Add Pyrefly config and fix type errors

2026-09-03 13:20:08 +03:00 · 2026-05-14 15:09:04 +01:00
4138 changed files with 103545 additions and 406981 deletions
@@ -20,8 +20,8 @@ set -e
 # - To build the project, use:
 #     ./gradlew build
 #
-# - To run the lint/format/secret checks, use:
-#     task pre-commit
+# - For running pre-commit hooks (if configured), use:
+#     pre-commit run --all-files
 #
 # Make sure you are in the project root directory after this script executes.
 # =============================================================================
@@ -70,6 +70,6 @@ echo ""
 echo "  To build the project: "
 echo -e "\e[34m    gradle build\e[0m"
 echo ""
-echo "  To run the lint/format/secret checks:"
-echo -e "\e[34m    task pre-commit\e[0m"
+echo "  To run pre-commit hooks (if configured):"
+echo -e "\e[34m    pre-commit run --all-files -c .pre-commit-config.yaml\e[0m"
 echo "=================================================================="
@@ -26,17 +26,16 @@ version_builds/
 node_modules/
 **/node_modules/
 frontend/node_modules/
-frontend/editor/dist/
-frontend/dist-portal/
-frontend/editor/playwright-report/
+frontend/dist/
+frontend/playwright-report/
 .npm/
 .yarn/

 # Tauri/desktop builds
 src-tauri/target/
 src-tauri/dist/
-frontend/editor/src-tauri/target/
-frontend/editor/src-tauri/dist/
+frontend/src-tauri/target/
+frontend/src-tauri/dist/

 # IDE and editor
 .idea/
@@ -24,7 +24,7 @@ runs:
      id: generate-token
      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
      with:
-        client-id: ${{ inputs.app-id }}
+        app-id: ${{ inputs.app-id }}
        private-key: ${{ inputs.private-key }}
    - name: Configure Git
      run: |
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.14.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.14.0
+pkgver=2.11.0
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')
@@ -1,8 +1,6 @@
 build: &build
  - build.gradle
  - app/(common|core|proprietary)/build.gradle
-  - Taskfile.yml
-  - .taskfiles/backend.yml

 openapi: &openapi
  - *build
@@ -10,6 +8,7 @@ openapi: &openapi

 docker-base: &docker-base
  - docker/base/Dockerfile
+  - ".github/workflows/push-docker-base.yml"

 docker: &docker
  - docker/embedded/Dockerfile
@@ -40,11 +39,6 @@ project: &project
  - frontend/**
  - docker/**
  - scripts/RestartHelper.java
-  - Taskfile.yml
-  - .taskfiles/backend.yml
-  - .taskfiles/docker.yml
-  - scripts/db-migration/**
-  - .github/workflows/db-migration-test.yml

 frontend: &frontend
  - frontend/**
@@ -60,22 +54,17 @@ frontend: &frontend
  - scripts/summarize_type3_signatures.py
  - scripts/type3_to_cff.py
  - scripts/update_type3_library.py
-  - Taskfile.yml
-  - .taskfiles/frontend.yml
-  - .taskfiles/e2e.yml

 # Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
 # job on changes to any of these.
 tauri: &tauri
-  - frontend/editor/src-tauri/**
-  - frontend/editor/src/desktop/**
-  - frontend/editor/tsconfig.desktop.vite.json
+  - frontend/src-tauri/**
+  - frontend/src/desktop/**
+  - frontend/tsconfig.desktop.json
  - frontend/package.json
  - frontend/package-lock.json
-  - frontend/editor/vite.config.ts
+  - frontend/vite.config.ts
  - .github/workflows/tauri-build.yml
-  - Taskfile.yml
-  - .taskfiles/desktop.yml

 # Files that affect the AI engine (Python tool models, fixers, tests). Gate
 # the engine validation job on changes to engine sources or to the Java
@@ -84,14 +73,12 @@ engine: &engine
  - engine/**
  - app/(common|core|proprietary)/src/main/java/**
  - .github/workflows/ai-engine.yml
-  - Taskfile.yml
-  - .taskfiles/engine.yml

 licenses-frontend: &licenses-frontend
  - ".github/workflows/frontend-backend-licenses-update.yml"
  - "frontend/package.json"
  - "frontend/package-lock.json"
-  - "frontend/editor/scripts/generate-licenses.js"
+  - "frontend/scripts/generate-licenses.js"

 licenses-backend: &licenses-backend
  - ".github/workflows/frontend-backend-licenses-update.yml"
@@ -101,8 +88,8 @@ licenses-backend: &licenses-backend
 # Playwright job on changes to any of these on PRs.
 proprietary: &proprietary
  - app/proprietary/**
-  - frontend/editor/src/proprietary/**
-  - frontend/editor/src/core/tests/enterprise/**
+  - frontend/src/proprietary/**
+  - frontend/src/core/tests/enterprise/**
  - testing/compose/docker-compose-keycloak-oauth.yml
  - testing/compose/docker-compose-keycloak-saml.yml
  - testing/compose/keycloak-realm-oauth.json
@@ -114,4 +101,4 @@ proprietary: &proprietary
  - configs/settings.yml.template
  - build.gradle
  - app/proprietary/build.gradle
-  - .github/workflows/build-enterprise.yml
+  - .github/workflows/build-enterprise.yml
@@ -25,8 +25,6 @@ updates:
      - "/docker/frontend"
      - "/docker/base"
      - "/docker/engine"
-      - "/docker/unoserver"
-      - "/engine"
    schedule:
      interval: "weekly"
    cooldown:
@@ -128,9 +126,9 @@ updates:

  - package-ecosystem: cargo
    directories:
-      - /frontend/editor/src-tauri
-      - /frontend/editor/src-tauri/thumbnail-handler
-      - /frontend/editor/src-tauri/provisioner
+      - /frontend/src-tauri
+      - /frontend/src-tauri/thumbnail-handler
+      - /frontend/src-tauri/provisioner
    schedule:
      interval: "weekly"
    cooldown:
@@ -51,7 +51,7 @@ labels:

  - label: 'Translation'
    files:
-      - 'frontend/editor/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
+      - 'frontend/public/locales/[a-zA-Z]{2}-[a-zA-Z\-]{2,7}/translation.toml'
      - 'scripts/ignore_translation.toml'
      - 'scripts/remove_translation_keys.sh'
      - 'scripts/replace_translation_line.sh'
@@ -69,8 +69,8 @@ labels:

  - label: 'Tauri'
    files:
-      - 'frontend/editor/src-tauri/**'
-      - 'frontend/editor/src-tauri/.*'
+      - 'frontend/src-tauri/**'
+      - 'frontend/src-tauri/.*'

  - label: 'engine'
    files:
@@ -13,7 +13,7 @@ Usage:
 """

 # Sample for Windows:
-# python .github/scripts/check_language_toml.py --reference-file frontend/editor/public/locales/en-US/translation.toml --branch "" --files frontend/editor/public/locales/de-DE/translation.toml frontend/editor/public/locales/fr-FR/translation.toml
+# python .github/scripts/check_language_toml.py --reference-file frontend/public/locales/en-GB/translation.toml --branch "" --files frontend/public/locales/de-DE/translation.toml frontend/public/locales/fr-FR/translation.toml

 import argparse
 import glob
@@ -184,7 +184,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
    if len(file_list) == 1:
        file_arr = file_list[0].split()

-    base_dir = Path.cwd() / "frontend" / "editor" / "public" / "locales"
+    base_dir = Path.cwd() / "frontend" / "public" / "locales"

    for file_path in file_arr:
        file_path = Path(file_path)
@@ -211,7 +211,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
            )
            continue

-        if basename_current_file == basename_reference_file and locale_dir == "en-US":
+        if basename_current_file == basename_reference_file and locale_dir == "en-GB":
            continue

        if (
@@ -308,7 +308,7 @@ def check_for_differences(reference_file, file_list, branch, actor):
        report.append("## ❌ Overall Check Status: **_Failed_**")
        report.append("")
        report.append(
-            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-US/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/editor/public/locales/en-US/translation.toml)"
+            f"@{actor} please check your translation if it conforms to the standard. Follow the format of [en-GB/translation.toml](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/frontend/public/locales/en-GB/translation.toml)"
        )
    else:
        report.append("## ✅ Overall Check Status: **_Success_**")
@@ -372,7 +372,6 @@ if __name__ == "__main__":
                os.path.join(
                    os.getcwd(),
                    "frontend",
-                    "editor",
                    "public",
                    "locales",
                    "*",
@@ -0,0 +1 @@
+pre-commit
@@ -0,0 +1,121 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file='.github\scripts\requirements_pre_commit.txt' --strip-extras '.github\scripts\requirements_pre_commit.in'
+#
+cfgv==3.5.0 \
+    --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
+    --hash=sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132
+    # via pre-commit
+distlib==0.4.0 \
+    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
+    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
+    # via virtualenv
+filelock==3.29.0 \
+    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
+    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
+    # via
+    #   python-discovery
+    #   virtualenv
+identify==2.6.19 \
+    --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
+    --hash=sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842
+    # via pre-commit
+nodeenv==1.10.0 \
+    --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
+    --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
+    # via pre-commit
+platformdirs==4.9.6 \
+    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
+    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
+    # via
+    #   python-discovery
+    #   virtualenv
+pre-commit==4.6.0 \
+    --hash=sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9 \
+    --hash=sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b
+    # via -r .github/scripts/requirements_pre_commit.in
+python-discovery==1.2.2 \
+    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
+    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
+    # via virtualenv
+pyyaml==6.0.3 \
+    --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
+    --hash=sha256:0150219816b6a1fa26fb4699fb7daa9caf09eb1999f3b70fb6e786805e80375a \
+    --hash=sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3 \
+    --hash=sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956 \
+    --hash=sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6 \
+    --hash=sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c \
+    --hash=sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65 \
+    --hash=sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a \
+    --hash=sha256:1ebe39cb5fc479422b83de611d14e2c0d3bb2a18bbcb01f229ab3cfbd8fee7a0 \
+    --hash=sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b \
+    --hash=sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1 \
+    --hash=sha256:22ba7cfcad58ef3ecddc7ed1db3409af68d023b7f940da23c6c2a1890976eda6 \
+    --hash=sha256:27c0abcb4a5dac13684a37f76e701e054692a9b2d3064b70f5e4eb54810553d7 \
+    --hash=sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e \
+    --hash=sha256:2e71d11abed7344e42a8849600193d15b6def118602c4c176f748e4583246007 \
+    --hash=sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310 \
+    --hash=sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4 \
+    --hash=sha256:3c5677e12444c15717b902a5798264fa7909e41153cdf9ef7ad571b704a63dd9 \
+    --hash=sha256:3ff07ec89bae51176c0549bc4c63aa6202991da2d9a6129d7aef7f1407d3f295 \
+    --hash=sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea \
+    --hash=sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0 \
+    --hash=sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e \
+    --hash=sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac \
+    --hash=sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9 \
+    --hash=sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7 \
+    --hash=sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35 \
+    --hash=sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb \
+    --hash=sha256:5cf4e27da7e3fbed4d6c3d8e797387aaad68102272f8f9752883bc32d61cb87b \
+    --hash=sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69 \
+    --hash=sha256:5ed875a24292240029e4483f9d4a4b8a1ae08843b9c54f43fcc11e404532a8a5 \
+    --hash=sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b \
+    --hash=sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c \
+    --hash=sha256:6344df0d5755a2c9a276d4473ae6b90647e216ab4757f8426893b5dd2ac3f369 \
+    --hash=sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd \
+    --hash=sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824 \
+    --hash=sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198 \
+    --hash=sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065 \
+    --hash=sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c \
+    --hash=sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c \
+    --hash=sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764 \
+    --hash=sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196 \
+    --hash=sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b \
+    --hash=sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00 \
+    --hash=sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac \
+    --hash=sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8 \
+    --hash=sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e \
+    --hash=sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28 \
+    --hash=sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3 \
+    --hash=sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5 \
+    --hash=sha256:9c57bb8c96f6d1808c030b1687b9b5fb476abaa47f0db9c0101f5e9f394e97f4 \
+    --hash=sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b \
+    --hash=sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf \
+    --hash=sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5 \
+    --hash=sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702 \
+    --hash=sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8 \
+    --hash=sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788 \
+    --hash=sha256:b865addae83924361678b652338317d1bd7e79b1f4596f96b96c77a5a34b34da \
+    --hash=sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d \
+    --hash=sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc \
+    --hash=sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c \
+    --hash=sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba \
+    --hash=sha256:c2514fceb77bc5e7a2f7adfaa1feb2fb311607c9cb518dbc378688ec73d8292f \
+    --hash=sha256:c3355370a2c156cffb25e876646f149d5d68f5e0a3ce86a5084dd0b64a994917 \
+    --hash=sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5 \
+    --hash=sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26 \
+    --hash=sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f \
+    --hash=sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b \
+    --hash=sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be \
+    --hash=sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c \
+    --hash=sha256:efd7b85f94a6f21e4932043973a7ba2613b059c4a000551892ac9f1d11f5baf3 \
+    --hash=sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6 \
+    --hash=sha256:fa160448684b4e94d80416c0fa4aac48967a969efe22931448d853ada8baf926 \
+    --hash=sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0
+    # via pre-commit
+virtualenv==21.2.4 \
+    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
+    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
+    # via pre-commit
@@ -1,83 +0,0 @@
-#!/usr/bin/env python3
-"""Verify Tauri updater .sig files against plugins.updater.pubkey in tauri.conf.json.
-
-Usage: verify-updater-signatures.py <dir-to-scan> [tauri.conf.json]
-"""
-
-import binascii
-import sys
-import json
-import base64
-import hashlib
-from pathlib import Path
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-from cryptography.exceptions import InvalidSignature
-
-ART_ROOT = Path(sys.argv[1])
-CONF = Path(
-    sys.argv[2] if len(sys.argv) > 2 else "frontend/editor/src-tauri/tauri.conf.json"
-)
-
-
-def load_pubkey():
-    # tauri pubkey = base64 of a minisign .pub file; last line is base64 of
-    # [2 algo][8 key-id][32 ed25519 public key].
-    raw = json.loads(CONF.read_text())["plugins"]["updater"]["pubkey"]
-    blob = base64.b64decode(base64.b64decode(raw).decode().splitlines()[-1])
-    return blob[2:10], Ed25519PublicKey.from_public_bytes(blob[10:])
-
-
-def hash_file(path: Path) -> bytes:
-    h = hashlib.blake2b(digest_size=64)
-    with path.open("rb") as f:
-        for chunk in iter(lambda: f.read(1 << 16), b""):
-            h.update(chunk)
-    return h.digest()
-
-
-def verify(artifact: Path, sig_file: Path, keyid_pub, pub) -> str:
-    # tauri .sig = base64 of a minisign signature file (4 lines).
-    try:
-        lines = base64.b64decode(sig_file.read_text()).decode().splitlines()
-        sig_blob = base64.b64decode(lines[1])
-    except (binascii.Error, IndexError, UnicodeDecodeError) as e:
-        return f"FAIL malformed sig ({type(e).__name__})"
-    algo, keyid, sig = sig_blob[:2], sig_blob[2:10], sig_blob[10:74]
-    if keyid != keyid_pub:
-        return f"FAIL key-id mismatch (sig {keyid.hex()} vs pub {keyid_pub.hex()})"
-    # 'ED' = prehashed (BLAKE2b-512), 'Ed' = legacy (raw message).
-    msg = hash_file(artifact) if algo == b"ED" else artifact.read_bytes()
-    try:
-        pub.verify(sig, msg)
-    except InvalidSignature:
-        return f"FAIL signature invalid (algo={algo.decode()})"
-    # Global signature covers sig + trusted_comment.
-    gc = "global-sig FAIL"
-    try:
-        tc = lines[2].split("trusted comment: ", 1)[1]
-        pub.verify(base64.b64decode(lines[3]), sig + tc.encode())
-        gc = "global-sig OK"
-    except (InvalidSignature, IndexError, binascii.Error):
-        pass
-    return f"VALID (algo={algo.decode()}, keyid={keyid.hex()}, {gc})"
-
-
-keyid_pub, pub = load_pubkey()
-print(f"updater pubkey keyid={keyid_pub.hex()}\n")
-sigs = sorted(ART_ROOT.rglob("*.sig"))
-if not sigs:
-    print(f"WARN: no .sig files under {ART_ROOT} - nothing to verify")
-    sys.exit(0)
-bad = 0
-for sig_file in sigs:
-    artifact = sig_file.with_suffix("")
-    if not artifact.exists():
-        print(f"  ? {sig_file.name}: artifact missing")
-        bad += 1
-        continue
-    res = verify(artifact, sig_file, keyid_pub, pub)
-    print(f"  {artifact.name}: {res}")
-    if not res.startswith("VALID") or "global-sig FAIL" in res:
-        bad += 1
-print(f"\n{'ALL SIGNATURES VALID' if bad == 0 else f'{bad} SIGNATURE(S) FAILED'}")
-sys.exit(1 if bad else 0)
@@ -23,13 +23,9 @@ permissions:
  pull-requests: write

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  check-pr:
    if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    outputs:
      should_deploy: ${{ steps.decide.outputs.should_deploy }}
      is_fork: ${{ steps.resolve.outputs.is_fork }}
@@ -39,7 +35,7 @@ jobs:
      pr_ref: ${{ steps.resolve.outputs.ref }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -101,8 +97,8 @@ jobs:
          echo "allow_fork=${allow_fork:-false}" >> $GITHUB_OUTPUT

  deploy-v2-pr:
-    needs: [pick, check-pr]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: check-pr
+    runs-on: ubuntu-latest
    if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
    # Concurrency control - only one deployment per PR at a time
    concurrency:
@@ -112,14 +108,10 @@ jobs:
      contents: read
      issues: write
      pull-requests: write
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -187,12 +179,7 @@ jobs:
          token: ${{ secrets.GITHUB_TOKEN }}
          fetch-depth: 0 # Fetch full history for commit hash detection

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get version number
@@ -237,20 +224,8 @@ jobs:
            echo "Image needs to be built"
          fi

-      - name: Build and push V2 image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-image.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push V2 image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-image.outputs.exists == 'false'
+      - name: Build and push V2 image
+        if: steps.check-image.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -287,13 +262,12 @@ jobs:
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/data:/usr/share/tessdata:rw
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/config:/configs:rw
                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/logs:/logs:rw
-                - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/storage:/storage:rw
              environment:
                DISABLE_ADDITIONAL_FEATURES: "false"
                SECURITY_ENABLELOGIN: "true"
                SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
                SECURITY_INITIALLOGIN_PASSWORD: "${{ secrets.TEST_LOGIN_PASSWORD }}"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF V2 PR#${{ needs.check-pr.outputs.pr_number }}"
                UI_HOMEDESCRIPTION: "V2 PR#${{ needs.check-pr.outputs.pr_number }} - Embedded Architecture"
                UI_APPNAMENAVBAR: "V2 PR#${{ needs.check-pr.outputs.pr_number }}"
@@ -310,7 +284,7 @@ jobs:

          ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -T ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << ENDSSH
            # Create V2 PR-specific directories
-            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs,storage}
+            mkdir -p /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/{data,config,logs}

            # Move docker-compose file to correct location
            mv /tmp/docker-compose-v2.yml /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/docker-compose.yml
@@ -377,8 +351,7 @@ jobs:

  cleanup-v2-deployment:
    if: github.event.action == 'closed'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
@@ -386,7 +359,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -34,12 +34,8 @@ permissions:
  pull-requests: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  check-comment:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    permissions:
      issues: write
    if: |
@@ -74,7 +70,7 @@ jobs:
      enable_prototypes: ${{ steps.check-prototypes-flag.outputs.enable_prototypes }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -179,19 +175,15 @@ jobs:
            }

  deploy-pr:
-    needs: [pick, check-comment]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: check-comment
+    runs-on: ubuntu-latest
    permissions:
      issues: write
      pull-requests: write
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -222,10 +214,10 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Run Gradle Command
        run: |
          if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then
@@ -240,12 +232,7 @@ jobs:
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          STIRLING_PDF_DESKTOP_UI: false

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Login to Docker Hub
@@ -254,22 +241,7 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push PR-specific image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: |
-            VERSION_TAG=alpha
-            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
-          platforms: linux/amd64
-
-      - name: Build and push PR-specific image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build and push PR-specific image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -283,19 +255,8 @@ jobs:
            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
          platforms: linux/amd64

-      - name: Build and push engine image (Depot)
-        if: env.USE_DEPOT == 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: ./engine
-          file: ./engine/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
-          platforms: linux/amd64
-
-      - name: Build and push engine image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
+      - name: Build and push engine image
+        if: needs.check-comment.outputs.enable_prototypes == 'true'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: ./engine
@@ -388,7 +349,7 @@ jobs:
              environment:
                DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}"
                SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF PR#${PR_NUMBER}"
                UI_HOMEDESCRIPTION: "PR#${PR_NUMBER} for Stirling-PDF Latest"
                UI_APPNAMENAVBAR: "PR#${PR_NUMBER}"
@@ -510,11 +471,10 @@ jobs:

  handle-label-commands:
    if: ${{ github.event.issue.pull_request != null }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -1,70 +0,0 @@
-name: _runner-pick
-
-# Tiny reusable workflow that classifies the trigger as either a "fork PR
-# from an untrusted contributor" or a "trusted commit" so downstream jobs
-# can pick a runner class without each one duplicating the 200-char gate
-# expression in their own `runs-on:`.
-#
-# Caller pattern:
-#
-#   jobs:
-#     pick:
-#       uses: ./.github/workflows/_runner-pick.yml
-#
-#     real-work:
-#       needs: pick
-#       runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-#       steps: [...]
-#
-# Output:
-#   is_fork: "true" when the trigger is a pull_request from a fork or an
-#            untrusted author_association, "false" otherwise.
-
-on:
-  workflow_call:
-    outputs:
-      is_fork:
-        description: '"true" if the trigger is an untrusted fork PR.'
-        value: ${{ jobs.pick.outputs.is_fork }}
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    runs-on: ubuntu-latest
-    timeout-minutes: 1
-    outputs:
-      is_fork: ${{ steps.decide.outputs.is_fork }}
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Classify the trigger
-        id: decide
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_REPO_FORK: ${{ github.event.pull_request.head.repo.fork }}
-          AUTHOR_ASSOC: ${{ github.event.pull_request.author_association }}
-        run: |
-          set -eu
-          if [ -z "${PR_NUMBER:-}" ]; then
-            # Not a pull_request event at all (push, schedule, workflow_dispatch,
-            # workflow_call from a non-PR trigger) -> trusted by default.
-            echo "is_fork=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          if [ "${HEAD_REPO_FORK}" = "true" ]; then
-            echo "is_fork=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          case "${AUTHOR_ASSOC}" in
-            OWNER|MEMBER|COLLABORATOR)
-              echo "is_fork=false" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "is_fork=true" >> "$GITHUB_OUTPUT"
-              ;;
-          esac
@@ -1,9 +1,8 @@
 name: AI Engine CI

-# Validates the Python AI engine: regenerates tool models and runs the
-# engine quality gate (lint, type-check, format-check, tests). Called from
-# build.yml on PRs and merge_group; also runs directly on push to main as
-# a post-merge safety net.
+# Validates the Python AI engine: regenerates tool models, runs fixers,
+# lint, type-check, and tests. Called from build.yml on PRs and merge_group;
+# also runs directly on push to main as a post-merge safety net.
 on:
  workflow_call:
  push:
@@ -18,19 +17,17 @@ jobs:
    permissions:
      contents: read
      pull-requests: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
        with:
          enable-cache: true

@@ -43,104 +40,36 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      - name: Regenerate tool models
        run: task engine:tool-models

      - name: Verify tool models are up to date
-        id: tool-models-check
-        continue-on-error: true
-        run: git diff --exit-code engine/src/stirling/models/tool_models.py
-
-      - name: Comment on tool models check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.tool-models-check.outcome == 'failure' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const body = [
-              marker,
-              '### Tool Models Check Failed',
-              '',
-              'The generated `engine/src/stirling/models/tool_models.py` is out of date with the Java OpenAPI spec and will need to be regenerated before it can be merged in.',
-              '',
-              'Run `task engine:tool-models` to regenerate, then commit the updated file.',
-            ].join('\n');
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
-
-      - name: Fail if tool models check failed
-        if: steps.tool-models-check.outcome == 'failure'
        run: |
-          echo "============================================"
-          echo "  Tool Models Check Failed"
-          echo "============================================"
-          echo ""
-          echo "The generated engine/src/stirling/models/tool_models.py"
-          echo "is out of date with the Java OpenAPI spec and will"
-          echo "need to be regenerated before it can be merged in."
-          echo ""
-          echo "Run 'task engine:tool-models' to regenerate, then"
-          echo "commit the updated file."
-          echo "============================================"
-          exit 1
+          if ! git diff --exit-code engine/src/stirling/models/tool_models.py; then
+            echo "tool_models.py is out of date."
+            echo "Run 'task engine:tool-models' locally and commit the updated file."
+            exit 1
+          fi

-      - name: Remove tool models check comment on success
-        if: steps.tool-models-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- tool-models-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
+      - name: Run fixers
+        run: task engine:fix

-      - name: Quality-check engine
-        id: engine-check
-        run: task engine:check
-        continue-on-error: true
+      - name: Verify fixes are committed
+        id: fixer_changes
+        run: |
+          if ! git diff --quiet; then
+            git --no-pager diff --stat
+            echo "::error::There are issues with your Python code that will need to be fixed before they can be merged in. Run 'task engine:fix' to auto-fix what can be fixed automatically, then run 'task engine:check' to see what still needs fixing manually."
+            exit 1
+          fi

-      - name: Comment on engine check failure
-        # Only post a comment on PRs. github-script's PR helpers need an
-        # issue/PR number, which doesn't exist on merge_group runs.
-        if: steps.engine-check.outcome == 'failure' && github.event_name == 'pull_request'
+      - name: Comment on fixer failures
+        if: steps.fixer_changes.outcome == 'failure' && github.event_name == 'pull_request'
        continue-on-error: true
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
@@ -176,39 +105,11 @@ jobs:
              });
            }

-      - name: Fail if engine check failed
-        if: steps.engine-check.outcome == 'failure'
-        run: |
-          echo "============================================"
-          echo "  Engine Check Failed"
-          echo "============================================"
-          echo ""
-          echo "There are issues with your Python code that"
-          echo "will need to be fixed before they can be merged in."
-          echo ""
-          echo "Run 'task engine:fix' to auto-fix what can be"
-          echo "fixed automatically, then run 'task engine:check'"
-          echo "to see what still needs fixing manually."
-          echo "============================================"
-          exit 1
+      - name: Run linting
+        run: task engine:lint

-      - name: Remove engine check comment on success
-        if: steps.engine-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- engine-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
+      - name: Run type checking
+        run: task engine:typecheck
+
+      - name: Run tests
+        run: task engine:test
@@ -19,7 +19,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -87,7 +87,7 @@ jobs:
      - name: AI PR Title Analysis
        if: steps.actor.outputs.is_repo_dev == 'true'
        id: ai-title-analysis
-        uses: actions/ai-inference@17ff458cb182449bbb2e43701fcd98f6af8f6570 # v2.1.0
+        uses: actions/ai-inference@e09e65981758de8b2fdab13c2bfb7c7d5493b0b6 # v2.0.7
        with:
          model: openai/gpt-4o
          system-prompt-file: ".github/config/system-prompt.txt"
@@ -26,7 +26,7 @@ jobs:
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -70,12 +70,12 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout repository (for PKGBUILD templates)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Update stirling-pdf-desktop PKGBUILD
        env:
@@ -106,7 +106,7 @@ jobs:

      - name: Publish stirling-pdf-desktop to AUR
        if: ${{ github.event_name == 'release' || inputs.dry_run == false }}
-        uses: KSXGitHub/github-actions-deploy-aur@da03e160361ce01bf087e790b6ffd196d7dccff7 # v4.1.3
+        uses: KSXGitHub/github-actions-deploy-aur@v4.1.3
        with:
          pkgname: stirling-pdf-desktop
          pkgbuild: .github/aur/stirling-pdf-desktop/PKGBUILD
@@ -16,7 +16,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -1,14 +1,8 @@
 name: Backend build, format check, and coverage

-# Reusable workflow called from build.yml. Runs the backend build matrix
-# (JDK 25 × every flavor), Spotless formatting check, JUnit, and
+# Reusable workflow called from build.yml. Runs the full backend build matrix
+# (JDK 21/25 × spring-security on/off), Spotless formatting check, JUnit, and
 # posts Jacoco coverage to PRs.
-#
-# Flavor axis (maps to STIRLING_FLAVOR in settings.gradle):
-#   core         - DISABLE_ADDITIONAL_FEATURES=true, no proprietary, no saas
-#   proprietary  - default build, no saas
-#   saas         - proprietary + the saas subproject (build + JUnit only,
-#                  never any runtime/integration testing)
 on:
  workflow_call:

@@ -19,22 +13,16 @@ permissions:
  pull-requests: write

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  build:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
-        jdk-version: [25]
-        flavor: [core, proprietary, saas]
+        jdk-version: [21, 25]
+        spring-security: [true, false]
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -58,16 +46,13 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1
          cache-disabled: true

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Check Java formatting (Spotless)
-        # Runs once per matrix combination - pick the cheapest leg
-        # (core - no proprietary, no saas) so we don't wait for the
-        # heavier flavors just to fail formatting.
-        if: matrix.jdk-version == 25 && matrix.flavor == 'core'
+        if: matrix.jdk-version == 25 && matrix.spring-security == false
        id: spotless-check
        run: task backend:format:check
        continue-on-error: true
@@ -76,7 +61,7 @@ jobs:
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}

-      - name: Comment on backend format check failure
+      - name: Comment on Java formatting failure
        # Only post a comment on PRs. github-script's PR helpers need an
        # issue/PR number, which doesn't exist on merge_group runs.
        if: steps.spotless-check.outcome == 'failure' && github.event_name == 'pull_request'
@@ -87,11 +72,15 @@ jobs:
            const marker = '<!-- java-formatting-check -->';
            const body = [
              marker,
-              '### Backend Format Check Failed',
+              '### Java Formatting Check Failed',
              '',
-              'There are formatting issues in your Java code that will need to be fixed before they can be merged in.',
+              'Your code has formatting issues. Run the following command to fix them:',
              '',
-              'Run `task backend:format` to auto-fix, then commit and push the changes.',
+              '```bash',
+              'task backend:format',
+              '```',
+              '',
+              'Then commit and push the changes.',
            ].join('\n');
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
@@ -115,61 +104,33 @@ jobs:
              });
            }

-      - name: Fail if backend format check failed
+      - name: Fail if Java formatting issues found
        if: steps.spotless-check.outcome == 'failure'
        run: |
          echo "============================================"
-          echo "  Backend Format Check Failed"
+          echo "  Java Formatting Check Failed"
          echo "============================================"
          echo ""
-          echo "There are formatting issues in your Java code"
-          echo "that will need to be fixed before they can be"
-          echo "merged in."
+          echo "Your code has formatting issues."
+          echo "Run the following command to fix them:"
          echo ""
-          echo "Run 'task backend:format' to auto-fix, then"
-          echo "commit and push the changes."
+          echo "  task backend:format"
+          echo ""
+          echo "Then commit and push the changes."
          echo "============================================"
          exit 1

-      - name: Remove backend format check comment on success
-        if: steps.spotless-check.outcome == 'success' && github.event_name == 'pull_request'
-        continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const marker = '<!-- java-formatting-check -->';
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.deleteComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-              });
-            }
-
-      - name: Build with Gradle (flavor=${{ matrix.flavor }})
-        # STIRLING_FLAVOR is read by settings.gradle and expands into the
-        # right combination of DISABLE_ADDITIONAL_FEATURES + ENABLE_SAAS
-        # so we don't have to set them by hand. The saas flavor pulls in
-        # the app/saas subproject (unit tests only - no runtime tests).
+      - name: Build with Gradle and spring security ${{ matrix.spring-security }}
        run: task backend:build:ci
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-          STIRLING_FLAVOR: ${{ matrix.flavor }}
+          DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }}

      - name: Check Test Reports Exist
        if: always()
        run: |
-          # Common + core + proprietary always build (proprietary is
-          # excluded only at runtime, not from the gradle subproject
-          # graph). Saas builds add a fourth report dir.
          declare -a dirs=(
            "app/core/build/reports/tests/"
            "app/core/build/test-results/"
@@ -178,9 +139,6 @@ jobs:
            "app/proprietary/build/reports/tests/"
            "app/proprietary/build/test-results/"
          )
-          if [ "${{ matrix.flavor }}" = "saas" ]; then
-            dirs+=("app/saas/build/reports/tests/" "app/saas/build/test-results/")
-          fi
          for dir in "${dirs[@]}"; do
            if [ ! -d "$dir" ]; then
              echo "Missing $dir"
@@ -192,7 +150,7 @@ jobs:
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: test-reports-jdk-${{ matrix.jdk-version }}-flavor-${{ matrix.flavor }}
+          name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }}
          path: |
            app/**/build/reports/jacoco/test
            app/**/build/reports/tests/
@@ -202,47 +160,7 @@ jobs:
          retention-days: 3
          if-no-files-found: warn

-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml to
-        # silence security scanners that pattern-match on the stdlib
-        # xml.etree.ElementTree.parse call.
-        if: always() && matrix.flavor == 'saas'
-        run: python -m pip install --quiet defusedxml
-
-      - name: JaCoCo coverage step summary
-        # Only the saas leg posts the JUnit summary - it's a strict
-        # superset of the core + proprietary legs (same .exec files plus
-        # the saas subproject). Posting from all three would mean three
-        # near-identical tables crowding out the aggregate report.
-        if: always() && matrix.flavor == 'saas'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Backend JUnit coverage (JDK ${{ matrix.jdk-version }})" \
-            --jacoco "common=app/common/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "core=app/core/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "proprietary=app/proprietary/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --jacoco "saas=app/saas/build/reports/jacoco/test/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload raw JUnit .exec for aggregate merge
-        # Same dedup rationale as the summary step: upload from the saas
-        # leg only (the most complete set, includes app/saas/.../test.exec)
-        # so the aggregate workflow merges the union rather than three
-        # overlapping subsets.
-        #
-        # Separate artifact from the HTML reports so the aggregate
-        # workflow can grab just the .exec files with a name pattern
-        # (`jacoco-exec-*`) instead of unpacking the whole test-reports
-        # tarball.
-        if: always() && matrix.flavor == 'saas'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-junit-jdk-${{ matrix.jdk-version }}
-          path: app/*/build/jacoco/*.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Add coverage to PR (flavor=${{ matrix.flavor }}, JDK=${{ matrix.jdk-version }})
+      - name: Add coverage to PR with spring security ${{ matrix.spring-security }} and JDK ${{ matrix.jdk-version }}
        # The action only supports the pull_request event (it posts a PR comment),
        # so skip it for merge_group runs and workflow_dispatch.
        if: github.event_name == 'pull_request'
@@ -17,23 +17,11 @@ name: Enterprise E2E (Playwright)

 on:
  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
  push:
    branches: ["main"]
  schedule:
    - cron: "0 4 * * *"
  workflow_dispatch:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"

 # No `concurrency:` block here on purpose. When this workflow is called via
 # workflow_call from build.yml, ${{ github.workflow }}/event_name/pr_number
@@ -47,21 +35,16 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-e2e-enterprise:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
      PREMIUM_ENABLED: "true"
      SYSTEM_ENABLEANALYTICS: "false"
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -78,7 +61,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
        run: task e2e:install -- chromium
      - name: Build frontend (needed for playwright's vite preview webServer)
@@ -285,5 +268,5 @@ jobs:
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-enterprise-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 7
@@ -46,7 +46,7 @@ jobs:
      proprietary: ${{ steps.changes.outputs.proprietary }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -68,18 +68,6 @@ jobs:
    uses: ./.github/workflows/backend-build.yml
    secrets: inherit

-  db-migration-test:
-    # Boots the current bootJar against H2 fixtures captured from past
-    # releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still
-    # works after Hibernate's ddl-auto=update migrates the schema. Gated on
-    # the `project` filter so doc-only PRs skip this ~5-minute job.
-    if: needs.files-changed.outputs.project == 'true'
-    needs: [files-changed]
-    permissions:
-      contents: read
-    uses: ./.github/workflows/db-migration-test.yml
-    secrets: inherit
-
  check-generateOpenApiDocs:
    if: needs.files-changed.outputs.openapi == 'true'
    needs: [files-changed]
@@ -147,7 +135,6 @@ jobs:
    permissions:
      contents: read
      packages: read
-      id-token: write
    uses: ./.github/workflows/test-build-docker.yml
    secrets: inherit
    with:
@@ -185,24 +172,6 @@ jobs:
    uses: ./.github/workflows/dependency-review.yml
    secrets: inherit

-  # Coverage aggregate: merges the JUnit + e2e:live + cucumber .exec
-  # artifacts produced by the jobs above into one report, plus pulls
-  # in vitest + Playwright frontend coverage for the per-area matrix.
-  # `if: always()` so a producer failing partway still gets credit
-  # for whatever did record. Advisory only - intentionally NOT in
-  # all-checks-passed, so a flaky aggregate run never blocks merging.
-  coverage-aggregate:
-    if: always()
-    needs:
-      - build
-      - playwright-e2e-live
-      - docker-compose-tests
-      - frontend-validation
-    permissions:
-      contents: read
-    uses: ./.github/workflows/coverage-aggregate.yml
-    secrets: inherit
-
  # Single status check that branch protection should mark as required.
  # Succeeds when every upstream job is either `success` or `skipped` (path-
  # gated jobs that didn't apply this run). Any `failure` or `cancelled`
@@ -214,7 +183,6 @@ jobs:
    needs:
      - files-changed
      - build
-      - db-migration-test
      - check-generateOpenApiDocs
      - frontend-validation
      - playwright-e2e
@@ -229,17 +197,11 @@ jobs:
      - dependency-review
    runs-on: ubuntu-latest
    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
      - name: Verify every required job passed (or was legitimately skipped)
        env:
          RESULTS: |
            files-changed=${{ needs.files-changed.result }}
            build=${{ needs.build.result }}
-            db-migration-test=${{ needs.db-migration-test.result }}
            check-generateOpenApiDocs=${{ needs.check-generateOpenApiDocs.result }}
            frontend-validation=${{ needs.frontend-validation.result }}
            playwright-e2e=${{ needs.playwright-e2e.result }}
@@ -11,11 +11,9 @@ permissions:
 jobs:
  check-licence:
    runs-on: ubuntu-latest
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -40,11 +38,11 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1
          cache-disabled: true

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Check licenses for compatibility
        run: task backend:licenses:check
        env:
@@ -10,17 +10,11 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  check-generate-openapi-docs:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -45,11 +39,11 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1
          cache-disabled: true

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Generate OpenAPI documentation
        run: task backend:swagger
        env:
@@ -6,7 +6,7 @@ on:
  pull_request_target:
    types: [opened, synchronize, reopened]
    paths:
-      - "frontend/editor/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.toml"
      - ".github/scripts/check_language_toml.py"
      - ".github/workflows/check_toml.yml"

@@ -27,7 +27,7 @@ jobs:
      pull-requests: write # Allow writing to pull requests
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -76,7 +76,7 @@ jobs:
            exit 1
          fi
          # Get changed files and filter for TOML translation files
-          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/editor/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
+          gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^frontend/public/locales/[a-zA-Z-]+/translation\.toml$' > changed_files.txt || echo "No matching TOML files found in PR"
          # Check if any files were found
          if [ ! -s changed_files.txt ]; then
            echo "No TOML translation files changed in this PR"
@@ -166,16 +166,16 @@ jobs:

            // Determine reference file
            let referenceFilePath;
-            if (changedFiles.includes("frontend/editor/public/locales/en-US/translation.toml")) {
+            if (changedFiles.includes("frontend/public/locales/en-GB/translation.toml")) {
              console.log("Using PR branch reference file.");
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: prRepoOwner,
                repo: prRepoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/public/locales/en-GB/translation.toml",
                ref: branch,
              });

-              referenceFilePath = "pr-branch-translation-en-US.toml";
+              referenceFilePath = "pr-branch-translation-en-GB.toml";
              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
              fs.writeFileSync(referenceFilePath, content);
            } else {
@@ -183,11 +183,11 @@ jobs:
              const { data: fileContent } = await github.rest.repos.getContent({
                owner: repoOwner,
                repo: repoName,
-                path: "frontend/editor/public/locales/en-US/translation.toml",
+                path: "frontend/public/locales/en-GB/translation.toml",
                ref: "main",
              });

-              referenceFilePath = "main-branch-translation-en-US.toml";
+              referenceFilePath = "main-branch-translation-en-GB.toml";
              const content = Buffer.from(fileContent.content, "base64").toString("utf-8");
              fs.writeFileSync(referenceFilePath, content);
            }
@@ -293,6 +293,6 @@ jobs:
        run: |
          echo "Cleaning up temporary files..."
          rm -rf pr-branch
-          rm -f pr-branch-translation-en-US.toml main-branch-translation-en-US.toml changed_files.txt result.txt
+          rm -f pr-branch-translation-en-GB.toml main-branch-translation-en-GB.toml changed_files.txt result.txt
          echo "Cleanup complete."
        continue-on-error: true # Ensure cleanup runs even if previous steps fail
@@ -1,230 +0,0 @@
-name: Aggregate backend coverage
-
-# Reusable workflow called from build.yml after every backend coverage
-# producer (JUnit, e2e:live, cucumber) has run. Downloads each job's raw
-# .exec, merges them into one JaCoCo report, and posts a combined step
-# summary alongside the per-source ones.
-#
-# Kept separate from the per-source jobs so:
-#   - the per-source jobs stay fast and independent (no cross-job waits)
-#   - this job can `if: always()` and still produce something useful when
-#     one of the producers fails partway through
-#   - frontend producers can be added later without touching the
-#     producers themselves
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  aggregate:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    timeout-minutes: 15
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: "25"
-          distribution: "temurin"
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-          cache-disabled: true
-
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for coverage scripts
-        # Both coverage-summary.py and coverage-matrix.py parse JaCoCo
-        # XML through defusedxml - see the script headers for context.
-        run: python -m pip install --quiet defusedxml
-
-      # Pattern matches every artifact this PR's producers might upload:
-      #   jacoco-exec-junit-jdk-25            (uploaded only by the saas
-      #                                         leg of backend-build, which
-      #                                         is a strict superset of the
-      #                                         core + proprietary legs)
-      #   jacoco-exec-e2e-live
-      #   jacoco-exec-cucumber
-      # Each lands as a sibling dir under coverage-execs/, with the .exec
-      # files preserving their original relative paths.
-      - name: Download all .exec artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          pattern: jacoco-exec-*
-          path: coverage-execs/
-          merge-multiple: false
-        continue-on-error: true
-
-      - name: Inventory .exec files
-        id: inventory
-        # Splits the downloaded artifacts into two buckets:
-        #   * e2e-only  = cucumber + Playwright live (user-flow coverage)
-        #   * all       = the above plus JUnit (everything we test)
-        #
-        # Bucketing is by artifact-name prefix: download-artifact preserves
-        # the artifact name as the top-level dir, so JUnit's `.exec`s live
-        # under coverage-execs/jacoco-exec-junit-*/... while the others
-        # are under coverage-execs/jacoco-exec-{e2e-live,cucumber}/...
-        #
-        # If nothing was uploaded (e.g. all producers crashed before
-        # writing) we exit gracefully so this advisory job never fails CI.
-        run: |
-          mapfile -t all_execs < <(find coverage-execs -name '*.exec' -type f | sort)
-          mapfile -t e2e_execs < <(find coverage-execs -name '*.exec' -type f -not -path '*/jacoco-exec-junit-*' | sort)
-          if [ "${#all_execs[@]}" -eq 0 ]; then
-            echo "::warning::No .exec artifacts found - skipping aggregate report"
-            echo "found_all=false" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          printf 'All %d .exec files:\n' "${#all_execs[@]}"
-          printf '  %s\n' "${all_execs[@]}"
-          IFS=','; all_joined="${all_execs[*]}"
-          echo "files_all=$all_joined" >> "$GITHUB_OUTPUT"
-          echo "found_all=true" >> "$GITHUB_OUTPUT"
-          if [ "${#e2e_execs[@]}" -eq 0 ]; then
-            echo "::notice::No e2e/cucumber .exec files - e2e-only report will be skipped"
-            echo "found_e2e=false" >> "$GITHUB_OUTPUT"
-          else
-            printf 'E2E-only %d .exec files:\n' "${#e2e_execs[@]}"
-            printf '  %s\n' "${e2e_execs[@]}"
-            unset IFS
-            IFS=','; e2e_joined="${e2e_execs[*]}"
-            echo "files_e2e=$e2e_joined" >> "$GITHUB_OUTPUT"
-            echo "found_e2e=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Compile classes for JaCoCo class lookup
-        # jacocoReportFromExec only needs the compiled .class files
-        # under each subproject's build/classes/java/main/. `classes`
-        # (compileJava + processResources) is enough; we skipped the
-        # heavier `assemble` to avoid building bootJar / fat jars that
-        # add 60+ seconds per run for no gain to the report.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: ./gradlew classes -PnoSpotless
-
-      - name: Generate e2e-only JaCoCo report
-        # "Real user-flow" coverage: only counts code reached by an actual
-        # HTTP request from cucumber or live Playwright. Useful for
-        # questions like "how much of our backend does a user actually
-        # hit?". Skipped when neither producer uploaded a .exec.
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_e2e }}" \
-            -PreportDir=build/reports/jacoco/aggregate-e2e \
-            -PnoSpotless
-
-      - name: Generate combined JaCoCo report (everything)
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          ./gradlew jacocoReportFromExec \
-            -PexecFile="${{ steps.inventory.outputs.files_all }}" \
-            -PreportDir=build/reports/jacoco/aggregate-all \
-            -PnoSpotless
-
-      - name: E2E-only step summary
-        # Rendered first so it gets prime real estate in the Summary
-        # tab - this is the number most readers actually want
-        # ("how much of the backend do real user flows cover?").
-        if: steps.inventory.outputs.found_e2e == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Real user-flow backend coverage (e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: ALL-sources step summary
-        # Separate call (not a multi-input one) because the helper's
-        # rightmost "Aggregate" column would sum the two reports - which
-        # is meaningless when one is a strict superset of the other.
-        if: steps.inventory.outputs.found_all == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Combined backend coverage (JUnit + e2e:live + cucumber)" \
-            --jacoco "merged=build/reports/jacoco/aggregate-all/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload combined aggregate report
-        if: steps.inventory.outputs.found_all == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-all-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-all/
-          retention-days: 14
-
-      - name: Upload e2e-only aggregate report
-        if: steps.inventory.outputs.found_e2e == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-aggregate-e2e-${{ github.run_id }}
-          path: build/reports/jacoco/aggregate-e2e/
-          retention-days: 14
-
-      # --------------------------------------------------------------
-      # Per-area matrix: rolls backend + frontend coverage into one
-      # table indexed by core/proprietary/saas/desktop. Pulls the
-      # frontend artifacts now (after the JaCoCo step has done its
-      # work) so the per-source backend summaries still render first
-      # even if the matrix step fails.
-      # --------------------------------------------------------------
-      - name: Download vitest coverage artifact
-        # frontend-validation uploads as `frontend-coverage`. Tolerate
-        # absence so a backend-only PR still produces the matrix with
-        # just backend rows populated.
-        if: always()
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: frontend-coverage
-          path: matrix-inputs/vitest/
-        continue-on-error: true
-
-      - name: Download Playwright frontend coverage artifact
-        # e2e-live uploads as `playwright-frontend-coverage-<run_id>`.
-        # Same tolerance as vitest - matrix script handles missing inputs.
-        if: always()
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v6.0.0
-        with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
-          path: matrix-inputs/playwright/
-        continue-on-error: true
-
-      - name: Coverage matrix step summary
-        if: always()
-        # Matrix references the two aggregate JaCoCo XMLs (already
-        # generated above) plus whichever frontend artifacts landed.
-        # Every input is optional; missing ones render as "-".
-        run: |
-          python scripts/coverage-matrix.py \
-            ${{ steps.inventory.outputs.found_all == 'true' && '--jacoco-all build/reports/jacoco/aggregate-all/jacocoTestReport.xml' || '' }} \
-            ${{ steps.inventory.outputs.found_e2e == 'true' && '--jacoco-e2e build/reports/jacoco/aggregate-e2e/jacocoTestReport.xml' || '' }} \
-            --vitest matrix-inputs/vitest/coverage-summary.json \
-            --playwright-frontend matrix-inputs/playwright/coverage-pw-summary/coverage-summary.json \
-            --title "Coverage matrix (per-area, e2e vs all)" \
-            --github-step-summary
@@ -1,93 +0,0 @@
-name: DB migration smoke test
-
-# Boots the current Stirling-PDF JAR against H2 fixtures captured from past
-# releases (v2.0.0 / v2.5.0 / v2.10.0) and verifies admin login still works.
-# Catches schema changes that would break existing user databases under
-# Hibernate's `ddl-auto=update` upgrade path.
-
-on:
-  workflow_call:
-
-permissions:
-  contents: read
-
-jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
-  migration-test:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
-    timeout-minutes: 30
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Set up JDK 25
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
-        with:
-          java-version: 25
-          distribution: temurin
-
-      - name: Cache Gradle dependency artifacts
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: |
-            ~/.gradle/wrapper
-            ~/.gradle/caches/modules-2/files-2.1
-            ~/.gradle/caches/modules-2/metadata-2.*
-          key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-        with:
-          gradle-version: 9.6.0
-          cache-disabled: true
-
-      # No `-PnoSpotless` here yet because the upstream cache layer matches the
-      # backend build's; reuse keeps cold-cache cost identical.
-      - name: Build Stirling-PDF JAR
-        env:
-          MAVEN_USER: ${{ secrets.MAVEN_USER }}
-          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
-          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
-        run: ./gradlew :stirling-pdf:bootJar -PnoSpotless --no-daemon
-
-      - name: Locate built JAR
-        id: jar
-        run: |
-          jar=$(find app/core/build/libs -maxdepth 1 -name 'Stirling-PDF*.jar' -o -name 'stirling-pdf*.jar' 2>/dev/null \
-              | grep -vE '(-plain|-sources)\.jar$' | head -n 1)
-          if [[ -z "$jar" ]]; then
-            echo "::error::No JAR under app/core/build/libs"
-            ls -lah app/core/build/libs || true
-            exit 1
-          fi
-          # Absolute path - the migration script pushd's into a temp workdir
-          # before invoking java, which would dangle a relative path.
-          jar=$(realpath "$jar")
-          echo "path=$jar" >> "$GITHUB_OUTPUT"
-          echo "Built JAR: $jar"
-
-      - name: Run migration smoke test
-        env:
-          STIRLING_JAR: ${{ steps.jar.outputs.path }}
-        run: bash scripts/db-migration/run-migration-test.sh
-
-      - name: Upload app logs on failure
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: db-migration-app-logs
-          # Path matches the preserved workdir in run-migration-test.sh -
-          # only failing fixtures leave a directory behind.
-          path: /tmp/stirling-migration-failed-*/app.log
-          retention-days: 7
-          if-no-files-found: warn
@@ -14,13 +14,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: "Checkout Repository"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: "Dependency Review"
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
        with:
          config-file: "./.github/config/dependency-review-config.yml"
@@ -10,37 +10,22 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  deploy-v2-on-push:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    concurrency:
      group: deploy-v2-push-V2
      cancel-in-progress: true
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get commit hashes for frontend and backend
@@ -105,22 +90,8 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push frontend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-frontend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/frontend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push frontend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-frontend.outputs.exists == 'false'
+      - name: Build and push frontend image
+        if: steps.check-frontend.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -134,22 +105,8 @@ jobs:
          build-args: VERSION_TAG=v2-alpha
          platforms: linux/amd64

-      - name: Build and push backend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-backend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/backend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push backend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-backend.outputs.exists == 'false'
+      - name: Build and push backend image
+        if: steps.check-backend.outputs.exists == 'false'
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -188,7 +145,7 @@ jobs:
              environment:
                DISABLE_ADDITIONAL_FEATURES: "true"
                SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF V2"
                UI_HOMEDESCRIPTION: "V2 Frontend/Backend Split"
                UI_APPNAMENAVBAR: "V2 Deployment"
@@ -11,32 +11,21 @@ on:
        required: false
        type: string
        default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 4 because bench showed 16 was within noise of 4."
-        required: false
-        type: string
-        default: "4"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  docker-compose-tests:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '4') }}
+    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read
      checks: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -61,22 +50,14 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1
          cache-disabled: true

-      # When the PR changes the base image, test.sh builds it locally
-      # (stirling-pdf-base:local) into the daemon image store. A buildx
-      # container builder can't see that store, so skip it here and let
-      # `docker buildx build` fall back to the default docker driver, which
-      # resolves the local base. The gha cache backend is also skipped (its
-      # runtime token isn't exposed) since the docker driver can't use it.
      - name: Set up Docker Buildx
-        if: inputs.docker-base-changed != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      # Expose ACTIONS_RUNTIME_TOKEN / ACTIONS_RESULTS_URL for docker buildx type=gha cache backend.
      - name: Expose GitHub runtime for Buildx cache
-        if: inputs.docker-base-changed != 'true'
        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0

      - name: Install Docker Compose
@@ -95,12 +76,6 @@ jobs:
        run: |
          pip install --require-hashes --only-binary=:all: -r ./testing/cucumber/requirements.txt

-      - name: Extract JaCoCo agent for cucumber coverage
-        # Stages build/jacoco/jacocoagent.jar where the coverage override
-        # file bind-mounts it into the cucumber container. The agent jar
-        # never goes into the published image - this is host-only.
-        run: ./gradlew copyJacocoAgent -PnoSpotless
-
      - name: Run Docker Compose Tests
        run: |
          chmod +x ./testing/test_webpages.sh
@@ -112,62 +87,6 @@ jobs:
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
-          # Tells test.sh to layer testing/compose/docker-compose-coverage.override.yml
-          # over the cucumber compose so the container starts with the
-          # JaCoCo agent attached via JAVA_CUSTOM_OPTS.
-          STIRLING_PDF_TEST_COVERAGE: "1"
-
-      - name: Generate cucumber JaCoCo report
-        # `if: always()` so a behave failure still produces partial
-        # coverage from whatever endpoints did run. The exec file only
-        # exists when the container shut down cleanly - guard so the step
-        # is silent on the (rare) crash path.
-        if: always()
-        id: cucumber-coverage
-        run: |
-          if [ -s testing/cucumber-coverage/cucumber.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=testing/cucumber-coverage/cucumber.exec \
-              -PreportDir=build/reports/jacoco/cucumber \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No cucumber .exec at testing/cucumber-coverage/cucumber.exec (container may have crashed before flushing)"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py parses JaCoCo XML through defusedxml -
-        # see the script header for context.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-
-      - name: Cucumber coverage step summary
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Cucumber (docker) JaCoCo coverage" \
-            --jacoco "cucumber=build/reports/jacoco/cucumber/jacocoTestReport.xml" \
-            --github-step-summary
-
-      - name: Upload cucumber JaCoCo report
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-cucumber-${{ github.run_id }}
-          path: build/reports/jacoco/cucumber/
-          retention-days: 7
-
-      - name: Upload raw cucumber .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.cucumber-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-cucumber
-          path: testing/cucumber-coverage/cucumber.exec
-          retention-days: 7
-          if-no-files-found: warn

      - name: Upload Cucumber Report
        if: always()
@@ -5,27 +5,17 @@ name: Playwright E2E (live backend)
 # server.
 on:
  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-e2e-live:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -42,139 +32,16 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
        run: task e2e:install -- chromium
      - name: Build frontend (production bundle for vite preview)
        env:
          VITE_BUILD_FOR_PREVIEW: "1"
        run: task frontend:build
-      - name: Run live E2E tests (chromium) with coverage
+      - name: Run live E2E tests (chromium)
        id: live-tests
-        env:
-          # Attaches the JaCoCo agent to the bootRun JVM (see
-          # .taskfiles/e2e.yml live:backend). The .exec gets flushed on
-          # graceful shutdown when the runner traps EXIT/INT/TERM, so the
-          # report step below sees a populated file.
-          COVERAGE: "1"
-          # Tells the Playwright fixture (test-base.ts) to capture per-test
-          # V8 JS coverage. Raw dumps land under
-          # .test-state/playwright/coverage-pw/ for the post-process step
-          # to aggregate. Chromium-only - other engines silently skip.
-          PW_COVERAGE: "1"
        run: task e2e:live
-      - name: Generate JaCoCo report from e2e:live .exec
-        if: always()
-        id: live-coverage
-        # `if: always()` so even a failed test run still produces a
-        # report from whatever flows did exercise the backend before
-        # the failure. The task itself tolerates a missing .exec
-        # (jacoco emits an empty report rather than crashing) but we
-        # guard with `test -s` to keep the job log clean.
-        run: |
-          if [ -s .test-state/playwright/jacoco.exec ]; then
-            ./gradlew jacocoReportFromExec \
-              -PexecFile=.test-state/playwright/jacoco.exec \
-              -PreportDir=build/reports/jacoco/e2e-live \
-              -PnoSpotless
-            echo "report=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::warning::No e2e:live .exec found at .test-state/playwright/jacoco.exec; skipping report"
-            echo "report=false" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Set up Python for coverage summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # coverage-summary.py uses defusedxml instead of stdlib xml.etree
-        # to dodge XXE / billion-laughs scanner findings.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: python -m pip install --quiet defusedxml
-      - name: e2e:live coverage step summary
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live backend) JaCoCo coverage" \
-            --jacoco "e2e-live=build/reports/jacoco/e2e-live/jacocoTestReport.xml" \
-            --github-step-summary
-      - name: Upload e2e:live JaCoCo report
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-e2e-live-${{ github.run_id }}
-          path: build/reports/jacoco/e2e-live/
-          retention-days: 7
-
-      - name: Upload raw e2e:live .exec for aggregate merge
-        # Picked up by the coverage-aggregate workflow via the
-        # `jacoco-exec-*` artifact name pattern.
-        if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: jacoco-exec-e2e-live
-          path: .test-state/playwright/jacoco.exec
-          retention-days: 7
-          if-no-files-found: warn
-
-      - name: Set up Python for frontend coverage summary
-        # Separate from the backend-coverage python step because the
-        # frontend path doesn't depend on a JaCoCo report - it produces
-        # a summary even on backend failure, as long as some Playwright
-        # tests ran far enough to dump V8 coverage.
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-
-      - name: Install defusedxml for frontend coverage summary
-        # Idempotent re-install: the backend-coverage step may have
-        # installed it already, but this leg can run on its own when the
-        # backend report step skips (e.g. .exec missing).
-        if: always()
-        run: python -m pip install --quiet defusedxml
-
-      - name: Aggregate Playwright frontend (V8) coverage
-        # Rolls per-test V8 dumps from the test-base fixture into one
-        # vitest-shaped coverage-summary.json. Tolerates a missing dump
-        # dir (firefox/webkit runs, or a failure before any test got
-        # far enough to dump).
-        if: always()
-        id: pw-frontend-coverage
-        run: |
-          if [ -d .test-state/playwright/coverage-pw ] && \
-             find .test-state/playwright/coverage-pw -name '*.json' -type f | grep -q .; then
-            python scripts/playwright-coverage-summary.py \
-              .test-state/playwright/coverage-pw \
-              --out .test-state/playwright/coverage-pw-summary/coverage-summary.json
-            echo "summary=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "::notice::No Playwright frontend coverage dumps found (chromium-only feature)"
-            echo "summary=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Playwright frontend coverage step summary
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Playwright (live) frontend coverage" \
-            --vitest .test-state/playwright/coverage-pw-summary/coverage-summary.json \
-            --github-step-summary
-
-      - name: Upload Playwright frontend coverage
-        # Bundle both the aggregated summary and the raw V8 dumps so
-        # someone debugging "why is this function showing as covered"
-        # can trace it back to the source dump.
-        if: always() && steps.pw-frontend-coverage.outputs.summary == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: playwright-frontend-coverage-${{ github.run_id }}
-          path: |
-            .test-state/playwright/coverage-pw-summary/
-            .test-state/playwright/coverage-pw/
-          retention-days: 7
-
      - name: Print backend log on failure
        if: failure() && steps.live-tests.conclusion == 'failure'
        run: |
@@ -188,30 +55,10 @@ jobs:
          name: backend-log-live-${{ github.run_id }}
          path: .test-state/playwright/backend.log
          retention-days: 7
-      - name: List Playwright output locations (debug)
-        if: always()
-        run: |
-          echo "::group::Playwright output dirs"
-          # Playwright anchors its default outputDir + HTML report to the
-          # nearest package.json, which is frontend/ (frontend/editor has
-          # none), so artifacts land under frontend/, not frontend/editor/.
-          ls -la frontend/playwright-report 2>/dev/null \
-            || echo "no playwright-report at frontend/"
-          ls -la frontend/test-results 2>/dev/null \
-            || echo "no test-results at frontend/"
-          find . -name node_modules -prune -o -name 'trace.zip' -print 2>/dev/null || true
-          echo "::endgroup::"
-      - name: Upload Playwright report + traces
+      - name: Upload Playwright report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-live-${{ github.run_id }}
-          # test-results/ holds the per-test trace.zip (with browser console
-          # logs) + screenshots/video; playwright-report/ is the HTML report.
-          # Both live under frontend/ (Playwright anchors them to the nearest
-          # package.json, which is frontend/; frontend/editor has none).
-          path: |
-            frontend/playwright-report/
-            frontend/test-results/
+          path: frontend/playwright-report/
          retention-days: 7
-          if-no-files-found: warn
@@ -5,26 +5,16 @@ name: Playwright E2E (stubbed)
 # mocks API responses in the browser.
 on:
  workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 8 to match the other playwright workflows; bench showed flat scaling above 8."
-        required: false
-        type: string
-        default: "8"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-e2e:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -36,7 +26,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install Playwright (chromium only)
        run: task e2e:install -- chromium
      - name: Build frontend (production bundle for vite preview)
@@ -50,5 +40,5 @@ jobs:
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-report-stubbed-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 7
@@ -19,20 +19,16 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  files-changed:
    name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    timeout-minutes: 3
    outputs:
      licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
      licenses-backend: ${{ steps.changes.outputs.licenses-backend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -48,15 +44,15 @@ jobs:
  generate-frontend-license-report:
    if: needs.files-changed.outputs.licenses-frontend == 'true'
    name: Generate Frontend License Report
-    needs: [pick, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: files-changed
+    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      repository-projects: write # Required for enabling automerge
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -97,7 +93,7 @@ jobs:
        run: npm ci --ignore-scripts --audit=false --fund=false

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Generate frontend license report (internal PR)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
        env:
@@ -110,31 +106,31 @@ jobs:
          NPM_CONFIG_IGNORE_SCRIPTS: "true"
        working-directory: frontend
        run: |
-          mkdir -p editor/src/assets
-          npx --yes license-report --only=prod --output=json > editor/src/assets/3rdPartyLicenses.json
+          mkdir -p src/assets
+          npx --yes license-report --only=prod --output=json > src/assets/3rdPartyLicenses.json

      - name: Postprocess with project script (BASE version)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
        env:
          PR_IS_FORK: "true"
        run: |
-          node base/frontend/editor/scripts/generate-licenses.js \
-            --input frontend/editor/src/assets/3rdPartyLicenses.json
+          node base/frontend/scripts/generate-licenses.js \
+            --input frontend/src/assets/3rdPartyLicenses.json

      - name: Copy postprocessed artifacts back (fork PRs)
        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true
        run: |
-          mkdir -p frontend/editor/src/assets
-          if [ -f "base/frontend/editor/src/assets/3rdPartyLicenses.json" ]; then
-            cp base/frontend/editor/src/assets/3rdPartyLicenses.json frontend/editor/src/assets/3rdPartyLicenses.json
+          mkdir -p frontend/src/assets
+          if [ -f "base/frontend/src/assets/3rdPartyLicenses.json" ]; then
+            cp base/frontend/src/assets/3rdPartyLicenses.json frontend/src/assets/3rdPartyLicenses.json
          fi
-          if [ -f "base/frontend/editor/src/assets/license-warnings.json" ]; then
-            cp base/frontend/editor/src/assets/license-warnings.json frontend/editor/src/assets/license-warnings.json
+          if [ -f "base/frontend/src/assets/license-warnings.json" ]; then
+            cp base/frontend/src/assets/license-warnings.json frontend/src/assets/license-warnings.json
          fi

      - name: Check for license warnings
        run: |
-          if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
+          if [ -f "frontend/src/assets/license-warnings.json" ]; then
            echo "LICENSE_WARNINGS_EXIST=true" >> $GITHUB_ENV
          else
            echo "LICENSE_WARNINGS_EXIST=false" >> $GITHUB_ENV
@@ -182,10 +178,10 @@ jobs:
            echo ""
            if [ "${LICENSE_WARNINGS_EXIST}" = "true" ]; then
              echo "❌ **Failed** – incompatible or unknown licenses found."
-              if [ -f "frontend/editor/src/assets/license-warnings.json" ]; then
+              if [ -f "frontend/src/assets/license-warnings.json" ]; then
                echo ""
                echo "### Warnings"
-                jq -r '.warnings[] | "- \(.message)"' frontend/editor/src/assets/license-warnings.json || true
+                jq -r '.warnings[] | "- \(.message)"' frontend/src/assets/license-warnings.json || true
              fi
            else
              echo "✅ **Passed** – no license warnings detected."
@@ -211,7 +207,7 @@ jobs:
              const fs = require('fs');
              let warningDetails = '';
              try {
-                const warnings = JSON.parse(fs.readFileSync('frontend/editor/src/assets/license-warnings.json', 'utf8'));
+                const warnings = JSON.parse(fs.readFileSync('frontend/src/assets/license-warnings.json', 'utf8'));
                warningDetails = warnings.warnings.map(w => `- ${w.message}`).join('\n');
              } catch (e) {
                warningDetails = 'Unable to read warning details';
@@ -251,7 +247,7 @@ jobs:
      - name: Commit changes (Push only)
        if: github.event_name == 'push'
        run: |
-          git add frontend/editor/src/assets/3rdPartyLicenses.json
+          git add frontend/src/assets/3rdPartyLicenses.json
          # Note: Do NOT commit license-warnings.json - it's only for PR review
          git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV

@@ -269,7 +265,7 @@ jobs:

          The following licenses may require review for corporate compatibility:

-          $(cat frontend/editor/src/assets/license-warnings.json | jq -r '.warnings[].message')
+          $(cat frontend/src/assets/license-warnings.json | jq -r '.warnings[].message')

          Please review these licenses to ensure they are acceptable for your use case."
          fi
@@ -311,18 +307,16 @@ jobs:

  generate-backend-license-report:
    if: needs.files-changed.outputs.licenses-backend == 'true'
-    needs: [pick, files-changed]
+    needs: files-changed
    name: Generate Backend License Report
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      repository-projects: write # Required for enabling automerge
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -349,10 +343,10 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Check licenses and generate report
        id: license-check
        run: task backend:licenses:generate || echo "LICENSE_CHECK_FAILED=true" >> $GITHUB_ENV
@@ -11,15 +11,11 @@ permissions:
  pull-requests: write

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  frontend-validation:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
      - name: Checkout repository
@@ -31,7 +27,7 @@ jobs:
          cache: "npm"
          cache-dependency-path: frontend/package-lock.json
      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Quality-check frontend
        id: frontend-check
        run: task frontend:check:all
@@ -109,44 +105,9 @@ jobs:
                comment_id: existing.id,
              });
            }
-      - name: Vitest coverage
-        # Separate from `frontend:check:all` so the quality-gate run stays
-        # uninstrumented (faster signal) and coverage stays an informational
-        # follow-up. Continue-on-error keeps the workflow green even when
-        # a handful of test files refuse to import (e.g. missing icon
-        # specifiers) - the summary still gets posted with whatever
-        # vitest managed to instrument.
-        id: frontend-coverage
-        continue-on-error: true
-        run: task frontend:test:coverage
-      - name: Set up Python for coverage summary
-        if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.12"
-      - name: Install defusedxml for coverage summary
-        # See coverage-summary.py header - it parses XML through defusedxml
-        # to dodge the stdlib parser's exposure to XXE / billion-laughs.
-        if: always()
-        run: python -m pip install --quiet defusedxml
-      - name: Vitest coverage step summary
-        if: always()
-        run: |
-          python scripts/coverage-summary.py \
-            --title "Frontend Vitest coverage" \
-            --vitest frontend/editor/coverage/coverage-summary.json \
-            --github-step-summary
-      - name: Upload vitest coverage report
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: frontend-coverage
-          path: frontend/editor/coverage/
-          retention-days: 7
-          if-no-files-found: warn
      - name: Upload frontend build artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: frontend-build
-          path: frontend/editor/dist/
+          path: frontend/dist/
          retention-days: 3
@@ -15,7 +15,7 @@ jobs:
      issues: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -36,19 +36,15 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  determine-matrix:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
      version: ${{ steps.versionNumber.outputs.versionNumber }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -73,10 +69,10 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: |
@@ -94,28 +90,26 @@ jobs:
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            case "${{ github.event.inputs.platform }}" in
              "windows")
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
              "macos")
-                echo 'matrix={"include":[{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal"}]}' >> $GITHUB_OUTPUT
                ;;
              "linux")
-                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
              *)
-                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
+                echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
                ;;
            esac
          else
            # For push/release events, build all platforms
-            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}]}' >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"},{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal"},{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}]}' >> $GITHUB_OUTPUT
          fi

  build-jars:
-    needs: [pick, determine-matrix]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    needs: determine-matrix
+    runs-on: ubuntu-latest
    strategy:
      matrix:
        variant:
@@ -133,7 +127,7 @@ jobs:
            file_suffix: "-server"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -148,7 +142,7 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Setup Node.js
        if: matrix.variant.build_frontend == true
@@ -159,7 +153,7 @@ jobs:
          cache-dependency-path: frontend/package-lock.json

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      - name: Build JAR
        run: ./gradlew build ${{ matrix.variant.build_frontend && '-PbuildWithFrontend=true' || '' }} -x spotlessApply -x spotlessCheck -x test -x sonarqube
@@ -195,10 +189,9 @@ jobs:
      SM_API_KEY: ${{ secrets.SM_API_KEY }}
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit
          allowed-endpoints: >
@@ -252,10 +245,10 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

      # Build the universal JRE before desktop:prepare so the jlink:runtime
      # task short-circuits on its `test -d runtime/jre` status check.
@@ -263,17 +256,15 @@ jobs:
        if: matrix.platform == 'macos-15'
        env:
          AARCH64_JAVA_HOME: ${{ env.JAVA_HOME }}
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
        run: task desktop:jlink:universal-mac

      - name: Prepare desktop build
+        run: task desktop:prepare
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:prepare

      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
@@ -427,7 +418,7 @@ jobs:
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -440,7 +431,7 @@ jobs:
          }
          EOF
          echo "Generated tauri.windows.conf.json (alias masked):"
-          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/editor/src-tauri/tauri.windows.conf.json
+          sed "s/${KEYPAIR_ALIAS}/***/g" ./frontend/src-tauri/tauri.windows.conf.json

      - name: Import release GPG signing key (Linux)
        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -488,10 +479,9 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          args: ${{ matrix.args }}
-          updaterJsonKeepUniversal: true

      - name: Clear release GPG key from runner keyring (Linux)
        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master')
@@ -515,7 +505,7 @@ jobs:
          $allSigned = $true

          # Check MSI installer (outer wrapper - what users download)
-          $msiFiles = Get-ChildItem -Path "./frontend/editor/src-tauri/target" -Filter "*.msi" -Recurse -File
+          $msiFiles = Get-ChildItem -Path "./frontend/src-tauri/target" -Filter "*.msi" -Recurse -File
          if ($msiFiles.Count -eq 0) {
            Write-Host "[ERROR] No MSI found under target/"
            exit 1
@@ -583,37 +573,21 @@ jobs:
        if: always() && steps.digicert-setup.conclusion != 'failure'
        shell: bash
        run: |
-          # Absolute dist path so the cd below can't break the copy targets.
-          DIST="$GITHUB_WORKSPACE/dist"
-          mkdir -p "$DIST"
-          cd ./frontend/editor/src-tauri/target
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target

-          echo "=== tauri bundle artifacts ==="
-          find . -path "*/bundle/*" \( -name "*.msi" -o -name "*.deb" \
-            -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.dmg" \
-            -o -name "*.app.tar.gz" -o -name "*.sig" \) 2>/dev/null | sort || true
-          echo "=============================="
-
-          # createUpdaterArtifacts:true signs the native installers in place;
-          # each <bundle> ships with a sibling <bundle>.sig consumed by latest.json.
+          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
-            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
-            find . -name "*.msi.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi.sig" \;
+            # Only ship the MSI installer on Windows. The loose exe and WiX toolset exes
+            # are not the user-facing installer - the MSI contains the signed inner exe.
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            # DMG = manual install; .app.tar.gz (+ .sig) = updater payload.
-            # Raw .app is intentionally not shipped (hundreds of MB of uncompressed input).
-            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
-            find . -name "*.app.tar.gz" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz" \;
-            find . -name "*.app.tar.gz.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.app.tar.gz.sig" \;
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.app" -exec cp -r {} "../../../dist/Stirling-PDF-${{ matrix.name }}.app" \;
          else
-            # The raw .AppImage IS its updater payload (signed -> .AppImage.sig),
-            # not a .tar.gz wrapper - that's only produced under v1Compatible.
-            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.deb.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb.sig" \;
-            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.rpm.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm.sig" \;
-            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
-            find . -name "*.AppImage.sig" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage.sig" \;
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      - name: Upload build artifacts
@@ -624,27 +598,18 @@ jobs:
          path: ./dist/*
          retention-days: 1

-  collect-and-release:
-    needs: [pick, determine-matrix, build, build-jars]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+  create-release:
+    if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
+    needs: [determine-matrix, build, build-jars]
+    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

-      # Sparse-check out the verifier + pubkey before the artifact downloads
-      # so the checkout cannot clobber ./artifacts.
-      - name: Checkout updater verifier
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          sparse-checkout: |
-            .github/scripts/verify-updater-signatures.py
-            frontend/editor/src-tauri/tauri.conf.json
-          sparse-checkout-cone-mode: false
-
      - name: Download all Tauri artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
@@ -672,146 +637,17 @@ jobs:
      - name: Display structure of downloaded files
        run: ls -R ./artifacts

-      # tauri-action only emits latest.json when it also publishes the release
-      # (tagName/releaseId set). We publish separately via action-gh-release,
-      # so build latest.json here from the per-platform .sig files.
-      - name: Generate updater latest.json
-        env:
-          VERSION: ${{ needs.determine-matrix.outputs.version }}
-          TAG: v${{ needs.determine-matrix.outputs.version }}
-          REPO: ${{ github.repository }}
-        run: |
-          python3 - << 'PYEOF'
-          import json, os, sys
-          from pathlib import Path
-          from datetime import datetime, timezone
-
-          VERSION = os.environ['VERSION']
-          TAG = os.environ['TAG']
-          REPO = os.environ['REPO']
-
-          ART = Path('./artifacts/tauri')
-
-          # Tauri updater looks up {os}-{arch}-{installer} (e.g. linux-x86_64-deb)
-          # before bare {os}-{arch}, so per-format Linux keys let deb/rpm/appimage
-          # each self-update from their matching file. macOS universal serves both
-          # arches from the one .app.tar.gz.
-          PLATFORM_MAP = [
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.deb'],
-                  'targets': ['linux-x86_64-deb'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.rpm'],
-                  'targets': ['linux-x86_64-rpm'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-linux-x86_64.AppImage'],
-                  'targets': ['linux-x86_64-appimage'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-windows-x86_64.msi'],
-                  'targets': ['windows-x86_64-msi', 'windows-x86_64'],
-              },
-              {
-                  'bundles': ['Stirling-PDF-macos-universal.app.tar.gz'],
-                  'targets': ['darwin-x86_64', 'darwin-aarch64'],
-              },
-          ]
-
-          # rglob() because download-artifact varies layout: one artifact -> flat,
-          # many -> nested under <artifact-name>/.
-          def find_signed(name):
-              for bundle_path in sorted(ART.rglob(name)):
-                  sig_path = bundle_path.with_name(bundle_path.name + '.sig')
-                  if sig_path.exists():
-                      return bundle_path, sig_path
-              return None
-
-          platforms = {}
-          skipped = []
-          for entry in PLATFORM_MAP:
-              picked = None
-              for name in entry['bundles']:
-                  picked = find_signed(name)
-                  if picked:
-                      break
-              if not picked:
-                  skipped.append(
-                      f"{entry['targets']} (no signed bundle among "
-                      f"{entry['bundles']} - TAURI_SIGNING_PRIVATE_KEY unset "
-                      f"or createUpdaterArtifacts disabled?)"
-                  )
-                  continue
-              bundle_path, sig_path = picked
-              signature = sig_path.read_text(encoding='utf-8').strip()
-              url = f"https://github.com/{REPO}/releases/download/{TAG}/{bundle_path.name}"
-              for target in entry['targets']:
-                  platforms[target] = {'signature': signature, 'url': url}
-              print(f"Added {entry['targets']} from {bundle_path.name}")
-
-          if skipped:
-              print("Skipped platforms:")
-              for s in skipped:
-                  print(f"  - {s}")
-
-          if not platforms:
-              print(
-                  "WARN: no signed updater bundles found - "
-                  "skipping latest.json generation"
-              )
-              sys.exit(0)
-
-          manifest = {
-              'version': VERSION,
-              'notes': f"See https://github.com/{REPO}/releases/tag/{TAG}",
-              'pub_date': datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ'),
-              'platforms': platforms,
-          }
-
-          out = Path('./artifacts/latest.json')
-          out.write_text(json.dumps(manifest, indent=2) + '\n', encoding='utf-8')
-          print(f"Generated {out} with platforms: {sorted(platforms.keys())}")
-          PYEOF
-
-      - name: Upload merged artifacts for review
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: release-artifacts
-          path: ./artifacts/
-          retention-days: 7
-
-      # Gate publish on valid updater sigs. Runs after the review upload (so
-      # artifacts survive for debugging) and before action-gh-release.
-      - name: Verify updater signatures
-        run: |
-          python3 -m pip install --quiet 'cryptography==44.0.0'
-          python3 .github/scripts/verify-updater-signatures.py \
-            ./artifacts/tauri frontend/editor/src-tauri/tauri.conf.json
-
-      # workflow_dispatch path requires platform=='all' so a single-platform
-      # dispatch can't overwrite an existing release's full latest.json with a
-      # partial one (action-gh-release defaults overwrite_files:true).
-      # release / V2-master always build the full matrix so no extra guard needed.
-      # fail_on_unmatched_files makes a missing latest.json or installer fail loudly
-      # instead of silently shipping a broken auto-update.
      - name: Upload binaries to Release
-        if: (github.event_name == 'workflow_dispatch' && github.event.inputs.test_mode != 'true' && github.event.inputs.platform == 'all') || github.event_name == 'release' || github.ref == 'refs/heads/V2-master'
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
        with:
          tag_name: v${{ needs.determine-matrix.outputs.version }}
          generate_release_notes: true
-          fail_on_unmatched_files: true
-          # Installers + updater payloads + manifest. .sig contents are embedded
-          # in latest.json so the .sig files themselves are not uploaded.
          files: |
            ./artifacts/**/*.jar
            ./artifacts/**/*.msi
            ./artifacts/**/*.dmg
-            ./artifacts/**/*.app.tar.gz
            ./artifacts/**/*.deb
            ./artifacts/**/*.rpm
            ./artifacts/**/*.AppImage
-            ./artifacts/latest.json
          draft: false
          prerelease: false
@@ -13,16 +13,12 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  playwright-all-browsers:
    name: Playwright (chromium + firefox + webkit)
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -37,15 +33,10 @@ jobs:
          cache-dependency-path: frontend/package-lock.json

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Install all Playwright browsers
        run: task e2e:install

-      - name: Build frontend (production bundle for vite preview)
-        env:
-          VITE_BUILD_FOR_PREVIEW: "1"
-        run: task frontend:build
-
      - name: Run E2E tests (all browsers)
        run: task e2e:cross-browser

@@ -54,18 +45,5 @@ jobs:
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: playwright-nightly-${{ github.run_id }}
-          path: frontend/editor/playwright-report/
+          path: frontend/playwright-report/
          retention-days: 14
-
-  # Builds all desktop platforms on a schedule so the Rust dependency cache is
-  # written on main, where PR and merge-queue tauri builds can restore it.
-  warm-tauri-cache:
-    name: Warm Tauri Rust cache
-    permissions:
-      contents: read
-      pull-requests: write
-    uses: ./.github/workflows/tauri-build.yml
-    with:
-      platform: all
-      sign: false
-    secrets: inherit
@@ -2,7 +2,7 @@ name: Update Package Manager Manifests

 on:
  release:
-    types: [released]
+    types: [ released ]
  workflow_dispatch:
    inputs:
      version:
@@ -28,7 +28,7 @@ jobs:
      jar_sha256: ${{ steps.hashes.outputs.jar_sha256 }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -79,12 +79,12 @@ jobs:
      contents: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: Checkout homebrew-stirling-pdf tap (also hosts Scoop bucket)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          repository: Stirling-Tools/homebrew-stirling-pdf
          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
@@ -1,7 +1,8 @@
 name: Pre-commit

-# Runs the repo-wide lint/format/secret checks via `task pre-commit`.
-# Called from build.yml on PRs and merge_group; also runnable on demand via workflow_dispatch.
+# Runs `pre-commit run` for ruff / codespell / gitleaks / EOF / trailing-ws.
+# Called from build.yml on PRs and merge_group; also runnable on demand via
+# workflow_dispatch for manual local-equivalent linting.
 on:
  workflow_call:
  workflow_dispatch:
@@ -12,9 +13,13 @@ permissions:
 jobs:
  pre-commit:
    runs-on: ubuntu-latest
+    env:
+      # Prevents sdist builds → no tar extraction
+      PIP_ONLY_BINARY: ":all:"
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -24,13 +29,23 @@ jobs:
          fetch-depth: 0
          persist-credentials: false

-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
-          enable-cache: true
+          python-version: 3.12
+          cache: "pip" # caching pip dependencies
+          cache-dependency-path: ./.github/scripts/requirements_pre_commit.txt

-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+      - name: Run Pre-Commit Hooks
+        run: |
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_pre_commit.txt

-      - name: Run pre-commit checks
-        run: task pre-commit
+      - name: Run Pre-Commit
+        run: |
+          pre-commit run ruff --all-files -c .pre-commit-config.yaml
+          pre-commit run ruff-format --all-files -c .pre-commit-config.yaml
+          pre-commit run codespell --all-files -c .pre-commit-config.yaml
+          pre-commit run gitleaks --all-files -c .pre-commit-config.yaml
+          pre-commit run end-of-file-fixer --all-files -c .pre-commit-config.yaml
+          pre-commit run trailing-whitespace --all-files -c .pre-commit-config.yaml
+          git diff --exit-code
@@ -43,7 +43,7 @@ jobs:
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -75,7 +75,7 @@ jobs:

      - name: Generate tags for base image
        id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base
@@ -100,7 +100,7 @@ jobs:
          sbom: true

      - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
        with:
          cosign-release: "v2.4.1"

@@ -53,7 +53,7 @@ jobs:
      RUN_UNOSERVER: ${{ github.event_name != 'workflow_dispatch' || inputs.build_unoserver }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -78,14 +78,14 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -96,13 +96,13 @@ jobs:

      - name: Install cosign
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
        with:
          cosign-release: "v2.4.1"

      - name: Install cosign
        if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master'
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
        with:
          cosign-release: "v2.4.1"

@@ -129,7 +129,7 @@ jobs:
      - name: Generate tags for latest
        id: meta
        if: env.RUN_MAIN_APP == 'true'
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ${{ secrets.DOCKER_HUB_USERNAME }}/s-pdf
@@ -155,9 +155,9 @@ jobs:
          cache-to: type=gha,mode=max,scope=stirling-pdf-latest
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          # No BASE_VERSION pin: inherit the Dockerfile ARG default (single source of truth).
          build-args: |
            VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
+            BASE_VERSION=1.0.0
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true
@@ -178,7 +178,7 @@ jobs:

      - name: Generate tags for latest-fat
        id: meta-fat
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
@@ -222,7 +222,7 @@ jobs:

      - name: Generate tags for ultra-lite
        id: meta-lite
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        if: env.RUN_MAIN_APP == 'true' && github.ref != 'refs/heads/main' && github.ref != 'refs/heads/testMain'
        with:
          images: |
@@ -18,7 +18,7 @@ jobs:
      packages: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -35,7 +35,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -75,6 +75,6 @@ jobs:

      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3.29.5
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v3.29.5
        with:
          sarif_file: results.sarif
@@ -17,12 +17,12 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

      - name: 30 days stale issues
-        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+        uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-stale: 30
@@ -22,18 +22,12 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  push:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -48,7 +42,7 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Generate Swagger documentation
        run: ./gradlew :stirling-pdf:generateOpenApiDocs
@@ -63,7 +57,7 @@ jobs:
          SWAGGERHUB_USER: "Frooodle"

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Get version number
        id: versionNumber
        run: echo "versionNumber=$(./gradlew printVersion --quiet | tail -1)" >> $GITHUB_OUTPUT
@@ -11,7 +11,7 @@ on:
      - "app/core/build.gradle"
      - "app/proprietary/build.gradle"
      - "README.md"
-      - "frontend/editor/public/locales/*/translation.toml"
+      - "frontend/public/locales/*/translation.toml"
      - "app/core/src/main/resources/static/3rdPartyLicenses.json"
      - "scripts/ignore_translation.toml"

@@ -35,7 +35,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -58,27 +58,19 @@ jobs:

      - name: Install Python dependencies
        run: |
-          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          enable-cache: true
-
-      - name: Install Task
-        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
+          pip install --require-hashes --only-binary=:all: -r ./.github/scripts/requirements_sync_readme.txt -r ./.github/scripts/requirements_pre_commit.txt

      - name: Sync translation TOML files
        run: |
-          python .github/scripts/check_language_toml.py --reference-file "frontend/editor/public/locales/en-US/translation.toml" --branch main
+          python .github/scripts/check_language_toml.py --reference-file "frontend/public/locales/en-GB/translation.toml" --branch main

-      - name: Sort translation TOML files
+      - name: pre-commit run
        run: |
-          task pre-commit:toml-sort FIX=1
+          pre-commit run toml-sort-fix --all-files

      - name: Commit translation files
        run: |
-          git add frontend/editor/public/locales/*/translation.toml
+          git add frontend/public/locales/*/translation.toml
          git diff --staged --quiet || git commit -m ":memo: Sync translation files (TOML)" || echo "No changes detected"

      - name: Sync README.md
@@ -108,7 +100,7 @@ jobs:
            This Pull Request was automatically generated to synchronize updates to translation files and documentation. Below are the details of the changes made:

            #### **1. Synchronization of Translation Files**
-            - Updated translation files (`frontend/editor/public/locales/*/translation.toml`) to reflect changes in the reference file `en-US/translation.toml`.
+            - Updated translation files (`frontend/public/locales/*/translation.toml`) to reflect changes in the reference file `en-GB/translation.toml`.
            - Ensured consistency and synchronization across all supported language files.
            - Highlighted any missing or incomplete translations.
            - **Format**: TOML
@@ -133,5 +125,5 @@ jobs:
          sign-commits: true
          add-paths: |
            README.md
-            frontend/editor/public/locales/*/translation.toml
+            frontend/public/locales/*/translation.toml
            scripts/ignore_translation.toml
@@ -4,10 +4,6 @@ name: Build Tauri Applications
 # Linux). Called from build.yml on PRs that touch desktop sources (gated
 # via the `tauri` filter in .github/config/.files.yaml). Also runnable
 # on demand via workflow_dispatch with a per-platform selector.
-#
-# Note: editing this file is itself enough to make the `tauri` path filter
-# match, which is how non-desktop PRs (e.g. backend-only fixes) opt into a
-# desktop smoke build.
 on:
  workflow_call:
    inputs:
@@ -16,11 +12,6 @@ on:
        required: false
        type: string
        default: "all"
-      sign:
-        description: "Sign and notarize the bundles."
-        required: false
-        type: boolean
-        default: true
  workflow_dispatch:
    inputs:
      platform:
@@ -33,11 +24,6 @@ on:
          - windows
          - macos
          - linux
-      sign:
-        description: "Sign and notarize the bundles."
-        required: false
-        default: true
-        type: boolean

 permissions:
  contents: read
@@ -51,7 +37,7 @@ jobs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -61,10 +47,12 @@ jobs:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          PLATFORM: ${{ inputs.platform }}
        run: |
-          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64","jpdfium_platforms":"windows-x64"}'
-          MACOS='{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal","jpdfium_platforms":"darwin-arm64,darwin-x64"}'
-          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64","jpdfium_platforms":"linux-x64"}'
+          WINDOWS='{"platform":"windows-latest","args":"--target x86_64-pc-windows-msvc","name":"windows-x86_64"}'
+          MACOS='{"platform":"macos-15","args":"--target universal-apple-darwin","name":"macos-universal"}'
+          LINUX='{"platform":"ubuntu-22.04","args":"","name":"linux-x86_64"}'

+          # Resolve requested platform — populated by either workflow_dispatch
+          # or workflow_call inputs; both paths default to "all".
          case "$PLATFORM" in
            windows) ENTRIES=("$WINDOWS") ;;
            macos)   ENTRIES=("$MACOS") ;;
@@ -96,10 +84,9 @@ jobs:
      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
      RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -125,20 +112,10 @@ jobs:
          toolchain: stable
          targets: ${{ matrix.platform == 'macos-15' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}

-      # Cache the Cargo registry and compiled dependency crates so the build
-      # only recompiles the app crate. Written on main; PRs and the merge queue
-      # restore from it.
-      - name: Cache Rust build
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          workspaces: frontend/editor/src-tauri
-          # Stable key shared across workflows so the nightly warmer.
-          # rust-cache still appends OS + rustc + Cargo.lock.
-          shared-key: tauri-${{ matrix.name }}
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-          # Save the dependency cache even if a later step fails
-          cache-on-failure: true
-
+      # x86_64 JDK is set up first so the aarch64 step below can leave its
+      # JAVA_HOME as the active one. The macOS universal JRE build needs
+      # jmods from both arches; the x64 path is captured into the env
+      # before the second setup-java overwrites JAVA_HOME.
      - name: Set up x86_64 JDK 25 (macOS universal JRE)
        if: matrix.platform == 'macos-15'
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
@@ -160,34 +137,31 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Setup Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

+      # Build the universal JRE before desktop:prepare so the jlink:runtime
+      # task short-circuits on its `test -d runtime/jre` status check.
      - name: Build universal macOS JRE
        if: matrix.platform == 'macos-15'
        env:
          AARCH64_JAVA_HOME: ${{ env.JAVA_HOME }}
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
        run: task desktop:jlink:universal-mac

      - name: Prepare desktop build
+        run: task desktop:prepare
        env:
          MAVEN_USER: ${{ secrets.MAVEN_USER }}
          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true
-          JPDFIUM_PLATFORMS: ${{ matrix.jpdfium_platforms }}
-        run: task desktop:prepare
-
-      - name: Run Tauri/Cargo tests
-        run: task desktop:test

      # DigiCert KeyLocker Setup (Cloud HSM)
      - name: Setup DigiCert KeyLocker
        id: digicert-setup
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
        uses: digicert/ssm-code-signing@1d820463733701cf1484c7eb5d7d24a15ca2c454 # v1.2.1
        env:
          SM_API_KEY: ${{ secrets.SM_API_KEY }}
@@ -197,7 +171,7 @@ jobs:
          SM_HOST: ${{ secrets.SM_HOST }}

      - name: Setup DigiCert KeyLocker Certificate
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
        shell: pwsh
        run: |
          Write-Host "Setting up DigiCert KeyLocker environment..."
@@ -232,7 +206,7 @@ jobs:

      # Traditional PFX Certificate Import (fallback if KeyLocker not configured)
      - name: Import Windows Code Signing Certificate
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY == '' && github.ref == 'refs/heads/main' }}
        env:
          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
@@ -263,7 +237,7 @@ jobs:
          }

      - name: Import Apple Developer Certificate
-        if: inputs.sign && matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
@@ -284,7 +258,7 @@ jobs:
          rm certificate.p12

      - name: Verify Certificate
-        if: inputs.sign && matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
+        if: matrix.platform == 'macos-15' && env.APPLE_CERTIFICATE != ''
        run: |
          echo "Verifying Apple Developer Certificate..."
          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
@@ -307,7 +281,7 @@ jobs:
          ls -la /usr/bin/hd* || echo "No hd* tools found"

      - name: Preflight smctl
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
        shell: pwsh
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
@@ -320,12 +294,12 @@ jobs:
          if ($LASTEXITCODE -ne 0) { Write-Host "[WARN] smctl windows certsync returned non-zero - continuing" }

      - name: Configure Windows code signing
-        if: ${{ inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
+        if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main' }}
        shell: bash
        env:
          KEYPAIR_ALIAS: ${{ secrets.SM_KEYPAIR_ALIAS }}
        run: |
-          cat > ./frontend/editor/src-tauri/tauri.windows.conf.json <<EOF
+          cat > ./frontend/src-tauri/tauri.windows.conf.json <<EOF
          {
            "bundle": {
              "windows": {
@@ -339,7 +313,7 @@ jobs:
          EOF

      - name: Import release GPG signing key (Linux)
-        if: inputs.sign && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
+        if: matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
        run: |
          echo "$RELEASE_GPG_PRIVATE_KEY" | gpg --batch --import
          gpg --list-secret-keys --keyid-format=long
@@ -356,8 +330,7 @@ jobs:
            exit 1
          fi

-      - name: Build Tauri app (signed)
-        if: inputs.sign
+      - name: Build Tauri app
        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -384,27 +357,7 @@ jobs:
          SM_CODE_SIGNING_CERT_SHA1_HASH: ${{ secrets.SM_CODE_SIGNING_CERT_SHA1_HASH }}
          CI: true
        with:
-          projectPath: ./frontend/editor
-          tauriScript: npx tauri
-          # Linux: build deb+rpm only here. AppImage runs in its own
-          # continue-on-error step below so its persistent linuxdeploy
-          # failure (#6127 onwards) does not tank deb/rpm uploads.
-          args: ${{ matrix.platform == 'ubuntu-22.04' && '--bundles deb,rpm' || matrix.args }}
-
-      - name: Build Tauri app (unsigned)
-        if: ${{ !inputs.sign }}
-        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SIGN: "0"
-          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
-          VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY: ${{ secrets.VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY || 'sb_publishable_UHz2SVRF5mvdrPHWkRteyA_yNlZTkYb' }}
-          VITE_SAAS_SERVER_URL: ${{ secrets.VITE_SAAS_SERVER_URL || 'https://app.stirlingpdf.com' }}
-          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
-          CI: true
-        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          # Linux: build deb+rpm only here. AppImage runs in its own
          # continue-on-error step below so its persistent linuxdeploy
@@ -419,7 +372,7 @@ jobs:
        uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SIGN: ${{ (inputs.sign && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
+          SIGN: ${{ (env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main') && '1' || '0' }}
          APPIMAGETOOL_SIGN_PASSPHRASE: ${{ secrets.RELEASE_GPG_PASSPHRASE }}
          SIGN_KEY: ${{ vars.RELEASE_GPG_FINGERPRINT }}
          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
@@ -429,12 +382,12 @@ jobs:
          VITE_SAAS_BACKEND_API_URL: ${{ secrets.VITE_SAAS_BACKEND_API_URL || 'https://api.stirlingpdf.com' }}
          CI: true
        with:
-          projectPath: ./frontend/editor
+          projectPath: ./frontend
          tauriScript: npx tauri
          args: --bundles appimage

      - name: Clear release GPG key from runner keyring (Linux)
-        if: always() && inputs.sign && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
+        if: always() && matrix.platform == 'ubuntu-22.04' && env.RELEASE_GPG_PRIVATE_KEY != '' && github.ref == 'refs/heads/main'
        env:
          RELEASE_GPG_FINGERPRINT: ${{ vars.RELEASE_GPG_FINGERPRINT }}
        run: |
@@ -444,10 +397,10 @@ jobs:
          fi

      - name: Verify notarization (macOS only)
-        if: inputs.sign && matrix.platform == 'macos-15'
+        if: matrix.platform == 'macos-15'
        run: |
          echo "🔍 Verifying notarization status..."
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target
          DMG_FILE=$(find . -name "*.dmg" | head -1)
          if [ -n "$DMG_FILE" ]; then
            echo "Found DMG: $DMG_FILE"
@@ -461,28 +414,26 @@ jobs:
      - name: Rename artifacts
        shell: bash
        run: |
-          # Absolute dist path so the cd below can't break the copy targets.
-          DIST="$GITHUB_WORKSPACE/dist"
-          mkdir -p "$DIST"
-          cd ./frontend/editor/src-tauri/target
+          mkdir -p ./dist
+          cd ./frontend/src-tauri/target

          # Find and rename artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
            # Only ship the MSI installer. The loose exe and WiX toolset exes
            # are not the user-facing installer - the MSI contains the signed inner exe.
-            find . -name "*.msi" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.msi" \;
+            find . -name "*.msi" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.msi" \;
          elif [ "${{ matrix.platform }}" = "macos-15" ]; then
-            find . -name "*.dmg" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.dmg" \;
+            find . -name "*.dmg" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.dmg" \;
          else
-            find . -name "*.deb" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.deb" \;
-            find . -name "*.rpm" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.rpm" \;
-            find . -name "*.AppImage" -exec cp {} "$DIST/Stirling-PDF-${{ matrix.name }}.AppImage" \;
+            find . -name "*.deb" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.deb" \;
+            find . -name "*.rpm" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.rpm" \;
+            find . -name "*.AppImage" -exec cp {} "../../../dist/Stirling-PDF-${{ matrix.name }}.AppImage" \;
          fi

      # Verify the MSI AND the inner exe extracted from it are signed.
      # The inner exe is what gets installed on users' machines and what AV scans.
      - name: Verify Windows Code Signature
-        if: inputs.sign && matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main'
+        if: matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && github.ref == 'refs/heads/main'
        shell: pwsh
        run: |
          $allSigned = $true
@@ -554,7 +505,7 @@ jobs:
      - name: Verify build artifacts
        shell: bash
        run: |
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target

          # Check for expected artifacts based on platform
          if [ "${{ matrix.platform }}" = "windows-latest" ]; then
@@ -585,7 +536,7 @@ jobs:
      - name: Test artifact sizes
        shell: bash
        run: |
-          cd ./frontend/editor/src-tauri/target
+          cd ./frontend/src-tauri/target
          echo "Artifact sizes for ${{ matrix.name }}:"
          find . -name "*.exe" -o -name "*.dmg" -o -name "*.deb" -o -name "*.rpm" -o -name "*.AppImage" -o -name "*.msi" | while read file; do
            if [ -f "$file" ]; then
@@ -606,7 +557,7 @@ jobs:
      pull-requests: write
    steps:
      - name: Harden the runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -697,7 +648,7 @@ jobs:
    if: always()
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -12,19 +12,11 @@ on:
        required: false
        type: string
        default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"

 permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  # TODO: extract a pre-matrix `prepare` job that runs once and produces
  # shared artifacts for the three matrix entries below to consume:
  #   1. `task backend:build` — currently runs 3× in parallel with
@@ -40,14 +32,7 @@ jobs:
  # spring-security=true matrix entry if `task backend:build` and
  # `task backend:build:ci` produce equivalent JARs (verify before wiring).
  test-build-docker-images:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
@@ -63,7 +48,7 @@ jobs:
            cache-scope: stirling-pdf-fat
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -106,11 +91,11 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1
          cache-disabled: true

      - name: Install Task
-        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+        uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
      - name: Build application
        run: task backend:build
        env:
@@ -120,16 +105,10 @@ jobs:
          DISABLE_ADDITIONAL_FEATURES: true
          STIRLING_PDF_DESKTOP_UI: false

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        id: buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

@@ -155,37 +134,7 @@ jobs:
            echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
          fi

-      # Base-changed PRs build the embedded image with the local docker driver
-      # so the locally-built stirling-pdf-base:pr-test (in the daemon image
-      # store) resolves. A buildx container builder cannot see it and would try
-      # to pull it from a registry, which fails. Single-platform, no gha cache.
-      - name: Build ${{ matrix.docker-rev }} against local base (PR base change)
-        if: github.event_name == 'pull_request' && inputs.docker-base-changed == 'true'
-        run: |
-          DOCKER_BUILDKIT=1 docker build \
-            --build-arg BASE_IMAGE=${{ steps.build-params.outputs.base_image }} \
-            --file ./${{ matrix.docker-rev }} \
-            --tag stirling-pdf-embedded:pr-test \
-            .
-
-      - name: Build ${{ matrix.docker-rev }} (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./${{ matrix.docker-rev }}
-          push: false
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
-          provenance: true
-          sbom: true
-
-      # Fork PRs that did NOT change the base use the buildx container builder
-      # (multi-platform + gha cache) against the published base image.
-      - name: Build ${{ matrix.docker-rev }} (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && inputs.docker-base-changed != 'true'
+      - name: Build ${{ matrix.docker-rev }}
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -213,52 +162,24 @@ jobs:
          if-no-files-found: warn

  test-build-unoserver-image:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
        with:
          egress-policy: audit

      - name: Checkout Repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0

      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        id: buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

-      - name: Build docker/unoserver/Dockerfile (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: false
-          load: true
-          platforms: linux/amd64
-          tags: stirling-unoserver:pr-test
-          provenance: false
-          sbom: false
-
-      - name: Build docker/unoserver/Dockerfile (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build docker/unoserver/Dockerfile
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
@@ -20,22 +20,12 @@ permissions:
  contents: read

 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
  deploy:
    if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -51,7 +41,7 @@ jobs:
      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
-          gradle-version: 9.6.0
+          gradle-version: 9.3.1

      - name: Build with Gradle
        run: ./gradlew build
@@ -61,12 +51,7 @@ jobs:
          MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
          DISABLE_ADDITIONAL_FEATURES: true

-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
      - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Get version number
@@ -81,20 +66,7 @@ jobs:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

-      - name: Build and push test image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64
-
-      - name: Build and push test image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build and push test image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
@@ -129,7 +101,7 @@ jobs:
              environment:
                DISABLE_ADDITIONAL_FEATURES: "true"
                SECURITY_ENABLELOGIN: "false"
-                SYSTEM_DEFAULTLOCALE: en-US
+                SYSTEM_DEFAULTLOCALE: en-GB
                UI_APPNAME: "Stirling-PDF Test"
                UI_HOMEDESCRIPTION: "Test Deployment"
                UI_APPNAMENAVBAR: "Test"
@@ -153,14 +125,13 @@ jobs:
  files-changed:
    if: always()
    name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ubuntu-latest
    timeout-minutes: 3
    outputs:
      frontend: ${{ steps.changes.outputs.frontend }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -174,11 +145,12 @@ jobs:

  test:
    if: needs.files-changed.outputs.frontend == 'true'
-    needs: [pick, deploy, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: [deploy, files-changed]
+    runs-on: ubuntu-latest
+
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -208,13 +180,13 @@ jobs:
          FORCE_COLOR: "3"

  cleanup:
-    needs: [pick, deploy, test]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    needs: [deploy, test]
+    runs-on: ubuntu-latest
    if: always()

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: audit

@@ -23,10 +23,6 @@ customFiles/
 configs/
 watchedFolders/
 clientWebUI/
-# Scratch dir used by local fixture-regeneration runs (see
-# app/proprietary/src/test/resources/db-migration-fixtures/README.md).
-# Holds downloaded JARs and disposable workdirs. Never committed.
-.alpha-local/
 !cucumber/
 !cucumber/exampleFiles/
 !cucumber/exampleFiles/example_html.zip
@@ -46,12 +42,6 @@ app/core/storage/
 # These are generated by npm build and should not be committed
 app/core/src/main/resources/static/assets/
 app/core/src/main/resources/static/index.html
-# Prerendered per-route SPA pages (OG/social-preview), e.g. compress.html. api-landing.html is source.
-app/core/src/main/resources/static/*.html
-!app/core/src/main/resources/static/api-landing.html
-!app/core/src/main/resources/static/mobile-upload.html
-# Prerendered nested-route pages (e.g. settings/people.html)
-app/core/src/main/resources/static/settings/
 app/core/src/main/resources/static/locales/
 app/core/src/main/resources/static/Login/
 app/core/src/main/resources/static/classic-logo/
@@ -59,14 +49,10 @@ app/core/src/main/resources/static/modern-logo/
 app/core/src/main/resources/static/og_images/
 app/core/src/main/resources/static/samples/
 app/core/src/main/resources/static/manifest-classic.json
-app/core/src/main/resources/static/og-metadata.json
-app/core/src/main/resources/static/sw-folder-retry.js
 app/core/src/main/resources/static/robots.txt
 app/core/src/main/resources/static/pdfium/
 app/core/src/main/resources/static/pdfjs/
 app/core/src/main/resources/static/vendor/
-app/core/src/main/resources/static/**/*.gz
-app/core/src/main/resources/static/**/*.br
 # Note: Keep backend-managed files like fonts/, css/, js/, pdfjs/, etc.

 # Gradle
@@ -171,7 +157,7 @@ app/proprietary/build
 common/build
 proprietary/build
 stirling-pdf/build
-frontend/editor/src-tauri/provisioner/target
+frontend/src-tauri/provisioner/target

 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -222,7 +208,7 @@ out/
 *.asc

 # Allow test fixture certificates (synthetic, no real credentials)
-!frontend/editor/src/core/tests/test-fixtures/certs/**
+!frontend/src/core/tests/test-fixtures/certs/**

 # SSH Keys
 *.pub
@@ -264,7 +250,7 @@ node_modules/
 *compact*.json
 test_batch.json
 *.backup.*.json
-frontend/editor/public/locales/*/translation.backup*.json
+frontend/public/locales/*/translation.backup*.json

 # Development/build artifacts
 .gradle-cache/
@@ -279,14 +265,9 @@ docs/type3/signatures/
 # Type3 sample PDFs (development only)
 **/type3/samples/

-**/application-dev-local.properties
-
 # Claude
 .claude/

 # Playwright MCP screenshots / traces
 .playwright-mcp/
 *.playwright-mcp.png
-
-# Local screenshot artifacts from *-screenshots.spec.ts
-frontend/editor/screenshots/
@@ -1,29 +0,0 @@
-# PostHog project-level key - phc_ prefix keys are public/client-side by design
-# (PostHog client-side tracking embeds them in the browser bundle). Committed
-# intentionally in #6150 so engine/.env has a working default, with real
-# credentials overridden via engine/.env.local.
-engine/.env:generic-api-key:41
-
-# MCP test fixtures / harness - no real secrets:
-# - test-only API key constant in an integration test
-# - JDBC URL + throwaway Keycloak creds in the local test compose
-# - placeholder / shell-variable Bearer headers in curl-based validation scripts
-app/proprietary/src/test/java/stirling/software/proprietary/mcp/security/McpApiKeyIntegrationTest.java:generic-api-key:40
-testing/compose/docker-compose-keycloak-mcp.yml:generic-api-key:25
-testing/compose/validate-mcp-apikey.sh:curl-auth-header:73
-testing/compose/validate-mcp-test.sh:curl-auth-header:92
-testing/compose/validate-mcp-test.sh:curl-auth-header:116
-
-# Storybook example showing curl with a fake Bearer token placeholder (sk_live_a3f8...).
-frontend/shared/components/CodeBlock.stories.tsx:curl-auth-header:4
-
-# Truncated placeholder API key in portal docs example (sk_live_8f2c...e10) - not a real secret.
-frontend/portal/src/components/docs/GettingStartedSection.tsx:generic-api-key:31
-
-# False positive: generic-api-key matches the Java type name "X509Certificate"
-# in a method signature (CreateSignatureBase.resolveSignatureAlgorithm) - not a secret.
-app/core/src/main/java/org/apache/pdfbox/examples/signature/CreateSignatureBase.java:generic-api-key:224
-
-# Supabase publishable key (public by design, RLS-protected) used as a CI fallback
-# default in the tauri-build workflow when the GitHub secret is unset - not a real secret.
-.github/workflows/tauri-build.yml:generic-api-key:402
@@ -1,14 +1,52 @@
-# The actual checks live in .taskfiles/pre-commit.yml (with helper scripts under
-# scripts/pre-commit/) and are driven by Task. This hook just delegates to `task
-# pre-commit` so the git pre-commit hook, CI and a manual `task pre-commit` all
-# run the exact same thing. Requires `task` and `uv` on PATH. To auto-fix instead
-# of only checking, run `task pre-commit:fix`.
 repos:
-  - repo: local
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.11
    hooks:
-      - id: task-pre-commit
-        name: task pre-commit
-        entry: task pre-commit
-        language: system
-        pass_filenames: false
-        always_run: true
+      - id: ruff
+        args:
+          - --fix
+          - --line-length=127
+        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+      - id: ruff-format
+        files: ^((\.github/scripts|scripts|app/core/src/main/resources/static/python)/.+)?[^/]+\.py$
+        exclude: (split_photos.py)
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.4.2
+    hooks:
+      - id: codespell
+        args:
+          - --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment
+          - --skip="./.*,*.csv,*.json,*.ambr"
+          - --quiet-level=2
+        files: \.(html|css|js|py|md)$
+        exclude: (.vscode|.devcontainer|app/core/src/main/resources|app/proprietary/src/main/resources|frontend/public/vendor|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js)
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: end-of-file-fixer
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+      - id: trailing-whitespace
+        files: ^.*(\.js|\.java|\.py|\.yml)$
+        exclude: ^(.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js|\.github/workflows/.*$)
+  - repo: https://github.com/pappasam/toml-sort
+    rev: v0.24.4
+    hooks:
+      - id: toml-sort-fix
+        files: frontend/public/locales/.*\.toml$
+        args: ['--in-place', '--all', '--ignore-case']
+  # - repo: https://github.com/thibaudcolas/pre-commit-stylelint
+  #   rev: v16.21.1
+  #   hooks:
+  #     - id: stylelint
+  #       additional_dependencies:
+  #         - stylelint@16.21.1
+  #         - stylelint-config-standard@38.0.0
+  #         - "@stylistic/stylelint-plugin@3.1.3"
+  #       files: \.(css)$
+  #       args: [--fix]
@@ -1,136 +1,55 @@
 version: '3'

-# Gradle invocation strategy:
-#   - Linux/macOS: `./gradlew` runs the POSIX shell wrapper natively.
-#   - Windows:     `cmd /c ".\gradlew.bat ..."` invokes the .bat wrapper through
-#                  cmd.exe so it inherits the user's Windows-side `JAVA_HOME`
-#                  and PATH. Routing through `bash gradlew` on Windows ends up
-#                  under WSL or Git-Bash, neither of which inherits
-#                  Adoptium/Temurin's default Windows-only Java env - gradlew
-#                  then errors with "JAVA_HOME is not set and no 'java' command
-#                  could be found".
-#
-#                  The entire `.\gradlew.bat ...` payload is double-quoted so
-#                  the leading `.\` survives mvdan/sh's POSIX backslash
-#                  stripping; cmd.exe also requires `.\` (not bare `gradlew.bat`)
-#                  because modern Windows excludes cwd from cmd's search path.
+# All gradle invocations go through `bash gradlew` (the sh wrapper) so they work
+# uniformly on Linux/macOS (native bash) and Windows-with-Git-Bash.

 tasks:
  dev:
    desc: "Start backend dev server"
-    cmds:
-      - task: dev:proprietary
-        vars:
-          PORT: '{{.PORT}}'
-          AIENGINE_URL: '{{.AIENGINE_URL}}'
-          AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-          AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-          SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN}}'
-          POLICIES_ENABLED: '{{.POLICIES_ENABLED}}'
-
-  dev:proprietary:
-    desc: "Start backend dev server in proprietary mode"
-    # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`. Local overrides in
-    # .env.proprietary.local win over the committed .env.proprietary defaults.
-    dotenv: ['app/.env.proprietary.local', 'app/.env.proprietary']
    ignore_error: true
    vars:
      PORT: '{{.PORT | default "8080"}}'
      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
-      SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN | default ""}}'
-      POLICIES_ENABLED: '{{.POLICIES_ENABLED | default ""}}'
    env:
      SERVER_PORT: '{{.PORT}}'
    cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}{{if .POLICIES_ENABLED}}POLICIES_ENABLED={{.POLICIES_ENABLED}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
-        platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}{{if .POLICIES_ENABLED}}POLICIES_ENABLED={{.POLICIES_ENABLED}} {{end}}./gradlew :stirling-pdf:bootRun'
-        platforms: [linux, darwin]
+      - '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED=true {{end}}bash gradlew :stirling-pdf:bootRun'

  dev:bundled:
    desc: "Clean + bootRun with frontend bundled into the backend (single :8080 server)"
    ignore_error: true
    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean bootRun -PbuildWithFrontend=true"
-        platforms: [windows]
-      - cmd: ./gradlew clean bootRun -PbuildWithFrontend=true
-        platforms: [linux, darwin]
-
-  dev:saas:
-    desc: "Start backend in SaaS flavor against Supabase"
-    # `dotenv:` reads from the root Taskfile's directory (".") because this
-    # subtaskfile is included with `dir: .`.
-    dotenv: ['app/.env.saas.local', 'app/.env.saas']
-    ignore_error: true
-    vars:
-      PORT: '{{.PORT | default "8080"}}'
-      # Override to "" to run the pure `saas` profile against your own SAAS_DB_*.
-      PROFILES: '{{.PROFILES | default "dev"}}'
-      AIENGINE_URL: '{{.AIENGINE_URL | default ""}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
-    env:
-      SERVER_PORT: '{{.PORT}}'
-      STIRLING_FLAVOR: saas
-      AIENGINE_URL: '{{.AIENGINE_URL}}'
-      AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
-      AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
-    cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:bootRun {{if .PROFILES}}--args=\"--spring.profiles.include={{.PROFILES}}\"{{end}}"
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:bootRun {{if .PROFILES}}--args='--spring.profiles.include={{.PROFILES}}'{{end}}
-        platforms: [linux, darwin]
+      - bash gradlew clean bootRun -PbuildWithFrontend=true

  build:
    desc: "Full backend build"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build"
-        platforms: [windows]
-      - cmd: ./gradlew clean build
-        platforms: [linux, darwin]
+      - bash gradlew clean build

  build:fast:
    desc: "Build without tests"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean build -x test"
-        platforms: [windows]
-      - cmd: ./gradlew clean build -x test
-        platforms: [linux, darwin]
+      - bash gradlew clean build -x test

  build:ci:
    desc: "Build for CI (formatting checked separately)"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat build -PnoSpotless"
-        platforms: [windows]
-      - cmd: ./gradlew build -PnoSpotless
-        platforms: [linux, darwin]
+      - bash gradlew build -PnoSpotless

  test:
    desc: "Run backend tests"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat test"
-        platforms: [windows]
-      - cmd: ./gradlew test
-        platforms: [linux, darwin]
+      - bash gradlew test

  format:
    desc: "Auto-fix code formatting"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessApply"
-        platforms: [windows]
-      - cmd: ./gradlew spotlessApply
-        platforms: [linux, darwin]
+      - bash gradlew spotlessApply

  format:check:
    desc: "Check code formatting"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat spotlessCheck"
-        platforms: [windows]
-      - cmd: ./gradlew spotlessCheck
-        platforms: [linux, darwin]
+      - bash gradlew spotlessCheck

  fix:
    desc: "Auto-fix backend"
@@ -140,10 +59,7 @@ tasks:
  swagger:
    desc: "Generate OpenAPI docs"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat :stirling-pdf:copySwaggerDoc"
-        platforms: [windows]
-      - cmd: ./gradlew :stirling-pdf:copySwaggerDoc
-        platforms: [linux, darwin]
+      - bash gradlew :stirling-pdf:copySwaggerDoc
    sources:
      - app/core/src/main/java/**/*.java
      - app/proprietary/src/main/java/**/*.java
@@ -161,31 +77,19 @@ tasks:
    desc: "Print project version"
    silent: true
    cmds:
-      - cmd: cmd /c ".\gradlew.bat printVersion --quiet" | tail -1
-        platforms: [windows]
-      - cmd: ./gradlew printVersion --quiet | tail -1
-        platforms: [linux, darwin]
+      - bash gradlew printVersion --quiet | tail -1

  licenses:check:
    desc: "Check dependency licenses"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense --no-parallel"
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense --no-parallel
-        platforms: [linux, darwin]
+      - bash gradlew checkLicense --no-parallel

  licenses:generate:
    desc: "Check and generate dependency license report"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat checkLicense generateLicenseReport --no-parallel"
-        platforms: [windows]
-      - cmd: ./gradlew checkLicense generateLicenseReport --no-parallel
-        platforms: [linux, darwin]
+      - bash gradlew checkLicense generateLicenseReport --no-parallel

  clean:
    desc: "Clean build artifacts"
    cmds:
-      - cmd: cmd /c ".\gradlew.bat clean"
-        platforms: [windows]
-      - cmd: ./gradlew clean
-        platforms: [linux, darwin]
+      - bash gradlew clean
@@ -1,30 +1,7 @@
 version: '3'

 vars:
-  # jdk.dynalink is required by VeraPDF (PDF/A validation); without it the bundled JRE throws
-  # NoClassDefFoundError: jdk/dynalink/Namespace at runtime in get-info-on-pdf and verify-pdf
-  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported,jdk.dynalink"
-
-  # Minimum Java major the bundled JRE must be. Keep in sync with build.gradle
-  # `modernJavaVersion` - the app JAR is compiled for this, so an older runtime
-  # fails at launch with UnsupportedClassVersionError. Enforced by jlink:verify.
-  REQUIRED_JAVA: "25"
-
-  # Override via JPDFIUM_PLATFORMS env (csv of platform keys, or 'all').
-  JPDFIUM_PLATFORMS:
-    sh: |
-      if [ -n "${JPDFIUM_PLATFORMS:-}" ]; then
-          echo "$JPDFIUM_PLATFORMS"
-      else
-          case "{{OS}}-{{ARCH}}" in
-              darwin-arm64)  echo "darwin-arm64";;
-              darwin-amd64)  echo "darwin-x64";;
-              linux-amd64)   echo "linux-x64";;
-              linux-arm64)   echo "linux-arm64";;
-              windows-amd64) echo "windows-x64";;
-              *)             echo "all";;
-          esac
-      fi
+  JLINK_MODULES: "java.base,java.compiler,java.desktop,java.instrument,java.logging,java.management,java.naming,java.net.http,java.prefs,java.rmi,java.scripting,java.security.jgss,java.security.sasl,java.sql,java.transaction.xa,java.xml,java.xml.crypto,jdk.crypto.ec,jdk.crypto.cryptoki,jdk.unsupported"

 tasks:
  prepare:
@@ -38,7 +15,6 @@ tasks:
  provisioner:
    desc: "Build installer provisioner"
    platforms: [windows]
-    dir: editor
    cmds:
      - node scripts/build-provisioner.mjs

@@ -46,55 +22,41 @@ tasks:
    desc: "Start Tauri desktop dev mode"
    deps: [prepare]
    ignore_error: true
-    dir: editor
    cmds:
      - npx tauri dev --no-watch

  build:
    desc: "Build Tauri desktop app (production)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build

  build:dev:
    desc: "Build Tauri desktop app (dev, no bundling)"
    deps: [prepare]
-    dir: editor
    cmds:
      - npx tauri build --no-bundle

  build:dev:mac:
    desc: "Build Tauri desktop .app bundle (macOS)"
    deps: [prepare]
-    dir: editor
    cmds:
-      - npx tauri build --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
+      - npx tauri build --bundles app

  build:dev:windows:
    desc: "Build Tauri desktop NSIS installer (Windows)"
    deps: [prepare]
-    dir: editor
    cmds:
-      - npx tauri build --bundles nsis --config '{"bundle":{"createUpdaterArtifacts":false}}'
+      - npx tauri build --bundles nsis

  build:dev:linux:
    desc: "Build Tauri desktop AppImage (Linux)"
    deps: [prepare]
-    dir: editor
    cmds:
-      - npx tauri build --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
-
-  test:
-    desc: "Run Tauri/Cargo tests"
-    deps: [prepare]
-    dir: editor/src-tauri
-    cmds:
-      - cargo test
+      - npx tauri build --bundles appimage

  clean:
    desc: "Clean Tauri/Cargo build artifacts"
-    dir: editor
    cmds:
      - task: jlink:clean
      - cd src-tauri && cargo clean
@@ -107,103 +69,44 @@ tasks:
  jlink:
    desc: "Build backend JAR and create JLink runtime for Tauri"
    deps: [jlink:jar, jlink:runtime]
-    # Runs after the runtime is in place. Lives here (not in jlink:runtime's
-    # cmds) so it still fires when jlink:runtime short-circuits on its `status:`
-    # check and reuses an existing runtime/jre - that reuse path is exactly how
-    # a stale, too-old JRE slips through.
-    cmds:
-      - task: jlink:verify
-
-  jlink:verify:
-    desc: "Fail the build if the bundled JRE is older than the app JAR requires"
-    dir: editor
-    env:
-      REQUIRED_JAVA: "{{.REQUIRED_JAVA}}"
-    cmds:
-      - node scripts/verify-bundled-jre.mjs src-tauri/runtime/jre/release

  jlink:jar:
-    desc: "Build backend JAR for Tauri bundling (host-OS natives only by default)"
+    desc: "Build backend JAR for Tauri bundling"
    run: once
    dir: ..
    env:
      DISABLE_ADDITIONAL_FEATURES: "true"
    cmds:
-      - echo "Building bootJar with JPDFium natives for {{.JPDFIUM_PLATFORMS}}"
-      - cmd: cmd /c gradlew.bat bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
+      - cmd: cmd /c gradlew.bat bootJar --no-daemon
        platforms: [windows]
-      - cmd: ./gradlew bootJar --no-daemon -PjpdfiumPlatforms={{.JPDFIUM_PLATFORMS}}
+      - cmd: ./gradlew bootJar --no-daemon
        platforms: [linux, darwin]
-      - mkdir -p frontend/editor/src-tauri/libs
-      - cp app/core/build/libs/stirling-pdf-*.jar frontend/editor/src-tauri/libs/
+      - mkdir -p frontend/src-tauri/libs
+      - cp app/core/build/libs/stirling-pdf-*.jar frontend/src-tauri/libs/
    status:
-      - test -f frontend/editor/src-tauri/libs/stirling-pdf-*.jar
+      - test -f frontend/src-tauri/libs/stirling-pdf-*.jar

  jlink:runtime:
    desc: "Create custom JRE with jlink"
    deps: [jlink:jar]
-    dir: editor/src-tauri
    cmds:
-      - rm -rf runtime/jre
-      - mkdir -p runtime
-      # Pin jlink to JAVA_HOME so the bundled JRE matches the JDK the build
-      # uses. Bare `jlink` on PATH can resolve to an older system Java (the
-      # ubuntu runner ships Java 11), producing a runtime jlink:verify rejects.
-      #
-      # jdk.crypto.mscapi (the Windows certificate store / SunMSCAPI provider, used by
-      # hardware-backed cert signing) is a Windows-only module - it only exists in a Windows
-      # JDK's jmods, so it is added on Windows only or jlink fails to resolve it elsewhere.
-      - cmd: |
-          JLINK="${JAVA_HOME:+$JAVA_HOME/bin/}jlink"
-          JLINK_COMPRESS="$("$JLINK" --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
-          "$JLINK" \
-            --add-modules {{.JLINK_MODULES}},jdk.crypto.mscapi \
-            --strip-debug \
-            --compress="$JLINK_COMPRESS" \
-            --no-header-files \
-            --no-man-pages \
-            --output runtime/jre
-        platforms: [windows]
-      - cmd: |
-          JLINK="${JAVA_HOME:+$JAVA_HOME/bin/}jlink"
-          JLINK_COMPRESS="$("$JLINK" --help 2>&1 | grep -q 'zip-\[0-9\]' && echo zip-6 || echo 2)"
-          "$JLINK" \
-            --add-modules {{.JLINK_MODULES}} \
-            --strip-debug \
-            --compress="$JLINK_COMPRESS" \
-            --no-header-files \
-            --no-man-pages \
-            --output runtime/jre
-        platforms: [linux, darwin]
-      # jlink emits its files mode 444 (read-only). Tauri's build-script
-      # resource copier preserves source permissions when staging
-      # `runtime/jre/**/*` into `target/<profile>/runtime/jre/...`, so the
-      # staged copies are read-only too. On any subsequent incremental
-      # build the copier tries to overwrite them and fails with a bare
-      # `Permission denied (os error 13)` (Rust's io::Error Display drops
-      # the path, so the failure is opaque). Make the source writable here
-      # so the staged destinations are writable and can be overwritten.
-      #
-      # Trade-off: this task runs for both `task desktop:dev` and
-      # `task desktop:build`, so production bundles also ship mode-644
-      # JRE files instead of 444. Functionally harmless on POSIX (the
-      # `other` bit is `r--` either way, and on macOS code signing is the
-      # real integrity check) and on Windows the DOS read-only attribute
-      # isn't load-bearing for the bundled JDK. If we ever need strict
-      # 444 in production, split the chmod into a dev-only step and have
-      # `desktop:build` run `jlink:clean` first to force a fresh build.
-      - cmd: chmod -R u+w runtime/jre
-        platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -Command "Get-ChildItem -Recurse runtime/jre | ForEach-Object { $_.IsReadOnly = $false }"
-        platforms: [windows]
+      - rm -rf src-tauri/runtime/jre
+      - mkdir -p src-tauri/runtime
+      - >-
+        jlink
+        --add-modules {{.JLINK_MODULES}}
+        --strip-debug
+        --compress=zip-6
+        --no-header-files
+        --no-man-pages
+        --output src-tauri/runtime/jre
    status:
-      - test -f runtime/jre/release
+      - test -d src-tauri/runtime/jre

  jlink:clean:
    desc: "Remove JLink runtime and bundled JARs"
-    dir: editor/src-tauri
    cmds:
-      - rm -rf libs runtime
+      - rm -rf src-tauri/libs src-tauri/runtime

  # macOS-only. Replaces jlink:runtime's single-arch JRE with a universal
  # (arm64 + x86_64) one for the universal Tauri shell. Runs the x86_64
@@ -214,7 +117,6 @@ tasks:
    desc: "Create universal (arm64+x86_64) JRE for the macOS Tauri build"
    deps: [jlink:jar]
    platforms: [darwin]
-    dir: editor
    env:
      JLINK_MODULES: "{{.JLINK_MODULES}}"
      OUTPUT_DIR: src-tauri/runtime/jre
@@ -20,11 +20,6 @@ tasks:
    cmds:
      - docker build -t stirling-pdf-ultra-lite -f {{.EMBEDDED_DIR}}/Dockerfile.ultra-lite .

-  build:backend:
-    desc: "Build backend-only Docker image (no embedded frontend)"
-    cmds:
-      - docker build -t stirling-pdf-backend -f docker/backend/Dockerfile .
-
  build:frontend:
    desc: "Build frontend-only Docker image"
    cmds:
@@ -3,14 +3,14 @@ version: '3'
 tasks:
  install:
    desc: "Install Playwright browsers"
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:install' ]
    cmds:
      - npx playwright install {{.CLI_ARGS}} --with-deps

  stubbed:
    desc: "Run stubbed E2E tests"
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:prepare' ]
    cmds:
      - npx playwright test --project=stubbed {{.CLI_ARGS}}
@@ -34,9 +34,6 @@ tasks:
    ignore_error: true
    vars:
      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
-    # COVERAGE=1 in the calling environment attaches the JaCoCo agent to
-    # the bootRun JVM and writes to BASE_DIR/jacoco.exec on shutdown.
-    # Off by default to keep local dev runs uninstrumented; CI flips it.
    env:
      STIRLING_BASE_PATH: '{{.BASE_DIR}}'
      # Suppress the analytics opt-in modal that fires on first admin login.
@@ -61,19 +58,12 @@ tasks:
          set -e
          rm -rf "{{.BASE_DIR}}"
          mkdir -p "{{.BASE_DIR}}"
-          GRADLE_ARGS=":stirling-pdf:bootRun"
-          if [ -n "${COVERAGE:-}" ]; then
-            # copyJacocoAgent is wired as a dependency of bootRun when
-            # -PjacocoAgent=true, so we do not need to invoke it separately.
-            GRADLE_ARGS="$GRADLE_ARGS -PjacocoAgent=true -PjacocoExec={{.BASE_DIR}}/jacoco.exec"
-            echo "JaCoCo coverage enabled, writing to {{.BASE_DIR}}/jacoco.exec"
-          fi
          # Background gradle and record its PID so the runner can clean up
          # the exact process tree (wrapper + forked Spring Boot JVM) without
          # resorting to fuzzy `pkill -f` patterns. `wait` keeps this script
          # alive for the lifetime of gradle so Task'"'"'s parallel deps stay
          # synchronised.
-          bash gradlew $GRADLE_ARGS > "{{.BASE_DIR}}/backend.log" 2>&1 &
+          bash gradlew :stirling-pdf:bootRun > "{{.BASE_DIR}}/backend.log" 2>&1 &
          GRADLE_PID=$!
          echo $GRADLE_PID > "{{.BASE_DIR}}/backend.pid"
          wait $GRADLE_PID
@@ -82,7 +72,7 @@ tasks:
  live:runner:
    internal: true
    deps: [ ':frontend:prepare' ]
-    dir: frontend/editor
+    dir: frontend
    vars:
      BASE_DIR: '{{.ROOT_DIR}}/.test-state/playwright'
    cmds:
@@ -151,14 +141,14 @@ tasks:
      up first with:
        task e2e:oauth:up
        task e2e:saml:up
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:prepare' ]
    cmds:
      - npx playwright test --project=enterprise {{.CLI_ARGS}}

  cross-browser:
    desc: "Run stubbed E2E tests on Chromium, Firefox, and WebKit"
-    dir: frontend/editor
+    dir: frontend
    deps: [ ':frontend:prepare' ]
    cmds:
      - npx playwright test --project=stubbed --project=stubbed-firefox --project=stubbed-webkit {{.CLI_ARGS}}
@@ -212,55 +202,3 @@ tasks:
    desc: "Stop the SAML keycloak test environment"
    cmds:
      - docker compose -f testing/compose/docker-compose-keycloak-saml.yml down -v
-
-  mcp:up:
-    desc: "Start the MCP keycloak test environment (Stirling as OAuth resource server)"
-    summary: |
-      Brings up Keycloak (OAuth authorization server) + Stirling configured as an
-      MCP resource server, then you can exercise /mcp with real Keycloak tokens.
-      Set LICENSE_KEY=<KEY> to skip the interactive license prompt:
-        task e2e:mcp:up LICENSE_KEY=abc123
-      Pass extra flags via -- :
-        task e2e:mcp:up -- --validate --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:manual:
-    desc: "Start the MCP keycloak test env in manual mode (prints URLs + a live token for your client)"
-    summary: |
-      Brings the stack up and prints copy-paste URLs/commands plus a freshly minted
-      access token so you can drive your own MCP client (Inspector, curl, ...).
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key>
-      Add --nobuild if the images are already built:
-        task e2e:mcp:manual LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --manual {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:apikey:
-    desc: "Start the MCP test env in API-KEY manual mode (no OAuth/IdP): mints a key + prints client settings"
-    summary: |
-      Brings Stirling up in apikey auth mode and prints copy-paste client settings with a freshly
-      minted X-API-KEY - ideal for clients whose OAuth layer can't reach localhost.
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key>
-      Add --nobuild if images are already built:
-        task e2e:mcp:apikey LICENSE_KEY=<your-license-key> -- --nobuild
-    ignore_error: true
-    cmds:
-      - bash testing/compose/start-mcp-test.sh --apikey {{if .LICENSE_KEY}}--license-key "{{.LICENSE_KEY}}"{{end}} {{.CLI_ARGS}}
-
-  mcp:validate:
-    desc: "Validate the running MCP keycloak test environment end-to-end (oauth mode + real MCP SDK client)"
-    cmds:
-      - bash testing/compose/validate-mcp-test.sh
-
-  mcp:validate-apikey:
-    desc: "Validate the MCP server in API-KEY auth mode (mints a key + real MCP SDK client), then restore oauth"
-    cmds:
-      - bash testing/compose/validate-mcp-apikey.sh
-
-  mcp:down:
-    desc: "Stop the MCP keycloak test environment"
-    cmds:
-      - docker compose -f testing/compose/docker-compose-keycloak-mcp.yml down -v
@@ -33,7 +33,7 @@ tasks:
    env:
      PYTHONUNBUFFERED: "1"
    cmds:
-      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}} --workers "${STIRLING_ENGINE_WORKERS:-4}"
+      - uv run uvicorn stirling.api.app:app --host 0.0.0.0 --port {{.PORT}}

  dev:
    desc: "Start engine dev server with hot reload"
@@ -75,7 +75,7 @@ tasks:
    desc: "Run type checking"
    deps: [install]
    cmds:
-      - uv run pyright . --warnings
+      - uv run pyrefly check

  test:
    desc: "Run tests"
@@ -86,9 +86,8 @@ tasks:
  fix:
    desc: "Auto-fix lint + format"
    cmds:
-      - task: format  # Can auto-fix some things that `lint:fix` can't like line length violations
      - task: lint:fix
-      - task: format  # Ensure that after lint fixing that the code is still formatted correctly
+      - task: format

  check:
    desc: "Full engine quality gate"
@@ -1,10 +1,5 @@
 version: '3'

-# Tasks operate from the workspace root (frontend/). Editor commands pass
-# `editor` as the vite project root (positional after `build` / before the
-# mode flag) or use `--project editor/...` for tsc — so the editor lives
-# under frontend/editor/ without each task needing a cd.
-
 tasks:
  install:
    desc: "Install dependencies"
@@ -26,43 +21,19 @@ tasks:
    vars:
      MODE: '{{.MODE | default ""}}'
    cmds:
-      - npx tsx editor/scripts/setup-env.mts{{if .MODE}} --{{.MODE}}{{end}}
+      - npx tsx scripts/setup-env.ts{{if .MODE}} --{{.MODE}}{{end}}
    sources:
-      - editor/scripts/setup-env.mts
+      - scripts/setup-env.ts
    generates:
-      - editor/.env.local
-      - editor/.env{{if .MODE}}.{{.MODE}}{{end}}.local
+      - .env.local
+      - .env{{if .MODE}}.{{.MODE}}{{end}}.local

  prepare:icons:
    internal: true
    run: once
    deps: [install]
    cmds:
-      - node editor/scripts/generate-icons.js
-
-  prepare:og:
-    internal: true
-    run: when_changed
-    desc: "Regenerate OG/social-preview metadata from the tool registry"
-    cmds:
-      - node editor/scripts/generate-og-metadata.mjs
-    sources:
-      - editor/src/core/types/toolId.ts
-      - editor/src/core/utils/urlMapping.ts
-      - editor/src/core/data/useTranslatedToolRegistry.tsx
-      - editor/public/og_images/*.png
-    generates:
-      - editor/src/core/data/ogImageMap.json
-      - editor/public/og-metadata.json
-
-  prepare:classifier-categories:
-    internal: true
-    run: when_changed
-    desc: "Regenerate the engine classifier categories JSON from the TS source of truth"
-    cmds:
-      - npx tsx editor/scripts/generate-classification-taxonomy.mts
-    sources:
-      - editor/src/proprietary/data/classificationTaxonomy.ts
+      - node scripts/generate-icons.js

  prepare:
    desc: "Set up dev environment"
@@ -73,8 +44,6 @@ tasks:
      - task: prepare:env
        vars: { MODE: '{{.MODE}}' }
      - prepare:icons
-      - prepare:og
-      - prepare:classifier-categories

  # ============================================================
  # Development
@@ -91,7 +60,7 @@ tasks:
    env:
      BACKEND_URL: '{{.BACKEND_URL}}'
    cmds:
-      - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
+      - npx vite --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}

  dev:
    desc: "Start frontend dev server"
@@ -138,37 +107,6 @@ tasks:
      - task: dev:_run
        vars: { MODE: prototypes, PORT: '{{.PORT}}', BACKEND_URL: '{{.BACKEND_URL}}', OPEN: '{{.OPEN}}' }

-  dev:portal:
-    desc: "Start developer portal dev server"
-    ignore_error: true
-    deps: [install]
-    vars:
-      PORT: '{{.PORT | default "5173"}}'
-      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
-      EDITOR_URL: '{{.EDITOR_URL | default ""}}'
-      OPEN: '{{.OPEN | default ""}}'
-      SUBPATH: '{{.SUBPATH | default ""}}'
-      MOCKS: '{{.MOCKS | default ""}}'
-    env:
-      BACKEND_URL: '{{.BACKEND_URL}}'
-    cmds:
-      - '{{if .SUBPATH}}RUN_SUBPATH={{.SUBPATH}} {{end}}{{if .MOCKS}}VITE_PORTAL_MOCKS={{.MOCKS}} {{end}}{{if .EDITOR_URL}}VITE_EDITOR_URL={{.EDITOR_URL}} {{end}}npx vite portal --port {{.PORT}}{{if .OPEN}} --open{{end}}'
-
-  dev:portal:proxy:serve:
-    internal: true
-    vars:
-      PORT: '{{.PORT | default "3000"}}'
-      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
-      EDITOR_DEV_URL: '{{.EDITOR_DEV_URL | default ""}}'
-      PORTAL_DEV_URL: '{{.PORTAL_DEV_URL | default ""}}'
-    env:
-      PORT: '{{.PORT}}'
-      BACKEND_URL: '{{.BACKEND_URL}}'
-      EDITOR_DEV_URL: '{{.EDITOR_DEV_URL}}'
-      PORTAL_DEV_URL: '{{.PORTAL_DEV_URL}}'
-    cmds:
-      - npx tsx scripts/dev-origin-proxy.ts
-
  # ============================================================
  # Build
  # ============================================================
@@ -177,21 +115,19 @@ tasks:
    desc: "Production build (default mode)"
    deps: [prepare]
    cmds:
-      - npx vite build editor
+      - npx vite build

  build:core:
    desc: "Build for core mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode core
+      - npx vite build --mode core

  build:proprietary:
    desc: "Build for proprietary mode"
    deps: [prepare]
-    vars:
-      PREVIEW: '{{.PREVIEW | default ""}}'
    cmds:
-      - '{{if .PREVIEW}}VITE_BUILD_FOR_PREVIEW=1 {{end}}npx vite build editor --mode proprietary'
+      - npx vite build --mode proprietary

  build:saas:
    desc: "Build for SaaS mode"
@@ -199,7 +135,7 @@ tasks:
      - task: prepare
        vars: { MODE: saas }
    cmds:
-      - npx vite build editor --mode saas
+      - npx vite build --mode saas

  build:desktop:
    desc: "Build for desktop mode"
@@ -207,49 +143,13 @@ tasks:
      - task: prepare
        vars: { MODE: desktop }
    cmds:
-      - npx vite build editor --mode desktop
+      - npx vite build --mode desktop

  build:prototypes:
    desc: "Build for prototypes mode"
    deps: [prepare]
    cmds:
-      - npx vite build editor --mode prototypes
-
-  build:portal:
-    desc: "Build developer portal"
-    deps: [install]
-    vars:
-      SUBPATH: '{{.SUBPATH | default ""}}'
-    cmds:
-      - '{{if .SUBPATH}}RUN_SUBPATH={{.SUBPATH}} {{end}}npx vite build portal'
-
-  preview:portal:proxy:
-    desc: "Build + serve editor + portal behind one origin (prod-like auth testing)"
-    deps: [prepare]
-    vars:
-      PORT: '{{.PORT | default "3000"}}'
-      BACKEND_URL: '{{.BACKEND_URL | default "http://localhost:8080"}}'
-    env:
-      PORT: '{{.PORT}}'
-      BACKEND_URL: '{{.BACKEND_URL}}'
-    cmds:
-      - task: build:proprietary
-        vars: { PREVIEW: '1' }
-      - task: build:portal
-        vars: { SUBPATH: portal }
-      - npx tsx scripts/dev-origin-proxy.ts
-
-  storybook:
-    desc: "Start Storybook dev server"
-    deps: [install]
-    cmds:
-      - npx storybook dev -p 6006 {{.CLI_ARGS}}
-
-  storybook:build:
-    desc: "Build static Storybook"
-    deps: [install]
-    cmds:
-      - npx storybook build {{.CLI_ARGS}}
+      - npx vite build --mode prototypes

  # ============================================================
  # Code quality
@@ -258,23 +158,9 @@ tasks:
  lint:
    desc: "Run linting"
    deps: [install]
-    cmds:
-      - task: lint:eslint
-      - task: lint:dpdm
-
-  lint:eslint:
-    desc: "Run ESLint linting"
-    deps: [install]
    cmds:
      - npx eslint --max-warnings=0
-
-  lint:dpdm:
-    desc: "Run circular import linting"
-    deps: [install]
-    cmds:
-      # Globs so dpdm walks the whole tree. dpdm expands the braces itself, so this is
-      # shell-agnostic. Covers editor, portal, and the shared design system.
-      - npx dpdm "editor/src/**/*.{ts,tsx}" "portal/src/**/*.{ts,tsx}" "shared/**/*.{ts,tsx}" --circular --no-warning --no-tree --exit-code circular:1
+      - npx dpdm src --circular --no-warning --no-tree --exit-code circular:1

  lint:fix:
    desc: "Auto-fix lint issues"
@@ -305,26 +191,17 @@ tasks:
    cmds:
      - task: typecheck:proprietary

-  typecheck:_run:
-    internal: true
-    env:
-      CI: '{{ .CI | default "false" }}'
-    cmds:
-      - '{{ if eq .CI "true" }}npx tsc{{ else }}npx tsgo{{ end }} --noEmit --project {{.PROJECT}}'
-
  typecheck:core:
    desc: "Typecheck core build variant"
    deps: [prepare]
    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/core/tsconfig.json }
+      - npx tsc --noEmit --project src/core/tsconfig.json

  typecheck:proprietary:
    desc: "Typecheck proprietary build variant"
    deps: [prepare]
    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/proprietary/tsconfig.json }
+      - npx tsc --noEmit --project src/proprietary/tsconfig.json

  typecheck:saas:
    desc: "Typecheck SaaS build variant"
@@ -332,8 +209,7 @@ tasks:
      - task: prepare
        vars: { MODE: saas }
    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/saas/tsconfig.json }
+      - npx tsc --noEmit --project src/saas/tsconfig.json

  typecheck:desktop:
    desc: "Typecheck desktop build variant"
@@ -341,45 +217,19 @@ tasks:
      - task: prepare
        vars: { MODE: desktop }
    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/desktop/tsconfig.json }
-
-  typecheck:cloud:
-    desc: "Typecheck cloud shared layer (standalone)"
-    deps: [prepare]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/cloud/tsconfig.json }
+      - npx tsc --noEmit --project src/desktop/tsconfig.json

  typecheck:scripts:
    desc: "Typecheck scripts"
    deps: [prepare]
    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: scripts/tsconfig.json }
-      - task: typecheck:_run
-        vars: { PROJECT: editor/scripts/tsconfig.json }
+      - npx tsc --noEmit --project scripts/tsconfig.json

  typecheck:prototypes:
    desc: "Typecheck prototypes build variant"
    deps: [prepare]
    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: editor/src/prototypes/tsconfig.json }
-
-  typecheck:portal:
-    desc: "Typecheck developer portal build variant"
-    deps: [install]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: portal/tsconfig.json }
-
-  typecheck:shared:
-    desc: "Typecheck the shared design system"
-    deps: [install]
-    cmds:
-      - task: typecheck:_run
-        vars: { PROJECT: shared/tsconfig.json }
+      - npx tsc --noEmit --project src/prototypes/tsconfig.json

  typecheck:all:
    desc: "Typecheck all build variants"
@@ -388,11 +238,8 @@ tasks:
      - task: typecheck:proprietary
      - task: typecheck:saas
      - task: typecheck:desktop
-      - task: typecheck:cloud
      - task: typecheck:scripts
      - task: typecheck:prototypes
-      - task: typecheck:portal
-      - task: typecheck:shared

  # ============================================================
  # Quality Gate
@@ -406,35 +253,14 @@ tasks:
      - task: format:check
      - task: test

-  og:check:
-    desc: "Fail if committed OG/social-preview metadata is out of date"
-    cmds:
-      - node editor/scripts/generate-og-metadata.mjs --check
-
-  classifier-categories:
-    desc: "Regenerate the engine classifier categories JSON from the TS source"
-    cmds:
-      - npx tsx editor/scripts/generate-classification-taxonomy.mts
-
-  classifier-categories:check:
-    desc: "Fail if the committed classifier categories JSON is out of date"
-    cmds:
-      - npx tsx editor/scripts/generate-classification-taxonomy.mts --check
-
  check:all:
    desc: "Full CI quality gate"
    cmds:
-      # Runs first, before prepare regenerates: guards the committed og-metadata.json /
-      # ogImageMap.json that the Cloudflare Pages (plain `vite build`) deploy relies on.
-      - task: og:check
-      - task: classifier-categories:check
      - task: typecheck:all
      - task: lint
      - task: format:check
      - task: build
-      - task: build:portal
      - task: test
-      - task: storybook:build

  # ============================================================
  # Test
@@ -442,48 +268,21 @@ tasks:

  test:
    desc: "Run tests"
+    deps: [install]
    cmds:
-      - task: test:editor
-      - task: test:portal
-
-  test:editor:
-    desc: "Run editor tests"
-    deps: [prepare]
-    cmds:
-      - npx vitest run --root editor
-
-  test:portal:
-    desc: "Run portal tests"
-    deps: [prepare]
-    cmds:
-      - npx vitest run --root portal
+      - npx vitest run

  test:watch:
    desc: "Run tests in watch mode"
-    deps: [prepare]
+    deps: [install]
    cmds:
-      - npx vitest --watch --root editor
+      - npx vitest --watch

  test:coverage:
-    desc: "Run tests with coverage (one-shot; CI-friendly)."
-    deps: [prepare]
+    desc: "Run tests with coverage"
+    deps: [install]
    cmds:
-      # `vitest run` makes this CI-safe (the bare `vitest` form enters watch
-      # mode). Explicit reporter list because v8 + json-summary is what the
-      # coverage-summary.py helper consumes; html/text are kept for humans.
-      #
-      # reportsDirectory is pinned to ./coverage relative to vitest's root
-      # (--root editor), so output lands at frontend/editor/coverage/. The
-      # CI upload step reads from that path. An earlier attempt with
-      # `./editor/coverage` double-nested into frontend/editor/editor/coverage;
-      # pinning future-proofs against vitest changing the default.
-      - >
-        npx vitest run --root editor --coverage
-        --coverage.provider=v8
-        --coverage.reporter=text-summary
-        --coverage.reporter=json-summary
-        --coverage.reporter=html
-        --coverage.reportsDirectory=./coverage
+      - npx vitest --coverage

  # ============================================================
  # Code Generation
@@ -493,16 +292,4 @@ tasks:
    desc: "Generate frontend license report"
    deps: [install]
    cmds:
-      - node editor/scripts/generate-licenses.js
-
-  # ============================================================
-  # Clean
-  # ============================================================
-
-  clean:
-    desc: "Clean build artifacts and caches"
-    cmds:
-      - cmd: powershell rm -Recurse -Force -ErrorAction SilentlyContinue node_modules/.vite, editor/dist, dist, dist-portal
-        platforms: [windows]
-      - cmd: rm -rf node_modules/.vite editor/dist dist dist-portal
-        platforms: [linux, darwin]
+      - node scripts/generate-licenses.js
@@ -1,133 +0,0 @@
-version: '3'
-
-# Repo-wide lint/format/secret checks - the single source of truth that the git
-# pre-commit hook (.pre-commit-config.yaml) and CI (pre_commit.yml) both call.
-
-vars:
-  # File selections as git pathspecs: git does the include/exclude matching, so
-  # there is no grep/xargs and it behaves identically on every platform.
-  PY_FILES: >-
-    'scripts/*.py'
-    '.github/scripts/*.py'
-    'app/core/src/main/resources/static/python/*.py'
-    ':(exclude)*split_photos.py'
-  SPELL_FILES: >-
-    '*.html'
-    '*.css'
-    '*.js'
-    '*.py'
-    '*.md'
-    ':(exclude).vscode/*'
-    ':(exclude).devcontainer/*'
-    ':(exclude)app/core/src/main/resources/*'
-    ':(exclude)app/proprietary/src/main/resources/*'
-    ':(exclude)frontend/editor/public/vendor/*'
-    ':(exclude)*Dockerfile*'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-  WS_FILES: >-
-    '*.js'
-    '*.java'
-    '*.py'
-    '*.yml'
-    ':(exclude)*pdfjs*'
-    ':(exclude)*thirdParty*'
-    ':(exclude)*bootstrap*'
-    ':(exclude)*.min.*'
-    ':(exclude)*diff.js'
-    ':(exclude).github/workflows/*'
-  LOCALE_TOML: 'frontend/editor/public/locales/*/translation.toml'
-
-  # gitleaks is pinned + checksum-verified by scripts/pre-commit/install_gitleaks.py,
-  # which owns the version and caches the binary here.
-  GITLEAKS_BIN: '.task/bin/gitleaks{{if eq OS "windows"}}.exe{{end}}'
-
-tasks:
-  default:
-    desc: "Check formatting, spelling, and secrets across the repo"
-    cmds:
-      - task: ruff
-      - task: ruff-format
-      - task: codespell
-      - task: gitleaks
-      - task: whitespace
-      - task: toml-sort
-
-  fix:
-    desc: "Auto-fix formatting, spelling, and secrets issues across the repo"
-    cmds:
-      # Auto-fixers first, then the report-only tools (codespell, gitleaks) so a
-      # finding there does not stop the fixers from running.
-      - task: ruff
-        vars: { FIX: '1' }
-      - task: ruff-format
-        vars: { FIX: '1' }
-      - task: whitespace
-        vars: { FIX: '1' }
-      - task: toml-sort
-        vars: { FIX: '1' }
-      - task: codespell
-      - task: gitleaks
-
-  install:
-    desc: "Install the pinned pre-commit Python tools (ruff, codespell, toml-sort)"
-    run: once
-    cmds:
-      - uv sync --project scripts/pre-commit --locked
-    sources:
-      - scripts/pre-commit/uv.lock
-      - scripts/pre-commit/pyproject.toml
-    status:
-      - test -d scripts/pre-commit/.venv
-
-  clean:
-    desc: "Remove the cached gitleaks binary and the tool virtualenv"
-    cmds:
-      - cmd: rm -rf scripts/pre-commit/.venv .task/bin/gitleaks
-        platforms: [linux, darwin]
-      - cmd: cmd /c "rmdir /s /q scripts\pre-commit\.venv & del /q .task\bin\gitleaks.exe"
-        platforms: [windows]
-        ignore_error: true
-
-  # Individual checks (hidden from `task --list`, but callable, e.g.
-  # `task pre-commit:toml-sort FIX=1`). Pass FIX=1 to auto-fix where supported.
-  ruff:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff check --line-length=127 {{if .FIX}}--fix {{end}}$(git ls-files {{.PY_FILES}})
-
-  ruff-format:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync ruff format {{if .FIX}}{{else}}--check {{end}}$(git ls-files {{.PY_FILES}})
-
-  codespell:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync codespell --ignore-words-list=thirdParty,tabEl,tabEls,Sie,ist,fulfilment --quiet-level=2 $(git ls-files {{.SPELL_FILES}})
-
-  toml-sort:
-    deps: [install]
-    cmds:
-      - uv run --project scripts/pre-commit --no-sync toml-sort --all --ignore-case {{if .FIX}}--in-place{{else}}--check{{end}} {{.LOCALE_TOML}}
-
-  whitespace:
-    cmds:
-      - uv run --no-project python scripts/pre-commit/whitespace.py {{if .FIX}}--fix {{end}}{{.WS_FILES}}
-
-  gitleaks:
-    deps: [gitleaks-bin]
-    # Scan staged changes only, matching the old hook: the git-mode fingerprints
-    # in .gitleaksignore (file:rule:line) still apply, and with nothing staged
-    # this is a no-op. Secrets are never auto-fixed, so FIX has no effect.
-    cmds:
-      - "{{.GITLEAKS_BIN}} git --pre-commit --redact --staged --verbose"
-
-  gitleaks-bin:
-    internal: true
-    desc: "Ensure the pinned, checksum-verified gitleaks binary is cached in .task/bin"
-    cmds:
-      - uv run --no-project python scripts/pre-commit/install_gitleaks.py
@@ -10,14 +10,14 @@ When adding tools, follow this systematic approach using the established pattern

 Create these files in the correct directories:
 ```
-frontend/editor/src/hooks/tools/[toolName]/
+frontend/src/hooks/tools/[toolName]/
  ├── use[ToolName]Parameters.ts     # Parameter definitions and validation
  └── use[ToolName]Operation.ts      # Tool operation logic using useToolOperation

-frontend/editor/src/components/tools/[toolName]/
+frontend/src/components/tools/[toolName]/
  └── [ToolName]Settings.tsx         # Settings UI component (if needed)

-frontend/editor/src/tools/
+frontend/src/tools/
  └── [ToolName].tsx                 # Main tool component
 ```

@@ -128,7 +128,7 @@ export default [ToolName] as ToolComponent;
 ## 3. Register Tool in System
 Update these files to register your new tool:

-**Tool Registry** (`frontend/editor/src/data/useTranslatedToolRegistry.tsx`):
+**Tool Registry** (`frontend/src/data/useTranslatedToolRegistry.tsx`):
 1. Add imports at the top:
 ```typescript
 import [ToolName] from "../tools/[ToolName]";
@@ -155,7 +155,7 @@ import [ToolName]Settings from "../components/tools/[toolName]/[ToolName]Setting
 ## 4. Add Tooltips (Optional but Recommended)
 Create user-friendly tooltips to help non-technical users understand your tool. **Use simple, clear language - avoid technical jargon:**

-**Tooltip Hook** (`frontend/editor/src/components/tooltips/use[ToolName]Tips.ts`):
+**Tooltip Hook** (`frontend/src/components/tooltips/use[ToolName]Tips.ts`):
 ```typescript
 import { useTranslation } from 'react-i18next';
 import { TooltipContent } from '../../types/tips';
@@ -200,9 +200,9 @@ const [ToolName] = (props: BaseToolProps) => {
 ```

 ## 5. Add Translations
-Update translation files. **Important: Only update `en-US` files** - other languages are handled separately.
+Update translation files. **Important: Only update `en-GB` files** - other languages are handled separately.

-**File to update:** `frontend/editor/public/locales/en-US/translation.toml`
+**File to update:** `frontend/public/locales/en-GB/translation.toml`

 **Required Translation Keys**:
 ```toml
@@ -251,7 +251,7 @@ Update translation files. **Important: Only update `en-US` files** - other langu
 ```

 **Translation Notes:**
- **Only update `en-US/translation.toml`** - other locale files are managed separately
+- **Only update `en-GB/translation.toml`** - other locale files are managed separately
 - Use descriptive keys that match your component's `t()` calls
 - Include tooltip translations if you created tooltip hooks
 - Add `options.*` keys if your tool has settings with descriptions
@@ -139,9 +139,9 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie

 #### Environment Variables
 - All `VITE_*` variables must be declared in the appropriate committed env file:
-  - `frontend/editor/.env` — core, proprietary, and shared vars
-  - `frontend/editor/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
-  - `frontend/editor/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
+  - `frontend/.env` — core, proprietary, and shared vars
+  - `frontend/.env.saas` — SaaS-only vars (layered on top of `.env` in SaaS mode)
+  - `frontend/.env.desktop` — desktop (Tauri)-only vars (layered on top of `.env` in desktop mode)
 - These files are committed to Git and must not contain private keys
 - Local overrides (API keys, machine-specific settings) go in uncommitted sibling `.env.local` / `.env.saas.local` / `.env.desktop.local` files — Vite automatically layers them on top
 - Never use `|| 'hardcoded-fallback'` inline — put defaults in the committed env files
@@ -152,7 +152,7 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie
 #### Import Paths - CRITICAL
 **ALWAYS use `@app/*` for imports.** Do not use `@core/*` or `@proprietary/*` unless explicitly wrapping/extending a lower layer implementation.

-For a broader explanation of the frontend layering and override architecture, read @frontend/editor/DeveloperGuide.md
+For a broader explanation of the frontend layering and override architecture, see [frontend/DeveloperGuide.md](frontend/DeveloperGuide.md).

 ```typescript
 // ✅ CORRECT - Use @app/* for all imports
@@ -169,31 +169,7 @@ import { useFileContext } from "@proprietary/contexts/FileContext";
 - Building layer-specific override that wraps a lower layer's component
 - Example: `import { AppProviders as CoreAppProviders } from "@core/components/AppProviders"` when creating proprietary/AppProviders.tsx that extends the core version

-The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/saas/desktop/cloud) and handles the fallback cascade — see "Frontend `cloud/` Layer" below for the full per-flavor order.
-
-#### Frontend `cloud/` Layer
-
-`@app/*` resolves through a per-flavor cascade — first existing file wins (shadow/override):
-
- **core** → core
- **proprietary** → proprietary → core
- **saas** → saas → cloud → proprietary → core
- **desktop** → desktop → cloud → proprietary → core
- **cloud** → cloud → proprietary → core
-
-What goes where:
-
- **core** — OSS base.
- **proprietary** — licensed / offline features.
- **cloud** — the SHARED hosted/SaaS experience used by BOTH saas + desktop: PAYG, wallet, plan, billing, usage meters, cloud config/team/onboarding.
- **saas** — web-only: Supabase web auth, AuthCallback, avatar canvas, `window.location`.
- **desktop** — Tauri-only: keyring authService, tauriHttpClient, native files/windows, backend routing.
-
-`cloud/` MUST NOT import `@supabase/*`, `@tauri-apps/*`, raw `fetch`, `window.location`, `localStorage`, `sessionStorage`, or `import.meta.env.VITE_*` (enforced by ESLint). It reaches platform-specific things only via `@app/*` seams: `services/apiClient`, `auth/session.getAccessToken`, `auth/supabase`, `platform/openExternal`, `services/billing`, `hooks/useSaaSMode` — each provided per-platform in `saas/` and `desktop/`.
-
-Rule of thumb — **move, don't copy**: share via `cloud/`, override by shadowing the same `@app/*` path in a leaf (`saas/` or `desktop/`).
-
-**Cloud feature flags on desktop.** The local `AppConfigContext` reads `/api/v1/config/app-config` from the LOCAL bundled backend, so cloud-only flags (`aiEngineEnabled`, `premiumEnabled`, …) are never seen on desktop. To read the cloud's view, use `useSaasAppConfig()` (`desktop/hooks/useSaasAppConfig.ts`, backed by the general `saasAppConfigService` — SaaS-mode-only, public endpoint, native HTTP, 5-min cache). It returns `null` outside SaaS mode, so cloud features stay off in local/self-hosted and the server keeps the on/off switch (no desktop release needed to flip a flag). Gate a feature behind a per-platform seam — e.g. `useAiEngineEnabled()` (core reads `useAppConfig()`, desktop reads `useSaasAppConfig()`) — rather than hardcoding the flag on.
+The `@app/*` alias automatically resolves to the correct layer based on build target (core/proprietary/desktop) and handles the fallback cascade.

 #### Component Override Pattern (Stub/Shadow)
 Use this pattern for desktop-specific or proprietary-specific features WITHOUT runtime checks or conditionals.
@@ -207,26 +183,26 @@ Use this pattern for desktop-specific or proprietary-specific features WITHOUT r
 **Example - Desktop-specific footer:**

 ```typescript
-// core/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (stub)
-interface WorkbenchBarFooterExtensionsProps {
+// core/components/rightRail/RightRailFooterExtensions.tsx (stub)
+interface RightRailFooterExtensionsProps {
  className?: string;
 }

-export function WorkbenchBarFooterExtensions(_props: WorkbenchBarFooterExtensionsProps) {
+export function RightRailFooterExtensions(_props: RightRailFooterExtensionsProps) {
  return null; // Stub - does nothing in web builds
 }
 ```

 ```tsx
-// desktop/components/workbenchBar/WorkbenchBarFooterExtensions.tsx (real implementation)
+// desktop/components/rightRail/RightRailFooterExtensions.tsx (real implementation)
 import { Box } from '@mantine/core';
 import { BackendHealthIndicator } from '@app/components/BackendHealthIndicator';

-interface WorkbenchBarFooterExtensionsProps {
+interface RightRailFooterExtensionsProps {
  className?: string;
 }

-export function WorkbenchBarFooterExtensions({ className }: WorkbenchBarFooterExtensionsProps) {
+export function RightRailFooterExtensions({ className }: RightRailFooterExtensionsProps) {
  return (
    <Box className={className}>
      <BackendHealthIndicator />
@@ -236,15 +212,15 @@ export function WorkbenchBarFooterExtensions({ className }: WorkbenchBarFooterEx
 ```

 ```tsx
-// core/components/shared/WorkbenchBar.tsx (usage - works in ALL builds)
-import { WorkbenchBarFooterExtensions } from '@app/components/workbenchBar/WorkbenchBarFooterExtensions';
+// core/components/shared/RightRail.tsx (usage - works in ALL builds)
+import { RightRailFooterExtensions } from '@app/components/rightRail/RightRailFooterExtensions';

-export function WorkbenchBar() {
+export function RightRail() {
  return (
    <div>
      {/* In web builds: renders nothing (stub returns null) */}
      {/* In desktop builds: renders BackendHealthIndicator */}
-      <WorkbenchBarFooterExtensions className="workbench-bar-footer" />
+      <RightRailFooterExtensions className="right-rail-footer" />
    </div>
  );
 }
@@ -267,7 +243,7 @@ Frontend designed for **stateful document processing**:
 - No file reloading between tools - performance critical for large PDFs (up to 100GB+)

 #### FileContext - Central State Management
-**Location**: `frontend/editor/src/core/contexts/FileContext.tsx`
+**Location**: `frontend/src/core/contexts/FileContext.tsx`
 - **Active files**: Currently loaded PDFs and their variants
 - **Tool navigation**: Current mode (viewer/pageEditor/fileEditor/toolName)
 - **Memory management**: PDF document cleanup, blob URL lifecycle, Web Worker management
@@ -292,7 +268,7 @@ Without cleanup: browser crashes with memory leaks.

 **Architecture**: Modular hook-based system with clear separation of concerns:

- **useToolOperation** (`frontend/editor/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
+- **useToolOperation** (`frontend/src/core/hooks/tools/shared/useToolOperation.ts`): Main orchestrator hook
  - Coordinates all tool operations with consistent interface
  - Integrates with FileContext for operation tracking
  - Handles validation, error handling, and UI state management
@@ -380,7 +356,7 @@ return useToolOperation({
 ### Frontend Directory Structure
 The frontend is organized with a clear separation of concerns:

- **`frontend/editor/src/core/`**: Main application code (shared, production-ready components)
+- **`frontend/src/core/`**: Main application code (shared, production-ready components)
  - **`core/components/`**: React components organized by feature
    - `core/components/tools/`: Individual PDF tool implementations
    - `core/components/viewer/`: PDF viewer components
@@ -398,17 +374,17 @@ The frontend is organized with a clear separation of concerns:
  - **`core/data/`**: Static data (tool taxonomy, etc.)
  - **`core/services/`**: Business logic services (PDF processing, storage, etc.)

- **`frontend/editor/src/desktop/`**: Desktop-specific (Tauri) code
- **`frontend/editor/src/proprietary/`**: Proprietary/licensed features
- **`frontend/editor/src-tauri/`**: Tauri (Rust) native desktop application code
- **`frontend/editor/public/`**: Static assets served directly
+- **`frontend/src/desktop/`**: Desktop-specific (Tauri) code
+- **`frontend/src/proprietary/`**: Proprietary/licensed features
+- **`frontend/src-tauri/`**: Tauri (Rust) native desktop application code
+- **`frontend/public/`**: Static assets served directly
  - `public/locales/`: Translation JSON files

 ### Component Architecture
- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/editor/public/` (modern)
+- **Static Assets**: CSS, JS, and resources in `src/main/resources/static/` (legacy) + `frontend/public/` (modern)
 - **Internationalization**:
  - Backend: `messages_*.properties` files
-  - Frontend: JSON files in `frontend/editor/public/locales/` (converted from .properties)
+  - Frontend: JSON files in `frontend/public/locales/` (converted from .properties)
  - Conversion Script: `scripts/convert_properties_to_json.py`

 ### Configuration Modes
@@ -433,7 +409,7 @@ The frontend is organized with a clear separation of concerns:
 4. **Code Style**: Spotless enforces Google Java Format automatically (`task backend:format`)
 5. **Translations**:
   - Backend: Use helper scripts in `/scripts` for multi-language updates
-   - Frontend: Update JSON files in `frontend/editor/public/locales/` or use conversion script
+   - Frontend: Update JSON files in `frontend/public/locales/` or use conversion script
 6. **Documentation**: API docs auto-generated and available at `/swagger-ui/index.html`

 ## Frontend Architecture Status
@@ -450,12 +426,12 @@ The frontend is organized with a clear separation of concerns:

 ## Translation Rules

- **CRITICAL**: Always update translations in `en-US` only - all other languages (including `en-GB`) are handled separately
- Translation files are located in `frontend/editor/public/locales/`
+- **CRITICAL**: Always update translations in `en-GB` only, never `en-US`
+- Translation files are located in `frontend/public/locales/`

 ## Important Notes

- **Java Version**: Requires JDK 25.
+- **Java Version**: Minimum JDK 21, supports and recommends JDK 25
 - **Lombok**: Used extensively - ensure IDE plugin is installed
 - **File Persistence**:
  - **Backend**: Designed to be stateless - files are processed in memory/temp locations only
@@ -482,26 +458,3 @@ The frontend is organized with a clear separation of concerns:
 - Confirm approach before making structural changes
 - Request guidance on preferences (cross-platform vs specific tools, etc.)
 - Verify understanding of requirements before proceeding
-
-
-## Stack reality check (don't trust LLM training data) <!-- bleeding-edge-stack-note -->
-
-This codebase is on bleeding-edge versions of its core JVM stack: **Spring Boot 4.0.6**,
-**Jackson 3 (`tools.jackson`)**, **JDK 21/25 source/target with JDK 25 toolchain**.
-All three are *post*-2024 releases and your training corpus is overwhelmingly Spring Boot 2/3 and
-Jackson 2 patterns — those patterns will compile, run differently, or hallucinate APIs that no
-longer exist.
-
-Before writing or editing Spring / Jackson / JDK code:
-
-1. Open an existing module in `app/core/` or `app/common/` and grep for the actual imports being
-   used — `import tools.jackson...` not `import com.fasterxml.jackson...`, and the new
-   `org.springframework.boot` 4.x package layout.
-2. If you're not sure whether an API exists in this stack version, **check the source on disk
-   first** (the dependency JARs are downloaded under `~/.gradle/caches/modules-2/`).
-3. Do not silently downgrade a Spring Boot 4 pattern to a Spring Boot 3 equivalent. If something
-   doesn't work, surface it to the human — don't guess.
-
-Same goes for Jackson 3's API surface (renamed `ObjectMapper` builder methods, new
-`tools.jackson.databind` namespace) and JDK 25 preview features. Ground your code in this repo's
-actual imports, not what worked three years ago.
@@ -11,7 +11,7 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 **Stirling 2.0** is built using:

 **Backend:**
- Spring Boot (requires JDK 25)
+- Spring Boot (Java 21+, JDK 25 recommended)
 - PDFBox for core PDF operations
 - LibreOffice for document conversions
 - qpdf for PDF optimization
@@ -45,24 +45,13 @@ This guide focuses on developing for Stirling 2.0, including both the React fron
 - [Task](https://taskfile.dev/installation/) — unified command runner (recommended)
 - Docker
 - Git
- Java JDK 25
+- Java JDK 21 or later (JDK 25 recommended)
 - Node.js 18+ and npm (required for frontend development)
 - Gradle 7.0 or later (Included within the repo)
 - [uv](https://docs.astral.sh/uv/) — Python package manager (required for engine development)
 - Rust and Cargo (required for Tauri desktop app development)
 - Tauri CLI (install with `cargo install tauri-cli`)

-### Optional System Dependencies
-
-These are not required to run the app but enable specific features. The app detects them at startup and disables the relevant features if they are missing.
-
-| Dependency | Feature | Install |
-|---|---|---|
-| LibreOffice | File-to-PDF conversions | `brew install libreoffice` / `apt install libreoffice` |
-| Tesseract | OCR | `brew install tesseract` / `apt install tesseract-ocr` |
-| WeasyPrint | AI document creation | `brew install weasyprint` / `apt install weasyprint` |
-| qpdf | PDF optimisation | `brew install qpdf` / `apt install qpdf` |
-
 ### Setup Steps

 1. Clone the repository:
@@ -72,7 +61,7 @@ These are not required to run the app but enable specific features. The app dete
   cd Stirling-PDF
   ```

-2. Install Docker and JDK 25 if not already installed.
+2. Install Docker and JDK 21 (or JDK 25 recommended) if not already installed.

 3. Install a recommended Java IDE such as Eclipse, IntelliJ, or VSCode
   1. Only VSCode
@@ -139,26 +128,24 @@ See [the frontend README](frontend/README.md#tauri) for detailed build instructi
 Stirling-PDF/
 ├── .github/               # GitHub-specific files (workflows, issue templates)
 ├── configs/               # Configuration files used by stirling at runtime (generated at runtime)
-├── frontend/              # Frontend workspace (Stirling 2.0)
-│   ├── editor/            # PDF editor app (the original React SPA)
-│   │   ├── src/
-│   │   │   ├── components/    # React components
-│   │   │   ├── tools/         # Tool-specific React components
-│   │   │   ├── hooks/         # Custom React hooks
-│   │   │   ├── services/      # API and utility services
-│   │   │   ├── types/         # TypeScript type definitions
-│   │   │   └── utils/         # Utility functions
-│   │   ├── src-tauri/     # Tauri desktop app configuration
-│   │   │   ├── src/           # Rust backend code
-│   │   │   ├── libs/          # JAR files (generated by build scripts)
-│   │   │   ├── runtime/       # Bundled JRE (generated by build scripts)
-│   │   │   ├── Cargo.toml     # Rust dependencies
-│   │   │   └── tauri.conf.json # Tauri configuration
-│   │   ├── public/
-│   │   │   └── locales/       # Internationalization files (JSON)
-│   │   └── vite.config.ts     # Vite configuration
-│   ├── package.json       # Shared workspace dependencies
-│   └── eslint.config.mjs  # Shared lint config
+├── frontend/              # React SPA frontend (Stirling 2.0)
+│   ├── src/
+│   │   ├── components/    # React components
+│   │   ├── tools/         # Tool-specific React components
+│   │   ├── hooks/         # Custom React hooks
+│   │   ├── services/      # API and utility services
+│   │   ├── types/         # TypeScript type definitions
+│   │   └── utils/         # Utility functions
+│   ├── src-tauri/         # Tauri desktop app configuration
+│   │   ├── src/           # Rust backend code
+│   │   ├── libs/          # JAR files (generated by build scripts)
+│   │   ├── runtime/       # Bundled JRE (generated by build scripts)
+│   │   ├── Cargo.toml     # Rust dependencies
+│   │   └── tauri.conf.json # Tauri configuration
+│   ├── public/
+│   │   └── locales/       # Internationalization files (JSON)
+│   ├── package.json       # Frontend dependencies
+│   └── vite.config.ts     # Vite configuration
 ├── customFiles/           # Custom static files and templates (generated at runtime used to replace existing files)
 ├── docs/                  # Documentation files
 ├── exampleYmlFiles/       # Example YAML configuration files
@@ -458,7 +445,7 @@ For Stirling 2.0, new features are built as React components:

 1. **Create the React Component:**
   ```typescript
-   // frontend/editor/src/tools/NewTool.tsx
+   // frontend/src/tools/NewTool.tsx
   import { useState } from 'react';
   import { Button, FileInput, Container } from '@mantine/core';

@@ -587,7 +574,7 @@ When adding a new feature or modifying existing ones in Stirling-PDF, you'll nee
 Find the existing `messages.properties` files in the `stirling-pdf/src/main/resources` directory. You'll see files like:

 - `messages.properties` (default, usually English)
- `messages_en_US.properties`
+- `messages_en_GB.properties`
 - `messages_fr_FR.properties`
 - `messages_de_DE.properties`
 - etc.
@@ -6,22 +6,16 @@ Portions of this software are licensed as follows:

 * All content that resides under the "app/proprietary/" directory of this repository,
 if that directory exists, is licensed under the license defined in "app/proprietary/LICENSE".
-* All content that resides under the "app/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "app/saas/LICENSE".
 * All content that resides under the "engine/" directory of this repository,
 if that directory exists, is licensed under the license defined in "engine/LICENSE".
-* All content that resides under the "frontend/editor/src/proprietary/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/proprietary/LICENSE".
-* All content that resides under the "frontend/editor/src/desktop/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/desktop/LICENSE".
-* All content that resides under the "frontend/editor/src/saas/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/saas/LICENSE".
-* All content that resides under the "frontend/editor/src/cloud/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/cloud/LICENSE".
-* All content that resides under the "frontend/editor/src/prototypes/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/editor/src/prototypes/LICENSE".
-* All content that resides under the "frontend/portal/" directory of this repository,
-if that directory exists, is licensed under the license defined in "frontend/portal/LICENSE".
+* All content that resides under the "frontend/src/proprietary/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/proprietary/LICENSE".
+* All content that resides under the "frontend/src/desktop/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/desktop/LICENSE".
+* All content that resides under the "frontend/src/saas/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/saas/LICENSE".
+* All content that resides under the "frontend/src/prototypes/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/src/prototypes/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.

@@ -60,7 +60,7 @@ For full installation options (including desktop and Kubernetes), see our [Docum

 We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

-This project uses [Task](https://taskfile.dev/) as a unified command runner for all build, dev, and test commands. Run `task dev` to get started running the editor, run `task` to see the most common commands, or see the [Developer Guide](DeveloperGuide.md) for full details.
+This project uses [Task](https://taskfile.dev/) as a unified command runner for all build, dev, and test commands. Run `task install` to get started, or see the [Developer Guide](DeveloperGuide.md) for full details.

 For adding translations, see the [Translation Guide](devGuide/HowToAddNewLanguage.md).

@@ -3,7 +3,7 @@ version: '3'
 output: prefixed

 vars:
-  FIND_FREE_PORT_PS: powershell -NoProfile -File scripts/find-free-port.ps1
+  FIND_FREE_PORT_PS: powershell -NoProfile -File scripts\find-free-port.ps1 -Preferred
  FIND_FREE_PORT_SH: bash scripts/find-free-port.sh

 includes:
@@ -25,28 +25,8 @@ includes:
  e2e:
    taskfile: .taskfiles/e2e.yml
    dir: .
-  pre-commit:
-    taskfile: .taskfiles/pre-commit.yml
-    dir: .

 tasks:
-  # ============================================================
-  # Help (shown when you run `task` with no arguments)
-  # ============================================================
-
-  default:
-    desc: "List the most common commands"
-    silent: true
-    cmds:
-      - |
-        echo "Common commands (run 'task --list' to see all):"
-        echo ""
-        echo "  task dev            Start backend & frontend on free ports"
-        echo "  task backend:dev    Start backend on default port"
-        echo "  task frontend:dev   Start frontend on default port"
-        echo "  task desktop:dev    Start desktop app"
-        echo "  task check          Quality gate (lint, typecheck, test, etc.)"
-
  # ============================================================
  # Setup & Prerequisites
  # ============================================================
@@ -65,7 +45,7 @@ tasks:
    desc: "Start backend + frontend concurrently on free ports"
    vars:
      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080,5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
    deps:
@@ -78,128 +58,11 @@ tasks:
          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
          OPEN: "true"

-  dev:portal:
-    desc: "Start backend + developer portal concurrently on free ports"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      PORTAL_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-    deps:
-      - task: backend:dev
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-          SECURITY_ENABLELOGIN: "true"
-          POLICIES_ENABLED: "true"
-      - task: frontend:dev:portal
-        vars:
-          PORT: '{{.PORTAL_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          MOCKS: 'false'
-          OPEN: "true"
-
-  dev:portal:all:
-    desc: "Start backend + developer portal + editor concurrently on free ports"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5174{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5174{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      PORTAL_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-      EDITOR_PORT: '{{index (splitList "\n" .PORTS) 2}}'
-    deps:
-      - task: backend:dev
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-          SECURITY_ENABLELOGIN: "true"
-          POLICIES_ENABLED: "true"
-      - task: frontend:dev:portal
-        vars:
-          PORT: '{{.PORTAL_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          # Point the portal's "Editor" app switcher at the editor we spawn here.
-          EDITOR_URL: 'http://localhost:{{.EDITOR_PORT}}/'
-          MOCKS: 'false'
-          OPEN: "true"
-      - task: frontend:dev
-        vars:
-          PORT: '{{.EDITOR_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-
-  dev:portal:all:saas:
-    desc: "Start SaaS backend + developer portal + editor concurrently on free ports"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5174{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5174{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      PORTAL_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-      EDITOR_PORT: '{{index (splitList "\n" .PORTS) 2}}'
-    deps:
-      - task: backend:dev:saas
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-          POLICIES_ENABLED: "true"
-      - task: frontend:dev:portal
-        vars:
-          PORT: '{{.PORTAL_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          EDITOR_URL: 'http://localhost:{{.EDITOR_PORT}}/'
-          MOCKS: 'false'
-          OPEN: "true"
-      - task: frontend:dev
-        vars:
-          PORT: '{{.EDITOR_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-
-  dev:portal:proxy:
-    desc: "Editor + portal on ONE origin + backend via live dev servers (shared-token login)"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 3000 5173 5174{{else}}{{.FIND_FREE_PORT_SH}} 8080 3000 5173 5174{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      PROXY_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-      EDITOR_PORT: '{{index (splitList "\n" .PORTS) 2}}'
-      PORTAL_PORT: '{{index (splitList "\n" .PORTS) 3}}'
-    deps:
-      - task: backend:dev
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-          SECURITY_ENABLELOGIN: "true"
-          POLICIES_ENABLED: "true"
-      - task: frontend:dev:proprietary
-        vars:
-          PORT: '{{.EDITOR_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-      - task: frontend:dev:portal
-        vars:
-          PORT: '{{.PORTAL_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          SUBPATH: portal
-          MOCKS: 'false'
-      - task: frontend:dev:portal:proxy:serve
-        vars:
-          PORT: '{{.PROXY_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-          EDITOR_DEV_URL: 'http://localhost:{{.EDITOR_PORT}}'
-          PORTAL_DEV_URL: 'http://localhost:{{.PORTAL_PORT}}'
-
-  dev:saas:
-    desc: "Start SaaS backend + frontend concurrently on free ports"
-    cmds:
-      - task: dev:_all
-        vars: { FRONTEND: saas, BACKEND: saas }
-
  dev:all:
    desc: "Start backend + frontend + engine concurrently on free ports"
-    cmds:
-      - task: dev:_all
-
-  dev:_all:
-    internal: true
    vars:
-      FRONTEND: '{{.FRONTEND | default "proprietary"}}'
-      BACKEND: '{{.BACKEND | default "proprietary"}}'
      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 5173 5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
+        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080,5173,5001{{else}}{{.FIND_FREE_PORT_SH}} 8080 5173 5001{{end}}'
      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
      FRONTEND_PORT: '{{index (splitList "\n" .PORTS) 1}}'
      ENGINE_PORT: '{{index (splitList "\n" .PORTS) 2}}'
@@ -207,12 +70,11 @@ tasks:
      - task: engine:dev
        vars:
          PORT: '{{.ENGINE_PORT}}'
-      - task: 'backend:dev:{{.BACKEND}}'
+      - task: backend:dev
        vars:
          PORT: '{{.BACKEND_PORT}}'
          AIENGINE_URL: 'http://localhost:{{.ENGINE_PORT}}'
-          AIENGINE_ENABLED: "true"
-      - task: 'frontend:dev:{{.FRONTEND}}'
+      - task: frontend:dev:prototypes
        vars:
          PORT: '{{.FRONTEND_PORT}}'
          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
@@ -228,24 +90,6 @@ tasks:
      - task: backend:build
      - task: frontend:build

-  preview:portal:proxy:
-    desc: "Build + serve editor + portal on ONE origin + backend (prod-like auth test)"
-    vars:
-      PORTS:
-        sh: '{{if eq OS "windows"}}{{.FIND_FREE_PORT_PS}} 8080 3000{{else}}{{.FIND_FREE_PORT_SH}} 8080 3000{{end}}'
-      BACKEND_PORT: '{{index (splitList "\n" .PORTS) 0}}'
-      PROXY_PORT: '{{index (splitList "\n" .PORTS) 1}}'
-    deps:
-      - task: backend:dev
-        vars:
-          PORT: '{{.BACKEND_PORT}}'
-          SECURITY_ENABLELOGIN: "true"
-          POLICIES_ENABLED: "true"
-      - task: frontend:preview:portal:proxy
-        vars:
-          PORT: '{{.PROXY_PORT}}'
-          BACKEND_URL: 'http://localhost:{{.BACKEND_PORT}}'
-
  # ============================================================
  # Test
  # ============================================================
@@ -314,6 +158,4 @@ tasks:
    desc: "Clean all build artifacts"
    cmds:
      - task: backend:clean
-      - task: frontend:clean
      - task: engine:clean
-      - task: pre-commit:clean
@@ -86,7 +86,7 @@ If you're using Tauri's built-in updater feature:

 ## Configuration Files

-### 1. Tauri Configuration (frontend/editor/src-tauri/tauri.conf.json)
+### 1. Tauri Configuration (frontend/src-tauri/tauri.conf.json)

 The Windows signing configuration is already set up:

@@ -1,8 +0,0 @@
-# Committed defaults for `task backend:dev:proprietary` (self-hosted / proprietary
-# flavor). Local overrides + secrets live in app/.env.proprietary.local (ignored).
-
-# Combined-billing account link (Mode A). Feature-flagged: OFF until release.
-# Flip to true in app/.env.proprietary.local to test linking locally.
-STIRLING_BILLING_ACCOUNT_LINK_ENABLED=false
-# SaaS base URL the linked instance calls (register + entitlement).
-STIRLING_BILLING_ACCOUNT_LINK_SAAS_BASE_URL=https://stirling.com/app
@@ -1,34 +0,0 @@
-###############################################################################
-# Stirling-PDF SaaS environment defaults.
-#
-# This file is committed and provides non-secret defaults loaded by
-# `task backend:dev:saas`. Put real values for secrets (passwords, project
-# refs, edge function secrets) in `.env.saas.local` - any variable set there
-# takes precedence over what's defined here.
-#
-# DO NOT commit `.env.saas.local`. Only `.env.saas` is checked in.
-###############################################################################
-
-# ---------- Supabase project ----------
-# Project reference (the subdomain part of <ref>.supabase.co). Required.
-# Set in .env.saas.local.
-SAAS_DB_PROJECT_REF=
-
-# Edge function secret used by billing/license rollup calls. Set in .env.saas.local.
-SUPABASE_EDGE_FUNCTION_SECRET=
-
-# ---------- Database (saas profile) ----------
-# Direct JDBC URL to the Supabase Postgres. Required when running the plain
-# `saas` profile (i.e. without `--spring.profiles.include=dev`).
-# Example: jdbc:postgresql://db.<project-ref>.supabase.co:5432/postgres
-SAAS_DB_URL=
-SAAS_DB_USERNAME=postgres
-SAAS_DB_PASSWORD=
-
-# ---------- Database (dev profile overrides) ----------
-# Used when `--spring.profiles.include=dev` is active. The dev profile
-# defaults the URL/username to the shared dev Supabase project, but the
-# password must still be provided in .env.saas.local.
-SAAS_DEV_DB_URL=
-SAAS_DEV_DB_USERNAME=postgres
-SAAS_DEV_DB_PASSWORD=
@@ -1,4 +0,0 @@
-# Whitelist committed env defaults. `.env.saas.local` (and any other .env*)
-# stays ignored via the root .gitignore.
-!.env.saas
-!.env.proprietary
@@ -44,10 +44,6 @@
      "moduleName": ".*",
      "moduleLicense": "The MIT License"
    },
-    {
-      "moduleName": ".*",
-      "moduleLicense": "MIT-0"
-    },
    {
      "moduleName": "com.github.jai-imageio:jai-imageio-core",
      "moduleLicense": "LICENSE.txt"
@@ -29,13 +29,13 @@ spotless {
    }
 }
 dependencies {
-    api "com.google.guava:guava:${guavaVersion}"
+    api 'com.google.guava:guava:33.6.0-jre'
    api 'org.springframework.boot:spring-boot-starter-webmvc'
    api 'org.springframework.boot:spring-boot-starter-aspectj'
    api 'com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sanitizer:20260313.1'
    api 'com.fathzer:javaluator:3.0.6'
    api 'com.posthog.java:posthog:1.2.0'
-    api "org.apache.commons:commons-lang3:${commonsLang3}"
+    api 'org.apache.commons:commons-lang3:3.20.0'
    api 'com.drewnoakes:metadata-extractor:2.20.0' // Image metadata extractor
    api 'com.vladsch.flexmark:flexmark-html2md-converter:0.64.8'
    api "org.apache.pdfbox:pdfbox:$pdfboxVersion"
@@ -51,36 +51,4 @@ dependencies {
    api 'org.simplejavamail:outlook-module:8.12.6' // MSG file support
    api 'jakarta.mail:jakarta.mail-api:2.1.5'
    runtimeOnly 'org.eclipse.angus:angus-mail:2.0.5'
-
-    // Tabula table extraction — used by the shared PDF parser and directly by downstream modules.
-    // api-scoped so downstream modules (core, proprietary) retain it on their compile classpath.
-    api ('technology.tabula:tabula:1.0.5') {
-        exclude group: 'org.slf4j', module: 'slf4j-simple'
-        exclude group: 'org.bouncycastle', module: 'bcprov-jdk15on'
-        exclude group: 'com.google.code.gson', module: 'gson'
-    }
-
-    api "com.stirling:jpdfium:${jpdfiumVersion}"
-
-    // -PjpdfiumPlatforms=all|<csv of linux-x64,linux-arm64,darwin-x64,darwin-arm64,windows-x64>
-    def jpdfiumPlatformsProp = (project.findProperty('jpdfiumPlatforms') ?: 'all').toString().trim()
-    def jpdfiumAllPlatforms = ['linux-x64', 'linux-arm64', 'darwin-x64', 'darwin-arm64', 'windows-x64']
-    def jpdfiumPlatforms = jpdfiumPlatformsProp == 'all'
-            ? jpdfiumAllPlatforms
-            : jpdfiumPlatformsProp.split(',').collect { it.trim() }.findAll { it }
-    def jpdfiumInvalid = jpdfiumPlatforms.findAll { !jpdfiumAllPlatforms.contains(it) }
-    if (jpdfiumInvalid) {
-        throw new GradleException("Unknown jpdfiumPlatforms value(s): ${jpdfiumInvalid.join(', ')}. " +
-                "Valid: ${jpdfiumAllPlatforms.join(', ')} or 'all'.")
-    }
-    logger.lifecycle("JPDFium native platforms: ${jpdfiumPlatforms.join(', ')}")
-    jpdfiumPlatforms.each { platform ->
-        runtimeOnly "com.stirling:jpdfium-natives-${platform}:${jpdfiumVersion}"
-    }
-
-    // Bucket4j (local in-process token bucket for RateLimitStore default impl)
-    implementation "com.bucket4j:bucket4j_jdk17-core:${bucket4jVersion}"
-
-    // ArchUnit: enforces module dependency direction (see ArchitectureTest)
-    testImplementation "com.tngtech.archunit:archunit-junit5:${archunitVersion}"
 }
@@ -1,142 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * Detects whether a page is one- or two-column from per-line bounding boxes, and classifies an
- * X-span into the column it belongs to. Detection is a midpoint vote at {@code pageWidth / 2}.
- *
- * <p>Capped at two columns by design — sufficient for the redaction target set (single-column
- * documents and IEEE-style two-column papers). 3+ column layouts (newspapers, magazines) and
- * off-centre gutters (asymmetric two-column) would need a histogram or clustering approach to
- * detect the actual gutter X. (future work)
- *
- * <p>Coordinates are PDFTextStripper screen space (top-left origin, Y increases downward).
- */
-public final class PageColumnLayout {
-
-    /**
-     * Slack when checking "crosses a gutter" so single-pixel overshoots don't mark a line as
-     * spanning.
-     */
-    public static final float SPAN_SLACK_PT = 2f;
-
-    /**
-     * Slack on each side of the page midpoint inside which a line is considered "spanning"
-     * (covering both columns) rather than belonging to one side.
-     */
-    private static final float MIDPOINT_SLACK_PT = 30f;
-
-    /**
-     * Minimum line width (points) for a line to count toward the two-column tally. Avoids false
-     * positives where right-aligned dates, page numbers, or short "Link" fragments next to a
-     * heading look like a second column when they're really just inline metadata.
-     */
-    private static final float MIN_COLUMN_LINE_WIDTH_PT = 100f;
-
-    /**
-     * Minimum number of clearly leftish AND clearly rightish lines (each of width &ge; {@link
-     * #MIN_COLUMN_LINE_WIDTH_PT}) required to call the page two-column. Anything below this falls
-     * back to single-column.
-     */
-    private static final int MIN_SIDE_LINES = 3;
-
-    private final List<float[]> columns;
-    private final List<float[]> gutters;
-
-    private PageColumnLayout(List<float[]> columns, List<float[]> gutters) {
-        this.columns = columns;
-        this.gutters = gutters;
-    }
-
-    /**
-     * Determines column layout from per-line bounding boxes ({@code [x1, _, x2, _]}). Counts lines
-     * whose X-midpoint sits clearly left of, or clearly right of, the page midpoint (with {@link
-     * #MIDPOINT_SLACK_PT} slack each side). If both sides have at least {@link #MIN_SIDE_LINES}
-     * lines, the page is treated as two-column with the gutter at the page midpoint. Otherwise it's
-     * single-column.
-     *
-     * <p>Cross-column lines must already be split: callers should feed boxes from a line extractor
-     * that splits same-Y glyphs at large X gaps (see {@code AllTextLineExtractor}). Without that
-     * split, IEEE-style aligned-baseline 2-column PDFs produce one wide merged box per row and the
-     * side tallies all end up classified as "spanning", falling to single-column.
-     */
-    public static PageColumnLayout fromLineBoxes(List<float[]> lineBoxes, float pageWidth) {
-        if (lineBoxes == null || lineBoxes.isEmpty()) {
-            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
-        }
-        float pageMid = pageWidth / 2f;
-        int left = 0, right = 0;
-        for (float[] lb : lineBoxes) {
-            if (lb == null || lb.length < 3) continue;
-            float width = lb[2] - lb[0];
-            // Skip narrow lines — dates, page numbers, "Link" labels next to a heading should
-            // not, on their own, make a single-column doc look two-column.
-            if (width < MIN_COLUMN_LINE_WIDTH_PT) continue;
-            float mid = (lb[0] + lb[2]) * 0.5f;
-            if (mid < pageMid - MIDPOINT_SLACK_PT) left++;
-            else if (mid > pageMid + MIDPOINT_SLACK_PT) right++;
-        }
-        if (left < MIN_SIDE_LINES || right < MIN_SIDE_LINES) {
-            return new PageColumnLayout(List.of(new float[] {0f, pageWidth}), List.of());
-        }
-        float gutterL = pageMid - MIDPOINT_SLACK_PT;
-        float gutterR = pageMid + MIDPOINT_SLACK_PT;
-        return new PageColumnLayout(
-                List.of(new float[] {0f, gutterL}, new float[] {gutterR, pageWidth}),
-                List.of(new float[] {gutterL, gutterR}));
-    }
-
-    /** All columns, left-to-right, as {@code [leftX, rightX]} pairs. Never empty. */
-    public List<float[]> columns() {
-        return columns;
-    }
-
-    /** Gutters between columns, left-to-right, as {@code [leftX, rightX]} pairs. */
-    public List<float[]> gutters() {
-        return gutters;
-    }
-
-    public int columnCount() {
-        return columns.size();
-    }
-
-    /**
-     * Returns the column index containing the X-midpoint of {@code [x1, x2]}, falling back to the
-     * closest column if the midpoint sits inside a gutter.
-     */
-    public int columnOf(float x1, float x2) {
-        float mid = (x1 + x2) * 0.5f;
-        int best = 0;
-        float bestDist = Float.MAX_VALUE;
-        for (int i = 0; i < columns.size(); i++) {
-            float[] c = columns.get(i);
-            if (mid >= c[0] && mid <= c[1]) return i;
-            float dist = mid < c[0] ? c[0] - mid : mid - c[1];
-            if (dist < bestDist) {
-                bestDist = dist;
-                best = i;
-            }
-        }
-        return best;
-    }
-
-    /**
-     * Returns every column index whose X-range overlaps {@code [x1, x2]} with at least {@link
-     * #SPAN_SLACK_PT} of intrusion. A normal in-column line returns one index; a line crossing a
-     * gutter returns two or more.
-     */
-    public int[] columnsCrossing(float x1, float x2) {
-        List<Integer> hits = new ArrayList<>();
-        for (int i = 0; i < columns.size(); i++) {
-            float[] c = columns.get(i);
-            float overlap = Math.min(x2, c[1]) - Math.max(x1, c[0]);
-            if (overlap > SPAN_SLACK_PT) hits.add(i);
-        }
-        if (hits.isEmpty()) hits.add(columnOf(x1, x2));
-        int[] out = new int[hits.size()];
-        for (int i = 0; i < hits.size(); i++) out[i] = hits.get(i);
-        return out;
-    }
-}
@@ -1,133 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.awt.geom.Point2D;
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.pdfbox.contentstream.PDFGraphicsStreamEngine;
-import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.graphics.image.PDImage;
-import org.apache.pdfbox.util.Matrix;
-
-/**
- * PDFGraphicsStreamEngine that intercepts {@code drawImage} calls and records each image's bounding
- * box in PDF user-space (origin bottom-left, Y up) by transforming the unit square through the
- * current transformation matrix (CTM).
- *
- * <p>Usage:
- *
- * <pre>{@code
- * PageImageLocator locator = new PageImageLocator(page, pageIndex);
- * locator.processPage(page);
- * List<ImageBox> boxes = locator.getImageBoxes();
- * }</pre>
- *
- * <p>Each {@link ImageBox} carries the 0-based page index and the axis-aligned bounding box {@code
- * (x1, y1, x2, y2)} in PDF user-space coordinates.
- */
-public final class PageImageLocator extends PDFGraphicsStreamEngine {
-
-    /**
-     * Bounding box of a raster or vector image found on a PDF page.
-     *
-     * @param pageIndex 0-based page index
-     * @param x1 left edge in PDF user-space (origin bottom-left)
-     * @param y1 bottom edge in PDF user-space
-     * @param x2 right edge
-     * @param y2 top edge
-     */
-    public record ImageBox(int pageIndex, float x1, float y1, float x2, float y2) {}
-
-    private final int pageIndex;
-    private final List<ImageBox> imageBoxes = new ArrayList<>();
-    private final Point2D.Float currentPoint = new Point2D.Float();
-
-    /**
-     * @param page the PDPage to process
-     * @param pageIndex 0-based index of this page in the document (stored on each returned {@link
-     *     ImageBox})
-     */
-    public PageImageLocator(PDPage page, int pageIndex) {
-        super(page);
-        this.pageIndex = pageIndex;
-    }
-
-    /** Returns all image bounding boxes collected during {@link #processPage}. */
-    public List<ImageBox> getImageBoxes() {
-        return imageBoxes;
-    }
-
-    @Override
-    public void drawImage(PDImage pdImage) throws IOException {
-        Matrix ctm = getGraphicsState().getCurrentTransformationMatrix();
-        // An image occupies the unit square (0,0)→(1,1) in image space.
-        // Transform all four corners through the CTM to get the page-space bounding box.
-        float a = ctm.getScaleX();
-        float b = ctm.getShearY();
-        float c = ctm.getShearX();
-        float d = ctm.getScaleY();
-        float e = ctm.getTranslateX();
-        float f = ctm.getTranslateY();
-        float[] xs = {e, a + e, c + e, a + c + e};
-        float[] ys = {f, b + f, d + f, b + d + f};
-        float x1 = Float.MAX_VALUE, y1 = Float.MAX_VALUE;
-        float x2 = -Float.MAX_VALUE, y2 = -Float.MAX_VALUE;
-        for (float x : xs) {
-            x1 = Math.min(x1, x);
-            x2 = Math.max(x2, x);
-        }
-        for (float y : ys) {
-            y1 = Math.min(y1, y);
-            y2 = Math.max(y2, y);
-        }
-        imageBoxes.add(new ImageBox(pageIndex, x1, y1, x2, y2));
-    }
-
-    // ---------- required abstract methods (no-op for path operations) ----------
-
-    @Override
-    public void appendRectangle(Point2D p0, Point2D p1, Point2D p2, Point2D p3) {}
-
-    @Override
-    public void clip(int windingRule) {}
-
-    @Override
-    public void moveTo(float x, float y) {
-        currentPoint.setLocation(x, y);
-    }
-
-    @Override
-    public void lineTo(float x, float y) {
-        currentPoint.setLocation(x, y);
-    }
-
-    @Override
-    public void curveTo(float x1, float y1, float x2, float y2, float x3, float y3) {
-        currentPoint.setLocation(x3, y3);
-    }
-
-    @Override
-    public Point2D getCurrentPoint() {
-        return currentPoint;
-    }
-
-    @Override
-    public void closePath() {}
-
-    @Override
-    public void endPath() {}
-
-    @Override
-    public void strokePath() {}
-
-    @Override
-    public void fillPath(int windingRule) {}
-
-    @Override
-    public void fillAndStrokePath(int windingRule) {}
-
-    @Override
-    public void shadingFill(COSName shadingName) {}
-}
@@ -1,148 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import java.io.IOException;
-import java.util.List;
-import java.util.Map;
-import java.util.stream.Collectors;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-
-/**
- * All PDF parser model types and the table-parser contract in one place.
- *
- * <p>Import as {@code import static stirling.software.SPDF.pdf.parser.PdfModels.*;} to use all
- * nested types without qualification.
- */
-public final class PdfModels {
-
-    private PdfModels() {}
-
-    // ── Geometry ──────────────────────────────────────────────────────────────
-
-    public record Bounds(float x, float y, float width, float height) {
-
-        public float right() {
-            return x + width;
-        }
-
-        public float bottom() {
-            return y + height;
-        }
-
-        public static Bounds merge(Bounds a, Bounds b) {
-            float x = Math.min(a.x, b.x);
-            float y = Math.min(a.y, b.y);
-            return new Bounds(
-                    x, y, Math.max(a.right(), b.right()) - x, Math.max(a.bottom(), b.bottom()) - y);
-        }
-    }
-
-    // ── Text fragments and lines ──────────────────────────────────────────────
-
-    /**
-     * A contiguous run of text from a single PDF content-stream string operation. {@code baseline}
-     * is preserved separately from bounds for line-grouping — characters of different sizes on the
-     * same visual line share a baseline but differ in top Y.
-     */
-    public record TextFragment(
-            String fragmentId,
-            String text,
-            Bounds bounds,
-            float baseline,
-            float fontSize,
-            String fontName,
-            boolean bold) {}
-
-    public record RawLine(
-            String lineId, List<TextFragment> fragments, Bounds bounds, int pageNumber) {
-
-        public String text() {
-            if (fragments.isEmpty()) return "";
-            StringBuilder sb = new StringBuilder();
-            TextFragment prev = null;
-            for (TextFragment f : fragments) {
-                if (prev != null) {
-                    float gap = f.bounds().x() - prev.bounds().right();
-                    float avgCharWidth = prev.bounds().width() / Math.max(prev.text().length(), 1);
-                    if (gap > avgCharWidth * 0.5f) sb.append(' ');
-                }
-                sb.append(f.text());
-                prev = f;
-            }
-            return sb.toString();
-        }
-
-        public float dominantFontSize() {
-            return fragments.stream()
-                    .collect(Collectors.groupingBy(TextFragment::fontSize, Collectors.counting()))
-                    .entrySet()
-                    .stream()
-                    .max(Map.Entry.comparingByValue())
-                    .map(Map.Entry::getKey)
-                    .orElse(0f);
-        }
-
-        public boolean hasBold() {
-            return fragments.stream().anyMatch(TextFragment::bold);
-        }
-    }
-
-    public record RawPage(int pageNumber, float widthPt, float heightPt, List<RawLine> lines) {}
-
-    // ── Table model ───────────────────────────────────────────────────────────
-
-    /**
-     * A single cell within a {@link TableRow}. {@code colSpan} and {@code rowSpan} are always 1 in
-     * v1 — span detection is deferred but the fields keep the schema stable.
-     */
-    public record TableCell(int colIndex, String text, Bounds bounds, int colSpan, int rowSpan) {
-
-        public static TableCell of(int colIndex, String text, Bounds bounds) {
-            return new TableCell(colIndex, text, bounds, 1, 1);
-        }
-    }
-
-    public record TableRow(int rowIndex, List<TableCell> cells) {}
-
-    /**
-     * A table as it appears on a single page. {@code headers} is empty in v1 — all rows are in
-     * {@code rows}. {@code rawRows} preserves exact Tabula text output for diagnostics. {@code
-     * confidence} is a heuristic score in [0.0, 1.0]. {@code continuedFromPage} is null in v1.
-     */
-    public record TableFragment(
-            String tableId,
-            int pageNumber,
-            Bounds bounds,
-            List<TableRow> headers,
-            List<TableRow> rows,
-            List<List<String>> rawRows,
-            int columnCount,
-            float confidence,
-            List<String> warnings,
-            Integer continuedFromPage) {}
-
-    // ── Page output ───────────────────────────────────────────────────────────
-
-    public record ParsedPage(
-            int pageNumber,
-            float widthPt,
-            float heightPt,
-            List<TableFragment> tables,
-            List<RawLine> layoutLines) {}
-
-    // ── Parser contract ───────────────────────────────────────────────────────
-
-    /**
-     * Extracts tables from a single page of a PDF. The caller owns the document lifecycle;
-     * implementations must not close it.
-     */
-    public interface TableParser {
-
-        /**
-         * @param document open PDF; must not be closed by the implementation
-         * @param rawPage page metadata and lines for the page to process
-         * @return zero or more table fragments found on the page, never null
-         */
-        List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException;
-    }
-}
@@ -1,256 +0,0 @@
-package stirling.software.SPDF.pdf.parser;
-
-import static stirling.software.SPDF.pdf.parser.PdfModels.*;
-
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.List;
-
-import org.apache.pdfbox.pdmodel.PDDocument;
-import org.springframework.stereotype.Service;
-
-import lombok.extern.slf4j.Slf4j;
-
-import technology.tabula.ObjectExtractor;
-import technology.tabula.Page;
-import technology.tabula.RectangularTextContainer;
-import technology.tabula.Table;
-import technology.tabula.extractors.BasicExtractionAlgorithm;
-import technology.tabula.extractors.ExtractionAlgorithm;
-import technology.tabula.extractors.SpreadsheetExtractionAlgorithm;
-
-/**
- * Primary {@link TableParser} implementation using Tabula's lattice-mode extraction.
- *
- * <h3>Algorithm</h3>
- *
- * Uses {@link SpreadsheetExtractionAlgorithm} (lattice mode), which detects tables from ruled lines
- * (horizontal and vertical PDF path operators). This is reliable for tables with visible borders.
- * Borderless or whitespace-delimited tables will not be detected — that requires stream mode, which
- * is deferred to a later iteration.
- *
- * <h3>Coordinate system</h3>
- *
- * Tabula normalises page coordinates so that (0,0) is the top-left corner and Y increases downward,
- * matching the {@link Bounds} convention used throughout this parser. No coordinate transformation
- * is needed when mapping Tabula cell bounds to {@link Bounds}.
- *
- * <h3>Known limitations</h3>
- *
- * <ul>
- *   <li>Borderless tables are not detected (use stream mode, deferred).
- *   <li>Colspan and rowspan are not detected; all cells report colSpan=1, rowSpan=1.
- *   <li>Header rows are not identified; all rows appear in {@code rows}, headers is empty.
- *   <li>Cross-page table linking is not performed; each page is independent.
- *   <li>Rotated tables (90°/270° pages) may produce incorrect bounds.
- * </ul>
- */
-@Service
-@Slf4j
-public class TabulaTableParser implements TableParser {
-
-    /** Lattice mode — reliable for tables with visible ruled borders. */
-    @Override
-    public List<TableFragment> parse(PDDocument document, RawPage rawPage) throws IOException {
-        return parseWithAlgorithm(
-                document, rawPage, new SpreadsheetExtractionAlgorithm(), "lattice");
-    }
-
-    /**
-     * Convenience overload for callers that only have a page number, not a full {@link RawPage}.
-     */
-    public List<TableFragment> parse(PDDocument document, int pageNumber) throws IOException {
-        return parse(document, new RawPage(pageNumber, 0f, 0f, List.of()));
-    }
-
-    /** Stream mode — whitespace-based column detection for borderless tables. */
-    public List<TableFragment> parseStream(PDDocument document, RawPage rawPage)
-            throws IOException {
-        return parseWithAlgorithm(document, rawPage, new BasicExtractionAlgorithm(), "stream");
-    }
-
-    private List<TableFragment> parseWithAlgorithm(
-            PDDocument document, RawPage rawPage, ExtractionAlgorithm algorithm, String modeName)
-            throws IOException {
-        int pageNumber = rawPage.pageNumber();
-
-        List<Table> tabulaTables;
-        try {
-            // Do NOT use try-with-resources: ObjectExtractor.close() closes the underlying
-            // PDDocument, which we don't own. The extractor holds no resources of its own.
-            ObjectExtractor extractor = new ObjectExtractor(document);
-            Page page = extractor.extract(pageNumber);
-            tabulaTables = new ArrayList<>(algorithm.extract(page));
-        } catch (Exception e) {
-            log.warn(
-                    "Tabula {} extraction failed on page {}: {}",
-                    modeName,
-                    pageNumber,
-                    e.getMessage());
-            return List.of();
-        }
-
-        if (tabulaTables.isEmpty()) {
-            log.debug("Page {}: no tables detected by Tabula ({})", pageNumber, modeName);
-            return List.of();
-        }
-
-        log.debug(
-                "Page {}: Tabula ({}) detected {} table(s)",
-                pageNumber,
-                modeName,
-                tabulaTables.size());
-
-        List<TableFragment> fragments = new ArrayList<>(tabulaTables.size());
-        for (int i = 0; i < tabulaTables.size(); i++) {
-            fragments.add(toFragment(tabulaTables.get(i), pageNumber, i));
-        }
-        return fragments;
-    }
-
-    // ── private helpers ──────────────────────────────────────────────────────────────────────────
-
-    private TableFragment toFragment(Table table, int pageNumber, int tableIndex) {
-        List<List<RectangularTextContainer>> tabulaRows = table.getRows();
-        List<String> warnings = new ArrayList<>();
-
-        List<List<String>> rawRows = buildRawRows(tabulaRows);
-        int colCount = inferColumnCount(rawRows, warnings);
-        List<TableRow> rows = buildRows(tabulaRows, colCount, warnings);
-        float confidence = computeConfidence(rawRows, colCount, warnings);
-        Bounds bounds = tableBounds(table);
-
-        String tableId = "tbl-p" + pageNumber + "-" + tableIndex;
-
-        if (!warnings.isEmpty()) {
-            log.warn("Page {}, table {}: {}", pageNumber, tableIndex, warnings);
-        }
-
-        return new TableFragment(
-                tableId,
-                pageNumber,
-                bounds,
-                List.of(), // headers: deferred to v2
-                rows,
-                rawRows,
-                colCount,
-                confidence,
-                Collections.unmodifiableList(warnings),
-                null); // continuedFromPage: deferred to v2
-    }
-
-    private List<List<String>> buildRawRows(List<List<RectangularTextContainer>> tabulaRows) {
-        List<List<String>> rawRows = new ArrayList<>(tabulaRows.size());
-        for (List<RectangularTextContainer> tabulaRow : tabulaRows) {
-            List<String> cells = new ArrayList<>(tabulaRow.size());
-            for (RectangularTextContainer cell : tabulaRow) {
-                cells.add(normaliseText(cell.getText()));
-            }
-            rawRows.add(Collections.unmodifiableList(cells));
-        }
-        return rawRows;
-    }
-
-    private List<TableRow> buildRows(
-            List<List<RectangularTextContainer>> tabulaRows, int colCount, List<String> warnings) {
-        List<TableRow> rows = new ArrayList<>(tabulaRows.size());
-        for (int rowIdx = 0; rowIdx < tabulaRows.size(); rowIdx++) {
-            List<RectangularTextContainer> tabulaRow = tabulaRows.get(rowIdx);
-            List<TableCell> cells = new ArrayList<>(tabulaRow.size());
-
-            for (int colIdx = 0; colIdx < tabulaRow.size(); colIdx++) {
-                RectangularTextContainer c = tabulaRow.get(colIdx);
-                Bounds cellBounds =
-                        new Bounds(
-                                (float) c.getX(),
-                                (float) c.getY(),
-                                (float) c.getWidth(),
-                                (float) c.getHeight());
-                cells.add(TableCell.of(colIdx, normaliseText(c.getText()), cellBounds));
-            }
-
-            if (tabulaRow.size() != colCount) {
-                warnings.add(
-                        "Row "
-                                + rowIdx
-                                + " has "
-                                + tabulaRow.size()
-                                + " cells; expected "
-                                + colCount);
-            }
-
-            rows.add(new TableRow(rowIdx, Collections.unmodifiableList(cells)));
-        }
-        return rows;
-    }
-
-    /**
-     * The canonical column count for a table is the size of the widest row. Tabula can produce
-     * uneven rows when a cell's ruling lines are partially missing.
-     */
-    private int inferColumnCount(List<List<String>> rawRows, List<String> warnings) {
-        if (rawRows.isEmpty()) return 0;
-        int max = rawRows.stream().mapToInt(List::size).max().orElse(0);
-        int mode =
-                rawRows.stream()
-                        .collect(
-                                java.util.stream.Collectors.groupingBy(
-                                        List::size, java.util.stream.Collectors.counting()))
-                        .entrySet()
-                        .stream()
-                        .max(java.util.Map.Entry.comparingByValue())
-                        .map(java.util.Map.Entry::getKey)
-                        .orElse(0);
-        if (max != mode) {
-            warnings.add("Inconsistent column count: modal=" + mode + " max=" + max);
-        }
-        return mode > 0 ? mode : max;
-    }
-
-    /**
-     * Heuristic confidence score in [0.0, 1.0].
-     *
-     * <ul>
-     *   <li>Starts at 1.0.
-     *   <li>-0.3 if only one column (single-column tables are usually not real tables).
-     *   <li>-0.1 per row with an inconsistent column count, capped at -0.4.
-     *   <li>-0.3 if the empty-cell ratio across all cells exceeds 80%.
-     * </ul>
-     */
-    private float computeConfidence(
-            List<List<String>> rawRows, int colCount, List<String> warnings) {
-        if (rawRows.isEmpty() || colCount == 0) return 0f;
-
-        float score = 1.0f;
-
-        if (colCount == 1) score -= 0.3f;
-
-        long inconsistentRows = rawRows.stream().filter(r -> r.size() != colCount).count();
-        score -= Math.min(inconsistentRows * 0.1f, 0.4f);
-
-        long totalCells = rawRows.stream().mapToLong(List::size).sum();
-        long emptyCells =
-                rawRows.stream().flatMap(Collection::stream).filter(String::isBlank).count();
-        if (totalCells > 0 && (float) emptyCells / totalCells > 0.8f) {
-            score -= 0.3f;
-        }
-
-        return Math.max(0f, Math.min(1f, score));
-    }
-
-    private Bounds tableBounds(Table table) {
-        return new Bounds(
-                (float) table.getX(),
-                (float) table.getY(),
-                (float) table.getWidth(),
-                (float) table.getHeight());
-    }
-
-    private String normaliseText(String raw) {
-        if (raw == null) return "";
-        // Tabula wraps multi-line cell content with \r\n — collapse to a single space.
-        return raw.replace("\r\n", " ").replace("\n", " ").replace("\r", " ").trim();
-    }
-}
@@ -75,12 +75,8 @@ public @interface AutoJobPostMapping {
    boolean queueable() default false;

    /**
-     * Relative resource weight (1-100). See {@link
-     * stirling.software.common.enumeration.ResourceWeight} for the standard tiers.
-     *
-     * <p>The default is a sentinel ({@link Integer#MIN_VALUE}); {@code
-     * AutoJobPostMappingWeightTest} fails the build if any endpoint leaves it unset. Runtime
-     * readers clamp the value into {@code [1, 100]}.
+     * Relative resource weight (1–100) used by the scheduler to prioritise / throttle jobs. Values
+     * below 1 are clamped to&nbsp;1, values above 100 to&nbsp;100.
     */
-    int resourceWeight() default Integer.MIN_VALUE;
+    int resourceWeight() default 50;
 }
@@ -1,24 +0,0 @@
-package stirling.software.common.cluster;
-
-/** Health and identity facade for the active cluster backplane. */
-public interface ClusterBackplane {
-
-    /** Returns {@code true} when the backplane is reachable; used for health endpoints. */
-    boolean isHealthy();
-
-    /** Returns {@code "inprocess"} or {@code "valkey"}. */
-    String backplaneType();
-
-    /** Returns this JVM's stable node id (matches {@code Cluster.resolvedNodeId()}). */
-    String localNodeId();
-
-    /**
-     * Whether this JVM should run the local {@link
-     * stirling.software.common.service.TaskManager#cleanupOldJobs()} loop. Distributed backplanes
-     * own job expiry via their own TTL, so they should override this to return {@code false}.
-     * Defaults to {@code true} so in-process behavior is preserved without an explicit override.
-     */
-    default boolean shouldRunLocalCleanup() {
-        return true;
-    }
-}
@@ -1,63 +0,0 @@
-package stirling.software.common.cluster;
-
-import org.springframework.context.annotation.Configuration;
-
-import jakarta.annotation.PostConstruct;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.model.ApplicationProperties.Cluster;
-
-/**
- * Validates that cluster mode is internally consistent.
- *
- * <p>Cluster settings are bound on the central {@link ApplicationProperties} under {@code
- * cluster.*}; this class reads {@link ApplicationProperties#getCluster()} and runs guards in {@link
- * PostConstruct}. When {@code cluster.enabled=false} (the default) all checks are skipped so a
- * single-instance install needs no new config.
- */
-@Slf4j
-@Configuration
-@RequiredArgsConstructor
-public class ClusterConfig {
-
-    private final ApplicationProperties applicationProperties;
-
-    @PostConstruct
-    void validate() {
-        Cluster cluster = applicationProperties.getCluster();
-        if (!cluster.isEnabled()) {
-            return;
-        }
-        String backplane = cluster.getBackplane();
-        if ("valkey".equalsIgnoreCase(backplane)) {
-            String url = cluster.getValkey() == null ? null : cluster.getValkey().getUrl();
-            if (url == null || url.isBlank()) {
-                throw new IllegalStateException(
-                        "cluster.enabled=true with backplane=valkey requires"
-                                + " cluster.valkey.url to be set (e.g."
-                                + " redis://valkey:6379).");
-            }
-        } else if ("inprocess".equalsIgnoreCase(backplane)) {
-            // enabled+inprocess only coordinates the local JVM; cross-node lookups will 410.
-            log.warn(
-                    "cluster.enabled=true with backplane=inprocess - only the local"
-                            + " JVM is coordinated. Cross-node lookups and the file proxy will fail."
-                            + " Use backplane=valkey for real multi-node deployments.");
-        } else {
-            // Fail fast on typos like "valky" so Spring doesn't later report a cryptic
-            // "no ClusterBackplane bean" - the operator-facing error names the bad value.
-            throw new IllegalStateException(
-                    "cluster.enabled=true with unknown backplane '"
-                            + backplane
-                            + "'. Valid values: inprocess | valkey.");
-        }
-        log.info(
-                "Cluster mode enabled (backplane={}, nodeRole={}, nodeId={}).",
-                backplane,
-                cluster.resolvedRole(),
-                cluster.resolvedNodeId());
-    }
-}
@@ -1,12 +0,0 @@
-package stirling.software.common.cluster;
-
-import java.time.Instant;
-
-/**
- * Snapshot of a peer node as recorded in the {@link InstanceRegistry}.
- *
- * @param internalAddress {@code host:port} the node listens on for {@code /internal/cluster/**}
- * @param role one of {@code WEB}, {@code WORKER}, {@code BOTH}
- */
-public record ClusterNode(
-        String nodeId, String internalAddress, Instant lastHeartbeat, String role) {}
@@ -1,21 +0,0 @@
-package stirling.software.common.cluster;
-
-import java.time.Duration;
-import java.util.Optional;
-
-/** Cluster-wide mutual exclusion primitive; non-reentrant by contract. */
-public interface DistributedLock {
-
-    Optional<LockHandle> tryAcquire(String lockKey, Duration leaseTime);
-
-    interface LockHandle extends AutoCloseable {
-        void release();
-
-        boolean renew(Duration leaseTime);
-
-        @Override
-        default void close() {
-            release();
-        }
-    }
-}
@@ -1,69 +0,0 @@
-package stirling.software.common.cluster;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-/** Low-level storage seam for result/job files. */
-public interface FileStore {
-
-    /** Stored file record. */
-    record Stored(String fileId, long size) {}
-
-    /**
-     * Store the given stream and return a generated file id and total bytes written. {@code owner}
-     * may be null to indicate the file has no associated user (anonymous / desktop / async job with
-     * no propagated security context); a non-null value is persisted alongside the data so {@link
-     * #getOwner(String)} can return it later for authorization checks.
-     */
-    Stored store(InputStream in, String originalName, String owner) throws IOException;
-
-    /** Store with no owner. Equivalent to {@link #store(InputStream, String, String)} with null. */
-    default Stored store(InputStream in, String originalName) throws IOException {
-        return store(in, originalName, null);
-    }
-
-    /**
-     * Store the file at {@code source} and return a generated file id and total bytes written.
-     *
-     * <p>Default implementation opens {@code source} as a stream and delegates to {@link
-     * #store(InputStream, String, String)}. Local-disk implementations should override to use a
-     * direct file-to-file copy ({@code Files.copy(source, dest)} can use {@code sendfile(2)} on
-     * Linux), which avoids the two-memory-copy hit of streaming a disk-backed upload through the
-     * JVM heap.
-     */
-    default Stored store(Path source, String originalName, String owner) throws IOException {
-        try (InputStream in = Files.newInputStream(source)) {
-            return store(in, originalName, owner);
-        }
-    }
-
-    /** Store with no owner. Equivalent to {@link #store(Path, String, String)} with null. */
-    default Stored store(Path source, String originalName) throws IOException {
-        return store(source, originalName, null);
-    }
-
-    /** Open the stored file for streaming reads. Caller closes. */
-    InputStream retrieve(String fileId) throws IOException;
-
-    /** Load the stored file into a byte array. */
-    byte[] retrieveBytes(String fileId) throws IOException;
-
-    /** Size of the stored file in bytes. */
-    long size(String fileId) throws IOException;
-
-    /** Delete the stored file. Returns true if a file was removed. */
-    boolean delete(String fileId);
-
-    /** Whether the file id exists in the store. */
-    boolean exists(String fileId);
-
-    /**
-     * Returns the owner identifier recorded at store time, or {@code null} if the file does not
-     * exist or was stored without an owner. Implementations must not throw when the file is missing
-     * or when the owner record is absent; they should return null so callers can treat "no owner"
-     * as a non-authoritative case.
-     */
-    String getOwner(String fileId) throws IOException;
-}
@@ -1,18 +0,0 @@
-package stirling.software.common.cluster;
-
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Optional;
-
-/** Maps {@code nodeId} to its internal cluster address, with TTL'd heartbeats. */
-public interface InstanceRegistry {
-
-    /** Register or refresh this node. Idempotent so a wiped backplane self-heals on next tick. */
-    void register(ClusterNode node, Duration heartbeatTtl);
-
-    Optional<ClusterNode> lookup(String nodeId);
-
-    Collection<ClusterNode> activeNodes();
-
-    void deregister(String nodeId);
-}
@@ -1,24 +0,0 @@
-package stirling.software.common.cluster;
-
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Optional;
-
-/** Cluster-visible storage for job status and result metadata, with TTL'd entries. */
-public interface JobStore {
-
-    /** Persist or overwrite a job entry. {@code ttl} sets the lifetime of the entry. */
-    void put(JobStoreEntry entry, Duration ttl);
-
-    Optional<JobStoreEntry> get(String jobId);
-
-    void delete(String jobId);
-
-    boolean exists(String jobId);
-
-    /** Reverse lookup: which job owns this result file id? */
-    Optional<String> findJobIdByFileId(String fileId);
-
-    /** Snapshot of every active entry. Used by admin/stats endpoints; may be O(n). */
-    Collection<JobStoreEntry> all();
-}
@@ -1,30 +0,0 @@
-package stirling.software.common.cluster;
-
-import java.time.Instant;
-import java.util.List;
-import java.util.Map;
-
-/**
- * Cluster-visible projection of a job's status and result metadata, as persisted in {@link
- * JobStore}.
- *
- * @param owningNodeId the node id that originally executed the job
- */
-public record JobStoreEntry(
-        String jobId,
-        JobState state,
-        String owningNodeId,
-        Instant createdAt,
-        Instant completedAt,
-        String error,
-        List<String> fileIds,
-        Map<String, String> resultMeta) {
-
-    /** Lifecycle states for a job as observed by the cluster. */
-    public enum JobState {
-        PENDING,
-        RUNNING,
-        COMPLETE,
-        FAILED
-    }
-}
@@ -1,16 +0,0 @@
-package stirling.software.common.cluster;
-
-import java.time.Duration;
-import java.util.Optional;
-
-/** Short-TTL namespaced key/value cache backed by the cluster backplane. */
-public interface KeyValueCache {
-
-    void put(String namespace, String key, String value, Duration ttl);
-
-    Optional<String> get(String namespace, String key);
-
-    void evict(String namespace, String key);
-
-    void evictNamespace(String namespace);
-}
@@ -1,24 +0,0 @@
-package stirling.software.common.cluster;
-
-import java.time.Duration;
-
-/**
- * Token-bucket rate limiting backed by the cluster backplane.
- *
- * <p>In-process implementations enforce a per-JVM limit; distributed implementations enforce a
- * single global limit across every node. Both use a Bucket4j greedy-refill token bucket so the
- * semantics match across single-node and cluster deployments.
- */
-public interface RateLimitStore {
-
-    /**
-     * Attempt to consume one token from the bucket identified by {@code bucketKey}.
-     *
-     * @param bucketKey opaque key identifying the bucket (e.g. {@code api:user:123})
-     * @param capacity bucket capacity
-     * @param refillPeriod time window over which {@code capacity} tokens refill
-     */
-    RateLimitDecision tryConsume(String bucketKey, long capacity, Duration refillPeriod);
-
-    record RateLimitDecision(boolean allowed, long remainingTokens, long nanosToWaitForRefill) {}
-}
@@ -1,7 +0,0 @@
-package stirling.software.common.cluster;
-
-/** Records one increment per sticky-session miss (a 410 Gone for a job owned by another node). */
-@FunctionalInterface
-public interface StickyMissRecorder {
-    void recordStickyMiss();
-}
@@ -1,31 +0,0 @@
-package stirling.software.common.cluster.inprocess;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.cluster.ClusterBackplane;
-import stirling.software.common.model.ApplicationProperties;
-
-@Slf4j
-public class InProcessClusterBackplane implements ClusterBackplane {
-
-    private final ApplicationProperties applicationProperties;
-
-    public InProcessClusterBackplane(ApplicationProperties applicationProperties) {
-        this.applicationProperties = applicationProperties;
-    }
-
-    @Override
-    public boolean isHealthy() {
-        return true;
-    }
-
-    @Override
-    public String backplaneType() {
-        return "inprocess";
-    }
-
-    @Override
-    public String localNodeId() {
-        return applicationProperties.getCluster().resolvedNodeId();
-    }
-}
@@ -1,65 +0,0 @@
-package stirling.software.common.cluster.inprocess;
-
-import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.cluster.ClusterBackplane;
-import stirling.software.common.cluster.DistributedLock;
-import stirling.software.common.cluster.InstanceRegistry;
-import stirling.software.common.cluster.JobStore;
-import stirling.software.common.cluster.KeyValueCache;
-import stirling.software.common.cluster.RateLimitStore;
-import stirling.software.common.model.ApplicationProperties;
-
-/**
- * Default cluster backplane wiring: every interface gets an {@code InProcess*} bean. Active when
- * cluster mode is off or {@code cluster.backplane=inprocess}.
- */
-@Slf4j
-@Configuration
-@ConditionalOnExpression(
-        "!${cluster.enabled:false} ||"
-                + " '${cluster.backplane:inprocess}'.equalsIgnoreCase('inprocess')")
-public class InProcessClusterConfiguration {
-
-    @Bean
-    @ConditionalOnMissingBean
-    public ClusterBackplane clusterBackplane(ApplicationProperties applicationProperties) {
-        log.info("Cluster backplane: in-process (single node)");
-        return new InProcessClusterBackplane(applicationProperties);
-    }
-
-    @Bean
-    @ConditionalOnMissingBean
-    public JobStore jobStore() {
-        return new InProcessJobStore();
-    }
-
-    @Bean
-    @ConditionalOnMissingBean
-    public RateLimitStore rateLimitStore() {
-        return new InProcessRateLimitStore();
-    }
-
-    @Bean
-    @ConditionalOnMissingBean
-    public DistributedLock distributedLock() {
-        return new InProcessDistributedLock();
-    }
-
-    @Bean
-    @ConditionalOnMissingBean
-    public KeyValueCache keyValueCache() {
-        return new InProcessKeyValueCache();
-    }
-
-    @Bean
-    @ConditionalOnMissingBean
-    public InstanceRegistry instanceRegistry() {
-        return new InProcessInstanceRegistry();
-    }
-}
@@ -1,128 +0,0 @@
-package stirling.software.common.cluster.inprocess;
-
-import java.time.Duration;
-import java.util.Optional;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.concurrent.atomic.AtomicLong;
-
-import stirling.software.common.cluster.DistributedLock;
-
-/**
- * In-process {@link DistributedLock}, non-reentrant per the interface contract, with lease-expiry
- * semantics that mirror a SET-NX-EX style distributed backend.
- *
- * <p>Each lock state carries a per-acquire {@code ownerToken} and an {@code expiryNanos}; another
- * caller can take over once the lease has elapsed even if the original holder never called {@link
- * LockHandle#release()}. This matters mostly for parity with the Valkey-backed implementation
- * (Redis {@code SETEX} auto-expires the key); within a single JVM a crashed holder takes its lock
- * state with it, but tests and code that rely on the {@code leaseTime} parameter still need it to
- * be honored.
- *
- * <p>Expiry is lazy: an expired lock state lingers in the map until the next acquire attempt for
- * the same key replaces it. Per-key cleanup also happens on explicit {@link LockHandle#release()},
- * so a balanced acquire/release workload keeps the map size bounded.
- */
-public class InProcessDistributedLock implements DistributedLock {
-
-    private final ConcurrentHashMap<String, LockState> locks = new ConcurrentHashMap<>();
-    private final AtomicLong tokenSeq = new AtomicLong();
-
-    /**
-     * Lease state for a single acquired lock. {@code ownerToken} prevents a former holder from
-     * releasing or renewing a lock now owned by someone else after lease expiry; {@code
-     * expiryNanos} is read/written only inside {@link ConcurrentHashMap#compute} so the bin lock
-     * provides the necessary happens-before guarantee.
-     */
-    private static final class LockState {
-        final long ownerToken;
-        long expiryNanos;
-
-        LockState(long ownerToken, long expiryNanos) {
-            this.ownerToken = ownerToken;
-            this.expiryNanos = expiryNanos;
-        }
-    }
-
-    @Override
-    public Optional<LockHandle> tryAcquire(String lockKey, Duration leaseTime) {
-        long token = tokenSeq.incrementAndGet();
-        long nowNanos = System.nanoTime();
-        long expiryNanos = nowNanos + leaseTime.toNanos();
-        boolean[] acquired = {false};
-        locks.compute(
-                lockKey,
-                (k, existing) -> {
-                    if (existing == null || existing.expiryNanos - nowNanos <= 0L) {
-                        // No lock, or the previous lease has expired - we take it. Subtraction
-                        // form avoids the long-overflow trap that would bite a naive
-                        // expiryNanos <= nowNanos comparison around System.nanoTime() rollover.
-                        acquired[0] = true;
-                        return new LockState(token, expiryNanos);
-                    }
-                    return existing;
-                });
-        if (!acquired[0]) {
-            return Optional.empty();
-        }
-        return Optional.of(new InProcessHandle(lockKey, token));
-    }
-
-    private void releaseInternal(String lockKey, long token) {
-        locks.compute(
-                lockKey,
-                (k, existing) -> {
-                    if (existing == null || existing.ownerToken != token) {
-                        // Already removed, expired-and-replaced, or never ours.
-                        return existing;
-                    }
-                    return null;
-                });
-    }
-
-    private boolean renewInternal(String lockKey, long token, Duration leaseTime) {
-        long nowNanos = System.nanoTime();
-        boolean[] renewed = {false};
-        locks.compute(
-                lockKey,
-                (k, existing) -> {
-                    if (existing == null
-                            || existing.ownerToken != token
-                            || existing.expiryNanos - nowNanos <= 0L) {
-                        // Lock is gone or expired; renewal is a no-op so the caller can detect it.
-                        return existing;
-                    }
-                    existing.expiryNanos = nowNanos + leaseTime.toNanos();
-                    renewed[0] = true;
-                    return existing;
-                });
-        return renewed[0];
-    }
-
-    private final class InProcessHandle implements LockHandle {
-        private final String lockKey;
-        private final long token;
-        private boolean released;
-
-        InProcessHandle(String lockKey, long token) {
-            this.lockKey = lockKey;
-            this.token = token;
-        }
-
-        @Override
-        public synchronized void release() {
-            if (released) {
-                return;
-            }
-            released = true;
-            releaseInternal(lockKey, token);
-        }
-
-        @Override
-        public synchronized boolean renew(Duration leaseTime) {
-            if (released) {
-                return false;
-            }
-            return renewInternal(lockKey, token, leaseTime);
-        }
-    }
-}
@@ -1,42 +0,0 @@
-package stirling.software.common.cluster.inprocess;
-
-import java.time.Duration;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.Optional;
-import java.util.concurrent.atomic.AtomicReference;
-
-import stirling.software.common.cluster.ClusterNode;
-import stirling.software.common.cluster.InstanceRegistry;
-
-public class InProcessInstanceRegistry implements InstanceRegistry {
-
-    private final AtomicReference<ClusterNode> self = new AtomicReference<>();
-
-    @Override
-    public void register(ClusterNode node, Duration heartbeatTtl) {
-        self.set(node);
-    }
-
-    @Override
-    public Optional<ClusterNode> lookup(String nodeId) {
-        ClusterNode current = self.get();
-        return current != null && current.nodeId().equals(nodeId)
-                ? Optional.of(current)
-                : Optional.empty();
-    }
-
-    @Override
-    public Collection<ClusterNode> activeNodes() {
-        ClusterNode current = self.get();
-        return current == null ? Collections.emptyList() : Collections.singletonList(current);
-    }
-
-    @Override
-    public void deregister(String nodeId) {
-        ClusterNode current = self.get();
-        if (current != null && current.nodeId().equals(nodeId)) {
-            self.set(null);
-        }
-    }
-}
@@ -1,96 +0,0 @@
-package stirling.software.common.cluster.inprocess;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.ConcurrentHashMap;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.cluster.JobStore;
-import stirling.software.common.cluster.JobStoreEntry;
-
-@Slf4j
-public class InProcessJobStore implements JobStore {
-
-    private final ConcurrentHashMap<String, Holder> entries = new ConcurrentHashMap<>();
-
-    @Override
-    public void put(JobStoreEntry entry, Duration ttl) {
-        Instant expiry = ttl == null ? Instant.MAX : Instant.now().plus(ttl);
-        entries.put(entry.jobId(), new Holder(entry, expiry));
-    }
-
-    @Override
-    public Optional<JobStoreEntry> get(String jobId) {
-        Holder h = entries.get(jobId);
-        if (h == null) {
-            return Optional.empty();
-        }
-        if (h.isExpired()) {
-            entries.remove(jobId, h);
-            return Optional.empty();
-        }
-        return Optional.of(h.entry);
-    }
-
-    @Override
-    public void delete(String jobId) {
-        entries.remove(jobId);
-    }
-
-    @Override
-    public boolean exists(String jobId) {
-        return get(jobId).isPresent();
-    }
-
-    @Override
-    public Optional<String> findJobIdByFileId(String fileId) {
-        for (Map.Entry<String, Holder> e : entries.entrySet()) {
-            Holder h = e.getValue();
-            if (h.isExpired()) {
-                continue;
-            }
-            List<String> fileIds = h.entry.fileIds();
-            if (fileIds != null && fileIds.contains(fileId)) {
-                return Optional.of(e.getKey());
-            }
-        }
-        return Optional.empty();
-    }
-
-    @Override
-    public Collection<JobStoreEntry> all() {
-        List<JobStoreEntry> result = new ArrayList<>(entries.size());
-        for (Holder h : entries.values()) {
-            if (!h.isExpired()) {
-                result.add(h.entry);
-            }
-        }
-        return result;
-    }
-
-    /** Drop entries whose TTL has elapsed. Called by the {@code TaskManager} cleanup scheduler. */
-    public int purgeExpired() {
-        int removed = 0;
-        Instant now = Instant.now();
-        for (Map.Entry<String, Holder> e : entries.entrySet()) {
-            if (!e.getValue().expiry.equals(Instant.MAX) && e.getValue().expiry.isBefore(now)) {
-                if (entries.remove(e.getKey(), e.getValue())) {
-                    removed++;
-                }
-            }
-        }
-        return removed;
-    }
-
-    private record Holder(JobStoreEntry entry, Instant expiry) {
-        boolean isExpired() {
-            return !expiry.equals(Instant.MAX) && expiry.isBefore(Instant.now());
-        }
-    }
-}
@@ -1,55 +0,0 @@
-package stirling.software.common.cluster.inprocess;
-
-import java.time.Duration;
-import java.time.Instant;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.ConcurrentHashMap;
-
-import stirling.software.common.cluster.KeyValueCache;
-
-public class InProcessKeyValueCache implements KeyValueCache {
-
-    private final ConcurrentHashMap<String, ConcurrentHashMap<String, Expiring>> namespaces =
-            new ConcurrentHashMap<>();
-
-    @Override
-    public void put(String namespace, String key, String value, Duration ttl) {
-        Instant expiry = ttl == null ? Instant.MAX : Instant.now().plus(ttl);
-        namespaces
-                .computeIfAbsent(namespace, n -> new ConcurrentHashMap<>())
-                .put(key, new Expiring(value, expiry));
-    }
-
-    @Override
-    public Optional<String> get(String namespace, String key) {
-        Map<String, Expiring> ns = namespaces.get(namespace);
-        if (ns == null) {
-            return Optional.empty();
-        }
-        Expiring e = ns.get(key);
-        if (e == null) {
-            return Optional.empty();
-        }
-        if (e.expiry.isBefore(Instant.now())) {
-            ns.remove(key, e);
-            return Optional.empty();
-        }
-        return Optional.of(e.value);
-    }
-
-    @Override
-    public void evict(String namespace, String key) {
-        Map<String, Expiring> ns = namespaces.get(namespace);
-        if (ns != null) {
-            ns.remove(key);
-        }
-    }
-
-    @Override
-    public void evictNamespace(String namespace) {
-        namespaces.remove(namespace);
-    }
-
-    private record Expiring(String value, Instant expiry) {}
-}
@@ -1,49 +0,0 @@
-package stirling.software.common.cluster.inprocess;
-
-import java.time.Duration;
-import java.util.Collections;
-import java.util.LinkedHashMap;
-import java.util.Map;
-
-import io.github.bucket4j.Bandwidth;
-import io.github.bucket4j.Bucket;
-import io.github.bucket4j.ConsumptionProbe;
-import io.github.bucket4j.local.LocalBucketBuilder;
-
-import stirling.software.common.cluster.RateLimitStore;
-
-/** Bucket4j-backed token bucket implementation of {@link RateLimitStore}. */
-public class InProcessRateLimitStore implements RateLimitStore {
-
-    /** Cap to bound memory; oldest accessed buckets are evicted. */
-    private static final int MAX_BUCKETS = 10_000;
-
-    private final Map<String, Bucket> buckets =
-            Collections.synchronizedMap(
-                    new LinkedHashMap<String, Bucket>(256, 0.75f, true) {
-                        @Override
-                        protected boolean removeEldestEntry(Map.Entry<String, Bucket> eldest) {
-                            return size() > MAX_BUCKETS;
-                        }
-                    });
-
-    @Override
-    public RateLimitDecision tryConsume(String bucketKey, long capacity, Duration refillPeriod) {
-        String compositeKey = bucketKey + "|" + capacity + "|" + refillPeriod.toNanos();
-        Bucket bucket =
-                buckets.computeIfAbsent(compositeKey, k -> buildBucket(capacity, refillPeriod));
-        ConsumptionProbe probe = bucket.tryConsumeAndReturnRemaining(1);
-        return new RateLimitDecision(
-                probe.isConsumed(),
-                probe.getRemainingTokens(),
-                probe.isConsumed() ? 0L : probe.getNanosToWaitForRefill());
-    }
-
-    private static Bucket buildBucket(long capacity, Duration refillPeriod) {
-        Bandwidth limit =
-                Bandwidth.builder().capacity(capacity).refillGreedy(capacity, refillPeriod).build();
-        LocalBucketBuilder builder = Bucket.builder();
-        builder.addLimit(limit);
-        return builder.build();
-    }
-}
@@ -1,205 +0,0 @@
-package stirling.software.common.cluster.inprocess;
-
-import java.io.BufferedInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.UUID;
-import java.util.concurrent.locks.ReentrantLock;
-import java.util.regex.Pattern;
-
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.common.cluster.FileStore;
-
-/** Local-disk {@link FileStore} storing files under a base directory keyed by a UUID file id. */
-@Slf4j
-public class LocalDiskFileStore implements FileStore {
-
-    private static final String OWNER_SUFFIX = ".owner";
-
-    // File ids are generated as random UUIDs; reject anything else so a tainted id can never reach
-    // Files.* APIs (defence in depth on top of the resolve() prefix check, and silences CodeQL's
-    // path-injection finding on the resolveOwner sidecar lookup).
-    private static final Pattern UUID_PATTERN =
-            Pattern.compile(
-                    "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$");
-
-    private final String baseDirPath;
-    // Fixed-size lock stripes so concurrent store/delete on the same (or colliding) fileId
-    // serialise the data-file + owner-sidecar pair as one critical section. Striped (not
-    // per-id) so the map never has to be cleaned up; collisions across unrelated ids are
-    // harmless contention.
-    private static final int LOCK_STRIPES = 64;
-    private final ReentrantLock[] stripes = new ReentrantLock[LOCK_STRIPES];
-
-    public LocalDiskFileStore(String baseDirPath) {
-        this.baseDirPath = baseDirPath;
-        for (int i = 0; i < LOCK_STRIPES; i++) {
-            stripes[i] = new ReentrantLock();
-        }
-    }
-
-    @Override
-    public Stored store(InputStream in, String originalName, String owner) throws IOException {
-        String fileId = UUID.randomUUID().toString();
-        Path filePath = resolve(fileId);
-        Files.createDirectories(filePath.getParent());
-        ReentrantLock lock = acquire(fileId);
-        boolean success = false;
-        try {
-            long size = Files.copy(in, filePath);
-            writeOwner(fileId, owner);
-            success = true;
-            return new Stored(fileId, size);
-        } finally {
-            if (!success) {
-                cleanupAfterFailedStore(fileId, filePath);
-            }
-            release(fileId, lock);
-        }
-    }
-
-    /**
-     * File-to-file copy. {@link Files#copy(Path, Path, java.nio.file.CopyOption...)} can use {@code
-     * sendfile(2)} on Linux for a zero-copy kernel transfer when source and destination share a
-     * filesystem, avoiding the streaming overhead of pulling the bytes through the JVM heap. Reads
-     * the source size before copying so the post-copy stat is unnecessary.
-     */
-    @Override
-    public Stored store(Path source, String originalName, String owner) throws IOException {
-        String fileId = UUID.randomUUID().toString();
-        Path filePath = resolve(fileId);
-        Files.createDirectories(filePath.getParent());
-        long size = Files.size(source);
-        ReentrantLock lock = acquire(fileId);
-        boolean success = false;
-        try {
-            Files.copy(source, filePath);
-            writeOwner(fileId, owner);
-            success = true;
-            return new Stored(fileId, size);
-        } finally {
-            if (!success) {
-                cleanupAfterFailedStore(fileId, filePath);
-            }
-            release(fileId, lock);
-        }
-    }
-
-    private void writeOwner(String fileId, String owner) throws IOException {
-        if (owner == null || owner.isBlank()) {
-            return;
-        }
-        Path ownerPath = resolveOwner(fileId);
-        Files.write(ownerPath, owner.getBytes(StandardCharsets.UTF_8));
-    }
-
-    private void cleanupAfterFailedStore(String fileId, Path filePath) {
-        try {
-            Files.deleteIfExists(filePath);
-        } catch (IOException cleanupEx) {
-            log.warn("Failed to clean up partial file {} after store failure", filePath, cleanupEx);
-        }
-        try {
-            Files.deleteIfExists(resolveOwner(fileId));
-        } catch (IOException cleanupEx) {
-            log.warn("Failed to clean up owner sidecar for {} after store failure", fileId);
-        }
-    }
-
-    @Override
-    public InputStream retrieve(String fileId) throws IOException {
-        return new BufferedInputStream(Files.newInputStream(resolve(fileId)));
-    }
-
-    @Override
-    public byte[] retrieveBytes(String fileId) throws IOException {
-        Path filePath = resolve(fileId);
-        if (!Files.exists(filePath)) {
-            throw new IOException("File not found with ID: " + fileId);
-        }
-        return Files.readAllBytes(filePath);
-    }
-
-    @Override
-    public long size(String fileId) throws IOException {
-        Path filePath = resolve(fileId);
-        if (!Files.exists(filePath)) {
-            throw new IOException("File not found with ID: " + fileId);
-        }
-        return Files.size(filePath);
-    }
-
-    @Override
-    public boolean delete(String fileId) {
-        ReentrantLock lock = acquire(fileId);
-        try {
-            // Data first, owner second: a concurrent retrieve that observes the transient
-            // (data-gone, owner-still-present) window simply fails with IOException; the inverse
-            // order would briefly look like an unowned file and could grant cross-user access.
-            boolean removed;
-            try {
-                removed = Files.deleteIfExists(resolve(fileId));
-            } catch (IOException e) {
-                log.error("Error deleting file with ID: {}", fileId, e);
-                return false;
-            }
-            try {
-                Files.deleteIfExists(resolveOwner(fileId));
-            } catch (IOException e) {
-                log.warn("Error deleting owner sidecar for file ID: {}", fileId, e);
-            }
-            return removed;
-        } finally {
-            release(fileId, lock);
-        }
-    }
-
-    @Override
-    public boolean exists(String fileId) {
-        return Files.exists(resolve(fileId));
-    }
-
-    @Override
-    public String getOwner(String fileId) throws IOException {
-        Path ownerPath = resolveOwner(fileId);
-        if (!Files.exists(ownerPath)) {
-            return null;
-        }
-        byte[] bytes = Files.readAllBytes(ownerPath);
-        if (bytes.length == 0) {
-            return null;
-        }
-        return new String(bytes, StandardCharsets.UTF_8);
-    }
-
-    public Path resolve(String fileId) {
-        if (fileId == null || !UUID_PATTERN.matcher(fileId).matches()) {
-            throw new IllegalArgumentException("Invalid file ID");
-        }
-        Path basePath = Path.of(baseDirPath).normalize().toAbsolutePath();
-        Path resolvedPath = basePath.resolve(fileId).normalize();
-        if (!resolvedPath.startsWith(basePath)) {
-            throw new IllegalArgumentException("File ID resolves to an invalid path");
-        }
-        return resolvedPath;
-    }
-
-    private Path resolveOwner(String fileId) {
-        Path data = resolve(fileId);
-        return data.resolveSibling(data.getFileName().toString() + OWNER_SUFFIX);
-    }
-
-    private ReentrantLock acquire(String fileId) {
-        ReentrantLock lock = stripes[(fileId.hashCode() & Integer.MAX_VALUE) % LOCK_STRIPES];
-        lock.lock();
-        return lock;
-    }
-
-    private void release(String fileId, ReentrantLock lock) {
-        lock.unlock();
-    }
-}
@@ -1,29 +0,0 @@
-package stirling.software.common.cluster.inprocess;
-
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-
-import stirling.software.common.cluster.FileStore;
-
-/**
- * Always-on wiring for the per-node local-disk {@link FileStore}. Active when {@code
- * cluster.artifactStore=local} (the default; {@code matchIfMissing=true}). The S3 artifact-store
- * supplies its own bean when {@code cluster.artifactStore=s3}.
- */
-@Configuration
-@ConditionalOnProperty(
-        prefix = "cluster",
-        name = "artifactStore",
-        havingValue = "local",
-        matchIfMissing = true)
-public class LocalDiskFileStoreConfiguration {
-
-    @Bean
-    @ConditionalOnMissingBean
-    public FileStore fileStore(@Value("${stirling.tempDir:/tmp/stirling-files}") String tempDir) {
-        return new LocalDiskFileStore(tempDir);
-    }
-}
@@ -3,6 +3,7 @@ package stirling.software.common.configuration;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.List;
 import java.util.Locale;
 import java.util.Properties;
@@ -121,17 +122,17 @@ public class AppConfig {

    @Bean(name = "RunningInDocker")
    public boolean runningInDocker() {
-        return Files.exists(Path.of("/.dockerenv"));
+        return Files.exists(Paths.get("/.dockerenv"));
    }

    @Bean(name = "configDirMounted")
    public boolean isRunningInDockerWithConfig() {
-        Path dockerEnv = Path.of("/.dockerenv");
+        Path dockerEnv = Paths.get("/.dockerenv");
        // default to true if not docker
        if (!Files.exists(dockerEnv)) {
            return true;
        }
-        Path mountInfo = Path.of("/proc/1/mountinfo");
+        Path mountInfo = Paths.get("/proc/1/mountinfo");
        // this should always exist, if not some unknown usecase
        if (!Files.exists(mountInfo)) {
            return true;
@@ -7,6 +7,7 @@ import java.net.URISyntaxException;
 import java.net.URL;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.nio.file.StandardCopyOption;
 import java.util.List;

@@ -26,7 +27,7 @@ public class ConfigInitializer {

    public void ensureConfigExists() throws IOException, URISyntaxException {
        // 1) If settings file doesn't exist, create from template
-        Path destPath = Path.of(InstallationPathConfig.getSettingsPath());
+        Path destPath = Paths.get(InstallationPathConfig.getSettingsPath());

        boolean settingsFileExists = Files.exists(destPath);

@@ -38,7 +39,7 @@ public class ConfigInitializer {
            if (settingsFileExists) {
                // move settings.yml to settings.yml.{timestamp}.bak
                Path backupPath =
-                        Path.of(
+                        Paths.get(
                                InstallationPathConfig.getSettingsPath()
                                        + "."
                                        + System.currentTimeMillis()
@@ -79,7 +80,6 @@ public class ConfigInitializer {
            YamlHelper settingsFile = new YamlHelper(settingTempPath);

            migrateEnterpriseEditionToPremium(settingsFile, settingsTemplateFile);
-            migrateProFeaturesKeyCasing(settingsFile, settingsTemplateFile);

            boolean changesMade =
                    settingsTemplateFile.updateValuesFromYaml(settingsFile, settingsTemplateFile);
@@ -95,7 +95,7 @@ public class ConfigInitializer {
        }

        // 3) Ensure custom settings file exists
-        Path customSettingsPath = Path.of(InstallationPathConfig.getCustomSettingsPath());
+        Path customSettingsPath = Paths.get(InstallationPathConfig.getCustomSettingsPath());
        if (Files.notExists(customSettingsPath)) {
            Files.createFile(customSettingsPath);
            log.info("Created custom_settings file: {}", customSettingsPath);
@@ -116,52 +116,31 @@ public class ConfigInitializer {
        }
        if (yaml.getValueByExactKeyPath("enterpriseEdition", "SSOAutoLogin") != null) {
            template.updateValue(
-                    List.of("premium", "proFeatures", "ssoAutoLogin"),
+                    List.of("premium", "proFeatures", "SSOAutoLogin"),
                    yaml.getValueByExactKeyPath("enterpriseEdition", "SSOAutoLogin"));
        }
        if (yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "autoUpdateMetadata")
                != null) {
            template.updateValue(
-                    List.of("premium", "proFeatures", "customMetadata", "autoUpdateMetadata"),
+                    List.of("premium", "proFeatures", "CustomMetadata", "autoUpdateMetadata"),
                    yaml.getValueByExactKeyPath(
                            "enterpriseEdition", "CustomMetadata", "autoUpdateMetadata"));
        }
        if (yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "author") != null) {
            template.updateValue(
-                    List.of("premium", "proFeatures", "customMetadata", "author"),
+                    List.of("premium", "proFeatures", "CustomMetadata", "author"),
                    yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "author"));
        }
        if (yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "creator") != null) {
            template.updateValue(
-                    List.of("premium", "proFeatures", "customMetadata", "creator"),
+                    List.of("premium", "proFeatures", "CustomMetadata", "creator"),
                    yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "creator"));
        }
        if (yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "producer")
                != null) {
            template.updateValue(
-                    List.of("premium", "proFeatures", "customMetadata", "producer"),
+                    List.of("premium", "proFeatures", "CustomMetadata", "producer"),
                    yaml.getValueByExactKeyPath("enterpriseEdition", "CustomMetadata", "producer"));
        }
    }
-
-    // TODO: Remove post migration
-    // settings.yml.template renamed the two non-camelCase proFeatures keys
-    // ("SSOAutoLogin" -> "ssoAutoLogin", "CustomMetadata" -> "customMetadata") so the whole
-    // settings pipeline is consistent camelCase. The save path (YamlHelper.updateValue) matches
-    // keys case-sensitively, so without this carry-forward an existing install's values written
-    // under the old PascalCase keys would be dropped on upgrade and reset to template defaults.
-    void migrateProFeaturesKeyCasing(YamlHelper yaml, YamlHelper template) {
-        Object ssoAutoLogin = yaml.getValueByExactKeyPath("premium", "proFeatures", "SSOAutoLogin");
-        if (ssoAutoLogin != null) {
-            template.updateValue(List.of("premium", "proFeatures", "ssoAutoLogin"), ssoAutoLogin);
-        }
-        for (String field : List.of("autoUpdateMetadata", "author", "creator", "producer")) {
-            Object value =
-                    yaml.getValueByExactKeyPath("premium", "proFeatures", "CustomMetadata", field);
-            if (value != null) {
-                template.updateValue(
-                        List.of("premium", "proFeatures", "customMetadata", field), value);
-            }
-        }
-    }
 }
@@ -3,6 +3,7 @@ package stirling.software.common.configuration;
 import java.nio.file.Files;
 import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.LinkedHashSet;
@@ -200,7 +201,7 @@ public class RuntimePathConfig {

            try {
                // Normalize to absolute path
-                Path path = Path.of(pathStr.trim()).toAbsolutePath().normalize();
+                Path path = Paths.get(pathStr.trim()).toAbsolutePath().normalize();
                String normalizedPath = path.toString();

                // Check for duplicates
@@ -223,9 +224,9 @@ public class RuntimePathConfig {

    private void detectOverlappingPaths(List<String> paths) {
        for (int i = 0; i < paths.size(); i++) {
-            Path path1 = Path.of(paths.get(i));
+            Path path1 = Paths.get(paths.get(i));
            for (int j = i + 1; j < paths.size(); j++) {
-                Path path2 = Path.of(paths.get(j));
+                Path path2 = Paths.get(paths.get(j));

                // Check if one path is a parent of the other
                if (path1.startsWith(path2)) {
@@ -245,10 +246,10 @@ public class RuntimePathConfig {

    private void validatePipelinePaths() {
        try {
-            Path finishedPath = Path.of(pipelineFinishedFoldersPath).toAbsolutePath().normalize();
+            Path finishedPath = Paths.get(pipelineFinishedFoldersPath).toAbsolutePath().normalize();

            for (String watchedPathStr : pipelineWatchedFoldersPaths) {
-                Path watchedPath = Path.of(watchedPathStr).toAbsolutePath().normalize();
+                Path watchedPath = Paths.get(watchedPathStr).toAbsolutePath().normalize();

                // Check if watched folder is same as finished folder
                if (watchedPath.equals(finishedPath)) {
--- a/Show More
+++ b/Show More