts
+++ b/frontend/editor/src/portal/components/policies/stepOperations.test.ts
@@ -229,6 +229,90 @@ describe("the Cloudmersive scan gate", () => {
   });
 });
 
+describe("the n8n operations", () => {
+  it("covers each of the engine's response behaviours exactly once", () => {
+    // A Webhook node can reply, so n8n reaches replace and requireTrue as well as report;
+    // collapsed onto notify() the extra three would silently become fire-and-forget.
+    const shape = (id: string) => {
+      const params = buildStepParameters(operationById(id)!, "1", {
+        message: "x",
+      });
+      return {
+        includeFile: params.includeFile,
+        responseMode: params.responseMode,
+        requireTrue: params.requireTrue,
+      };
+    };
+
+    expect(shape("n8nNotify")).toEqual({
+      includeFile: "false",
+      responseMode: "report",
+      requireTrue: "",
+    });
+    expect(shape("n8nSend")).toEqual({
+      includeFile: "true",
+      responseMode: "report",
+      requireTrue: "",
+    });
+    expect(shape("n8nTransform")).toEqual({
+      includeFile: "true",
+      responseMode: "replace",
+      requireTrue: "",
+    });
+    expect(shape("n8nGate")).toEqual({
+      includeFile: "true",
+      responseMode: "report",
+      requireTrue: "approved",
+    });
+  });
+
+  it("sends the facts as fields rather than one sentence to parse", () => {
+    const params = buildStepParameters(operationById("n8nNotify")!, "1", {
+      message: "done",
+    });
+    const body = JSON.parse(params.bodyTemplate) as Record<string, unknown>;
+
+    expect(body.message).toBe("done");
+    expect(body.document).toEqual({
+      filename: "{{document.filename}}",
+      extension: "{{document.extension}}",
+      contentType: "{{document.contentType}}",
+      sizeBytes: "{{document.sizeBytes}}",
+      sha256: "{{document.sha256}}",
+    });
+    expect(body.run).toMatchObject({ policy: "{{run.policyName}}" });
+  });
+
+  it("uses no PDF-only placeholder in a fixed body", () => {
+    // document.pageCount is added only for PDFs, and the backend throws on a placeholder it cannot
+    // resolve - baking it in would fail the step on the first non-PDF that reached it.
+    for (const id of ["n8nNotify", "n8nSend", "n8nTransform", "n8nGate"]) {
+      const params = buildStepParameters(operationById(id)!, "1", {
+        message: "x",
+      });
+      expect(params.bodyTemplate, id).not.toContain("pageCount");
+    }
+  });
+
+  it("gives the workflow the run's context beside the file", () => {
+    for (const id of ["n8nSend", "n8nTransform", "n8nGate"]) {
+      const params = buildStepParameters(operationById(id)!, "1", {});
+      expect(params.includeContext, id).toBe("true");
+      expect(params.bodyMode, id).toBe("multipart");
+    }
+  });
+
+  it("leaves every other vendor's context off", () => {
+    // includeContext used to be hardcoded false; now that it is per-operation, a vendor with a
+    // fixed API would reject the extra part.
+    const optedIn = STEP_OPERATIONS.filter(
+      (op) => buildStepParameters(op, "1", {}).includeContext === "true",
+    ).map((op) => op.id);
+
+    expect(optedIn.sort()).toEqual(["n8nGate", "n8nSend", "n8nTransform"]);
+  });
+});
+
 describe("substituting an answer into the URL path", () => {
   it("percent-encodes the answer so a slash stays a value, not a new segment", () => {
     // A Jira key like "OPS/1" (or a space) must not add a path segment or reach another endpoint.
diff --git a/frontend/editor/src/portal/components/policies/stepOperations.ts b/frontend/editor/src/portal/components/policies/stepOperations.ts
index 5c6e0958d9..c1b7beb8c8 100644
--- a/frontend/editor/src/portal/components/policies/stepOperations.ts
+++ b/frontend/editor/src/portal/components/policies/stepOperations.ts
@@ -83,6 +83,9 @@ export interface OperationCall {
   bodyTemplate?: string;
   /** False for notify-style calls that send facts rather than the document. */
   includeFile?: boolean;
+  /** Send the fact context beside the document so the receiver can branch on the run.
+   * Off by default: a vendor with a fixed API has no field for it. */
+  includeContext?: boolean;
 }
 
 export interface StepOperation {
@@ -153,6 +156,138 @@ function notify(
   };
 }
 
+/** Facts every document has, whatever its type — `document.pageCount` is PDF-only and would
+ * fail the step on anything else, so it is offered in the editable message rather than baked in. */
+const N8N_FACTS = {
+  event: "policy.document.processed",
+  run: {
+    policy: "{{run.policyName}}",
+    id: "{{run.runId}}",
+    at: "{{run.timestamp}}",
+  },
+  document: {
+    filename: "{{document.filename}}",
+    extension: "{{document.extension}}",
+    contentType: "{{document.contentType}}",
+    sizeBytes: "{{document.sizeBytes}}",
+    sha256: "{{document.sha256}}",
+  },
+};
+
+/** The four shapes an n8n workflow can take part in; see the catalogue entry for why n8n gets more
+ * than one. All four post to the Webhook node's URL, which is the whole endpoint. */
+function n8nOperations(): StepOperation[] {
+  const base = {
+    connectionTypeId: "n8n",
+    integrationType: "API" as const,
+    category: "notify" as const,
+  };
+  const entry = (
+    id: string,
+    call: OperationCall,
+    extra: Partial<StepOperation> = {},
+  ) => ({
+    ...base,
+    id,
+    labelKey: `${PREFIX}.${id}.label`,
+    descriptionKey: `${PREFIX}.${id}.description`,
+    call,
+    ...extra,
+  });
+
+  return [
+    // Facts only, structured rather than one text blob: a workflow branches on
+    // fields instead of parsing a sentence back apart.
+    entry(
+      "n8nNotify",
+      {
+        path: "",
+        bodyMode: "json",
+        includeFile: false,
+        bodyTemplate: JSON.stringify({ ...N8N_FACTS, message: "{{message}}" }),
+      },
+      {
+        searchTerms: ["n8n", "notify", "trigger", "workflow", "automation"],
+        fields: [
+          {
+            key: "message",
+            labelKey: `${PREFIX}.fields.message.label`,
+            control: "textarea",
+            required: true,
+            helperTextKey: `${PREFIX}.fields.message.helperText`,
+            defaultValue: "{{run.policyName}} processed {{document.filename}}",
+          },
+        ],
+      },
+    ),
+
+    // The document itself, plus the facts as a `stirlingContext` part so the workflow knows which
+    // policy sent it. Fire-and-forget: whatever n8n replies is recorded, the document is unchanged.
+    entry(
+      "n8nSend",
+      {
+        path: "",
+        bodyMode: "multipart",
+        fileFieldName: "file",
+        includeContext: true,
+        responseMode: "report",
+      },
+      {
+        searchTerms: ["n8n", "send", "file", "upload", "workflow", "binary"],
+      },
+    ),
+
+    // The round trip: the returned file replaces the one in the pipeline. Needs the Webhook node
+    // set to "Respond to Webhook" - on "Immediately" its acknowledgement would replace the document.
+    entry(
+      "n8nTransform",
+      {
+        path: "",
+        bodyMode: "multipart",
+        fileFieldName: "file",
+        includeContext: true,
+        responseMode: "replace",
+      },
+      {
+        searchTerms: [
+          "n8n",
+          "transform",
+          "process",
+          "convert",
+          "workflow",
+          "replace",
+        ],
+        noteKey: `${PREFIX}.n8nTransform.note`,
+      },
+    ),
+
+    // The workflow decides whether the run continues. `requireTrue` is fail-closed, so an n8n
+    // outage or a malformed reply parks the document rather than waving it through.
+    entry(
+      "n8nGate",
+      {
+        path: "",
+        bodyMode: "multipart",
+        fileFieldName: "file",
+        includeContext: true,
+        responseMode: "report",
+        requireTrue: "approved",
+      },
+      {
+        searchTerms: [
+          "n8n",
+          "approve",
+          "gate",
+          "review",
+          "decision",
+          "workflow",
+        ],
+        noteKey: `${PREFIX}.n8nGate.note`,
+      },
+    ),
+  ];
+}
+
 export const STEP_OPERATIONS: StepOperation[] = [
   // ---- scan & classify: the verdict gates the run ------------------------------------------
   {
@@ -501,6 +636,11 @@ export const STEP_OPERATIONS: StepOperation[] = [
     "trigger",
   ]),
 
+  // ---- n8n: the one vendor here that can answer back ---------------------------------------------
+  // A Webhook node takes binary and can return what the workflow produces, so n8n reaches all three
+  // engine modes - report, replace and a `requireTrue` verdict - and gets an operation for each.
+  ...n8nOperations(),
+
   {
     id: "webhookPost",
     connectionTypeId: "webhook",
@@ -660,7 +800,7 @@ export function buildStepParameters(
     headers: call.headers ? substituteJson(JSON.stringify(call.headers)) : "",
     fields: call.fields ? substituteJson(JSON.stringify(call.fields)) : "",
     bodyTemplate: call.bodyTemplate ? substituteJson(call.bodyTemplate) : "",
-    includeContext: "false",
+    includeContext: String(call.includeContext ?? false),
     includeFile: String(call.includeFile ?? true),
     operationId: op.id,
     operationValues: JSON.stringify(values),
diff --git a/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
index ef2172bb27..643d6dd56b 100644
--- a/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
+++ b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
@@ -15,6 +15,7 @@ import {
 } from "@portal/components/icons";
 import { warmCalendly } from "@portal/components/procurement/CalendlyInline";
 import { openApiUrl } from "@portal/api/externalUrl";
+import "@portal/theme/surface.css";
 import "@portal/views/Procurement.css";
 
 /** What each stage asks of the buyer, read out in the stage sentence. */
@@ -114,7 +115,7 @@ export function DealStatusHero({
   const nextStage = FLOW_JOURNEY[currentIdx + 1];
 
   return (
-    <div className="portal-hero">
+    <div className="portal-surface portal-hero">
       <div className="portal-hero__top">
         <div className="portal-hero__ident">
           <span className="portal-hero__eyebrow">
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx b/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx
index 7aee96c822..52c3fc10fb 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementAgreement.tsx
@@ -12,6 +12,7 @@ import {
 import { DownloadIcon } from "@portal/components/icons";
 import { StepModalHeader } from "@portal/components/shared/StepModalHeader";
 import { useAsync } from "@portal/hooks/useAsync";
+import "@portal/theme/surface.css";
 import "@portal/views/Procurement.css";
 
 /**
@@ -154,7 +155,7 @@ export function ProcurementAgreement({
         role="group"
         aria-label={t("portal.procurement.agreement.docName")}
       >
-        <div className="portal-agreement__doc">
+        <div className="portal-surface portal-agreement__doc">
           {loading && <p>{t("portal.procurement.agreement.loading")}</p>}
           {!loading && !doc && (
             <p>{t("portal.procurement.agreement.loadError")}</p>
diff --git a/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx b/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
index 98fcbd4f04..409f470685 100644
--- a/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
+++ b/frontend/editor/src/portal/components/procurement/QuoteBuilder.tsx
@@ -16,6 +16,7 @@ import {
 } from "@portal/api/procurement";
 import { LegalDocumentModal } from "@portal/components/procurement/ProcurementExtras";
 import { StepModalHeader } from "@portal/components/shared/StepModalHeader";
+import "@portal/theme/surface.css";
 import "@portal/views/Procurement.css";
 
 const STEPS = ["volume", "plan", "details", "review"] as const;
@@ -526,7 +527,7 @@ export function QuoteBuilder({
             PDF and the Stripe quote exactly. */}
         {step === REVIEW_STEP && issued && (
           <div className="portal-qb__papertray">
-            <div className="portal-qb__paper">
+            <div className="portal-surface portal-qb__paper">
               <div className="portal-qb__paper-head">
                 <div>
                   <div className="portal-qb__paper-brand">Stirling PDF</div>
diff --git a/frontend/editor/src/portal/components/sources/ConnectionForm.tsx b/frontend/editor/src/portal/components/sources/ConnectionForm.tsx
index f975e5cc9d..6bcb1cc8b5 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionForm.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionForm.tsx
@@ -5,6 +5,7 @@ import {
   type ConnectionFieldDef,
   type CreatableConnectionType,
 } from "@portal/components/sources/connectionTypes";
+import "@portal/components/sources/connections.css";
 
 /**
  * Renders whatever fields a connection type declares, rather than knowing any vendor's shape.
diff --git a/frontend/editor/src/portal/components/sources/ConnectionModal.tsx b/frontend/editor/src/portal/components/sources/ConnectionModal.tsx
index b2845da0ba..f6e46bd752 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionModal.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionModal.tsx
@@ -11,6 +11,7 @@ import {
 } from "@portal/api/integrations";
 import { ConnectionTypePicker } from "@portal/components/sources/ConnectionTypePicker";
 import { ConnectionForm } from "@portal/components/sources/ConnectionForm";
+import "@portal/components/sources/connections.css";
 import {
   CREATABLE_CONNECTION_TYPES,
   buildConnectionConfig,
diff --git a/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx b/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx
index 9e7f4dc143..5f2e3c4811 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx
@@ -9,6 +9,7 @@ import {
 } from "@portal/api/integrations";
 import { ConnectionModal } from "@portal/components/sources/ConnectionModal";
 import { connectionTypeOf } from "@portal/components/sources/connectionTypes";
+import "@portal/components/sources/connections.css";
 
 /**
  * Selects a stored connection of one type by id — an S3 bucket for a source, a Purview tenant for a
diff --git a/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx b/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx
index b652626d96..9540006ee3 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx
@@ -8,6 +8,8 @@ import {
   type CreatableConnectionType,
 } from "@portal/components/sources/connectionTypes";
 import { BrandMark } from "@portal/components/BrandMarks";
+import "@portal/theme/surface.css";
+import "@portal/components/sources/connections.css";
 
 /**
  * Choose what to connect to.
@@ -112,7 +114,7 @@ function Grid({
             key={type.id}
             type="button"
             className={
-              "portal-conn-picker__card" +
+              "portal-surface portal-conn-picker__card" +
               (type.kind === "custom"
                 ? " portal-conn-picker__card--advanced"
                 : "")
diff --git a/frontend/editor/src/portal/components/sources/SourcesTable.stories.tsx b/frontend/editor/src/portal/components/sources/SourcesTable.stories.tsx
index 9fb025c7e1..32ff2a24be 100644
--- a/frontend/editor/src/portal/components/sources/SourcesTable.stories.tsx
+++ b/frontend/editor/src/portal/components/sources/SourcesTable.stories.tsx
@@ -57,3 +57,22 @@ export default meta;
 type Story = StoryObj<typeof SourcesTable>;
 
 export const Default: Story = {};
+
+export const OnlyEditorSource: Story = {
+  args: {
+    sources: [
+      {
+        id: "src-editor",
+        name: "Editor",
+        type: "editor",
+        status: "active",
+        referenceCount: 1,
+        referencingPolicies: [],
+        config: [],
+        docsTotal: 0,
+        docs24h: 0,
+        docs30d: 0,
+      },
+    ],
+  },
+};
diff --git a/frontend/editor/src/portal/components/sources/SourcesTable.tsx b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
index ad99eeb942..b5007ec5c1 100644
--- a/frontend/editor/src/portal/components/sources/SourcesTable.tsx
+++ b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
@@ -1,12 +1,10 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import ChevronRightRoundedIcon from "@mui/icons-material/ChevronRightRounded";
 import {
-  Chip,
-  StatusBadge,
+  column,
+  DataTable,
+  type DataTableColumn,
   type StatusTone,
-  Table,
-  type TableColumn,
 } from "@app/ui";
 import type { SourceStatus, SourceView } from "@portal/api/sources";
 import {
@@ -14,7 +12,6 @@ import {
   sourceTypeMeta,
 } from "@portal/components/sources/sourceTypes";
 import { SourceTypeIcon } from "@portal/components/sources/SourceTypeIcon";
-import "@portal/views/Sources.css";
 
 const STATUS_TONE: Record<SourceStatus, StatusTone> = {
   active: "success",
@@ -30,95 +27,65 @@ interface SourcesTableProps {
 
 export function SourcesTable({ sources, onRowClick }: SourcesTableProps) {
   const { t } = useTranslation();
-  const columns = useMemo<TableColumn<SourceView>[]>(
+  const columns = useMemo<DataTableColumn<SourceView>[]>(
     () => [
-      {
+      column.entity({
         key: "name",
         header: t("portal.sources.table.source"),
-        render: (s) => {
-          const meta = sourceTypeMeta(s.type);
-          // The editor is a system source with no instance name: label it from its type and drop
-          // the chip, which would just repeat the name.
-          const isEditor = s.type === EDITOR_SOURCE_TYPE;
-          return (
-            <div className="portal-sources__name-cell">
-              <span className="portal-sources__type-dot" aria-hidden>
-                <SourceTypeIcon type={s.type} />
-              </span>
-              <div className="portal-sources__name-text">
-                <strong>{isEditor ? t(meta.labelKey) : s.name}</strong>
-                {!isEditor && (
-                  <Chip accent={meta.accent} size="sm">
-                    {t(meta.labelKey)}
-                  </Chip>
-                )}
-              </div>
-            </div>
-          );
-        },
-      },
-      {
+        sortable: true,
+        icon: (s) => <SourceTypeIcon type={s.type} />,
+        // The editor is a system source with no instance name: label it from its
+        // type (and leave its Type cell blank, so it isn't repeated).
+        primary: (s) =>
+          s.type === EDITOR_SOURCE_TYPE
+            ? t(sourceTypeMeta(s.type).labelKey)
+            : s.name,
+      }),
+      column.text({
+        key: "type",
+        header: t("portal.sources.table.type", "Type"),
+        sortable: true,
+        get: (s) =>
+          s.type === EDITOR_SOURCE_TYPE
+            ? ""
+            : t(sourceTypeMeta(s.type).labelKey),
+      }),
+      column.badge({
         key: "status",
         header: t("portal.sources.table.status"),
-        render: (s) => (
-          <StatusBadge tone={STATUS_TONE[s.status]} size="sm">
-            {t(`portal.sources.status.${s.status}`)}
-          </StatusBadge>
-        ),
-      },
-      {
+        sortable: true,
+        get: (s) => ({
+          tone: STATUS_TONE[s.status],
+          label: t(`portal.sources.status.${s.status}`),
+        }),
+      }),
+      column.number({
         key: "docs",
         header: t("portal.sources.table.documents"),
-        align: "right",
-        render: (s) => (
-          <span
-            className={s.docsTotal === 0 ? "portal-sources__muted" : undefined}
-          >
-            {s.docsTotal.toLocaleString()}
-          </span>
-        ),
-      },
-      {
+        sortable: true,
+        get: (s) => s.docsTotal,
+        format: (n) => n.toLocaleString(),
+      }),
+      column.number({
         key: "referenceCount",
         header: t("portal.sources.table.usedBy"),
-        align: "right",
-        render: (s) => (
-          <span
-            className={
-              s.referenceCount === 0 ? "portal-sources__muted" : undefined
-            }
-          >
-            {s.referenceCount}
-          </span>
-        ),
-      },
-      {
-        key: "open",
-        header: t("portal.sources.table.open"),
-        headerHidden: true,
-        align: "right",
-        width: "2.5rem",
-        // The editor source has no page to open, so it shows no chevron.
-        render: (s) =>
-          s.type === EDITOR_SOURCE_TYPE ? null : (
-            <span className="portal-sources__caret" aria-hidden>
-              <ChevronRightRoundedIcon style={{ fontSize: "1.25rem" }} />
-            </span>
-          ),
-      },
+        sortable: true,
+        get: (s) => s.referenceCount,
+      }),
     ],
     [t],
   );
 
   return (
-    <Table<SourceView>
-      className="portal-sources__table"
+    <DataTable<SourceView>
       columns={columns}
       rows={sources}
       rowKey={(s) => s.id}
       onRowClick={onRowClick}
-      // The virtual editor row has no page to open, so it's inert - not a fake button.
+      // The virtual editor row has no page to open, so it's inert (and gets no
+      // chevron) - not a fake button.
       isRowInteractive={(s) => s.type !== EDITOR_SOURCE_TYPE}
+      rowAffordance="chevron"
     />
   );
 }
diff --git a/frontend/editor/src/portal/components/sources/connectionTypes.test.ts b/frontend/editor/src/portal/components/sources/connectionTypes.test.ts
index 8de257e88b..bf59c201bf 100644
--- a/frontend/editor/src/portal/components/sources/connectionTypes.test.ts
+++ b/frontend/editor/src/portal/components/sources/connectionTypes.test.ts
@@ -136,6 +136,74 @@ describe("isFieldVisible", () => {
   });
 });
 
+describe("the n8n preset", () => {
+  const n8n = byId("n8n");
+  const field = (key: string) => {
+    const found = n8n.fields.find((f) => f.key === key);
+    if (!found) throw new Error(`no field ${key}`);
+    return found;
+  };
+
+  it("offers only the authentication an n8n Webhook node can be set to", () => {
+    // The node does None, Basic and Header. Offering bearer or the token-login dance would be
+    // auth the operator cannot configure on the other end.
+    expect(field("authType").options?.map((o) => o.value)).toEqual([
+      "NONE",
+      "HEADER",
+      "BASIC",
+    ]);
+  });
+
+  it("shows each credential only for the auth it belongs to", () => {
+    expect(isFieldVisible(field("headerName"), { authType: "HEADER" })).toBe(
+      true,
+    );
+    expect(isFieldVisible(field("headerName"), { authType: "NONE" })).toBe(
+      false,
+    );
+    expect(isFieldVisible(field("username"), { authType: "BASIC" })).toBe(true);
+    expect(isFieldVisible(field("username"), { authType: "HEADER" })).toBe(
+      false,
+    );
+  });
+
+  it("lets the operator's answer override the preset's default of no auth", () => {
+    // buildConnectionConfig spreads presetConfig first, so an unanswered form still yields NONE
+    // but a chosen HEADER must win - otherwise the credential is stored and never sent.
+    const open = buildConnectionConfig(n8n, {
+      baseUrl: "https://n8n.acme.test/webhook/abc",
+    });
+    expect(open.authType).toBe("NONE");
+
+    const secured = buildConnectionConfig(n8n, {
+      baseUrl: "https://n8n.acme.test/webhook/abc",
+      authType: "HEADER",
+      headerName: "X-N8N-Key",
+      token: "s3cr3t",
+    });
+    expect(secured).toMatchObject({
+      authType: "HEADER",
+      headerName: "X-N8N-Key",
+      token: "s3cr3t",
+    });
+  });
+
+  it("recovers an n8n Cloud connection from its host", () => {
+    expect(
+      connectionTypeOf("API", {
+        baseUrl: "https://acme.app.n8n.cloud/webhook/abc",
+      })?.id,
+    ).toBe("n8n");
+  });
+
+  it("recovers a self-hosted n8n from its marker, since the host names nothing", () => {
+    const config = buildConnectionConfig(n8n, {
+      baseUrl: "https://automation.acme.internal/webhook/abc",
+    });
+    expect(connectionTypeOf("API", config)?.id).toBe("n8n");
+  });
+});
+
 describe("resolving a stored connection back to its preset", () => {
   it("keeps a Discord connection as Discord, not the first API preset", () => {
     // Seventeen presets share integrationType "API". Matching on that alone returned whichever
diff --git a/frontend/editor/src/portal/components/sources/connectionTypes.ts b/frontend/editor/src/portal/components/sources/connectionTypes.ts
index d71d0ce2dc..3591814b4f 100644
--- a/frontend/editor/src/portal/components/sources/connectionTypes.ts
+++ b/frontend/editor/src/portal/components/sources/connectionTypes.ts
@@ -496,6 +496,57 @@ const field = {
   }),
 };
 
+/** The three modes an n8n Webhook node can be set to, asked for rather than baked into the preset
+ * because it is the operator's choice; field values apply over `presetConfig`, so the answer wins. */
+const N8N_AUTH_FIELDS: ConnectionFieldDef[] = [
+  {
+    key: "authType",
+    labelKey: `${PREFIX}.n8n.fields.authType.label`,
+    control: "select",
+    required: true,
+    defaultValue: "NONE",
+    helperTextKey: `${PREFIX}.n8n.fields.authType.helperText`,
+    options: [
+      {
+        value: "NONE",
+        labelKey: `${PREFIX}.n8n.fields.authType.options.none.label`,
+      },
+      {
+        value: "HEADER",
+        labelKey: `${PREFIX}.n8n.fields.authType.options.header.label`,
+      },
+      {
+        value: "BASIC",
+        labelKey: `${PREFIX}.n8n.fields.authType.options.basic.label`,
+      },
+    ],
+  },
+  {
+    key: "headerName",
+    labelKey: `${PREFIX}.n8n.fields.headerName.label`,
+    control: "text",
+    required: true,
+    placeholderKey: `${PREFIX}.n8n.fields.headerName.placeholder`,
+    helperTextKey: `${PREFIX}.n8n.fields.headerName.helperText`,
+    visibleWhen: { key: "authType", oneOf: ["HEADER"] },
+  },
+  {
+    key: "token",
+    labelKey: `${PREFIX}.n8n.fields.token.label`,
+    control: "password",
+    required: true,
+    visibleWhen: { key: "authType", oneOf: ["HEADER"] },
+  },
+  {
+    ...field.username(),
+    visibleWhen: { key: "authType", oneOf: ["BASIC"] },
+  },
+  {
+    ...field.password(),
+    visibleWhen: { key: "authType", oneOf: ["BASIC"] },
+  },
+];
+
 /**
  * A vendor whose integration is "an HTTP API with known mechanics". The auth shape, and the base
  * URL when the vendor has a single global one, are baked into `preset`; the operator supplies only
@@ -692,6 +743,26 @@ const API_PRESETS: CreatableConnectionType[] = [
     searchTerms: ["make", "automation", "workflow", "trigger", "no-code"],
     identifyHosts: ["zapier.com"],
   }),
+  // Usually self-hosted, so there is no global host to bake in. The node's three auth options are
+  // mirrored exactly; BEARER or TOKEN_LOGIN would be auth it cannot be configured for.
+  apiPreset({
+    id: "n8n",
+    category: "notify",
+    preset: { authType: "NONE" },
+    fields: [field.webhookUrl("n8n"), ...N8N_AUTH_FIELDS],
+    searchTerms: [
+      "n8n",
+      "automation",
+      "workflow",
+      "trigger",
+      "self-hosted",
+      "no-code",
+      "low-code",
+    ],
+    // n8n Cloud instances live at <tenant>.app.n8n.cloud; a self-hosted one is recovered from
+    // its presetId marker instead, since its host is whatever the operator chose.
+    identifyHosts: ["n8n.cloud"],
+  }),
   apiPreset({
     id: "webhook",
     category: "notify",
diff --git a/frontend/editor/src/portal/components/sources/connections.css b/frontend/editor/src/portal/components/sources/connections.css
new file mode 100644
index 0000000000..c0a0b53be4
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/connections.css
@@ -0,0 +1,241 @@
+/* Connect flow, shared by the Sources view, the Integrations view and the policy external-API step. */
+
+.portal-sources__connection-picker {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  align-items: flex-start;
+}
+
+.portal-sources__connection-picker .sui-select,
+.portal-sources__connection-picker > div:first-child {
+  align-self: stretch;
+}
+
+.portal-sources__connection-create-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.5rem;
+}
+
+.portal-sources__connection-form {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+/* Back to the grid from the form. Sits above the fields, where the type dropdown used to be. */
+.portal-sources__connection-back {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.35rem;
+  margin-bottom: 1rem;
+  padding: 0;
+  background: none;
+  border: none;
+  cursor: pointer;
+  font: inherit;
+  font-size: 0.8125rem;
+  color: var(--c-text-muted);
+}
+
+.portal-sources__connection-back:hover {
+  color: var(--c-text);
+}
+
+/* The "request an integration" / "advanced" affordances, set below the form so presets read as
+   the primary path and these as the way out of it. */
+.portal-sources__connection-secondary {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 1rem;
+  margin-top: 1rem;
+  padding-top: 0.75rem;
+  border-top: 1px solid var(--c-border-subtle);
+}
+
+.portal-sources__connection-link {
+  background: none;
+  border: none;
+  padding: 0;
+  cursor: pointer;
+  font: inherit;
+  font-size: 0.8125rem;
+  color: var(--c-conn-accent);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+
+.portal-sources__connection-link:hover {
+  opacity: 0.8;
+}
+
+/* Free-text fields (result-host list, body template) that outgrow a single-line input. */
+.portal-sources__connection-textarea {
+  width: 100%;
+  padding: 0.5rem 0.75rem;
+  border: 1px solid var(--c-border);
+  border-radius: var(--radius-sm, 0.375rem);
+  background: var(--c-input-bg);
+  color: inherit;
+  font-family: var(--font-mono, ui-monospace, monospace);
+  font-size: 0.8125rem;
+  line-height: 1.5;
+  resize: vertical;
+}
+
+.portal-sources__connection-textarea:focus-visible {
+  outline: 2px solid var(--c-conn-accent);
+  outline-offset: -1px;
+}
+
+/* ---- Integration picker ---------------------------------------------------------------------
+   A searchable grid of what we can connect to. Sized so a full category is visible without
+   scrolling on a laptop, and so the search box is the first thing focus lands on. */
+.portal-conn-picker {
+  display: flex;
+  flex-direction: column;
+  gap: 1.25rem;
+  /* Bounded rather than free-growing: the modal should not become the page. */
+  max-height: min(60vh, 32rem);
+  overflow-y: auto;
+}
+
+.portal-conn-picker__search {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0.5rem 0.75rem;
+  border: 1px solid var(--c-border);
+  border-radius: var(--radius-sm, 0.375rem);
+  /* Real theme token with a transparent fallback so it never falls back to opaque white in dark;
+     the border alone is enough to read as an input. */
+  background: var(--color-bg-subtle, transparent);
+}
+
+.portal-conn-picker__search-icon {
+  flex: none;
+  font-size: 1.125rem;
+  color: var(--c-text-muted);
+}
+
+.portal-conn-picker__search input {
+  flex: 1;
+  min-width: 0;
+  border: none;
+  background: none;
+  outline: none;
+  font: inherit;
+  color: inherit;
+}
+
+.portal-conn-picker__section {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.portal-conn-picker__section-title {
+  margin: 0;
+  font-size: 0.8125rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--c-text-muted);
+}
+
+.portal-conn-picker__section-desc {
+  margin: 0 0 0.5rem;
+  font-size: 0.8125rem;
+  color: var(--c-text-muted);
+}
+
+.portal-conn-picker__grid {
+  display: grid;
+  /* auto-fill so the grid reflows to the modal rather than to a fixed column count. */
+  grid-template-columns: repeat(auto-fill, minmax(13.5rem, 1fr));
+  gap: 0.5rem;
+}
+
+.portal-conn-picker__card {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.625rem;
+  padding: 0.625rem 0.75rem;
+  text-align: left;
+  cursor: pointer;
+  font: inherit;
+  color: inherit;
+}
+
+.portal-conn-picker__card:hover {
+  border-color: var(--c-conn-accent);
+  background: color-mix(in srgb, var(--c-conn-neutral) 6%, transparent);
+}
+
+/* The custom-API card is an escape hatch, not a vendor: dashed, so it reads as "something else". */
+.portal-conn-picker__card--advanced {
+  border-style: dashed;
+}
+
+/* The vendor's real mark: full colour, no tinted plate behind it. Neutral
+   (currentColor) marks pick up the muted text tone instead. */
+.portal-conn-picker__mark {
+  flex: none;
+  display: grid;
+  place-items: center;
+  width: 1.5rem;
+  height: 1.5rem;
+  color: var(--c-text-subtle);
+}
+
+.portal-conn-picker__mark svg {
+  display: block;
+}
+
+.portal-conn-picker__card-text {
+  display: flex;
+  flex-direction: column;
+  gap: 0.125rem;
+  min-width: 0;
+}
+
+.portal-conn-picker__card-name {
+  font-size: 0.875rem;
+  font-weight: 500;
+}
+
+.portal-conn-picker__card-desc {
+  font-size: 0.75rem;
+  line-height: 1.35;
+  color: var(--c-text-muted);
+  /* Two lines keeps every card the same height without truncating most descriptions. */
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+}
+
+.portal-conn-picker__empty {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 2rem 1rem;
+  text-align: center;
+}
+
+.portal-conn-picker__empty-title {
+  margin: 0;
+  font-size: 0.9375rem;
+  font-weight: 600;
+}
+
+.portal-conn-picker__empty-body {
+  margin: 0 0 0.5rem;
+  font-size: 0.8125rem;
+  color: var(--c-text-muted);
+}
diff --git a/frontend/editor/src/portal/components/users/PendingInvitations.test.tsx b/frontend/editor/src/portal/components/users/PendingInvitations.test.tsx
index ffecdc3f83..18535a7ca2 100644
--- a/frontend/editor/src/portal/components/users/PendingInvitations.test.tsx
+++ b/frontend/editor/src/portal/components/users/PendingInvitations.test.tsx
@@ -37,7 +37,7 @@ describe("PendingInvitations", () => {
     expect(screen.getByText("sam@acme.com")).toBeInTheDocument();
     expect(screen.getByText("dana@acme.com")).toBeInTheDocument();
     expect(screen.getByText("Invited by leader@acme.com")).toBeInTheDocument();
-    expect(screen.getByText("2 pending")).toBeInTheDocument();
+    expect(screen.getByText("Pending invitations")).toBeInTheDocument();
   });
 
   it("cancelling an invite calls back with that invitation", () => {
diff --git a/frontend/editor/src/portal/components/users/PendingInvitations.tsx b/frontend/editor/src/portal/components/users/PendingInvitations.tsx
index 5c6fd65b5a..9def224314 100644
--- a/frontend/editor/src/portal/components/users/PendingInvitations.tsx
+++ b/frontend/editor/src/portal/components/users/PendingInvitations.tsx
@@ -1,8 +1,8 @@
+import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
 import type { TFunction } from "i18next";
-import { Avatar, Button } from "@app/ui";
+import { Avatar, column, DataTable, type DataTableColumn } from "@app/ui";
 import type { PendingInvitation } from "@portal/api/users";
-import "@portal/views/Users.css";
 
 interface PendingInvitationsProps {
   invitations: PendingInvitation[];
@@ -24,60 +24,54 @@ function expiryLabel(iso: string | undefined, t: TFunction): string {
 }
 
 /**
- * Pending team invitations (SaaS): the parity gap vs the editor. Each row shows
- * the invitee and lets a team leader cancel the invite. Rendered only when the
- * flavor supports it (manageInvitations) and there are pending invites.
+ * Pending team invitations (SaaS): the parity gap vs the editor. A single flat
+ * list (not a section - there's only ever one) captioned with its title; each
+ * row shows the invitee and lets a team leader cancel the invite.
  */
 export function PendingInvitations({
   invitations,
   onCancel,
 }: PendingInvitationsProps) {
   const { t } = useTranslation();
+
+  const columns = useMemo<DataTableColumn<PendingInvitation>[]>(
+    () => [
+      column.entity({
+        key: "invitee",
+        header: t("users.invites.columns.invitee", "Invitee"),
+        icon: (inv) => <Avatar name={inv.email} size="sm" tone="neutral" />,
+        primary: (inv) => inv.email,
+        note: (inv) =>
+          inv.invitedBy
+            ? t("users.invites.by", "Invited by {{who}}", {
+                who: inv.invitedBy,
+              })
+            : undefined,
+      }),
+      column.muted({
+        key: "expires",
+        header: t("users.invites.columns.expires", "Expires"),
+        get: (inv) => expiryLabel(inv.expiresAt, t),
+      }),
+      column.actions({
+        key: "actions",
+        get: (inv) => [
+          {
+            label: t("users.invites.cancel", "Cancel"),
+            onClick: () => onCancel(inv),
+          },
+        ],
+      }),
+    ],
+    [t, onCancel],
+  );
+
   return (
-    <section className="portal-users__group">
-      <header className="portal-users__group-head">
-        <div className="portal-users__group-title">
-          <strong>{t("users.invites.title", "Pending invitations")}</strong>
-          <span className="portal-users__group-desc">
-            {t(
-              "users.invites.desc",
-              "Invited people who haven't joined yet. They hold a seat until they accept.",
-            )}
-          </span>
-        </div>
-        <span className="portal-users__group-count">
-          {t("users.invites.count", "{{count}} pending", {
-            count: invitations.length,
-          })}
-        </span>
-      </header>
-      {invitations.map((inv) => {
-        const expires = expiryLabel(inv.expiresAt, t);
-        return (
-          <div className="portal-users__row" key={inv.id}>
-            <div className="portal-users__row-main">
-              <Avatar name={inv.email} size="sm" tone="neutral" />
-              <div className="portal-users__row-id">
-                <span className="portal-users__row-name">{inv.email}</span>
-                {inv.invitedBy && (
-                  <span className="portal-users__row-email">
-                    {t("users.invites.by", "Invited by {{who}}", {
-                      who: inv.invitedBy,
-                    })}
-                  </span>
-                )}
-              </div>
-            </div>
-            <span className="portal-users__inv-spacer" />
-            {expires && (
-              <span className="portal-users__row-active">{expires}</span>
-            )}
-            <Button variant="secondary" size="sm" onClick={() => onCancel(inv)}>
-              {t("users.invites.cancel", "Cancel")}
-            </Button>
-          </div>
-        );
-      })}
-    </section>
+    <DataTable<PendingInvitation>
+      columns={columns}
+      rows={invitations}
+      rowKey={(inv) => String(inv.id)}
+      caption={t("users.invites.title", "Pending invitations")}
+    />
   );
 }
diff --git a/frontend/editor/src/portal/components/users/UsersDirectory.stories.tsx b/frontend/editor/src/portal/components/users/UsersDirectory.stories.tsx
index ff4fb4b6f1..2925958efd 100644
--- a/frontend/editor/src/portal/components/users/UsersDirectory.stories.tsx
+++ b/frontend/editor/src/portal/components/users/UsersDirectory.stories.tsx
@@ -23,6 +23,7 @@ const FULL_CAPS: UsersCapabilities = {
   seats: false,
   manageGrants: true,
   removeScope: "org",
+  listingRequiresAdmin: true,
 };
 
 /** SaaS team-leader: invite / rename / remove-member only, no org group. */
@@ -44,6 +45,7 @@ const SAAS_CAPS: UsersCapabilities = {
   seats: true,
   manageGrants: false,
   removeScope: "team",
+  listingRequiresAdmin: false,
 };
 
 /** A full org: one org owner and two teams, each with a leader. */
@@ -92,7 +94,7 @@ const MEMBERS: Member[] = [
     name: "Priya Patel",
     email: "priya@stirlingpdf.com",
     role: "member",
-    status: "active",
+    status: "suspended",
     lastActive: "Never",
     username: "priya",
     teamId: 2,
@@ -124,6 +126,7 @@ const MEMBERS: Member[] = [
     teamName: "Compliance",
     portalAccess: "granted",
     portalGrantId: 11,
+    locked: true,
   },
 ];
 
diff --git a/frontend/editor/src/portal/components/users/UsersDirectory.test.tsx b/frontend/editor/src/portal/components/users/UsersDirectory.test.tsx
index c26fedcd5f..a1ed4b34a4 100644
--- a/frontend/editor/src/portal/components/users/UsersDirectory.test.tsx
+++ b/frontend/editor/src/portal/components/users/UsersDirectory.test.tsx
@@ -133,6 +133,7 @@ describe("UsersDirectory - member avatars", () => {
     renderDirectory(selfHostedCaps);
 
     expect(pictureOf()).toBeNull();
-    expect(screen.getByText("PR")).toBeInTheDocument();
+    // A one-word name renders a single initial.
+    expect(screen.getByText("P")).toBeInTheDocument();
   });
 });
diff --git a/frontend/editor/src/portal/components/users/UsersDirectory.tsx b/frontend/editor/src/portal/components/users/UsersDirectory.tsx
index ee32c78e57..d9350f868e 100644
--- a/frontend/editor/src/portal/components/users/UsersDirectory.tsx
+++ b/frontend/editor/src/portal/components/users/UsersDirectory.tsx
@@ -1,8 +1,16 @@
-import { useMemo, useState } from "react";
+import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import { Menu } from "@mantine/core";
-import PersonAddAltRounded from "@mui/icons-material/PersonAddAltRounded";
-import { Avatar, Chip, Select } from "@app/ui";
+import {
+  Avatar,
+  type CellAction,
+  type CellCap,
+  type CellLabel,
+  type CellMenuItem,
+  column,
+  DataTable,
+  type DataTableColumn,
+  type DataTableGroup,
+} from "@app/ui";
 import { type Member, type RoleId } from "@portal/api/users";
 import type { Team } from "@portal/api/teams";
 import type { UsersCapabilities } from "@portal/api/usersCapabilities";
@@ -11,7 +19,6 @@ import {
   buildDirectory,
   type TeamGroup,
 } from "@portal/components/users/directory";
-import "@portal/views/Users.css";
 
 /** Collapse a group's rows past this many, behind a "Show all" expander. */
 const COLLAPSED_LIMIT = 8;
@@ -42,23 +49,17 @@ interface UsersDirectoryProps {
   // Team actions (the team-header kebab).
   onRenameTeam: (team: TeamGroup) => void;
   onDeleteTeam: (team: TeamGroup) => void;
-  /**
-   * Show the "Approves policy" capability chip on org owners. Off in the live
-   * app (no backend for it yet); on in Storybook to document the intended design.
-   */
+  /** Show the "Approves policy" capability on org owners (Storybook design doc). */
   showApprover?: boolean;
-  /**
-   * Show the Guests group + the "Guest" role option. Off in the live app (the
-   * Guest concept is parked); on in Storybook to document the intended design.
-   */
+  /** Show the Guests group + the "Guest" role option (Storybook design doc). */
   showGuests?: boolean;
 }
 
 /**
- * The people roster, grouped like the org chart: Organization owners, then each
- * team (with its leader), each row carrying capability chips, a role selector,
- * and a kebab of admin actions. Long groups collapse behind a "Show all" so big
- * orgs stay scannable.
+ * The people roster on the shared DataTable: grouped like the org chart
+ * (Organization owners, then each team, then guests), each row carrying its
+ * capability chips, a role selector, and a kebab of admin actions. Long groups
+ * collapse behind a "Show all".
  */
 export function UsersDirectory({
   members,
@@ -84,7 +85,6 @@ export function UsersDirectory({
 }: UsersDirectoryProps) {
   const { t } = useTranslation();
   const dir = useMemo(() => buildDirectory(members, teams), [members, teams]);
-  const [expanded, setExpanded] = useState<Set<string>>(new Set());
 
   const nameByUsername = useMemo(() => {
     const m = new Map<string, string>();
@@ -94,397 +94,343 @@ export function UsersDirectory({
     return m;
   }, [members]);
 
-  const roleOptions: { value: RoleId; label: string }[] = [
-    // No SaaS user is ever ROLE_ADMIN, so the Org Owner option is dropped there.
-    ...(capabilities.adminRole
-      ? [
-          {
-            value: "admin" as RoleId,
-            label: t("users.role.orgOwner", "Org Owner"),
-          },
-        ]
-      : []),
-    { value: "team_owner", label: t("users.role.teamOwner", "Team Owner") },
-    { value: "member", label: t("users.role.member", "Member") },
-    ...(showGuests
-      ? [{ value: "guest" as RoleId, label: t("users.role.guest", "Guest") }]
-      : []),
-  ];
+  const roleOptions = useMemo(
+    () => [
+      // No SaaS user is ever ROLE_ADMIN, so the Org Owner option is dropped there.
+      ...(capabilities.adminRole
+        ? [
+            {
+              value: "admin" as RoleId,
+              label: t("users.role.orgOwner", "Org Owner"),
+            },
+          ]
+        : []),
+      {
+        value: "team_owner" as RoleId,
+        label: t("users.role.teamOwner", "Team Owner"),
+      },
+      { value: "member" as RoleId, label: t("users.role.member", "Member") },
+      ...(showGuests
+        ? [{ value: "guest" as RoleId, label: t("users.role.guest", "Guest") }]
+        : []),
+    ],
+    [capabilities.adminRole, showGuests, t],
+  );
 
-  function toggleExpand(key: string) {
-    setExpanded((prev) => {
-      const next = new Set(prev);
-      if (next.has(key)) next.delete(key);
-      else next.add(key);
-      return next;
-    });
-  }
+  const columns = useMemo<DataTableColumn<Member>[]>(() => {
+    function rowKebab(m: Member): CellAction {
+      const removeLabel =
+        capabilities.removeScope === "team"
+          ? t("users.action.removeTeam", "Remove from team")
+          : t("users.action.remove", "Remove from org");
+      const items: CellMenuItem[] = [];
+      if (capabilities.resetPassword) {
+        items.push({
+          label: t("users.action.resetPw", "Reset password"),
+          disabled: m.isSelf,
+          onClick: () => onResetPassword(m),
+        });
+      }
+      if (capabilities.moveTeam) {
+        items.push({
+          label: t("users.action.move", "Move to team"),
+          onClick: () => onMoveToTeam(m),
+        });
+      }
+      if (capabilities.suspend) {
+        items.push({
+          label:
+            m.status === "suspended"
+              ? t("users.action.reinstate", "Reinstate")
+              : t("users.action.suspend", "Suspend"),
+          disabled: m.isSelf,
+          onClick: () => onToggleEnabled(m),
+        });
+      }
+      if (capabilities.unlock && m.locked) {
+        items.push({
+          label: t("users.action.unlock", "Unlock account"),
+          onClick: () => onUnlock(m),
+        });
+      }
+      if (capabilities.resetMfa && m.mfaEnabled) {
+        items.push({
+          label: t("users.action.disableMfa", "Reset MFA"),
+          disabled: m.isSelf,
+          onClick: () => onDisableMfa(m),
+        });
+      }
+      items.push({
+        label: removeLabel,
+        tone: "danger",
+        disabled: m.isSelf,
+        onClick: () => onRemove(m),
+        dividerBefore: items.length > 0,
+      });
+      return {
+        label: t("users.rowActions", "Actions for {{name}}", { name: m.name }),
+        glyph: "kebab",
+        iconOnly: true,
+        menu: items,
+      };
+    }
 
-  function ownerNames(owners: string[]): string {
-    return owners.map((u) => nameByUsername.get(u) ?? u).join(", ");
-  }
-
-  // A team whose name/membership is managed by the system - no rename/delete.
-  // SaaS personal teams (isPersonal) reject rename/delete at the backend too.
-  function isManagedTeam(team: TeamGroup): boolean {
-    return SYSTEM_TEAMS.has(team.name) || team.isPersonal === true;
-  }
-
-  // Whether the team-header kebab has any actions (else it isn't rendered).
-  function teamKebabHasItems(team: TeamGroup): boolean {
-    return (
-      capabilities.manageGrants ||
-      (!isManagedTeam(team) &&
-        (capabilities.renameTeam || capabilities.deleteTeam))
-    );
-  }
-
-  // Whether any action sits above the "Remove" item (so we render a divider).
-  function rowKebabHasUpperActions(m: Member): boolean {
-    return (
-      capabilities.resetPassword ||
-      capabilities.moveTeam ||
-      capabilities.suspend ||
-      (capabilities.unlock && !!m.locked) ||
-      (capabilities.resetMfa && !!m.mfaEnabled)
-    );
-  }
-
-  function rowKebab(m: Member) {
-    // Both flavors have a backed remove now: org-delete (self-hosted) or
-    // team-remove (SaaS, via SaasTeamController's remove-member endpoint), so the
-    // kebab always carries at least the remove action.
-    const removeLabel =
-      capabilities.removeScope === "team"
-        ? t("users.action.removeTeam", "Remove from team")
-        : t("users.action.remove", "Remove from org");
-    return (
-      <Menu position="bottom-end" withinPortal shadow="md" width={210}>
-        <Menu.Target>
-          <button
-            type="button"
-            className="portal-users__row-kebab"
-            aria-label={t("users.rowActions", "Actions for {{name}}", {
-              name: m.name,
-            })}
-          >
-            ⋯
-          </button>
-        </Menu.Target>
-        <Menu.Dropdown>
-          {capabilities.resetPassword && (
-            <Menu.Item disabled={m.isSelf} onClick={() => onResetPassword(m)}>
-              {t("users.action.resetPw", "Reset password")}
-            </Menu.Item>
-          )}
-          {capabilities.moveTeam && (
-            <Menu.Item onClick={() => onMoveToTeam(m)}>
-              {t("users.action.move", "Move to team")}
-            </Menu.Item>
-          )}
-          {capabilities.suspend && (
-            <Menu.Item disabled={m.isSelf} onClick={() => onToggleEnabled(m)}>
-              {m.status === "suspended"
-                ? t("users.action.reinstate", "Reinstate")
-                : t("users.action.suspend", "Suspend")}
-            </Menu.Item>
-          )}
-          {capabilities.unlock && m.locked && (
-            <Menu.Item onClick={() => onUnlock(m)}>
-              {t("users.action.unlock", "Unlock account")}
-            </Menu.Item>
-          )}
-          {capabilities.resetMfa && m.mfaEnabled && (
-            <Menu.Item disabled={m.isSelf} onClick={() => onDisableMfa(m)}>
-              {t("users.action.disableMfa", "Reset MFA")}
-            </Menu.Item>
-          )}
-          {rowKebabHasUpperActions(m) && <Menu.Divider />}
-          <Menu.Item
-            color="red"
-            disabled={m.isSelf}
-            onClick={() => onRemove(m)}
-          >
-            {removeLabel}
-          </Menu.Item>
-        </Menu.Dropdown>
-      </Menu>
-    );
-  }
-
-  function renderRow(m: Member) {
-    const access = m.portalAccess ?? "none";
-    return (
-      <div className="portal-users__row" key={m.id}>
-        <div className="portal-users__row-main">
+    const cols: DataTableColumn<Member>[] = [
+      column.entity({
+        key: "person",
+        header: t("users.columns.person", "Person"),
+        icon: (m) => (
           <Avatar
             src={m.avatarUrl}
             name={m.name}
             size="sm"
             tone={avatarToneForMember(m)}
           />
-          <div className="portal-users__row-id">
-            <span className="portal-users__row-name">
-              {m.name}
-              {m.isSelf && (
-                <span className="portal-users__row-you">
-                  {" "}
-                  {t("users.you", "(you)")}
-                </span>
-              )}
-              {m.status === "suspended" && (
-                <Chip
-                  accent="danger"
-                  size="sm"
-                  className="portal-users__row-tag"
-                >
-                  {t("users.suspended", "Suspended")}
-                </Chip>
-              )}
-              {m.locked && (
-                <Chip
-                  accent="warning"
-                  size="sm"
-                  className="portal-users__row-tag"
-                >
-                  {t("users.locked", "Locked")}
-                </Chip>
-              )}
-            </span>
-            {m.email !== m.name && (
-              <span className="portal-users__row-email">{m.email}</span>
-            )}
-          </div>
-        </div>
+        ),
+        primary: (m) => m.name,
+        suffix: (m) => (m.isSelf ? t("users.you", "(you)") : undefined),
+      }),
+      column.muted({
+        key: "email",
+        header: t("users.columns.email", "Email"),
+        // Blank when the name already is the email (no separate display name).
+        get: (m) => (m.email !== m.name ? m.email : undefined),
+      }),
+      column.labels({
+        key: "status",
+        header: t("users.columns.status", "Status"),
+        get: (m) => {
+          const out: CellLabel[] = [];
+          if (m.status === "suspended") {
+            out.push({
+              label: t("users.suspended", "Suspended"),
+              accent: "danger",
+            });
+          }
+          if (m.locked) {
+            out.push({ label: t("users.locked", "Locked"), accent: "warning" });
+          }
+          return out;
+        },
+      }),
+      column.caps({
+        key: "capabilities",
+        header: t("users.columns.capabilities", "Capabilities"),
+        get: (m) => {
+          const access = m.portalAccess ?? "none";
+          const out: CellCap[] = [
+            { label: t("users.cap.editor", "Editor"), accent: "neutral" },
+          ];
+          if (access === "granted") {
+            out.push({
+              label: t("users.cap.processor", "Processor"),
+              accent: "default",
+              onRemove: capabilities.manageGrants
+                ? () => onRevokeProcessor(m)
+                : undefined,
+            });
+          } else if (access !== "none") {
+            out.push({
+              label: t("users.cap.processor", "Processor"),
+              accent: "default",
+            });
+          } else if (capabilities.manageGrants) {
+            out.push({
+              label: t("users.cap.addProcessor", "+ Processor"),
+              accent: "neutral",
+              dashed: true,
+              onClick: () => onGrantProcessor(m),
+            });
+          }
+          if (showApprover && m.role === "admin") {
+            out.push({
+              label: t("users.cap.approver", "Approves policy"),
+              accent: "success",
+            });
+          }
+          return out;
+        },
+      }),
+      column.muted({
+        key: "lastActive",
+        header: t("users.lastActive", "Last active"),
+        get: (m) => m.lastActive,
+      }),
+    ];
 
-        <div className="portal-users__caps">
-          <Chip accent="neutral" size="sm">
-            {t("users.cap.editor", "Editor")}
-          </Chip>
-          {access === "granted" ? (
-            <Chip
-              accent="default"
-              size="sm"
-              onRemove={
-                capabilities.manageGrants
-                  ? () => onRevokeProcessor(m)
-                  : undefined
-              }
-            >
-              {t("users.cap.processor", "Processor")}
-            </Chip>
-          ) : access !== "none" ? (
-            // admin / team-owner role / inherited from a team-wide grant
-            <Chip accent="default" size="sm">
-              {t("users.cap.processor", "Processor")}
-            </Chip>
-          ) : capabilities.manageGrants ? (
-            <Chip
-              accent="neutral"
-              size="sm"
-              dashed
-              onClick={() => onGrantProcessor(m)}
-            >
-              {t("users.cap.addProcessor", "+ Processor")}
-            </Chip>
-          ) : null}
-          {showApprover && m.role === "admin" && (
-            <Chip
-              accent="success"
-              size="sm"
-              leadingIcon={<span aria-hidden>✓</span>}
-            >
-              {t("users.cap.approver", "Approves policy")}
-            </Chip>
-          )}
-        </div>
+    if (capabilities.changeRole) {
+      cols.push(
+        column.select({
+          key: "role",
+          header: t("users.columns.role", "Role"),
+          get: (m) => ({
+            value: m.role,
+            options: roleOptions,
+            ariaLabel: t("users.roleFor", "Role for {{name}}", {
+              name: m.name,
+            }),
+            disabled: m.isSelf,
+          }),
+          onChange: (m, value) => onChangeRole(m, (value ?? m.role) as RoleId),
+        }),
+      );
+    }
 
-        <span
-          className="portal-users__row-active"
-          title={t("users.lastActive", "Last active")}
-        >
-          {m.lastActive}
-        </span>
+    cols.push(column.actions({ key: "actions", get: (m) => [rowKebab(m)] }));
+    return cols;
+  }, [
+    t,
+    capabilities,
+    roleOptions,
+    showApprover,
+    onChangeRole,
+    onGrantProcessor,
+    onRevokeProcessor,
+    onResetPassword,
+    onMoveToTeam,
+    onToggleEnabled,
+    onUnlock,
+    onDisableMfa,
+    onRemove,
+  ]);
 
-        {capabilities.changeRole && (
-          <div className="portal-users__row-role">
-            <Select
-              aria-label={t("users.roleFor", "Role for {{name}}", {
-                name: m.name,
-              })}
-              options={roleOptions}
-              value={m.role}
-              disabled={m.isSelf}
-              onChange={(value) => onChangeRole(m, (value ?? m.role) as RoleId)}
-            />
-          </div>
-        )}
+  const groups = useMemo<DataTableGroup<Member>[]>(() => {
+    function ownerNames(owners: string[]): string {
+      return owners.map((u) => nameByUsername.get(u) ?? u).join(", ");
+    }
+    // A team whose name/membership is system-managed - no rename/delete.
+    function isManagedTeam(team: TeamGroup): boolean {
+      return SYSTEM_TEAMS.has(team.name) || team.isPersonal === true;
+    }
+    function teamKebabHasItems(team: TeamGroup): boolean {
+      return (
+        capabilities.manageGrants ||
+        (!isManagedTeam(team) &&
+          (capabilities.renameTeam || capabilities.deleteTeam))
+      );
+    }
+    function teamActions(team: TeamGroup): CellAction[] {
+      const acts: CellAction[] = [
+        {
+          label: t("users.group.addToTeam", "Add to team"),
+          onClick: () => onAddToTeam(team),
+        },
+      ];
+      if (teamKebabHasItems(team)) {
+        const items: CellMenuItem[] = [];
+        if (capabilities.manageGrants) {
+          items.push(
+            processorTeamIds.has(team.id)
+              ? {
+                  label: t(
+                    "users.team.revokeProcessor",
+                    "Revoke Processor from team",
+                  ),
+                  onClick: () => onRevokeTeamProcessor(team),
+                }
+              : {
+                  label: t(
+                    "users.team.grantProcessor",
+                    "Grant Processor to team",
+                  ),
+                  onClick: () => onGrantTeamProcessor(team),
+                },
+          );
+        }
+        if (!isManagedTeam(team)) {
+          const divider = capabilities.manageGrants;
+          if (capabilities.renameTeam) {
+            items.push({
+              label: t("users.action.rename", "Rename team"),
+              onClick: () => onRenameTeam(team),
+              dividerBefore: divider,
+            });
+          }
+          if (capabilities.deleteTeam) {
+            items.push({
+              label: t("users.action.deleteTeam", "Delete team"),
+              tone: "danger",
+              onClick: () => onDeleteTeam(team),
+              dividerBefore: divider && !capabilities.renameTeam,
+            });
+          }
+        }
+        acts.push({
+          label: t("users.teamActions", "Team actions"),
+          glyph: "kebab",
+          iconOnly: true,
+          menu: items,
+        });
+      }
+      return acts;
+    }
 
-        {rowKebab(m)}
-      </div>
-    );
-  }
-
-  /** Rows for a group, collapsing past COLLAPSED_LIMIT behind a toggle. */
-  function renderMembers(list: Member[], key: string) {
-    const isOpen = expanded.has(key);
-    const overflow = list.length > COLLAPSED_LIMIT;
-    const shown = overflow && !isOpen ? list.slice(0, COLLAPSED_LIMIT) : list;
-    return (
-      <>
-        {shown.map(renderRow)}
-        {overflow && (
-          <button
-            type="button"
-            className="portal-users__show-more"
-            onClick={() => toggleExpand(key)}
-          >
-            {isOpen
-              ? t("users.showLess", "Show less")
-              : t("users.showAll", "Show all {{count}}", {
-                  count: list.length,
-                })}
-          </button>
-        )}
-      </>
-    );
-  }
+    const gs: DataTableGroup<Member>[] = [];
+    if (capabilities.orgGroup && dir.organization.length > 0) {
+      gs.push({
+        key: "org",
+        title: t("users.group.org", "Organization"),
+        meta: t("users.group.owners", "{{count}} owner", {
+          count: dir.organization.length,
+        }),
+        rows: dir.organization,
+        collapseAfter: COLLAPSED_LIMIT,
+      });
+    }
+    for (const team of dir.teams) {
+      const led =
+        team.owners.length > 0
+          ? ` · ${t("users.group.ledBy", "led by {{owner}}", {
+              owner: ownerNames(team.owners),
+            })}`
+          : "";
+      gs.push({
+        key: `team-${team.id}`,
+        title: t("users.group.team", "{{name}} team", { name: team.name }),
+        meta:
+          t("users.group.teamMeta", "{{count}} people", {
+            count: team.members.length,
+          }) + led,
+        actions: teamActions(team),
+        rows: team.members,
+        collapseAfter: COLLAPSED_LIMIT,
+      });
+    }
+    if (showGuests && dir.guests.length > 0) {
+      gs.push({
+        key: "guests",
+        title: t("users.group.guests", "Guests"),
+        meta: t("users.group.guestCount", "{{count}} guest", {
+          count: dir.guests.length,
+        }),
+        rows: dir.guests,
+        collapseAfter: COLLAPSED_LIMIT,
+      });
+    }
+    return gs;
+  }, [
+    t,
+    dir,
+    nameByUsername,
+    capabilities,
+    showGuests,
+    processorTeamIds,
+    onAddToTeam,
+    onGrantTeamProcessor,
+    onRevokeTeamProcessor,
+    onRenameTeam,
+    onDeleteTeam,
+  ]);
 
   return (
-    <div className="portal-users__directory">
-      {/* Organization (a single-org deployment only; SaaS has no org). */}
-      {capabilities.orgGroup && dir.organization.length > 0 && (
-        <section className="portal-users__group">
-          <header className="portal-users__group-head">
-            <div className="portal-users__group-title">
-              <strong>{t("users.group.org", "Organization")}</strong>
-              <span className="portal-users__group-desc">
-                {t(
-                  "users.group.orgDesc",
-                  "Owners with org-wide authority and policy approval",
-                )}
-              </span>
-            </div>
-            <span className="portal-users__group-count">
-              {t("users.group.owners", "{{count}} owner", {
-                count: dir.organization.length,
-              })}
-            </span>
-          </header>
-          {renderMembers(dir.organization, "org")}
-        </section>
-      )}
-
-      {/* Teams */}
-      {dir.teams.map((team) => (
-        <section className="portal-users__group" key={team.id}>
-          <header className="portal-users__group-head">
-            <div className="portal-users__group-title">
-              <strong>
-                {t("users.group.team", "{{name}} team", { name: team.name })}
-              </strong>
-              <span className="portal-users__group-desc">
-                {t("users.group.teamMeta", "{{count}} people", {
-                  count: team.members.length,
-                })}
-                {team.owners.length > 0 &&
-                  ` · ${t("users.group.ledBy", "led by {{owner}}", {
-                    owner: ownerNames(team.owners),
-                  })}`}
-              </span>
-            </div>
-            <div className="portal-users__group-actions">
-              <button
-                type="button"
-                className="portal-users__group-action"
-                onClick={() => onAddToTeam(team)}
-              >
-                <PersonAddAltRounded sx={{ fontSize: 15 }} />
-                {t("users.group.addToTeam", "Add to team")}
-              </button>
-              {teamKebabHasItems(team) && (
-                <Menu
-                  position="bottom-end"
-                  withinPortal
-                  shadow="md"
-                  width={210}
-                >
-                  <Menu.Target>
-                    <button
-                      type="button"
-                      className="portal-users__row-kebab"
-                      aria-label={t("users.teamActions", "Team actions")}
-                    >
-                      ⋯
-                    </button>
-                  </Menu.Target>
-                  <Menu.Dropdown>
-                    {capabilities.manageGrants &&
-                      (processorTeamIds.has(team.id) ? (
-                        <Menu.Item onClick={() => onRevokeTeamProcessor(team)}>
-                          {t(
-                            "users.team.revokeProcessor",
-                            "Revoke Processor from team",
-                          )}
-                        </Menu.Item>
-                      ) : (
-                        <Menu.Item onClick={() => onGrantTeamProcessor(team)}>
-                          {t(
-                            "users.team.grantProcessor",
-                            "Grant Processor to team",
-                          )}
-                        </Menu.Item>
-                      ))}
-                    {!isManagedTeam(team) &&
-                      (capabilities.renameTeam || capabilities.deleteTeam) && (
-                        <>
-                          {capabilities.manageGrants && <Menu.Divider />}
-                          {capabilities.renameTeam && (
-                            <Menu.Item onClick={() => onRenameTeam(team)}>
-                              {t("users.action.rename", "Rename team")}
-                            </Menu.Item>
-                          )}
-                          {capabilities.deleteTeam && (
-                            <Menu.Item
-                              color="red"
-                              onClick={() => onDeleteTeam(team)}
-                            >
-                              {t("users.action.deleteTeam", "Delete team")}
-                            </Menu.Item>
-                          )}
-                        </>
-                      )}
-                  </Menu.Dropdown>
-                </Menu>
-              )}
-            </div>
-          </header>
-          {renderMembers(team.members, `team-${team.id}`)}
-        </section>
-      ))}
-
-      {/* Guests (parked in the live app; shown when showGuests is set). */}
-      {showGuests && dir.guests.length > 0 && (
-        <section className="portal-users__group">
-          <header className="portal-users__group-head">
-            <div className="portal-users__group-title">
-              <strong>{t("users.group.guests", "Guests")}</strong>
-              <span className="portal-users__group-desc">
-                {t(
-                  "users.group.guestsDesc",
-                  "External collaborators, scoped to what you shared. Editor only.",
-                )}
-              </span>
-            </div>
-            <span className="portal-users__group-count">
-              {t("users.group.guestCount", "{{count}} guest", {
-                count: dir.guests.length,
-              })}
-            </span>
-          </header>
-          {renderMembers(dir.guests, "guests")}
-        </section>
-      )}
-    </div>
+    <DataTable<Member>
+      columns={columns}
+      groups={groups}
+      rowKey={(m) => String(m.id)}
+      collapseLabels={{
+        showAll: (count) => t("users.showAll", "Show all {{count}}", { count }),
+        showLess: t("users.showLess", "Show less"),
+      }}
+    />
   );
 }
diff --git a/frontend/editor/src/portal/contexts/UIContext.tsx b/frontend/editor/src/portal/contexts/UIContext.tsx
index ba0676ab6d..b5ebada257 100644
--- a/frontend/editor/src/portal/contexts/UIContext.tsx
+++ b/frontend/editor/src/portal/contexts/UIContext.tsx
@@ -7,11 +7,6 @@ import {
 } from "react";
 
 interface UIContextValue {
-  searchOpen: boolean;
-  openSearch: () => void;
-  closeSearch: () => void;
-  toggleSearch: () => void;
-
   /** Off-canvas sidebar drawer on small screens (no-op chrome on desktop). */
   mobileNavOpen: boolean;
   openMobileNav: () => void;
@@ -32,7 +27,8 @@ interface UIContextValue {
    * modal pick its own default. Cleared back to `null` on close.
    */
   settingsInitialSection: string | null;
-  openSettings: (section?: string) => void;
+  settingsInitialFocus: string | null;
+  openSettings: (section?: string, focus?: string) => void;
   closeSettings: () => void;
 
   /**
@@ -81,7 +77,6 @@ function writeSidebarCollapsed(collapsed: boolean): void {
 }
 
 export function UIProvider({ children }: { children: ReactNode }) {
-  const [searchOpen, setSearchOpen] = useState(false);
   const [mobileNavOpen, setMobileNavOpen] = useState(false);
   const [sidebarCollapsed, setSidebarCollapsed] =
     useState(readSidebarCollapsed);
@@ -90,6 +85,9 @@ export function UIProvider({ children }: { children: ReactNode }) {
   const [settingsInitialSection, setSettingsInitialSection] = useState<
     string | null
   >(null);
+  const [settingsInitialFocus, setSettingsInitialFocus] = useState<
+    string | null
+  >(null);
   const [linkModalOpen, setLinkModalOpen] = useState(false);
   const [trialSetupRequested, setTrialSetupRequested] = useState(false);
   const [linkModalMode, setLinkModalMode] = useState<"link" | "reauth">("link");
@@ -101,16 +99,8 @@ export function UIProvider({ children }: { children: ReactNode }) {
 
   const value = useMemo<UIContextValue>(
     () => ({
-      // Opening any overlay (search, settings, link modal) dismisses the mobile
-      // nav drawer so overlays never stack on top of it.
-      searchOpen,
-      openSearch: () => {
-        setMobileNavOpen(false);
-        setSearchOpen(true);
-      },
-      closeSearch: () => setSearchOpen(false),
-      toggleSearch: () => setSearchOpen((o) => !o),
-
+      // Opening any overlay (settings, link modal) dismisses the mobile nav
+      // drawer so overlays never stack on top of it.
       mobileNavOpen,
       openMobileNav: () => setMobileNavOpen(true),
       closeMobileNav: () => setMobileNavOpen(false),
@@ -131,14 +121,17 @@ export function UIProvider({ children }: { children: ReactNode }) {
 
       settingsOpen,
       settingsInitialSection,
-      openSettings: (section?: string) => {
+      settingsInitialFocus,
+      openSettings: (section?: string, focus?: string) => {
         setMobileNavOpen(false);
         setSettingsInitialSection(section ?? null);
+        setSettingsInitialFocus(focus ?? null);
         setSettingsOpen(true);
       },
       closeSettings: () => {
         setSettingsOpen(false);
         setSettingsInitialSection(null);
+        setSettingsInitialFocus(null);
       },
 
       linkModalOpen,
@@ -152,6 +145,7 @@ export function UIProvider({ children }: { children: ReactNode }) {
           setReopenSettingsAfterLink("account-link");
           setSettingsOpen(false);
           setSettingsInitialSection(null);
+          setSettingsInitialFocus(null);
         }
         setLinkModalOpen(true);
       },
@@ -166,18 +160,19 @@ export function UIProvider({ children }: { children: ReactNode }) {
         setLinkModalMode("link");
         if (reopenSettingsAfterLink) {
           setSettingsInitialSection(reopenSettingsAfterLink);
+          setSettingsInitialFocus(null);
           setSettingsOpen(true);
           setReopenSettingsAfterLink(null);
         }
       },
     }),
     [
-      searchOpen,
       mobileNavOpen,
       sidebarCollapsed,
       assistantOpen,
       settingsOpen,
       settingsInitialSection,
+      settingsInitialFocus,
       linkModalOpen,
       linkModalMode,
       reopenSettingsAfterLink,
diff --git a/frontend/editor/src/portal/hooks/useFreeCreditsSummary.test.tsx b/frontend/editor/src/portal/hooks/useFreeCreditsSummary.test.tsx
new file mode 100644
index 0000000000..fb48250fed
--- /dev/null
+++ b/frontend/editor/src/portal/hooks/useFreeCreditsSummary.test.tsx
@@ -0,0 +1,110 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { cleanup, render, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { LinkProvider, type LinkState } from "@portal/contexts/LinkContext";
+import { useFreeCreditsSummary } from "@portal/hooks/useFreeCreditsSummary";
+
+const fetchWallet = vi.fn();
+vi.mock("@portal/api/billing", () => ({
+  fetchWallet: () => fetchWallet(),
+}));
+
+function Probe() {
+  const credits = useFreeCreditsSummary();
+  return (
+    <span data-testid="credits">
+      {credits ? `${credits.remaining}/${credits.total}` : "none"}
+    </span>
+  );
+}
+
+function renderFor(initialState: LinkState) {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  });
+  return render(
+    <QueryClientProvider client={client}>
+      <LinkProvider initialState={initialState}>
+        <Probe />
+      </LinkProvider>
+    </QueryClientProvider>,
+  ).getByTestId("credits");
+}
+
+describe("useFreeCreditsSummary (self-hosted) — wallet behind the link gate", () => {
+  beforeEach(() => {
+    // The figures persist across mounts now, so isolate the suite from itself.
+    localStorage.clear();
+    fetchWallet.mockReset();
+    fetchWallet.mockResolvedValue({
+      status: "free",
+      freeRemaining: 247,
+      freeAllowance: 500,
+    });
+  });
+
+  it("unlinked reads no wallet at all", async () => {
+    const el = renderFor("unlinked");
+    await waitFor(() => expect(el.textContent).toBe("none"));
+    expect(fetchWallet).not.toHaveBeenCalled();
+  });
+
+  it("linked surfaces the free grant", async () => {
+    const el = renderFor("linked-free");
+    await waitFor(() => expect(el.textContent).toBe("247/500"));
+  });
+
+  it("hides the meter once the team subscribes", async () => {
+    // The grant is a lifetime pool that survives subscribing, so a paying team
+    // would otherwise sit on a spent meter forever.
+    fetchWallet.mockResolvedValue({
+      status: "subscribed",
+      freeRemaining: 0,
+      freeAllowance: 500,
+    });
+    const el = renderFor("linked-subscribed");
+    // The row holds its space while the wallet loads, then drops once the
+    // answer says this team is paying.
+    await waitFor(() => expect(el.textContent).toBe("none"));
+  });
+
+  it("hides the meter when the wallet read fails", async () => {
+    fetchWallet.mockRejectedValue(new Error("saas unreachable"));
+    const el = renderFor("linked-subscribed");
+    await waitFor(() => expect(el.textContent).toBe("none"));
+  });
+
+  it("ignores cached figures once the instance is unlinked", async () => {
+    // The cache survives an unlink and nothing rewrites it afterwards, so the
+    // linkage gate has to cover the seed too, not just the fetch.
+    const linked = renderFor("linked-free");
+    await waitFor(() => expect(linked.textContent).toBe("247/500"));
+    cleanup();
+
+    fetchWallet.mockClear();
+    const unlinked = renderFor("unlinked");
+    expect(unlinked.textContent).toBe("none");
+    expect(fetchWallet).not.toHaveBeenCalled();
+  });
+
+  it("shows the last known figures while the wallet reloads", async () => {
+    // What stops the row popping in — and resizing the footer — every time the
+    // processor mounts.
+    const el = renderFor("linked-free");
+    await waitFor(() => expect(el.textContent).toBe("247/500"));
+    cleanup();
+
+    let release: (v: unknown) => void = () => {};
+    fetchWallet.mockReturnValue(
+      new Promise((resolve) => {
+        release = resolve;
+      }),
+    );
+    const second = renderFor("linked-free");
+    // Seeded before the refetch lands...
+    expect(second.textContent).toBe("247/500");
+    release({ status: "free", freeRemaining: 12, freeAllowance: 500 });
+    // ...then updated in place, without the row ever being absent.
+    await waitFor(() => expect(second.textContent).toBe("12/500"));
+  });
+});
diff --git a/frontend/editor/src/portal/hooks/useFreeCreditsSummary.ts b/frontend/editor/src/portal/hooks/useFreeCreditsSummary.ts
new file mode 100644
index 0000000000..3fd814ebb1
--- /dev/null
+++ b/frontend/editor/src/portal/hooks/useFreeCreditsSummary.ts
@@ -0,0 +1,65 @@
+import { useEffect, useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { useLink } from "@portal/contexts/LinkContext";
+import { fetchWallet } from "@portal/api/billing";
+import { qk } from "@portal/queries/keys";
+import {
+  readCachedCredits,
+  writeCachedCredits,
+  type CachedCredits,
+} from "@app/services/navFooterCache";
+import { type NavFooterCredits } from "@app/components/shared/navFooter/NavFooterCreditsRow";
+
+/**
+ * Free credits left on this team's allowance, for the processor's sidebar
+ * footer meter. Null hides the meter.
+ *
+ * This is the portal's own seam rather than the editor's {@code
+ * @app/hooks/useFreeCreditsSummary}, because self-hosted resolves {@code @app/*}
+ * as proprietary → core: the cloud wallet hook isn't in that cascade, and the
+ * implementation can't move down into proprietary either, since core/desktop
+ * builds ship no portal and must never resolve {@code @portal}. Keeping it here
+ * means only builds that actually have a processor pull in the wallet read.
+ *
+ * Self-hosted reads the same {@code GET /api/v1/payg/wallet} the Usage page's
+ * trial meter renders — {@code apiClient.saas} with the admin's Supabase JWT,
+ * since the wallet lives in the cloud even when the instance doesn't. Gated on
+ * linkage: an unlinked instance has no wallet to read.
+ *
+ * Free teams only, matching the editor and the Plan page. The grant is a
+ * lifetime pool that survives subscribing, so a paying team would otherwise sit
+ * on a permanent "0 of 500" in red; their usage lives on Usage & Billing.
+ */
+export function useFreeCreditsSummary(): NavFooterCredits | null {
+  const { isLinked } = useLink();
+  // Shared query key, so the footer rides the same cached snapshot as any other
+  // wallet reader rather than adding a fetch per mount.
+  const { data: wallet } = useQuery({
+    queryKey: qk.wallet(isLinked),
+    queryFn: fetchWallet,
+    enabled: isLinked,
+  });
+  // Shared with the editor's seam, so crossing between the two apps shows the
+  // figures the other one last saw rather than re-fetching into an empty row.
+  const [seed] = useState(readCachedCredits);
+
+  const live: CachedCredits | undefined = !wallet
+    ? undefined
+    : wallet.status === "subscribed"
+      ? null
+      : { remaining: wallet.freeRemaining, total: wallet.freeAllowance };
+
+  useEffect(() => {
+    // Only once linked: an unlinked instance never asks, so it has no answer of
+    // its own and must not overwrite what the editor recorded.
+    if (isLinked && live !== undefined) writeCachedCredits(live);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [wallet, isLinked]);
+
+  // Linkage gates the seed as well as the fetch. The cache outlives an unlink
+  // — nothing refetches or rewrites it once the instance stops asking — so
+  // without this an unlinked instance would keep showing the figures from when
+  // it was linked, indefinitely.
+  if (!isLinked) return null;
+  return (live !== undefined ? live : seed) ?? null;
+}
diff --git a/frontend/editor/src/portal/hooks/useOpenPlan.ts b/frontend/editor/src/portal/hooks/useOpenPlan.ts
new file mode 100644
index 0000000000..57b30c91d0
--- /dev/null
+++ b/frontend/editor/src/portal/hooks/useOpenPlan.ts
@@ -0,0 +1,13 @@
+import { useCallback } from "react";
+import { useView } from "@portal/contexts/ViewContext";
+
+/**
+ * Self-hosted processor: settings carries no Plan section (it is a cloud
+ * surface, and this build's registry has none), so the footer's credits row
+ * opens the portal's own Usage & Billing view instead — the same figures, on
+ * the surface this flavor actually owns.
+ */
+export function useOpenPlan(): (() => void) | null {
+  const { setActiveView } = useView();
+  return useCallback(() => setActiveView("usage"), [setActiveView]);
+}
diff --git a/frontend/editor/src/portal/hooks/usePortalSearchResults.test.ts b/frontend/editor/src/portal/hooks/usePortalSearchResults.test.ts
new file mode 100644
index 0000000000..4be356bab0
--- /dev/null
+++ b/frontend/editor/src/portal/hooks/usePortalSearchResults.test.ts
@@ -0,0 +1,442 @@
+import { createElement, type ReactNode } from "react";
+import { renderHook, waitFor } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+vi.mock("react-i18next", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("react-i18next")>();
+  return {
+    ...actual,
+    useTranslation: () => ({
+      t: (
+        key: string,
+        fallbackOrOptions?: string | Record<string, unknown>,
+      ) => {
+        if (key === "portal.policies.defaultName") {
+          return `${(fallbackOrOptions as Record<string, unknown>)?.category as string} Policy`;
+        }
+        if (typeof fallbackOrOptions === "string") return fallbackOrOptions;
+        const labels: Record<string, string> = {
+          "portal.nav.users": "Users",
+          "portal.nav.policies": "Policies",
+          "portal.nav.pipelines": "Pipelines",
+          "portal.nav.sources": "Sources",
+          "portal.nav.editor": "Editor",
+          "superSearch.group.processor": "Processor",
+          "superSearch.group.settings": "Settings",
+          "superSearch.group.tools": "Tools",
+          "settings.email.smtpHost": "SMTP host",
+          "settings.email.title": "Email",
+        };
+        return labels[key] ?? key;
+      },
+    }),
+  };
+});
+
+vi.mock("react-router-dom", () => ({
+  useNavigate: vi.fn(() => vi.fn()),
+}));
+
+vi.mock("@app/contexts/AppConfigContext", () => ({
+  useAppConfig: vi.fn(() => ({
+    config: {
+      isAdmin: false,
+      enableLogin: true,
+    },
+  })),
+}));
+
+vi.mock("@app/contexts/ToolRegistryContext", () => ({
+  useToolRegistry: vi.fn(() => ({
+    allTools: {},
+  })),
+}));
+
+vi.mock("@portal/contexts/TierContext", () => ({
+  useTier: vi.fn(() => ({
+    tier: "pro",
+  })),
+}));
+
+const mockOpenSettings = vi.fn();
+vi.mock("@portal/contexts/UIContext", () => ({
+  useUI: vi.fn(() => ({
+    openSettings: mockOpenSettings,
+  })),
+}));
+
+vi.mock("@app/data/toolsTaxonomy", () => ({
+  getToolUrlPath: vi.fn((id: string) => `/tools/${id}`),
+  isComingSoonTool: vi.fn(() => false),
+}));
+
+vi.mock("@app/data/settingsSearchIndex", () => ({
+  SETTINGS_SEARCH_INDEX: [
+    {
+      section: "email",
+      anchor: "smtp-host",
+      labelKey: "settings.email.smtpHost",
+      labelFallback: "SMTP host",
+      keywords: ["smtp"],
+    },
+  ],
+}));
+
+vi.mock("@app/data/settingsSectionRegistry", () => ({
+  SETTINGS_SECTION_REGISTRY: [
+    {
+      key: "email",
+      labelKey: "settings.email.title",
+      labelFallback: "Email",
+      keywords: ["smtp", "email"],
+      requiresLogin: true,
+    },
+  ],
+}));
+
+vi.mock("@app/data/settingsContentSearch", () => ({
+  findSettingsContentMatch: vi.fn(() => null),
+  buildMatchSnippet: vi.fn(() => ""),
+}));
+
+vi.mock("@app/data/processorSearchIndex", () => ({
+  PROCESSOR_SEARCH_INDEX: [
+    {
+      id: "users",
+      labelKey: "portal.nav.users",
+      labelFallback: "Users",
+      path: "/portal/users",
+      keywords: ["members"],
+    },
+    {
+      id: "policies",
+      labelKey: "portal.nav.policies",
+      labelFallback: "Policies",
+      path: "/portal/policies",
+      keywords: ["rules"],
+    },
+    {
+      id: "pipelines",
+      labelKey: "portal.nav.pipelines",
+      labelFallback: "Pipelines",
+      path: "/portal/pipelines",
+      keywords: ["automation"],
+    },
+    {
+      id: "sources",
+      labelKey: "portal.nav.sources",
+      labelFallback: "Sources",
+      path: "/portal/sources",
+      keywords: ["connectors"],
+    },
+    {
+      id: "docs",
+      labelKey: "portal.nav.docs",
+      labelFallback: "Documentation",
+      path: "/portal/docs",
+      keywords: ["docs"],
+    },
+  ],
+  // Tests run as an org admin; per-scope access gating has its own coverage
+  // in the stubbed suite.
+  isPortalEntityScopeAccessible: () => true,
+}));
+
+// The roster is fetched through the flavor-resolved usersBackend (the same
+// path the shared users query uses), not @portal/api/users directly.
+vi.mock("@app/portal/usersBackend", () => ({
+  usersBackend: {
+    fetchUsers: vi.fn(),
+  },
+}));
+
+// Keep the real (pure) assemblePolicies; only the network fetchers are mocked.
+vi.mock("@portal/api/policies", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@portal/api/policies")>()),
+  fetchPoliciesList: vi.fn(),
+  fetchPolicyRuns: vi.fn(),
+}));
+
+vi.mock("@portal/api/pipelines", () => ({
+  fetchPipelines: vi.fn(),
+}));
+
+vi.mock("@portal/api/sources", () => ({
+  fetchSources: vi.fn(),
+}));
+
+import type { CatalogueEntry } from "@portal/api/policies";
+import { fetchPoliciesList, fetchPolicyRuns } from "@portal/api/policies";
+import type { PipelineView } from "@portal/api/pipelines";
+import { fetchPipelines } from "@portal/api/pipelines";
+import { fetchSources } from "@portal/api/sources";
+import type { Member, UsersResponse } from "@portal/api/users";
+import { usersBackend } from "@app/portal/usersBackend";
+import {
+  rankDocsResults,
+  rankPortalPipelineResults,
+  rankPortalPolicyResults,
+} from "@portal/search/entitySearch";
+import { usePortalSearchResults } from "@portal/hooks/usePortalSearchResults";
+
+function makePolicyEntry(overrides?: Partial<CatalogueEntry>): CatalogueEntry {
+  return {
+    category: {
+      id: "security",
+      label: "Security",
+      tone: "purple",
+      desc: "Protect sensitive documents",
+    },
+    config: {
+      summary: "",
+      rules: [],
+      scopeLabel: "",
+      fields: [],
+      defaultOperations: [],
+    },
+    policy: {
+      category: {
+        id: "security",
+        label: "Security",
+        tone: "purple",
+        desc: "Protect sensitive documents",
+      },
+      config: {
+        summary: "",
+        rules: [],
+        scopeLabel: "",
+        fields: [],
+        defaultOperations: [],
+      },
+      state: {
+        configured: true,
+        status: "active",
+        sources: [],
+        scopeTypes: [],
+        reviewerEmail: "",
+        fieldValues: {},
+        backendId: "policy-security",
+      },
+      steps: [],
+      stats: {
+        enforced: 0,
+        dataProcessed: "0 B",
+        activeFor: "0d",
+      },
+      activity: [],
+    },
+    ...overrides,
+  };
+}
+
+function makePipelineView(
+  id: string,
+  name: string,
+  trigger = "manual",
+): PipelineView {
+  return {
+    id,
+    name,
+    enabled: true,
+    status: "active",
+    trigger,
+    sources: [],
+    steps: [],
+    output: "inline",
+    owner: "alice",
+  };
+}
+
+function makeMember(overrides?: Partial<Member>): Member {
+  return {
+    id: "member-1",
+    name: "Alice Admin",
+    email: "alice@example.com",
+    role: "admin",
+    status: "active",
+    lastActive: "1m ago",
+    ...overrides,
+  };
+}
+
+function makeUsersResponse(members: Member[]): UsersResponse {
+  return {
+    summary: {
+      totalMembers: members.length,
+      pendingInvites: 0,
+      seatsUsed: members.length,
+      seatLimit: null,
+    },
+    members,
+    roles: [],
+    access: {
+      tier: "pro",
+      seatsUsed: members.length,
+      seatLimit: null,
+    },
+    mailEnabled: true,
+    emailInvitesEnabled: true,
+  };
+}
+
+function createDeferred<T>() {
+  let resolve: ((value: T) => void) | undefined;
+  let reject: ((reason?: unknown) => void) | undefined;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return {
+    promise,
+    resolve: (value: T) => resolve?.(value),
+    reject: (reason?: unknown) => reject?.(reason),
+  };
+}
+
+function queryWrapper() {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  });
+  return ({ children }: { children: ReactNode }) =>
+    createElement(QueryClientProvider, { client }, children);
+}
+
+describe("usePortalSearchResults helpers", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockOpenSettings.mockReset();
+    vi.mocked(usersBackend.fetchUsers).mockResolvedValue(makeUsersResponse([]));
+    vi.mocked(fetchPoliciesList).mockResolvedValue([]);
+    vi.mocked(fetchPolicyRuns).mockResolvedValue([]);
+    vi.mocked(fetchPipelines).mockResolvedValue({ kpis: [], pipelines: [] });
+    vi.mocked(fetchSources).mockResolvedValue({ kpis: [], sources: [] });
+  });
+
+  it("ranks configured policies under the policies group", () => {
+    const openPolicy = vi.fn();
+    const results = rankPortalPolicyResults(
+      [makePolicyEntry()],
+      "security policy",
+      (key: string, options?: Record<string, unknown>) =>
+        key === "portal.policies.defaultName"
+          ? `${options?.category as string} Policy`
+          : key,
+      openPolicy,
+    );
+
+    expect(results).toHaveLength(1);
+    expect(results[0]).toMatchObject({
+      key: "portal-policy:security",
+      group: "portal-policies",
+      title: "Security Policy",
+    });
+
+    void results[0]?.onSelect();
+    expect(openPolicy).toHaveBeenCalledWith("security");
+  });
+
+  it("filters policy-backed records out of the pipelines group", () => {
+    const openPipeline = vi.fn();
+    const results = rankPortalPipelineResults(
+      [
+        makePipelineView("policy-security", "Security Policy"),
+        makePipelineView("custom-pipeline", "Nightly OCR"),
+      ],
+      "nightly",
+      new Set(["policy-security"]),
+      openPipeline,
+    );
+
+    expect(results.map((result) => result.key)).toEqual([
+      "portal-pipeline:custom-pipeline",
+    ]);
+  });
+
+  it("full-text searches the bundled docs, not just their titles", () => {
+    const navigate = vi.fn();
+    // "Tesseract" appears in the OCR doc body but in no doc title — a hit
+    // whose snippet contains it proves content search.
+    const results = rankDocsResults("Tesseract", navigate);
+    expect(results.length).toBeGreaterThan(0);
+    expect(results[0]?.subtitle).toMatch(/tesseract/i);
+
+    void results[0]?.onSelect();
+    expect(navigate).toHaveBeenCalledWith(expect.stringMatching(/\/docs#./));
+  });
+
+  it("forwards portal settings row hits with their focus anchor", () => {
+    const { result } = renderHook(
+      () => usePortalSearchResults("smtp", true, { scopeIds: ["settings"] }),
+      { wrapper: queryWrapper() },
+    );
+
+    const settingHit = result.current.flatResults[0];
+    expect(settingHit?.key).toBe("setting:email:smtp-host");
+
+    void settingHit?.onSelect();
+    expect(mockOpenSettings).toHaveBeenCalledWith("email", "smtp-host");
+    expect(usersBackend.fetchUsers).not.toHaveBeenCalled();
+  });
+
+  it("fetches only the requested entity scope", async () => {
+    vi.mocked(usersBackend.fetchUsers).mockResolvedValue(
+      makeUsersResponse([makeMember({ id: "member-2", name: "Alice" })]),
+    );
+
+    const { result } = renderHook(
+      () =>
+        usePortalSearchResults("alice", true, { scopeIds: ["portal-users"] }),
+      { wrapper: queryWrapper() },
+    );
+
+    await waitFor(() =>
+      expect(usersBackend.fetchUsers).toHaveBeenCalledTimes(1),
+    );
+    await waitFor(() => expect(result.current.loadingFiles).toBe(false));
+
+    expect(fetchPoliciesList).not.toHaveBeenCalled();
+    expect(fetchPipelines).not.toHaveBeenCalled();
+    expect(fetchSources).not.toHaveBeenCalled();
+    expect(result.current.groups.map((group) => group.id)).toEqual([
+      "portal-users",
+    ]);
+  });
+
+  it("reuses the in-flight query after close/reopen instead of sticking in loading", async () => {
+    const firstUsers = createDeferred<UsersResponse>();
+    vi.mocked(usersBackend.fetchUsers).mockImplementationOnce(
+      () => firstUsers.promise,
+    );
+
+    const { result, rerender } = renderHook(
+      ({ query }) =>
+        usePortalSearchResults(query, true, { scopeIds: ["portal-users"] }),
+      {
+        initialProps: { query: "alice" },
+        wrapper: queryWrapper(),
+      },
+    );
+
+    await waitFor(() => expect(result.current.loadingFiles).toBe(true));
+    expect(usersBackend.fetchUsers).toHaveBeenCalledTimes(1);
+
+    rerender({ query: "" });
+    await waitFor(() => expect(result.current.loadingFiles).toBe(false));
+
+    rerender({ query: "alice" });
+    await waitFor(() => expect(result.current.loadingFiles).toBe(true));
+    expect(usersBackend.fetchUsers).toHaveBeenCalledTimes(1);
+
+    firstUsers.resolve(
+      makeUsersResponse([
+        makeMember({ id: "member-3", name: "Alice Reloaded" }),
+      ]),
+    );
+
+    await waitFor(() => expect(result.current.loadingFiles).toBe(false));
+    expect(result.current.groups.map((group) => group.id)).toEqual([
+      "portal-users",
+    ]);
+  });
+});
diff --git a/frontend/editor/src/portal/hooks/usePortalSearchResults.tsx b/frontend/editor/src/portal/hooks/usePortalSearchResults.tsx
new file mode 100644
index 0000000000..b839d980d6
--- /dev/null
+++ b/frontend/editor/src/portal/hooks/usePortalSearchResults.tsx
@@ -0,0 +1,321 @@
+import { useCallback, useMemo } from "react";
+import { useTranslation } from "react-i18next";
+import { useNavigate } from "react-router-dom";
+import { useQuery } from "@tanstack/react-query";
+import { getToolUrlPath } from "@app/data/toolsTaxonomy";
+import { isPortalEntityScopeAccessible } from "@app/data/processorSearchIndex";
+import { useAppConfig } from "@app/contexts/AppConfigContext";
+import { PORTAL_HIDDEN_SECTION_KEYS } from "@portal/components/PortalSettingsHost";
+import { useToolRegistry } from "@app/contexts/ToolRegistryContext";
+import {
+  assembleSuperSearchGroups,
+  rankSettingsResults,
+  rankToolResults,
+  useSearchScopeFilter,
+} from "@app/hooks/useSuperSearch";
+import {
+  PORTAL_ENTITY_SCOPE_DEFS,
+  PORTAL_DOCS_SCOPE_ID,
+  type SuperSearchGates,
+  type SuperSearchGroup,
+  type SuperSearchGroupId,
+  type SuperSearchQueryOptions,
+  type SuperSearchScope,
+  type UseSuperSearchResult,
+} from "@app/types/superSearch";
+import type { ToolId } from "@app/types/toolId";
+import { assignLocation, openExternalUrl } from "@app/utils/safeNavigation";
+import { usersBackend } from "@app/portal/usersBackend";
+import {
+  assemblePolicies,
+  fetchPoliciesList,
+  fetchPolicyRuns,
+} from "@portal/api/policies";
+import { fetchPipelines } from "@portal/api/pipelines";
+import { fetchSources } from "@portal/api/sources";
+import { EDITOR_IS_SAME_APP, EDITOR_URL } from "@portal/auth/editorUrl";
+import { useTier } from "@portal/contexts/TierContext";
+import { useUI } from "@portal/contexts/UIContext";
+import { qk } from "@portal/queries/keys";
+import {
+  buildProcessorEntityGroups,
+  defaultPortalEntityScopes,
+  isDocsSearchable,
+  isVisiblePortalScope,
+  withPortalEntityDependencies,
+  type ProcessorEntities,
+} from "@portal/search/entitySearch";
+
+const EDITOR_GROUP_ORDER: SuperSearchGroupId[] = ["tools"];
+const SETTINGS_GROUP_ORDER: SuperSearchGroupId[] = ["settings"];
+const PROCESSOR_SECTION_LABEL_KEY = "superSearch.group.processor";
+const PROCESSOR_SECTION_LABEL_FALLBACK = "Processor";
+const SETTINGS_SECTION_LABEL_KEY = "superSearch.group.settings";
+const SETTINGS_SECTION_LABEL_FALLBACK = "Settings";
+const EDITOR_SECTION_LABEL_KEY = "portal.nav.editor";
+const EDITOR_SECTION_LABEL_FALLBACK = "Editor";
+
+/**
+ * Cross-origin editor URL for a tool. Only used when a separately-hosted
+ * editor is configured — the same-app case routes client-side instead: on
+ * bundled deploys the backend serves the frontend and 401s unauthenticated
+ * document GETs (the JWT lives in localStorage, so a full page load carries
+ * no credentials), which would bounce every tool hop to /login.
+ */
+function externalEditorHref(path: string): string {
+  return EDITOR_URL.replace(/\/$/, "") + path;
+}
+
+/**
+ * The portal bar's filter chips — every lane the editor offers except Files
+ * (files only open in the editor) and Pages (the sidebar covers navigation).
+ * Ordered to match the dropdown's section priority. Lanes whose data source
+ * refuses this session (the users roster for non-admins on self-hosted) get
+ * no chip — an offered lane must be able to return results.
+ */
+export function usePortalSearchScopes(): SuperSearchScope[] {
+  const { t } = useTranslation();
+  const { config } = useAppConfig();
+  const isAdmin = config?.isAdmin ?? false;
+
+  return useMemo(
+    () => [
+      ...PORTAL_ENTITY_SCOPE_DEFS.filter(
+        (def) =>
+          isVisiblePortalScope(def.id) &&
+          isPortalEntityScopeAccessible(def.id, isAdmin),
+      ).map((def) => ({
+        id: def.id,
+        label: t(def.labelKey, def.labelFallback),
+        aliases: [...def.aliases],
+      })),
+      ...(isDocsSearchable()
+        ? [
+            {
+              id: PORTAL_DOCS_SCOPE_ID,
+              label: t("superSearch.group.docs", "Docs"),
+              aliases: ["doc", "docs", "documentation"],
+            },
+          ]
+        : []),
+      {
+        id: "settings",
+        label: t("superSearch.group.settings", "Settings"),
+        aliases: ["setting", "settings"],
+      },
+      {
+        id: "tools",
+        label: t("superSearch.group.tools", "Tools"),
+        aliases: ["tool", "tools"],
+      },
+    ],
+    [t, isAdmin],
+  );
+}
+
+/**
+ * The portal's results provider for the shared super search bar: files stay
+ * editor-only, portal entity results are grouped under a Processor section,
+ * and the shared tools/settings lanes sit under an Editor section. Portal page
+ * routes themselves stay out of the portal search — once you're in the portal,
+ * the entities are the useful targets.
+ */
+export function usePortalSearchResults(
+  query: string,
+  active: boolean,
+  options?: SuperSearchQueryOptions,
+): UseSuperSearchResult {
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const { openSettings } = useUI();
+  const { allTools } = useToolRegistry();
+  const { config } = useAppConfig();
+  const { tier } = useTier();
+
+  const trimmed = query.trim();
+  const { scopeEnabled } = useSearchScopeFilter(options);
+  const requestedEntityScopes = useMemo(() => {
+    if (!active || trimmed.length === 0) return new Set<string>();
+    const enabled = defaultPortalEntityScopes(config?.isAdmin ?? false).filter(
+      (scopeId) => scopeEnabled(scopeId),
+    );
+    return new Set<string>(withPortalEntityDependencies(enabled));
+  }, [active, scopeEnabled, trimmed, config?.isAdmin]);
+
+  // Entity data rides the portal's shared query layer — the same keys the
+  // views use, so searching warms the view (and vice versa) and the client's
+  // staleTime/retry policy replaces bespoke fetch discipline. `enabled` keeps
+  // each lane's fetch behind its scope chip and the active-query gate.
+  const usersQuery = useQuery({
+    queryKey: qk.usersRoster(tier),
+    queryFn: () => usersBackend.fetchUsers(tier),
+    enabled: requestedEntityScopes.has("portal-users"),
+  });
+  const policiesListQuery = useQuery({
+    queryKey: qk.policiesList(),
+    queryFn: fetchPoliciesList,
+    enabled: requestedEntityScopes.has("portal-policies"),
+  });
+  const policyRunsQuery = useQuery({
+    queryKey: qk.policyRuns(),
+    queryFn: fetchPolicyRuns,
+    enabled: requestedEntityScopes.has("portal-policies"),
+  });
+  const pipelinesQuery = useQuery({
+    queryKey: qk.pipelines(),
+    queryFn: fetchPipelines,
+    enabled: requestedEntityScopes.has("portal-pipelines"),
+  });
+  const sourcesQuery = useQuery({
+    queryKey: qk.sources(),
+    queryFn: fetchSources,
+    enabled: requestedEntityScopes.has("portal-sources"),
+  });
+
+  // Loading only counts for lanes the current search actually requests — a
+  // fetch left in flight after its lane was deselected (or the bar closed)
+  // must not hold the dropdown's no-results gate open.
+  const loadingEntities =
+    (requestedEntityScopes.has("portal-users") && usersQuery.isLoading) ||
+    (requestedEntityScopes.has("portal-policies") &&
+      (policiesListQuery.isLoading || policyRunsQuery.isLoading)) ||
+    (requestedEntityScopes.has("portal-pipelines") &&
+      pipelinesQuery.isLoading) ||
+    (requestedEntityScopes.has("portal-sources") && sourcesQuery.isLoading);
+
+  const entities = useMemo<ProcessorEntities>(
+    () => ({
+      users: usersQuery.data?.members ?? [],
+      policies: policiesListQuery.data
+        ? assemblePolicies(policiesListQuery.data, policyRunsQuery.data ?? [])
+            .catalogue
+        : [],
+      pipelines: pipelinesQuery.data?.pipelines ?? [],
+      sources: sourcesQuery.data?.sources ?? [],
+    }),
+    [
+      usersQuery.data,
+      policiesListQuery.data,
+      policyRunsQuery.data,
+      pipelinesQuery.data,
+      sourcesQuery.data,
+    ],
+  );
+
+  const openTool = useCallback(
+    (id: ToolId) => {
+      // Link tools have no in-editor UI — navigating to a tool URL for one
+      // lands on a "tool not found" panel. Open their destination directly,
+      // matching how the editor's tool lists treat them.
+      const tool = allTools[id];
+      if (tool?.link) {
+        openExternalUrl(tool.link);
+        return;
+      }
+      const path = getToolUrlPath(id);
+      if (EDITOR_IS_SAME_APP) {
+        // One SPA: swap route-sets through the router. The portal tree
+        // unmounts and the editor mounts fresh at the tool URL, so its
+        // URL-driven tool init runs exactly as it does on a cold load.
+        navigate(path);
+      } else {
+        assignLocation(externalEditorHref(path));
+      }
+    },
+    [allTools, navigate],
+  );
+
+  const openSettingsSection = useCallback(
+    (section: string, anchor?: string) => openSettings(section, anchor),
+    [openSettings],
+  );
+
+  const gates = useMemo<SuperSearchGates | null>(
+    () =>
+      config
+        ? {
+            isAdmin: config.isAdmin ?? false,
+            loginEnabled: config.enableLogin ?? false,
+            showSettingsWhenNoLogin: config.showSettingsWhenNoLogin ?? true,
+          }
+        : null,
+    [config],
+  );
+
+  const entityGroups = useMemo<SuperSearchGroup[]>(
+    () =>
+      buildProcessorEntityGroups(entities, trimmed, t, navigate, {
+        scopeEnabled,
+      }),
+    [entities, trimmed, t, navigate, scopeEnabled],
+  );
+
+  const groups = useMemo(() => {
+    // Section order: Processor first, Settings second, Editor last.
+    const settingsGroups = assembleSuperSearchGroups(
+      {
+        settings: scopeEnabled("settings")
+          ? rankSettingsResults(
+              trimmed,
+              t,
+              gates,
+              openSettingsSection,
+              undefined,
+              PORTAL_HIDDEN_SECTION_KEYS,
+            )
+          : [],
+      },
+      t,
+      SETTINGS_GROUP_ORDER,
+    ).map((group) => ({
+      ...group,
+      sectionLabel: t(
+        SETTINGS_SECTION_LABEL_KEY,
+        SETTINGS_SECTION_LABEL_FALLBACK,
+      ),
+    }));
+
+    const editorGroups = assembleSuperSearchGroups(
+      {
+        tools: scopeEnabled("tools")
+          ? rankToolResults(allTools, trimmed, openTool)
+          : [],
+      },
+      t,
+      EDITOR_GROUP_ORDER,
+    ).map((group) => ({
+      ...group,
+      sectionLabel: t(EDITOR_SECTION_LABEL_KEY, EDITOR_SECTION_LABEL_FALLBACK),
+    }));
+
+    return [
+      ...entityGroups.map((group) => ({
+        ...group,
+        sectionLabel: t(
+          PROCESSOR_SECTION_LABEL_KEY,
+          PROCESSOR_SECTION_LABEL_FALLBACK,
+        ),
+      })),
+      ...settingsGroups,
+      ...editorGroups,
+    ];
+  }, [
+    entityGroups,
+    gates,
+    openSettingsSection,
+    openTool,
+    scopeEnabled,
+    allTools,
+    t,
+    trimmed,
+  ]);
+
+  const flatResults = useMemo(
+    () => groups.flatMap((group) => group.results),
+    [groups],
+  );
+
+  // loadingFiles doubles as "an async source is still loading" for the
+  // dropdown's no-results gate — here that's the entity fetch.
+  return { groups, flatResults, loadingFiles: loadingEntities };
+}
diff --git a/frontend/editor/src/portal/mocks/fileRunEvents.ts b/frontend/editor/src/portal/mocks/fileRunEvents.ts
index 31c97e1088..0e0fd25679 100644
--- a/frontend/editor/src/portal/mocks/fileRunEvents.ts
+++ b/frontend/editor/src/portal/mocks/fileRunEvents.ts
@@ -46,6 +46,7 @@ export const FILE_RUN_EVENTS: FileRunEvent[] = [
     detail: "The PDF Document is passworded and the password was not provided",
     policyId: "policy-contract-redaction",
     runId: "run-8841",
+    sourceId: null,
     fileId: "f-8841a",
     actor: "dana@example.com",
     occurrences: 1,
@@ -74,15 +75,70 @@ export const FILE_RUN_EVENTS: FileRunEvent[] = [
       "Policy run failed: Tool returned HTTP 500 INTERNAL_SERVER_ERROR for /api/v1/misc/ocr-pdf",
     policyId: "policy-invoice-ocr",
     runId: "run-8839",
+    sourceId: "src-s3-invoices",
     fileId: "f-8839b",
-    actor: "sam@example.com",
+    // Unattended: arrived from a bucket, so there is no user to name.
+    actor: null,
     occurrences: 12,
-    status: "ACKNOWLEDGED",
-    statusActor: "ops@example.com",
-    actions: [acknowledgeOffer(), dismissOffer()],
+    status: "NEW",
+    statusActor: null,
+    // Nothing to fix, so the only decision is whether to clear it.
+    actions: [dismissOffer()],
     createdAt: NOW - 6 * HOUR,
     lastSeenAt: NOW - 2 * HOUR,
   },
+  {
+    id: "fre-editor-1",
+    kindId: "UNKNOWN",
+    stage: "INTERNAL",
+    severity: "ERROR",
+    scope: "FILE",
+    origin: "TOOL",
+    remedy: "PERMANENT",
+    titleKey: "portal.failures.kind.unknown.title",
+    descriptionKey: "portal.failures.kind.unknown.description",
+    defaultTitle: "Unrecognised failure",
+    // Reported by the user's own client, so there is no run to reference.
+    detail: "compress: Request failed with status code 500",
+    policyId: null,
+    runId: null,
+    sourceId: null,
+    fileId: "f-editor-77",
+    actor: "priya@example.com",
+    occurrences: 1,
+    status: "NEW",
+    statusActor: null,
+    actions: [dismissOffer()],
+    createdAt: NOW - 3 * HOUR,
+    lastSeenAt: NOW - 3 * HOUR,
+  },
+  {
+    id: "fre-editor-2",
+    kindId: "INPUT_PASSWORD_PROTECTED",
+    stage: "INPUT",
+    severity: "ERROR",
+    scope: "FILE",
+    origin: "TOOL",
+    remedy: "NEEDS_USER_INPUT",
+    titleKey: "portal.failures.kind.inputPasswordProtected.title",
+    descriptionKey: "portal.failures.kind.inputPasswordProtected.description",
+    defaultTitle: "Password-protected document",
+    detail: "remove-password: The PDF Document is passworded",
+    policyId: null,
+    runId: null,
+    sourceId: null,
+    fileId: "f-editor-91",
+    // A colleague's own upload: the reviewer sees it, but unlocking is not theirs to do.
+    actor: "sam@example.com",
+    occurrences: 1,
+    status: "NEW",
+    statusActor: null,
+    // A colleague's own upload. Nothing here acts on the document, so triage is just
+    // acknowledging or clearing the row.
+    actions: [dismissOffer(true, "portal.failures.action.dismissSkipFile")],
+    createdAt: NOW - 4 * HOUR,
+    lastSeenAt: NOW - 4 * HOUR,
+  },
   {
     id: "fre-3",
     kindId: "INPUT_PASSWORD_PROTECTED",
@@ -97,6 +153,7 @@ export const FILE_RUN_EVENTS: FileRunEvent[] = [
     detail: "The PDF Document is passworded and the password was not provided",
     policyId: "policy-contract-redaction",
     runId: "run-8790",
+    sourceId: null,
     fileId: "f-8790c",
     actor: "dana@example.com",
     // Closed rows keep their actions, disabled with a reason, so the reviewer
diff --git a/frontend/editor/src/portal/mocks/handlers/fileRunEvents.ts b/frontend/editor/src/portal/mocks/handlers/fileRunEvents.ts
index 297298134e..c6440fb13b 100644
--- a/frontend/editor/src/portal/mocks/handlers/fileRunEvents.ts
+++ b/frontend/editor/src/portal/mocks/handlers/fileRunEvents.ts
@@ -26,9 +26,13 @@ export const fileRunEventsHandlers = [
     const status = url.searchParams.get("status");
     const kindId = url.searchParams.get("kindId");
 
+    // Mirrors the server: no status asked for means the open queue, so a dismissed
+    // row leaves the list instead of sitting there with its buttons greyed out.
     const filtered = events.filter(
       (event) =>
-        (!status || event.status === status) &&
+        (status
+          ? event.status === status
+          : event.status !== "DISMISSED" && event.status !== "RESOLVED") &&
         (!kindId || event.kindId === kindId),
     );
     return HttpResponse.json({
diff --git a/frontend/editor/src/portal/mocks/handlers/index.ts b/frontend/editor/src/portal/mocks/handlers/index.ts
index d5428b1853..13b22d6941 100644
--- a/frontend/editor/src/portal/mocks/handlers/index.ts
+++ b/frontend/editor/src/portal/mocks/handlers/index.ts
@@ -1,7 +1,6 @@
 import { assistantHandlers } from "@portal/mocks/handlers/assistant";
 import { authHandlers } from "@portal/mocks/handlers/auth";
 import { notificationsHandlers } from "@portal/mocks/handlers/notifications";
-import { searchHandlers } from "@portal/mocks/handlers/search";
 import { pipelinesHandlers } from "@portal/mocks/handlers/pipelines";
 import { sourcesHandlers } from "@portal/mocks/handlers/sources";
 import { infrastructureHandlers } from "@portal/mocks/handlers/infrastructure";
@@ -21,7 +20,6 @@ export const handlers = [
   ...authHandlers,
   ...notificationsHandlers,
   ...assistantHandlers,
-  ...searchHandlers,
   ...pipelinesHandlers,
   ...sourcesHandlers,
   ...infrastructureHandlers,
diff --git a/frontend/editor/src/portal/mocks/handlers/infrastructure.ts b/frontend/editor/src/portal/mocks/handlers/infrastructure.ts
index 715175978a..58c41a7f3b 100644
--- a/frontend/editor/src/portal/mocks/handlers/infrastructure.ts
+++ b/frontend/editor/src/portal/mocks/handlers/infrastructure.ts
@@ -1,14 +1,6 @@
 import { http, HttpResponse, delay } from "msw";
 import type { Tier } from "@portal/contexts/TierContext";
-import {
-  apiKeysFor,
-  auditLogFor,
-  modelsResponseFor,
-  recentDeploymentsFor,
-  regionsFor,
-  securityFor,
-  storageFor,
-} from "@portal/mocks/infrastructure";
+import { apiKeysFor, auditLogFor } from "@portal/mocks/infrastructure";
 
 function tierFrom(request: Request): Tier {
   const url = new URL(request.url);
@@ -16,15 +8,6 @@ function tierFrom(request: Request): Tier {
 }
 
 export const infrastructureHandlers = [
-  http.get("/v1/infrastructure/deployments", async ({ request }) => {
-    await delay(120);
-    const tier = tierFrom(request);
-    return HttpResponse.json({
-      regions: regionsFor(tier),
-      recent: recentDeploymentsFor(tier),
-    });
-  }),
-
   // Real backend route; wildcard prefix intercepts both local (same-origin) and
   // SaaS (absolute) callers.
   http.get(
@@ -68,21 +51,6 @@ export const infrastructureHandlers = [
     },
   ),
 
-  http.get("/v1/infrastructure/security", async ({ request }) => {
-    await delay(120);
-    return HttpResponse.json(securityFor(tierFrom(request)));
-  }),
-
-  http.get("/v1/infrastructure/models", async ({ request }) => {
-    await delay(120);
-    return HttpResponse.json(modelsResponseFor(tierFrom(request)));
-  }),
-
-  http.get("/v1/infrastructure/storage", async ({ request }) => {
-    await delay(120);
-    return HttpResponse.json(storageFor(tierFrom(request)));
-  }),
-
   // Mirrors the real backend route. Wildcard prefix so it intercepts both the
   // self-hosted apiClient.local call (same-origin) and the SaaS apiClient.saas
   // call (absolute VITE_SAAS_API_URL).
diff --git a/frontend/editor/src/portal/mocks/handlers/pipelines.ts b/frontend/editor/src/portal/mocks/handlers/pipelines.ts
index 0158d1e168..ed7cec1626 100644
--- a/frontend/editor/src/portal/mocks/handlers/pipelines.ts
+++ b/frontend/editor/src/portal/mocks/handlers/pipelines.ts
@@ -152,9 +152,16 @@ function toView(policy: StoredPolicy): PipelineView {
   };
 }
 
-function buildKpis(): PipelineKpi[] {
-  const total = store.length;
-  const active = store.filter((p) => p.enabled).length;
+// Mirrors the backend PolicyOverviewService: hide frontend/catalogue policies (a categoryId in
+// output options). A folder-watch trigger is still a normal pipeline and stays.
+function isPipeline(policy: StoredPolicy): boolean {
+  const categoryId = policy.output?.options?.categoryId;
+  return !(typeof categoryId === "string" && categoryId.length > 0);
+}
+
+function buildKpis(policies: StoredPolicy[]): PipelineKpi[] {
+  const total = policies.length;
+  const active = policies.filter((p) => p.enabled).length;
   return [
     { value: total, description: "pipelines" },
     { value: active, description: "running automatically" },
@@ -163,10 +170,11 @@ function buildKpis(): PipelineKpi[] {
 }
 
 function buildOverview(): PipelinesOverviewResponse {
-  const pipelines = store
+  const visible = store.filter(isPipeline);
+  const pipelines = visible
     .map(toView)
     .sort((a, b) => a.name.localeCompare(b.name));
-  return { kpis: buildKpis(), pipelines };
+  return { kpis: buildKpis(visible), pipelines };
 }
 
 export const pipelinesHandlers = [
diff --git a/frontend/editor/src/portal/mocks/handlers/search.ts b/frontend/editor/src/portal/mocks/handlers/search.ts
deleted file mode 100644
index b62e8bc910..0000000000
--- a/frontend/editor/src/portal/mocks/handlers/search.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-import { http, HttpResponse } from "msw";
-import { QUICK_ACTIONS } from "@portal/mocks/search";
-
-export const searchHandlers = [
-  http.get("/v1/search/quick-actions", () => {
-    return HttpResponse.json(QUICK_ACTIONS);
-  }),
-];
diff --git a/frontend/editor/src/portal/mocks/infrastructure.ts b/frontend/editor/src/portal/mocks/infrastructure.ts
index 560a3e2c31..bb6b88f4f8 100644
--- a/frontend/editor/src/portal/mocks/infrastructure.ts
+++ b/frontend/editor/src/portal/mocks/infrastructure.ts
@@ -4,9 +4,7 @@
  * mocks/handlers/ serve the fixture data over the intercepted apiClient.local.json() calls.
  * Components never reach into this module directly.
  *
- * Everything here is tier-scaled deterministically: free sees a single region
- * and a trimmed slice of every list, pro adds a second region and the IP
- * allowlist, enterprise unlocks the full topology + compliance posture.
+ * Everything here is tier-scaled deterministically: free sees the least of every list, enterprise the lot.
  *
  * Once a real backend exists the MSW handlers stop being registered and these
  * fixtures can be deleted (or kept as test seeds).
@@ -19,146 +17,8 @@ import type {
   AuditEvent,
   AuditLogResponse,
   AuditSummary,
-  ComplianceAttestation,
-  ComplianceCert,
-  DeploymentRegion,
-  IpAllowEntry,
-  KeyManagement,
-  ModelEntry,
-  ModelsResponse,
-  RecentDeployment,
-  RoutingRule,
-  SecurityConfig,
-  StorageConfig,
-  StorageProvider,
 } from "@portal/api/infrastructure";
 
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Deployments                                                              */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-const REGION_US_EAST: DeploymentRegion = {
-  name: "US East (N. Virginia)",
-  code: "us-east-1",
-  latencyMs: 41,
-  load: 0.62,
-  status: "healthy",
-  version: "v3.4.2",
-  uptime: 0.99987,
-  instances: 18,
-  throughput: 2140,
-  p99Ms: 287,
-};
-
-const REGION_US_WEST: DeploymentRegion = {
-  name: "US West (Oregon)",
-  code: "us-west-2",
-  latencyMs: 53,
-  load: 0.74,
-  status: "healthy",
-  version: "v3.4.2",
-  uptime: 0.99971,
-  instances: 12,
-  throughput: 1480,
-  p99Ms: 331,
-};
-
-const REGION_EU_WEST: DeploymentRegion = {
-  name: "EU West (Ireland)",
-  code: "eu-west-1",
-  latencyMs: 68,
-  load: 0.83,
-  status: "degraded",
-  version: "v3.4.1",
-  uptime: 0.99924,
-  instances: 9,
-  throughput: 1120,
-  p99Ms: 521,
-};
-
-// A region mid-incident: zero healthy instances, traffic drained away.
-const REGION_AP_SOUTHEAST: DeploymentRegion = {
-  name: "Asia Pacific (Singapore)",
-  code: "ap-southeast-1",
-  latencyMs: 0,
-  load: 0,
-  status: "down",
-  version: "v3.4.1",
-  uptime: 0.98612,
-  instances: 0,
-  throughput: 0,
-  p99Ms: 0,
-};
-
-export function regionsFor(tier: Tier): DeploymentRegion[] {
-  if (tier === "free") return [REGION_US_EAST];
-  if (tier === "pro") return [REGION_US_EAST, REGION_US_WEST];
-  return [REGION_US_EAST, REGION_US_WEST, REGION_EU_WEST, REGION_AP_SOUTHEAST];
-}
-
-const RECENT_DEPLOYMENTS_ALL: RecentDeployment[] = [
-  {
-    id: "dep-1",
-    version: "v3.4.2",
-    environment: "production",
-    product: "Extraction engine",
-    status: "live",
-    deployedBy: "ci-bot",
-    timestamp: "8m ago",
-  },
-  {
-    id: "dep-2",
-    version: "v3.4.2-rc4",
-    environment: "canary",
-    product: "Redaction service",
-    status: "rolling",
-    deployedBy: "maria.chen",
-    timestamp: "34m ago",
-  },
-  {
-    id: "dep-3",
-    version: "v2.9.0",
-    environment: "production",
-    product: "API gateway",
-    status: "live",
-    deployedBy: "ci-bot",
-    timestamp: "2h ago",
-  },
-  {
-    id: "dep-4",
-    version: "v3.4.1",
-    environment: "staging",
-    product: "OCR worker pool",
-    status: "queued",
-    deployedBy: "devon.park",
-    timestamp: "3h ago",
-  },
-  {
-    id: "dep-5",
-    version: "v3.3.9",
-    environment: "production",
-    product: "Extraction engine",
-    status: "rolled-back",
-    deployedBy: "maria.chen",
-    timestamp: "yesterday",
-  },
-  {
-    id: "dep-6",
-    version: "v3.3.8",
-    environment: "production",
-    product: "Webhook dispatcher",
-    status: "live",
-    deployedBy: "ci-bot",
-    timestamp: "2d ago",
-  },
-];
-
-export function recentDeploymentsFor(tier: Tier): RecentDeployment[] {
-  if (tier === "free") return RECENT_DEPLOYMENTS_ALL.slice(0, 2);
-  if (tier === "pro") return RECENT_DEPLOYMENTS_ALL.slice(0, 4);
-  return RECENT_DEPLOYMENTS_ALL;
-}
-
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  API Keys                                                                 */
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -220,288 +80,6 @@ export function apiKeysFor(tier: Tier): ApiKeysResponse {
   return { keys };
 }
 
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Security                                                                 */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-const CERTS_FULL: ComplianceCert[] = [
-  {
-    id: "soc2",
-    name: "SOC 2 Type II",
-    status: "certified",
-    detail: "Audited Apr 2026 · Coalfire",
-  },
-  {
-    id: "iso",
-    name: "ISO 27001",
-    status: "certified",
-    detail: "Cert #IS-774201 · valid to 2027",
-  },
-  {
-    id: "hipaa",
-    name: "HIPAA",
-    status: "certified",
-    detail: "BAA available · PHI-eligible",
-  },
-  {
-    id: "gdpr",
-    name: "GDPR",
-    status: "certified",
-    detail: "EU SCCs · DPA on file",
-  },
-];
-
-const CERTS_FREE: ComplianceCert[] = [
-  {
-    id: "soc2",
-    name: "SOC 2 Type II",
-    status: "certified",
-    detail: "Inherited — Stirling platform",
-  },
-  {
-    id: "iso",
-    name: "ISO 27001",
-    status: "certified",
-    detail: "Inherited — Stirling platform",
-  },
-  {
-    id: "hipaa",
-    name: "HIPAA",
-    status: "not-started",
-    detail: "Requires a paid plan + BAA",
-  },
-  {
-    id: "gdpr",
-    name: "GDPR",
-    status: "in-progress",
-    detail: "Standard EU processing terms",
-  },
-];
-
-const IP_ALLOWLIST: IpAllowEntry[] = [
-  {
-    id: "ip-1",
-    label: "Corp VPN egress",
-    cidr: "52.14.0.0/16",
-    addedBy: "maria.chen",
-    added: "Feb 11, 2026",
-  },
-  {
-    id: "ip-2",
-    label: "Data centre — IAD",
-    cidr: "18.221.0.0/16",
-    addedBy: "devon.park",
-    added: "Jan 4, 2026",
-  },
-  {
-    id: "ip-3",
-    label: "On-call jump host",
-    cidr: "203.0.113.7/32",
-    addedBy: "maria.chen",
-    added: "Dec 19, 2025",
-  },
-];
-
-// Stirling-managed key custody — what free/pro tiers run on. No key ops on the
-// customer side, so the provider/key fields describe Stirling's own KMS.
-const KEY_MANAGED: KeyManagement = {
-  mode: "managed",
-  provider: "Stirling KMS",
-  keyId: "arn:stirling:kms:us-east-1:platform/cmk-default",
-  algorithm: "AES-256-GCM",
-  lastRotated: "32 days ago",
-  rotationPolicy: "Automatic · every 90 days",
-  customerManaged: false,
-};
-
-const KEY_HYOK: KeyManagement = {
-  mode: "hyok",
-  provider: "AWS CloudHSM (customer)",
-  keyId: "arn:aws:kms:eu-west-1:418xxxx:key/2a7e-hyok",
-  algorithm: "AES-256-GCM · external key store",
-  lastRotated: "5 days ago",
-  rotationPolicy: "Customer-controlled · keys never leave your HSM",
-  customerManaged: true,
-};
-
-// Full attestation set an enterprise contract is covered by.
-const ATTESTATIONS_FULL: ComplianceAttestation[] = [
-  {
-    id: "soc2",
-    name: "SOC 2 Type II",
-    framework: "AICPA Trust Services",
-    status: "attested",
-    detail: "Type II · audited Apr 2026 · Coalfire",
-    reportUrl: "/v1/infrastructure/security/reports/soc2",
-  },
-  {
-    id: "iso27001",
-    name: "ISO 27001",
-    framework: "ISO/IEC 27001:2022",
-    status: "attested",
-    detail: "Cert #IS-774201 · valid to 2027",
-    reportUrl: "/v1/infrastructure/security/reports/iso27001",
-  },
-  {
-    id: "hipaa",
-    name: "HIPAA",
-    framework: "US healthcare · PHI",
-    status: "attested",
-    detail: "BAA signed · PHI-eligible workloads",
-    reportUrl: "/v1/infrastructure/security/reports/hipaa",
-  },
-  {
-    id: "gdpr",
-    name: "GDPR",
-    framework: "EU data protection",
-    status: "attested",
-    detail: "EU SCCs · DPA on file · EU residency",
-    reportUrl: "/v1/infrastructure/security/reports/gdpr",
-  },
-  {
-    id: "pci",
-    name: "PCI DSS",
-    framework: "Payment card data",
-    status: "in-scope",
-    detail: "SAQ-D in progress · QSA assessment Q3",
-    reportUrl: null,
-  },
-];
-
-// What lower tiers can claim: the platform-inherited attestations only. HIPAA
-// and PCI require a paid contract + signed paperwork, so they read as
-// not-applicable until the customer upgrades.
-const ATTESTATIONS_FREE: ComplianceAttestation[] = [
-  {
-    id: "soc2",
-    name: "SOC 2 Type II",
-    framework: "AICPA Trust Services",
-    status: "attested",
-    detail: "Inherited — Stirling platform",
-    reportUrl: "/v1/infrastructure/security/reports/soc2",
-  },
-  {
-    id: "iso27001",
-    name: "ISO 27001",
-    framework: "ISO/IEC 27001:2022",
-    status: "attested",
-    detail: "Inherited — Stirling platform",
-    reportUrl: "/v1/infrastructure/security/reports/iso27001",
-  },
-  {
-    id: "gdpr",
-    name: "GDPR",
-    framework: "EU data protection",
-    status: "in-scope",
-    detail: "Standard EU processing terms",
-    reportUrl: null,
-  },
-  {
-    id: "hipaa",
-    name: "HIPAA",
-    framework: "US healthcare · PHI",
-    status: "not-applicable",
-    detail: "Requires a paid plan + signed BAA",
-    reportUrl: null,
-  },
-  {
-    id: "pci",
-    name: "PCI DSS",
-    framework: "Payment card data",
-    status: "not-applicable",
-    detail: "Requires an enterprise contract",
-    reportUrl: null,
-  },
-];
-
-export function securityFor(tier: Tier): SecurityConfig {
-  if (tier === "free") {
-    return {
-      accessPolicy: "stirling",
-      dataResidency: "us",
-      certs: CERTS_FREE,
-      ipAllowlist: [],
-      keyManagement: KEY_MANAGED,
-      attestations: ATTESTATIONS_FREE,
-    };
-  }
-  if (tier === "pro") {
-    return {
-      accessPolicy: "byok",
-      dataResidency: "us",
-      certs: CERTS_FULL,
-      ipAllowlist: IP_ALLOWLIST.slice(0, 2),
-      // Pro stays on Stirling-managed keys; BYOK/HYOK is an enterprise lever.
-      keyManagement: KEY_MANAGED,
-      attestations: ATTESTATIONS_FREE,
-    };
-  }
-  return {
-    accessPolicy: "hyok",
-    dataResidency: "eu",
-    certs: CERTS_FULL,
-    ipAllowlist: IP_ALLOWLIST,
-    keyManagement: KEY_HYOK,
-    attestations: ATTESTATIONS_FULL,
-  };
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Storage                                                                  */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-const PROVIDERS_FULL: StorageProvider[] = [
-  {
-    id: "stirling",
-    name: "Stirling Cloud",
-    kind: "stirling",
-    connected: true,
-    detail: "Primary vault · us-east-1",
-    usedGb: 612,
-  },
-  {
-    id: "s3",
-    name: "Amazon S3",
-    kind: "s3",
-    connected: true,
-    detail: "s3://acme-prod-archive · WORM",
-    usedGb: 388,
-  },
-  {
-    id: "azure",
-    name: "Azure Blob",
-    kind: "azure",
-    connected: false,
-    detail: "Not connected",
-    usedGb: 0,
-  },
-];
-
-export function storageFor(tier: Tier): StorageConfig {
-  if (tier === "free") {
-    return {
-      usedGb: 4.2,
-      quotaGb: 5,
-      retention: "30",
-      providers: [PROVIDERS_FULL[0]],
-    };
-  }
-  if (tier === "pro") {
-    return {
-      usedGb: 318,
-      quotaGb: 500,
-      retention: "90",
-      providers: [PROVIDERS_FULL[0], PROVIDERS_FULL[1]],
-    };
-  }
-  return {
-    usedGb: 1000,
-    quotaGb: 2000,
-    retention: "180",
-    providers: PROVIDERS_FULL,
-  };
-}
-
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  Audit Logs                                                               */
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -693,199 +271,6 @@ const AUDIT_EVENTS_ALL: AuditEvent[] = [
   },
 ];
 
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Models                                                                   */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-const MODELS_ALL: ModelEntry[] = [
-  {
-    id: "m-extract-v3",
-    name: "Stirling Extract",
-    provider: "stirling",
-    type: "extraction",
-    status: "active",
-    latencyMs: 142,
-    cost: 0.9,
-    costUnit: "per-1k-docs",
-    version: "v3.4.2",
-    load: 0.71,
-    managed: true,
-  },
-  {
-    id: "m-classify-v2",
-    name: "Stirling Classify",
-    provider: "stirling",
-    type: "classification",
-    status: "active",
-    latencyMs: 61,
-    cost: 0.4,
-    costUnit: "per-1k-docs",
-    version: "v2.8.0",
-    load: 0.48,
-    managed: true,
-  },
-  {
-    id: "m-ocr-tess",
-    name: "Stirling OCR",
-    provider: "stirling",
-    type: "ocr",
-    status: "active",
-    latencyMs: 318,
-    cost: 1.2,
-    costUnit: "per-1k-docs",
-    version: "v3.1.0",
-    load: 0.55,
-    managed: true,
-  },
-  {
-    id: "m-gpt4o",
-    name: "GPT-4o",
-    provider: "openai",
-    type: "llm",
-    status: "active",
-    latencyMs: 880,
-    cost: 0.012,
-    costUnit: "per-call",
-    version: "2026-05",
-    load: 0.33,
-    managed: true,
-  },
-  {
-    id: "m-claude-sonnet",
-    name: "Claude Sonnet 4.5",
-    provider: "anthropic",
-    type: "llm",
-    status: "degraded",
-    latencyMs: 1240,
-    cost: 0.009,
-    costUnit: "per-call",
-    version: "2026-04",
-    load: 0.21,
-    managed: true,
-  },
-  {
-    id: "m-onprem-ocr",
-    name: "On-prem OCR (Tesseract)",
-    provider: "on-prem",
-    type: "ocr",
-    status: "active",
-    latencyMs: 502,
-    cost: 0,
-    costUnit: "per-1k-docs",
-    version: "byo-1.2",
-    load: 0.12,
-    managed: false,
-  },
-  // Registered but parked: a customer LLM weight kept warm without traffic.
-  {
-    id: "m-onprem-llm",
-    name: "On-prem Llama 3 70B",
-    provider: "on-prem",
-    type: "llm",
-    status: "disabled",
-    latencyMs: 0,
-    cost: 0,
-    costUnit: "per-call",
-    version: "byo-0.9",
-    load: 0,
-    managed: false,
-  },
-];
-
-export function modelsFor(tier: Tier): ModelEntry[] {
-  // Free sees only the two managed Stirling models it can actually use.
-  if (tier === "free")
-    return MODELS_ALL.filter(
-      (m) => m.id === "m-extract-v3" || m.id === "m-classify-v2",
-    );
-  // Pro gets the full managed catalogue but no bring-your-own / on-prem models.
-  if (tier === "pro") return MODELS_ALL.filter((m) => m.managed);
-  return MODELS_ALL;
-}
-
-const ROUTING_ALL: RoutingRule[] = [
-  {
-    id: "r-extract",
-    operation: "Field extraction",
-    docType: "Invoices",
-    modelId: "m-extract-v3",
-    modelName: "Stirling Extract",
-    isDefault: false,
-  },
-  {
-    id: "r-classify",
-    operation: "Document classification",
-    docType: "All document types",
-    modelId: "m-classify-v2",
-    modelName: "Stirling Classify",
-    isDefault: false,
-  },
-  {
-    id: "r-ocr",
-    operation: "Text recognition",
-    docType: "Scanned PDFs",
-    modelId: "m-ocr-tess",
-    modelName: "Stirling OCR",
-    isDefault: false,
-  },
-  {
-    id: "r-summarize",
-    operation: "Summarisation",
-    docType: "Contracts",
-    modelId: "m-gpt4o",
-    modelName: "GPT-4o",
-    isDefault: false,
-  },
-  // Catch-all: any operation without a narrower rule falls back here.
-  {
-    id: "r-default",
-    operation: "Default",
-    docType: "All document types",
-    modelId: "m-extract-v3",
-    modelName: "Stirling Extract",
-    isDefault: true,
-  },
-];
-
-export function routingFor(tier: Tier): RoutingRule[] {
-  // Free has no routing control — the table is locked behind an upgrade nudge,
-  // so there are no rules to surface.
-  if (tier === "free") return [];
-  if (tier === "pro") return ROUTING_ALL.filter((r) => r.modelId !== "m-gpt4o");
-  return ROUTING_ALL;
-}
-
-export function modelsResponseFor(tier: Tier): ModelsResponse {
-  const models = modelsFor(tier);
-  const active = models.filter((m) => m.status === "active");
-
-  // Average latency is capacity-weighted so a barely-used model doesn't skew
-  // the headline; falls back to a plain mean when nothing is taking load.
-  const totalLoad = active.reduce((sum, m) => sum + m.load, 0);
-  const avgLatencyMs =
-    totalLoad > 0
-      ? Math.round(
-          active.reduce((sum, m) => sum + m.latencyMs * m.load, 0) / totalLoad,
-        )
-      : active.length > 0
-        ? Math.round(
-            active.reduce((sum, m) => sum + m.latencyMs, 0) / active.length,
-          )
-        : 0;
-
-  const monthlySpend = tier === "free" ? 0 : tier === "pro" ? 1840 : 6120;
-
-  return {
-    summary: {
-      activeModels: active.length,
-      avgLatencyMs,
-      monthlySpend,
-    },
-    models,
-    routing: routingFor(tier),
-  };
-}
-
 export function auditLogFor(tier: Tier): AuditLogResponse {
   const events =
     tier === "free"
diff --git a/frontend/editor/src/portal/mocks/search.ts b/frontend/editor/src/portal/mocks/search.ts
deleted file mode 100644
index 86d332de70..0000000000
--- a/frontend/editor/src/portal/mocks/search.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * Mock quick-action catalogue for the ⌘K search palette. The QuickAction type
- * lives in api/search.ts (the backend contract); this module only builds fake
- * data for Storybook and tests.
- */
-
-import type { QuickAction } from "@portal/api/search";
-
-export const QUICK_ACTIONS: QuickAction[] = [
-  { group: "Jump to", label: "Home", hint: "G H" },
-  { group: "Jump to", label: "Pipelines", hint: "G P" },
-  { group: "Jump to", label: "Sources", hint: "G S" },
-  { group: "Jump to", label: "Documents", hint: "G D" },
-  { group: "Create", label: "New pipeline", hint: "N P" },
-  { group: "Create", label: "New API key", hint: "N K" },
-  { group: "Theme", label: "Toggle dark / light", hint: "T" },
-];
diff --git a/frontend/editor/src/portal/queries/keys.ts b/frontend/editor/src/portal/queries/keys.ts
index 6c29430cb4..e1c46a59c0 100644
--- a/frontend/editor/src/portal/queries/keys.ts
+++ b/frontend/editor/src/portal/queries/keys.ts
@@ -20,6 +20,8 @@ export const qk = {
   // Keyed on linkage: an unlinked account has no deal to read, so linking must not
   // serve the unlinked (null) snapshot back from cache.
   procurement: (linked: boolean) => ["portal", "procurement", linked] as const,
+  // Same reasoning: an unlinked instance has no wallet in the cloud.
+  wallet: (linked: boolean) => ["portal", "wallet", linked] as const,
 
   // Tier-dependent
   documents: (tier: Tier) => ["portal", "documents", tier] as const,
diff --git a/frontend/editor/src/portal/search/entitySearch.tsx b/frontend/editor/src/portal/search/entitySearch.tsx
new file mode 100644
index 0000000000..1d0a7cc489
--- /dev/null
+++ b/frontend/editor/src/portal/search/entitySearch.tsx
@@ -0,0 +1,393 @@
+import {
+  PROCESSOR_SEARCH_INDEX,
+  isPortalEntityScopeAccessible,
+} from "@app/data/processorSearchIndex";
+import {
+  PORTAL_ENTITY_SCOPE_DEFS,
+  PORTAL_DOCS_SCOPE_ID,
+  type SuperSearchGroup,
+  type SuperSearchResult,
+} from "@app/types/superSearch";
+import { rankByFuzzy } from "@app/utils/fuzzySearch";
+import {
+  assemblePolicies,
+  fetchPoliciesList,
+  fetchPolicyRuns,
+  type CatalogueEntry,
+} from "@portal/api/policies";
+import { fetchPipelines, type PipelineView } from "@portal/api/pipelines";
+import { fetchSources, type SourceView } from "@portal/api/sources";
+import type { Member } from "@portal/api/users";
+// Flavor-resolved users backend: self-hosted reads the proprietary admin
+// endpoints, SaaS the invitation-based team endpoints (the admin ones 403
+// there for the always-ROLE_USER sessions).
+import { usersBackend } from "@app/portal/usersBackend";
+import {
+  DocsIcon,
+  PipelinesIcon,
+  PoliciesIcon,
+  SourcesIcon,
+  UsersIcon,
+} from "@portal/components/icons";
+import type { Tier } from "@portal/contexts/TierContext";
+import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
+import { allDocs, loadDocsNav } from "@portal/docs/manifest/registry";
+import { searchDocs, toPlainText, type SearchDoc } from "@portal/docs/search";
+
+/**
+ * The Processor's entity search: users, policies, pipelines and sources,
+ * fetched per scope and fuzzy-ranked client-side. Shared by both super search
+ * hosts — the portal bar imports it statically, the editor bar loads it on
+ * demand through the processorEntitySearch seam (a static import there would
+ * pull the portal into the main bundle).
+ */
+
+export const PORTAL_ENTITY_SCOPE_IDS = PORTAL_ENTITY_SCOPE_DEFS.map(
+  (def) => def.id,
+);
+
+export type PortalEntityScopeId =
+  (typeof PORTAL_ENTITY_SCOPE_DEFS)[number]["id"];
+
+export type PortalEntityItems =
+  | Member[]
+  | CatalogueEntry[]
+  | PipelineView[]
+  | SourceView[];
+
+export interface ProcessorEntities {
+  users: Member[];
+  policies: CatalogueEntry[];
+  pipelines: PipelineView[];
+  sources: SourceView[];
+}
+
+/**
+ * How many results each entity ranker computes — the ceiling the dropdown's
+ * "show more" can reveal (the component shows a small initial slice).
+ */
+export const ENTITY_GROUP_LIMIT = 24;
+
+/** How long a fetched entity scope stays fresh before a search refetches it. */
+export const ENTITY_REFRESH_MS = 30_000;
+
+const PORTAL_VIEW_BY_SCOPE_ID = Object.fromEntries(
+  PORTAL_ENTITY_SCOPE_DEFS.map((def) => [def.id, def.viewId]),
+) as Record<PortalEntityScopeId, string>;
+
+const VISIBLE_PORTAL_VIEW_IDS = new Set(
+  PROCESSOR_SEARCH_INDEX.map((entry) => entry.id),
+);
+
+/** Whether the flavor's portal nav ships the view an entity scope targets. */
+export function isVisiblePortalScope(scopeId: PortalEntityScopeId): boolean {
+  return VISIBLE_PORTAL_VIEW_IDS.has(PORTAL_VIEW_BY_SCOPE_ID[scopeId]);
+}
+
+/** Whether this build ships the in-app developer docs (so they're searchable). */
+export function isDocsSearchable(): boolean {
+  return VISIBLE_PORTAL_VIEW_IDS.has("docs");
+}
+
+// The docs manifest is static (bundled JSON), so the full-text index — the
+// plaintext strip over every doc — is built once and reused across queries.
+let docsSearchIndex: SearchDoc[] | null = null;
+function getDocsSearchIndex(): SearchDoc[] {
+  if (!docsSearchIndex) {
+    const sectionLabels = new Map(loadDocsNav().map((s) => [s.id, s.label]));
+    docsSearchIndex = allDocs().map((doc) => ({
+      id: doc.id,
+      title: doc.title,
+      sectionLabel: sectionLabels.get(doc.section) ?? "",
+      text: toPlainText(doc.markdown),
+    }));
+  }
+  return docsSearchIndex;
+}
+
+export function rankDocsResults(
+  trimmed: string,
+  navigate: (path: string) => void,
+  limit = ENTITY_GROUP_LIMIT,
+): SuperSearchResult[] {
+  if (!isDocsSearchable()) return [];
+  return searchDocs(getDocsSearchIndex(), trimmed, limit).map((result) => ({
+    key: `portal-doc:${result.id}`,
+    group: PORTAL_DOCS_SCOPE_ID,
+    title: result.title,
+    // The matched-content snippet (full text is what makes docs worth
+    // searching), falling back to the doc's section when the hit is title-only.
+    subtitle:
+      result.snippet
+        .map((seg) => seg.text)
+        .join("")
+        .trim() || result.sectionLabel,
+    icon: <DocsIcon />,
+    score: result.score,
+    onSelect: () => navigate(`${toPortalPath(VIEW_PATHS.docs)}#${result.id}`),
+  }));
+}
+
+export function withPortalEntityDependencies(
+  scopes: readonly PortalEntityScopeId[],
+): readonly PortalEntityScopeId[] {
+  // Pipeline rows must exclude policy-backed records, so they depend on the
+  // policy catalogue even when the user only scoped into pipelines.
+  if (
+    !scopes.includes("portal-pipelines") ||
+    scopes.includes("portal-policies")
+  ) {
+    return scopes;
+  }
+  return [...scopes, "portal-policies"];
+}
+
+/** Every entity scope the flavor ships AND the session can actually query
+ * (see isPortalEntityScopeAccessible), dependencies included — the request
+ * set for an unscoped search. */
+export function defaultPortalEntityScopes(
+  isAdmin: boolean,
+): readonly PortalEntityScopeId[] {
+  return withPortalEntityDependencies(
+    PORTAL_ENTITY_SCOPE_IDS.filter(
+      (scopeId) =>
+        isVisiblePortalScope(scopeId) &&
+        isPortalEntityScopeAccessible(scopeId, isAdmin),
+    ),
+  );
+}
+
+/** One entity scope's fetch, for the editor seam (which has no QueryClient —
+ * the portal bar reads the shared query layer instead). `tier` shapes only
+ * presentational fields on the users payload, never the lists — hosts without
+ * a TierContext pass "free". */
+export async function fetchPortalEntityScope(
+  scopeId: PortalEntityScopeId,
+  tier: Tier,
+): Promise<PortalEntityItems> {
+  switch (scopeId) {
+    case "portal-users":
+      return (await usersBackend.fetchUsers(tier)).members;
+    case "portal-policies": {
+      const [list, runs] = await Promise.all([
+        fetchPoliciesList(),
+        fetchPolicyRuns(),
+      ]);
+      return assemblePolicies(list, runs).catalogue;
+    }
+    case "portal-pipelines":
+      return (await fetchPipelines()).pipelines;
+    case "portal-sources":
+      return (await fetchSources()).sources;
+  }
+}
+
+/** Assembles per-scope cache values into the typed entity sets. The casts are
+ * sound because fetchPortalEntityScope keys each item type to its scope. */
+export function toProcessorEntities(
+  values: Partial<Record<PortalEntityScopeId, PortalEntityItems>>,
+): ProcessorEntities {
+  return {
+    users: (values["portal-users"] as Member[] | undefined) ?? [],
+    policies: (values["portal-policies"] as CatalogueEntry[] | undefined) ?? [],
+    pipelines: (values["portal-pipelines"] as PipelineView[] | undefined) ?? [],
+    sources: (values["portal-sources"] as SourceView[] | undefined) ?? [],
+  };
+}
+
+type Translate = (key: string, options?: Record<string, unknown>) => string;
+
+function policyResultTitle(entry: CatalogueEntry, t: Translate) {
+  const category = t(entry.category.label);
+  return entry.policy
+    ? t("portal.policies.defaultName", { category })
+    : category;
+}
+
+export function rankPortalPolicyResults(
+  entries: CatalogueEntry[],
+  trimmed: string,
+  t: Translate,
+  openPolicy: (categoryId: string) => void,
+  limit = ENTITY_GROUP_LIMIT,
+): SuperSearchResult[] {
+  return rankByFuzzy(
+    entries.filter((entry) => !entry.category.comingSoon),
+    trimmed,
+    [
+      (entry) => policyResultTitle(entry, t),
+      (entry) => t(entry.category.label),
+      (entry) => t(entry.category.desc),
+    ],
+  )
+    .slice(0, limit)
+    .map(({ item, score }) => ({
+      key: `portal-policy:${item.category.id}`,
+      group: "portal-policies",
+      title: policyResultTitle(item, t),
+      subtitle: t(item.category.desc),
+      icon: <PoliciesIcon />,
+      score,
+      onSelect: () => openPolicy(item.category.id),
+    }));
+}
+
+export function rankPortalPipelineResults(
+  entries: PipelineView[],
+  trimmed: string,
+  excludedIds: ReadonlySet<string>,
+  openPipeline: (pipelineId: string) => void,
+  limit = ENTITY_GROUP_LIMIT,
+): SuperSearchResult[] {
+  return rankByFuzzy(
+    entries.filter((entry) => !excludedIds.has(entry.id)),
+    trimmed,
+    [(entry) => entry.name, (entry) => entry.trigger],
+  )
+    .slice(0, limit)
+    .map(({ item, score }) => ({
+      key: `portal-pipeline:${item.id}`,
+      group: "portal-pipelines",
+      title: item.name,
+      subtitle: item.trigger,
+      icon: <PipelinesIcon />,
+      score,
+      onSelect: () => openPipeline(item.id),
+    }));
+}
+
+export interface BuildEntityGroupsOptions {
+  /** Host scope filter; defaults to every scope enabled. */
+  scopeEnabled?: (scopeId: string) => boolean;
+}
+
+/**
+ * Ranks the entity sets into display groups. Selects navigate to the entity's
+ * portal route (deep links where the views support them) — the portal is a
+ * route-set of the same SPA, so this works from either app.
+ */
+export function buildProcessorEntityGroups(
+  entities: ProcessorEntities,
+  trimmed: string,
+  t: Translate,
+  navigate: (path: string) => void,
+  options: BuildEntityGroupsOptions = {},
+): SuperSearchGroup[] {
+  if (!trimmed) return [];
+  const scopeEnabled = options.scopeEnabled ?? (() => true);
+  const groups: SuperSearchGroup[] = [];
+
+  const includeScope = (scopeId: PortalEntityScopeId) =>
+    isVisiblePortalScope(scopeId) && scopeEnabled(scopeId);
+
+  const users = includeScope("portal-users")
+    ? rankByFuzzy(entities.users, trimmed, [
+        (member) => member.name,
+        (member) => member.email,
+      ])
+        .slice(0, ENTITY_GROUP_LIMIT)
+        .map(({ item, score }) => ({
+          key: `portal-user:${item.id}`,
+          group: "portal-users",
+          title: item.name,
+          subtitle: item.email,
+          icon: <UsersIcon />,
+          score,
+          onSelect: () =>
+            navigate(
+              `${toPortalPath(VIEW_PATHS.users)}?member=${encodeURIComponent(item.id)}`,
+            ),
+        }))
+    : [];
+  if (users.length > 0) {
+    groups.push({
+      id: "portal-users",
+      label: t("portal.nav.users"),
+      results: users,
+    });
+  }
+
+  const policies = includeScope("portal-policies")
+    ? rankPortalPolicyResults(
+        entities.policies,
+        trimmed,
+        t,
+        (categoryId) =>
+          navigate(
+            `${toPortalPath(VIEW_PATHS.policies)}?category=${encodeURIComponent(categoryId)}`,
+          ),
+        ENTITY_GROUP_LIMIT,
+      )
+    : [];
+  if (policies.length > 0) {
+    groups.push({
+      id: "portal-policies",
+      label: t("portal.nav.policies"),
+      results: policies,
+    });
+  }
+
+  // Policy-backed pipelines already surface as policies; listing them twice
+  // under different names would read as duplicates.
+  const policyPipelineIds = new Set(
+    entities.policies.flatMap((entry) =>
+      entry.policy?.state.backendId ? [entry.policy.state.backendId] : [],
+    ),
+  );
+  const pipelines = includeScope("portal-pipelines")
+    ? rankPortalPipelineResults(
+        entities.pipelines,
+        trimmed,
+        policyPipelineIds,
+        (pipelineId) =>
+          navigate(`${toPortalPath(VIEW_PATHS.pipelines)}/${pipelineId}`),
+        ENTITY_GROUP_LIMIT,
+      )
+    : [];
+  if (pipelines.length > 0) {
+    groups.push({
+      id: "portal-pipelines",
+      label: t("portal.nav.pipelines"),
+      results: pipelines,
+    });
+  }
+
+  const sources = includeScope("portal-sources")
+    ? rankByFuzzy(entities.sources, trimmed, [
+        (source) => source.name,
+        (source) => source.type,
+      ])
+        .slice(0, ENTITY_GROUP_LIMIT)
+        .map(({ item, score }) => ({
+          key: `portal-source:${item.id}`,
+          group: "portal-sources",
+          title: item.name,
+          subtitle: item.type,
+          icon: <SourcesIcon />,
+          score,
+          onSelect: () =>
+            navigate(`${toPortalPath(VIEW_PATHS.sources)}/${item.id}`),
+        }))
+    : [];
+  if (sources.length > 0) {
+    groups.push({
+      id: "portal-sources",
+      label: t("portal.nav.sources"),
+      results: sources,
+    });
+  }
+
+  const docs =
+    isDocsSearchable() && scopeEnabled(PORTAL_DOCS_SCOPE_ID)
+      ? rankDocsResults(trimmed, navigate, ENTITY_GROUP_LIMIT)
+      : [];
+  if (docs.length > 0) {
+    groups.push({
+      id: PORTAL_DOCS_SCOPE_ID,
+      label: t("superSearch.group.docs"),
+      results: docs,
+    });
+  }
+
+  return groups;
+}
diff --git a/frontend/editor/src/portal/setupTests.ts b/frontend/editor/src/portal/setupTests.ts
index 9064c734ba..7de4f9f309 100644
--- a/frontend/editor/src/portal/setupTests.ts
+++ b/frontend/editor/src/portal/setupTests.ts
@@ -1,6 +1,9 @@
 import "@testing-library/jest-dom";
 import { vi } from "vitest";
 
+// The shims `src/index.tsx` installs - see core/setupTests.ts.
+import "@app/utils/engineShims";
+
 // Mirrors the editor's setup: jsdom lacks a handful of browser APIs that shared
 // components (Mantine FocusTrap, responsive helpers) touch on render.
 
diff --git a/frontend/editor/src/portal/theme/mantineTheme.ts b/frontend/editor/src/portal/theme/mantineTheme.ts
index 7108a90073..e371b4aeb8 100644
--- a/frontend/editor/src/portal/theme/mantineTheme.ts
+++ b/frontend/editor/src/portal/theme/mantineTheme.ts
@@ -163,6 +163,10 @@ export const mantineTheme = createTheme({
     CloseButton: { defaultProps: { "aria-label": "Close" } },
     Modal: { defaultProps: { closeButtonProps: { "aria-label": "Close" } } },
     Drawer: { defaultProps: { closeButtonProps: { "aria-label": "Close" } } },
+    // The portal's md default radius (8px) is right for cards and buttons but
+    // rounds a 20px checkbox into a circle. Pin it to the smaller radius the
+    // editor's checkboxes use so the box reads as a checkbox.
+    Checkbox: { styles: { input: { borderRadius: "var(--radius-sm)" } } },
   },
   fontFamily: "var(--font-sans)",
   fontFamilyMonospace: "var(--font-mono)",
diff --git a/frontend/editor/src/portal/theme/surface.css b/frontend/editor/src/portal/theme/surface.css
new file mode 100644
index 0000000000..91ba40b41e
--- /dev/null
+++ b/frontend/editor/src/portal/theme/surface.css
@@ -0,0 +1,7 @@
+/* The portal's own in-page surface. Same look as SUI's `.sui-surface`, owned here because a
+   `sui-` class belongs to the component that emits it — feature markup doesn't apply one. */
+.portal-surface {
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-nav);
+}
diff --git a/frontend/editor/src/portal/views/DeveloperDocs.css b/frontend/editor/src/portal/views/DeveloperDocs.css
index 314cf17eef..8ca485bc4e 100644
--- a/frontend/editor/src/portal/views/DeveloperDocs.css
+++ b/frontend/editor/src/portal/views/DeveloperDocs.css
@@ -45,137 +45,6 @@
   gap: 0.25rem;
 }
 
-/* Search */
-.portal-docs__search {
-  margin-bottom: 0.75rem;
-  padding: 0 0.75rem;
-}
-
-.portal-docs__search-box {
-  position: relative;
-}
-
-.portal-docs__search-icon {
-  position: absolute;
-  left: 0.625rem;
-  top: 50%;
-  transform: translateY(-50%);
-  font-size: 0.9375rem;
-  color: var(--c-text-subtle);
-  pointer-events: none;
-}
-
-.portal-docs__search-input {
-  width: 100%;
-  padding: 0.4rem 0.6rem 0.4rem 1.9rem;
-  font-size: 0.8125rem;
-  color: var(--c-text);
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-md);
-  outline: none;
-}
-
-.portal-docs__search-input:focus {
-  border-color: var(--c-primary);
-}
-
-.portal-docs__nav-empty {
-  font-size: 0.8125rem;
-  color: var(--c-text-subtle);
-  padding: 0.5rem 0.75rem;
-  margin: 0;
-}
-
-/* ── Search results ────────────────────────────────────────────────────── */
-
-.portal-docs__results {
-  margin-top: 0.5rem;
-}
-
-.portal-docs__results-count {
-  font-size: 0.6875rem;
-  font-weight: 500;
-  color: var(--c-text-subtle);
-  padding: 0 0.75rem 0.5rem;
-}
-
-.portal-docs__results-list {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-}
-
-/* Hairline divider between results for clear, calm separation. */
-.portal-docs__results-list li + li {
-  border-top: 1px solid var(--c-border-subtle);
-}
-
-.portal-docs__result {
-  height: auto;
-  padding: 0.5rem 0.75rem;
-  border-radius: 0;
-}
-
-.portal-docs__result:hover,
-.portal-docs__result.is-active {
-  background: var(--c-hover);
-}
-
-.portal-docs__result-body {
-  display: flex;
-  flex-direction: column;
-  gap: 0.125rem;
-  width: 100%;
-  min-width: 0;
-  text-align: left;
-  white-space: normal;
-}
-
-/* Title + section share one line; the title truncates before the section. */
-.portal-docs__result-head {
-  display: flex;
-  align-items: baseline;
-  gap: 0.4rem;
-  min-width: 0;
-}
-
-.portal-docs__result-title {
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--c-text);
-  line-height: 1.3;
-  min-width: 0;
-  overflow: hidden;
-  white-space: nowrap;
-  text-overflow: ellipsis;
-}
-
-.portal-docs__result-section {
-  flex-shrink: 0;
-  font-size: 0.6875rem;
-  color: var(--c-text-subtle);
-}
-
-.portal-docs__result-snippet {
-  font-size: 0.75rem;
-  line-height: 1.4;
-  color: var(--c-text-subtle);
-  display: -webkit-box;
-  -webkit-line-clamp: 1;
-  -webkit-box-orient: vertical;
-  overflow: hidden;
-}
-
-/* Subtle match emphasis — coloured text, not a filled block. */
-.portal-docs__hl {
-  color: var(--c-accent-text);
-  font-weight: 600;
-  background: none;
-}
-
 .portal-docs__nav-group {
   display: flex;
   flex-direction: column;
@@ -569,8 +438,6 @@
 .portal-docs__endpoint-group {
   display: flex;
   flex-direction: column;
-  border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-lg);
   overflow: hidden;
 }
 
diff --git a/frontend/editor/src/portal/views/DeveloperDocs.test.tsx b/frontend/editor/src/portal/views/DeveloperDocs.test.tsx
index d2071011d8..354c6359c6 100644
--- a/frontend/editor/src/portal/views/DeveloperDocs.test.tsx
+++ b/frontend/editor/src/portal/views/DeveloperDocs.test.tsx
@@ -25,7 +25,6 @@ const renderDocs = (ui: ReactElement) =>
 describe("DeveloperDocs — markdown browser over the generated manifest", () => {
   it("keeps Overview static (open, no toggle) and other sections collapsed", () => {
     renderDocs(<DeveloperDocs />);
-    expect(screen.getByRole("searchbox")).toBeInTheDocument();
     // Overview is static: its items show, and it has no toggle button.
     expect(
       screen.getByRole("button", { name: "Production Deployment Guide" }),
@@ -50,23 +49,6 @@ describe("DeveloperDocs — markdown browser over the generated manifest", () =>
     ).toBeInTheDocument();
   });
 
-  it("searches doc content (not just titles), shows a snippet, and navigates", async () => {
-    renderDocs(<DeveloperDocs />);
-    // "Tesseract" appears in the OCR doc body but in no doc title — a result
-    // whose snippet contains it proves full-text (content) search.
-    fireEvent.change(screen.getByRole("searchbox"), {
-      target: { value: "Tesseract" },
-    });
-    const hits = await screen.findAllByRole("button", { name: /Tesseract/i });
-    expect(hits.length).toBeGreaterThan(0);
-    fireEvent.click(hits[0]);
-    await waitFor(() =>
-      expect(
-        screen.queryByText(/locally hosted web application/i),
-      ).not.toBeInTheDocument(),
-    );
-  });
-
   it("follows an internal doc: link inside the rendered markdown", async () => {
     renderDocs(<DeveloperDocs />);
     // The Getting Started body links to the Migration guide via the doc: scheme.
diff --git a/frontend/editor/src/portal/views/DeveloperDocs.tsx b/frontend/editor/src/portal/views/DeveloperDocs.tsx
index fb62b8566c..d32666e1dd 100644
--- a/frontend/editor/src/portal/views/DeveloperDocs.tsx
+++ b/frontend/editor/src/portal/views/DeveloperDocs.tsx
@@ -3,25 +3,22 @@ import { useTranslation } from "react-i18next";
 import { useLocation, useNavigate } from "react-router-dom";
 import { Button, EmptyState } from "@app/ui";
 import { DocsNav } from "@portal/components/docs/DocsNav";
-import { DocsSearch } from "@portal/components/docs/DocsSearch";
 import { DocsSection } from "@portal/components/docs/DocsSection";
 import { DocsToc } from "@portal/components/docs/DocsToc";
 import { MarkdownDoc } from "@portal/components/docs/MarkdownDoc";
 import { extractHeadings } from "@portal/docs/headings";
 import {
-  allDocs,
   firstDocId,
   loadDoc,
   loadDocsNav,
 } from "@portal/docs/manifest/registry";
-import { searchDocs, toPlainText, type SearchDoc } from "@portal/docs/search";
 import "@portal/views/DeveloperDocs.css";
 
 /**
  * Developer Docs — a markdown browser over the docs manifest generated from the
  * Stirling docs repo (see scripts/sync-portal-docs.mts). The nav is auto-sorted
- * from the repo's folders + frontmatter; content is the repo markdown, and the
- * search box does full-text search across every doc.
+ * from the repo's folders + frontmatter; content is the repo markdown. Full-text
+ * search across docs lives in the global super search (Cmd/Ctrl+K).
  */
 export function DeveloperDocs() {
   const { t } = useTranslation();
@@ -29,24 +26,10 @@ export function DeveloperDocs() {
   const navigate = useNavigate();
   const contentRef = useRef<HTMLElement>(null);
   const [navOpen, setNavOpen] = useState(false);
-  const [query, setQuery] = useState("");
 
   const nav = useMemo(() => loadDocsNav(), []);
   const fallback = useMemo(() => firstDocId(), []);
 
-  // Full-text index over every doc's plaintext body (built once).
-  const index = useMemo<SearchDoc[]>(() => {
-    const labels = new Map(nav.map((s) => [s.id, s.label]));
-    return allDocs().map((d) => ({
-      id: d.id,
-      title: d.title,
-      sectionLabel: labels.get(d.section) ?? "",
-      text: toPlainText(d.markdown),
-    }));
-  }, [nav]);
-  const results = useMemo(() => searchDocs(index, query), [index, query]);
-  const searching = query.trim().length > 0;
-
   // Deep-link support: the active doc id lives in the URL hash.
   const hashId = decodeURIComponent(hash.replace(/^#/, ""));
   const activeId = hashId && loadDoc(hashId) ? hashId : fallback;
@@ -61,12 +44,11 @@ export function DeveloperDocs() {
     [doc],
   );
 
-  // Navigating closes the mobile drawer, clears the search, and resets the pane.
+  // Navigating closes the mobile drawer and resets the pane.
   const onSelect = useCallback(
     (id: string) => {
       navigate({ hash: id });
       setNavOpen(false);
-      setQuery("");
     },
     [navigate],
   );
@@ -100,19 +82,11 @@ export function DeveloperDocs() {
         {t("portal.docs.browse")}
       </Button>
 
-      {/* Layout columns, not landmarks: the search and the two <nav>s inside them
-          already carry their own named landmarks, and a pair of unlabelled
-          complementary regions is indistinguishable to assistive tech. */}
+      {/* Layout column, not a landmark: the <nav> inside already carries its
+          own named landmark, and an unlabelled complementary region would be
+          indistinguishable to assistive tech. */}
       <div className={"portal-docs__sidebar" + (navOpen ? " is-open" : "")}>
-        <DocsSearch
-          query={query}
-          onQueryChange={setQuery}
-          results={results}
-          onSelect={onSelect}
-        />
-        {!searching && (
-          <DocsNav sections={nav} active={activeId ?? ""} onSelect={onSelect} />
-        )}
+        <DocsNav sections={nav} active={activeId ?? ""} onSelect={onSelect} />
       </div>
 
       <main className="portal-docs__content" ref={contentRef}>
diff --git a/frontend/editor/src/portal/views/Documents.tsx b/frontend/editor/src/portal/views/Documents.tsx
index 74bc26d320..f47abd3ffe 100644
--- a/frontend/editor/src/portal/views/Documents.tsx
+++ b/frontend/editor/src/portal/views/Documents.tsx
@@ -96,7 +96,7 @@ export function Documents() {
         </div>
         <Button
           variant="secondary"
-          size="sm"
+          fat
           leftSection={<DownloadIcon />}
           onClick={exportCsv}
           disabled={documents.length === 0}
diff --git a/frontend/editor/src/portal/views/Infrastructure.css b/frontend/editor/src/portal/views/Infrastructure.css
index 660bd4a69f..962be38b04 100644
--- a/frontend/editor/src/portal/views/Infrastructure.css
+++ b/frontend/editor/src/portal/views/Infrastructure.css
@@ -122,27 +122,7 @@
   gap: 0.75rem;
 }
 
-/* Two-column split */
-.portal-infra__split {
-  display: grid;
-  grid-template-columns: 1fr 1fr;
-  gap: 1rem;
-  align-items: start;
-}
-
-@media (max-width: 60rem) {
-  .portal-infra__split {
-    grid-template-columns: 1fr;
-  }
-}
-
 /* Shared cell styles */
-.portal-infra__cell-stack {
-  display: flex;
-  flex-direction: column;
-  gap: 0.125rem;
-}
-
 .portal-infra__cell-strong {
   font-size: 0.8125rem;
   font-weight: 600;
@@ -165,26 +145,6 @@
   color: var(--c-text-muted);
 }
 
-.portal-infra__muted {
-  font-size: 0.75rem;
-  color: var(--c-text-subtle);
-}
-
-/* Region load cell */
-.portal-infra__load {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-}
-
-.portal-infra__load-pct {
-  font-family: var(--font-mono);
-  font-size: 0.6875rem;
-  color: var(--c-text-subtle);
-  min-width: 2.25rem;
-  text-align: right;
-}
-
 /* ── API keys ───────────────────────────────────────────────────────────── */
 .portal-infra__keys {
   display: flex;
@@ -252,10 +212,6 @@
   }
 }
 
-.portal-infra__kv-wide {
-  grid-column: 1 / -1;
-}
-
 .portal-infra__kv dt {
   font-size: 0.6875rem;
   text-transform: uppercase;
@@ -270,12 +226,6 @@
   color: var(--c-text-muted);
 }
 
-.portal-infra__chips {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 0.375rem;
-}
-
 /* Modal form */
 .portal-infra__form {
   display: flex;
@@ -283,217 +233,12 @@
   gap: 1rem;
 }
 
-.portal-infra__perm-row {
-  display: flex;
-  gap: 1.25rem;
-  flex-wrap: wrap;
-}
-
 .portal-infra__modal-actions {
   display: flex;
   justify-content: flex-end;
   gap: 0.625rem;
 }
 
-/* ── Security ───────────────────────────────────────────────────────────── */
-.portal-infra__banner {
-  margin-top: 1rem;
-}
-
-.portal-infra__certs {
-  display: grid;
-  grid-template-columns: repeat(4, 1fr);
-  gap: 0.75rem;
-}
-
-@media (max-width: 60rem) {
-  .portal-infra__certs {
-    grid-template-columns: repeat(2, 1fr);
-  }
-}
-
-.portal-infra__cert-head {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.5rem;
-  margin-bottom: 0.375rem;
-}
-
-.portal-infra__cert-detail {
-  margin: 0;
-  font-size: 0.6875rem;
-  color: var(--c-text-subtle);
-  line-height: 1.4;
-}
-
-/* Encryption key management */
-.portal-infra__keymgmt-head {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 1rem;
-  margin-bottom: 1rem;
-}
-
-.portal-infra__keymgmt-title {
-  display: flex;
-  align-items: center;
-  gap: 0.625rem;
-  min-width: 0;
-}
-
-/* Compliance attestations — same grid rhythm as certs, but each card stacks
-   a framework chip + report link, so it needs a little more vertical room. */
-.portal-infra__attestations {
-  display: grid;
-  grid-template-columns: repeat(3, 1fr);
-  gap: 0.75rem;
-}
-
-@media (max-width: 60rem) {
-  .portal-infra__attestations {
-    grid-template-columns: repeat(2, 1fr);
-  }
-}
-
-@media (max-width: 36rem) {
-  .portal-infra__attestations {
-    grid-template-columns: 1fr;
-  }
-}
-
-.portal-infra__attestation {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-  align-items: flex-start;
-}
-
-.portal-infra__attestation-link {
-  font-size: 0.75rem;
-  font-weight: 600;
-  color: var(--c-accent-text);
-  text-decoration: none;
-}
-
-.portal-infra__attestation-link:hover {
-  text-decoration: underline;
-}
-
-/* ── Storage ────────────────────────────────────────────────────────────── */
-.portal-infra__usage-head {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.5rem;
-  margin-bottom: 0.625rem;
-}
-
-.portal-infra__usage-value {
-  font-size: 1.25rem;
-  font-weight: 650;
-  color: var(--c-text);
-}
-
-.portal-infra__usage-value .portal-infra__muted {
-  font-size: 0.875rem;
-  font-weight: 400;
-}
-
-.portal-infra__providers {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.portal-infra__provider {
-  display: grid;
-  grid-template-columns: auto 1fr auto;
-  align-items: center;
-  gap: 0.75rem;
-  padding: 0.625rem 0.75rem;
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-md);
-}
-
-.portal-infra__provider-glyph {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1.75rem;
-  height: 1.75rem;
-  border-radius: var(--radius-md);
-  background: var(--c-primary-tint);
-  color: var(--c-accent-text);
-  font-size: 0.875rem;
-}
-
-.portal-infra__provider-text {
-  display: flex;
-  flex-direction: column;
-  gap: 0.125rem;
-  min-width: 0;
-}
-
-.portal-infra__provider-meta {
-  display: flex;
-  align-items: center;
-  gap: 0.625rem;
-}
-
-/* Lifecycle timeline */
-.portal-infra__lifecycle {
-  display: flex;
-  align-items: stretch;
-  gap: 0.5rem;
-  margin-top: 1rem;
-}
-
-.portal-infra__lifecycle-stage {
-  flex: 1;
-  display: flex;
-  flex-direction: column;
-  gap: 0.25rem;
-  padding: 0.625rem 0.75rem;
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-md);
-}
-
-.portal-infra__lifecycle-stage.is-active {
-  background: var(--color-green-light);
-  border-color: var(--color-green-border);
-}
-
-.portal-infra__lifecycle-dot {
-  width: 0.5rem;
-  height: 0.5rem;
-  border-radius: 50%;
-  background: var(--c-text-subtle);
-}
-
-.portal-infra__lifecycle-stage.is-active .portal-infra__lifecycle-dot {
-  background: var(--color-green);
-}
-
-.portal-infra__lifecycle-label {
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--c-text);
-}
-
-.portal-infra__lifecycle-arrow {
-  display: flex;
-  align-items: center;
-  color: var(--c-text-subtle);
-  font-size: 0.875rem;
-}
-
 /* ── Audit ──────────────────────────────────────────────────────────────── */
 .portal-infra__event {
   display: flex;
diff --git a/frontend/editor/src/portal/views/Infrastructure.test.tsx b/frontend/editor/src/portal/views/Infrastructure.test.tsx
new file mode 100644
index 0000000000..cda36caef8
--- /dev/null
+++ b/frontend/editor/src/portal/views/Infrastructure.test.tsx
@@ -0,0 +1,94 @@
+import { describe, expect, it, vi } from "vitest";
+import { fireEvent, render, screen } from "@testing-library/react";
+import { MemoryRouter } from "react-router-dom";
+import { MantineProvider } from "@mantine/core";
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+vi.mock("@portal/contexts/ViewContext", () => ({
+  useView: () => ({ setActiveView: vi.fn() }),
+}));
+
+vi.mock("@portal/components/infrastructure/ApiKeysTab", () => ({
+  ApiKeysTab: () => <div data-testid="api-keys-tab" />,
+}));
+vi.mock("@portal/components/infrastructure/AuditTab", () => ({
+  AuditTab: () => <div data-testid="audit-tab" />,
+}));
+
+import { Infrastructure } from "@portal/views/Infrastructure";
+
+const T = "portal.infrastructure.tabs";
+
+function renderView(initialPath = "/infrastructure") {
+  return render(
+    <MantineProvider>
+      <MemoryRouter initialEntries={[initialPath]}>
+        <Infrastructure />
+      </MemoryRouter>
+    </MantineProvider>,
+  );
+}
+
+function tabButtons() {
+  return screen
+    .getAllByRole("button")
+    .filter((b) => b.className.includes("sui-tabs__tab"));
+}
+
+describe("Infrastructure view", () => {
+  it("orders the working tabs first and defaults to API keys", () => {
+    renderView();
+
+    expect(tabButtons().map((b) => b.textContent)).toEqual([
+      `${T}.apiKeys`,
+      `${T}.audit`,
+      `${T}.deployments`,
+      `${T}.security`,
+      `${T}.models`,
+      `${T}.storage`,
+    ]);
+    expect(screen.getByTestId("api-keys-tab")).toBeInTheDocument();
+  });
+
+  it("renders the backend-less tabs as inert: disabled, aria-disabled, never active", () => {
+    renderView();
+
+    const byLabel = new Map(tabButtons().map((b) => [b.textContent, b]));
+    for (const key of ["deployments", "security", "models", "storage"]) {
+      const btn = byLabel.get(`${T}.${key}`) as HTMLButtonElement;
+      expect(btn).toBeDisabled();
+      expect(btn).toHaveAttribute("aria-disabled", "true");
+      expect(btn).toHaveAttribute("aria-pressed", "false");
+
+      fireEvent.click(btn);
+      expect(screen.getByTestId("api-keys-tab")).toBeInTheDocument();
+    }
+  });
+
+  it("switches to the audit tab when clicked", () => {
+    renderView();
+
+    fireEvent.click(screen.getByRole("button", { name: `${T}.audit` }));
+    expect(screen.getByTestId("audit-tab")).toBeInTheDocument();
+    expect(screen.queryByTestId("api-keys-tab")).not.toBeInTheDocument();
+  });
+
+  it("honours ?tab=audit deep links (used by the home visualiser)", () => {
+    renderView("/infrastructure?tab=audit");
+
+    expect(screen.getByTestId("audit-tab")).toBeInTheDocument();
+  });
+
+  it("ignores a deep link to a disabled tab and stays on the default", () => {
+    renderView("/infrastructure?tab=storage");
+
+    expect(screen.getByTestId("api-keys-tab")).toBeInTheDocument();
+    expect(screen.queryByTestId("audit-tab")).not.toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/views/Infrastructure.tsx b/frontend/editor/src/portal/views/Infrastructure.tsx
index 7d720f6895..64ef579b55 100644
--- a/frontend/editor/src/portal/views/Infrastructure.tsx
+++ b/frontend/editor/src/portal/views/Infrastructure.tsx
@@ -3,34 +3,20 @@ import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { Button, Tabs, type TabItem } from "@app/ui";
 import { useView } from "@portal/contexts/ViewContext";
-import { DeploymentsTab } from "@portal/components/infrastructure/DeploymentsTab";
 import { ApiKeysTab } from "@portal/components/infrastructure/ApiKeysTab";
-import { SecurityTab } from "@portal/components/infrastructure/SecurityTab";
-import { ModelsTab } from "@portal/components/infrastructure/ModelsTab";
-import { StorageTab } from "@portal/components/infrastructure/StorageTab";
 import { AuditTab } from "@portal/components/infrastructure/AuditTab";
 import "@portal/views/Infrastructure.css";
 
-type InfraTab =
-  | "deployments"
-  | "api-keys"
-  | "security"
-  | "models"
-  | "storage"
-  | "audit";
+type InfraTab = "api-keys" | "audit";
 
-const INFRA_TABS: InfraTab[] = [
-  "deployments",
-  "api-keys",
-  "security",
-  "models",
-  "storage",
-  "audit",
-];
+/** Shown but inert: no backend behind these screens yet. */
+type DisabledInfraTab = "deployments" | "security" | "models" | "storage";
+
+const ENABLED_TABS: InfraTab[] = ["api-keys", "audit"];
 
 export function Infrastructure() {
   const { t } = useTranslation();
-  const [tab, setTab] = useState<InfraTab>("deployments");
+  const [tab, setTab] = useState<InfraTab>("api-keys");
   const { setActiveView } = useView();
   const [searchParams, setSearchParams] = useSearchParams();
 
@@ -39,7 +25,7 @@ export function Infrastructure() {
   useEffect(() => {
     const requested = searchParams.get("tab");
     if (!requested) return;
-    if ((INFRA_TABS as string[]).includes(requested)) {
+    if ((ENABLED_TABS as string[]).includes(requested)) {
       setTab(requested as InfraTab);
     }
     const next = new URLSearchParams(searchParams);
@@ -47,13 +33,29 @@ export function Infrastructure() {
     setSearchParams(next, { replace: true });
   }, [searchParams, setSearchParams]);
 
-  const tabs: TabItem<InfraTab>[] = [
-    { key: "deployments", label: t("portal.infrastructure.tabs.deployments") },
+  const tabs: TabItem<InfraTab | DisabledInfraTab>[] = [
     { key: "api-keys", label: t("portal.infrastructure.tabs.apiKeys") },
-    { key: "security", label: t("portal.infrastructure.tabs.security") },
-    { key: "models", label: t("portal.infrastructure.tabs.models") },
-    { key: "storage", label: t("portal.infrastructure.tabs.storage") },
     { key: "audit", label: t("portal.infrastructure.tabs.audit") },
+    {
+      key: "deployments",
+      label: t("portal.infrastructure.tabs.deployments"),
+      disabled: true,
+    },
+    {
+      key: "security",
+      label: t("portal.infrastructure.tabs.security"),
+      disabled: true,
+    },
+    {
+      key: "models",
+      label: t("portal.infrastructure.tabs.models"),
+      disabled: true,
+    },
+    {
+      key: "storage",
+      label: t("portal.infrastructure.tabs.storage"),
+      disabled: true,
+    },
   ];
 
   return (
@@ -67,29 +69,23 @@ export function Infrastructure() {
             {t("portal.infrastructure.subtitle")}
           </p>
         </div>
-        <Button
-          variant="secondary"
-          size="sm"
-          onClick={() => setActiveView("editor")}
-        >
+        <Button fat onClick={() => setActiveView("editor")}>
           {t("portal.infrastructure.manageEditorDeployment")}
         </Button>
       </header>
 
-      <Tabs<InfraTab>
+      <Tabs<InfraTab | DisabledInfraTab>
         items={tabs}
         activeKey={tab}
-        onChange={setTab}
+        onChange={(key) => {
+          if ((ENABLED_TABS as string[]).includes(key)) setTab(key as InfraTab);
+        }}
         variant="underline"
         ariaLabel={t("portal.infrastructure.sectionsAriaLabel")}
       />
 
       <div className="portal-infra__panel">
-        {tab === "deployments" && <DeploymentsTab />}
         {tab === "api-keys" && <ApiKeysTab />}
-        {tab === "security" && <SecurityTab />}
-        {tab === "models" && <ModelsTab />}
-        {tab === "storage" && <StorageTab />}
         {tab === "audit" && <AuditTab />}
       </div>
     </div>
diff --git a/frontend/editor/src/portal/views/Integrations.css b/frontend/editor/src/portal/views/Integrations.css
index d006fcbb84..bfc4cf06f3 100644
--- a/frontend/editor/src/portal/views/Integrations.css
+++ b/frontend/editor/src/portal/views/Integrations.css
@@ -116,9 +116,6 @@
 /* One list, table-shaped: a shared 4-column grid so the connected, available
    and coming-soon bands line up under the same headers. */
 .portal-integrations__table {
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-md);
-  background: var(--c-surface);
   overflow: hidden;
 }
 
diff --git a/frontend/editor/src/portal/views/Integrations.test.tsx b/frontend/editor/src/portal/views/Integrations.test.tsx
index c5e96d8666..8c4e684bfa 100644
--- a/frontend/editor/src/portal/views/Integrations.test.tsx
+++ b/frontend/editor/src/portal/views/Integrations.test.tsx
@@ -68,39 +68,35 @@ describe("Integrations view", () => {
     ).toBeInTheDocument();
   });
 
-  it("groups connections of the same type and expands to the instances", async () => {
+  it("groups connections of the same type, instances shown as rows (no expand)", async () => {
     fetchIntegrations.mockResolvedValue([
       bucket(1, "Claims"),
       bucket(2, "Archive"),
     ]);
     render(<Integrations />);
 
-    // One connected group row for S3 with the instance count, not two rows.
-    const group = await screen.findByText(
-      "portal.integrations.connectionCount",
-    );
-    expect(group).toBeInTheDocument();
-
-    fireEvent.click(screen.getByText("portal.connections.types.s3.label"));
+    // Instances are rows directly under the S3 vendor group - no expand click.
     expect(await screen.findByText("Claims")).toBeInTheDocument();
     expect(screen.getByText("Archive")).toBeInTheDocument();
+    // Vendor group header shows the instance count and the "add another" action.
     expect(
-      screen.getByText("portal.integrations.addAnother"),
+      screen.getByText("portal.integrations.connectionCount"),
     ).toBeInTheDocument();
+    // Each connected vendor group offers a Connect action (to add another).
+    expect(
+      screen.getAllByText("portal.integrations.connect").length,
+    ).toBeGreaterThan(0);
     // The available band remains for the other, unconnected vendors.
     expect(
       screen.getByText(/portal\.integrations\.availableHeading/),
     ).toBeInTheDocument();
   });
 
-  it("deletes an instance from the expanded group", async () => {
+  it("deletes an instance directly from its row", async () => {
     fetchIntegrations.mockResolvedValueOnce([bucket(5, "Claims")]);
     fetchIntegrations.mockResolvedValueOnce([]);
     render(<Integrations />);
 
-    fireEvent.click(
-      await screen.findByText("portal.connections.types.s3.label"),
-    );
     fireEvent.click(await screen.findByText("portal.connections.delete"));
 
     await waitFor(() => expect(deleteIntegration).toHaveBeenCalledWith(5));
@@ -115,9 +111,6 @@ describe("Integrations view", () => {
     );
     render(<Integrations />);
 
-    fireEvent.click(
-      await screen.findByText("portal.connections.types.s3.label"),
-    );
     fireEvent.click(await screen.findByText("portal.connections.delete"));
 
     expect(
diff --git a/frontend/editor/src/portal/views/Integrations.tsx b/frontend/editor/src/portal/views/Integrations.tsx
index dad19e750c..793c21f880 100644
--- a/frontend/editor/src/portal/views/Integrations.tsx
+++ b/frontend/editor/src/portal/views/Integrations.tsx
@@ -2,8 +2,15 @@ import { useCallback, useEffect, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
 import AddRoundedIcon from "@mui/icons-material/AddRounded";
 import SearchRoundedIcon from "@mui/icons-material/SearchRounded";
-import ExpandMoreRoundedIcon from "@mui/icons-material/ExpandMoreRounded";
-import { Banner, Button, Skeleton } from "@app/ui";
+import {
+  Banner,
+  Button,
+  column,
+  DataTable,
+  type DataTableColumn,
+  type DataTableGroup,
+  EmptyState,
+} from "@app/ui";
 import { errorMessage } from "@portal/api/http";
 import {
   deleteIntegration,
@@ -24,17 +31,17 @@ import {
 } from "@portal/components/sources/connectionTypes";
 import { STEP_OPERATIONS } from "@portal/components/policies/stepOperations";
 import { COMING_SOON_SOURCE_TYPES } from "@portal/components/sources/sourceTypes";
+import "@portal/theme/surface.css";
 import "@portal/views/Integrations.css";
 
 /**
  * The integrations catalogue: everything Stirling can talk to, in one place.
  *
- * Three bands in one list. Connected first — stored connections grouped by
- * vendor, expandable when a vendor has several (two S3 buckets is normal, not
- * an error), each instance editable and one click from "add another". Then
- * Available — the supported vendors, each saying what it works with (sources,
- * policies, pipelines) so it's obvious whether a vendor feeds documents in or
- * receives them. Coming-soon source connectors close the list greyed out, so
+ * Three bands, one grouped table. Connected first - stored connections grouped
+ * by vendor (two S3 buckets is normal, not an error), every instance a row you
+ * can edit or remove, with "add another" on the vendor's group header. Then
+ * Available - the supported vendors, each saying what it works with (sources,
+ * policies, pipelines). Coming-soon source connectors close the list so
  * "do you support X?" is answered honestly instead of hidden.
  *
  * Setup itself stays in the shared {@link ConnectionModal}; every entry point
@@ -71,6 +78,20 @@ interface TypeGroup {
   connections: IntegrationConfig[];
 }
 
+/** One normalized row across the three bands, so a single grouped table renders
+ *  connected instances, available vendors, and coming-soon vendors alike. */
+type IntegrationRow = {
+  key: string;
+  brandId: string;
+  title: string;
+  subtitle: string;
+  worksWith: WorksWith[];
+} & (
+  | { kind: "instance"; connection: IntegrationConfig; canManage: boolean }
+  | { kind: "available"; typeId: string }
+  | { kind: "soon" }
+);
+
 export function Integrations() {
   const { t } = useTranslation();
   const [connections, setConnections] = useState<IntegrationConfig[] | null>(
@@ -81,13 +102,13 @@ export function Integrations() {
   >(undefined);
   const [filter, setFilter] = useState<Filter>("all");
   const [query, setQuery] = useState("");
-  const [expanded, setExpanded] = useState<Set<string>>(new Set());
   const [modal, setModal] = useState<{
     open: boolean;
     editing: IntegrationConfig | null;
     fixedTypeId?: string;
   }>({ open: false, editing: null });
   const [busy, setBusy] = useState(false);
+  const [deletingId, setDeletingId] = useState<number | null>(null);
   const [error, setError] = useState<string | null>(null);
 
   const refresh = useCallback(async () => {
@@ -191,45 +212,152 @@ export function Integrations() {
     return counts;
   }, [catalogue]);
 
-  function toggleExpand(typeId: string) {
-    setExpanded((current) => {
-      const next = new Set(current);
-      if (next.has(typeId)) next.delete(typeId);
-      else next.add(typeId);
-      return next;
-    });
-  }
-
-  function openCreate(typeId: string) {
+  const openCreate = useCallback((typeId: string) => {
     setModal({ open: true, editing: null, fixedTypeId: typeId });
-  }
+  }, []);
 
-  function openEdit(connection: IntegrationConfig) {
+  const openEdit = useCallback((connection: IntegrationConfig) => {
     setModal({ open: true, editing: connection });
-  }
+  }, []);
 
-  async function remove(connection: IntegrationConfig) {
-    if (busy) return;
-    setBusy(true);
-    setError(null);
-    try {
-      await deleteIntegration(connection.id);
-      await refresh();
-    } catch (e) {
-      setError(errorMessage(e));
-    } finally {
-      setBusy(false);
-    }
-  }
+  const remove = useCallback(
+    async (connection: IntegrationConfig) => {
+      if (busy) return;
+      setBusy(true);
+      setDeletingId(connection.id);
+      setError(null);
+      try {
+        await deleteIntegration(connection.id);
+        await refresh();
+      } catch (e) {
+        setError(errorMessage(e));
+      } finally {
+        setBusy(false);
+        setDeletingId(null);
+      }
+    },
+    [busy, refresh],
+  );
 
   const isLoading = connections === null;
 
-  const chip = (kind: WorksWith) => (
-    <span key={kind} className="portal-integrations__chip">
-      {t(`portal.integrations.worksWith.${kind}`)}
-    </span>
+  const worksWithText = useCallback(
+    (list: WorksWith[]) =>
+      list.map((w) => t(`portal.integrations.worksWith.${w}`)).join(", "),
+    [t],
   );
 
+  const columns = useMemo<DataTableColumn<IntegrationRow>[]>(
+    () => [
+      column.entity({
+        key: "integration",
+        header: t("portal.integrations.table.integration"),
+        icon: (r) => <BrandMark id={r.brandId} size={22} />,
+        primary: (r) => r.title,
+        note: (r) => r.subtitle || undefined,
+      }),
+      column.text({
+        key: "worksWith",
+        header: t("portal.integrations.table.worksWith"),
+        get: (r) => worksWithText(r.worksWith),
+      }),
+      column.actions({
+        key: "actions",
+        get: (r) => {
+          if (r.kind === "instance") {
+            return r.canManage
+              ? [
+                  {
+                    label: t("portal.connections.edit"),
+                    disabled: busy,
+                    onClick: () => openEdit(r.connection),
+                  },
+                  {
+                    label: t("portal.connections.delete"),
+                    tone: "danger",
+                    loading: busy && deletingId === r.connection.id,
+                    disabled: busy,
+                    onClick: () => void remove(r.connection),
+                  },
+                ]
+              : [];
+          }
+          if (r.kind === "available") {
+            return [
+              {
+                label: t("portal.integrations.connect"),
+                onClick: () => openCreate(r.typeId),
+              },
+            ];
+          }
+          return [];
+        },
+      }),
+    ],
+    [t, busy, deletingId, remove, openEdit, openCreate, worksWithText],
+  );
+
+  const tableGroups = useMemo<DataTableGroup<IntegrationRow>[]>(() => {
+    const gs: DataTableGroup<IntegrationRow>[] = [];
+    for (const { type, connections: list } of connectedGroups) {
+      gs.push({
+        key: `connected-${type.id}`,
+        title: t(type.labelKey),
+        meta:
+          list.length > 1
+            ? t("portal.integrations.connectionCount", { count: list.length })
+            : t("portal.integrations.status.connected"),
+        actions: [
+          {
+            label: t("portal.integrations.connect"),
+            onClick: () => openCreate(type.id),
+          },
+        ],
+        rows: list.map((c) => ({
+          kind: "instance" as const,
+          key: `i-${c.id}`,
+          brandId: type.id,
+          title: c.name,
+          subtitle: connectionDetail(c),
+          worksWith: worksWith(type),
+          connection: c,
+          canManage: !!c.canManage,
+        })),
+      });
+    }
+    if (availableTypes.length > 0) {
+      gs.push({
+        key: "available",
+        title: t("portal.integrations.availableHeading"),
+        rows: availableTypes.map((type) => ({
+          kind: "available" as const,
+          key: `a-${type.id}`,
+          brandId: type.id,
+          title: t(type.labelKey),
+          subtitle: t(type.descriptionKey),
+          worksWith: worksWith(type),
+          typeId: type.id,
+        })),
+      });
+    }
+    if (comingSoon.length > 0) {
+      gs.push({
+        key: "soon",
+        title: t("portal.integrations.comingSoonHeading"),
+        muted: true,
+        rows: comingSoon.map((entry) => ({
+          kind: "soon" as const,
+          key: `s-${entry.type}`,
+          brandId: entry.type,
+          title: t(entry.labelKey),
+          subtitle: t(entry.descriptionKey),
+          worksWith: ["sources"],
+        })),
+      });
+    }
+    return gs;
+  }, [connectedGroups, availableTypes, comingSoon, t, openCreate]);
+
   return (
     <div className="portal-integrations">
       <header className="portal-integrations__head">
@@ -243,6 +371,7 @@ export function Integrations() {
         </div>
         {capabilities?.customApi && (
           <Button
+            fat
             onClick={() => openCreate("api")}
             leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
           >
@@ -299,187 +428,23 @@ export function Integrations() {
 
       {error && <Banner tone="danger" description={error} />}
 
-      {isLoading ? (
-        <div className="portal-integrations__skeleton" aria-hidden>
-          {Array.from({ length: 4 }).map((_, i) => (
-            <Skeleton key={i} height="3.25rem" />
-          ))}
-        </div>
+      {!isLoading && tableGroups.length === 0 ? (
+        <EmptyState
+          size="compact"
+          title={t("portal.integrations.noResults.title", "No matches")}
+          description={t(
+            "portal.integrations.noResults.description",
+            "No integrations match your filters. Try a different category or search.",
+          )}
+        />
       ) : (
-        <div className="portal-integrations__table">
-          <div className="portal-integrations__cols" aria-hidden>
-            <span>{t("portal.integrations.table.integration")}</span>
-            <span>{t("portal.integrations.table.worksWith")}</span>
-            <span />
-          </div>
-
-          {connectedGroups.length > 0 && (
-            <div className="portal-integrations__section">
-              {t("portal.integrations.connectedHeading")} ·{" "}
-              {connectedGroups.length}
-            </div>
-          )}
-          {connectedGroups.map(({ type, connections: list }) => {
-            const open = expanded.has(type.id);
-            return (
-              <div key={type.id} className="portal-integrations__group">
-                <button
-                  type="button"
-                  className="portal-integrations__row portal-integrations__row--connected"
-                  aria-expanded={open}
-                  onClick={() => toggleExpand(type.id)}
-                >
-                  <span className="portal-integrations__name">
-                    <BrandMark id={type.id} size={22} />
-                    <span className="portal-integrations__name-text">
-                      <span className="portal-integrations__label">
-                        {t(type.labelKey)}
-                      </span>
-                      <span className="portal-integrations__detail">
-                        {list.length === 1
-                          ? list[0].name
-                          : t("portal.integrations.connectionCount", {
-                              count: list.length,
-                            })}
-                      </span>
-                    </span>
-                  </span>
-                  <span className="portal-integrations__chips">
-                    {worksWith(type).map(chip)}
-                  </span>
-                  <span className="portal-integrations__status">
-                    <span className="portal-integrations__status-dot" />
-                    {t("portal.integrations.status.connected")}
-                    <ExpandMoreRoundedIcon
-                      fontSize="inherit"
-                      className={
-                        "portal-integrations__chevron" +
-                        (open ? " is-open" : "")
-                      }
-                    />
-                  </span>
-                </button>
-                {open && (
-                  <div className="portal-integrations__instances">
-                    {list.map((connection) => (
-                      <div
-                        key={connection.id}
-                        className="portal-integrations__instance"
-                      >
-                        <span className="portal-integrations__instance-name">
-                          {connection.name}
-                        </span>
-                        <span className="portal-integrations__instance-detail">
-                          {connectionDetail(connection)}
-                        </span>
-                        {connection.canManage && (
-                          <span className="portal-integrations__instance-actions">
-                            <Button
-                              variant="tertiary"
-                              size="sm"
-                              disabled={busy}
-                              onClick={() => openEdit(connection)}
-                            >
-                              {t("portal.connections.edit")}
-                            </Button>
-                            <Button
-                              variant="tertiary"
-                              size="sm"
-                              accent="danger"
-                              disabled={busy}
-                              onClick={() => void remove(connection)}
-                            >
-                              {t("portal.connections.delete")}
-                            </Button>
-                          </span>
-                        )}
-                      </div>
-                    ))}
-                    <div className="portal-integrations__instance portal-integrations__instance--add">
-                      <Button
-                        variant="tertiary"
-                        size="sm"
-                        onClick={() => openCreate(type.id)}
-                        leftSection={
-                          <AddRoundedIcon style={{ fontSize: "1rem" }} />
-                        }
-                      >
-                        {t("portal.integrations.addAnother")}
-                      </Button>
-                    </div>
-                  </div>
-                )}
-              </div>
-            );
-          })}
-
-          {availableTypes.length > 0 && (
-            <div className="portal-integrations__section">
-              {t("portal.integrations.availableHeading")} ·{" "}
-              {availableTypes.length}
-            </div>
-          )}
-          {availableTypes.map((type) => (
-            <div key={type.id} className="portal-integrations__row">
-              <span className="portal-integrations__name">
-                <BrandMark id={type.id} size={22} />
-                <span className="portal-integrations__name-text">
-                  <span className="portal-integrations__label">
-                    {t(type.labelKey)}
-                  </span>
-                  <span className="portal-integrations__detail">
-                    {t(type.descriptionKey)}
-                  </span>
-                </span>
-              </span>
-              <span className="portal-integrations__chips">
-                {worksWith(type).map(chip)}
-              </span>
-              <span className="portal-integrations__status">
-                <Button
-                  variant="secondary"
-                  size="sm"
-                  onClick={() => openCreate(type.id)}
-                >
-                  {t("portal.integrations.connect")}
-                </Button>
-              </span>
-            </div>
-          ))}
-
-          {comingSoon.length > 0 && (
-            <div className="portal-integrations__section">
-              {t("portal.integrations.comingSoonHeading")} · {comingSoon.length}
-            </div>
-          )}
-          {comingSoon.map((entry) => (
-            <div
-              key={entry.type}
-              className="portal-integrations__row portal-integrations__row--soon"
-              aria-disabled
-            >
-              <span className="portal-integrations__name">
-                <BrandMark id={entry.type} size={22} />
-                <span className="portal-integrations__name-text">
-                  <span className="portal-integrations__label">
-                    {t(entry.labelKey)}
-                  </span>
-                  <span className="portal-integrations__detail">
-                    {t(entry.descriptionKey)}
-                  </span>
-                </span>
-              </span>
-              <span className="portal-integrations__chips">
-                {chip("sources")}
-              </span>
-              <span className="portal-integrations__status">
-                <span className="portal-integrations__soon-badge">
-                  {t("portal.sources.builder.comingSoon")}
-                </span>
-              </span>
-            </div>
-          ))}
-        </div>
+        <DataTable<IntegrationRow>
+          columns={columns}
+          groups={tableGroups}
+          rowKey={(r) => r.key}
+          loading={isLoading}
+          skeletonRows={5}
+        />
       )}
 
       <ConnectionModal
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.css b/frontend/editor/src/portal/views/PipelineBuilder.css
index 464d3fad55..343aea95f6 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.css
+++ b/frontend/editor/src/portal/views/PipelineBuilder.css
@@ -225,3 +225,43 @@
   gap: 0.5rem;
   width: 100%;
 }
+
+/* The graph column IS the card: the test control is its header and the graph its body, so the test
+   control reads as the graph's toolbar and - crucially - the card's top lines up with the inspector
+   beside it (a toolbar sitting *above* the card pushed the graph down out of alignment). Caps at the
+   row height and clips its rounded corners; the body scrolls inside while the header stays put. */
+.portal-builder__canvas {
+  display: flex;
+  flex-direction: column;
+  min-height: 0;
+  max-height: 100%;
+  overflow: hidden;
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-lg);
+  background: var(--c-surface-sunken);
+}
+
+/* The test control as the card's header, ruled off from the graph below it. */
+.portal-builder__canvas > .portal-pipeline-toolbar {
+  flex: none;
+  padding: 0.75rem 1rem;
+  border-bottom: 1px solid var(--c-border-subtle);
+}
+
+/* The graph as the card's body: it drops its own frame (the canvas provides it now) and scrolls
+   inside while the header stays put. */
+.portal-builder__canvas > .portal-graph {
+  flex: 1 1 auto;
+  min-height: 0;
+  max-height: none;
+  border: none;
+  border-radius: 0;
+  background: transparent;
+}
+
+/* Stacked (short viewport): the page scrolls, so the column must not cap or nest its own scroll. */
+@media (max-width: 60rem) {
+  .portal-builder__canvas {
+    max-height: none;
+  }
+}
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
index b1ff80682d..52fb5d516c 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
@@ -456,7 +456,7 @@ describe("PipelineBuilder", () => {
     expect(
       await screen.findByText("portal.pipelines.builder.needsSource"),
     ).toBeInTheDocument();
-    // Still nothing chosen, so the pipeline cannot be saved.
+    // Still nothing chosen, so the pipeline cannot be created.
     expect(
       screen.getByText("portal.pipelines.composer.create").closest("button"),
     ).toBeDisabled();
@@ -601,15 +601,15 @@ describe("PipelineBuilder", () => {
         target: { value: "Needs both" },
       },
     );
-    const saveButton = () =>
+    const createButton = () =>
       screen.getByText("portal.pipelines.composer.create").closest("button");
 
     // Name only: blocked (no source, no destination).
-    expect(saveButton()).toBeDisabled();
+    expect(createButton()).toBeDisabled();
 
     // An input with a source but still no destination: blocked.
     await pickInputSource("Claims intake");
-    expect(saveButton()).toBeDisabled();
+    expect(createButton()).toBeDisabled();
 
     // Both chosen: allowed, and both are sent.
     await pickDestination();
@@ -782,17 +782,19 @@ describe("PipelineBuilder", () => {
     ).toBeInTheDocument();
   });
 
-  it("clears processed history from the header and confirms", async () => {
+  it("reprocesses the source: clears the processed record, runs, and reports", async () => {
     renderBuilder("/processor/pipelines/plc-1");
 
     await openTray();
     fireEvent.click(screen.getByText("portal.pipelines.detail.clearHistory"));
 
+    // It forgets what was processed, then triggers a run so those files go through now.
     await waitFor(() =>
       expect(clearProcessedHistory).toHaveBeenCalledWith("plc-1"),
     );
+    await waitFor(() => expect(triggerPipeline).toHaveBeenCalledWith("plc-1"));
     expect(
-      await screen.findByText("portal.pipelines.run.historyCleared"),
+      await screen.findByText("portal.pipelines.run.completed"),
     ).toBeInTheDocument();
   });
 
@@ -846,6 +848,8 @@ describe("PipelineBuilder", () => {
   it("deletes an existing pipeline after confirmation", async () => {
     renderBuilder("/processor/pipelines/plc-1");
 
+    // Delete is a rare, destructive action, so it lives behind the overflow tray.
+    await openTray();
     fireEvent.click(await screen.findByText("portal.pipelines.detail.delete"));
     fireEvent.click(await screen.findByText("portal.pipelines.delete.confirm"));
 
@@ -853,6 +857,45 @@ describe("PipelineBuilder", () => {
     expect(await screen.findByText("pipelines list")).toBeInTheDocument();
   });
 
+  it("pauses a live pipeline at once, in place, and re-saves the persisted policy", async () => {
+    renderBuilder("/processor/pipelines/plc-1");
+
+    // POLICY.enabled is true, so the toggle offers to pause it.
+    fireEvent.click(await screen.findByText("portal.pipelines.builder.pause"));
+
+    await waitFor(() => expect(savePipeline).toHaveBeenCalledTimes(1));
+    expect(savePipeline).toHaveBeenCalledWith(
+      expect.objectContaining({ id: "plc-1", enabled: false }),
+    );
+    // It acts in place: the builder stays open and the control now offers to activate again.
+    expect(
+      await screen.findByText("portal.pipelines.builder.activate"),
+    ).toBeInTheDocument();
+    expect(screen.queryByText("pipelines list")).not.toBeInTheDocument();
+  });
+
+  it("creates a paused pipeline when Create paused is chosen", async () => {
+    renderBuilder("/processor/pipelines/new");
+
+    fireEvent.change(
+      await screen.findByRole("textbox", {
+        name: "portal.pipelines.composer.name",
+      }),
+      { target: { value: "Paused draft" } },
+    );
+    await addTool("Compress");
+    await pickInputSource("Claims intake");
+    await pickDestination();
+
+    fireEvent.click(screen.getByText("portal.pipelines.composer.createPaused"));
+
+    await waitFor(() => expect(savePipeline).toHaveBeenCalledTimes(1));
+    expect(savePipeline).toHaveBeenCalledWith(
+      expect.objectContaining({ name: "Paused draft", enabled: false }),
+    );
+    expect(await screen.findByText("pipelines list")).toBeInTheDocument();
+  });
+
   it("prompts to save or discard when leaving with unsaved edits", async () => {
     renderBuilder("/processor/pipelines/new");
 
@@ -864,7 +907,7 @@ describe("PipelineBuilder", () => {
         target: { value: "Draft" },
       },
     );
-    fireEvent.click(screen.getByText("portal.pipelines.composer.cancel"));
+    fireEvent.click(screen.getByLabelText("portal.pipelines.builder.back"));
 
     expect(
       await screen.findByText("portal.pipelines.builder.unsavedTitle"),
@@ -928,7 +971,7 @@ describe("PipelineBuilder", () => {
     await screen.findByRole("textbox", {
       name: "portal.pipelines.composer.name",
     });
-    fireEvent.click(screen.getByText("portal.pipelines.composer.cancel"));
+    fireEvent.click(screen.getByLabelText("portal.pipelines.builder.back"));
 
     expect(await screen.findByText("pipelines list")).toBeInTheDocument();
   });
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.tsx b/frontend/editor/src/portal/views/PipelineBuilder.tsx
index 746fd61ab0..d5092f5c88 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.tsx
@@ -67,7 +67,9 @@ import { useQueryClient } from "@tanstack/react-query";
 import { qk } from "@portal/queries/keys";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { humanizeOperation } from "@portal/components/pipelines/pipelineOperations";
-import { PipelineHeader } from "@portal/components/pipelines/PipelineHeader";
+import { PipelineCreateHeader } from "@portal/components/pipelines/PipelineCreateHeader";
+import { PipelineEditHeader } from "@portal/components/pipelines/PipelineEditHeader";
+import { PipelineGraphToolbar } from "@portal/components/pipelines/PipelineGraphToolbar";
 import { PipelineInspector } from "@portal/components/pipelines/PipelineInspector";
 import { PipelineDefinitionModal } from "@portal/components/pipelines/PipelineDefinitionModal";
 import {
@@ -258,10 +260,19 @@ export function PipelineBuilder() {
   const [inputAsked, setInputAsked] = useState(false);
   const [outputAsked, setOutputAsked] = useState(false);
   const [submitting, setSubmitting] = useState(false);
+  // Which create action is in flight, so only the button that was clicked (Create / Create paused)
+  // shows its spinner. Null in edit and while idle.
+  const [pendingCreateEnabled, setPendingCreateEnabled] = useState<
+    boolean | null
+  >(null);
   const [error, setError] = useState<string | null>(null);
   const [seeded, setSeeded] = useState(false);
   const [running, setRunning] = useState(false);
-  const [clearingHistory, setClearingHistory] = useState(false);
+  // Pausing/activating an existing pipeline acts immediately (a separate save), not on the next
+  // "Save changes"; this tracks that in-flight toggle.
+  const [togglingEnabled, setTogglingEnabled] = useState(false);
+  // Clearing the processed record then running, so already-handled files go through again.
+  const [reprocessing, setReprocessing] = useState(false);
   const [runResult, setRunResult] = useState<RunResult | null>(null);
   const [pendingDelete, setPendingDelete] = useState(false);
   const [deleting, setDeleting] = useState(false);
@@ -587,10 +598,11 @@ export function PipelineBuilder() {
   }
 
   // Track unsaved edits: snapshot the form and compare against the state captured just after
-  // seeding, so leaving the builder can prompt to save or discard.
+  // seeding, so leaving the builder can prompt to save or discard. `enabled` is deliberately left
+  // out: in edit it is toggled and persisted at once (never an unsaved edit), and in create it is
+  // chosen at submit - so it can never be the thing that makes the form dirty.
   const snapshot = JSON.stringify({
     name: name.trim(),
-    enabled,
     input,
     steps: steps.map((step) => serializeToolStep(step, allTools)),
     uploads: steps.map(stepRequiresUpload),
@@ -602,20 +614,46 @@ export function PipelineBuilder() {
   }, [seeded, snapshot]);
   const dirty = baseline.current !== null && baseline.current !== snapshot;
 
-  // The input needs a source, and a scheduled input needs a positive interval; the pipeline
-  // needs exactly one output destination.
-  const inputValid =
-    input.sourceId !== "" &&
-    (input.triggerType !== "schedule" || Number(input.scheduleCount) > 0);
+  // Each validity condition is defined exactly once here, then consumed both by the graph (which
+  // flags each end) and by the blocker list below.
+  const sourceChosen = input.sourceId !== "";
+  const scheduleValid =
+    input.triggerType !== "schedule" || Number(input.scheduleCount) > 0;
+  const inputValid = sourceChosen && scheduleValid;
   const outputValid = outputIds.length === 1;
-  const canSave =
-    name.trim() !== "" &&
-    inputValid &&
-    outputValid &&
-    !hasUploadSteps &&
-    !hasUnconfiguredSteps &&
-    !hasIncompatibleSteps &&
-    !submitting;
+
+  // The single source of truth for "can this be committed": every reason it can't be, in the order
+  // they appear down the form, so a disabled Create / Save button can say exactly what is still owed.
+  const blockers: string[] = [];
+  if (name.trim() === "")
+    blockers.push(t("portal.pipelines.builder.blocker.name"));
+  if (!sourceChosen)
+    blockers.push(t("portal.pipelines.builder.blocker.source"));
+  else if (!scheduleValid)
+    blockers.push(t("portal.pipelines.builder.blocker.schedule"));
+  if (!outputValid)
+    blockers.push(t("portal.pipelines.builder.blocker.destination"));
+  if (hasUnconfiguredSteps)
+    blockers.push(
+      t("portal.pipelines.builder.blocker.setup", {
+        tools: unconfiguredStepLabels.join(", "),
+      }),
+    );
+  if (hasUploadSteps)
+    blockers.push(
+      t("portal.pipelines.builder.blocker.upload", {
+        tools: uploadStepLabels.join(", "),
+      }),
+    );
+  if (hasIncompatibleSteps)
+    blockers.push(
+      t("portal.pipelines.builder.blocker.incompatible", {
+        tools: blockingSteps.join(", "),
+      }),
+    );
+
+  // Nothing left to fix, and not already committing.
+  const canSave = blockers.length === 0 && !submitting;
 
   const listPath = toPortalPath(VIEW_PATHS.pipelines);
 
@@ -629,14 +667,14 @@ export function PipelineBuilder() {
     else navigate(destination);
   }
 
-  async function save(destination: string) {
+  async function save(destination: string, enabledOverride?: boolean) {
     if (!canSave) return;
     setSubmitting(true);
     setError(null);
     const policy: Policy = {
       id: policyState.data?.id ?? undefined,
       name: name.trim(),
-      enabled,
+      enabled: enabledOverride ?? enabled,
       // The wire shape stays a list; canSave guarantees the one input has a source.
       inputs: [{ sourceId: input.sourceId, trigger: buildTriggerFor(input) }],
       steps: steps.map((step) => serializeToolStep(step, allTools)),
@@ -652,6 +690,39 @@ export function PipelineBuilder() {
     } catch (e) {
       setError(errorMessage(e));
       setSubmitting(false);
+      setPendingCreateEnabled(null);
+    }
+  }
+
+  // Create live or paused. The buttons disable until the pipeline is valid, so this only fires on a
+  // saveable pipeline; the flag records which button spins and whether it starts live or paused.
+  function submitCreate(enabledValue: boolean) {
+    setPendingCreateEnabled(enabledValue);
+    void save(listPath, enabledValue);
+  }
+
+  /**
+   * Pause or activate the saved pipeline now, without leaving the builder. It re-saves the
+   * persisted policy with the flag flipped - deliberately NOT the working form - so a pending chain
+   * edit is not silently committed by a pause. The dirty tracker ignores `enabled`, so this never
+   * looks like an unsaved change.
+   */
+  async function handleTogglePause() {
+    // Never run alongside a Save: both write the whole policy, and a concurrent pair would race
+    // (the pause carries the persisted steps, so it could clobber the edits Save is committing).
+    if (togglingEnabled || submitting || !policyState.data) return;
+    const next = !enabled;
+    setTogglingEnabled(true);
+    setError(null);
+    try {
+      await savePipeline({ ...policyState.data, enabled: next });
+      if (!mounted.current) return;
+      setEnabled(next);
+      await invalidatePipelines();
+    } catch (e) {
+      if (mounted.current) setError(errorMessage(e));
+    } finally {
+      if (mounted.current) setTogglingEnabled(false);
     }
   }
 
@@ -741,39 +812,45 @@ export function PipelineBuilder() {
     return { tone: "info", text: t("portal.pipelines.run.empty") };
   }
 
+  // Trigger the saved pipeline and report the outcome: what the sweep started (or why it started
+  // nothing), then each run's terminal state. Shared by Run now and the reprocess action.
+  async function reportRun(policyId: string) {
+    const outcome = await triggerPipeline(policyId);
+    const runIds = outcome.runIds;
+    if (runIds.length === 0) {
+      if (mounted.current) setRunResult(emptySweepResult(outcome));
+      return;
+    }
+    const finals = await Promise.all(runIds.map((runId) => awaitRun(runId)));
+    if (!mounted.current) return;
+    const failed = finals.find((r) => r?.status === "FAILED");
+    if (failed) {
+      setRunResult({
+        tone: "danger",
+        text: t("portal.pipelines.run.failed", { error: failed.error ?? "" }),
+      });
+    } else if (finals.some((r) => r === null)) {
+      // Gave up polling before a terminal status; the run may still finish server-side.
+      setRunResult({
+        tone: "warning",
+        text: t("portal.pipelines.run.timeout"),
+      });
+    } else if (finals.every((r) => r?.status === "COMPLETED")) {
+      setRunResult({
+        tone: "success",
+        text: t("portal.pipelines.run.completed", { count: finals.length }),
+      });
+    } else {
+      setRunResult({ tone: "info", text: t("portal.pipelines.run.running") });
+    }
+  }
+
   async function handleRun() {
-    if (running || !id) return;
+    if (running || reprocessing || !id) return;
     setRunning(true);
     setRunResult(null);
     try {
-      const outcome = await triggerPipeline(id);
-      const runIds = outcome.runIds;
-      if (runIds.length === 0) {
-        if (mounted.current) setRunResult(emptySweepResult(outcome));
-        return;
-      }
-      const finals = await Promise.all(runIds.map((runId) => awaitRun(runId)));
-      if (!mounted.current) return;
-      const failed = finals.find((r) => r?.status === "FAILED");
-      if (failed) {
-        setRunResult({
-          tone: "danger",
-          text: t("portal.pipelines.run.failed", { error: failed.error ?? "" }),
-        });
-      } else if (finals.some((r) => r === null)) {
-        // Gave up polling before a terminal status; the run may still finish server-side.
-        setRunResult({
-          tone: "warning",
-          text: t("portal.pipelines.run.timeout"),
-        });
-      } else if (finals.every((r) => r?.status === "COMPLETED")) {
-        setRunResult({
-          tone: "success",
-          text: t("portal.pipelines.run.completed", { count: finals.length }),
-        });
-      } else {
-        setRunResult({ tone: "info", text: t("portal.pipelines.run.running") });
-      }
+      await reportRun(id);
     } catch (e) {
       if (mounted.current)
         setRunResult({ tone: "danger", text: errorMessage(e) });
@@ -783,26 +860,22 @@ export function PipelineBuilder() {
   }
 
   /**
-   * Forget which source files this pipeline has processed, so the next sweep
-   * reprocesses everything currently in its sources (the standard retry for a
-   * parked-by-failure file). Does not touch the files themselves.
+   * Reprocess everything currently in the sources: forget which files the pipeline already handled,
+   * then run at once so those files - which a normal run skips - go through now. Reports the run's
+   * outcome exactly like Run now; does not touch the files themselves.
    */
-  async function handleClearHistory() {
-    if (clearingHistory || !id) return;
-    setClearingHistory(true);
+  async function handleReprocessAll() {
+    if (running || reprocessing || !id) return;
+    setReprocessing(true);
     setRunResult(null);
     try {
       await clearProcessedHistory(id);
-      if (mounted.current)
-        setRunResult({
-          tone: "success",
-          text: t("portal.pipelines.run.historyCleared"),
-        });
+      await reportRun(id);
     } catch (e) {
       if (mounted.current)
         setRunResult({ tone: "danger", text: errorMessage(e) });
     } finally {
-      if (mounted.current) setClearingHistory(false);
+      if (mounted.current) setReprocessing(false);
     }
   }
 
@@ -1056,29 +1129,37 @@ export function PipelineBuilder() {
 
   return (
     <div className="portal-builder">
-      <PipelineHeader
-        name={name}
-        onNameChange={setName}
-        enabled={enabled}
-        onEnabledChange={setEnabled}
-        isEdit={isEdit}
-        stepCount={steps.length}
-        canSave={canSave}
-        saving={submitting}
-        onSave={() => save(listPath)}
-        onCancel={() => attemptLeave(listPath)}
-        onBack={() => attemptLeave(listPath)}
-        onTest={handleTest}
-        testing={testing}
-        onRun={handleRun}
-        running={running}
-        onClearHistory={handleClearHistory}
-        clearingHistory={clearingHistory}
-        onDelete={() => setPendingDelete(true)}
-        onViewDefinition={() => setDefinitionOpen(true)}
-        runResult={testSummary}
-        onDownloadOutput={downloadOutput}
-      />
+      {isEdit ? (
+        <PipelineEditHeader
+          name={name}
+          onNameChange={setName}
+          enabled={enabled}
+          onTogglePause={handleTogglePause}
+          togglingEnabled={togglingEnabled}
+          onBack={() => attemptLeave(listPath)}
+          canSave={canSave}
+          blockers={blockers}
+          saving={submitting}
+          onSave={() => save(listPath)}
+          onRun={handleRun}
+          running={running}
+          onReprocess={handleReprocessAll}
+          reprocessing={reprocessing}
+          onDelete={() => setPendingDelete(true)}
+        />
+      ) : (
+        <PipelineCreateHeader
+          name={name}
+          onNameChange={setName}
+          canSave={canSave}
+          blockers={blockers}
+          saving={submitting}
+          pendingCreateEnabled={pendingCreateEnabled}
+          onCreate={() => submitCreate(true)}
+          onCreatePaused={() => submitCreate(false)}
+          onBack={() => attemptLeave(listPath)}
+        />
+      )}
 
       {error && <Banner tone="danger" description={error} />}
       {runResult && (
@@ -1110,44 +1191,54 @@ export function PipelineBuilder() {
       )}
 
       <div className="portal-builder__grid">
-        <PipelineGraph
-          // An end is on the chain once it has been asked for or already holds a value, so a
-          // loaded pipeline needs no seeding: its source and destination place themselves.
-          input={
-            inputAsked || inputValid
-              ? {
-                  label:
-                    chosenSource?.name ??
-                    t("portal.pipelines.builder.chooseSource"),
-                  detail: chosenSource ? triggerSummary() : undefined,
-                  warning: inputValid
-                    ? undefined
-                    : t("portal.pipelines.builder.needsSource"),
-                }
-              : null
-          }
-          output={
-            outputAsked || outputValid
-              ? {
-                  label:
-                    chosenDestination?.name ??
-                    t("portal.pipelines.builder.chooseDestination"),
-                  warning: outputValid
-                    ? undefined
-                    : t("portal.pipelines.builder.needsDestination"),
-                }
-              : null
-          }
-          steps={graphSteps}
-          selected={selected}
-          onSelect={setSelected}
-          onAddEnd={addEnd}
-          onRemoveEnd={removeEnd}
-          onInsertStep={setPickerAt}
-          onRemoveSteps={removeSteps}
-          onReorderSteps={reorderSteps}
-          onOpenStepError={(index) => setSelected({ steps: [index] })}
-        />
+        <div className="portal-builder__canvas">
+          <PipelineGraphToolbar
+            stepCount={steps.length}
+            onTest={handleTest}
+            testing={testing}
+            runResult={testSummary}
+            onDownloadOutput={downloadOutput}
+            onViewDefinition={() => setDefinitionOpen(true)}
+          />
+          <PipelineGraph
+            // An end is on the chain once it has been asked for or already holds a value, so a
+            // loaded pipeline needs no seeding: its source and destination place themselves.
+            input={
+              inputAsked || inputValid
+                ? {
+                    label:
+                      chosenSource?.name ??
+                      t("portal.pipelines.builder.chooseSource"),
+                    detail: chosenSource ? triggerSummary() : undefined,
+                    warning: inputValid
+                      ? undefined
+                      : t("portal.pipelines.builder.needsSource"),
+                  }
+                : null
+            }
+            output={
+              outputAsked || outputValid
+                ? {
+                    label:
+                      chosenDestination?.name ??
+                      t("portal.pipelines.builder.chooseDestination"),
+                    warning: outputValid
+                      ? undefined
+                      : t("portal.pipelines.builder.needsDestination"),
+                  }
+                : null
+            }
+            steps={graphSteps}
+            selected={selected}
+            onSelect={setSelected}
+            onAddEnd={addEnd}
+            onRemoveEnd={removeEnd}
+            onInsertStep={setPickerAt}
+            onRemoveSteps={removeSteps}
+            onReorderSteps={reorderSteps}
+            onOpenStepError={(index) => setSelected({ steps: [index] })}
+          />
+        </div>
 
         <PipelineInspector
           title={
diff --git a/frontend/editor/src/portal/views/Pipelines.tsx b/frontend/editor/src/portal/views/Pipelines.tsx
index b0321cfee1..f2203de972 100644
--- a/frontend/editor/src/portal/views/Pipelines.tsx
+++ b/frontend/editor/src/portal/views/Pipelines.tsx
@@ -46,6 +46,7 @@ export function Pipelines() {
           </p>
         </div>
         <Button
+          fat
           onClick={openCreate}
           leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
         >
diff --git a/frontend/editor/src/portal/views/Policies.tsx b/frontend/editor/src/portal/views/Policies.tsx
index 5bdcd19a8f..9e316852fd 100644
--- a/frontend/editor/src/portal/views/Policies.tsx
+++ b/frontend/editor/src/portal/views/Policies.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useState } from "react";
+import { useCallback, useEffect, useMemo, useState } from "react";
 import { useQueryClient } from "@tanstack/react-query";
 import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
@@ -75,30 +75,58 @@ export function Policies() {
   // is configured so a fresh workspace doesn't show a row of zeros.
   const hasPolicies = !!data && data.summary.active + data.summary.paused > 0;
 
-  const displayCatalogue: CatalogueEntry[] =
-    catalogue.length > 0
-      ? catalogue
-      : POLICY_CATEGORIES.map((cat) => ({
-          category: cat,
-          config: POLICY_CONFIG[cat.id] ?? {
-            summary: "",
-            rules: [],
-            scopeLabel: "",
-            fields: [],
-            defaultOperations: [],
-          },
-          policy: null,
-        }));
+  const displayCatalogue: CatalogueEntry[] = useMemo(
+    () =>
+      catalogue.length > 0
+        ? catalogue
+        : POLICY_CATEGORIES.map((cat) => ({
+            category: cat,
+            config: POLICY_CONFIG[cat.id] ?? {
+              summary: "",
+              rules: [],
+              scopeLabel: "",
+              fields: [],
+              defaultOperations: [],
+            },
+            policy: null,
+          })),
+    [catalogue],
+  );
 
-  function openEntry(entry: CatalogueEntry) {
-    // Block setup of an AI-required policy until the engine is confirmed on (so a
-    // click during the app-config load can't open a wizard for a disabled
-    // feature); a configured policy stays openable so it can be paused/deleted.
-    if (entry.category.requiresAiEngine && !aiEngineEnabled && !entry.policy)
-      return;
-    if (entry.policy) setDetail(entry);
-    else setWizard(entry);
-  }
+  const openEntry = useCallback(
+    (entry: CatalogueEntry) => {
+      // Block setup of an AI-required policy until the engine is confirmed on (so a
+      // click during the app-config load can't open a wizard for a disabled
+      // feature); a configured policy stays openable so it can be paused/deleted.
+      if (entry.category.requiresAiEngine && !aiEngineEnabled && !entry.policy)
+        return;
+      if (entry.policy) setDetail(entry);
+      else setWizard(entry);
+    },
+    [aiEngineEnabled],
+  );
+
+  // Open a category passed as ?category=<id> (deep link from the super
+  // search), then strip the param so back/reload doesn't re-open it. Waits for
+  // the AI-engine flag too: openEntry refuses AI-gated categories until the
+  // flag is confirmed, and stripping the param before that decision would
+  // drop the deep link silently.
+  useEffect(() => {
+    const categoryId = searchParams.get("category");
+    if (categoryId === null || loading || aiEngineLoading) return;
+    const entry = displayCatalogue.find((e) => e.category.id === categoryId);
+    if (entry) openEntry(entry);
+    const next = new URLSearchParams(searchParams);
+    next.delete("category");
+    setSearchParams(next, { replace: true });
+  }, [
+    searchParams,
+    setSearchParams,
+    loading,
+    aiEngineLoading,
+    displayCatalogue,
+    openEntry,
+  ]);
 
   async function handleSubmit(
     entry: CatalogueEntry,
diff --git a/frontend/editor/src/portal/views/Procurement.css b/frontend/editor/src/portal/views/Procurement.css
index 556fff726a..8bdd97c118 100644
--- a/frontend/editor/src/portal/views/Procurement.css
+++ b/frontend/editor/src/portal/views/Procurement.css
@@ -279,11 +279,7 @@
   margin: 0 calc(-1 * var(--flowmodal-inset));
 }
 .portal-qb__paper {
-  background: var(--c-surface);
-  border: 1px solid var(--c-border-subtle);
-  border-radius: 12px;
   overflow: hidden;
-  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.06);
 }
 .portal-qb__paper-head {
   display: flex;
@@ -386,10 +382,7 @@
 
 /* ── Deal-status hero (Home, active deal) ─────────────────────────────────── */
 .portal-hero {
-  border: 1px solid var(--c-border);
-  border-radius: 12px;
   padding: 1.1rem 1.25rem;
-  background: var(--c-surface);
   display: flex;
   flex-direction: column;
   gap: 1rem;
@@ -592,12 +585,12 @@
   cursor: pointer;
   transition:
     background 0.12s,
-    box-shadow 0.12s,
+    border-color 0.12s,
     transform 0.12s;
 }
 .portal-hero__chip--action:hover {
   background: var(--c-surface);
-  box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);
+  border-color: var(--c-border-strong);
   transform: translateY(-1px);
 }
 
@@ -786,10 +779,6 @@
      does the scrolling. */
   min-height: 16rem;
   padding: 1.35rem 1.6rem;
-  border: 1px solid var(--c-border-subtle);
-  border-radius: 12px;
-  background: var(--c-surface);
-  box-shadow: var(--shadow-sm);
   /* No serif token exists in the theme — the serif is specific to rendering legal terms as paper. */
   font-family: Georgia, "Times New Roman", "Liberation Serif", serif;
   font-size: 0.84rem;
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index bb39eae86c..67d94a0848 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -89,69 +89,6 @@
   color: var(--c-accent-text);
 }
 
-/* Expanded detail panel */
-.portal-sources__expanded {
-  background: var(--c-surface);
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-sm);
-  padding: 1.25rem;
-  animation: portal-sources-reveal var(--motion-fast) ease-out;
-}
-
-@keyframes portal-sources-reveal {
-  from {
-    opacity: 0;
-    transform: translateY(-0.25rem);
-  }
-  to {
-    opacity: 1;
-    transform: translateY(0);
-  }
-}
-
-.portal-sources__expanded-head {
-  display: flex;
-  align-items: center;
-  gap: 0.75rem;
-  padding-bottom: 0.875rem;
-  margin-bottom: 1rem;
-  border-bottom: 1px solid var(--c-border-subtle);
-}
-
-.portal-sources__expanded-title {
-  margin: 0;
-  font-size: 1rem;
-  font-weight: 600;
-  color: var(--c-text);
-}
-
-.portal-sources__expanded-sub {
-  font-size: 0.75rem;
-  color: var(--c-text-subtle);
-}
-
-.portal-sources__expanded-close {
-  margin-left: auto;
-  width: 1.75rem;
-  height: 1.75rem;
-  border-radius: var(--radius-md);
-  border: 1px solid var(--c-border);
-  background: var(--c-surface);
-  color: var(--c-text-subtle);
-  font-size: 1.125rem;
-  line-height: 1;
-  cursor: pointer;
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-
-.portal-sources__expanded-close:hover {
-  background: var(--c-hover);
-  color: var(--c-text);
-}
-
 /* Detail body */
 .portal-sources__detail {
   display: flex;
@@ -368,42 +305,6 @@
   }
 }
 
-/* Override the shared Button's flex-row label to a centred icon-over-label
-   column so the SVG sits above the name with real spacing. */
-.portal-sources__type-card .mantine-Button-label {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: 0.5rem;
-  width: 100%;
-}
-
-.portal-sources__type-card {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: 0.5rem;
-  padding: 1rem 0.5rem;
-  background: var(--c-surface);
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-md);
-  cursor: pointer;
-  transition:
-    border-color var(--motion-fast),
-    background var(--motion-fast);
-}
-
-.portal-sources__type-card:hover {
-  border-color: var(--color-border-strong, var(--c-border));
-  background: var(--c-hover);
-}
-
-.portal-sources__type-card.is-selected {
-  border-color: var(--c-primary);
-  background: color-mix(in srgb, var(--c-primary) 12%, var(--c-surface));
-  box-shadow: 0 0 0 1px var(--c-primary) inset;
-}
-
 /* Icon inside the type picker: a plain stroke icon above the label (no badge
    box — the tinted box read as an extra bordered chip floating on the tile). */
 .portal-sources__type-icon {
@@ -413,10 +314,6 @@
   color: var(--c-text-subtle);
 }
 
-.portal-sources__type-card.is-selected .portal-sources__type-icon {
-  color: var(--c-accent-text);
-}
-
 .portal-sources__type-icon .portal-sources__type-svg {
   width: 1.6rem;
   height: 1.6rem;
@@ -460,256 +357,3 @@
   gap: 0.5rem;
   width: 100%;
 }
-
-.portal-sources__connection-picker {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-  align-items: flex-start;
-}
-
-.portal-sources__connection-picker .sui-select,
-.portal-sources__connection-picker > div:first-child {
-  align-self: stretch;
-}
-
-.portal-sources__connection-create {
-  display: flex;
-  flex-direction: column;
-  gap: 0.75rem;
-  padding: 0.75rem;
-  border: 1px solid var(--color-border-2);
-  border-radius: 0.5rem;
-  align-self: stretch;
-}
-
-.portal-sources__connection-create-actions {
-  display: flex;
-  justify-content: flex-end;
-  gap: 0.5rem;
-}
-
-.portal-sources__connection-form {
-  display: flex;
-  flex-direction: column;
-  gap: 0.75rem;
-}
-
-/* Back to the grid from the form. Sits above the fields, where the type dropdown used to be. */
-.portal-sources__connection-back {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.35rem;
-  margin-bottom: 1rem;
-  padding: 0;
-  background: none;
-  border: none;
-  cursor: pointer;
-  font: inherit;
-  font-size: 0.8125rem;
-  color: var(--c-text-muted);
-}
-
-.portal-sources__connection-back:hover {
-  color: var(--text-default, inherit);
-}
-
-/* The "request an integration" / "advanced" affordances, set below the form so presets read as
-   the primary path and these as the way out of it. */
-.portal-sources__connection-secondary {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 1rem;
-  margin-top: 1rem;
-  padding-top: 0.75rem;
-  border-top: 1px solid var(--c-border-subtle);
-}
-
-.portal-sources__connection-link {
-  background: none;
-  border: none;
-  padding: 0;
-  cursor: pointer;
-  font: inherit;
-  font-size: 0.8125rem;
-  color: var(--c-conn-accent);
-  text-decoration: underline;
-  text-underline-offset: 2px;
-}
-
-.portal-sources__connection-link:hover {
-  opacity: 0.8;
-}
-
-/* Free-text fields (result-host list, body template) that outgrow a single-line input. */
-.portal-sources__connection-textarea {
-  width: 100%;
-  padding: 0.5rem 0.75rem;
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-sm, 0.375rem);
-  background: var(--surface-input, transparent);
-  color: inherit;
-  font-family: var(--font-mono, ui-monospace, monospace);
-  font-size: 0.8125rem;
-  line-height: 1.5;
-  resize: vertical;
-}
-
-.portal-sources__connection-textarea:focus-visible {
-  outline: 2px solid var(--c-conn-accent);
-  outline-offset: -1px;
-}
-
-/* ---- Integration picker ---------------------------------------------------------------------
-   A searchable grid of what we can connect to. Sized so a full category is visible without
-   scrolling on a laptop, and so the search box is the first thing focus lands on. */
-.portal-conn-picker {
-  display: flex;
-  flex-direction: column;
-  gap: 1.25rem;
-  /* Bounded rather than free-growing: the modal should not become the page. */
-  max-height: min(60vh, 32rem);
-  overflow-y: auto;
-}
-
-.portal-conn-picker__search {
-  position: sticky;
-  top: 0;
-  z-index: 1;
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  padding: 0.5rem 0.75rem;
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-sm, 0.375rem);
-  /* Real theme token with a transparent fallback so it never falls back to opaque white in dark;
-     the border alone is enough to read as an input. */
-  background: var(--color-bg-subtle, transparent);
-}
-
-.portal-conn-picker__search-icon {
-  flex: none;
-  font-size: 1.125rem;
-  color: var(--c-text-muted);
-}
-
-.portal-conn-picker__search input {
-  flex: 1;
-  min-width: 0;
-  border: none;
-  background: none;
-  outline: none;
-  font: inherit;
-  color: inherit;
-}
-
-.portal-conn-picker__section {
-  display: flex;
-  flex-direction: column;
-  gap: 0.25rem;
-}
-
-.portal-conn-picker__section-title {
-  margin: 0;
-  font-size: 0.8125rem;
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-  color: var(--c-text-muted);
-}
-
-.portal-conn-picker__section-desc {
-  margin: 0 0 0.5rem;
-  font-size: 0.8125rem;
-  color: var(--c-text-muted);
-}
-
-.portal-conn-picker__grid {
-  display: grid;
-  /* auto-fill so the grid reflows to the modal rather than to a fixed column count. */
-  grid-template-columns: repeat(auto-fill, minmax(13.5rem, 1fr));
-  gap: 0.5rem;
-}
-
-.portal-conn-picker__card {
-  display: flex;
-  align-items: flex-start;
-  gap: 0.625rem;
-  padding: 0.625rem 0.75rem;
-  text-align: left;
-  cursor: pointer;
-  border: 1px solid var(--c-border-subtle);
-  border-radius: var(--radius-sm, 0.375rem);
-  background: var(--surface-subtle, transparent);
-  font: inherit;
-  color: inherit;
-}
-
-.portal-conn-picker__card:hover {
-  border-color: var(--c-conn-accent);
-  background: color-mix(in srgb, var(--c-conn-neutral) 6%, transparent);
-}
-
-/* The custom-API card is an escape hatch, not a vendor: dashed, so it reads as "something else". */
-.portal-conn-picker__card--advanced {
-  border-style: dashed;
-}
-
-/* The vendor's real mark: full colour, no tinted plate behind it. Neutral
-   (currentColor) marks pick up the muted text tone instead. */
-.portal-conn-picker__mark {
-  flex: none;
-  display: grid;
-  place-items: center;
-  width: 1.5rem;
-  height: 1.5rem;
-  color: var(--c-text-subtle);
-}
-
-.portal-conn-picker__mark svg {
-  display: block;
-}
-
-.portal-conn-picker__card-text {
-  display: flex;
-  flex-direction: column;
-  gap: 0.125rem;
-  min-width: 0;
-}
-
-.portal-conn-picker__card-name {
-  font-size: 0.875rem;
-  font-weight: 500;
-}
-
-.portal-conn-picker__card-desc {
-  font-size: 0.75rem;
-  line-height: 1.35;
-  color: var(--c-text-muted);
-  /* Two lines keeps every card the same height without truncating most descriptions. */
-  display: -webkit-box;
-  -webkit-line-clamp: 2;
-  -webkit-box-orient: vertical;
-  overflow: hidden;
-}
-
-.portal-conn-picker__empty {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: 0.5rem;
-  padding: 2rem 1rem;
-  text-align: center;
-}
-
-.portal-conn-picker__empty-title {
-  margin: 0;
-  font-size: 0.9375rem;
-  font-weight: 600;
-}
-
-.portal-conn-picker__empty-body {
-  margin: 0 0 0.5rem;
-  font-size: 0.8125rem;
-  color: var(--c-text-muted);
-}
diff --git a/frontend/editor/src/portal/views/Sources.test.tsx b/frontend/editor/src/portal/views/Sources.test.tsx
index d4d4b0137f..166d4016fc 100644
--- a/frontend/editor/src/portal/views/Sources.test.tsx
+++ b/frontend/editor/src/portal/views/Sources.test.tsx
@@ -158,14 +158,14 @@ describe("Sources view", () => {
     expect(await screen.findByText("integrations view")).toBeInTheDocument();
   });
 
-  it("hides the KPI strip and shows the empty state when only the editor exists", async () => {
+  it("hides the KPI strip when only the editor exists", async () => {
     fetchSources.mockResolvedValue({
       kpis: RESPONSE.kpis,
       sources: [RESPONSE.sources[0]],
     });
     renderView();
     expect(
-      await screen.findByText("portal.sources.empty.title"),
+      await screen.findByText("portal.sources.types.editor.label"),
     ).toBeInTheDocument();
     expect(screen.queryByText("portal.sources.kpi.total")).toBeNull();
   });
diff --git a/frontend/editor/src/portal/views/Sources.tsx b/frontend/editor/src/portal/views/Sources.tsx
index dd449e71c8..f676b4f3db 100644
--- a/frontend/editor/src/portal/views/Sources.tsx
+++ b/frontend/editor/src/portal/views/Sources.tsx
@@ -2,10 +2,9 @@ import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Navigate, useSearchParams } from "react-router-dom";
 import AddRoundedIcon from "@mui/icons-material/AddRounded";
-import { Button, EmptyState, Skeleton } from "@app/ui";
+import { Button, Skeleton } from "@app/ui";
 import { useSectionFlags } from "@portal/hooks/useAsync";
 import { useSources } from "@portal/queries/sources";
-import { SourcesIcon } from "@portal/components/icons";
 import { type SourceView } from "@portal/api/sources";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { KpiStrip } from "@portal/components/sources/KpiStrip";
@@ -39,9 +38,9 @@ export function Sources() {
   const sources = data?.sources ?? [];
 
   // The editor is a virtual row that's always present, so "empty" means no
-  // configured sources beyond it. Gates the KPI strip and empty panel.
+  // configured sources beyond it. Gates the KPI strip.
   const configuredCount = sources.filter((s) => s.type !== "editor").length;
-  const showEmpty = !isLoading && configuredCount === 0;
+  const showKpis = isLoading || configuredCount > 0;
 
   const openCreate = () => setModal({ open: true, sourceId: null });
   const openSource = (source: SourceView) =>
@@ -61,6 +60,7 @@ export function Sources() {
         </div>
         <div className="portal-sources__actions">
           <Button
+            fat
             onClick={openCreate}
             leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
           >
@@ -69,7 +69,7 @@ export function Sources() {
         </div>
       </header>
 
-      {!showEmpty && <KpiStrip data={data} loading={loading} />}
+      {showKpis && <KpiStrip data={data} loading={loading} />}
 
       {isLoading && (
         <div className="portal-sources__table-skeleton" aria-hidden>
@@ -79,25 +79,7 @@ export function Sources() {
         </div>
       )}
 
-      {showEmpty && (
-        <EmptyState
-          icon={<SourcesIcon size={28} />}
-          title={t("portal.sources.empty.title")}
-          description={t("portal.sources.empty.description")}
-          actions={
-            <Button
-              onClick={openCreate}
-              leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
-            >
-              {t("portal.sources.actions.connectSource")}
-            </Button>
-          }
-        />
-      )}
-
-      {!isLoading && sources.length > 0 && (
-        <SourcesTable sources={sources} onRowClick={openSource} />
-      )}
+      {!isLoading && <SourcesTable sources={sources} onRowClick={openSource} />}
 
       <SourceModal
         open={modal.open}
diff --git a/frontend/editor/src/portal/views/Usage.tsx b/frontend/editor/src/portal/views/Usage.tsx
index 776b210951..b8970c4094 100644
--- a/frontend/editor/src/portal/views/Usage.tsx
+++ b/frontend/editor/src/portal/views/Usage.tsx
@@ -176,7 +176,7 @@ export function Usage({ onWalletLoaded, onReauth }: UsageProps = {}) {
           {wallet?.status === "subscribed" && (
             <Button
               variant="secondary"
-              size="sm"
+              fat
               loading={portal.opening}
               onClick={portal.open}
             >
diff --git a/frontend/editor/src/portal/views/Users.css b/frontend/editor/src/portal/views/Users.css
index ae11d3b88d..0b63c8baba 100644
--- a/frontend/editor/src/portal/views/Users.css
+++ b/frontend/editor/src/portal/views/Users.css
@@ -293,9 +293,6 @@
 }
 
 .portal-users__group {
-  background: var(--c-surface);
-  border: 1px solid var(--c-border);
-  border-radius: var(--radius-lg);
   overflow: hidden;
 }
 
@@ -355,6 +352,18 @@
 .portal-users__row + .portal-users__row {
   border-top: 1px solid var(--c-border-subtle);
 }
+/* Deep-link landing flash (?member=<id>). */
+.portal-users__row--flash {
+  animation: portal-users-row-flash 1.6s ease-out;
+}
+@keyframes portal-users-row-flash {
+  from {
+    background: var(--c-hover);
+  }
+  to {
+    background: transparent;
+  }
+}
 .portal-users__row-main {
   display: flex;
   align-items: center;
diff --git a/frontend/editor/src/portal/views/Users.saas.test.tsx b/frontend/editor/src/portal/views/Users.saas.test.tsx
index a81dcf1c28..5313857c2c 100644
--- a/frontend/editor/src/portal/views/Users.saas.test.tsx
+++ b/frontend/editor/src/portal/views/Users.saas.test.tsx
@@ -138,7 +138,7 @@ describe("Users page (SaaS flavor, end-to-end via SaasTeamController mocks)", ()
     await screen.findByText("sam.lee@acme.com");
     const panel = screen
       .getByText("Pending invitations")
-      .closest("section") as HTMLElement;
+      .closest("table") as HTMLElement;
     fireEvent.click(within(panel).getByRole("button", { name: "Cancel" }));
     // Confirm dialog -> DELETE /invitations/{id} -> refetch drops the invite.
     fireEvent.click(
diff --git a/frontend/editor/src/portal/views/Users.tsx b/frontend/editor/src/portal/views/Users.tsx
index ad76894b06..79c6c11611 100644
--- a/frontend/editor/src/portal/views/Users.tsx
+++ b/frontend/editor/src/portal/views/Users.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useMemo, useState } from "react";
+import { useEffect, useMemo, useRef, useState } from "react";
 import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { Button, EmptyState, Skeleton } from "@app/ui";
@@ -70,6 +70,29 @@ export function Users() {
     setSearchParams(next, { replace: true });
   }, [searchParams, setSearchParams]);
 
+  // Scroll to and flash the row for ?member=<id> (deep link from the super
+  // search), once the roster has rendered; then strip the param. Scoped to the
+  // roster so a pending-invitation row sharing the id can't match first.
+  const rosterRef = useRef<HTMLDivElement>(null);
+  useEffect(() => {
+    const memberId = searchParams.get("member");
+    if (memberId === null || usersState.loading) return;
+    const row = rosterRef.current?.querySelector(
+      `[data-row-key="${CSS.escape(memberId)}"]`,
+    );
+    if (row) {
+      row.scrollIntoView({ block: "center" });
+      row.classList.add("portal-users__row--flash");
+      window.setTimeout(
+        () => row.classList.remove("portal-users__row--flash"),
+        1600,
+      );
+    }
+    const next = new URLSearchParams(searchParams);
+    next.delete("member");
+    setSearchParams(next, { replace: true });
+  }, [searchParams, setSearchParams, usersState.loading]);
+
   // PORTAL grants held by a whole team (principalId = teamId); members inherit these.
   const grantByTeam = useMemo(() => {
     const m = new Map<number, ResourceGrant>();
@@ -259,11 +282,15 @@ export function Users() {
         </div>
         <div className="portal-users__head-actions">
           {caps.createTeam && (
-            <Button variant="secondary" onClick={() => setNewTeamOpen(true)}>
+            <Button
+              fat
+              variant="secondary"
+              onClick={() => setNewTeamOpen(true)}
+            >
               {t("users.newTeam.action", "+ New team")}
             </Button>
           )}
-          <Button onClick={() => openInvite(null)}>
+          <Button fat onClick={() => openInvite(null)}>
             {t("users.invite.action", "Invite people")}
           </Button>
         </div>
@@ -318,28 +345,30 @@ export function Users() {
       )}
 
       {!loading && members.length > 0 && (
-        <UsersDirectory
-          members={members}
-          teams={teams}
-          capabilities={caps}
-          onChangeRole={changeRole}
-          onGrantProcessor={grantProcessor}
-          onRevokeProcessor={revokeProcessor}
-          processorTeamIds={processorTeamIds}
-          onGrantTeamProcessor={grantTeamProcessor}
-          onRevokeTeamProcessor={revokeTeamProcessor}
-          onAddToTeam={(team) => openInvite(team.id)}
-          onResetPassword={setResetPwMember}
-          onMoveToTeam={setMoveMember}
-          onToggleEnabled={toggleEnabled}
-          onUnlock={unlock}
-          onDisableMfa={disableMfa}
-          onRemove={removeUser}
-          onRenameTeam={(team) =>
-            setRenameTarget({ id: team.id, name: team.name })
-          }
-          onDeleteTeam={deleteTeamAction}
-        />
+        <div ref={rosterRef}>
+          <UsersDirectory
+            members={members}
+            teams={teams}
+            capabilities={caps}
+            onChangeRole={changeRole}
+            onGrantProcessor={grantProcessor}
+            onRevokeProcessor={revokeProcessor}
+            processorTeamIds={processorTeamIds}
+            onGrantTeamProcessor={grantTeamProcessor}
+            onRevokeTeamProcessor={revokeTeamProcessor}
+            onAddToTeam={(team) => openInvite(team.id)}
+            onResetPassword={setResetPwMember}
+            onMoveToTeam={setMoveMember}
+            onToggleEnabled={toggleEnabled}
+            onUnlock={unlock}
+            onDisableMfa={disableMfa}
+            onRemove={removeUser}
+            onRenameTeam={(team) =>
+              setRenameTarget({ id: team.id, name: team.name })
+            }
+            onDeleteTeam={deleteTeamAction}
+          />
+        </div>
       )}
 
       <InviteMemberModal
diff --git a/frontend/editor/src/proprietary/billing/format.ts b/frontend/editor/src/proprietary/billing/format.ts
index f91f98af44..ff44e69882 100644
--- a/frontend/editor/src/proprietary/billing/format.ts
+++ b/frontend/editor/src/proprietary/billing/format.ts
@@ -293,6 +293,29 @@ export function computeBundleQuote(
 
 export type MeterState = "FULL" | "WARNED" | "DEGRADED";
 
+/**
+ * Meter for a balance that is spent DOWN — a free grant, a prepaid pool. The
+ * bar shows what is LEFT, so full reads as "plenty" and empty as "none", which
+ * is how the sidebar footer's credits row reads and the only direction that
+ * matches a figure quoting the remainder.
+ *
+ * The state bands still key on consumption, so the tone is unchanged: amber
+ * once 80% is gone, red once it's exhausted. Meters for money SPENT against a
+ * cap keep using {@link meterState} directly — there a full bar correctly means
+ * "at your ceiling".
+ */
+export function remainingMeter(
+  remaining: number,
+  total: number,
+): { state: MeterState; pct: number } {
+  const { state } = meterState(Math.max(0, total - remaining), total);
+  const pct =
+    total > 0
+      ? Math.min(100, Math.max(0, (Math.max(0, remaining) / total) * 100))
+      : 0;
+  return { state, pct };
+}
+
 /** Warn (≥80%) / degrade (≥100%) band for a usage meter; mirrors the BE thresholds. */
 export function meterState(
   used: number,
diff --git a/frontend/editor/src/proprietary/billing/index.ts b/frontend/editor/src/proprietary/billing/index.ts
index 687adec541..2fe9dffd93 100644
--- a/frontend/editor/src/proprietary/billing/index.ts
+++ b/frontend/editor/src/proprietary/billing/index.ts
@@ -14,6 +14,7 @@ export {
   docCapForMoney,
   formatPeriodDate,
   meterState,
+  remainingMeter,
   PREPAID_MONTHS_GRANTED,
   PREPAID_MONTHS_PAID,
   PDFS_PER_USER_MONTH,
diff --git a/frontend/editor/src/proprietary/components/policies/policyRunSettles.test.ts b/frontend/editor/src/proprietary/components/policies/policyRunSettles.test.ts
new file mode 100644
index 0000000000..fdce331821
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/policies/policyRunSettles.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import { finishedWithNothingToDeliver } from "@app/components/policies/usePolicyAutoRun";
+import type { PolicyRunRecord } from "@app/components/policies/policyRunStore";
+
+/**
+ * A redaction that matches nothing completes with no output file. The import
+ * effect used to skip those runs entirely, so `imported` never flipped and the
+ * file's badge + blocking overlay spun forever - on every engine.
+ */
+const run = (overrides: Partial<PolicyRunRecord> = {}): PolicyRunRecord =>
+  ({
+    runId: "r",
+    categoryId: "security",
+    fileId: "f",
+    fileName: "f.pdf",
+    fileSize: 1,
+    target: "saas",
+    status: "COMPLETED",
+    outputs: [],
+    error: null,
+    startedAt: 0,
+    ...overrides,
+  }) as PolicyRunRecord;
+
+describe("finishedWithNothingToDeliver", () => {
+  it("settles a completed run that produced no output", () => {
+    expect(finishedWithNothingToDeliver(run())).toBe(true);
+  });
+
+  it("leaves a run with outputs to the import path", () => {
+    expect(
+      finishedWithNothingToDeliver(
+        run({ outputs: [{ fileId: "o", fileName: "o.pdf" }] as never }),
+      ),
+    ).toBe(false);
+  });
+
+  it("ignores runs that aren't finished, or are already settled", () => {
+    expect(finishedWithNothingToDeliver(run({ status: "PENDING" }))).toBe(
+      false,
+    );
+    expect(finishedWithNothingToDeliver(run({ status: "FAILED" }))).toBe(false);
+    expect(finishedWithNothingToDeliver(run({ imported: true }))).toBe(false);
+  });
+
+  it("leaves classification alone - it settles via its own label path", () => {
+    expect(
+      finishedWithNothingToDeliver(run({ categoryId: "classification" })),
+    ).toBe(false);
+  });
+});
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
index 597136a32f..7a2c4bda2e 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
@@ -124,6 +124,21 @@ function failRun(runId: string, message: string): void {
 const FILE_WAIT_TRIES = 20;
 const FILE_WAIT_MS = 250;
 
+/**
+ * A policy that changed nothing (redaction matched no text, say) completes with no
+ * output: nothing to deliver, but finished. Left unimported, the file's badge and
+ * its blocking overlay spin forever.
+ */
+export function finishedWithNothingToDeliver(run: PolicyRunRecord): boolean {
+  return (
+    run.status === "COMPLETED" &&
+    !run.imported &&
+    (run.outputs?.length ?? 0) === 0 &&
+    // Classification has its own settle path: labels, no output file.
+    !isClassificationCategory(run.categoryId)
+  );
+}
+
 function isTerminal(status: PolicyRunStatus): boolean {
   return (
     status === "COMPLETED" || status === "FAILED" || status === "CANCELLED"
@@ -351,13 +366,14 @@ export function usePolicyAutoRun(): void {
       if (
         run.status !== "COMPLETED" ||
         run.imported ||
-        importing.current.has(run.runId) ||
-        // Classification settles even with no outputs (nothing to tag); other
-        // policies need an output to import.
-        (!run.outputs?.length && !classification)
+        importing.current.has(run.runId)
       ) {
         continue;
       }
+      if (finishedWithNothingToDeliver(run)) {
+        updateRun(run.runId, { imported: true });
+        continue;
+      }
       importing.current.add(run.runId);
       // Classification is metadata-only: stamp labels onto the current leaf of
       // the file it ran on (no version fork). See importClassificationLabels.
diff --git a/frontend/editor/src/proprietary/components/shared/AppSwitcher.tsx b/frontend/editor/src/proprietary/components/shared/AppSwitcher.tsx
index 2e02db3068..9ba0b6438d 100644
--- a/frontend/editor/src/proprietary/components/shared/AppSwitcher.tsx
+++ b/frontend/editor/src/proprietary/components/shared/AppSwitcher.tsx
@@ -1,15 +1,21 @@
-import { useNavigate } from "react-router-dom";
-import { useAuth } from "@app/auth/context";
 import { Logo } from "@app/ui/Logo";
 import { BrandSwitcher } from "@app/components/shared/BrandSwitcher";
 import { type AppSwitcherProps } from "@core/components/shared/AppSwitcher";
-import { PORTAL_BASENAME } from "@app/routes/portalBasename";
+import { useOtherAppSwitch } from "@app/hooks/useOtherAppSwitch";
 
+/**
+ * Sidebar brand header for builds that ship the processor. When this user can
+ * open it, the Stirling logo doubles as the editor⇄processor switcher: the mark
+ * morphs into a chevron and opens the switch menu (the same BrandSwitcher the
+ * processor sidebar uses). Users without access get a plain logo.
+ *
+ * The access gate lives in {@link useOtherAppSwitch} so this header and the
+ * sidebar footer's "Open PDF Processor" row are driven by one answer.
+ */
 export function AppSwitcher({ collapsed }: AppSwitcherProps) {
-  const { portalAccess } = useAuth();
-  const navigate = useNavigate();
+  const otherApp = useOtherAppSwitch();
 
-  if (!portalAccess) {
+  if (!otherApp) {
     return (
       <Logo
         variant={collapsed ? "iconOnly" : "iconAndText"}
@@ -22,7 +28,7 @@ export function AppSwitcher({ collapsed }: AppSwitcherProps) {
   return (
     <BrandSwitcher
       current="editor"
-      onSwitch={() => navigate(PORTAL_BASENAME)}
+      onSwitch={otherApp.onOpen}
       collapsed={collapsed}
     />
   );
diff --git a/frontend/editor/src/proprietary/components/shared/UpgradeBanner.tsx b/frontend/editor/src/proprietary/components/shared/UpgradeBanner.tsx
index c3b5ae0307..365c64a030 100644
--- a/frontend/editor/src/proprietary/components/shared/UpgradeBanner.tsx
+++ b/frontend/editor/src/proprietary/components/shared/UpgradeBanner.tsx
@@ -3,7 +3,7 @@ import { useTranslation } from "react-i18next";
 import { useNavigate, useLocation } from "react-router-dom";
 import { isAuthRoute } from "@core/constants/routes";
 import { useCheckout } from "@app/contexts/CheckoutContext";
-import { InfoBanner } from "@app/components/shared/InfoBanner";
+import { AppBanner } from "@app/components/shared/AppBanner";
 import {
   SERVER_LICENSE_REQUEST_EVENT,
   type ServerLicenseRequestPayload,
@@ -300,7 +300,7 @@ const UpgradeBanner: React.FC = () => {
         );
 
     return (
-      <InfoBanner
+      <AppBanner
         icon="warning-rounded"
         tone="warning"
         title={t(
@@ -312,13 +312,6 @@ const UpgradeBanner: React.FC = () => {
         buttonIcon="info-rounded"
         onButtonClick={buttonText ? handleSeeInfo : undefined}
         dismissible={false}
-        minHeight={60}
-        background="#FFF4E6"
-        borderColor="var(--mantine-color-orange-7)"
-        textColor="#9A3412"
-        iconColor="#EA580C"
-        buttonVariant="filled"
-        buttonColor="orange.7"
       />
     );
   };
@@ -341,7 +334,7 @@ const UpgradeBanner: React.FC = () => {
   return (
     <>
       {friendlyVisible && (
-        <InfoBanner
+        <AppBanner
           icon="stars-rounded"
           title={t("upgradeBanner.title", "Upgrade to Server Plan")}
           message={t(
@@ -353,14 +346,7 @@ const UpgradeBanner: React.FC = () => {
           onButtonClick={handleUpgrade}
           onDismiss={handleFriendlyDismiss}
           show={friendlyVisible}
-          background="linear-gradient(135deg, #667eea 0%, #764ba2 100%)"
-          borderColor="transparent"
-          textColor="#fff"
-          iconColor="#fff"
-          closeIconColor="#fff"
-          buttonVariant="filled"
-          buttonColor="blue"
-          minHeight={48}
+          tone="promo"
           compact
         />
       )}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx
index 8a902a0604..3fdd597175 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx
@@ -370,11 +370,11 @@ export default function AdminGeneralSection() {
   // Show the server setting when loaded (for admin config), otherwise show user's preference
   // Note: User's preference in localStorage is separate and takes precedence in the app via useLogoVariant hook
   const logoStyleValue = loginEnabled
-    ? (settings.ui?.logoStyle ?? preferences.logoVariant ?? "classic")
-    : (preferences.logoVariant ?? "classic");
+    ? (settings.ui?.logoStyle ?? preferences.logoVariant ?? "modern")
+    : (preferences.logoVariant ?? "modern");
 
   const handleLogoStyleChange = (value: string) => {
-    const nextValue = value === "modern" ? "modern" : "classic";
+    const nextValue = value === "classic" ? "classic" : "modern";
 
     // Only update local settings state - don't update the actual preference until save
     // When login is disabled, update preference immediately since there's no server to save to
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminPlanSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminPlanSection.tsx
index f683861e8d..c69040f0e7 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminPlanSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminPlanSection.tsx
@@ -12,7 +12,7 @@ import AvailablePlansSection from "@app/components/shared/config/configSections/
 import StaticPlanSection from "@app/components/shared/config/configSections/plan/StaticPlanSection";
 import LicenseKeySection from "@app/components/shared/config/configSections/plan/LicenseKeySection";
 import { alert } from "@app/components/toast";
-import { InfoBanner } from "@app/components/shared/InfoBanner";
+import { AppBanner } from "@app/components/shared/AppBanner";
 import { useLicenseAlert } from "@app/hooks/useLicenseAlert";
 import {
   getPreferredCurrency,
@@ -200,7 +200,7 @@ const AdminPlanSection: React.FC = () => {
       <LoginRequiredBanner show={!loginEnabled} />
 
       {shouldShowLicenseWarning && (
-        <InfoBanner
+        <AppBanner
           icon="warning-rounded"
           tone="warning"
           title={t(
@@ -215,13 +215,6 @@ const AdminPlanSection: React.FC = () => {
           buttonIcon="upgrade-rounded"
           onButtonClick={scrollToPlans}
           dismissible={false}
-          minHeight={68}
-          background="#FFF4E6"
-          borderColor="var(--mantine-color-orange-7)"
-          textColor="#9A3412"
-          iconColor="#EA580C"
-          buttonVariant="filled"
-          buttonColor="orange.7"
         />
       )}
 
diff --git a/frontend/editor/src/proprietary/components/shared/dividerWithText/DividerWithText.css b/frontend/editor/src/proprietary/components/shared/dividerWithText/DividerWithText.css
index 4d98d87239..43aaee2f83 100644
--- a/frontend/editor/src/proprietary/components/shared/dividerWithText/DividerWithText.css
+++ b/frontend/editor/src/proprietary/components/shared/dividerWithText/DividerWithText.css
@@ -16,11 +16,7 @@
 }
 
 .text-divider .text-divider__label {
-  /* A single channel triple cannot follow the colour scheme, and the old
-     fallback only reached 3.8:1 on the dark page. The muted text token carries
-     the readable shade for each scheme; the opacity hook is kept separate. */
   color: var(--c-text-muted);
-  opacity: var(--text-divider-opacity, 1);
   font-size: 0.75rem; /* 12px */
   white-space: nowrap;
 }
@@ -48,13 +44,6 @@
   );
 }
 
-.text-divider.force-light .text-divider__label {
-  color: rgb(
-    var(--text-divider-label-rgb-light, var(--gray-400)) /
-      var(--text-divider-opacity, 1)
-  );
-}
-
 .text-divider.subcategory.force-light .text-divider__rule {
   background-color: var(--tool-subcategory-rule-color-light);
 }
diff --git a/frontend/editor/src/proprietary/data/processorEntitySearch.ts b/frontend/editor/src/proprietary/data/processorEntitySearch.ts
new file mode 100644
index 0000000000..544babf59f
--- /dev/null
+++ b/frontend/editor/src/proprietary/data/processorEntitySearch.ts
@@ -0,0 +1,97 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import type { TFunction } from "i18next";
+import { useScopedFetchCache } from "@app/hooks/useScopedFetchCache";
+import type { SuperSearchGroup } from "@app/types/superSearch";
+import type {
+  PortalEntityItems,
+  PortalEntityScopeId,
+} from "@portal/search/entitySearch";
+
+type EntitySearchModule = typeof import("@portal/search/entitySearch");
+
+// Mirrors the admin-route seam's gate: the portal route-set is only mounted in
+// dev and in builds made with VITE_INCLUDE_PORTAL=true, so the search must not
+// fetch or offer entities that have nowhere to open.
+const includePortal =
+  import.meta.env.VITE_INCLUDE_PORTAL === "true" || import.meta.env.DEV;
+
+const NO_GROUPS: SuperSearchGroup[] = [];
+const NO_SCOPES: readonly PortalEntityScopeId[] = [];
+
+/**
+ * Processor entity results for the editor's super search. The portal's
+ * entity-search module is imported on demand (first search keystroke) — a
+ * static value import here would pull the portal into the main bundle, the
+ * same constraint the static page index (processorSearchIndex) lives under.
+ * Fetch discipline (TTL, in-flight dedupe, generation guard) comes from
+ * useScopedFetchCache; the scope list is dynamic and the fetcher lives in the
+ * lazily loaded module, which useQuery's static-key shape handles awkwardly.
+ *
+ * `tier` shapes only presentational fields on the users payload, never the
+ * lists (see fetchPortalEntityScope), so the editor passes "free" rather than
+ * mounting the portal's TierContext.
+ */
+export function useProcessorEntityGroups(
+  trimmed: string,
+  enabled: boolean,
+  t: TFunction,
+  navigate: (path: string) => void,
+  scopeEnabled: (scopeId: string) => boolean = () => true,
+  isAdmin = false,
+): SuperSearchGroup[] {
+  const [mod, setMod] = useState<EntitySearchModule | null>(null);
+  const modRef = useRef<EntitySearchModule | null>(null);
+  const active = enabled && includePortal;
+  const hasQuery = trimmed.length > 0;
+
+  useEffect(() => {
+    if (!active || modRef.current) return;
+    let cancelled = false;
+    void import("@portal/search/entitySearch").then((loaded) => {
+      if (cancelled) return;
+      modRef.current = loaded;
+      setMod(loaded);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [active]);
+
+  const requestedScopes = useMemo<readonly PortalEntityScopeId[]>(() => {
+    if (!active || !hasQuery || !mod) return NO_SCOPES;
+    return mod.withPortalEntityDependencies(
+      mod
+        .defaultPortalEntityScopes(isAdmin)
+        .filter((scopeId) => scopeEnabled(scopeId)),
+    );
+  }, [active, hasQuery, mod, scopeEnabled, isAdmin]);
+
+  const fetchScope = useCallback(
+    async (scopeId: PortalEntityScopeId): Promise<PortalEntityItems> => {
+      const loaded =
+        modRef.current ?? (await import("@portal/search/entitySearch"));
+      return loaded.fetchPortalEntityScope(scopeId, "free");
+    },
+    [],
+  );
+
+  const { values } = useScopedFetchCache(
+    requestedScopes,
+    fetchScope,
+    // The TTL lives in the (lazily loaded) module; until it arrives no scope
+    // is requested, so the placeholder never gates a real fetch.
+    mod?.ENTITY_REFRESH_MS ?? Number.MAX_SAFE_INTEGER,
+  );
+
+  const entities = useMemo(
+    () => (mod ? mod.toProcessorEntities(values) : null),
+    [mod, values],
+  );
+
+  return useMemo(() => {
+    if (!mod || !entities || !active || !hasQuery) return NO_GROUPS;
+    return mod.buildProcessorEntityGroups(entities, trimmed, t, navigate, {
+      scopeEnabled,
+    });
+  }, [mod, entities, active, hasQuery, trimmed, t, navigate, scopeEnabled]);
+}
diff --git a/frontend/editor/src/proprietary/data/processorSearchIndex.ts b/frontend/editor/src/proprietary/data/processorSearchIndex.ts
new file mode 100644
index 0000000000..ae48893e25
--- /dev/null
+++ b/frontend/editor/src/proprietary/data/processorSearchIndex.ts
@@ -0,0 +1,111 @@
+import { PORTAL_BASENAME } from "@app/routes/portalBasename";
+// A static leaf module (its portal import is type-only), so it doesn't pull
+// the lazy portal chunk into the main bundle the way @portal/* values would.
+import { usersCapabilities } from "@app/portal/usersCapabilities";
+import type { ProcessorSearchEntry } from "@core/data/processorSearchIndex";
+
+export type { ProcessorSearchEntry };
+
+// Mirrors the admin-route seam's gate: the portal route-set is only mounted in
+// dev and in builds made with VITE_INCLUDE_PORTAL=true, so the search must not
+// offer destinations that would 404 elsewhere.
+const includePortal =
+  import.meta.env.VITE_INCLUDE_PORTAL === "true" || import.meta.env.DEV;
+
+/**
+ * The portal's in-app views. Deliberately a static mirror of the portal's nav
+ * (labels via the same portal.nav.* keys its sidebar uses) rather than an
+ * import from @portal/* — referencing the portal package here would pull the
+ * lazy portal chunk into the main bundle.
+ */
+const VIEWS: ProcessorSearchEntry[] = [
+  {
+    id: "home",
+    labelKey: "portal.nav.home",
+    labelFallback: "Home",
+    path: PORTAL_BASENAME,
+    keywords: ["portal", "processor", "admin"],
+  },
+  {
+    id: "users",
+    labelKey: "portal.nav.users",
+    labelFallback: "Users",
+    path: `${PORTAL_BASENAME}/users`,
+    keywords: ["team", "members", "roles", "admin"],
+  },
+  {
+    id: "sources",
+    labelKey: "portal.nav.sources",
+    labelFallback: "Sources",
+    path: `${PORTAL_BASENAME}/sources`,
+    keywords: ["s3", "connections", "webhooks", "folders"],
+  },
+  {
+    id: "policies",
+    labelKey: "portal.nav.policies",
+    labelFallback: "Policies",
+    path: `${PORTAL_BASENAME}/policies`,
+    keywords: ["enforcement", "redact", "compliance"],
+  },
+  {
+    id: "pipelines",
+    labelKey: "portal.nav.pipelines",
+    labelFallback: "Pipelines",
+    path: `${PORTAL_BASENAME}/pipelines`,
+    keywords: ["automation", "workflows", "operations"],
+  },
+  {
+    id: "documents",
+    labelKey: "portal.nav.documents",
+    labelFallback: "Documents",
+    path: `${PORTAL_BASENAME}/documents`,
+    keywords: ["audit", "files"],
+  },
+  {
+    id: "integrations",
+    labelKey: "portal.nav.integrations",
+    labelFallback: "Integrations",
+    path: `${PORTAL_BASENAME}/integrations`,
+    keywords: ["connections", "external", "api", "webhooks"],
+  },
+  {
+    id: "infrastructure",
+    labelKey: "portal.nav.infrastructure",
+    labelFallback: "Infrastructure",
+    path: `${PORTAL_BASENAME}/infrastructure`,
+    keywords: ["deployment", "instances", "health"],
+  },
+  {
+    id: "usage",
+    labelKey: "portal.nav.usage",
+    labelFallback: "Usage & Billing",
+    path: `${PORTAL_BASENAME}/usage`,
+    keywords: ["billing", "invoices", "plan", "wallet", "payg", "bundles"],
+  },
+  {
+    id: "docs",
+    labelKey: "portal.nav.docs",
+    labelFallback: "Documentation",
+    path: `${PORTAL_BASENAME}/docs`,
+    keywords: ["api", "documentation", "reference", "guides"],
+  },
+];
+
+export const PROCESSOR_SEARCH_INDEX: ProcessorSearchEntry[] = includePortal
+  ? VIEWS
+  : [];
+
+/**
+ * Whether an entity scope's data source will serve the current session at
+ * all. The users roster is the one divergent case: portal access alone
+ * doesn't imply the roster endpoint will answer (see
+ * UsersCapabilities.listingRequiresAdmin) — offering the lane anyway renders
+ * a permanently-empty chip that fires a doomed request on every search.
+ */
+export function isPortalEntityScopeAccessible(
+  scopeId: string,
+  isAdmin: boolean,
+): boolean {
+  if (scopeId !== "portal-users") return true;
+  return isAdmin || !usersCapabilities.listingRequiresAdmin;
+}
diff --git a/frontend/editor/src/proprietary/data/settingsSectionRegistry.ts b/frontend/editor/src/proprietary/data/settingsSectionRegistry.ts
new file mode 100644
index 0000000000..e72582a0b1
--- /dev/null
+++ b/frontend/editor/src/proprietary/data/settingsSectionRegistry.ts
@@ -0,0 +1,233 @@
+import {
+  SETTINGS_SECTION_REGISTRY as CORE_SETTINGS_SECTION_REGISTRY,
+  type SettingsSectionEntry,
+} from "@core/data/settingsSectionRegistry";
+
+export type { SettingsSectionEntry };
+
+/**
+ * Self-hosted (proprietary) settings sections. Extends the core list with the
+ * account tab, the developer API keys tab, and the admin area — mirroring the
+ * sections added by the proprietary nav builder (`configNavSections`). Keep the
+ * two in sync: a section here that the modal can't render would deep-link to a
+ * dead tab, and a modal section missing here isn't searchable.
+ *
+ * Gating flags mirror the builder: `account`/`api-keys` need login; the admin
+ * sections are surfaced when the user is an admin OR login mode is off.
+ */
+export const SETTINGS_SECTION_REGISTRY: SettingsSectionEntry[] = [
+  ...CORE_SETTINGS_SECTION_REGISTRY,
+  {
+    key: "account",
+    labelKey: "account.accountSettings",
+    labelFallback: "Account",
+    keywords: ["profile", "email", "password", "user"],
+    requiresLogin: true,
+    groupLabelKey: "settings.preferences.title",
+    groupLabelFallback: "Preferences",
+  },
+  {
+    key: "api-keys",
+    labelKey: "settings.developer.apiKeys",
+    labelFallback: "API Keys",
+    keywords: ["api", "token", "developer", "key"],
+    requiresLogin: true,
+    groupLabelKey: "settings.developer.title",
+    groupLabelFallback: "Developer",
+  },
+  // --- Workspace ---
+  {
+    key: "people",
+    labelKey: "settings.workspace.people",
+    labelFallback: "People",
+    keywords: ["members", "users", "invite", "add member", "roles"],
+    adminArea: true,
+    groupLabelKey: "settings.workspace.title",
+    groupLabelFallback: "Workspace",
+  },
+  {
+    key: "teams",
+    labelKey: "settings.workspace.teams",
+    labelFallback: "Teams",
+    keywords: ["team", "group", "create team"],
+    adminArea: true,
+    groupLabelKey: "settings.workspace.title",
+    groupLabelFallback: "Workspace",
+  },
+  // --- Configuration ---
+  {
+    key: "adminGeneral",
+    labelKey: "settings.configuration.systemSettings",
+    labelFallback: "System Settings",
+    keywords: ["system", "config", "server"],
+    adminArea: true,
+    groupLabelKey: "settings.configuration.title",
+    groupLabelFallback: "Configuration",
+  },
+  {
+    key: "adminFeatures",
+    labelKey: "settings.configuration.features",
+    labelFallback: "Features",
+    keywords: ["features", "toggles", "flags"],
+    adminArea: true,
+    groupLabelKey: "settings.configuration.title",
+    groupLabelFallback: "Configuration",
+  },
+  {
+    key: "adminStorageSharing",
+    labelKey: "settings.configuration.storageSharing",
+    labelFallback: "File Storage & Sharing",
+    keywords: ["storage", "sharing", "files"],
+    adminArea: true,
+    groupLabelKey: "settings.configuration.title",
+    groupLabelFallback: "Configuration",
+  },
+  {
+    key: "adminEndpoints",
+    labelKey: "settings.configuration.endpoints",
+    labelFallback: "Endpoints",
+    keywords: ["endpoints", "api", "routes"],
+    adminArea: true,
+    groupLabelKey: "settings.configuration.title",
+    groupLabelFallback: "Configuration",
+  },
+  {
+    key: "adminMcp",
+    labelKey: "settings.configuration.mcp",
+    labelFallback: "MCP Server",
+    keywords: ["mcp", "server", "ai", "model context protocol"],
+    adminArea: true,
+    groupLabelKey: "settings.configuration.title",
+    groupLabelFallback: "Configuration",
+  },
+  {
+    key: "adminDatabase",
+    labelKey: "settings.configuration.database",
+    labelFallback: "Database",
+    keywords: ["database", "db", "backup"],
+    adminArea: true,
+    groupLabelKey: "settings.configuration.title",
+    groupLabelFallback: "Configuration",
+  },
+  {
+    key: "adminFolderAccess",
+    labelKey: "settings.configuration.folderAccess",
+    labelFallback: "Folder Access",
+    keywords: ["folders", "access", "permissions", "scanning"],
+    adminArea: true,
+    groupLabelKey: "settings.configuration.title",
+    groupLabelFallback: "Configuration",
+  },
+  {
+    key: "adminAdvanced",
+    labelKey: "settings.configuration.advanced",
+    labelFallback: "Advanced",
+    keywords: ["advanced", "expert"],
+    adminArea: true,
+    groupLabelKey: "settings.configuration.title",
+    groupLabelFallback: "Configuration",
+  },
+  // --- AI ---
+  {
+    key: "adminAiGeneral",
+    labelKey: "settings.ai.general",
+    labelFallback: "General",
+    keywords: ["ai", "assistant", "enable"],
+    adminArea: true,
+    groupLabelKey: "settings.ai.title",
+    groupLabelFallback: "AI",
+  },
+  {
+    key: "adminAiModels",
+    labelKey: "settings.ai.models",
+    labelFallback: "Models & Providers",
+    keywords: ["ai", "models", "providers", "llm", "openai", "anthropic"],
+    adminArea: true,
+    groupLabelKey: "settings.ai.title",
+    groupLabelFallback: "AI",
+  },
+  {
+    key: "adminAiDocuments",
+    labelKey: "settings.ai.documents",
+    labelFallback: "Documents & RAG",
+    keywords: ["ai", "rag", "embedding", "retrieval", "documents"],
+    adminArea: true,
+    groupLabelKey: "settings.ai.title",
+    groupLabelFallback: "AI",
+  },
+  {
+    key: "adminAiLimits",
+    labelKey: "settings.ai.limits",
+    labelFallback: "Limits & Performance",
+    keywords: ["ai", "limits", "tokens", "rate", "performance"],
+    adminArea: true,
+    groupLabelKey: "settings.ai.title",
+    groupLabelFallback: "AI",
+  },
+  // --- Security & Authentication ---
+  {
+    key: "adminSecurity",
+    labelKey: "settings.securityAuth.security",
+    labelFallback: "Security",
+    keywords: ["security", "authentication", "auth", "password", "sessions"],
+    adminArea: true,
+    groupLabelKey: "settings.securityAuth.title",
+    groupLabelFallback: "Security & Authentication",
+  },
+  {
+    key: "adminConnections",
+    labelKey: "settings.securityAuth.connections",
+    labelFallback: "Connections",
+    keywords: ["connections", "oauth", "sso", "integrations"],
+    adminArea: true,
+    groupLabelKey: "settings.securityAuth.title",
+    groupLabelFallback: "Security & Authentication",
+  },
+  // --- Licensing & Analytics ---
+  {
+    key: "adminPlan",
+    labelKey: "settings.licensingAnalytics.plan",
+    labelFallback: "Plan",
+    keywords: ["plan", "license", "billing", "subscription", "enterprise"],
+    adminArea: true,
+    groupLabelKey: "settings.licensingAnalytics.title",
+    groupLabelFallback: "Licensing & Analytics",
+  },
+  {
+    key: "adminAudit",
+    labelKey: "settings.licensingAnalytics.audit",
+    labelFallback: "Audit",
+    keywords: ["audit", "logs", "events", "history"],
+    adminArea: true,
+    groupLabelKey: "settings.licensingAnalytics.title",
+    groupLabelFallback: "Licensing & Analytics",
+  },
+  {
+    key: "adminUsage",
+    labelKey: "settings.licensingAnalytics.usageAnalytics",
+    labelFallback: "Usage Analytics",
+    keywords: ["usage", "analytics", "stats", "metrics"],
+    adminArea: true,
+    groupLabelKey: "settings.licensingAnalytics.title",
+    groupLabelFallback: "Licensing & Analytics",
+  },
+  // --- Policies & Privacy ---
+  {
+    key: "adminLegal",
+    labelKey: "settings.policiesPrivacy.legal",
+    labelFallback: "Legal",
+    keywords: ["legal", "terms", "agreement"],
+    adminArea: true,
+    groupLabelKey: "settings.policiesPrivacy.title",
+    groupLabelFallback: "Policies & Privacy",
+  },
+  {
+    key: "adminPrivacy",
+    labelKey: "settings.policiesPrivacy.privacy",
+    labelFallback: "Privacy",
+    keywords: ["privacy", "gdpr", "data"],
+    adminArea: true,
+    groupLabelKey: "settings.policiesPrivacy.title",
+    groupLabelFallback: "Policies & Privacy",
+  },
+];
diff --git a/frontend/editor/src/proprietary/hooks/useOtherAppSwitch.ts b/frontend/editor/src/proprietary/hooks/useOtherAppSwitch.ts
new file mode 100644
index 0000000000..8bf07b5c2f
--- /dev/null
+++ b/frontend/editor/src/proprietary/hooks/useOtherAppSwitch.ts
@@ -0,0 +1,15 @@
+import { useNavigate } from "react-router-dom";
+import { useAuth } from "@app/auth/context";
+import { PORTAL_BASENAME } from "@app/routes/portalBasename";
+import { type NavFooterAppLink } from "@app/components/shared/navFooter/NavFooter";
+
+/**
+ * Self-hosted: the Spring session carries `portalAccess`, so the switch to the
+ * processor is offered exactly when that flag is set.
+ */
+export function useOtherAppSwitch(): NavFooterAppLink | null {
+  const { portalAccess } = useAuth();
+  const navigate = useNavigate();
+  if (!portalAccess) return null;
+  return { app: "processor", onOpen: () => navigate(PORTAL_BASENAME) };
+}
diff --git a/frontend/editor/src/proprietary/portal/usersCapabilities.ts b/frontend/editor/src/proprietary/portal/usersCapabilities.ts
index a72bf16ca6..fce47ff2b6 100644
--- a/frontend/editor/src/proprietary/portal/usersCapabilities.ts
+++ b/frontend/editor/src/proprietary/portal/usersCapabilities.ts
@@ -22,4 +22,5 @@ export const usersCapabilities: UsersCapabilities = {
   seats: false,
   manageGrants: true,
   removeScope: "org",
+  listingRequiresAdmin: true,
 };
diff --git a/frontend/editor/src/proprietary/utils/scheduleIdle.ts b/frontend/editor/src/proprietary/utils/scheduleIdle.ts
index 8d3e5bec96..55d395b504 100644
--- a/frontend/editor/src/proprietary/utils/scheduleIdle.ts
+++ b/frontend/editor/src/proprietary/utils/scheduleIdle.ts
@@ -1,11 +1,10 @@
 // Idle-time scheduling shared by the classification/backfill passes.
 
-/** Schedule work for the browser's idle time (or soon after, as a fallback). */
+/**
+ * Schedule work for the browser's idle time. Main thread only: the entry-point
+ * shim guarantees `requestIdleCallback`, but not in worker scope.
+ */
 export function scheduleIdle(task: () => void): () => void {
-  if (typeof requestIdleCallback === "function") {
-    const handle = requestIdleCallback(task, { timeout: 2000 });
-    return () => cancelIdleCallback(handle);
-  }
-  const timer = window.setTimeout(task, 200);
-  return () => window.clearTimeout(timer);
+  const handle = requestIdleCallback(task, { timeout: 2000 });
+  return () => cancelIdleCallback(handle);
 }
diff --git a/frontend/editor/src/prototypes/data/processorEntitySearch.ts b/frontend/editor/src/prototypes/data/processorEntitySearch.ts
new file mode 100644
index 0000000000..2a3187ac5f
--- /dev/null
+++ b/frontend/editor/src/prototypes/data/processorEntitySearch.ts
@@ -0,0 +1,6 @@
+/**
+ * Prototypes builds ship no portal (and have no @portal alias) — shadow the
+ * entity search back to core's empty stub so the super search never resolves
+ * the proprietary implementation's portal imports here.
+ */
+export { useProcessorEntityGroups } from "@core/data/processorEntitySearch";
diff --git a/frontend/editor/src/prototypes/data/processorSearchIndex.ts b/frontend/editor/src/prototypes/data/processorSearchIndex.ts
new file mode 100644
index 0000000000..8b09a79f29
--- /dev/null
+++ b/frontend/editor/src/prototypes/data/processorSearchIndex.ts
@@ -0,0 +1,10 @@
+/**
+ * Prototypes builds ship no portal (and have no @portal alias) — shadow the
+ * index back to core's empty list so the super search never resolves the
+ * proprietary version's portal-flavored imports here.
+ */
+export type { ProcessorSearchEntry } from "@core/data/processorSearchIndex";
+export {
+  PROCESSOR_SEARCH_INDEX,
+  isPortalEntityScopeAccessible,
+} from "@core/data/processorSearchIndex";
diff --git a/frontend/editor/src/saas/auth/UseSession.tsx b/frontend/editor/src/saas/auth/UseSession.tsx
index 101ed58d06..a1c4db2396 100644
--- a/frontend/editor/src/saas/auth/UseSession.tsx
+++ b/frontend/editor/src/saas/auth/UseSession.tsx
@@ -73,6 +73,13 @@ interface AuthContextType {
   refreshProStatus: () => Promise<void>;
   refreshProfilePicture: () => Promise<void>;
   refreshProfilePictureMetadata: () => Promise<void>;
+  /**
+   * Session-level permission flags (see the core auth seam). Supabase
+   * sessions don't carry them — consumers treat undefined as "not granted"
+   * and fall back to app-config gates.
+   */
+  isAdmin?: boolean;
+  portalAccess?: boolean;
 }
 
 const AuthContext = createContext<AuthContextType>({
diff --git a/frontend/editor/src/saas/components/shared/AppConfigModal.tsx b/frontend/editor/src/saas/components/shared/AppConfigModal.tsx
index 0d534fa088..cfd8aef1b4 100644
--- a/frontend/editor/src/saas/components/shared/AppConfigModal.tsx
+++ b/frontend/editor/src/saas/components/shared/AppConfigModal.tsx
@@ -31,6 +31,8 @@ interface AppConfigModalProps {
   urlSync?: boolean;
   /** Section to land on when opening (used by non-URL hosts like the portal). */
   initialSection?: NavKey | null;
+  /** Accepted for interface parity with the core shell; this shell ignores it. */
+  initialFocus?: string | null;
   /** Host-specific sections appended after the saas registry sections. */
   extraSections?: ConfigNavSection[];
   /** Registry section keys to drop, for hosts a section can't run in. */
diff --git a/frontend/editor/src/saas/components/shared/AppSwitcher.tsx b/frontend/editor/src/saas/components/shared/AppSwitcher.tsx
deleted file mode 100644
index 364f094478..0000000000
--- a/frontend/editor/src/saas/components/shared/AppSwitcher.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-import { useNavigate } from "react-router-dom";
-import { Logo } from "@app/ui/Logo";
-import { BrandSwitcher } from "@app/components/shared/BrandSwitcher";
-import { type AppSwitcherProps } from "@core/components/shared/AppSwitcher";
-import { usePortalAccess } from "@app/hooks/usePortalAccess";
-import { PORTAL_BASENAME } from "@app/routes/portalBasename";
-
-/**
- * SaaS sidebar brand header. When the backend says this user can open the
- * processor (`/api/v1/auth/me` → `portalAccess` — the exact signal the
- * processor's own gate uses), the Stirling logo doubles as the
- * editor⇄processor switcher: the mark morphs into a chevron and opens the
- * switch menu (same BrandSwitcher the processor sidebar uses). Users without
- * access get a plain logo.
- *
- * Deliberately NOT gated on the editor's Supabase auth context: that context
- * never fetches /me, so it can't know about portal access (and its session
- * state doesn't always mirror the backend login that actually grants it).
- */
-export function AppSwitcher({ collapsed }: AppSwitcherProps) {
-  const portalAccess = usePortalAccess();
-  const navigate = useNavigate();
-
-  if (!portalAccess) {
-    return (
-      <Logo
-        variant={collapsed ? "iconOnly" : "iconAndText"}
-        iconHeight="1.6rem"
-        textHeight="1.3rem"
-      />
-    );
-  }
-
-  return (
-    <BrandSwitcher
-      current="editor"
-      onSwitch={() => navigate(PORTAL_BASENAME)}
-      collapsed={collapsed}
-    />
-  );
-}
diff --git a/frontend/editor/src/saas/components/shared/config/configSections/Overview.tsx b/frontend/editor/src/saas/components/shared/config/configSections/Overview.tsx
index a4cc4f90a0..595d2c89d4 100644
--- a/frontend/editor/src/saas/components/shared/config/configSections/Overview.tsx
+++ b/frontend/editor/src/saas/components/shared/config/configSections/Overview.tsx
@@ -1,7 +1,6 @@
 import React, { useRef, useState } from "react";
 import {
   Alert,
-  Avatar,
   Divider,
   Group,
   Image,
@@ -11,10 +10,12 @@ import {
   TextInput,
   Modal,
 } from "@mantine/core";
+import { Avatar } from "@app/ui/Avatar";
 import { Button as DSButton } from "@app/ui/Button";
 import { FilePicker } from "@app/ui/FilePicker";
 import { useTranslation } from "react-i18next";
 import { useAuth } from "@app/auth/UseSession";
+import { useAccountIdentity } from "@app/hooks/useAccountIdentity";
 import {
   isUserAnonymous,
   linkEmailIdentity,
@@ -46,6 +47,8 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
     refreshProfilePicture,
     refreshProfilePictureMetadata,
   } = useAuth();
+  // Same name + initials the sidebar footer draws, so the two discs agree.
+  const { displayName } = useAccountIdentity();
 
   const PROFILE_BUCKET = "profile-pictures";
 
@@ -69,7 +72,6 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
   const provider = profilePictureMetadata?.provider;
 
   const profilePath = user ? `${user.id}/avatar` : null;
-  const profileInitial = user?.email?.trim()?.charAt(0)?.toUpperCase() || "U";
 
   const handleProfileUpload = async (file: File | null) => {
     resetPicker.current?.();
@@ -413,12 +415,9 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
           <Group align="center" gap="md">
             <Avatar
               src={profilePictureUrl || undefined}
-              radius="xl"
-              size={72}
-              color="blue"
-            >
-              {profileInitial}
-            </Avatar>
+              name={displayName}
+              size="xl"
+            />
             <div
               style={{
                 display: "flex",
@@ -453,12 +452,9 @@ const Overview: React.FC<OverviewProps> = ({ onLogoutClick }) => {
           <Group align="center" gap="md">
             <Avatar
               src={profilePictureUrl || undefined}
-              radius="xl"
-              size={72}
-              color="blue"
-            >
-              {profileInitial}
-            </Avatar>
+              name={displayName}
+              size="xl"
+            />
             <div
               style={{
                 display: "flex",
diff --git a/frontend/editor/src/saas/data/settingsSectionRegistry.ts b/frontend/editor/src/saas/data/settingsSectionRegistry.ts
new file mode 100644
index 0000000000..6d2e770889
--- /dev/null
+++ b/frontend/editor/src/saas/data/settingsSectionRegistry.ts
@@ -0,0 +1,99 @@
+import { type SettingsSectionEntry } from "@core/data/settingsSectionRegistry";
+
+export type { SettingsSectionEntry };
+
+/**
+ * SaaS web settings sections. The SaaS modal is composed differently from
+ * self-hosted (see `saasConfigNavSections`): an Account area (Overview,
+ * Passwords & Security, Team), Preferences, a Developer area (API Keys, MCP),
+ * cloud Billing (Plan) and Legal. It deliberately does NOT list the self-hosted
+ * admin sections, so search never deep-links to a tab the SaaS modal can't show.
+ *
+ * The local backend's login/admin flags don't reflect SaaS auth, so entries
+ * avoid `requiresLogin`/`adminArea`. Sections the SaaS nav only mounts for a
+ * signed-in account (Team, Plan) carry `requiresAccount`, which the search
+ * gates on the auth seam's `isAnonymous` — the signal the nav itself uses.
+ */
+export const SETTINGS_SECTION_REGISTRY: SettingsSectionEntry[] = [
+  {
+    key: "overview",
+    labelKey: "config.account.overview.label",
+    labelFallback: "Overview",
+    keywords: ["account", "profile", "email", "avatar", "logout"],
+    groupLabelKey: "config.account.overview.title",
+    groupLabelFallback: "Account Settings",
+  },
+  {
+    key: "security",
+    labelKey: "config.account.security.title",
+    labelFallback: "Passwords & Security",
+    keywords: ["password", "2fa", "authentication", "sessions", "security"],
+    groupLabelKey: "config.account.overview.title",
+    groupLabelFallback: "Account Settings",
+  },
+  {
+    key: "teams",
+    labelKey: "config.team",
+    labelFallback: "Team",
+    keywords: ["team", "members", "invite", "seats"],
+    requiresAccount: true,
+    groupLabelKey: "config.account.overview.title",
+    groupLabelFallback: "Account Settings",
+  },
+  {
+    key: "general",
+    labelKey: "settings.general.title",
+    labelFallback: "General",
+    keywords: ["theme", "language", "appearance", "preferences", "startup"],
+    groupLabelKey: "settings.preferences.title",
+    groupLabelFallback: "Preferences",
+  },
+  {
+    key: "hotkeys",
+    labelKey: "settings.hotkeys.title",
+    labelFallback: "Keyboard Shortcuts",
+    keywords: ["hotkey", "shortcut", "keybinding", "keyboard"],
+    groupLabelKey: "settings.preferences.title",
+    groupLabelFallback: "Preferences",
+  },
+  {
+    key: "api-keys",
+    labelKey: "settings.developer.apiKeys",
+    labelFallback: "API Keys",
+    keywords: ["api", "token", "developer", "key"],
+    groupLabelKey: "settings.developer.title",
+    groupLabelFallback: "Developer",
+  },
+  {
+    key: "mcp",
+    labelKey: "config.mcp.navLabel",
+    labelFallback: "MCP Server",
+    keywords: ["mcp", "server", "ai", "model context protocol"],
+    groupLabelKey: "settings.developer.title",
+    groupLabelFallback: "Developer",
+  },
+  {
+    key: "plan",
+    labelKey: "config.plan",
+    labelFallback: "Plan",
+    keywords: [
+      "billing",
+      "subscription",
+      "upgrade",
+      "payment",
+      "invoice",
+      "wallet",
+    ],
+    requiresAccount: true,
+    groupLabelKey: "settings.planBilling.title",
+    groupLabelFallback: "Plan & Billing",
+  },
+  {
+    key: "legal",
+    labelKey: "settings.legal.label",
+    labelFallback: "Legal",
+    keywords: ["legal", "terms", "privacy", "licenses"],
+    groupLabelKey: "settings.legal.title",
+    groupLabelFallback: "Legal",
+  },
+];
diff --git a/frontend/editor/src/saas/hooks/useOtherAppSwitch.ts b/frontend/editor/src/saas/hooks/useOtherAppSwitch.ts
new file mode 100644
index 0000000000..824e612bd8
--- /dev/null
+++ b/frontend/editor/src/saas/hooks/useOtherAppSwitch.ts
@@ -0,0 +1,16 @@
+import { useNavigate } from "react-router-dom";
+import { usePortalAccess } from "@app/hooks/usePortalAccess";
+import { PORTAL_BASENAME } from "@app/routes/portalBasename";
+import { type NavFooterAppLink } from "@app/components/shared/navFooter/NavFooter";
+
+/**
+ * SaaS: the editor's Supabase context never fetches /me, so processor access
+ * comes from the backend via {@link usePortalAccess} — the same signal the
+ * processor's own gate uses.
+ */
+export function useOtherAppSwitch(): NavFooterAppLink | null {
+  const portalAccess = usePortalAccess();
+  const navigate = useNavigate();
+  if (!portalAccess) return null;
+  return { app: "processor", onOpen: () => navigate(PORTAL_BASENAME) };
+}
diff --git a/frontend/editor/src/saas/hooks/usePortalAccess.test.tsx b/frontend/editor/src/saas/hooks/usePortalAccess.test.tsx
index a0e8ba618d..809138850a 100644
--- a/frontend/editor/src/saas/hooks/usePortalAccess.test.tsx
+++ b/frontend/editor/src/saas/hooks/usePortalAccess.test.tsx
@@ -1,5 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { renderHook, waitFor } from "@testing-library/react";
+import { renderHook as baseRenderHook, waitFor } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { ReactNode } from "react";
 
 const get = vi.fn();
 let currentUserId: string | null = null;
@@ -20,10 +22,28 @@ function meReturning(portalAccess: boolean) {
   return { data: { user: { portalAccess } } };
 }
 
+// A fresh client per render, so one test's cached answer can't satisfy the
+// next — each case exercises a cold cache unless it deliberately shares one.
+let client: QueryClient;
+
+function renderHook<T>(cb: () => T) {
+  return baseRenderHook(cb, {
+    wrapper: ({ children }: { children: ReactNode }) => (
+      <QueryClientProvider client={client}>{children}</QueryClientProvider>
+    ),
+  });
+}
+
 describe("usePortalAccess", () => {
   beforeEach(() => {
+    // The hook now remembers the last answer across mounts, so without this a
+    // prior test's result seeds the next one.
+    localStorage.clear();
     get.mockReset();
     currentUserId = null;
+    client = new QueryClient({
+      defaultOptions: { queries: { retry: false, gcTime: 0, staleTime: 0 } },
+    });
   });
 
   it("reports the backend's answer for the signed-in user", async () => {
@@ -82,12 +102,31 @@ describe("usePortalAccess", () => {
     expect(first.result.current).toBe(false);
     first.unmount();
 
-    // The failure isn't sticky.
+    // The failure isn't sticky — a cold cache asks again.
+    client.clear();
     get.mockResolvedValue(meReturning(true));
     const second = renderHook(() => usePortalAccess());
     await waitFor(() => expect(second.result.current).toBe(true));
   });
 
+  it("shows the last known answer at first paint, then revalidates", async () => {
+    // What stops the switcher and the footer's "Open ..." row popping in a
+    // request late on every mount.
+    currentUserId = "admin-1";
+    get.mockResolvedValue(meReturning(true));
+    const first = renderHook(() => usePortalAccess());
+    await waitFor(() => expect(first.result.current).toBe(true));
+    first.unmount();
+
+    client.clear();
+    get.mockResolvedValue(meReturning(false));
+    const second = renderHook(() => usePortalAccess());
+    // Seeded from the remembered answer before the request lands...
+    expect(second.result.current).toBe(true);
+    // ...and corrected once the backend disagrees.
+    await waitFor(() => expect(second.result.current).toBe(false));
+  });
+
   it("ignores a response that lands after unmount", async () => {
     currentUserId = "admin-1";
     let resolveMe: (v: unknown) => void = () => {};
diff --git a/frontend/editor/src/saas/hooks/usePortalAccess.ts b/frontend/editor/src/saas/hooks/usePortalAccess.ts
index 442061cbe1..6e91f0864c 100644
--- a/frontend/editor/src/saas/hooks/usePortalAccess.ts
+++ b/frontend/editor/src/saas/hooks/usePortalAccess.ts
@@ -1,52 +1,64 @@
 import { useEffect, useState } from "react";
+import { useQuery } from "@tanstack/react-query";
 import apiClient from "@app/services/apiClient";
 import { useAuth } from "@app/auth/UseSession";
+import {
+  readCachedOtherApp,
+  writeCachedOtherApp,
+} from "@app/services/navFooterCache";
+import { qk } from "@app/query/keys";
+
+async function fetchPortalAccess(): Promise<boolean> {
+  const res = await apiClient.get<{ user?: { portalAccess?: boolean } }>(
+    "/api/v1/auth/me",
+  );
+  return res.data.user?.portalAccess === true;
+}
 
 /**
  * Whether the current user can open the processor (admin portal), straight
  * from the backend (`/api/v1/auth/me` → `portalAccess`) — the same signal the
  * processor's own SaasPortalGate uses. Components that must mirror processor
- * access (e.g. the sidebar's editor⇄processor switcher) ask here.
+ * access (the sidebar's editor⇄processor switcher and its footer row) ask here.
  *
  * The editor's Supabase auth context can't *answer* this — it never fetches
- * /me — so it is used only to identify who is asking. Keying the effect on
- * that identity is what keeps the answer per-user: the SPA can swap users
+ * /me — so it is used only to identify who is asking. That identity is the
+ * cache key, which is what keeps the answer per-user: the SPA can swap users
  * without a reload (Supabase fires SIGNED_OUT/SIGNED_IN in place; only the
- * settings Logout button hard-navigates), so any answer held beyond the
- * current identity would leak to whoever signs in next.
+ * settings Logout button hard-navigates), and a keyed cache addresses each
+ * identity separately rather than holding one answer that would have to be
+ * invalidated on the swap — the bug class this hook once had.
  *
- * Deliberately unmemoised beyond the mount: the one consumer (the sidebar
- * switcher) mounts once, so a cross-mount cache would only add user-scoped
- * state that has to be invalidated on identity change — the bug class this
- * hook already had once. Guests skip the request entirely.
+ * Cached through the app query client, so leaving the editor for the processor
+ * and coming back resolves from cache: the switcher is there on first paint
+ * instead of appearing a request later. Guests skip the request entirely.
  */
 export function usePortalAccess(): boolean {
   const { user } = useAuth();
   const userId = user?.id ?? null;
-  const [access, setAccess] = useState(false);
+  // The query cache is per-tree and per-load, so it can't help a cold start or
+  // the hop into the processor, which mounts its own client. Seed from the last
+  // answer this browser saw so the switcher and the footer's "Open ..." row are
+  // there at first paint. Marked ancient so it still revalidates immediately.
+  const [seed] = useState(readCachedOtherApp);
+
+  const { data, isSuccess } = useQuery({
+    queryKey: qk.portalAccess(userId),
+    queryFn: fetchPortalAccess,
+    // Signed out: nothing to ask, and any previous answer is void.
+    enabled: userId !== null,
+    // Backend unreachable or guest (401) means no access now; a later refetch
+    // asks again rather than trusting the failure.
+    retry: false,
+    initialData: seed,
+    initialDataUpdatedAt: 0,
+  });
 
   useEffect(() => {
-    // Signed out: nothing to ask, and any previous answer is void.
-    if (userId === null) {
-      setAccess(false);
-      return;
-    }
+    // Only a real answer is recorded — a failed probe is not one, so the next
+    // mount trusts the last backend response rather than a network blip.
+    if (isSuccess && data !== undefined) writeCachedOtherApp(data);
+  }, [isSuccess, data]);
 
-    let cancelled = false;
-    apiClient
-      .get<{ user?: { portalAccess?: boolean } }>("/api/v1/auth/me")
-      .then((res) => {
-        if (!cancelled) setAccess(res.data.user?.portalAccess === true);
-      })
-      .catch(() => {
-        // Backend unreachable or guest (401): no access now; a remount or
-        // identity change asks again rather than trusting a failure.
-        if (!cancelled) setAccess(false);
-      });
-    return () => {
-      cancelled = true;
-    };
-  }, [userId]);
-
-  return access;
+  return data === true;
 }
diff --git a/frontend/editor/src/saas/hooks/useWallet.poll.test.tsx b/frontend/editor/src/saas/hooks/useWallet.poll.test.tsx
new file mode 100644
index 0000000000..b72eac67f8
--- /dev/null
+++ b/frontend/editor/src/saas/hooks/useWallet.poll.test.tsx
@@ -0,0 +1,158 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { renderHook, act, waitFor } from "@testing-library/react";
+import { expectConsole } from "@app/tests/failOnConsole";
+
+const get = vi.fn();
+vi.mock("@app/services/apiClient", () => ({
+  default: { get: (...args: unknown[]) => get(...args) },
+}));
+vi.mock("@app/hooks/walletDevPreview", () => ({
+  getWalletDevPreview: () => null,
+}));
+vi.mock("@app/services/billing", () => ({ createPortalSession: vi.fn() }));
+vi.mock("@app/platform/openExternal", () => ({ openExternal: vi.fn() }));
+
+const { useWallet } = await import("@app/hooks/useWallet");
+
+/** Full enough for the hook's deep-compare, which reads every field. */
+function walletWith(freeRemaining: number) {
+  return {
+    data: {
+      teamId: 1,
+      status: "free",
+      role: "leader",
+      billingPeriodStart: "2026-08-01",
+      billingPeriodEnd: "2026-08-31",
+      billableUsed: 500 - freeRemaining,
+      billableLimit: 500,
+      freeAllowance: 500,
+      freeRemaining,
+      pricePerDocMinor: 2,
+      bundleRatePerCreditMinor: null,
+      currency: "usd",
+      estimatedBillMinor: 0,
+      capUsd: null,
+      noCap: false,
+      stripeSubscriptionId: null,
+      spendUnitsThisPeriod: 0,
+      docsProcessedThisPeriod: 0,
+      uniquePdfsThisPeriod: 0,
+      sizeMultiplierPdfsThisPeriod: 0,
+      billingMode: "metered",
+      prepaidUnitsRemaining: 0,
+      prepaidUnitsTotal: 0,
+      prepaidExpiresAt: null,
+      recent: [],
+      members: [],
+      categoryBreakdown: { api: 0, ai: 0, automation: 0 },
+      categoryDocs: { api: 0, ai: 0, automation: 0 },
+    },
+  };
+}
+
+describe("useWallet — keeping the figures fresh", () => {
+  beforeEach(() => {
+    vi.useFakeTimers({ shouldAdvanceTime: true });
+    get.mockReset();
+    get.mockResolvedValue(walletWith(500));
+  });
+  afterEach(() => vi.useRealTimers());
+
+  it("re-reads the wallet on the poll interval", async () => {
+    const { result } = renderHook(() => useWallet());
+    await waitFor(() => expect(result.current.wallet).not.toBeNull());
+    expect(get).toHaveBeenCalledTimes(1);
+
+    get.mockResolvedValue(walletWith(480));
+    await act(async () => {
+      vi.advanceTimersByTime(30_000);
+    });
+
+    await waitFor(() => expect(result.current.wallet?.freeRemaining).toBe(480));
+  });
+
+  it("polls silently, so consumers gating on loading/error don't flicker", async () => {
+    const { result } = renderHook(() => useWallet());
+    await waitFor(() => expect(result.current.wallet).not.toBeNull());
+
+    // A poll that fails must leave the last good snapshot, and must not raise
+    // `error` — Plan swaps a working page for an alert on that.
+    get.mockRejectedValue(new Error("network blip"));
+    await act(async () => {
+      vi.advanceTimersByTime(30_000);
+    });
+
+    expect(result.current.loading).toBe(false);
+    expect(result.current.error).toBeNull();
+    expect(result.current.wallet?.freeRemaining).toBe(500);
+  });
+
+  it("settles loading when a silent poll supersedes an in-flight visible load", async () => {
+    // The mount load raises `loading`; a poll firing before it lands cancels it.
+    // If clearing the flag were the silent load's to skip, both would decline
+    // and `loading` would stay true forever — which permanently suppresses the
+    // limit modals, since they do `if (loading || !wallet) return null`.
+    const visibility = vi.spyOn(document, "visibilityState", "get");
+    visibility.mockReturnValue("visible");
+
+    let landMount: (v: unknown) => void = () => {};
+    get.mockReturnValueOnce(
+      new Promise((resolve) => {
+        landMount = resolve;
+      }),
+    );
+    const { result } = renderHook(() => useWallet());
+    expect(result.current.loading).toBe(true);
+
+    get.mockResolvedValue(walletWith(470));
+    await act(async () => {
+      document.dispatchEvent(new Event("visibilitychange"));
+    });
+    await act(async () => {
+      landMount(walletWith(500));
+    });
+
+    await waitFor(() => expect(result.current.wallet?.freeRemaining).toBe(470));
+    expect(result.current.loading).toBe(false);
+    visibility.mockRestore();
+  });
+
+  it("clears a stale error once a silent poll succeeds", async () => {
+    // The visible mount load failing is meant to be logged; only the silent
+    // retries stay quiet.
+    expectConsole.warn(/\[useWallet\] fetch failed/);
+    get.mockRejectedValueOnce(new Error("network blip"));
+    const { result } = renderHook(() => useWallet());
+    await waitFor(() => expect(result.current.error).not.toBeNull());
+
+    get.mockResolvedValue(walletWith(500));
+    await act(async () => {
+      vi.advanceTimersByTime(30_000);
+    });
+
+    await waitFor(() => expect(result.current.error).toBeNull());
+    expect(result.current.wallet?.freeRemaining).toBe(500);
+  });
+
+  it("stops polling while the tab is hidden and re-reads on return", async () => {
+    const visibility = vi.spyOn(document, "visibilityState", "get");
+    visibility.mockReturnValue("visible");
+    const { result } = renderHook(() => useWallet());
+    await waitFor(() => expect(result.current.wallet).not.toBeNull());
+    const afterMount = get.mock.calls.length;
+
+    visibility.mockReturnValue("hidden");
+    await act(async () => {
+      document.dispatchEvent(new Event("visibilitychange"));
+      vi.advanceTimersByTime(120_000);
+    });
+    expect(get).toHaveBeenCalledTimes(afterMount);
+
+    visibility.mockReturnValue("visible");
+    await act(async () => {
+      document.dispatchEvent(new Event("visibilitychange"));
+    });
+    await waitFor(() => expect(get.mock.calls.length).toBe(afterMount + 1));
+    visibility.mockRestore();
+  });
+});
diff --git a/frontend/editor/src/saas/portal/usersCapabilities.ts b/frontend/editor/src/saas/portal/usersCapabilities.ts
index b9408cbcd6..79d8adec31 100644
--- a/frontend/editor/src/saas/portal/usersCapabilities.ts
+++ b/frontend/editor/src/saas/portal/usersCapabilities.ts
@@ -23,4 +23,5 @@ export const usersCapabilities: UsersCapabilities = {
   seats: true,
   manageGrants: false,
   removeScope: "team",
+  listingRequiresAdmin: false,
 };
diff --git a/frontend/editor/src/saas/setupTests.ts b/frontend/editor/src/saas/setupTests.ts
index 2c5f53e271..3e8864e49e 100644
--- a/frontend/editor/src/saas/setupTests.ts
+++ b/frontend/editor/src/saas/setupTests.ts
@@ -2,6 +2,9 @@ import "@testing-library/jest-dom";
 import { vi } from "vitest";
 import { installFailOnConsole } from "@app/tests/failOnConsole";
 
+// The shims `src/index.tsx` installs - see core/setupTests.ts.
+import "@app/utils/engineShims";
+
 installFailOnConsole();
 
 // Mock localStorage for tests
diff --git a/frontend/editor/vite.config.ts b/frontend/editor/vite.config.ts
index 3dc3272d59..96ce29c480 100644
--- a/frontend/editor/vite.config.ts
+++ b/frontend/editor/vite.config.ts
@@ -335,6 +335,11 @@ export default defineConfig(async ({ mode, command }) => {
       compressStaticCopyPlugin(),
       prerenderOgPlugin(effectiveMode === "saas"),
     ],
+    // Worker bundles are a separate Rollup pass and do NOT inherit `plugins`,
+    // so without this `@app/*` resolves in the app and fails in a worker.
+    worker: {
+      plugins: () => [tsconfigPaths({ projects: [tsconfigProject] })],
+    },
     server: {
       host: true,
       allowedHosts: allowedHosts.length > 0 ? allowedHosts : undefined,
diff --git a/frontend/editor/vitest.config.ts b/frontend/editor/vitest.config.ts
index 5d7a00bccf..16d457bbd3 100644
--- a/frontend/editor/vitest.config.ts
+++ b/frontend/editor/vitest.config.ts
@@ -1,6 +1,11 @@
 import { defineConfig } from "vitest/config";
 import react from "@vitejs/plugin-react-swc";
 import tsconfigPaths from "vite-tsconfig-paths";
+
+// Projects do NOT inherit the root test.testTimeout, so every project silently
+// ran at vitest's 5s default. Spread this into each one instead.
+const TIMEOUTS = { testTimeout: 10000, hookTimeout: 10000 };
+
 export default defineConfig({
   test: {
     globals: true,
@@ -12,8 +17,7 @@ export default defineConfig({
       "src/**/*.spec.ts", // Exclude Playwright E2E tests
       "src/tests/test-fixtures/**",
     ],
-    testTimeout: 10000,
-    hookTimeout: 10000,
+    ...TIMEOUTS,
     coverage: {
       reporter: ["text", "json", "html"],
       exclude: [
@@ -30,6 +34,7 @@ export default defineConfig({
       {
         test: {
           name: "core",
+          ...TIMEOUTS,
           include: ["src/core/**/*.test.{ts,tsx}"],
           environment: "jsdom",
           globals: true,
@@ -48,6 +53,7 @@ export default defineConfig({
       {
         test: {
           name: "portal",
+          ...TIMEOUTS,
           include: ["src/portal/**/*.test.{ts,tsx}"],
           environment: "jsdom",
           globals: true,
@@ -68,6 +74,7 @@ export default defineConfig({
       {
         test: {
           name: "proprietary",
+          ...TIMEOUTS,
           include: ["src/proprietary/**/*.test.{ts,tsx}"],
           environment: "jsdom",
           globals: true,
@@ -86,6 +93,7 @@ export default defineConfig({
       {
         test: {
           name: "desktop",
+          ...TIMEOUTS,
           include: ["src/desktop/**/*.test.{ts,tsx}"],
           environment: "jsdom",
           globals: true,
@@ -104,6 +112,7 @@ export default defineConfig({
       {
         test: {
           name: "saas",
+          ...TIMEOUTS,
           // src/saas = editor-saas layer; src/portal-saas = the portal's saas
           // overrides (sibling to src/portal). Both build under the saas flavor,
           // so both resolve @portal via the saas cascade (tsconfig.saas.vite.json).
@@ -128,6 +137,7 @@ export default defineConfig({
       {
         test: {
           name: "prototypes",
+          ...TIMEOUTS,
           include: ["src/prototypes/**/*.test.{ts,tsx}"],
           environment: "jsdom",
           globals: true,
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index c7ce36f314..37bca97b95 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -10,7 +10,7 @@
       "license": "SEE LICENSE IN https://raw.githubusercontent.com/Stirling-Tools/Stirling-PDF/refs/heads/main/proprietary/LICENSE",
       "dependencies": {
         "@atlaskit/pragmatic-drag-and-drop": "^1.7.7",
-        "@cantoo/pdf-lib": "^2.5.3",
+        "@cantoo/pdf-lib": "^2.8.2",
         "@dnd-kit/core": "^6.3.1",
         "@embedpdf/core": "^2.14.4",
         "@embedpdf/engines": "^2.14.4",
@@ -50,6 +50,7 @@
         "@supabase/supabase-js": "^2.47.13",
         "@tailwindcss/postcss": "^4.1.13",
         "@tanstack/react-query": "^5.101.4",
+        "@tanstack/react-table": "^9.1.2",
         "@tanstack/react-virtual": "^3.13.12",
         "@tauri-apps/api": "^2.10.1",
         "@tauri-apps/plugin-dialog": "2.7.0",
@@ -605,18 +606,22 @@
       }
     },
     "node_modules/@cantoo/pdf-lib": {
-      "version": "2.6.5",
-      "resolved": "https://registry.npmjs.org/@cantoo/pdf-lib/-/pdf-lib-2.6.5.tgz",
-      "integrity": "sha512-3eMHEaqKHt/G/q+6QjT06A3lz0S/a8x3+myiSN7FNeL3uWcedO0lpfs6TWofa4C03Z1wz3tWeHoa4CsI7DrTSA==",
+      "version": "2.8.2",
+      "resolved": "https://registry.npmjs.org/@cantoo/pdf-lib/-/pdf-lib-2.8.2.tgz",
+      "integrity": "sha512-f0BJM3uPOjbPR3YriSEUIaTM0qnqthjFmTZX9NGI0NDM2Tj4a8xv7Z5Hb6jzUrhfb3/9Y77+xxoOln0IIiYq+w==",
       "license": "MIT",
       "dependencies": {
         "@pdf-lib/standard-fonts": "^1.0.0",
         "@pdf-lib/upng": "^1.0.1",
         "color": "^4.2.3",
         "crypto-js": "^4.2.0",
-        "node-html-better-parser": ">=1.4.0",
-        "pako": "^1.0.11",
+        "html-entities": "^2.3.2",
+        "node-html-better-parser": ">=1.5.9",
+        "pako": "^2.2.0",
         "tslib": ">=2"
+      },
+      "peerDependencies": {
+        "html-entities": "^2.3.2"
       }
     },
     "node_modules/@csstools/color-helpers": {
@@ -4936,6 +4941,44 @@
         "react": "^18 || ^19"
       }
     },
+    "node_modules/@tanstack/react-store": {
+      "version": "0.11.1",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-store/-/react-store-0.11.1.tgz",
+      "integrity": "sha512-HaIGKI3YLmjBYIvy5DFDY23oNaYZIsTZfngey07Uh5iLVJgM3bIGCnZeOFOqzjFld9JHWcaHJnasD/bKoGKwJQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/store": "0.11.1",
+        "use-sync-external-store": "^1.6.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
+        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/@tanstack/react-table": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-table/-/react-table-9.1.2.tgz",
+      "integrity": "sha512-YQPZFJ1nIi/bjjwsPZVouABgahDcl7Gdm33CdTStUJBn0DjEVJ2uhSTVmIoWt9MVKdQziXGAsXipSzy949Hygg==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/react-store": "^0.11.0",
+        "@tanstack/table-core": "9.1.2"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "react": ">=18"
+      }
+    },
     "node_modules/@tanstack/react-virtual": {
       "version": "3.13.23",
       "resolved": "https://registry.npmjs.org/@tanstack/react-virtual/-/react-virtual-3.13.23.tgz",
@@ -4953,6 +4996,32 @@
         "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
+    "node_modules/@tanstack/store": {
+      "version": "0.11.1",
+      "resolved": "https://registry.npmjs.org/@tanstack/store/-/store-0.11.1.tgz",
+      "integrity": "sha512-mzTOBhypOuDJAy/D8n2MfUZ1HFkXnmSETviRyhqEC8LUE7/IZQExOTxMANj3KjTofYTkFNpBY67qaVrT41YccA==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@tanstack/table-core": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/@tanstack/table-core/-/table-core-9.1.2.tgz",
+      "integrity": "sha512-ONpWQeass1sfg80CWF1NSwQ8r3GiqxA2lT/EdqIcrDEPZ0Z+0mM94eQoFYLPN0Kztzj8TQVb2+PrSZSItqA61g==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/store": "^0.11.0"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
     "node_modules/@tanstack/virtual-core": {
       "version": "3.13.23",
       "resolved": "https://registry.npmjs.org/@tanstack/virtual-core/-/virtual-core-3.13.23.tgz",
@@ -12394,9 +12463,9 @@
       }
     },
     "node_modules/node-html-better-parser": {
-      "version": "1.5.8",
-      "resolved": "https://registry.npmjs.org/node-html-better-parser/-/node-html-better-parser-1.5.8.tgz",
-      "integrity": "sha512-t/wAKvaTSKco43X+yf9+76RiMt18MtMmzd4wc7rKj+fWav6DV4ajDEKdWlLzSE8USDF5zr/06uGj0Wr/dGAFtw==",
+      "version": "1.5.9",
+      "resolved": "https://registry.npmjs.org/node-html-better-parser/-/node-html-better-parser-1.5.9.tgz",
+      "integrity": "sha512-z1I5UINMezJXYL9cH3h0a9KBth2G978gSLlfkpQ+CQzzVHVQy9gpARgm9eDsz1O4gn1HtgUqjdAIYxKFZm6uHQ==",
       "license": "MIT",
       "dependencies": {
         "html-entities": "^2.3.2"
@@ -12686,9 +12755,19 @@
       "license": "MIT"
     },
     "node_modules/pako": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
-      "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/pako/-/pako-2.2.0.tgz",
+      "integrity": "sha512-zJq6RP/5q+TO2OpFV3FHzlPnFjmkb7Nc99a5SNjJE+uu/PkpChs+NIZSSzbBoD+6kjiISXjfYdwj1ZRQ81dz/w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "(MIT AND Zlib)"
     },
     "node_modules/parent-module": {
diff --git a/frontend/package.json b/frontend/package.json
index 3fd1f8e106..f874dedfa3 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -7,7 +7,7 @@
   "proxy": "http://localhost:8080",
   "dependencies": {
     "@atlaskit/pragmatic-drag-and-drop": "^1.7.7",
-    "@cantoo/pdf-lib": "^2.5.3",
+    "@cantoo/pdf-lib": "^2.8.2",
     "@dnd-kit/core": "^6.3.1",
     "@embedpdf/core": "^2.14.4",
     "@embedpdf/engines": "^2.14.4",
@@ -47,6 +47,7 @@
     "@supabase/supabase-js": "^2.47.13",
     "@tailwindcss/postcss": "^4.1.13",
     "@tanstack/react-query": "^5.101.4",
+    "@tanstack/react-table": "^9.1.2",
     "@tanstack/react-virtual": "^3.13.12",
     "@tauri-apps/api": "^2.10.1",
     "@tauri-apps/plugin-dialog": "2.7.0",
@@ -170,6 +171,7 @@
   },
   "overrides": {
     "devalue": "^5.8.1",
+    "pako": "^2.2.0",
     "tsconfck": {
       "typescript": "$typescript"
     }
diff --git a/testing/allEndpointsRemovedSettings.yml b/testing/allEndpointsRemovedSettings.yml
index 52e85dd128..c3de95eae2 100644
--- a/testing/allEndpointsRemovedSettings.yml
+++ b/testing/allEndpointsRemovedSettings.yml
@@ -266,7 +266,7 @@ autoPipeline:
 
 ui:
   appNameNavbar: "" # name displayed on the navigation bar
-  logoStyle: classic # Options: 'classic' (default - classic S icon) or 'modern' (minimalist logo)
+  logoStyle: modern # Options: 'modern' (default - minimalist logo) or 'classic' (legacy S icon)
   languages: [] # If empty, all languages are enabled. To restrict to specific languages, use a whitelist like ["de_DE", "pl_PL", "sv_SE"]. Empty list or not restricting any languages will enable all available languages.
   defaultHideUnavailableTools: false # Default user preference: hide disabled tools instead of greying them out
   defaultHideUnavailableConversions: false # Default user preference: hide disabled conversion options instead of greying them out
diff --git a/testing/cucumber/behave.ini b/testing/cucumber/behave.ini
index 0b2a9e4bac..f838c8dad2 100644
--- a/testing/cucumber/behave.ini
+++ b/testing/cucumber/behave.ini
@@ -3,6 +3,7 @@
 # Run either directly, e.g. `python -m behave features/enterprise`.
 exclude_re = features/(enterprise|multinode)
 tags = ~@manual
+       ~@nightly
 
 [behave.formatters]
 # Registers the html report formatter (behave-html-formatter) used by run-multinode-regression.sh.
diff --git a/testing/cucumber/features/analysis.feature b/testing/cucumber/features/analysis.feature
index 0f7ed17b32..039dc31d76 100644
--- a/testing/cucumber/features/analysis.feature
+++ b/testing/cucumber/features/analysis.feature
@@ -15,6 +15,7 @@ Feature: Analysis API Endpoints
         Given I generate a PDF file as "fileInput"
         And the pdf contains <pages> pages
         When I send the API request to the endpoint "/api/v1/analysis/page-count"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -35,6 +36,7 @@ Feature: Analysis API Endpoints
         Given I generate a PDF file as "fileInput"
         And the pdf contains 4 pages
         When I send the API request to the endpoint "/api/v1/analysis/basic-info"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -66,6 +68,7 @@ Feature: Analysis API Endpoints
         Given I generate a PDF file as "fileInput"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/analysis/document-properties"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -104,6 +107,7 @@ Feature: Analysis API Endpoints
         Given I generate a PDF file as "fileInput"
         And the pdf contains 2 pages with random text
         When I send the API request to the endpoint "/api/v1/analysis/page-dimensions"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -118,6 +122,7 @@ Feature: Analysis API Endpoints
         Given I generate a PDF file as "fileInput"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/analysis/form-fields"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -141,6 +146,7 @@ Feature: Analysis API Endpoints
         Given I generate a PDF file as "fileInput"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/analysis/annotation-info"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -164,6 +170,7 @@ Feature: Analysis API Endpoints
         Given I generate a PDF file as "fileInput"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/analysis/font-info"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -187,6 +194,7 @@ Feature: Analysis API Endpoints
         Given I generate a PDF file as "fileInput"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/analysis/security-info"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
diff --git a/testing/cucumber/features/async_jobs.feature b/testing/cucumber/features/async_jobs.feature
new file mode 100644
index 0000000000..b0181bbe94
--- /dev/null
+++ b/testing/cucumber/features/async_jobs.feature
@@ -0,0 +1,143 @@
+@jobs
+Feature: Asynchronous job API
+
+    # Any tool endpoint accepts ?async=true and returns a jobId instead of the file.
+    # No parallel step here: every step after the submit depends on that one jobId.
+
+    @positive
+    Scenario: An async job runs to completion and returns its result
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 3 pages
+        And the request data includes
+            | parameter | value |
+            | angle     | 90    |
+        When I send the API request to the endpoint "/api/v1/general/rotate-pdf?async=true"
+        Then the response status code should be 200
+        And the response JSON field "async" should be true
+
+        When I store the job id from the response
+        And I wait for the job to complete
+        Then the job should be reported complete
+
+        When I request the job result
+        Then the response status code should be 200
+        And the response content type should be "application/pdf"
+        And the response PDF should contain 3 pages
+
+
+    @positive
+    Scenario: Async job results are listed and downloadable as individual files
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 4 pages
+        And the request data includes
+            | parameter   | value |
+            | pageNumbers | all   |
+        When I send the API request to the endpoint "/api/v1/general/split-pages?async=true"
+        Then the response status code should be 200
+
+        When I store the job id from the response
+        And I wait for the job to complete
+        And I request the job result file list
+        Then the response status code should be 200
+        And the job result file list should contain at least 4 file(s)
+
+        When I request the first job result file metadata
+        Then the response status code should be 200
+        And the response JSON field "fileName" should not be empty
+
+        When I download the first job result file
+        Then the response status code should be 200
+        And the response file should have size greater than 100
+
+
+    @negative
+    Scenario: Cancelling an already-finished job is rejected
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 2 pages
+        And the request data includes
+            | parameter | value |
+            | angle     | 180   |
+        When I send the API request to the endpoint "/api/v1/general/rotate-pdf?async=true"
+        And I store the job id from the response
+        And I wait for the job to complete
+        And I cancel the job
+        Then the response status code should be 400
+
+
+    @negative
+    Scenario: Polling a job id the caller does not own is forbidden
+        When I send a GET request to "/api/v1/general/job/does-not-exist-1234"
+        Then the response status code should be 403
+
+
+    @negative
+    Scenario: Downloading an unknown file id is rejected
+        When I send a GET request to "/api/v1/general/files/does-not-exist-1234"
+        Then the response status code should be 404
+
+
+    # An async submit persists a copy of the upload and its results under the server's
+    # file store. Those outlive the request by design, so the only proof they are not a
+    # leak is that cleanup actually removes them. These scenarios exercise that, and
+    # environment.after_all sweeps the rest so the post-run temp-file diff stays honest.
+
+    @positive @cleanup
+    Scenario: Downloading a result does not consume it
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 2 pages
+        And the request data includes
+            | parameter | value |
+            | angle     | 90    |
+        When I send the API request to the endpoint "/api/v1/general/rotate-pdf?async=true"
+        And I store the job id from the response
+        And I wait for the job to complete
+        And I request the job result file list
+        Then the response status code should be 200
+
+        When I download the first job result file
+        Then the response status code should be 200
+        And the response file should have size greater than 100
+        # A download is a read, not a take: the file survives for a retry or a second client.
+        And the job result file should still be downloadable
+
+
+    @positive @cleanup
+    Scenario: Cleanup releases a finished job and deletes its stored files
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 3 pages
+        And the request data includes
+            | parameter   | value |
+            | pageNumbers | all   |
+        When I send the API request to the endpoint "/api/v1/general/split-pages?async=true"
+        And I store the job id from the response
+        And I wait for the job to complete
+        And I request the job result file list
+        Then the response status code should be 200
+        And the job result file list should contain at least 3 file(s)
+
+        When I trigger the async job cleanup
+        Then the response status code should be 200
+        # 3 split results plus the persisted copy of the upload.
+        And the cleanup should report at least 1 job(s) removed
+        And the cleanup should report at least 4 file(s) deleted
+        And the job should no longer exist
+        And the job result file should no longer be downloadable
+
+
+    @positive @cleanup
+    Scenario: A second cleanup finds nothing left behind
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 2 pages
+        And the request data includes
+            | parameter | value |
+            | angle     | 180   |
+        When I send the API request to the endpoint "/api/v1/general/rotate-pdf?async=true"
+        And I store the job id from the response
+        And I wait for the job to complete
+        And I trigger the async job cleanup
+        Then the response status code should be 200
+        And the cleanup should report at least 1 job(s) removed
+
+        When I trigger the async job cleanup
+        Then the response status code should be 200
+        And the cleanup should report nothing left to remove
diff --git a/testing/cucumber/features/attachments.feature b/testing/cucumber/features/attachments.feature
index 6bb9cfd6ea..582abadda0 100644
--- a/testing/cucumber/features/attachments.feature
+++ b/testing/cucumber/features/attachments.feature
@@ -7,6 +7,7 @@ Feature: Attachments API Validation
         And the pdf contains 2 pages with random text
         And I also generate a PDF file as "attachments"
         When I send the API request to the endpoint "/api/v1/misc/add-attachments"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -30,6 +31,7 @@ Feature: Attachments API Validation
         And the pdf contains 2 pages
         And the pdf has an attachment named "test_doc.txt"
         When I send the API request to the endpoint "/api/v1/misc/list-attachments"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -49,6 +51,7 @@ Feature: Attachments API Validation
         And the pdf contains 2 pages
         And the pdf has an attachment named "report.txt"
         When I send the API request to the endpoint "/api/v1/misc/extract-attachments"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response file should have size greater than 0
 
@@ -62,6 +65,7 @@ Feature: Attachments API Validation
             | attachmentName | original.txt |
             | newName        | renamed.txt  |
         When I send the API request to the endpoint "/api/v1/misc/rename-attachment"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -76,6 +80,7 @@ Feature: Attachments API Validation
             | parameter      | value          |
             | attachmentName | to_delete.txt  |
         When I send the API request to the endpoint "/api/v1/misc/delete-attachment"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
diff --git a/testing/cucumber/features/bookmarks_chapters.feature b/testing/cucumber/features/bookmarks_chapters.feature
index 8bda991728..02fb33fb23 100644
--- a/testing/cucumber/features/bookmarks_chapters.feature
+++ b/testing/cucumber/features/bookmarks_chapters.feature
@@ -7,6 +7,7 @@ Feature: Bookmarks and Chapter Splitting API Validation
         And the pdf contains 3 pages with random text
         And the pdf has bookmarks
         When I send the API request to the endpoint "/api/v1/general/extract-bookmarks"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -31,6 +32,7 @@ Feature: Bookmarks and Chapter Splitting API Validation
             | includeMetadata | false |
             | allowDuplicates | false |
         When I send the API request to the endpoint "/api/v1/general/split-pdf-by-chapters"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response file should have size greater than 0
 
diff --git a/testing/cucumber/features/convert_nightly.feature b/testing/cucumber/features/convert_nightly.feature
new file mode 100644
index 0000000000..eb30bdbbac
--- /dev/null
+++ b/testing/cucumber/features/convert_nightly.feature
@@ -0,0 +1,53 @@
+@nightly @convert
+Feature: Heavy conversion endpoints
+
+    # Too slow for every PR: these shell out to LibreOffice, Calibre or Ghostscript.
+    # behave.ini excludes @nightly; the nightly job opts back in with --tags=@nightly.
+
+    @pdf-to-xlsx @positive
+    Scenario: Convert a PDF containing tables to XLSX
+        Given I use an example file at "exampleFiles/tables.pdf" as parameter "fileInput"
+        When I send the API request to the endpoint "/api/v1/convert/pdf/xlsx"
+        And this operation is run 3 times in parallel
+        Then the response status code should be 200
+        And the response file should have size greater than 1000
+        And the response file should have extension ".xlsx"
+
+
+    @pdf-to-xlsx @positive
+    Scenario: A PDF with no tables converts without producing a spreadsheet
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 2 pages with random text
+        When I send the API request to the endpoint "/api/v1/convert/pdf/xlsx"
+        Then the response status code should be 204
+
+
+    @text-editor @positive
+    Scenario: text-editor metadata describes the document for the editor
+        Given I use an example file at "exampleFiles/tables.pdf" as parameter "fileInput"
+        When I send the API request to the endpoint "/api/v1/convert/pdf/text-editor/metadata"
+        And this operation is run 3 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "application/json"
+        And the response JSON field "fonts" should not be empty
+
+
+    @vector @negative
+    Scenario: vector conversion rejects an input format Ghostscript cannot read
+        Given I generate an SVG file as "fileInput"
+        When I send the API request to the endpoint "/api/v1/convert/vector/pdf"
+        Then the response status code should be 400
+        And the response JSON error should contain "Unsupported"
+
+
+    @ebook @positive
+    Scenario: An EPUB produced by Stirling converts back to PDF
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 3 pages with random text
+        And the request data includes
+            | parameter    | value |
+            | outputFormat | EPUB  |
+        When I send the API request to the endpoint "/api/v1/convert/pdf/epub"
+        And this operation is run 3 times in parallel
+        Then the response status code should be 200
+        And the response file should have size greater than 200
diff --git a/testing/cucumber/features/environment.py b/testing/cucumber/features/environment.py
index 208e45b23b..84d30a50bc 100644
--- a/testing/cucumber/features/environment.py
+++ b/testing/cucumber/features/environment.py
@@ -1,8 +1,13 @@
 import os
 import subprocess
+import sys
 
 import requests
 
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "steps"))
+import job_support  # noqa: E402
+import parallel_support  # noqa: E402
+
 _BASE_URL = "http://localhost:8080"
 _CONTAINER_NAME = os.environ.get("TEST_CONTAINER_NAME", "")
 _REPORT_DIR = os.environ.get("TEST_REPORT_DIR", "")
@@ -142,8 +147,17 @@ def before_all(context):
 
 def before_scenario(context, scenario):
     """Reset all per-scenario state before each scenario runs."""
-    # Skip scenarios that require JWT Bearer auth when it is not functional.
     scenario_tags = set(scenario.effective_tags)
+
+    # Concurrency is opted into by a step in the feature, never by configuration.
+    context.parallel_repeat = 1
+    context.parallel_decoy = False
+    context.parallel_validated = False
+    context.parallel_ran_at = 0
+    context.parallel_request = None
+    context.parallel_get = None
+
+    # Skip scenarios that require JWT Bearer auth when it is not functional.
     if _JWT_DEPENDENT_TAGS & scenario_tags and not context.jwt_available:
         scenario.skip(
             "JWT Bearer authentication not available in this environment (V2 disabled). "
@@ -217,3 +231,48 @@ def after_scenario(context, scenario):
     context.jwt_token = None
     context.original_jwt_token = None
     context._status_ok = False
+    context.parallel_request = None
+    context.parallel_get = None
+
+
+def _cleanup_async_job_files():
+    """Release every async job result the run left on the server.
+
+    An async submit persists a copy of the upload plus its results, and both are held
+    for the job retention window (30 minutes by default) - far longer than a test run.
+    The regression check that diffs the container filesystem before and after this suite
+    would otherwise flag them as leaked temp files. Sweeping them here keeps that check
+    strict: anything it still reports afterwards is a genuine leak.
+    """
+    try:
+        response = job_support.trigger_cleanup()
+    except Exception as exc:
+        print(f"\n[CLEANUP] Async job cleanup request failed: {exc}")
+        return
+    if response.status_code == 404:
+        print(
+            "\n[CLEANUP] Async job cleanup endpoint not available on this build; "
+            "async job files will age out on their own."
+        )
+        return
+    if response.status_code != 200:
+        print(
+            f"\n[CLEANUP] Async job cleanup returned {response.status_code}: "
+            f"{response.text[:200]}"
+        )
+        return
+    try:
+        summary = response.json()
+    except ValueError:
+        print("\n[CLEANUP] Async job cleanup returned a non-JSON body")
+        return
+    print(
+        f"\n[CLEANUP] Released {summary.get('jobsRemoved', '?')} async job(s) and "
+        f"{summary.get('filesDeleted', '?')} stored file(s); "
+        f"{summary.get('jobsRetained', '?')} retained."
+    )
+
+
+def after_all(context):
+    _cleanup_async_job_files()
+    parallel_support.print_summary()
diff --git a/testing/cucumber/features/examples.feature b/testing/cucumber/features/examples.feature
index e0ea72024e..186d882e1c 100644
--- a/testing/cucumber/features/examples.feature
+++ b/testing/cucumber/features/examples.feature
@@ -10,6 +10,7 @@ Feature: API Validation
             | parameter | value       |
             | password  | password123 |
         When I send the API request to the endpoint "/api/v1/security/remove-password"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response file should have size greater than 0
         And the response PDF is not passworded
@@ -31,6 +32,7 @@ Feature: API Validation
     Scenario: Get info
         Given I generate a PDF file as "fileInput"
         When I send the API request to the endpoint "/api/v1/security/get-info-on-pdf"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/json"
         And the response file should have size greater than 100
         And the response status code should be 200
@@ -43,6 +45,7 @@ Feature: API Validation
             | parameter | value       |
             | password  | password123 |
         When I send the API request to the endpoint "/api/v1/security/add-password"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response file should have size greater than 100
         And the response PDF is passworded
@@ -81,6 +84,7 @@ Feature: API Validation
             | alphabet      | roman            |
             | customColor   | #d3d3d3          |
         When I send the API request to the endpoint "/api/v1/security/add-watermark"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response file should have size greater than 100
         And the response status code should be 200
@@ -94,6 +98,7 @@ Feature: API Validation
             | threshold    | 90    |
             | whitePercent | 99.9  |
         When I send the API request to the endpoint "/api/v1/misc/remove-blanks"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/octet-stream"
         And the response file should have extension ".zip"
         And the response ZIP should contain 1 files
@@ -106,6 +111,7 @@ Feature: API Validation
             | parameter        | value |
             | flattenOnlyForms | false |
         When I send the API request to the endpoint "/api/v1/misc/flatten"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response file should have size greater than 0
         And the response status code should be 200
@@ -121,6 +127,7 @@ Feature: API Validation
             | keywords  | sample, test   |
             | producer  | Test Producer  |
         When I send the API request to the endpoint "/api/v1/misc/update-metadata"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response file should have size greater than 0
         And the response PDF metadata should include "Author" as "John Doe"
diff --git a/testing/cucumber/features/external.feature b/testing/cucumber/features/external.feature
index e8e8d85272..3257657068 100644
--- a/testing/cucumber/features/external.feature
+++ b/testing/cucumber/features/external.feature
@@ -174,6 +174,7 @@ Feature: API Validation
             | dpi         | 300      |
             | imageFormat | <format> |
         When I send the API request to the endpoint "/api/v1/convert/pdf/img"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response file should have size greater than 100
         And the response file should have extension ".zip"
@@ -231,6 +232,7 @@ Feature: API Validation
         Given I generate a PDF file as "fileInput"
         And the pdf contains 3 pages with random text
         When I send the API request to the endpoint "/api/v1/convert/pdf/markdown"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response file should have size greater than 100
         And the response file should have extension ".md"
@@ -244,6 +246,7 @@ Feature: API Validation
             | outputFormat | csv   |
             | pageNumbers  | all   |
         When I send the API request to the endpoint "/api/v1/convert/pdf/csv"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response file should have size greater than 200
         And the response file should have extension ".zip"
diff --git a/testing/cucumber/features/filter.feature b/testing/cucumber/features/filter.feature
index d0f34c8731..2caf1eacf1 100644
--- a/testing/cucumber/features/filter.feature
+++ b/testing/cucumber/features/filter.feature
@@ -18,6 +18,7 @@ Feature: Filter API Endpoints
             | pageCount  | <pageCount>  |
             | comparator | <comparator> |
         When I send the API request to the endpoint "/api/v1/filter/filter-page-count"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -59,6 +60,7 @@ Feature: Filter API Endpoints
             | fileSize   | <fileSize>   |
             | comparator | <comparator> |
         When I send the API request to the endpoint "/api/v1/filter/filter-file-size"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -93,6 +95,7 @@ Feature: Filter API Endpoints
             | rotation   | 0     |
             | comparator | Equal |
         When I send the API request to the endpoint "/api/v1/filter/filter-page-rotation"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -170,6 +173,7 @@ Feature: Filter API Endpoints
             | standardPageSize | LETTER |
             | comparator       | Equal  |
         When I send the API request to the endpoint "/api/v1/filter/filter-page-size"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -242,6 +246,7 @@ Feature: Filter API Endpoints
             | text        | FINDME |
             | pageNumbers | all    |
         When I send the API request to the endpoint "/api/v1/filter/filter-contains-text"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -281,6 +286,7 @@ Feature: Filter API Endpoints
             | parameter   | value |
             | pageNumbers | all   |
         When I send the API request to the endpoint "/api/v1/filter/filter-contains-image"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
diff --git a/testing/cucumber/features/form_advanced.feature b/testing/cucumber/features/form_advanced.feature
index bb02a453b4..c66e7df2e0 100644
--- a/testing/cucumber/features/form_advanced.feature
+++ b/testing/cucumber/features/form_advanced.feature
@@ -8,6 +8,7 @@ Feature: Advanced Forms API Validation (JSON data parts)
         And the pdf has form fields
         And the request includes a JSON part "data" with content "{}"
         When I send the API request to the endpoint "/api/v1/form/fill"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
diff --git a/testing/cucumber/features/forms.feature b/testing/cucumber/features/forms.feature
index c0c1b0f7ff..05ece6f99d 100644
--- a/testing/cucumber/features/forms.feature
+++ b/testing/cucumber/features/forms.feature
@@ -6,6 +6,7 @@ Feature: Forms API Validation
         Given I generate a PDF file as "file"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/form/fields"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -24,6 +25,7 @@ Feature: Forms API Validation
         Given I generate a PDF file as "file"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/form/fields-with-coordinates"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 0
@@ -67,6 +69,7 @@ Feature: Forms API Validation
         Given I generate a PDF file as "file"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/form/modify-fields"
+        And this operation is run 5 times in parallel
         Then the response status code should be 400
 
     @modify-fields @negative
@@ -81,6 +84,7 @@ Feature: Forms API Validation
         Given I generate a PDF file as "file"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/form/delete-fields"
+        And this operation is run 5 times in parallel
         Then the response status code should be 400
 
     @delete-fields @negative
@@ -89,3 +93,34 @@ Feature: Forms API Validation
         And the pdf contains 4 pages
         When I send the API request to the endpoint "/api/v1/form/delete-fields"
         Then the response status code should be 400
+
+
+    @extract-csv @positive
+    Scenario: extract-csv returns CSV for a form PDF
+        Given I generate a PDF file as "file"
+        And the pdf contains 2 pages
+        And the pdf has form fields
+        When I send the API request to the endpoint "/api/v1/form/extract-csv"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "text/csv"
+
+
+    @extract-xlsx @positive
+    Scenario: extract-xlsx returns a spreadsheet for a form PDF
+        Given I generate a PDF file as "file"
+        And the pdf contains 2 pages
+        And the pdf has form fields
+        When I send the API request to the endpoint "/api/v1/form/extract-xlsx"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response file should have size greater than 200
+
+
+    @extract-csv @negative
+    Scenario: extract-csv rejects a upload sent under the wrong part name
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 2 pages
+        When I send the API request to the endpoint "/api/v1/form/extract-csv"
+        Then the response status code should be 400
+        And the response JSON error should contain "file"
diff --git a/testing/cucumber/features/general.feature b/testing/cucumber/features/general.feature
index 6ede9bb4fc..747788a9b5 100644
--- a/testing/cucumber/features/general.feature
+++ b/testing/cucumber/features/general.feature
@@ -12,6 +12,7 @@ Feature: API Validation
             | verticalDivisions   | <verticalDivisions>   |
             | merge               | true                  |
         When I send the API request to the endpoint "/api/v1/general/split-pdf-by-sections"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response file should have size greater than 200
         And the response status code should be 200
@@ -34,6 +35,7 @@ Feature: API Validation
             | fileInput   | fileInput     |
             | pageNumbers | <pageNumbers> |
         When I send the API request to the endpoint "/api/v1/general/split-pages"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/octet-stream"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -57,6 +59,7 @@ Feature: API Validation
             | splitType  | <splitType>  |
             | splitValue | <splitValue> |
         When I send the API request to the endpoint "/api/v1/general/split-by-size-or-count"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/octet-stream"
         And the response status code should be 200
         And the response file should have size greater than 200
diff --git a/testing/cucumber/features/general_new.feature b/testing/cucumber/features/general_new.feature
index 9d07bb1749..cd25b09650 100644
--- a/testing/cucumber/features/general_new.feature
+++ b/testing/cucumber/features/general_new.feature
@@ -10,6 +10,7 @@ Feature: General PDF Operations API Validation
             | parameter | value   |
             | angle     | <angle> |
         When I send the API request to the endpoint "/api/v1/general/rotate-pdf"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -41,6 +42,7 @@ Feature: General PDF Operations API Validation
             | parameter   | value |
             | pageNumbers | 3     |
         When I send the API request to the endpoint "/api/v1/general/remove-pages"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -76,6 +78,7 @@ Feature: General PDF Operations API Validation
             | parameter  | value        |
             | customMode | <customMode> |
         When I send the API request to the endpoint "/api/v1/general/rearrange-pages"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -103,6 +106,7 @@ Feature: General PDF Operations API Validation
             | parameter | value      |
             | pageSize  | <pageSize> |
         When I send the API request to the endpoint "/api/v1/general/scale-pages"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -127,6 +131,7 @@ Feature: General PDF Operations API Validation
             | width     | 50    |
             | height    | 50    |
         When I send the API request to the endpoint "/api/v1/general/crop"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -155,6 +160,7 @@ Feature: General PDF Operations API Validation
         Given I generate a PDF file as "fileInput"
         And the pdf contains 5 pages
         When I send the API request to the endpoint "/api/v1/general/pdf-to-single-page"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -199,6 +205,7 @@ Feature: General PDF Operations API Validation
             | parameter     | value |
             | pagesPerSheet | 9     |
         When I send the API request to the endpoint "/api/v1/general/multi-page-layout"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -213,6 +220,7 @@ Feature: General PDF Operations API Validation
             | parameter     | value |
             | pagesPerSheet | 2     |
         When I send the API request to the endpoint "/api/v1/general/booklet-imposition"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -249,3 +257,55 @@ Feature: General PDF Operations API Validation
     #     Then the response content type should be "application/pdf"
     #     And the response status code should be 200
     #     And the response file should have size greater than 0
+
+
+    @edit-table-of-contents @positive
+    Scenario: edit-table-of-contents rewrites the outline
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 3 pages
+        And the pdf has bookmarks
+        And the request data includes
+            | parameter    | value                                                    |
+            | bookmarkData | [{"title":"Intro","pageNumber":1,"children":[]}]          |
+        When I send the API request to the endpoint "/api/v1/general/edit-table-of-contents"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "application/pdf"
+        And the response PDF should contain 3 pages
+
+
+    @edit-text @positive
+    Scenario: edit-text applies a find and replace across the document
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 3 pages
+        And the pdf pages all contain the text "Hello world"
+        And the request data includes
+            | parameter | value                                        |
+            | edits     | [{"find":"Hello","replace":"Goodbye"}]       |
+        When I send the API request to the endpoint "/api/v1/general/edit-text"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "application/pdf"
+
+
+    @edit-text @negative
+    Scenario: edit-text without any operations returns 400
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 2 pages
+        When I send the API request to the endpoint "/api/v1/general/edit-text"
+        Then the response status code should be 400
+        And the response JSON error should contain "find/replace"
+
+
+    @split-for-poster-print @positive
+    Scenario: split-for-poster-print tiles each page into an archive
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 2 pages
+        And the request data includes
+            | parameter           | value |
+            | horizontalDivisions | 1     |
+            | verticalDivisions   | 1     |
+        When I send the API request to the endpoint "/api/v1/general/split-for-poster-print"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response file should have size greater than 200
diff --git a/testing/cucumber/features/info_config.feature b/testing/cucumber/features/info_config.feature
new file mode 100644
index 0000000000..3559110c29
--- /dev/null
+++ b/testing/cucumber/features/info_config.feature
@@ -0,0 +1,134 @@
+@info @config
+Feature: Config, info and UI-data read APIs
+
+    # Cheap read-only JSON endpoints behind the frontend and admin surfaces.
+
+    @app-config @positive
+    Scenario: app-config returns the frontend configuration
+        When I send a GET request to "/api/v1/config/app-config"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "application/json"
+
+
+    @endpoints-availability @positive
+    Scenario: endpoints-availability reports per-endpoint availability
+        When I send a GET request to "/api/v1/config/endpoints-availability"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "application/json"
+
+
+    @endpoints-enabled @positive
+    Scenario: endpoints-enabled reports the status of a named endpoint
+        When I send a GET request to "/api/v1/config/endpoints-enabled" with parameters
+            | parameter | value      |
+            | endpoints | merge-pdfs |
+        Then the response status code should be 200
+        And the response content type should be "application/json"
+
+
+    @endpoints-enabled @negative
+    Scenario: endpoints-enabled without the endpoints parameter returns 400
+        When I send a GET request to "/api/v1/config/endpoints-enabled"
+        Then the response status code should be 400
+
+
+    @login-disclaimer @positive
+    Scenario: login-disclaimer returns its configuration
+        When I send a GET request to "/api/v1/config/login-disclaimer"
+        Then the response status code should be 200
+        And the response JSON field "enabled" should be false
+
+
+    @health @positive
+    Scenario: info health reports the running version
+        When I send a GET request to "/api/v1/info/health"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response JSON field "status" should equal "UP"
+        And the response JSON field "version" should not be empty
+
+
+    @metrics @positive
+    Scenario Outline: metrics endpoints return a numeric aggregate
+        When I send a GET request to "<endpoint>"
+        Then the response status code should be 200
+        And the response content type should be "application/json"
+        And the response should match the regex "^[0-9.]+$"
+
+        Examples:
+            | endpoint                       |
+            | /api/v1/info/load/unique       |
+            | /api/v1/info/requests/unique   |
+
+
+    @metrics @positive
+    Scenario Outline: metrics list endpoints return a JSON list
+        When I send a GET request to "<endpoint>"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response JSON should be a list
+
+        Examples:
+            | endpoint                          |
+            | /api/v1/info/load/all/unique      |
+            | /api/v1/info/requests/all/unique  |
+
+
+    @metrics @positive
+    Scenario: weekly active users reports tracking metadata
+        When I send a GET request to "/api/v1/info/wau"
+        Then the response status code should be 200
+        And the response JSON field "trackingSince" should not be empty
+
+
+    @settings @positive
+    Scenario: get-endpoints-status returns the endpoint toggle map
+        When I send a GET request to "/api/v1/settings/get-endpoints-status"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "application/json"
+
+
+    @ui-data @positive
+    Scenario Outline: UI data endpoints return JSON for the frontend
+        When I send a GET request to "<endpoint>"
+        Then the response status code should be 200
+        And the response content type should be "application/json"
+
+        Examples:
+            | endpoint                      |
+            | /api/v1/ui-data/footer-info   |
+            | /api/v1/ui-data/home          |
+            | /api/v1/ui-data/licenses      |
+            | /api/v1/ui-data/pipeline      |
+
+
+    @ui-data @positive
+    Scenario: OCR UI data lists the installed tesseract languages
+        When I send a GET request to "/api/v1/ui-data/ocr-pdf"
+        Then the response status code should be 200
+        And the response JSON field "languages" should be a list
+
+
+    @ui-data @positive
+    Scenario: Sign UI data lists the available signature fonts
+        When I send a GET request to "/api/v1/ui-data/sign"
+        Then the response status code should be 200
+        And the response JSON field "fonts" should be a list
+
+
+    @hardware-signing @positive
+    Scenario: Hardware signing capabilities are reported for the server build
+        When I send a GET request to "/api/v1/security/cert-sign/hardware/capabilities"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response JSON field "desktop" should be false
+
+
+    @hardware-signing @negative
+    Scenario: Windows certificate store is rejected outside the desktop app
+        When I send a GET request to "/api/v1/security/cert-sign/hardware/windows-certificates"
+        Then the response status code should be 400
+        And the response JSON error should contain "desktop"
diff --git a/testing/cucumber/features/merge_overlay.feature b/testing/cucumber/features/merge_overlay.feature
index 9e62d1ae99..2f7abe06bc 100644
--- a/testing/cucumber/features/merge_overlay.feature
+++ b/testing/cucumber/features/merge_overlay.feature
@@ -7,6 +7,7 @@ Feature: Merge and Overlay PDF API Validation
         And the pdf contains 2 pages with random text
         And I also generate a PDF file as "fileInput"
         When I send the API request to the endpoint "/api/v1/general/merge-pdfs"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -51,6 +52,7 @@ Feature: Merge and Overlay PDF API Validation
             | overlayMode     | SequentialOverlay |
             | overlayPosition | 0                 |
         When I send the API request to the endpoint "/api/v1/general/overlay-pdfs"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
diff --git a/testing/cucumber/features/misc_new.feature b/testing/cucumber/features/misc_new.feature
index c10f0601d7..528ed6391d 100644
--- a/testing/cucumber/features/misc_new.feature
+++ b/testing/cucumber/features/misc_new.feature
@@ -48,6 +48,7 @@ Feature: Miscellaneous PDF Operations API Validation
             | overrideX    | -1           |
             | overrideY    | -1           |
         When I send the API request to the endpoint "/api/v1/misc/add-stamp"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -92,6 +93,7 @@ Feature: Miscellaneous PDF Operations API Validation
             | position       | 2     |
             | fontSize       | 14    |
         When I send the API request to the endpoint "/api/v1/misc/add-page-numbers"
+        And this operation is run 5 times in parallel against decoy traffic
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 200
@@ -103,6 +105,7 @@ Feature: Miscellaneous PDF Operations API Validation
         Given I generate a PDF file as "fileInput"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/misc/unlock-pdf-forms"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 0
@@ -138,6 +141,7 @@ Feature: Miscellaneous PDF Operations API Validation
             | replaceAndInvertOption       | HIGH_CONTRAST_COLOR |
             | highContrastColorCombination | WHITE_TEXT_ON_BLACK |
         When I send the API request to the endpoint "/api/v1/misc/replace-invert-pdf"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 0
@@ -163,6 +167,7 @@ Feature: Miscellaneous PDF Operations API Validation
         Given I generate a PDF file as "fileInput"
         And the pdf contains 3 pages
         When I send the API request to the endpoint "/api/v1/misc/decompress-pdf"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 0
@@ -188,6 +193,7 @@ Feature: Miscellaneous PDF Operations API Validation
             | parameter              | value |
             | useFirstTextAsFallback | true  |
         When I send the API request to the endpoint "/api/v1/misc/auto-rename"
+        And this operation is run 5 times in parallel
         Then the response content type should be "application/pdf"
         And the response status code should be 200
         And the response file should have size greater than 0
@@ -212,6 +218,7 @@ Feature: Miscellaneous PDF Operations API Validation
         Given I generate a PDF file as "fileInput"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/misc/show-javascript"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response file should have size greater than 0
 
@@ -222,3 +229,28 @@ Feature: Miscellaneous PDF Operations API Validation
         And the pdf contains 5 pages with random text
         When I send the API request to the endpoint "/api/v1/misc/show-javascript"
         Then the response status code should be 200
+
+
+    @auto-rotate-pdf @positive
+    Scenario: auto-rotate-pdf returns a PDF with the page count preserved
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 3 pages with random text
+        When I send the API request to the endpoint "/api/v1/misc/auto-rotate-pdf"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "application/pdf"
+        And the response PDF should contain 3 pages
+
+
+    @add-comments @positive
+    Scenario: add-comments annotates a page without changing the page count
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 3 pages
+        And the request data includes
+            | parameter | value                                                                        |
+            | comments  | [{"pageNumber":1,"x":100,"y":100,"text":"review me","author":"qa"}]           |
+        When I send the API request to the endpoint "/api/v1/misc/add-comments"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "application/pdf"
+        And the response PDF should contain 3 pages
diff --git a/testing/cucumber/features/security_new.feature b/testing/cucumber/features/security_new.feature
index 7058cf2fdd..13763e302f 100644
--- a/testing/cucumber/features/security_new.feature
+++ b/testing/cucumber/features/security_new.feature
@@ -14,6 +14,7 @@ Feature: Security API Validation
             | removeLinks          | true  |
             | removeFonts          | false |
         When I send the API request to the endpoint "/api/v1/security/sanitize-pdf"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -54,6 +55,7 @@ Feature: Security API Validation
             | wholeWordSearch| true         |
             | convertPDFToImage | false     |
         When I send the API request to the endpoint "/api/v1/security/auto-redact"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -96,6 +98,7 @@ Feature: Security API Validation
             | pageNumbers        | 2,4     |
             | pageRedactionColor | #000000 |
         When I send the API request to the endpoint "/api/v1/security/redact"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -130,6 +133,7 @@ Feature: Security API Validation
     Scenario: Verify PDF-A compliance
         Given I use an example file at "exampleFiles/pdfa1.pdf" as parameter "fileInput"
         When I send the API request to the endpoint "/api/v1/security/verify-pdf"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/json"
         And the response file should have size greater than 2
@@ -148,6 +152,7 @@ Feature: Security API Validation
         Given I generate a PDF file as "fileInput"
         And the pdf contains 2 pages
         When I send the API request to the endpoint "/api/v1/security/remove-cert-sign"
+        And this operation is run 5 times in parallel
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
@@ -161,3 +166,35 @@ Feature: Security API Validation
         Then the response status code should be 200
         And the response content type should be "application/pdf"
         And the response file should have size greater than 0
+
+
+    @validate-signature @positive
+    Scenario: validate-signature reports no signatures on an unsigned PDF
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 3 pages
+        When I send the API request to the endpoint "/api/v1/security/validate-signature"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response JSON should be a list
+
+
+    @redact-execute @positive
+    Scenario: redact-execute removes the targeted text
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 3 pages
+        And the pdf pages all contain the text "Hello world"
+        And the request data includes
+            | parameter  | value |
+            | textValues | Hello |
+        When I send the API request to the endpoint "/api/v1/security/redact-execute"
+        And this operation is run 5 times in parallel
+        Then the response status code should be 200
+        And the response content type should be "application/pdf"
+
+
+    @redact-execute @negative
+    Scenario: redact-execute without any targets returns 400
+        Given I generate a PDF file as "fileInput"
+        And the pdf contains 2 pages
+        When I send the API request to the endpoint "/api/v1/security/redact-execute"
+        Then the response status code should be 400
diff --git a/testing/cucumber/features/steps/job_step_definitions.py b/testing/cucumber/features/steps/job_step_definitions.py
new file mode 100644
index 0000000000..44c695b7a4
--- /dev/null
+++ b/testing/cucumber/features/steps/job_step_definitions.py
@@ -0,0 +1,171 @@
+"""Steps for the async job API. DELETE is a cancel, so it 400s once the job finishes."""
+import time
+
+import requests
+from behave import then, when
+from job_support import API_HEADERS, BASE_URL, trigger_cleanup
+
+POLL_TIMEOUT_SECONDS = 60
+
+
+@when("I store the job id from the response")
+def step_store_job_id(context):
+    payload = context.response.json()
+    context.job_id = payload.get("jobId")
+    assert context.job_id, f"No jobId in async submit response: {payload}"
+
+
+@when("I wait for the job to complete")
+def step_wait_for_job(context):
+    deadline = time.time() + POLL_TIMEOUT_SECONDS
+    while time.time() < deadline:
+        response = requests.get(
+            f"{BASE_URL}/api/v1/general/job/{context.job_id}",
+            headers=API_HEADERS, timeout=30,
+        )
+        assert response.status_code == 200, (
+            f"Job status returned {response.status_code}: {response.text}"
+        )
+        context.response = response
+        payload = response.json()
+        if payload.get("complete"):
+            context.job_status = payload
+            return
+        time.sleep(0.2)
+    raise AssertionError(
+        f"Job {context.job_id} did not complete within {POLL_TIMEOUT_SECONDS}s"
+    )
+
+
+@when("I request the job result")
+def step_request_job_result(context):
+    context.response = requests.get(
+        f"{BASE_URL}/api/v1/general/job/{context.job_id}/result",
+        headers=API_HEADERS, timeout=60,
+    )
+
+
+@when("I request the job result file list")
+def step_request_job_result_files(context):
+    context.response = requests.get(
+        f"{BASE_URL}/api/v1/general/job/{context.job_id}/result/files",
+        headers=API_HEADERS, timeout=60,
+    )
+    files = context.response.json().get("files") or []
+    context.job_files = files
+    if files:
+        context.job_file_id = files[0].get("fileId")
+
+
+@when("I download the first job result file")
+def step_download_job_file(context):
+    assert getattr(context, "job_file_id", None), "No fileId captured from the result file list"
+    context.response = requests.get(
+        f"{BASE_URL}/api/v1/general/files/{context.job_file_id}",
+        headers=API_HEADERS, timeout=60,
+    )
+
+
+@when("I request the first job result file metadata")
+def step_job_file_metadata(context):
+    assert getattr(context, "job_file_id", None), "No fileId captured from the result file list"
+    context.response = requests.get(
+        f"{BASE_URL}/api/v1/general/files/{context.job_file_id}/metadata",
+        headers=API_HEADERS, timeout=60,
+    )
+
+
+@when("I cancel the job")
+def step_cancel_job(context):
+    context.response = requests.delete(
+        f"{BASE_URL}/api/v1/general/job/{context.job_id}",
+        headers=API_HEADERS, timeout=30,
+    )
+
+
+@then("the job result file list should contain at least {count:d} file(s)")
+def step_check_job_file_count(context, count):
+    files = context.response.json().get("files") or []
+    assert len(files) >= count, f"Expected at least {count} result file(s), got {len(files)}"
+
+
+@then("the job should be reported complete")
+def step_check_job_complete(context):
+    payload = context.response.json()
+    assert payload.get("complete") is True, f"Job not complete: {payload}"
+    assert not payload.get("error"), f"Job reported an error: {payload.get('error')}"
+
+
+# --- Cleanup: the async job files must actually go away, not just age out ---
+
+
+@when("I trigger the async job cleanup")
+def step_trigger_cleanup(context):
+    context.response = trigger_cleanup()
+    try:
+        context.cleanup_summary = context.response.json()
+    except ValueError:
+        context.cleanup_summary = {}
+
+
+@then("the cleanup should report at least {count:d} job(s) removed")
+def step_check_cleanup_jobs(context, count):
+    removed = context.cleanup_summary.get("jobsRemoved")
+    assert removed is not None, f"No jobsRemoved in cleanup response: {context.cleanup_summary}"
+    assert removed >= count, f"Expected at least {count} job(s) removed, got {removed}"
+
+
+@then("the cleanup should report at least {count:d} file(s) deleted")
+def step_check_cleanup_files(context, count):
+    deleted = context.cleanup_summary.get("filesDeleted")
+    assert deleted is not None, f"No filesDeleted in cleanup response: {context.cleanup_summary}"
+    assert deleted >= count, f"Expected at least {count} file(s) deleted, got {deleted}"
+
+
+@then("the cleanup should report nothing left to remove")
+def step_check_cleanup_idempotent(context):
+    removed = context.cleanup_summary.get("jobsRemoved")
+    deleted = context.cleanup_summary.get("filesDeleted")
+    assert removed == 0 and deleted == 0, (
+        "A repeat cleanup still found work to do, so the first pass did not fully clean up: "
+        f"{context.cleanup_summary}"
+    )
+
+
+@then("the job should no longer exist")
+def step_check_job_gone(context):
+    response = requests.get(
+        f"{BASE_URL}/api/v1/general/job/{context.job_id}",
+        headers=API_HEADERS, timeout=30,
+    )
+    assert response.status_code == 404, (
+        f"Job {context.job_id} still exists after cleanup: "
+        f"{response.status_code} {response.text[:200]}"
+    )
+
+
+@then("the job result file should no longer be downloadable")
+def step_check_job_file_gone(context):
+    assert getattr(context, "job_file_id", None), "No fileId captured from the result file list"
+    response = requests.get(
+        f"{BASE_URL}/api/v1/general/files/{context.job_file_id}",
+        headers=API_HEADERS, timeout=30,
+    )
+    assert response.status_code == 404, (
+        f"File {context.job_file_id} still downloadable after cleanup: "
+        f"{response.status_code} {response.text[:200]}"
+    )
+
+
+@then("the job result file should still be downloadable")
+def step_check_job_file_still_there(context):
+    assert getattr(context, "job_file_id", None), "No fileId captured from the result file list"
+    response = requests.get(
+        f"{BASE_URL}/api/v1/general/files/{context.job_file_id}",
+        headers=API_HEADERS, timeout=60,
+    )
+    assert response.status_code == 200, (
+        f"File {context.job_file_id} was not retrievable a second time: "
+        f"{response.status_code} {response.text[:200]}"
+    )
+    assert len(response.content) > 0, "Second download returned an empty body"
diff --git a/testing/cucumber/features/steps/job_support.py b/testing/cucumber/features/steps/job_support.py
new file mode 100644
index 0000000000..027bdcb9eb
--- /dev/null
+++ b/testing/cucumber/features/steps/job_support.py
@@ -0,0 +1,22 @@
+"""Shared helpers for the async job API.
+
+Support module, not a step module: behave execs everything under features/steps as
+step definitions, so anything environment.py needs to import has to live apart from
+the @when/@then decorators or they would register twice.
+"""
+import requests
+
+BASE_URL = "http://localhost:8080"
+API_HEADERS = {"X-API-KEY": "123456789"}
+CLEANUP_URL = f"{BASE_URL}/api/v1/general/jobs/cleanup"
+
+
+def trigger_cleanup():
+    """Force-expire finished jobs so their stored files are released now.
+
+    An async submit persists a copy of the upload plus its results and holds them for
+    the job retention window (30 minutes by default), which far outlasts a test run.
+    Calling this keeps the post-run temp-file check strict: anything it still reports
+    afterwards is a genuine leak rather than a file that simply had not aged out.
+    """
+    return requests.post(CLEANUP_URL, headers=API_HEADERS, timeout=60)
diff --git a/testing/cucumber/features/steps/parallel_step_definitions.py b/testing/cucumber/features/steps/parallel_step_definitions.py
new file mode 100644
index 0000000000..d832005fba
--- /dev/null
+++ b/testing/cucumber/features/steps/parallel_step_definitions.py
@@ -0,0 +1,47 @@
+"""Concurrency steps, usable either before the request or after it."""
+
+from behave import given, then, when
+
+import parallel_support
+
+
+def _set_repeat(context, count, decoy=False):
+    context.parallel_decoy = decoy
+    if count < 2:
+        context.parallel_repeat = 1
+        return
+    context.parallel_repeat = count
+
+    # An asked-for level higher than one already run wins.
+    if count > getattr(context, "parallel_ran_at", 0):
+        context.parallel_validated = False
+    if getattr(context, "parallel_validated", False):
+        return
+
+    # Placed after the request: replay whichever request was just sent.
+    pending = getattr(context, "parallel_request", None)
+    if pending is not None:
+        url, spec, headers, label = pending
+        parallel_support.validate(context, url, spec, headers, context.response, label)
+        return
+
+    pending_get = getattr(context, "parallel_get", None)
+    if pending_get is not None:
+        url, params, headers, label = pending_get
+        parallel_support.validate_get(context, url, params, headers, context.response, label)
+
+
+@given("this operation is run {count:d} times in parallel")
+@when("this operation is run {count:d} times in parallel")
+@then("this operation is run {count:d} times in parallel")
+def step_operation_run_in_parallel(context, count):
+    _set_repeat(context, count)
+
+
+# Decoy traffic is an equal number of concurrent requests carrying different page
+# text, so a response that came from the wrong request becomes visible.
+@given("this operation is run {count:d} times in parallel against decoy traffic")
+@when("this operation is run {count:d} times in parallel against decoy traffic")
+@then("this operation is run {count:d} times in parallel against decoy traffic")
+def step_operation_run_in_parallel_with_decoy(context, count):
+    _set_repeat(context, count, decoy=True)
diff --git a/testing/cucumber/features/steps/parallel_support.py b/testing/cucumber/features/steps/parallel_support.py
new file mode 100644
index 0000000000..d84d8354de
--- /dev/null
+++ b/testing/cucumber/features/steps/parallel_support.py
@@ -0,0 +1,478 @@
+"""Re-issues a request concurrently and asserts every response matches the baseline."""
+
+import io
+import json as json_module
+import os
+import re
+import sys
+import zipfile
+from concurrent.futures import ThreadPoolExecutor
+from hashlib import sha256
+
+import requests
+from pypdf import PdfReader
+
+_UUID_RE = re.compile(r"[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}")
+_LONG_NUM_RE = re.compile(r"\d{10,}")
+_DATE_RE = re.compile(r"\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?Z?")
+_VOLATILE_KEY_RE = re.compile(
+    r"^(id|uuid|.*Id|.*_id|.*[Tt]ime|.*[Dd]ate|timestamp|created.*|modified.*|"
+    r"updated.*|expires.*|token|traceId|requestId|duration.*|elapsed.*)$"
+)
+
+# Only hash text for reasonably sized documents so the check stays cheap.
+_MAX_TEXT_PAGES = 25
+
+# Sequential samples taken to separate inherent nondeterminism from a concurrency bug.
+NOISE_PROBE_SAMPLES = 3
+
+# Response size is allowed to drift this far before it counts as a difference.
+SIZE_TOLERANCE = 0.05
+
+# Collected per-scenario results, printed as a summary in after_all.
+VALIDATIONS = []
+
+
+# A spec replaces open file handles with bytes so it can be replayed from many threads.
+
+
+def materialize(spec):
+    """Turn a captured spec into a fresh `files=` list for one request."""
+    parts = []
+    for key, filename, payload, mime in spec:
+        if filename is None:
+            parts.append((key, (None, payload) if mime is None else (None, payload, mime)))
+        else:
+            parts.append((key, (filename, io.BytesIO(payload), mime)))
+    return parts
+
+
+def send(url, spec, headers, timeout=300):
+    return requests.post(url, files=materialize(spec), headers=headers, timeout=timeout)
+
+
+def _normalize_name(name):
+    name = _UUID_RE.sub("<uuid>", name)
+    return _LONG_NUM_RE.sub("<num>", name)
+
+
+def _strip_volatile(value):
+    """Drop keys whose values legitimately differ between two identical requests."""
+    if isinstance(value, dict):
+        return {
+            k: _strip_volatile(v)
+            for k, v in sorted(value.items())
+            if not _VOLATILE_KEY_RE.match(k)
+        }
+    if isinstance(value, list):
+        return [_strip_volatile(v) for v in value]
+    if isinstance(value, str):
+        return _normalize_name(value)
+    return value
+
+
+def _pdf_fingerprint(body, prefix=""):
+    parts = {}
+    try:
+        reader = PdfReader(io.BytesIO(body))
+    except Exception as exc:
+        parts[prefix + "pdf"] = f"unreadable: {type(exc).__name__}"
+        return parts
+    parts[prefix + "encrypted"] = reader.is_encrypted
+    if reader.is_encrypted:
+        return parts
+    try:
+        pages = reader.pages
+        parts[prefix + "pages"] = len(pages)
+    except Exception as exc:
+        parts[prefix + "pdf"] = f"unreadable pages: {type(exc).__name__}"
+        return parts
+    if len(pages) <= _MAX_TEXT_PAGES:
+        try:
+            text = "\n".join((page.extract_text() or "") for page in pages)
+            parts[prefix + "text_sha"] = sha256(text.encode("utf-8")).hexdigest()[:16]
+        except Exception:
+            pass
+    return parts
+
+
+def _entry_sha(entry):
+    """Hash an archive entry, normalizing the ids and timestamps EPUB/ODF restamp each run."""
+    try:
+        text = entry.decode("utf-8")
+        if "\x00" not in text:
+            entry = _DATE_RE.sub("<date>", _normalize_name(text)).encode("utf-8")
+    except UnicodeDecodeError:
+        pass
+    return sha256(entry).hexdigest()[:16]
+
+
+def _zip_fingerprint(body):
+    parts = {}
+    try:
+        with zipfile.ZipFile(io.BytesIO(body)) as archive:
+            names = sorted(_normalize_name(n) for n in archive.namelist())
+            parts["zip_entries"] = len(names)
+            parts["zip_names"] = names
+            for index, name in enumerate(sorted(archive.namelist())):
+                entry = archive.read(name)
+                if entry[:5] == b"%PDF-":
+                    parts.update(_pdf_fingerprint(entry, prefix=f"zip[{index}]."))
+                else:
+                    parts[f"zip[{index}].sha"] = _entry_sha(entry)
+    except Exception as exc:
+        parts["zip"] = f"unreadable: {type(exc).__name__}"
+    return parts
+
+
+def fingerprint(response):
+    """Structural signature of a response, ignoring benign per-request variance."""
+    body = response.content
+    content_type = (response.headers.get("Content-Type") or "").split(";")[0].strip()
+    parts = {"status": response.status_code, "content_type": content_type, "size": len(body)}
+
+
+    if "json" in content_type:
+        try:
+            parts["json"] = _strip_volatile(json_module.loads(body.decode("utf-8")))
+        except Exception:
+            parts["body_sha"] = sha256(body).hexdigest()[:16]
+    elif body[:5] == b"%PDF-":
+        parts.update(_pdf_fingerprint(body))
+    elif body[:2] == b"PK":
+        parts.update(_zip_fingerprint(body))
+    elif content_type.startswith("text/") or response.status_code >= 400:
+        try:
+            parts["text"] = _normalize_name(body.decode("utf-8", "replace"))[:2000]
+        except Exception:
+            parts["body_sha"] = sha256(body).hexdigest()[:16]
+    else:
+        parts["body_sha"] = sha256(body).hexdigest()[:16]
+    return parts
+
+
+def differing_keys(baseline, other):
+    return {
+        key
+        for key in set(baseline) | set(other)
+        if key != "size" and baseline.get(key) != other.get(key)
+    }
+
+
+def size_differs(baseline, other):
+    base_size, other_size = baseline.get("size", 0), other.get("size", 0)
+    return abs(other_size - base_size) > max(64, base_size * SIZE_TOLERANCE)
+
+
+def compare(baseline, other, ignore=frozenset(), ignore_size=False):
+    """Return a list of human-readable differences between two fingerprints."""
+    diffs = []
+    for key in sorted(differing_keys(baseline, other) - set(ignore)):
+        diffs.append(
+            f"{key}: baseline={_short(baseline.get(key))} parallel={_short(other.get(key))}"
+        )
+    if not ignore_size and size_differs(baseline, other):
+        diffs.append(
+            f"size: baseline={baseline.get('size', 0)} parallel={other.get('size', 0)} "
+            f"(differs by more than {SIZE_TOLERANCE:.0%})"
+        )
+    return diffs
+
+
+def _short(value):
+    text = repr(value)
+    return text if len(text) <= 160 else text[:157] + "..."
+
+
+def build_decoy_spec(spec):
+    """Clone a spec with each PDF stamped with unique text, or None if not possible.
+
+    Structure is preserved so parameters stay valid; only the text differs, which
+    is what makes bleed visible.
+    """
+    try:
+        from pypdf import PdfWriter
+        from reportlab.pdfgen import canvas
+    except ImportError:
+        return None
+
+    decoy = []
+    stamped_any = False
+    for key, filename, payload, mime in spec:
+        if filename is None or not isinstance(payload, bytes) or payload[:5] != b"%PDF-":
+            decoy.append((key, filename, payload, mime))
+            continue
+        try:
+            reader = PdfReader(io.BytesIO(payload))
+            if reader.is_encrypted:
+                return None
+            writer = PdfWriter()
+            for index, page in enumerate(reader.pages):
+                box = page.mediabox
+                width, height = float(box.width), float(box.height)
+                overlay_buffer = io.BytesIO()
+                overlay_canvas = canvas.Canvas(overlay_buffer, pagesize=(width, height))
+                overlay_canvas.drawString(
+                    20, max(20.0, height - 20), f"DECOY-MARKER-{index}-do-not-mix"
+                )
+                overlay_canvas.showPage()
+                overlay_canvas.save()
+                overlay_buffer.seek(0)
+                page.merge_page(PdfReader(overlay_buffer).pages[0])
+                writer.add_page(page)
+            out = io.BytesIO()
+            writer.write(out)
+            decoy.append((key, filename, out.getvalue(), mime))
+            stamped_any = True
+        except Exception:
+            return None
+    return decoy if stamped_any else None
+
+
+def _run_concurrently(url, specs, headers, timeout):
+    """Fire every spec at once and return (response, error) in submission order."""
+    results = [None] * len(specs)
+
+    def _worker(index):
+        try:
+            results[index] = (send(url, specs[index], headers, timeout=timeout), None)
+        except Exception as exc:
+            results[index] = (None, exc)
+
+    with ThreadPoolExecutor(max_workers=len(specs)) as pool:
+        list(pool.map(_worker, range(len(specs))))
+    return results
+
+
+def validate(context, url, spec, headers, baseline, label, timeout=300):
+    """Re-issue the request concurrently; no-op unless the repeat count is above 1."""
+    repeat = getattr(context, "parallel_repeat", 1)
+    if repeat < 2 or getattr(context, "parallel_validated", False):
+        return
+    context.parallel_validated = True
+    context.parallel_ran_at = repeat
+
+    decoy_spec = build_decoy_spec(spec) if getattr(context, "parallel_decoy", False) else None
+    specs = [spec] * repeat + ([decoy_spec] * repeat if decoy_spec else [])
+    results = _run_concurrently(url, specs, headers, timeout)
+
+    main_results = results[:repeat]
+    decoy_results = results[repeat:]
+    baseline_fp = fingerprint(baseline)
+
+    noise, noisy_size = frozenset(), False
+    failures = _collect_failures(
+        main_results, decoy_results, baseline_fp, repeat, noise, noisy_size
+    )
+    if failures:
+        # Some endpoints are inherently nondeterministic (embedded ids, timestamps,
+        # deliberate randomness). Re-run sequentially to tell that apart from a real bug.
+        noise, noisy_size = _probe_noise(url, spec, headers, baseline_fp, timeout)
+        failures = _collect_failures(
+            main_results, decoy_results, baseline_fp, repeat, noise, noisy_size
+        )
+
+    VALIDATIONS.append(
+        {
+            "label": label,
+            "repeat": repeat,
+            "decoy": bool(decoy_spec),
+            "failed": bool(failures),
+            "noise": sorted(noise) + (["size"] if noisy_size else []),
+        }
+    )
+
+    if failures:
+        raise AssertionError(
+            f"Parallel consistency failed for {label} at concurrency {repeat}.\n"
+            f"Two sequential runs agreed on these fields, so the differences below are "
+            f"caused by running the same operation concurrently.\n"
+            f"Baseline fingerprint: {_short(baseline_fp)}\n  - " + "\n  - ".join(failures)
+        )
+
+
+def _collect_failures(main_results, decoy_results, baseline_fp, repeat, noise, noisy_size):
+    decoy_fp = _decoy_reference(decoy_results, baseline_fp, noise, noisy_size)
+    failures = []
+
+    for index, (response, error) in enumerate(main_results):
+        if error is not None:
+            failures.append(f"copy {index + 1}/{repeat} raised {type(error).__name__}: {error}")
+            continue
+        actual_fp = fingerprint(response)
+        diffs = compare(baseline_fp, actual_fp, noise, noisy_size)
+        if not diffs:
+            continue
+        if decoy_fp is not None and not compare(
+            decoy_fp, actual_fp, noise, noisy_size
+        ):
+            failures.append(
+                f"copy {index + 1}/{repeat} returned the CONCURRENT DECOY REQUEST'S response "
+                f"(cross-request bleed)"
+            )
+        else:
+            failures.append(f"copy {index + 1}/{repeat} diverged: " + "; ".join(diffs))
+
+    failures.extend(_check_decoys(decoy_results, repeat, noise, noisy_size))
+    return failures
+
+
+def _probe_noise(url, spec, headers, baseline_fp, timeout, samples=NOISE_PROBE_SAMPLES):
+    """Fields that already vary between uncontended runs, so they prove nothing.
+
+    Several samples: high-variance output can look stable across any single pair.
+    """
+    probes = []
+    for _ in range(samples):
+        try:
+            probes.append(fingerprint(send(url, spec, headers, timeout=timeout)))
+        except Exception:
+            break
+    return _noise_from_samples(baseline_fp, probes)
+
+
+def _noise_from_samples(baseline_fp, probes):
+    noise = set()
+    noisy_size = False
+    for index, probe in enumerate(probes):
+        for other in [baseline_fp] + probes[:index]:
+            noise |= differing_keys(other, probe)
+            noisy_size = noisy_size or size_differs(other, probe)
+    return frozenset(noise), noisy_size
+
+
+def validate_get(context, url, params, headers, baseline, label, timeout=60):
+    """Concurrency check for read-only GET endpoints."""
+    repeat = getattr(context, "parallel_repeat", 1)
+    if repeat < 2 or getattr(context, "parallel_validated", False):
+        return
+    context.parallel_validated = True
+    context.parallel_ran_at = repeat
+
+    results = [None] * repeat
+
+    def _worker(index):
+        try:
+            results[index] = (
+                requests.get(url, params=params, headers=headers, timeout=timeout),
+                None,
+            )
+        except Exception as exc:
+            results[index] = (None, exc)
+
+    with ThreadPoolExecutor(max_workers=repeat) as pool:
+        list(pool.map(_worker, range(repeat)))
+
+    baseline_fp = fingerprint(baseline)
+
+    def _failures(noise, noisy_size):
+        found = []
+        for index, (response, error) in enumerate(results):
+            if error is not None:
+                found.append(f"copy {index + 1}/{repeat} raised {type(error).__name__}: {error}")
+                continue
+            diffs = compare(
+                baseline_fp,
+                fingerprint(response),
+                    noise,
+                noisy_size,
+            )
+            if diffs:
+                found.append(f"copy {index + 1}/{repeat} diverged: " + "; ".join(diffs))
+        return found
+
+    noise, noisy_size = frozenset(), False
+    failures = _failures(noise, noisy_size)
+    if failures:
+        probes = []
+        for _ in range(NOISE_PROBE_SAMPLES):
+            try:
+                probes.append(
+                    fingerprint(
+                        requests.get(url, params=params, headers=headers, timeout=timeout)
+                    )
+                )
+            except Exception:
+                break
+        noise, noisy_size = _noise_from_samples(baseline_fp, probes)
+        failures = _failures(noise, noisy_size)
+
+    VALIDATIONS.append(
+        {
+            "label": label,
+            "repeat": repeat,
+            "decoy": False,
+            "failed": bool(failures),
+            "noise": sorted(noise) + (["size"] if noisy_size else []),
+        }
+    )
+    if failures:
+        raise AssertionError(
+            f"Parallel consistency failed for GET {label} at concurrency {repeat}.\n  - "
+            + "\n  - ".join(failures)
+        )
+
+
+def _decoy_reference(decoy_results, baseline_fp, noise, noisy_size):
+    """Fingerprint of the decoy response, or None when it is not distinguishable."""
+    live = [r for r, _e in decoy_results if r is not None]
+    if not live:
+        return None
+    decoy_fp = fingerprint(live[0])
+    # Some endpoints ignore page content, so the decoy cannot prove anything there.
+    if not compare(baseline_fp, decoy_fp, noise, noisy_size):
+        return None
+    return decoy_fp
+
+
+def _check_decoys(decoy_results, repeat, noise, noisy_size):
+    """Assert the decoy load stayed self-consistent while contending with the main copies."""
+    if not decoy_results:
+        return []
+    live = [(i, r) for i, (r, _e) in enumerate(decoy_results) if r is not None]
+    if not live:
+        return ["every decoy request failed to complete"]
+
+    failures = []
+    reference_fp = fingerprint(live[0][1])
+    for index, response in live[1:]:
+        diffs = compare(
+            reference_fp,
+            fingerprint(response),
+            noise,
+            noisy_size,
+        )
+        if diffs:
+            failures.append(f"decoy {index + 1}/{repeat} diverged: " + "; ".join(diffs))
+    return failures
+
+
+def print_summary():
+    if not VALIDATIONS:
+        return
+    total = len(VALIDATIONS)
+    failed = sum(1 for v in VALIDATIONS if v["failed"])
+    max_repeat = max(v["repeat"] for v in VALIDATIONS)
+    requests_sent = sum(v["repeat"] * (2 if v["decoy"] else 1) for v in VALIDATIONS)
+
+    lines = [
+        f"\n[PARALLEL] {total - failed}/{total} operations stayed consistent under "
+        f"concurrency (up to {max_repeat} at once, {requests_sent} concurrent requests sent)."
+    ]
+    noisy = {}
+    for entry in VALIDATIONS:
+        if entry["noise"]:
+            noisy.setdefault(entry["label"], set()).update(entry["noise"])
+    if noisy:
+        lines.append(
+            f"[PARALLEL] {len(noisy)} endpoint(s) produce nondeterministic output. Those "
+            f"fields were excluded only after confirming they also vary across "
+            f"{NOISE_PROBE_SAMPLES} sequential runs:"
+        )
+        for label, fields in sorted(noisy.items()):
+            lines.append(f"           {label} -> {', '.join(sorted(fields))}")
+
+    # behave's --junit reporter swallows after_all stdout, so bypass any capture.
+    stream = getattr(sys, "__stderr__", None) or sys.stderr
+    stream.write("\n".join(lines) + "\n")
+    stream.flush()
diff --git a/testing/cucumber/features/steps/step_definitions.py b/testing/cucumber/features/steps/step_definitions.py
index aa1d45cac0..5abefa049a 100644
--- a/testing/cucumber/features/steps/step_definitions.py
+++ b/testing/cucumber/features/steps/step_definitions.py
@@ -15,6 +15,8 @@ import zipfile
 import re
 from PIL import Image, ImageDraw
 
+import parallel_support
+
 API_HEADERS = {"X-API-KEY": "123456789"}
 
 #########
@@ -585,6 +587,8 @@ def step_send_get_request(context, endpoint):
     full_url = f"{base_url}{endpoint}"
     response = requests.get(full_url, headers=API_HEADERS, timeout=60)
     context.response = response
+    context.parallel_get = (full_url, None, API_HEADERS, endpoint)
+    parallel_support.validate_get(context, full_url, None, API_HEADERS, response, endpoint)
 
 
 @when('I send a GET request to "{endpoint}" with parameters')
@@ -594,17 +598,18 @@ def step_send_get_request_with_params(context, endpoint):
     full_url = f"{base_url}{endpoint}"
     response = requests.get(full_url, params=params, headers=API_HEADERS, timeout=60)
     context.response = response
+    context.parallel_get = (full_url, params, API_HEADERS, endpoint)
+    parallel_support.validate_get(context, full_url, params, API_HEADERS, response, endpoint)
 
 
-@when('I send the API request to the endpoint "{endpoint}"')
-def step_send_api_request(context, endpoint):
-    url = f"http://localhost:8080{endpoint}"
+def _build_request_spec(context):
+    """Capture the multipart payload as replayable bytes rather than file handles."""
     files = context.files if hasattr(context, "files") else {}
 
     if not hasattr(context, "request_data") or context.request_data is None:
         context.request_data = {}
 
-    form_data = []
+    spec = []
     for key, value in context.request_data.items():
         # Handle list parameters (like 'languages') - send multiple form fields
         # Split comma-separated values or treat single values as single-item lists
@@ -612,32 +617,50 @@ def step_send_api_request(context, endpoint):
             # Split by comma if present, otherwise treat as single value
             values = [v.strip() for v in value.split(",")] if "," in value else [value]
             for val in values:
-                form_data.append((key, (None, val)))
+                spec.append((key, None, val, None))
         else:
-            form_data.append((key, (None, value)))
+            spec.append((key, None, value, None))
+
+    def _read(file):
+        file.seek(0)
+        payload = file.read()
+        file.seek(0)
+        return payload
 
     for key, file in files.items():
         mime_type, _ = mimetypes.guess_type(file.name)
         mime_type = mime_type or "application/octet-stream"
         print(f"form_data {file.name} with {mime_type}")
-        form_data.append((key, (file.name, file, mime_type)))
+        spec.append((key, file.name, _read(file), mime_type))
 
     # Multi-file entries (duplicate keys for MultipartFile[] endpoints, e.g. merge-pdfs)
     for key, file in getattr(context, "multi_files", []):
         mime_type, _ = mimetypes.guess_type(file.name)
         mime_type = mime_type or "application/octet-stream"
         print(f"form_data (multi) {file.name} with {mime_type}")
-        form_data.append((key, (file.name, file, mime_type)))
+        spec.append((key, file.name, _read(file), mime_type))
 
     # JSON multipart parts for @RequestPart endpoints (e.g. /form/fill)
     for part_name, json_content in getattr(context, "json_parts", {}).items():
-        form_data.append((part_name, (None, json_content, "application/json")))
+        spec.append((part_name, None, json_content, "application/json"))
+
+    return spec
+
+
+@when('I send the API request to the endpoint "{endpoint}"')
+def step_send_api_request(context, endpoint):
+    url = f"http://localhost:8080{endpoint}"
+    spec = _build_request_spec(context)
 
     # Set timeout to 300 seconds (5 minutes) to prevent infinite hangs
     print(f"Sending POST request to {endpoint} with timeout=300s")
-    response = requests.post(url, files=form_data, headers=API_HEADERS, timeout=300)
+    response = parallel_support.send(url, spec, API_HEADERS, timeout=300)
     context.response = response
 
+    # Remembered so a later "run N times in parallel" step can replay this request.
+    context.parallel_request = (url, spec, API_HEADERS, endpoint)
+    parallel_support.validate(context, url, spec, API_HEADERS, response, endpoint)
+
 
 ########
 # THEN #
diff --git a/testing/cucumber/run-parallel.sh b/testing/cucumber/run-parallel.sh
new file mode 100644
index 0000000000..40d30b3c40
--- /dev/null
+++ b/testing/cucumber/run-parallel.sh
@@ -0,0 +1,143 @@
+#!/bin/bash
+# Run the behave suite as N concurrent shards against one server.
+# Usage: ./run-parallel.sh [SHARDS] [-- behave args]   Env: BASE_URL
+
+set -uo pipefail
+
+SHARDS="${1:-10}"
+if [[ "$SHARDS" =~ ^[0-9]+$ ]]; then
+    shift
+else
+    SHARDS=10
+fi
+[[ "${1:-}" == "--" ]] && shift
+
+BASE_URL="${BASE_URL:-http://localhost:8080}"
+CUCUMBER_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK_ROOT="$CUCUMBER_DIR/.parallel"
+REPORT_DIR="${PARALLEL_REPORT_DIR:-$WORK_ROOT/reports}"
+
+cd "$CUCUMBER_DIR" || exit 1
+
+if ! curl -sf --retry 30 --retry-delay 2 --retry-connrefused --retry-all-errors \
+    "$BASE_URL/api/v1/info/status" >/dev/null; then
+    echo "ERROR: no server responding at $BASE_URL"
+    exit 1
+fi
+
+mapfile -t ALL_FEATURES < <(
+    find features -name '*.feature' \
+        -not -path 'features/enterprise/*' \
+        -not -path 'features/multinode/*' | sort
+)
+
+if [ "${#ALL_FEATURES[@]}" -eq 0 ]; then
+    echo "ERROR: no feature files found under $CUCUMBER_DIR/features"
+    exit 1
+fi
+
+# user_management.feature changes the admin password mid-scenario, so a concurrent
+# shard logging in then gets a 401. Keep all admin-auth features in one shard.
+AUTH_RE='logged in as admin|I login with username|JWT authentication|stored JWT token'
+declare -a AUTH_FEATURES=() FEATURES=()
+for feature in "${ALL_FEATURES[@]}"; do
+    if grep -qE "$AUTH_RE" "$feature"; then
+        AUTH_FEATURES+=("$feature")
+    else
+        FEATURES+=("$feature")
+    fi
+done
+
+if [ "${#AUTH_FEATURES[@]}" -gt 0 ]; then
+    echo "Pinning ${#AUTH_FEATURES[@]} auth-coupled feature(s) to a single shard:"
+    printf '  %s\n' "${AUTH_FEATURES[@]##*/}"
+    SHARDS=$((SHARDS - 1))
+fi
+
+# The pin above can take SHARDS to 0 or below, which makes the shard loop run zero
+# times: every shardable feature is skipped and the run still reports success.
+[ "$SHARDS" -lt 0 ] && SHARDS=0
+[ "${#FEATURES[@]}" -gt 0 ] && [ "$SHARDS" -lt 1 ] && SHARDS=1
+
+if [ "$SHARDS" -gt "${#FEATURES[@]}" ]; then
+    echo "Only ${#FEATURES[@]} shardable feature files, reducing shards from $SHARDS"
+    SHARDS="${#FEATURES[@]}"
+fi
+
+rm -rf "$WORK_ROOT"
+mkdir -p "$WORK_ROOT" "$REPORT_DIR"
+
+TOTAL_SHARDS=$SHARDS
+[ "${#AUTH_FEATURES[@]}" -gt 0 ] && TOTAL_SHARDS=$((SHARDS + 1))
+echo "Running ${#ALL_FEATURES[@]} feature files across $TOTAL_SHARDS concurrent shards against $BASE_URL"
+
+declare -a PIDS=()
+
+start_shard() {
+    local shard=$1
+    shift
+    local SHARD_DIR="$WORK_ROOT/shard-$shard"
+    mkdir -p "$SHARD_DIR"
+    # Feature files reference exampleFiles/ and behave.ini relative to the CWD.
+    cp -r "$CUCUMBER_DIR/exampleFiles" "$SHARD_DIR/exampleFiles"
+    cp "$CUCUMBER_DIR/behave.ini" "$SHARD_DIR/behave.ini"
+
+    local assigned=("$@")
+    (
+        cd "$SHARD_DIR" || exit 1
+        uv run --project "$CUCUMBER_DIR/../../engine" --locked --group cucumber \
+            python -m behave "${assigned[@]}" \
+            --junit --junit-directory "$REPORT_DIR/shard-$shard" \
+            --no-capture -f plain "${BEHAVE_EXTRA[@]}" \
+            >"$REPORT_DIR/shard-$shard.log" 2>&1
+    ) &
+    PIDS+=($!)
+}
+
+declare -a BEHAVE_EXTRA=("$@")
+
+for ((shard = 0; shard < SHARDS; shard++)); do
+    assigned=()
+    for ((i = shard; i < ${#FEATURES[@]}; i += SHARDS)); do
+        assigned+=("$CUCUMBER_DIR/${FEATURES[$i]}")
+    done
+    start_shard "$shard" "${assigned[@]}"
+done
+
+if [ "${#AUTH_FEATURES[@]}" -gt 0 ]; then
+    assigned=()
+    for feature in "${AUTH_FEATURES[@]}"; do
+        assigned+=("$CUCUMBER_DIR/$feature")
+    done
+    start_shard "$SHARDS" "${assigned[@]}"
+fi
+
+FAILED=0
+for ((shard = 0; shard < TOTAL_SHARDS; shard++)); do
+    if wait "${PIDS[$shard]}"; then
+        echo "shard $shard PASSED"
+    else
+        echo "shard $shard FAILED"
+        FAILED=$((FAILED + 1))
+    fi
+done
+
+echo ""
+echo "=== Parallel shard summary ==="
+grep -h '^[0-9]* scenarios passed' "$REPORT_DIR"/shard-*.log 2>/dev/null || true
+grep -h '^\[PARALLEL\] [0-9]*/' "$REPORT_DIR"/shard-*.log 2>/dev/null || true
+
+if [ "$FAILED" -gt 0 ]; then
+    echo ""
+    echo "$FAILED of $TOTAL_SHARDS shards failed. Failing scenarios:"
+    sed -n '/^Failing scenarios:/,/^[0-9]* features/p' "$REPORT_DIR"/shard-*.log 2>/dev/null |
+        grep 'feature:' | sort -u
+    echo ""
+    echo "Parallel consistency failures:"
+    grep -h -A4 'Parallel consistency failed' "$REPORT_DIR"/shard-*.log 2>/dev/null | head -40
+    echo ""
+    echo "Full logs: $REPORT_DIR/shard-*.log"
+    exit 1
+fi
+
+echo "All $TOTAL_SHARDS shards passed."
diff --git a/testing/test.sh b/testing/test.sh
index 95c0c77edd..254d566763 100644
--- a/testing/test.sh
+++ b/testing/test.sh
@@ -391,6 +391,17 @@ capture_file_list() {
     gha_endgroup
 }
 
+# Tail of container logs shown when a leak is detected. The full log is captured as a
+# job artifact anyway, and dumping all of it here buried the actual finding.
+TEMP_FILE_LOG_TAIL=${TEMP_FILE_LOG_TAIL:-200}
+
+# Print the log context for a detected temp-file leak, bounded so the finding stays readable.
+print_temp_file_leak_logs() {
+    local container_name=$1
+    echo "Last $TEMP_FILE_LOG_TAIL lines of container logs (full log is in the uploaded artifacts):"
+    docker logs --tail "$TEMP_FILE_LOG_TAIL" "$container_name" 2>&1 || true
+}
+
 # Function to compare before and after file lists
 compare_file_lists() {
     local before_file=$1
@@ -417,8 +428,7 @@ compare_file_lists() {
             if [ -s "${diff_file}.tmp" ]; then
                 echo "WARNING: Temporary files found:"
                 cat "${diff_file}.tmp"
-                echo "Printing docker logs due to temporary file detection:"
-                docker logs "$container_name"  # Print logs when temp files are found
+                print_temp_file_leak_logs "$container_name"
                 gha_endgroup
                 return 1
             else
@@ -450,8 +460,11 @@ compare_file_lists() {
             if [ -s "${diff_file}.tmp" ]; then
                 echo "WARNING: Temporary files detected:"
                 cat "${diff_file}.tmp"
-                echo "Printing docker logs due to temporary file detection:"
-                docker logs "$container_name"  # Print logs when temp files are found
+                echo "These files were still present after the suite finished. Async job results"
+                echo "and their input copies live under the server's file store and are released"
+                echo "by the cleanup that features/environment.py runs in after_all - if they show"
+                echo "up here, that cleanup did not cover them."
+                print_temp_file_leak_logs "$container_name"
                 return 1
             fi
         fi