docs(handoff): machine-switch handoff report 2026-06-05

Session summary, branch inventory, push instructions, v1.1.8 follow-ups, and pickup-on-new-machine smoke commands. Main is at v1.1.7 (5cbb6ca); seven minor releases shipped this session via the dispatch-and-review workflow. Read this first on the new machine.
2026-06-05 07:12:06 +02:00
256 changed files with 2483 additions and 40033 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -19,9 +19,6 @@ Cargo.lock.bak
 .env.*
 !.env.example
 # Local-only docker-compose overrides (per-developer)
 docker-compose.override.yml
 # Local config overrides
 config.local.toml
 /data
--- a/AUDIT.md
+++ b/AUDIT.md
@@ -1,546 +0,0 @@
 # PiCloud Codebase Audit — 2026-06-07
 **Scope:** `main` at v1.1.9 head, commit `450bada`.
 **Methodology:** Multi-agent audit — orchestrator + 6 parallel subagents sliced by (Security data-plane, Security auth/secrets, Performance, Code Quality, UI/UX, Migration+TS client). Reviewer-verified on the highest-severity findings (Q-001, T-001, U-006, P-001, P-004, S-002).
 **Categories:** Security (S), Performance (P), Code Quality (Q), UI/UX (U), Migration/Schema (M), TypeScript client (T).
 ## Executive summary
 - **One Critical: the manager-core / orchestrator-core boundary has inverted.** `manager-core/Cargo.toml` depends on `picloud-orchestrator-core` and the dispatcher / route_admin / apps_api / repo modules reach into `RouteTable`, `ExecutionGate`, `ExecutorClient`, `ScriptResolver`, and `InProcessBroadcaster` for **behavior**, not just DTOs. CLAUDE.md's "Working Rules" call this exact pattern the bright line that keeps cluster mode a swap-not-rewrite. Today it's a swap-and-rewrite. See [F-Q-001](#f-q-001--manager-core-depends-on-orchestrator-core-for-behavior-reversing-the-architectural-arrow).
 - **Load-bearing risk: every stateful Rhai SDK service silently accepts unbounded payloads.** `kv::set`, `docs::create/update`, `pubsub::publish_durable`, `queue::enqueue` — none of them cap value size. Files + secrets + email have caps; the other four do not. An anonymous public-HTTP script can OOM Postgres JSONB columns or amplify one publish into N outbox rows × M MB each. See [F-S-001](#f-s-001--unbounded-payload-sizes-on-kvset-docs-pubsubpublish_durable-queueenqueue).
 - **Biggest performance leak: Argon2id on the async worker, on the hottest paths.** `attach_principal_if_present` middleware runs an Argon2 verify per API-key candidate for every request carrying a Bearer header (including the data plane). Login and password reset do the same on async workers. Compounded by an unspawned-blocking call and no rate limit, the auth surface is one DoS vector for memory and three for CPU. See [F-P-002](#f-p-002--argon2id-password--api-key-verify-runs-synchronously-on-the-tokio-async-worker), [F-S-006](#f-s-006--api-key-bearer-creates-argon2-cpu-amplifier-for-arbitrary-callers).
 - **Pool sized for 10, gate sized for 32.** `init_db` opens `max_connections = 10`; the execution gate defaults to 32. Pool starvation under load is not a question of if. See [F-P-003](#f-p-003--postgres-pool-max_connections10-vs-executiongate-default-32).
 - **Most user-visible UX gap: the dashboard can't create half the trigger kinds.** Backend exposes create for KV/docs/files/dead-letter triggers; the dashboard lists them but ships create forms only for cron/pubsub/email/queue. Operators must hit the API directly. See [F-U-001](#f-u-001--dashboard-cannot-create-kvdocsfilesdead-letter-triggers). The queues drilldown also has a broken link that 404s — [F-U-002](#f-u-002--queue-drilldown-links-to-a-non-existent-app-scoped-scripts-route).
 - **A handful of dashboard pages render in light-theme fallback colors on a dark-theme app.** Dead-letters, Files, App-Users, Invitations, Queues all reference `var(--name, #fff)` style fallbacks for CSS variables the dashboard never defines, so users see `#666` text on `#0f172a` backgrounds. See [F-U-004](#f-u-004--five-dashboard-pages-render-light-theme-fallback-colors-on-the-dark-theme-app).
 - **TypeScript client has a Rules-of-Hooks violation.** `useEndpoint().get()` / `.post()` returns hook-calling functions; calling them conditionally or both in the same component produces undefined state. The test suite doesn't exercise it. See [F-T-001](#f-t-001--useendpoint-violates-react-rules-of-hooks).
 - **The cleanest surface is the migration set.** 35 sequential migrations with consistent FK-cascade discipline, partial indexes that match their predicates, and a working schema-snapshot test. Findings here are largely "redundant index" or "missing belt-and-suspenders CHECK" — refinement, not breakage.
 ## Counts by severity
 | Severity | Count |
 |---|---|
 | Critical | 1 |
 | High | 18 |
 | Medium | 35 |
 | Low | 39 |
 | Info | 22 |
 ## Findings
 ### Security
 #### Critical
 _(See Code Quality for the only Critical finding — the manager-core ↔ orchestrator-core boundary breach.)_
 #### High
 ##### F-S-001 — Unbounded payload sizes on `kv::set`, `docs::*`, `pubsub::publish_durable`, `queue::enqueue`
 - **Severity:** High
 - **Location:** [crates/manager-core/src/queue_service.rs:33-92](crates/manager-core/src/queue_service.rs#L33-L92), [crates/manager-core/src/kv_service.rs:93](crates/manager-core/src/kv_service.rs#L93), [crates/manager-core/src/docs_service.rs:107](crates/manager-core/src/docs_service.rs#L107), [crates/manager-core/src/pubsub_service.rs:138](crates/manager-core/src/pubsub_service.rs#L138)
 - **Summary:** Four stateful SDK services accept any JSON value and write it straight to a `JSONB` column with no size validation. Files (per-file cap, env-overridable), secrets (64 KB default), and email (25 MB default) all enforce limits; these four don't. An anonymous public-HTTP script can fill disk via `queue::enqueue` (up to Postgres's ~1 GB JSONB limit per row), or amplify a single `publish_durable` into N outbox rows × payload bytes. Fix shape: add a per-service `max_value_bytes` config (default ~256 KB) validated at the service entry, before authz/repo. Mirror the existing `MAX_VALUE_BYTES` constant pattern in `secrets_service.rs`.
 ##### F-S-002 — `users::request_password_reset` and `send_verification_email` are unrate-limited and reachable from anonymous scripts
 - **Severity:** High
 - **Location:** [crates/manager-core/src/users_service.rs:633](crates/manager-core/src/users_service.rs#L633), [crates/manager-core/src/users_service.rs:575](crates/manager-core/src/users_service.rs#L575)
 - **Summary:** Both methods short-circuit the authz gate when `cx.principal == None`. An attacker who can call any public route can trigger unbounded outbound email per call to arbitrary or attacker-supplied addresses — exhausting SMTP-relay quota, getting the relay blacklisted, or burning provider credits. No per-app rate limit, per-recipient cooldown, or per-execution counter. Fix shape: token-bucket rate limit keyed on `(cx.app_id, recipient_email)`, with a per-app daily cap. Optionally require `cx.principal.is_some()` when invoked from a public route.
 ##### F-P-001 — `users::list` N+1: one `fetch_roles` query per user row
 - **Category:** Performance
 - **Severity:** High
 - **Location:** [crates/manager-core/src/users_service.rs:466-471](crates/manager-core/src/users_service.rs#L466-L471)
 - **Summary:** `list` page-fetches users then loops calling `self.fetch_roles(cx.app_id, row.id)` — one query per user. Default limit 50, max 500, so the admin "users" page does 51-501 round-trips. The same `fetch_roles` is also called from `verify_session_for_realtime` (one extra query on every authenticated SSE subscribe). Fix: add `AppUserRoleRepo::list_for_users(app_id, &[user_ids])` returning a `HashMap<AppUserId, Vec<String>>` and join in a single query (`WHERE user_id = ANY($2)`).
 ##### F-P-002 — Argon2id password / API-key verify runs synchronously on the Tokio async worker
 - **Category:** Performance
 - **Severity:** High
 - **Location:** [crates/manager-core/src/auth_middleware.rs:206-208](crates/manager-core/src/auth_middleware.rs#L206-L208), [crates/manager-core/src/auth_api.rs:98](crates/manager-core/src/auth_api.rs#L98), [crates/manager-core/src/users_service.rs:502](crates/manager-core/src/users_service.rs#L502)
 - **Summary:** `verify_password` (Argon2id default params: m=19456 KiB, t=2) is CPU-bound at tens-to-hundreds of ms and is invoked synchronously on the Tokio worker. Worse, `verify_api_key` Argon2-verifies **every** candidate sharing the 8-char prefix on **every** authenticated `/api/v1/admin/*` request — a single hot user with N keys serializes every admin request behind N×Argon2 verifies. Fix: wrap each verify in `tokio::task::spawn_blocking`, and maintain a short-lived (60-300s) cache `LruCache<(prefix, raw)→user_id>` so a hot API key doesn't re-Argon2 every request.
 ##### F-P-003 — Postgres pool `max_connections=10` vs `ExecutionGate` default 32
 - **Category:** Performance
 - **Severity:** High
 - **Location:** [crates/picloud/src/lib.rs:583-588](crates/picloud/src/lib.rs#L583-L588) vs [crates/orchestrator-core/src/gate.rs](crates/orchestrator-core/src/gate.rs)
 - **Summary:** `init_db` hard-codes `max_connections(10)`. The execution gate allows 32 concurrent script executions, each doing multiple sequential DB calls (script resolve, every SDK call inside the script, log sink, outbox emit), plus the dispatcher tick every 100ms, the cron tick, three GC sweeps, and the auth middleware running per request. Pool starvation manifests as `acquire_timeout` (5 s) errors and tail-latency spikes. Fix: scale `max_connections` to roughly `gate.max_permits × estimated_queries_per_exec + headroom`, expose a `PICLOUD_DB_MAX_CONNECTIONS` env knob, and document the relationship.
 ##### F-P-004 — `LocalExecutorClient::execute` and `invoke()` re-entry recompile AST every call
 - **Category:** Performance
 - **Severity:** High
 - **Location:** [crates/orchestrator-core/src/client.rs:178-216](crates/orchestrator-core/src/client.rs#L178-L216), [crates/executor-core/src/sdk/invoke.rs:192-200](crates/executor-core/src/sdk/invoke.rs#L192-L200)
 - **Summary:** Two code paths bypass the AST cache: `ExecutorClient::execute` (used in tests + fallback) calls `engine.execute(&source, req)` which compiles inline; and `invoke()` synchronous re-entry calls `self_engine.execute(&resolved.source, req)`, re-parsing every callee on every invoke. Composed workflows multiply parse cost by depth. Fix: have `InvokeService::resolve` return `(ScriptIdentity, source)` and route through the cached `LocalExecutorClient::get_or_compile`, or expose `Engine::execute_with_identity` so the engine itself can cache.
 ##### F-P-005 — `execution_logs` admin list uses `OFFSET` pagination
 - **Category:** Performance
 - **Severity:** High
 - **Location:** [crates/manager-core/src/repo.rs:511-535](crates/manager-core/src/repo.rs#L511-L535)
 - **Summary:** `list_for_script` does `ORDER BY created_at DESC LIMIT $2 OFFSET $3`. Postgres has to scan + discard `OFFSET` rows on every page; deep pages get linearly slower. Sister tables in the same repo all use cursor pagination. Fix: switch to keyset cursor on `(created_at, id)` — `WHERE script_id=$1 AND (created_at, id) < ($cursor_ts, $cursor_id)`. Same shape as every other list endpoint.
 ##### F-P-006 — `queue::depth` / `depth_pending` are `COUNT(*)` reachable per script call
 - **Category:** Performance
 - **Severity:** High
 - **Location:** [crates/manager-core/src/queue_repo.rs:264-287](crates/manager-core/src/queue_repo.rs#L264-L287), [crates/manager-core/src/queue_repo.rs:289-322](crates/manager-core/src/queue_repo.rs#L289-L322)
 - **Summary:** Scripts call `queue::depth(name)` / `queue::depth_pending(name)` per invocation; each is an unbounded `COUNT(*)` over the queue_messages partial index. On a backed-up queue with millions of rows, every call scans the whole partition. `list_for_app` (dashboard queue overview) does 3× `COUNT(*) FILTER (...)` in one pass — same scan magnified. Fix: maintain per-`(app_id, queue_name)` running counters in a small table (incremented on enqueue, decremented on ack/dead-letter), or downgrade `depth()` to a presence check (`SELECT 1 … LIMIT 1`).
 ##### F-P-007 — Dispatcher tick loops queue consumers serially (one claim per consumer per tick)
 - **Category:** Performance
 - **Severity:** High
 - **Location:** [crates/manager-core/src/dispatcher.rs:152-164](crates/manager-core/src/dispatcher.rs#L152-L164), [crates/manager-core/src/dispatcher.rs:166-290](crates/manager-core/src/dispatcher.rs#L166-L290)
 - **Summary:** `tick_queue_arm` calls `list_active_queue_consumers()` then iterates serially, awaiting one `queue.claim(app, queue)` per consumer per tick. With N queue consumers and a 100ms tick, worst-case throughput is `N × (claim + executor) / tick`. Each iteration is a full `dispatch_one_queue` (resolve script, resolve principal, executor round-trip) sequential on the dispatcher's task. Fix: bound concurrency with `futures::stream::iter(consumers).for_each_concurrent(N, …)` (the execution gate caps anyway), and/or cache the consumer list across ticks.
 ##### F-P-008 — `TriggerRepo::list_for_app` is N+1 — one detail-table query per parent row
 - **Category:** Performance
 - **Severity:** High
 - **Location:** [crates/manager-core/src/trigger_repo.rs:971-987](crates/manager-core/src/trigger_repo.rs#L971-L987) (calls `hydrate_one` at ~:1351 per row)
 - **Summary:** `list_for_app` selects parent rows then for each one issues a `SELECT … FROM <kind>_trigger_details WHERE trigger_id = $1`. For N triggers on an app, that's N+1 queries on every dashboard `GET /apps/{id}/triggers` load. Fix: split by kind and issue one-per-kind `JOIN <details> ON details.trigger_id = t.id WHERE t.app_id=$1 AND t.kind='<k>'`, or write a single CTE with LEFT JOIN to each `*_trigger_details` table.
 ##### F-P-009 — `attach_principal_if_present` runs on every data-plane request, including paths that don't need auth
 - **Category:** Performance
 - **Severity:** High
 - **Location:** [crates/manager-core/src/auth_middleware.rs:141](crates/manager-core/src/auth_middleware.rs#L141), [crates/manager-core/src/auth_middleware.rs:192-229](crates/manager-core/src/auth_middleware.rs#L192-L229)
 - **Summary:** Every request hitting `/api/v1/execute/...` or any user-route path goes through `attach_principal_if_present`. If the request carries any `Authorization: Bearer pic_...` header, the middleware does: prefix lookup + Argon2 verify per candidate + `admin_users.get` + `touch_last_used` UPDATE. Three DB round-trips + Argon2id per request — on a path that may not need authz at all. Fix: short-circuit when the route doesn't require auth; add a sliding-window cache of `(token → principal)` valid for 60-300s.
 ##### F-Q-001 — `manager-core` depends on `orchestrator-core` for behavior, reversing the architectural arrow
 - **Category:** Code Quality
 - **Severity:** Critical
 - **Location:** [crates/manager-core/Cargo.toml:13](crates/manager-core/Cargo.toml#L13), [crates/manager-core/src/dispatcher.rs:28](crates/manager-core/src/dispatcher.rs#L28), [crates/manager-core/src/route_admin.rs:15](crates/manager-core/src/route_admin.rs#L15), [crates/manager-core/src/apps_api.rs](crates/manager-core/src/apps_api.rs), [crates/manager-core/src/invoke_service.rs:15](crates/manager-core/src/invoke_service.rs#L15), [crates/manager-core/src/pubsub_service.rs:519](crates/manager-core/src/pubsub_service.rs#L519)
 - **Summary:** CLAUDE.md's bright line: "the orchestrator never imports `executor-core` directly — define a trait in `shared`". The same rule should hold for `manager-core ↔ orchestrator-core`. Instead, `manager-core` pulls `picloud_orchestrator_core::routing::{RouteTable, AppDomainTable, matcher::CompiledRoute, pattern, conflict}` plus `{ExecutorClient, ExecutionGate, ScriptIdentity, ScriptResolver, ResolverError, InProcessBroadcaster}`. `RouteTable` is a stateful `Arc`'d object with methods (`replace_all`, `match_request_for_app`) — not a DTO. This kills the cluster-mode swap: when manager and orchestrator are separate binaries the control plane shouldn't link the orchestrator's routing-table impl. Fix: move `RouteTable`, `AppDomainTable`, `CompiledRoute`, `CompiledAppDomain`, `ScriptResolver`, `ResolverError`, `ExecutorClient`, `ExecutionGate`, `ScriptIdentity`, and the broadcaster trait into `shared/` (traits + DTOs); keep only in-process impls in `orchestrator-core`.
 ##### F-Q-002 — Every SDK module open-codes its own `block_on` helper
 - **Category:** Code Quality
 - **Severity:** High
 - **Location:** [crates/executor-core/src/sdk/kv.rs:178](crates/executor-core/src/sdk/kv.rs#L178), [crates/executor-core/src/sdk/docs.rs:240](crates/executor-core/src/sdk/docs.rs#L240), [crates/executor-core/src/sdk/pubsub.rs:162](crates/executor-core/src/sdk/pubsub.rs#L162), [crates/executor-core/src/sdk/users.rs:593](crates/executor-core/src/sdk/users.rs#L593), [crates/executor-core/src/sdk/dead_letters.rs:69](crates/executor-core/src/sdk/dead_letters.rs#L69), [crates/executor-core/src/sdk/secrets.rs:138](crates/executor-core/src/sdk/secrets.rs#L138), [crates/executor-core/src/sdk/files.rs:266](crates/executor-core/src/sdk/files.rs#L266), [crates/executor-core/src/sdk/email.rs:136](crates/executor-core/src/sdk/email.rs#L136), [crates/executor-core/src/sdk/http.rs:369](crates/executor-core/src/sdk/http.rs#L369), [crates/executor-core/src/sdk/queue.rs:120](crates/executor-core/src/sdk/queue.rs#L120)
 - **Summary:** Ten SDK modules each define a near-identical `block_on` that grabs `TokioHandle::try_current()`, calls `block_on`, and wraps the error into `EvalAltResult::ErrorRuntime` with a service prefix. The shapes diverge only by which `Error` variant they pin and the prefix string. Promote `sdk::bridge::block_on::<E, F>(service_name, fut)` (or a `block_on_kind!` macro) — keeps each call site to one line and ensures uniform error formatting + a single point for future tracing instrumentation.
 ##### F-Q-003 — Each stateful service open-codes the same `check_read` / `check_write` authz idiom
 - **Category:** Code Quality
 - **Severity:** High
 - **Location:** [crates/manager-core/src/kv_service.rs:48-64](crates/manager-core/src/kv_service.rs#L48-L64), [crates/manager-core/src/docs_service.rs:57-73](crates/manager-core/src/docs_service.rs#L57-L73), [crates/manager-core/src/files_service.rs:51-71](crates/manager-core/src/files_service.rs#L51-L71), [crates/manager-core/src/pubsub_service.rs:116-127](crates/manager-core/src/pubsub_service.rs#L116-L127), [crates/manager-core/src/queue_service.rs:61-68](crates/manager-core/src/queue_service.rs#L61-L68)
 - **Summary:** Every service has the same pattern: `if cx.principal.is_some() { authz::require(...).await.map_err(|_| <Service>Error::Forbidden) }`. That's 9 hand-rolled copies of the same 6-line idiom, each with its own error type. `users_service` does this slightly differently (returns `Repo` vs `Denied`). Promote a single helper `authz::script_gate<E>(authz, cx, cap, deny_to: impl Fn(AuthzDenied) -> E)`. Eliminates drift risk: e.g., `queue_service` maps to `Rejected("forbidden")` instead of `Forbidden` because there's no `Forbidden` variant — see F-Q-004.
 ##### F-Q-004 — Sibling services have inconsistent error-variant shapes, and `QueueError` is missing `Forbidden` entirely
 - **Category:** Code Quality
 - **Severity:** High
 - **Location:** [crates/shared/src/kv.rs:139](crates/shared/src/kv.rs#L139), [crates/shared/src/queue.rs:60-77](crates/shared/src/queue.rs#L60-L77), [crates/shared/src/pubsub.rs:85](crates/shared/src/pubsub.rs#L85), [crates/shared/src/invoke.rs:110](crates/shared/src/invoke.rs#L110)
 - **Summary:** Same semantic error has two names: "Backend" in `KvError`/`DocsError`/`FilesError`/`SecretsError`; "Unavailable" in `QueueError`/`PubsubError`/`InvokeError`. Worse, `QueueError` has no `Forbidden` variant at all, so authz denial gets squashed into `QueueError::Rejected("forbidden".into())` ([queue_service.rs:68](crates/manager-core/src/queue_service.rs#L68)), losing the structured variant a 403-translation layer would need. And `queue_service::depth/depth_pending` skip authz entirely. Fix: pick one name (`Backend`), add `Forbidden` to every service's error enum uniformly, and gate `depth`/`depth_pending` on `AppQueueRead` (or document why they're public).
 ##### F-Q-005 — Authz failures collapse `AuthzDenied::Repo` into `Forbidden` via `map_err(|_| …)`
 - **Category:** Code Quality
 - **Severity:** High
 - **Location:** [crates/manager-core/src/kv_service.rs:52,61](crates/manager-core/src/kv_service.rs#L52), [crates/manager-core/src/docs_service.rs:61,70](crates/manager-core/src/docs_service.rs#L61), [crates/manager-core/src/files_service.rs:55,68](crates/manager-core/src/files_service.rs#L55), [crates/manager-core/src/pubsub_service.rs:124,226](crates/manager-core/src/pubsub_service.rs#L124)
 - **Summary:** Every `check_read`/`check_write` uses `.map_err(|_| KvError::Forbidden)?` — collapsing both `AuthzDenied::Denied` AND `AuthzDenied::Repo(repo_err)` into `Forbidden`. A DB blip in the authz repo surfaces as 403 to scripts; operators can't distinguish "real forbidden" from "Postgres flap during permission check". `users_service::require` ([users_service.rs:177-181](crates/manager-core/src/users_service.rs#L177-L181)) gets this right by mapping separately. Apply the same pattern uniformly.
 ##### F-Q-006 — `InboxRegistry::register` silently no-ops on lock poisoning, leaking a dead id
 - **Category:** Code Quality
 - **Severity:** High
 - **Location:** [crates/orchestrator-core/src/inbox.rs:46-53](crates/orchestrator-core/src/inbox.rs#L46-L53)
 - **Summary:** `register()` returns `(Uuid, Receiver)` even when the inner `Mutex` is poisoned — the `if let Ok(mut g) = self.inner.lock()` swallows the error, the sender is never inserted, the later `deliver(id, …)` will see no entry and return `Abandoned`. The caller's `await rx` blocks until the orchestrator's outer timeout. Sister registries `RouteTable` ([routing/table.rs:36](crates/orchestrator-core/src/routing/table.rs#L36)) and `AppDomainTable` correctly panic with `.expect("route table poisoned")`. Fix: switch to `expect("inbox poisoned")` and document the policy.
 ##### F-T-001 — `useEndpoint` violates React Rules of Hooks
 - **Category:** Code Quality
 - **Severity:** High
 - **Location:** [clients/typescript/src/react/index.ts:73-101](clients/typescript/src/react/index.ts#L73-L101)
 - **Summary:** `useEndpoint(path)` returns `{ get: () => useResource(…), post: (body) => useResource(…) }`. Each of `.get()` and `.post()` calls `useResource`, which calls `useState` and `useEffect`. React's Rules of Hooks require hook calls in the top level of a component, in the same order each render. Calling `useEndpoint(path).get()` conditionally, or calling both `.get()` and `.post()` from the same component, will violate hook ordering and produce undefined behavior (state from one call leaking into the other). `react.test.tsx` doesn't exercise `useEndpoint` at all — only `useTopic` — so this is uncaught. Fix: refactor to a flat hook (`useEndpointGet(path)` / `useEndpointPost(path)`) with consistent hook order.
 ##### F-U-001 — Dashboard cannot create KV, Docs, Files, or Dead-letter triggers
 - **Category:** UI/UX
 - **Severity:** High
 - **Location:** [dashboard/src/routes/apps/[slug]/+page.svelte:1092-1342](dashboard/src/routes/apps/[slug]/+page.svelte#L1092-L1342), [dashboard/src/lib/api.ts:771-801](dashboard/src/lib/api.ts#L771-L801)
 - **Summary:** Backend `triggers_api.rs` exposes `POST /apps/{id}/triggers/{kv,docs,files,dead_letter}`, but the dashboard's Triggers tab ships create forms only for cron, pubsub, email, and queue. Listing shows kv/docs/files/dead_letter rows (with `collection_glob` and `ops`) but operators can't create them from the UI. Add four more `submitCreate*` forms (collection glob + ops checkboxes).
 ##### F-U-002 — Queue drilldown links to a non-existent app-scoped scripts route
 - **Category:** UI/UX
 - **Severity:** High
 - **Location:** [dashboard/src/routes/apps/[slug]/queues/[name]/+page.svelte:71](dashboard/src/routes/apps/[slug]/queues/[name]/+page.svelte#L71)
 - **Summary:** The consumer-script link is `{base}/apps/{slug}/scripts/{detail.consumer.script_id}` but the actual script detail route is `{base}/scripts/{id}` — there is no `apps/[slug]/scripts/[id]` directory. Clicking the consumer name 404s. Either move scripts under apps in the route tree (the breadcrumb on the script page already wants this), or fix the link to `{base}/scripts/{detail.consumer.script_id}`.
 ##### F-U-003 — Files page has no collection list — operators must guess collection names
 - **Category:** UI/UX
 - **Severity:** High
 - **Location:** [dashboard/src/routes/apps/[slug]/files/+page.svelte:96-110](dashboard/src/routes/apps/[slug]/files/+page.svelte#L96-L110)
 - **Summary:** The Files page can only list a collection if you already know its name and type it in. There's no "browse known collections" affordance, no list endpoint (`GET /apps/{id}/files/collections` is missing in the backend too — flag for v1.1.10+), so first-time operators have no recourse. Minimum fix: show a hint listing collection-glob patterns drawn from any registered `files` triggers. Longer-term: backend endpoint to list known collections.
 #### Medium
 ##### F-S-003 — `users::find_by_email` exposes user existence to anonymous callers
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/users_service.rs:400-413](crates/manager-core/src/users_service.rs#L400-L413)
 - **Summary:** `find_by_email` requires `AppUsersRead`, which means anonymous public-HTTP scripts can call it (the gate short-circuits on `None`). An attacker hitting any public route can iterate emails to enumerate registered users, then pivot to `login` / `request_password_reset`. The reset path is silent-on-miss; `find_by_email` is not. Fix: require an authenticated principal for `find_by_email`, or document that scripts must wrap it in their own auth check before calling from a public route.
 ##### F-S-004 — `request_password_reset` has an observable timing oracle for email existence
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/users_service.rs:646-651](crates/manager-core/src/users_service.rs#L646-L651)
 - **Summary:** Handler returns immediately when email shape is invalid or user is unknown; on found user it generates an Argon2 token, INSERTs into `app_user_password_resets`, builds a link, and calls `email.send` (tens of ms + DB write + SMTP RTT). The wall-clock delta is enormous and externally observable. Combined with F-S-003, this gives a reliable enumeration oracle. Fix: when no user matches, still do a dummy `generate_session_token()` and a dummy `email.send` (against `/dev/null` or a fixed sleep). Better: run the full code path unconditionally and discard the result on no-match.
 ##### F-S-005 — `users_admin_api::delete_user` doesn't enforce `AppUsersAdmin` despite the brief
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/users_admin_api.rs:250-272](crates/manager-core/src/users_admin_api.rs#L250-L272)
 - **Summary:** Handler comment acknowledges the brief required `AppUsersAdmin` for the irreversible dashboard delete, but the implementation calls `service.delete(...)` which only gates on `AppUsersWrite`. v1.1.8 HANDBACK §7 lists this as known. Effect: any editor can delete app users via the admin HTTP API and dashboard button, not just admins. Fix: add an explicit `authz::require(... AppUsersAdmin(app_id))` before `service.delete`.
 ##### F-S-006 — API-key bearer creates Argon2 CPU amplifier for arbitrary callers
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/auth_middleware.rs:192-211](crates/manager-core/src/auth_middleware.rs#L192-L211)
 - **Summary:** `verify_api_key` Argon2id-verifies every candidate sharing the 8-char prefix. An unauthenticated attacker can submit unlimited `Authorization: Bearer pic_<8>...` requests and force the server into per-request Argon2 (OWASP defaults: ~tens of ms each). A few hundred concurrent connections trivially DoSes the manager — the verify runs before any concurrency cap. The 32-byte random body has astronomical entropy, so Argon2 is overkill here. Fix: switch the key-verify hash to SHA-256 (high-entropy tokens don't need Argon2), cap the candidate set at a small constant (e.g. 16) and log when truncation occurs, and add per-IP rate limit at the reverse proxy.
 ##### F-S-007 — No rate limit on `auth/login` — Argon2 verify is a memory DoS
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/auth_api.rs:74-101](crates/manager-core/src/auth_api.rs#L74-L101)
 - **Summary:** Login always runs Argon2 verify (timing-flat — good), but no rate limit, no failed-attempt lockout, no captcha. OWASP-default Argon2 cost (m=19456 KiB ≈ 19 MB RAM per verify) makes this a credible memory + CPU DoS: a few hundred concurrent `POST /admin/auth/login` exhausts manager memory. Combined with F-S-006, the auth surface has no brute-force defense. Fix: per-IP throttling at the reverse proxy (documented Caddy rate-limit module) and a per-username sliding-window lockout in `admin_user_repo`.
 ##### F-S-008 — Realtime authority key cache never invalidates
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/realtime_authority.rs:34,56-72](crates/manager-core/src/realtime_authority.rs#L34)
 - **Summary:** `key_cache: Mutex<HashMap<AppId, Vec<u8>>>` is populated on first read and never evicted, bounded, or cleared on app deletion. (1) Once key rotation lands, every running process keeps accepting tokens signed by the old key until restart. (2) Today, if an operator drops and re-creates an app (FK CASCADE removes `app_secrets`, fresh row inserted), the cache hands out the **old** key bytes. Also unbounded growth on a many-app install. Fix: TTL on cache entries, rotation eviction hook, or simplify by removing the cache (DB lookup is cheap; only fires on subscribe).
 ##### F-S-009 — `PICLOUD_DEV_MODE` deterministic master key is fatal if accidentally enabled in prod
 - **Severity:** Medium
 - **Location:** [crates/shared/src/crypto.rs:206-231](crates/shared/src/crypto.rs#L206-L231)
 - **Summary:** When `PICLOUD_DEV_MODE=true` AND `PICLOUD_SECRET_KEY` is unset, the master key becomes `SHA-256("picloud-dev-master-key-v1.1.7")` — a fully public value. The warning is correct but the gate is a single env var. An operator who copies a dev docker-compose file into prod silently encrypts everything with a world-known key. Fix: add a startup check that refuses dev mode when prod indicators are present (non-localhost `PICLOUD_PUBLIC_BASE_URL`, etc.), or require BOTH `PICLOUD_DEV_MODE=true` AND `PICLOUD_DEV_INSECURE_KEY=i-understand-this-is-insecure`.
 ##### F-S-010 — Inbound-email HMAC verification has no replay protection
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/email_inbound_api.rs:83-144](crates/manager-core/src/email_inbound_api.rs#L83-L144)
 - **Summary:** Receiver verifies `HMAC-SHA256(secret, body)` constant-time — good. But the signature covers only the body. No timestamp binding, no nonce/idempotency check. A captured webhook request can be replayed indefinitely, re-firing the trigger and enqueueing duplicate executions. Industry standard (Stripe, Slack) includes a timestamp in the signed payload and rejects requests outside a ~5-minute window. Fix: add `X-Picloud-Timestamp` to the HMAC input, reject requests outside the configured window, and dedupe on `message_id` in a TTL'd cache.
 ##### F-S-011 — `admin_sessions` has no `revoked_at` — password change can't invalidate live sessions
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/admin_session_repo.rs:1-152](crates/manager-core/src/admin_session_repo.rs#L1-L152)
 - **Summary:** Unlike `app_user_sessions` (v1.1.8 — has `revoked_at` and `revoke_for_user`), `admin_sessions` only has `expires_at` and a `delete_for_user(user_id)` helper. No admin-side "revoke all sessions" gesture; an admin password change must explicitly call `delete_for_user` (audit the flow to confirm it does). Fix: add a `revoked_at` column for explicit revocation distinct from TTL expiry, and add a "log out all sessions" action.
 ##### F-S-012 — `invoke_async` has no authz check — anonymous scripts can fire any script in the app
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/invoke_service.rs:121-161](crates/manager-core/src/invoke_service.rs#L121-L161), [crates/executor-core/src/sdk/invoke.rs:86-110](crates/executor-core/src/sdk/invoke.rs#L86-L110)
 - **Summary:** `enqueue_async` and the sync `invoke()` perform no `authz::require` check — no `AppInvoke` capability exists. Same-app isolation is preserved (cross-app guard works), but within one app, an anonymous public-HTTP script can trigger any other script (e.g. an admin-only worker that hits secrets/files/external HTTP). Worse: `invoke_async` runs the callee with `principal: None`, so the callee may itself hold capabilities the original public caller shouldn't. Fix: add `Capability::AppInvoke(app_id)` and gate `invoke()` / `invoke_async()` on it; consider a "private" vs "public" script tag for the anonymous case.
 ##### F-S-013 — `users::invite` accumulates pending invitations per email without dedup
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/users_service.rs:720-778](crates/manager-core/src/users_service.rs#L720-L778), [crates/manager-core/migrations/0030_app_user_invitations.sql:16-26](crates/manager-core/migrations/0030_app_user_invitations.sql#L16-L26)
 - **Summary:** No unique constraint on `(app_id, email)` for pending rows. Calling `users::invite("alice@…")` N times creates N rows with N valid tokens. Combined with `accept_invite` returning `Ok(None)` silently when the email already exists, an attacker who learns one invitation token can permanently consume it without effect. Fix: partial unique index `(app_id, lower(email)) WHERE accepted_at IS NULL` + handle conflict as 409 with "reissue?" UX.
 ##### F-S-014 — Topic edit modal warns only on `internal → external` flip, not on any other permissive change
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/apps/[slug]/+page.svelte:1678-1722](dashboard/src/routes/apps/[slug]/+page.svelte#L1678-L1722)
 - **Summary:** Warning fires only for the internal→external transition (`editFlipToExternal`). Switching `token → public` or `session → public` while already external is equally risky (opens topic to anonymous subscribers) but produces no warning. Fix: fire the warning whenever the resulting `(external, auth_mode)` pair is strictly more permissive than the current one.
 ##### F-P-010 — `list_active_queue_consumers` (called every 100ms) lacks a matching index
 - **Category:** Performance
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/trigger_repo.rs:1290-1303](crates/manager-core/src/trigger_repo.rs#L1290-L1303) vs [crates/manager-core/migrations/0008_triggers.sql:47-49](crates/manager-core/migrations/0008_triggers.sql#L47-L49)
 - **Summary:** Query is `WHERE t.kind='queue' AND t.enabled=TRUE` with no `app_id` filter; available index `idx_triggers_app_kind_enabled (app_id, kind) WHERE enabled = TRUE` requires an `app_id` predicate to be useful. With many apps × many trigger kinds, this query becomes a sequential scan every 100ms. Fix: add `CREATE INDEX idx_triggers_kind_enabled ON triggers(kind) WHERE enabled = TRUE`, or maintain an in-memory consumer registry refreshed by admin writes.
 ##### F-P-011 — `RouteTable::replace_all` rebuilds the entire per-app trie on every route CRUD write
 - **Category:** Performance
 - **Severity:** Medium
 - **Location:** [crates/orchestrator-core/src/routing/table.rs:31-38](crates/orchestrator-core/src/routing/table.rs#L31-L38), [crates/manager-core/src/route_admin.rs:372-379](crates/manager-core/src/route_admin.rs#L372-L379)
 - **Summary:** Every admin route create/delete calls `refresh_table` → `routes.list_all()` → compile all rows → `replace_all`. With a thousand routes a single edit reparses every route under the writer lock. Fix: incremental update — push compiled `CompiledRoute` into the per-app slice on create, remove by id on delete.
 ##### F-P-012 — `app_user_repo::list` cursor lacks an `(created_at, id)` tiebreaker
 - **Category:** Performance
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/app_user_repo.rs:200-225](crates/manager-core/src/app_user_repo.rs#L200-L225)
 - **Summary:** `ORDER BY created_at DESC, id DESC` but cursor is `WHERE created_at < $2` — when two users were created at the same instant, pagination can skip the second row at a page boundary or return it twice. Fix: encode `(created_at, id)` in the cursor and use `WHERE (created_at, id) < ($ts, $id)`. Same shape used elsewhere in this repo.
 ##### F-P-013 — RhaiEngine + every SDK module registered per call
 - **Category:** Performance
 - **Severity:** Medium
 - **Location:** [crates/executor-core/src/engine.rs:167-204](crates/executor-core/src/engine.rs#L167-L204), [crates/executor-core/src/sdk/mod.rs:49-68](crates/executor-core/src/sdk/mod.rs#L49-L68)
 - **Summary:** Each `execute_ast` calls `build_engine` (new Rhai engine, every limit setter, disable-symbol, register all stdlib static modules), then `sdk::register_all` registers 12 service modules. At 32 concurrent executions on a Pi, this is real per-call overhead even with AST caching. Fix shape: pool pre-built Rhai engines with stateless modules pre-registered, reset per-call state, and only install per-call closures that need `SdkCallCx`.
 ##### F-P-014 — `regex::*` SDK functions compile patterns on every call
 - **Category:** Performance
 - **Severity:** Medium
 - **Location:** [crates/executor-core/src/sdk/stdlib/regex.rs:23-25](crates/executor-core/src/sdk/stdlib/regex.rs#L23-L25)
 - **Summary:** `is_match`, `find`, `find_all`, `replace`, `replace_all`, `split`, `captures` all call `Regex::new(pattern)` per invocation. A script doing `regex::is_match("\\d+", x)` in a tight loop pays the compile every iteration. Fix: thread-local `LruCache<String, Arc<Regex>>` bounded to e.g. 128 entries. Regex compile dominates `is_match` on short strings.
 ##### F-P-015 — `OutboxEventEmitter` inserts one row per matching trigger
 - **Category:** Performance
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/outbox_event_emitter.rs:88-103](crates/manager-core/src/outbox_event_emitter.rs#L88-L103)
 - **Summary:** For each matched trigger, one separate `outbox.insert` round-trip. A KV mutation matched by 5 triggers becomes 5 sequential INSERTs inside the script's hot path, each cloning the JSONB payload. Fix: extend `OutboxRepo::insert_many(rows)` and emit one multi-row `INSERT … SELECT * FROM UNNEST(...)`; bind payload once.
 ##### F-P-016 — `app_user_session_repo::gc` `OR` chain mismatches the available index
 - **Category:** Performance
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/app_user_session_repo.rs:186-200](crates/manager-core/src/app_user_session_repo.rs#L186-L200) vs [crates/manager-core/migrations/0027_app_user_sessions.sql:34-35](crates/manager-core/migrations/0027_app_user_sessions.sql#L34-L35)
 - **Summary:** GC inner SELECT predicate is `expires_at <= NOW() OR absolute_expires_at <= NOW() OR revoked_at IS NOT NULL`. Available partial index is `(expires_at) WHERE revoked_at IS NULL` — only helps the first disjunct on non-revoked rows. The OR chain forces a sequential scan. Fix: add `CREATE INDEX … ON app_user_sessions(revoked_at) WHERE revoked_at IS NOT NULL`, and rewrite the GC as three UNION ALL subqueries (one per disjunct).
 ##### F-Q-007 — `DispatcherError` truncates the entire error chain into `String`
 - **Category:** Code Quality
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/dispatcher.rs:957-963](crates/manager-core/src/dispatcher.rs#L957-L963) and many call sites (lines 129, 157, 176, 228, 235, 353, 365, 379, 391, 411, 453, 462, 488, 494, 545, 615, 724, 755, 779)
 - **Summary:** `DispatcherError::{Outbox, ResolveTrigger}` wrap `String`. Every `?` calls `.to_string()` on the source, killing `#[source]` introspection and the cause chain. Logs show "outbox: database error: ..." with no programmatic way to discriminate. Fix: convert to `#[from] sqlx::Error` (or structured variants) so `tracing::error!(error.cause_chain = ?err)` works.
 ##### F-Q-008 — `HttpError::Backend` misclassifies validation errors
 - **Category:** Code Quality
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/http_service.rs:209,340,342](crates/manager-core/src/http_service.rs#L209)
 - **Summary:** `Method::from_bytes` failing on a user-supplied HTTP method gets `HttpError::Backend(format!("invalid method: {}", req.method))` — but that's user input, not a backend problem. Same for header-name / header-value validation. Misclassifying as `Backend` corrupts retry policies (operators may retry "backend" but not "invalid input"). Fix: add `HttpError::InvalidArgs(String)`.
 ##### F-Q-009 — `dispatcher::TICK_INTERVAL` and `ASYNC_EXEC_TIMEOUT` are hard-coded; siblings are env-overridable
 - **Category:** Code Quality
 - **Severity:** Medium
 - **Location:** [crates/manager-core/src/dispatcher.rs:73,80](crates/manager-core/src/dispatcher.rs#L73)
 - **Summary:** `TICK_INTERVAL = 100ms` and `ASYNC_EXEC_TIMEOUT = 300s` are `const`. Every other timing knob in the file (cron tick, queue reclaim, retry policy) is env-overridable via `TriggerConfig::from_env()`. Operators on a constrained Pi or a busier instance can tune retries but not dispatcher cadence. Fix: promote to `TriggerConfig` with `PICLOUD_DISPATCHER_TICK_INTERVAL_MS` and `PICLOUD_DISPATCHER_ASYNC_EXEC_TIMEOUT_SEC`.
 ##### F-Q-010 — Mutex poisoning policy inconsistent across orchestrator-core registries
 - **Category:** Code Quality
 - **Severity:** Medium
 - **Location:** [crates/orchestrator-core/src/inbox.rs:49,75](crates/orchestrator-core/src/inbox.rs#L49) (silent), [crates/orchestrator-core/src/routing/table.rs:36](crates/orchestrator-core/src/routing/table.rs#L36) (loud `expect`)
 - **Summary:** Two registries playing the same architectural role (in-memory caches behind `Arc`) handle poisoning oppositely. `RouteTable` / `AppDomainTable` `expect("route table poisoned")`; `InboxRegistry` silently swallows. Settle on one policy — the loud `expect` is correct (poisoning means a prior panic; nothing is recoverable). See also F-Q-006.
 ##### F-Q-011 — `PostgresScriptRepoHandle` newtype hand-delegates 11 methods
 - **Category:** Code Quality
 - **Severity:** Medium
 - **Location:** [crates/picloud/src/lib.rs:622-693](crates/picloud/src/lib.rs#L622-L693)
 - **Summary:** A 70-line newtype wraps `Arc<PostgresScriptRepository>` and re-implements every `ScriptRepository` method via `self.0.method(...).await`. Comment claims it exists because the resolver wants `impl ScriptRepository` "owned." Fix: provide a blanket `impl<T: ScriptRepository + ?Sized> ScriptRepository for Arc<T>` in `manager-core`, or accept `&dyn`/`Arc<dyn>` ScriptRepository everywhere. Hand-delegation invites silent skew when the trait gains a method.
 ##### F-Q-012 — `build_app` is ~480 lines of pure wiring
 - **Category:** Code Quality
 - **Severity:** Medium
 - **Location:** [crates/picloud/src/lib.rs:101-578](crates/picloud/src/lib.rs#L101-L578) (`#[allow(clippy::too_many_lines)]`)
 - **Summary:** Constructs ~30 `Arc<dyn ...>` handles, ~15 `*State` structs, ~12 routers, spawns 6 background tasks — all in one function with an opt-out clippy allow. Fix: extract `wire_services(pool, master_key) -> Services`, `wire_admin_states(...) -> AdminStates`, `spawn_background_tasks(...)`. Current shape makes the "field-missing" mistake in F-Q-013 easy.
 ##### F-Q-013 — `Services::new` takes 13 positional `Arc<dyn …>` args — adding a service silently breaks all callers
 - **Category:** Code Quality
 - **Severity:** Medium
 - **Location:** [crates/shared/src/services.rs:118-148](crates/shared/src/services.rs#L118-L148), [crates/picloud/src/lib.rs:296-310](crates/picloud/src/lib.rs#L296-L310)
 - **Summary:** Constructor is `#[allow(clippy::too_many_arguments)]` and takes 13 positional handles (kv, docs, dl, events, modules, http, files, pubsub, secrets, email, users, queue, invoke). Adding workflows in v1.2 means every caller breaks silently if order is wrong. Fix: builder (`Services::builder().kv(kv).docs(docs)….build()`) or struct-literal constructor — both make field-name binding type-checked.
 ##### F-Q-014 — Hundreds of `#[ignore]`'d integration tests with no CI hook
 - **Category:** Code Quality
 - **Severity:** Medium
 - **Location:** [crates/picloud/tests/api.rs](crates/picloud/tests/api.rs) (~60 ignored), [crates/picloud/tests/authz.rs](crates/picloud/tests/authz.rs) (~30 ignored), `crates/picloud-cli/tests/*` (~70 ignored)
 - **Summary:** Every test is `#[ignore = "needs DATABASE_URL pointing at a running Postgres"]`. Hundreds of tests don't run unless a developer explicitly runs `cargo test -- --ignored` with Postgres. No marker for "this was the test that was supposed to catch X." Fix: flip to the `schema_snapshot.rs` / `dispatcher_e2e.rs` convention (auto-skip when Postgres is absent, no `#[ignore]`), or document the CI workflow that runs them.
 ##### F-M-001 — `idx_cron_triggers_due` index doesn't match the actual scheduler query
 - **Category:** Migration/Schema
 - **Severity:** Medium
 - **Location:** [crates/manager-core/migrations/0017_cron_triggers.sql:41](crates/manager-core/migrations/0017_cron_triggers.sql#L41), [crates/manager-core/src/cron_scheduler.rs:117-123](crates/manager-core/src/cron_scheduler.rs#L117-L123)
 - **Summary:** Index is on `(last_fired_at)` with a comment claiming it serves the scheduler. The actual query is `WHERE t.enabled = TRUE FOR UPDATE OF d SKIP LOCKED` — no `last_fired_at` predicate. The index is unused; the query is effectively a full-table scan of cron details joined to enabled triggers. Fix: either the query should filter on `last_fired_at` (to skip very-recently-fired rows), or the index should be dropped.
 ##### F-M-002 — `email_trigger_details` encrypted-secret columns lack coupled-nullness CHECK
 - **Category:** Migration/Schema
 - **Severity:** Medium
 - **Location:** [crates/manager-core/migrations/0024_email_triggers.sql:28-32](crates/manager-core/migrations/0024_email_triggers.sql#L28-L32)
 - **Summary:** `inbound_secret_encrypted` and `inbound_secret_nonce` are each nullable independently. There is no CHECK that they be either both NULL or both NOT NULL. A bug or partial write could leave one populated and the other NULL — silently bypassing signature verification (receiver decrypts only if the encrypted column is set). Fix: `CHECK ((inbound_secret_encrypted IS NULL) = (inbound_secret_nonce IS NULL))`. Same pattern applies to `app_secrets.realtime_signing_key_encrypted/nonce` (0025).
 ##### F-M-003 — `outbox.trigger_id` is polymorphic — no FK, orphans accumulate after route/trigger delete
 - **Category:** Migration/Schema
 - **Severity:** Medium
 - **Location:** [crates/manager-core/migrations/0009_outbox.sql:29](crates/manager-core/migrations/0009_outbox.sql#L29)
 - **Summary:** The migration notes `trigger_id` is polymorphic (`routes.id` when `source_kind='http'`, else `triggers.id`) and has no FK. Deleting a route or trigger leaves orphan outbox rows pointing at non-existent parents. Dispatcher tolerates this (rows fail dispatch and dead-letter), but a route delete + dispatcher restart can produce orphan dead-letters referencing a script that no longer matches the original route. Fix: explicit cleanup in route/trigger delete paths; consider source-kind-keyed FKs via a partial constraint or trigger.
 ##### F-T-002 — `useEndpoint().post()` auto-fires on mount — a typo creates user records or sends emails per refresh
 - **Category:** Code Quality
 - **Severity:** Medium
 - **Location:** [clients/typescript/src/react/index.ts:73-100](clients/typescript/src/react/index.ts#L73-L100)
 - **Summary:** README says "the mutation variant (auto-fires once per mount)" — but a typical mutation is event-driven (click → POST), not fire-on-mount idempotent. Auto-firing a POST on mount creates user records, sends emails, etc. unconditionally. `useEndpoint('/api/users').post({ name })` on a typo will create a user on every refresh. Fix: refactor to `{ mutate, data, loading, error }` pattern; `mutate(body)` is event-driven, not auto-firing.
 ##### F-U-004 — Five dashboard pages render light-theme fallback colors on the dark-theme app
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/apps/[slug]/dead-letters/+page.svelte:175-309](dashboard/src/routes/apps/[slug]/dead-letters/+page.svelte#L175-L309), [dashboard/src/routes/apps/[slug]/files/+page.svelte:174-228](dashboard/src/routes/apps/[slug]/files/+page.svelte#L174-L228), [dashboard/src/routes/apps/[slug]/users/+page.svelte:364-466](dashboard/src/routes/apps/[slug]/users/+page.svelte#L364-L466), [dashboard/src/routes/apps/[slug]/users/invitations/+page.svelte:254-325](dashboard/src/routes/apps/[slug]/users/invitations/+page.svelte#L254-L325), [dashboard/src/routes/apps/[slug]/queues/+page.svelte:93-128](dashboard/src/routes/apps/[slug]/queues/+page.svelte#L93-L128)
 - **Summary:** Styles use `var(--text-muted, #666)`, `var(--bg-secondary, #f5f5f5)`, `var(--border, #e0e0e0)`, `.error { color: #b00020; }`, `var(--color-link)` (undefined). The dashboard never defines any of these CSS custom properties, so the fallbacks are what users see. Result: light-grey text on near-white headers over the dark slate-900 page background; the dead-letters error banner is white-on-red; borders disappear on Queues. Fix: align to the explicit slate palette used by `apps/[slug]/+page.svelte`. Or, better: define CSS custom properties on a root scope.
 ##### F-U-005 — Trigger create forms hide dispatch_mode and retry-policy knobs
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/apps/[slug]/+page.svelte:1101-1296](dashboard/src/routes/apps/[slug]/+page.svelte#L1101-L1296)
 - **Summary:** `Trigger.dispatch_mode`, `retry_max_attempts`, `retry_backoff`, `retry_base_ms` are all editable via the create API and visible in the list, but the cron/pubsub/email create forms never expose them — only queue has `retry_max_attempts`. Operators have no way to set sync vs async dispatch or backoff strategy from the UI. Fix: add an `<details>Advanced</details>` block per trigger form.
 ##### F-U-006 — Trigger `enabled` flag never displayed; no toggle UI
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/apps/[slug]/+page.svelte:1300-1340](dashboard/src/routes/apps/[slug]/+page.svelte#L1300-L1340)
 - **Summary:** `Trigger.enabled: boolean` is on the DTO and the backend supports disabled triggers, but the trigger list never shows the state and offers no pause/resume action. Add at minimum a "• disabled" pill; ideally a toggle. If no PATCH endpoint exists, flag for backend.
 ##### F-U-007 — Native `confirm()` and `alert()` used for route deletion
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/scripts/[id]/+page.svelte:282,287](dashboard/src/routes/scripts/[id]/+page.svelte#L282)
 - **Summary:** `removeRoute()` uses `window.confirm('Delete this route?')` and surfaces errors via `window.alert()`. The rest of the dashboard adopted `ConfirmModal` for exactly this case. The browser modal is unstyled, can't show route detail, and the alert is a dead-end. Fix: convert to a `ConfirmModal` with route details in the body and an inline error region.
 ##### F-U-008 — Script-page "← Scripts" back-link drops out to /apps
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/scripts/[id]/+page.svelte:420](dashboard/src/routes/scripts/[id]/+page.svelte#L420)
 - **Summary:** "← Scripts" link uses `base + '/'`, which the root page redirects to `/apps`. After deleting a script the user is also bounced to `base + '/'`. The breadcrumb already resolves `appSlug`; the back-link should be `{base}/apps/{appSlug}`.
 ##### F-U-009 — Files page exposes no upload, download, or copy-id affordance
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/apps/[slug]/files/+page.svelte:120-153](dashboard/src/routes/apps/[slug]/files/+page.svelte#L120-L153)
 - **Summary:** Listing shows name/content-type/size/created/id; only mutation is Delete. No download link, no copy-id button (the UUID is shown but unclickable), no preview, no metadata refresh. Operators must use the admin API directly. Fix: add download link per row and a copy-id button.
 ##### F-U-010 — No instance-level configuration page surfacing `PICLOUD_*` env knobs
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** _(missing)_ `dashboard/src/routes/config/`
 - **Summary:** The platform reads ~25 `PICLOUD_*` env vars at startup (concurrency cap, session TTL, sandbox ceilings, files root + max size, SMTP timeout/TLS/port, secret max bytes, email max bytes, queue reclaim, trigger retry, HTTP allow-private, script/module cache sizes, public base URL, cookie secure). None are visible from the dashboard. Operators debugging "why is upload rejected" or "why did session expire early" have to ssh in. Fix: add a read-only `/admin/config` page using a new `GET /api/v1/admin/config` endpoint that returns non-secret current values.
 ##### F-U-011 — Cron trigger schedule has no helper, preview, or field-count validation
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/apps/[slug]/+page.svelte:1112-1118](dashboard/src/routes/apps/[slug]/+page.svelte#L1112-L1118)
 - **Summary:** Cron input is a plain text box with placeholder `0 0 9 * * MON-FRI`. Description says "6-field cron expressions (with seconds)" but a user typing a typical 5-field crontab (`0 9 * * 1-5`) gets a confusing 422 from the server. No "next 3 fires" preview, no client-side validation. Fix: split-count check before submit, info popover listing the 6 positions, and a cron-parser preview of the next fires.
 ##### F-U-012 — Logs viewer hard-capped at 50 rows, no pagination or filtering
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/scripts/[id]/+page.svelte:369,773-839](dashboard/src/routes/scripts/[id]/+page.svelte#L369)
 - **Summary:** `api.scripts.logs(id, { limit: 50 })` is the only call; backend supports `offset` (see [api.ts:659](dashboard/src/lib/api.ts#L659)) but there's no "load more". No filter by status (success/error/timeout/budget_exceeded), no filter by request path or log level, no time range. Operators investigating a failing script see only the most recent 50 with no way to drill back. Fix: offset pagination, status filter dropdown, and a level filter.
 ##### F-U-013 — Queues read-only pages have no auto-refresh or refresh button
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/apps/[slug]/queues/+page.svelte:56-91](dashboard/src/routes/apps/[slug]/queues/+page.svelte#L56-L91), [dashboard/src/routes/apps/[slug]/queues/[name]/+page.svelte:50-90](dashboard/src/routes/apps/[slug]/queues/[name]/+page.svelte#L50-L90)
 - **Summary:** Queue depths change continuously; the page shows a page-load snapshot with no way to update without a hard refresh. Dead-letters has a Refresh button; queues doesn't. Fix: add a Refresh button; auto-refresh-every-5s toggle would make this page useful for live monitoring.
 ##### F-U-014 — Email-inbound webhook URL uses `window.location.origin` — wrong under reverse proxy
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/apps/[slug]/+page.svelte:246-248](dashboard/src/routes/apps/[slug]/+page.svelte#L246-L248)
 - **Summary:** `emailInboundUrl()` builds `${window.location.origin}/api/v1/email-inbound/...`. If the admin browses via an internal LAN address but the public webhook URL is on a different host, the dashboard hands the operator the wrong URL. `VersionInfo.public_base_url` already exists for exactly this case. Fix: use `version.public_base_url` instead of `window.location.origin`.
 ##### F-U-015 — No session-expiry warning; silent 401 redirect drops in-flight form state
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/lib/api.ts:438-446](dashboard/src/lib/api.ts#L438-L446)
 - **Summary:** On any 401 the fetch wrapper immediately calls `clearSession()` and `goto('/login')`. A user mid-edit on a long Rhai script loses the entire scratch. No warning before expiry, no interstitial showing lost state, no draft auto-save. Fix: session-warning toast ~5min before TTL; localStorage-backed source drafts; "your session expired, sign in again" interstitial preserving form state.
 ##### F-U-016 — Several modals lack focus trap — Tab moves focus to background elements
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/lib/ConfirmModal.svelte:100-156](dashboard/src/lib/ConfirmModal.svelte#L100-L156), [dashboard/src/routes/users/+page.svelte:402-476](dashboard/src/routes/users/+page.svelte#L402-L476)
 - **Summary:** `ConfirmModal` focuses the first input on mount and listens for Escape but doesn't trap Tab. Keyboard users can Tab out of the modal into the underlying page. Fix: implement focus trap (via `inert` on the rest of the document, or a Tab-bound key handler).
 ##### F-U-017 — Users tables grid columns overflow below ~700px viewport
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/users/+page.svelte:727-734](dashboard/src/routes/users/+page.svelte#L727-L734), [dashboard/src/routes/profile/+page.svelte:669-677](dashboard/src/routes/profile/+page.svelte#L669-L677)
 - **Summary:** Both tables use 7- and 8-column CSS grids with no `@media` rule for mobile. Columns squash and the search input pushes header controls off-screen on narrow viewports. Fix: switch to card layout below `min-width: 600px`, or horizontal scroll with sticky first column.
 ##### F-U-018 — Dashboard can't create instance admins in the "owner" role
 - **Category:** UI/UX
 - **Severity:** Medium
 - **Location:** [dashboard/src/routes/users/+page.svelte:452-462](dashboard/src/routes/users/+page.svelte#L452-L462)
 - **Summary:** Invite-user modal offers radios "admin" and "member" only. Owner can be granted only by editing an existing user. This is intentional friction (prevents the first-owner footgun) but is asymmetric with `editRoleOptions` (line 111) where owners can assign owner directly. Document the distinction visibly above the role group, or expose "Owner" for the bootstrapping case.
 #### Low
 - **F-S-015** — `users::login` requires `AppUsersWrite` so authenticated viewer-role scripts can't authenticate users — sharp edge for "login form on an authed admin page". [users_service.rs:478-485](crates/manager-core/src/users_service.rs#L478-L485) — Low
 - **F-S-016** — Dispatcher `trigger_depth > max` vs invoke SDK `cx.trigger_depth + 1 > max` differ by one level; align the boundary semantics and add a unit test. [dispatcher.rs:342](crates/manager-core/src/dispatcher.rs#L342), [invoke.rs:141](crates/executor-core/src/sdk/invoke.rs#L141)
 - **F-S-017** — `SmtpConfig` derives `Debug` with raw `password: String` — accidental `tracing::debug!(?cfg)` leaks. [email_service.rs:88-97](crates/manager-core/src/email_service.rs#L88-L97). Hand-implement `Debug` with redaction.
 - **F-S-018** — `OutboxEventEmitter` log-and-ignore on emit failure: triggers can silently miss events if the outbox insert fails after the primary write. [kv_service.rs:114-130](crates/manager-core/src/kv_service.rs#L114-L130), [docs_service.rs:122-138](crates/manager-core/src/docs_service.rs#L122-L138), [files_service.rs:74-102](crates/manager-core/src/files_service.rs#L74-L102). Bump a metric on emit failure; long-term make primary + outbox a single tx.
 - **F-S-019** — `retry::run` allows cumulative sleep far exceeding the wall-clock timeout, tying up a gate permit. [retry.rs:189-222](crates/executor-core/src/sdk/retry.rs#L189-L222). Cap cumulative sleep inside `retry::run`.
 - **F-S-020** — `request_password_reset` email-send clamping accumulates dead reset tokens when SMTP misconfigured. Mark the just-inserted row consumed when `email.send` returns non-NotConfigured failures. [users_service.rs:678-690](crates/manager-core/src/users_service.rs#L678-L690)
 - **F-S-021** — Bearer token in `Set-Cookie` not validated against cookie-octet alphabet — if the token format ever changes, header injection becomes possible. [auth_api.rs:207-223](crates/manager-core/src/auth_api.rs#L207-L223). Guard with `[A-Za-z0-9_-]+`.
 - **F-S-022** — `attach_principal_if_present` swallows DB errors as anonymous — a transient DB blip strips authed callers and converts authed writes into anonymous writes that skip the capability gate (e.g. on `secrets_service`). [auth_middleware.rs:119-130](crates/manager-core/src/auth_middleware.rs#L119-L130)
 - **F-S-023** — `users::login` cross-app belt-and-suspenders check is unreachable in practice. Assert the invariant at the repo boundary instead. [users_service.rs:478-514](crates/manager-core/src/users_service.rs#L478-L514)
 - **F-S-024** — `PICLOUD_COOKIE_SECURE` env-var parsing is inverted-boolean readability. Replace with explicit `is_truthy` parse identical to crypto.rs. [auth_api.rs:212-218](crates/manager-core/src/auth_api.rs#L212-L218)
 - **F-S-025** — Realtime signing key plaintext lingers in `Vec<u8>` allocations without zeroize; heap dumps can leak. Use `Zeroizing<Vec<u8>>` for the realtime signing key and `ZeroizeOnDrop` for `MasterKey`. [app_secrets_repo.rs:78-91](crates/manager-core/src/app_secrets_repo.rs#L78-L91), [realtime_authority.rs:34](crates/manager-core/src/realtime_authority.rs#L34), [shared/crypto.rs:117](crates/shared/src/crypto.rs#L117)
 - **F-S-026** — Inbound-email decrypt failure → 401 conflates DB blip with bad signature; provider retries hammer the endpoint indefinitely. [email_inbound_api.rs:149-166](crates/manager-core/src/email_inbound_api.rs#L149-L166). Surface decryption failure as a logged 500.
 - **F-S-027** — Migration 0006 backfills every Phase-3a admin to `'owner'` — documented but permissive. Future audits may surface unexpected owner sprawl. [0006_users_authz.sql:24-30](crates/manager-core/migrations/0006_users_authz.sql#L24-L30)
 - **F-S-028** — API-key prefix collisions force the middleware to Argon2-verify every candidate; cap the candidate set at a small constant (e.g. 16). [auth_middleware.rs:198-211](crates/manager-core/src/auth_middleware.rs#L198-L211)
 - **F-S-029** — `admin_reset_password_token` returns raw token in JSON without rate limit. Mint a new token doesn't invalidate prior unconsumed tokens. [users_service.rs:902-927](crates/manager-core/src/users_service.rs#L902-L927)
 - **F-S-030** — `GeneratedSession`/`GeneratedAccept`/`GeneratedToken` derive `Debug` with raw tokens — same footgun as F-S-017. [shared/users.rs:89-102](crates/shared/src/users.rs#L89-L102), [auth.rs:72](crates/manager-core/src/auth.rs#L72)
 - **F-S-031** — `auth_middleware::touch` failure becomes 500, blocking authed requests on transient DB blips. Fail-soft (log + continue with existing expiry). [auth_middleware.rs:170-176](crates/manager-core/src/auth_middleware.rs#L170-L176)
 - **F-S-032** — Cookie `SameSite=Lax` is not exploitable today (admin POSTs accept JSON only), but adding a `Form<...>` extractor would make it CSRF-able. Switch admin cookie to `SameSite=Strict`. [auth_api.rs:175,220-223](crates/manager-core/src/auth_api.rs#L175)
 - **F-P-017** — `execute_by_id` clones request body, headers, and path before executing — wasteful on large bodies. Serialize logged shape from `&req` after a Result branch. [orchestrator-core/src/api.rs:117-159](crates/orchestrator-core/src/api.rs#L117-L159)
 - **F-P-018** — Sync HTTP path serializes body twice and clones a 3rd time for audit log. [orchestrator-core/src/api.rs:363-373](crates/orchestrator-core/src/api.rs#L363-L373)
 - **F-P-019** — `realtime_authority::signing_key` clones a `Vec<u8>` under `Mutex` on every cache hit. Use `Arc<[u8]>` so clone is a refcount bump. [realtime_authority.rs:56-72](crates/manager-core/src/realtime_authority.rs#L56-L72)
 - **F-P-020** — Files orphan sweep walks the entire blob tree synchronously every 6h. Skip subtrees by mtime, or track temp files in a `files_pending_tmp` table. [files_sweep.rs:75-111](crates/manager-core/src/files_sweep.rs#L75-L111)
 - **F-P-021** — `dispatcher.handle_failure` decodes payload JSON 3× per failure. Decode once at top of `handle_failure`. [dispatcher.rs:741-848](crates/manager-core/src/dispatcher.rs#L741-L848)
 - **F-P-022** — `InProcessBroadcaster::publish` allocates a `String` from the `&str` topic per publish for the lookup key, even when no subscriber exists. Use a borrowed equivalent (`raw_entry_mut`). [orchestrator-core/src/realtime.rs:107-117](crates/orchestrator-core/src/realtime.rs#L107-L117)
 - **F-P-023** — `dead_letters_api` `unresolved_count` is `COUNT(*)` per dashboard load. Partial index covers it today; cap at 100 with a "100+" UI state. [dead_letter_repo.rs:172-181](crates/manager-core/src/dead_letter_repo.rs#L172-L181)
 - **F-P-024** — Inline `block_on` for `signing_key` lookup in the realtime hot path on cold cache — fleet of reconnecting subscribers hits Postgres N times. Warm cache for active apps at startup. [realtime_authority.rs:99-102](crates/manager-core/src/realtime_authority.rs#L99-L102)
 - **F-P-025** — `attach_principal_if_present` middleware applied twice on overlapping routers (`data_plane_routed` + `user_routes`). Confirm no double-Argon2. [picloud/src/lib.rs:546-553](crates/picloud/src/lib.rs#L546-L553)
 - **F-Q-015** — `pubsub_service::publish_durable` spawns a task only to immediately await its `JoinHandle` — accomplishes nothing the inline `.await` wouldn't. [pubsub_service.rs:193-198](crates/manager-core/src/pubsub_service.rs#L193-L198)
 - **F-Q-016** — `KvError::from(KvRepoError)` does `Backend(e.to_string())` for any repo error; files_service has the right shape (pattern-match and promote). Adopt uniformly. [kv_service.rs:74-78](crates/manager-core/src/kv_service.rs#L74-L78), [files_service.rs:111-119](crates/manager-core/src/files_service.rs#L111-L119)
 - **F-Q-017** — `kv_service.rs` and `docs_service.rs` inline emit-and-log boilerplate 17 lines × 2 callsites; `files_service` / `users_service` already extract it. Apply the `emit` helper pattern. [kv_service.rs:111-130](crates/manager-core/src/kv_service.rs#L111-L130), [docs_service.rs:122-138](crates/manager-core/src/docs_service.rs#L122-L138)
 - **F-Q-018** — `auth_api::login` has a stale `.unwrap()` after the contract has been narrowed; future refactor of the predicate ordering can re-enable the panic. Use `let Some(user_id) = user_id else { … };`. [auth_api.rs:102](crates/manager-core/src/auth_api.rs#L102)
 - **F-Q-019** — SDK trait methods in `shared/` lack per-method rustdoc on most public surfaces. [shared/src/{kv,docs,queue,files,secrets,email,pubsub,users}.rs](crates/shared/src/)
 - **F-Q-020** — Several tests use `assert!(... .is_ok())` instead of asserting on the value — auth, realtime_authority, http_service especially. [client.rs:408](crates/orchestrator-core/src/client.rs#L408), [http_service.rs:774](crates/manager-core/src/http_service.rs#L774), [auth.rs:186](crates/manager-core/src/auth.rs#L186), [realtime_authority.rs:251](crates/manager-core/src/realtime_authority.rs#L251)
 - **F-Q-021** — `gc::SWEEP_INTERVAL` (weekly) and 5000-row batch hardcoded; retention is env-overridable but cadence isn't. Promote to `TriggerConfig`. [gc.rs:25,30](crates/manager-core/src/gc.rs#L25)
 - **F-Q-022** — `SmtpConfig::from_env` uses bare literal `.unwrap_or(30)` for default timeout. Name it `DEFAULT_SMTP_TIMEOUT_SECS`. [email_service.rs:128](crates/manager-core/src/email_service.rs#L128)
 - **F-M-004** — Redundant or under-targeted indexes: `secrets (app_id)` duplicates PK leftmost prefix; `idx_kv_entries_app_collection` duplicates PK; `idx_queue_trigger_details_queue_name` lacks `app_id`; `idx_triggers_app_pubsub_enabled` duplicates broader `idx_triggers_app_kind_enabled`. Each costs write amplification without enabling new plans. [0007_kv.sql:28](crates/manager-core/migrations/0007_kv.sql#L28), [0020_pubsub_triggers.sql:32](crates/manager-core/migrations/0020_pubsub_triggers.sql#L32), [0023_secrets.sql:24](crates/manager-core/migrations/0023_secrets.sql#L24), [0035_queue_triggers.sql:40](crates/manager-core/migrations/0035_queue_triggers.sql#L40)
 - **F-M-005** — `triggers.retry_max_attempts`/`retry_base_ms` and `queue_messages.max_attempts`/`attempt` have no CHECK against negative or absurd values. Apply the `scripts.timeout_seconds CHECK (> 0 AND <= 300)` discipline. [0008_triggers.sql:35,38](crates/manager-core/migrations/0008_triggers.sql#L35), [0034_queue_messages.sql:28-29](crates/manager-core/migrations/0034_queue_messages.sql#L28-L29)
 - **F-M-006** — `dead_letters.resolution` is NULL-able with no coupled-with-`resolved_at` CHECK. Same pattern as F-M-002. [0010_dead_letters.sql:37-40](crates/manager-core/migrations/0010_dead_letters.sql#L37-L40)
 - **F-M-007** — `routes_unique_binding_idx` uses `COALESCE(method, '')` allowing ambiguous binding (an empty-string method conflicts with a NULL method). Add `CHECK method IS NULL OR method IN ('GET','POST',…)`. [0005_apps.sql:100](crates/manager-core/migrations/0005_apps.sql#L100)
 - **F-T-003** — `subscribeTopic` 401 refresh path recurses without backoff. If `onTokenExpired` returns a stale token, unbounded recursion. Track `consecutive401Count`. [subscribe.ts:63-75](clients/typescript/src/subscribe.ts#L63-L75)
 - **F-T-004** — `subscribeTopic` resets `attempt = 0` after a successful connect, but a stream that errors immediately after one byte means the next reconnect is `base * 2^0` (no backoff) — hot reconnect loop possible. Gate the reset on receiving the first event or an uptime threshold. [subscribe.ts:82-96](clients/typescript/src/subscribe.ts#L82-L96)
 - **F-T-005** — `useTopic` excludes `opts` from deps — a caller changing `validate: zSchemaA` to `zSchemaB` for the same topic won't take effect. Document that `opts` is captured once per topic. [react/index.ts:39-55](clients/typescript/src/react/index.ts#L39-L55)
 - **F-T-006** — `parseBody` swallows JSON parse errors and silently falls through to text; the caller's `validate.parse` then receives raw text and throws a confusing "expected object". [endpoint.ts:84-95](clients/typescript/src/endpoint.ts#L84-L95)
 - **F-T-007** — `joinUrl` doesn't normalize repeated slashes (`https://x/v1//users` survives). Strip multiple consecutive `/` in the path portion. [endpoint.ts:102-106](clients/typescript/src/endpoint.ts#L102-L106)
 - **F-T-008** — `tsup.config.ts` externals don't include `react/jsx-runtime` — if anyone uses JSX syntax, the build bundles a copy. Pre-emptive add. [tsup.config.ts:17](clients/typescript/tsup.config.ts#L17)
 - **F-T-009** — `AuthClient` token storage is in-memory only; SSR and persistence-across-refresh aren't documented. Add a README section on the `onToken` callback + storage trade-off. [auth.ts:26](clients/typescript/src/auth.ts#L26)
 - **F-T-010** — `AuthClient.login` hardcoded to `{ email, password }` — overload with arbitrary credentials object would suit the hybrid-model intent. [auth.ts:39-48](clients/typescript/src/auth.ts#L39-L48)
 - **F-U-019** — Email-trigger inbound webhook URL has no copy button (compare API-key reveal pattern with clipboard support). [+page.svelte:1321](dashboard/src/routes/apps/[slug]/+page.svelte#L1321)
 - **F-U-020** — Version info fetched via `api.version()` but never displayed; header is the natural place for a build-info chip. [scripts/[id]/+page.svelte:50](dashboard/src/routes/scripts/[id]/+page.svelte#L50)
 - **F-U-021** — Several pages override `.container { max-width }` inside a layout that already caps at 64rem — the override is silently ignored, and dead-letters' 8-column table overflows on narrow viewports. [dead-letters/+page.svelte:176-180](dashboard/src/routes/apps/[slug]/dead-letters/+page.svelte#L176-L180), [files/+page.svelte:175-179](dashboard/src/routes/apps/[slug]/files/+page.svelte#L175-L179)
 - **F-U-022** — `$effect` blocks reference variables via `void slug;` to force tracking — Svelte 5 cargo-cult; the synchronous deref inside `load()` already registers the dependency. [dead-letters/+page.svelte:32-37](dashboard/src/routes/apps/[slug]/dead-letters/+page.svelte#L32-L37)
 - **F-U-023** — Logs viewer expanded JSON has no pretty-print toggle, copy button, or syntax highlighting. [scripts/[id]/+page.svelte:804-811](dashboard/src/routes/scripts/[id]/+page.svelte#L804-L811)
 - **F-U-024** — Test-invoke headers field accepts any JSON value but the runtime coerces all to strings; `{x-foo: null}` becomes header `"null"` with no warning. [scripts/[id]/+page.svelte:178-188](dashboard/src/routes/scripts/[id]/+page.svelte#L178-L188)
 - **F-U-025** — Apps list refetches dead-letter counts in N+1 (one per app) on every mount. Backend endpoint to batch counts would be O(1). [apps/+page.svelte:19-33](dashboard/src/routes/apps/+page.svelte#L19-L33)
 - **F-U-026** — Login form doesn't reset password on failed attempt — typo persists into next try. Either clear the password or add a "show password" toggle. [login/+page.svelte:24-36](dashboard/src/routes/login/+page.svelte#L24-L36)
 - **F-U-027** — App-user create form has no password strength meter or visibility toggle. The instance Users page uses `generatePassword(16)` + reveal-once — much safer for the admin-bootstraps-user flow. [apps/[slug]/users/+page.svelte:202-205](dashboard/src/routes/apps/[slug]/users/+page.svelte#L202-L205)
 - **F-U-028** — App-user roles input on Invitations is comma-separated string with no autocomplete from existing roles. Render as chips with autocomplete. [apps/[slug]/users/invitations/+page.svelte:146-149](dashboard/src/routes/apps/[slug]/users/invitations/+page.svelte#L146-L149)
 - **F-U-029** — Trigger creation dropdown doesn't decorate `<option>` text with existing-trigger counts per script — operators don't notice they're piling on. [apps/[slug]/+page.svelte:1101-1296](dashboard/src/routes/apps/[slug]/+page.svelte#L1101-L1296)
 - **F-U-030** — Members tab eligibleUsers errors only display once per session and disappear after submit attempt; the empty state for `app_admin` users is a dead-end with no actionable workflow. [apps/[slug]/+page.svelte:519-540](dashboard/src/routes/apps/[slug]/+page.svelte#L519-L540)
 - **F-U-031** — Members table inactive rows are opacity-greyed but the ActionMenu items remain fully active and the row gives no screen-reader cue. Add `aria-disabled="true"`. [apps/[slug]/+page.svelte:1048-1090](dashboard/src/routes/apps/[slug]/+page.svelte#L1048-L1090)
 - **F-U-032** — Modal backdrop has no focus restoration on close — keyboard users lose their place. Capture `document.activeElement` on mount, re-focus on destroy. [ConfirmModal.svelte:91-97](dashboard/src/lib/ConfirmModal.svelte#L91-L97)
 - **F-U-033** — Apps-list "No apps yet. Create one above…" misleads `member` instance-role users who can't create apps. Branch the empty-state copy. [apps/+page.svelte:217-218](dashboard/src/routes/apps/+page.svelte#L217-L218)
 - **F-U-034** — `ConfirmModal.confirmPhrasePrompt` defaults to "Type the slug to confirm:" regardless of context (e.g. script delete uses script name, not slug). Make default neutral. [ConfirmModal.svelte:121-122](dashboard/src/lib/ConfirmModal.svelte#L121-L122)
 - **F-U-035** — Triggers list shows full UUIDs inline; dead-letters truncates to 8 chars without tooltip or link. Render script name with full UUID as `title` and link to `/scripts/{id}`. [apps/[slug]/+page.svelte:1329](dashboard/src/routes/apps/[slug]/+page.svelte#L1329), [dead-letters/+page.svelte:131](dashboard/src/routes/apps/[slug]/dead-letters/+page.svelte#L131)
 - **F-U-036** — No copy-to-clipboard for any UUID shown anywhere. Reusable `<CopyableId>` component. [profile/+page.svelte:230](dashboard/src/routes/profile/+page.svelte#L230), [files/+page.svelte:138](dashboard/src/routes/apps/[slug]/files/+page.svelte#L138)
 - **F-U-037** — Timestamps via `new Date(iso).toLocaleString()` give no timezone hint. Show ISO UTC as `title=` tooltip or use relative time with absolute on hover. (Several pages.)
 - **F-U-038** — Cron timezone dropdown is a hand-rolled 14-entry list; missing common zones. Use `Intl.supportedValuesOf('timeZone')` with datalist autocomplete. [apps/[slug]/+page.svelte:34-50](dashboard/src/routes/apps/[slug]/+page.svelte#L34-L50)
 - **F-U-039** — Pubsub topic-pattern input has no datalist from registered topics. Drawing from `topics[].name` would catch typos. [apps/[slug]/+page.svelte:1152-1179](dashboard/src/routes/apps/[slug]/+page.svelte#L1152-L1179)
 - **F-U-040** — Dashboard doesn't display `public_base_url` anywhere as a "this instance lives at" hint. Add to footer/header chip. [api.ts:142-149](dashboard/src/lib/api.ts#L142-L149)
 - **F-U-041** — Apps page DL-badge has `title` but no `aria-label`; screen readers hear only the bare count. [apps/+page.svelte:228-232](dashboard/src/routes/apps/+page.svelte#L228-L232)
 #### Info
 - **F-S-033** — `users::accept_invite` deliberately skips authz ("the invitation token IS the authorization"); document the threat model explicitly. [users_service.rs:780-787](crates/manager-core/src/users_service.rs#L780-L787)
 - **F-S-034** — HTTP outbox dispatch runs with `principal: None` even when caller was authenticated — design-as-documented but operators should know inbound-anon and triggered-from-authed-HTTP are indistinguishable inside the callee. [dispatcher.rs:566](crates/manager-core/src/dispatcher.rs#L566)
 - **F-S-035** — `users::admin_create_invitation` synthesizes a `SdkCallCx` with random `script_id`/`execution_id`. Forensic noise; consider sentinel `nil()` values. [users_service.rs:982-992](crates/manager-core/src/users_service.rs#L982-L992)
 - **F-S-036** — Dispatcher uses true `rand::thread_rng()`; `retry::run` uses `DefaultHasher`-based pseudo-randomness that gives identical jitter for same `(span, raw)` pairs — defeats jitter purpose under concurrent retries. Unify. [dispatcher.rs:1041](crates/manager-core/src/dispatcher.rs#L1041) vs [retry.rs:249-261](crates/executor-core/src/sdk/retry.rs#L249-L261)
 - **F-S-037** — SSRF DNS-rebind protection depends on reqwest re-resolving DNS on every connect. Verify connection-pool behavior empirically; disable connection pooling or set short idle timeout. [ssrf.rs:154-221](crates/manager-core/src/ssrf.rs#L154-L221)
 - **F-S-038** — `me` endpoint has no scope check — an API key with only `script:read` learns the owning admin's username/instance_role/email. Document intent or filter for non-session principals. [auth_api.rs:180-201](crates/manager-core/src/auth_api.rs#L180-L201)
 - **F-S-039** — Login response body includes raw session token in addition to setting cookie — same-origin XSS gadgets can read it. Document that the dashboard SPA should discard the response-body token and rely on the cookie. [auth_api.rs:140-157](crates/manager-core/src/auth_api.rs#L140-L157)
 - **F-S-040** — Reveal-password modal exposes plaintext immediately on open. For shoulder-surfing protection, render as `type="password"` initially with a "Show value" button. [apps/[slug]/+page.svelte:1744-1756](dashboard/src/routes/apps/[slug]/+page.svelte#L1744-L1756)
 - **F-S-041** — Queue dispatcher livelocks when the registering principal becomes Inactive — message re-claimed every visibility-timeout cycle, attempt bumped each time, never reaching max_attempts. Catch `Inactive`/`NotFound` and dead-letter with reason "principal unavailable". [dispatcher.rs:231-235](crates/manager-core/src/dispatcher.rs#L231-L235)
 - **F-Q-023** — `Services` `Arc<dyn>` bundle + `#[allow(clippy::too_many_arguments)]` hides drift signal. See F-Q-013. [shared/services.rs:117](crates/shared/src/services.rs#L117)
 - **F-M-008** — `app_secrets`/`secrets`/`outbox`/`queue_messages`/`dead_letters` `JSONB` value columns are NOT NULL but allow `'null'::jsonb`. Probably not worth a CHECK; flag. [0007_kv.sql:18](crates/manager-core/migrations/0007_kv.sql#L18)
 - **F-M-009** — Migration 0006 default `'owner'` widens authority on upgrade — see F-S-027. (Migration framing of same issue.)
 - **F-M-010** — All migrations forward-only. Migration 0032 (drop plaintext realtime key) is a destructive point-of-no-return; CHANGELOG should mark it explicitly. [0032_drop_plaintext_realtime_signing_key.sql](crates/manager-core/migrations/0032_drop_plaintext_realtime_signing_key.sql)
 - **F-M-011** — Asymmetric defaults: `triggers.dispatch_mode = 'async'`, `routes.dispatch_mode = 'sync'`. Document in one place. [0008_triggers.sql:30](crates/manager-core/migrations/0008_triggers.sql#L30), [0012_routes_dispatch_mode.sql:15](crates/manager-core/migrations/0012_routes_dispatch_mode.sql#L15)
 - **F-M-012** — `app_users` lacks indexes on `email_verified_at` / `last_login_at` despite likely admin-filter views. May be premature; flag for v1.2. [0026_app_users.sql:24-25](crates/manager-core/migrations/0026_app_users.sql#L24-L25)
 - **F-M-013** — Free-text columns (`apps.slug`, `*_email`, `api_keys.scopes TEXT[]`, `app_user_invitations.roles TEXT[]`, `routes.host_kind` 'strict' vs 'exact' naming) lack DB-level shape CHECKs. Validation lives in Rust; consistent across the repo; flagging for defense-in-depth conversation.
 - **F-M-014** — `pgcrypto` extension declared once in 0001; subsequent migrations rely on `gen_random_uuid()` without re-declaring. Belt-and-suspenders `CREATE EXTENSION IF NOT EXISTS pgcrypto` in each migration that uses it.
 - **F-T-011** — `subscribeTopic` sends `Last-Event-ID` header even though server-side replay isn't implemented (README is honest). Test suite doesn't assert the header is actually sent. [subscribe.ts:51-52](clients/typescript/src/subscribe.ts#L51-L52)
 - **F-T-012** — Svelte `topicStore` `items` closure resets when last subscriber unsubscribes — non-obvious lifecycle; README doesn't call it out. [svelte/index.ts:20-32](clients/typescript/src/svelte/index.ts#L20-L32)
 - **F-T-013** — `react.test.tsx` fakeClient bypasses type safety with `as unknown as PicloudClient`. Public API additions won't be caught. Expose `PicloudClientLike` interface. [tests/react.test.tsx:19](clients/typescript/tests/react.test.tsx#L19)
 - **F-T-014** — `package.json` has both modern `exports` and legacy `main`/`module`/`types`; consistent today, but `exports`-only would be a single source of truth. [clients/typescript/package.json:11-30](clients/typescript/package.json#L11-L30)
 - **F-U-042** — `let appBySlug = $derived(...)` should be `const`. [profile/+page.svelte:28](dashboard/src/routes/profile/+page.svelte#L28)
 - **F-U-043** — `/profile?denied=users` deep-link doesn't `replaceState`-strip the param; refresh keeps the banner. [profile/+page.svelte:35](dashboard/src/routes/profile/+page.svelte#L35)
 - **F-U-044** — Test invoke result clobbers earlier with no history; small ring buffer would help iterative testing. [scripts/[id]/+page.svelte:158-197](dashboard/src/routes/scripts/[id]/+page.svelte#L158-L197)
 - **F-U-045** — `route-utils.ts` and `slugify.ts` lack vitest coverage; both are pure-function modules — easy to add. [dashboard/src/lib/](dashboard/src/lib/)
 ## Methodology notes
 - **Subagents:** 6 parallel `general-purpose` agents — Security data-plane, Security auth/secrets, Performance, Code Quality (Rust crates), UI/UX (dashboard), Migration/Schema + TypeScript client. Orchestrator (this conversation) read the project docs and verified the highest-severity findings against actual file/line state before writing the report.
 - **Wall-clock:** Single message of parallel agent dispatch + post-processing; agents took 4–22 minutes each.
 - **Verification:** F-Q-001 (manager-core cross-crate behavior import) confirmed via `grep`. F-T-001 (Rules of Hooks) confirmed by reading [clients/typescript/src/react/index.ts](clients/typescript/src/react/index.ts). F-P-001 (users::list N+1) confirmed at [users_service.rs:466-471](crates/manager-core/src/users_service.rs#L466-L471). F-P-003 (pool=10) confirmed at [picloud/src/lib.rs:583-588](crates/picloud/src/lib.rs#L583-L588). F-S-001 (unbounded queue payload) confirmed at [queue_service.rs:33-92](crates/manager-core/src/queue_service.rs#L33-L92). F-U-002 (queue drilldown 404) confirmed via grep against the routes tree.
 - **Coverage gaps:**
  - The `dashboard/tests/e2e/` Playwright suite was out of scope per the brief (149 known errors from missing `@playwright/test`).
  - The `clients/typescript/` package got a shallower pass than the Rust crates — appropriate since it's a deliberately minimal surface per v1.1.6 hybrid-model decision.
  - The orchestrator did not run the test suites; subagent line-number citations are accurate at audit time but may drift if files change.
  - SQL query plans were not measured — performance findings are static-analysis based, citing the predicate-vs-index mismatch shape rather than EXPLAIN output.
  - Caddyfile + docker-compose configurations not audited (the brief focused on application code).
  - `crates/picloud-cli/` got a light pass (mainly the `#[ignore]`'d tests count).
 - **Notes to next reviewer:**
  - The Critical (F-Q-001) is structural and load-bearing for the cluster-mode roadmap (v1.3+) — addressing it is a v1.2+ release in its own right, not a v1.1.10 patch.
  - The High-severity performance findings (F-P-001..F-P-009) cluster around two themes: (1) auth middleware doing Argon2id on the async runtime per request, (2) N+1 / OFFSET / COUNT(*) anti-patterns that an instance with real traffic will feel immediately. A focused "perf clean-up" release (call it v1.1.10) could land 6–8 of these as a single bundled PR.
  - F-S-001 (unbounded payloads) is a one-PR fix that hardens four services at once; consider doing it before any external preview.
  - The dashboard CSS-variable issue (F-U-004) is one global theme-token fix that closes 5+ pages worth of light-on-dark rendering.
  - The TypeScript client `useEndpoint` (F-T-001) is a public API correctness bug — fix or undocument before any 1.x stability claim on the client.
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,383 +1,5 @@
 # PiCloud Changelog
 ## v1.1.9 — Durable Queues & Function Composition (unreleased)
 Per-app durable queues + same-app function composition + caller-
 controlled retries. The final v1.1.x release before the v1.2 phase
 milestone. **No upgrade-order constraint** — pure additive surface,
 no destructive migrations.
 ### Added — `queue::*` SDK (durable per-app named queues)
 - **`queue::enqueue(name, message)` / `queue::enqueue(name, message, opts)`**
  — write one message onto a per-app named queue. `opts` is a Map
  with `delay_ms` (defer delivery until `NOW() + delay`) and
  `max_attempts` (clamped to `[1, 20]`; default 3). Message is any
  JSON-serializable value — Maps, Arrays, scalars, and Blobs (which
  base64-encode at any depth, mirroring `pubsub::publish_durable`).
  FnPtr / closures are rejected at the bridge.
 - **`queue::depth(name)` / `queue::depth_pending(name)`** — read-only
  inspection. `depth` is `COUNT(*)`; `depth_pending` filters to
  `claim_token IS NULL AND (deliver_after IS NULL OR deliver_after <= NOW())`.
 - Identity tuple is `(app_id, queue_name)`. Queue names are implicit
  — no queue registry table, no separate "create queue" ceremony. A
  queue exists once the first message is enqueued under that name.
 - No `peek` / `dequeue` / `purge` script-side surface. Consumers are
  triggers; exposing manual dequeue would force the platform to
  surface visibility-timeout semantics into script-land.
 - New capability `AppQueueEnqueue(AppId)` (script:write scope, editor+).
 ### Added — `queue:receive` trigger kind
 - **Exactly one consumer per `(app_id, queue_name)`** — enforced via
  `pg_advisory_xact_lock(hash(app_id || queue_name))` + a SELECT-then-
  INSERT in one transaction (a partial unique index can't span the
  parent's `app_id` from the detail table). The second create returns
  `422 Invalid` with the message `queue 'X' already has a consumer
  trigger; remove the existing one first`.
 - Per-trigger `visibility_timeout_secs` (clamped `[5, 3600]`; default
  via `PICLOUD_QUEUE_DEFAULT_VISIBILITY_TIMEOUT_SECS`). The dispatcher
  treats this as the lease window; a handler that holds the claim
  past this point loses it to the periodic reclaim task.
 - Retry policy lives on the parent `triggers` row (the same
  `retry_max_attempts` / `retry_backoff` / `retry_base_ms` every
  other trigger kind reads); no duplication on the detail row.
 - Surfaced to handler scripts as `ctx.event.queue` —
  `{ queue_name, message, enqueued_at, attempt, message_id }` — plus
  `ctx.event.source = "queue"` and `ctx.event.op = "receive"`.
 - Trigger executes as the principal that **registered** it (matches
  design notes §4 — every trigger kind does this).
 ### Added — Dispatcher queue arm + visibility-timeout reclaim task
 - The queue table IS the outbox for queue semantics. The dispatcher
  doesn't double-buffer through `outbox`; it claims directly from
  `queue_messages` via the single-round-trip
  `UPDATE … WHERE id = (SELECT id … FOR UPDATE SKIP LOCKED LIMIT 1)
   RETURNING …`. `SKIP LOCKED` keeps concurrent dispatchers (cluster
  mode v1.3+) safe.
 - Per tick (every 100ms), interleaved with the existing outbox arm:
  list every enabled `queue:receive` consumer and try one claim each.
  Bounded by the registered-consumer count, so one busy queue can't
  starve the rest.
 - **Auto-ack**: handler returns successfully → `DELETE FROM queue_messages
   WHERE id = $1 AND claim_token = $2`. The token in the WHERE is the
  leasing guarantee.
 - **Auto-nack**: handler throws → if `attempt < max_attempts`, clear
  the claim and set `deliver_after = NOW() + compute_backoff(...)`;
  else, write a `dead_letters` row (the existing `fan_out_dead_letter`
  path then fires registered `dead_letter` triggers off it) and delete
  the queue row, in one transaction.
 - **Visibility-timeout reclaim**: a separate `tokio::spawn` task ticks
  every `PICLOUD_QUEUE_RECLAIM_INTERVAL_MS` (default 30000) and clears
  claims older than the per-queue `visibility_timeout_secs`. A crashed
  consumer (or one whose handler hung past the visibility window) thus
  loses its lease and the message becomes claimable again.
 ### Added — `invoke()` + `invoke_async()` (same-app function composition)
 - **`invoke(target, args)`** — sync, returns the callee's response
  body as a Rhai Dynamic. `target` is a string (path → route trie,
  UUID → `ScriptId`, else → `(app_id, name)` lookup). Same engine
  instance and `Services` are reused; only the per-call `SdkCallCx`
  changes (callee gets `trigger_depth + 1` and a fresh `execution_id`,
  inherits the caller's principal and `root_execution_id`).
 - **`invoke_async(target, args)`** — fire-and-forget. Writes an
  `OutboxSourceKind::Invoke` row the dispatcher fires once (no retry
  loop — callers who want retries wrap in `retry::run`). Returns the
  new `ExecutionId` as a string for caller tracking.
 - **Cross-app invokes are rejected** at the `InvokeService::resolve`
  layer with `InvokeError::CrossApp` ("invoke: target script belongs
  to a different app"). v1.1.x maintains strict isolation; cross-app
  sharing arrives in v1.3+.
 - **Depth-bound**: `cx.trigger_depth + 1 > limits.trigger_depth_max`
  throws "invoke: depth limit exceeded (max N)" — shared with the
  trigger fan-out cap so a misbehaving recursive script can't blow
  the stack.
 - FnPtr / closures in `args` are rejected (closures don't survive
  re-entry into a fresh `SdkCallCx`).
 ### Added — `retry::*` SDK (caller-controlled retry)
 - **`retry::policy(opts)`** — constructs a `Policy` value (custom Rhai
  type). Validates + clamps: `max_attempts ∈ [1, 20]`,
  `base_ms ∈ [1, 60_000]`, `jitter_pct ∈ [0, 100]`,
  `backoff ∈ {"exponential" | "linear" | "constant"}`.
 - **`retry::run(policy, closure)`** — calls `closure()`; on throw,
  sleeps per the policy and re-invokes; after `max_attempts`
  exhausted, throws the last error. Sleeps via `tokio::time::sleep`
  through `TokioHandle::block_on` — the bridge is already inside the
  caller's `spawn_blocking` thread.
 - **`retry::on_codes(policy, codes_array)`** — returns a new policy
  with an error-string filter. When non-empty, only throws containing
  one of the codes retry; others surface immediately.
 - **NOTE on the brief deviation**: the brief asked for `retry::with`,
  but both `with` AND `call` are Rhai reserved keywords (rejected at
  the parser, before registration could matter). Shipped as
  `retry::run(policy, closure)` instead. Documented in HANDBACK §7.
 ### Added — Admin HTTP endpoints
 - `POST /api/v1/admin/apps/{id}/triggers/queue` — create a
  `queue:receive` trigger. Body:
  `{ script_id, queue_name, visibility_timeout_secs?, dispatch_mode?,
     retry_max_attempts?, retry_backoff?, retry_base_ms? }`.
  Capability: `AppManageTriggers`.
 - `GET /api/v1/admin/apps/{id}/queues` — list every distinct queue
  name in the app with `(total, pending, claimed)` counts.
  Capability: `AppLogRead`.
 - `GET /api/v1/admin/apps/{id}/queues/{queue_name}` — drill-down:
  stats + registered consumer trigger (if any). Capability:
  `AppLogRead`.
 - No mutating queue endpoints (purge / requeue / delete-message stays
  at v1.2).
 ### Added — Dashboard (v0.15.0)
 - New `/apps/{slug}/queues` read-only list view (queue name + counts +
  drilldown link) and `/apps/{slug}/queues/{name}` drill-down (depth +
  registered consumer + visibility timeout + last_fired_at).
 - "Queues" link added to the app-level nav between Files and Dead
  letters.
 - Triggers tab gains a "Queue:receive trigger (v1.1.9)" form alongside
  cron / pubsub / email. Trigger list renders queue triggers with the
  queue name + visibility timeout + last_fired_at.
 - TypeScript types: `TriggerKind` gains `'queue'`; `TriggerDetails`
  gains the `Queue` variant. `CreateQueueTriggerInput`,
  `QueueSummary`, `QueueConsumer`, `QueueDetail` exported.
 ### Changed
 - `Services::new` signature gains `queue: Arc<dyn QueueService>` and
  `invoke: Arc<dyn InvokeService>` positionally after `users` (mirrors
  v1.1.8's positional append of `users`). `with_noop_services` updated.
 - `Limits` (`crates/executor-core/src/sandbox.rs`) gains
  `trigger_depth_max: u32` (default 8). The picloud binary syncs it
  from `TriggerConfig::from_env().max_trigger_depth` so the
  dispatcher's trigger-depth cap and the invoke depth-bound stay
  aligned (env var: `PICLOUD_MAX_TRIGGER_DEPTH`).
 - `Engine` gains `set_self_weak(Weak<Engine>)` + `self_arc()`. The
  picloud binary calls `engine.set_self_weak(Arc::downgrade(&engine))`
  right after construction so the invoke bridge can re-enter the
  engine synchronously. `Weak` so the Arc-cycle stays loose.
 - `register_all` gains two parameters: `limits: Limits` and
  `self_engine: Option<Arc<Engine>>`. The invoke bridge surfaces a
  clear error if `self_engine` is `None` (only in harnesses that don't
  wire it).
 - `OutboxSourceKind` gains `Invoke`; `TriggerKind` gains `Queue`;
  `TriggerDetails` gains the `Queue` variant; `TriggerEvent` gains the
  `Queue` variant with `source = "queue"` discriminant.
 - `ScriptRepository` gains `get_by_name(app_id, name)` for the
  `invoke()` name resolution path.
 - SDK schema 1.9 → 1.10.
 ### Migrations
 - `0034_queue_messages.sql` — the `queue_messages` table with three
  indexes: a partial `(app_id, queue_name, enqueued_at) WHERE
  claim_token IS NULL` for the dispatch hot path, a `(app_id,
  queue_name)` for the depth queries, and a partial `(claimed_at)
  WHERE claim_token IS NOT NULL` for the reclaim scan.
 - `0035_queue_triggers.sql` — widens `triggers.kind` to admit
  `'queue'`, widens `outbox.source_kind` to admit `'invoke'`, adds the
  `queue_trigger_details` table.
 ### F1–F5 follow-ups (carry-forward from v1.1.8)
 - **F1 — integration test density**: four new DB-gated test binaries
  (`crates/picloud/tests/queue_e2e.rs` ×4, `…/invoke_e2e.rs` ×4,
  `…/retry_e2e.rs` ×3, `crates/manager-core/tests/migration_queue_messages.rs`
  ×4) + 50+ net new inline unit tests. All skip cleanly when
  `DATABASE_URL` is unset; all pass against the docker-compose
  postgres on `localhost:15432`.
 - **F2 — schema snapshot re-blessed** via
  `BLESS=1 cargo test -p picloud-manager-core --test schema_snapshot
   -- --include-ignored`. Delta matches the plan exactly (no unrelated
  drift).
 - **F3 — fmt + clippy attestation as literal output**: see HANDBACK §8.
 - **F4 — `TIMING_FLAT_DUMMY_HASH` dedup**: inline copy in
  `crates/manager-core/src/auth_api.rs::login` now references the
  shared `crate::auth::TIMING_FLAT_DUMMY_HASH` const. `grep -rn` for
  the PHC literal returns exactly one hit.
 - **F5 — clippy without cold cache**: incremental cache used; HANDBACK
  §8 notes the explicit choice.
 ### Notes
 - New env vars:
  - `PICLOUD_QUEUE_RECLAIM_INTERVAL_MS` (default 30000) — visibility-
    timeout reclaim cadence.
  - `PICLOUD_QUEUE_DEFAULT_VISIBILITY_TIMEOUT_SECS` (default 30) —
    visibility timeout fallback when the trigger create request omits
    one. Per-trigger column overrides this.
 - SDK schema bumped to 1.10.
 - `@picloud/client` unchanged — no client-library work this release.
 ---
 ## v1.1.8 — User Management (unreleased)
 Per-app data-plane user management — a `users::*` SDK for scripts
 plus an admin HTTP surface and dashboard tab — together with three
 load-bearing follow-ups from v1.1.7 (dropping the plaintext realtime
 signing-key column, `--all-targets` clippy discipline, and adding a
 session-based realtime SSE auth mode).
 **UPGRADE PATH IS LOAD-BEARING.** v1.1.8 requires v1.1.7 to have
 been applied first. Operators upgrading directly from v1.1.6 or
 earlier MUST apply v1.1.7 (and let its startup encryption sweep
 complete) before applying v1.1.8 — migration 0032's guard refuses
 to drop the plaintext `realtime_signing_key` column while any row
 still needs encryption.
 ### Added — `users::*` SDK (data-plane user management)
 - **`users::create(#{...})` / `users::get(id)` / `users::find_by_email(...)`
  / `users::update(id, #{...})` / `users::delete(id)` /
  `users::list(#{ "$limit", cursor })`** — CRUD on per-app end-users
  (distinct from the control-plane `admin_users` table). Identity tuple
  is `(app_id, user_id)`; uniqueness is on `(app_id, lower(email))` so
  the same email can exist across two apps but not twice within one.
  Password hash is Argon2id PHC (same algorithm as `admin_users`);
  the public AppUser record never carries the hash.
 - **`users::login(email, password)`** returns a session token string,
  or `()` on bad credentials. The bad-email and bad-password branches
  share wall-clock cost via a timing-flat dummy Argon2id verify on
  email miss. **Required for security**, not polish.
 - **`users::verify(token)`** returns the user on success (bumping the
  sliding TTL), `()` on missing / expired / revoked / cross-app.
 - **`users::logout(token)`** revokes the session row.
 - `migrations/0026_app_users.sql` + `0027_app_user_sessions.sql`.
 ### Added — Sessions
 - `app_user_sessions` table with SHA-256 token hash, sliding TTL
  (`PICLOUD_APP_USER_SESSION_TTL_HOURS`, default 24h), hard cap
  (`PICLOUD_APP_USER_SESSION_ABSOLUTE_HOURS`, default 720h = 30d),
  and explicit `revoked_at` for logout / admin revoke-all / password-
  reset side-effects. Lookups reject revoked/expired rows
  immediately, before the weekly GC sweep runs.
 ### Added — Email verification
 - **`users::send_verification_email(user_id, #{ link_base, from,
  subject, body_template })`** mints a 32-byte token, stores its
  SHA-256 in `app_user_email_verifications`, and dispatches via
  `email::send` with `{link}` in the body substituted for
  `link_base?token=<raw>`. `EmailError::NotConfigured` propagates as
  `UsersError::EmailNotConfigured` so scripts already handling the
  v1.1.7 email-disabled mode don't need new branches.
 - **`users::verify_email(token)`** atomically consumes the one-shot
  token, sets `email_verified_at = NOW()`, emits
  `users::email_verified`.
 - `migrations/0028_app_user_email_verifications.sql`.
 ### Added — Password reset
 - **`users::request_password_reset(email, #{ template })`** returns
  `Ok(())` regardless of whether the email matched — no
  existence-leak signal in script-land. Email-not-configured does
  surface (operators need to know); other email failures are silently
  swallowed and logged server-side.
 - **`users::complete_password_reset(token, new_password)`** atomically
  consumes the token, updates the Argon2id hash, and **revokes every
  active session** for the user (stale tokens shouldn't ride out the
  reset). TTL `PICLOUD_APP_USER_PASSWORD_RESET_TTL_HOURS` (default 1h).
 - `migrations/0029_app_user_password_resets.sql`.
 ### Added — Invitations
 - **`users::invite(email, #{ template?, display_name?, roles? })`**
  gated on `AppUsersAdmin`. Omitting the template skips the email
  send so an admin can issue invitations for out-of-band delivery.
 - **`users::accept_invite(token, password, display_name?)`** atomically
  consumes the invitation, creates the user with pre-staged roles
  applied, and mints a fresh session — caller can return both the
  user and the session token in one round trip. TTL
  `PICLOUD_APP_USER_INVITATION_TTL_DAYS` (default 7d).
 - `migrations/0030_app_user_invitations.sql`.
 ### Added — Per-app roles
 - **`users::add_role(id, role)` / `users::remove_role(id, role)` /
  `users::has_role(id, role)`** — string-tagged, per-app. The script
  app decides what `"admin"` / `"editor"` / `"viewer"` mean. Stored
  in `app_user_roles` (composite PK so `add` is idempotent).
 - The full `AppUser` record returned by every `users::*` getter now
  carries a `roles` array.
 - `migrations/0031_app_user_roles.sql`.
 - **Role permission matrices / hierarchy / role registry are
  explicitly v1.2 work** — v1.1.8 does not pre-commit to a model
  that would lock in a wrong API.
 ### Added — Admin HTTP surface
 - `GET / POST / PATCH / DELETE /api/v1/admin/apps/{id}/users` and
  `/users/{user_id}` — list, get, create, update, delete.
 - `POST /users/{user_id}/reset-password` — returns a one-shot reset
  token in the response body (TTL 1h). No email is sent — that's
  the SDK's `users::request_password_reset`.
 - `POST /users/{user_id}/revoke-sessions` — bulk revoke for that
  user.
 - `GET / POST / DELETE /api/v1/admin/apps/{id}/invitations` and
  `/invitations/{invite_id}` — list, create, revoke pending.
 - Capability gating: `AppUsersRead` for reads, `AppUsersWrite` for
  CRUD, `AppUsersAdmin` for admin-mediated verbs + invitations. All
  three map to existing scopes (`script:read` / `script:write`) —
  **no new scope** (seven-scope commitment).
 - DTOs never include password hashes, session tokens, or unrotated
  reset tokens.
 ### Added — Dashboard Users tab
 - `apps/[slug]/users/+page.svelte` — list, create form, edit modal,
  revoke-sessions, reset-password (one-shot token displayed once),
  delete. Sub-route `users/invitations/+page.svelte` for pending
  invitations (list, create with optional inline email template,
  revoke).
 - The main app-detail tab strip gains a Users entry above Files.
 - `@picloud/dashboard` 0.13.0 → 0.14.0.
 ### Changed — Realtime: drop plaintext signing-key column (F1)
 - `migrations/0032_drop_plaintext_realtime_signing_key.sql` —
  guard query + `ALTER TABLE app_secrets DROP COLUMN IF EXISTS
  realtime_signing_key`. The guard refuses to apply if any row still
  has plaintext but no encrypted counterpart.
 - v1.1.7's `migrate_plaintext_keys` startup task and its call from
  `build_app` are deleted; the read path now consults only the
  encrypted columns.
 ### Changed — Realtime: `auth_mode = 'session'` (F3)
 - `migrations/0033_topics_auth_mode_session.sql` widens the
  `topics_auth_mode_check` CHECK to allow `'session'` alongside
  `'public'` and `'token'`.
 - `RealtimeAuthorityImpl` gains a `UsersService` dependency; the
  Session branch of `authorize_subscribe` delegates to
  `verify_session_for_realtime(app_id, token)` (same DB lookup +
  sliding-TTL bump as the SDK's `users::verify`, but app_id is
  taken from the topic row, not a script).
 - Dashboard Topics tab gains `session` as a third radio option.
 - `token` (HMAC) validator is unchanged; both coexist per topic.
 ### Notes
 - New env vars (all with documented defaults):
  - `PICLOUD_APP_USER_SESSION_TTL_HOURS` (24)
  - `PICLOUD_APP_USER_SESSION_ABSOLUTE_HOURS` (720 = 30d)
  - `PICLOUD_APP_USER_VERIFICATION_TTL_HOURS` (48)
  - `PICLOUD_APP_USER_PASSWORD_RESET_TTL_HOURS` (1)
  - `PICLOUD_APP_USER_INVITATION_TTL_DAYS` (7)
 - SDK schema 1.8 → 1.9 (additive surface: `users::*` + `session`
  topic auth mode).
 - Workspace version 1.1.7 → 1.1.8.
 - `@picloud/client` does NOT bump in v1.1.8 — its `auth.login` /
  `auth.logout` helpers already call dev-defined endpoints;
  nothing to change in the client.
 - New weekly GC sweep (`spawn_app_user_token_gc`) prunes expired /
  revoked / consumed rows across the four new token tables.
 ## v1.1.7 — Configuration & Email (unreleased)
 The operational-config layer: **encrypted per-app secrets**, **outbound
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -116,18 +116,10 @@ Environment variables consumed by the `picloud` binary:
 | `PICLOUD_BIND` | `0.0.0.0:8080` | HTTP listen address. Port 8080 is owned by another process on this host — override locally. |
 | `PICLOUD_MAX_CONCURRENT_EXECUTIONS` | `32` | Global concurrency cap on data-plane script executions. Overflow returns HTTP 503 with `Retry-After: 1` immediately (no queue). |
 | `DATABASE_URL` | — | Required. Postgres connection string. |
 | `PICLOUD_SECRET_KEY` | — | Master encryption key (base64). Required at startup unless dev mode is acknowledged (below). |
 | `PICLOUD_DEV_MODE` | `false` | `true` enables local-dev conveniences. Without `PICLOUD_SECRET_KEY` it ALSO requires the acknowledgement var below — `PICLOUD_DEV_MODE=true` alone aborts at startup. Also: when no SMTP relay is configured, `email::send` switches from disabled (`NotConfigured`) to an **in-memory dev sink** — sends succeed and the last 100 messages are readable at `GET /api/v1/admin/dev/emails` (instance Owner/Admin only; route exists only in this mode). Never in production. |
 | `PICLOUD_DEV_INSECURE_KEY` | — | Set to the literal `i-understand-this-is-insecure` to let dev mode boot without `PICLOUD_SECRET_KEY`, using a deterministic, world-known dev master key. Never set in production — it would encrypt everything with a public value. |
 | `PICLOUD_DB_MAX_CONNECTIONS` | `32` | Postgres pool size. Matched to `PICLOUD_MAX_CONCURRENT_EXECUTIONS` so the data plane can't starve background workers. |
 | `PICLOUD_SESSION_TTL_HOURS` | `24` | Sliding-window session lifetime. |
 | `PICLOUD_SANDBOX_MAX_*` | conservative defaults | Per-knob admin ceilings on Rhai sandbox overrides. See `manager-core::sandbox::SandboxCeiling`. |
 | `PICLOUD_FILES_ROOT` | `./data` | Filesystem root for `files::*` blob storage (v1.1.5). Bytes live at `<root>/files/<app_id>/<collection>/<id[0:2]>/<id>`; metadata in Postgres. |
 | `PICLOUD_FILES_MAX_FILE_SIZE_BYTES` | `104857600` (100 MB) | Per-file hard size cap for `files::*` (v1.1.5). Per-app quotas deferred to v1.2. |
 | `PICLOUD_KV_MAX_VALUE_BYTES` | `262144` (256 KB) | Per-key JSON-encoded value cap for `kv::set`. Rejects oversized payloads before authz so anonymous public scripts can't DoS Postgres JSONB columns. |
 | `PICLOUD_DOCS_MAX_VALUE_BYTES` | `262144` (256 KB) | Per-document JSON-encoded data cap for `docs::create`/`update`. |
 | `PICLOUD_PUBSUB_MAX_MESSAGE_BYTES` | `262144` (256 KB) | Per-message JSON-encoded payload cap for `pubsub::publish_durable`. Prevents one publish from amplifying into N outbox rows × M MB. |
 | `PICLOUD_QUEUE_MAX_PAYLOAD_BYTES` | `262144` (256 KB) | Per-message JSON-encoded payload cap for `queue::enqueue`. |
 ## Out of MVP
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8,7 +8,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
 "generic-array",
 ]
@@ -20,7 +20,7 @@ checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
 "cfg-if",
 "cipher",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 ]
 [[package]]
@@ -139,7 +139,7 @@ checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
 dependencies = [
 "base64ct",
 "blake2",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 "password-hash",
 ]
@@ -324,7 +324,7 @@ version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
 dependencies = [
- "digest 0.10.7",
+ "digest",
 ]
 [[package]]
@@ -336,15 +336,6 @@ dependencies = [
 "generic-array",
 ]
 [[package]]
 name = "block-buffer"
 version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
 dependencies = [
 "hybrid-array",
 ]
 [[package]]
 name = "bstr"
 version = "1.12.1"
@@ -408,17 +399,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 [[package]]
 name = "chacha20"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
 dependencies = [
 "cfg-if",
 "cpufeatures 0.3.0",
 "rand_core 0.10.1",
 ]
 [[package]]
 name = "chrono"
 version = "0.4.44"
@@ -441,7 +421,7 @@ checksum = "93698b29de5e97ad0ae26447b344c482a7284c737d9ddc5f9e52b74a336671bb"
 dependencies = [
 "chrono",
 "chrono-tz-build",
- "phf 0.11.3",
+ "phf",
 ]
 [[package]]
@@ -451,7 +431,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c088aee841df9c3041febbb73934cfc39708749bf96dc827e3359cd39ef11b1"
 dependencies = [
 "parse-zoneinfo",
- "phf 0.11.3",
+ "phf",
 "phf_codegen",
 ]
@@ -461,7 +441,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
 "inout",
 ]
@@ -505,12 +485,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 [[package]]
 name = "cmov"
 version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -532,12 +506,6 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 [[package]]
 name = "const-oid"
 version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -583,15 +551,6 @@ dependencies = [
 "libc",
 ]
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
 dependencies = [
 "libc",
 ]
 [[package]]
 name = "crc"
 version = "3.4.0"
@@ -650,15 +609,6 @@ dependencies = [
 "typenum",
 ]
 [[package]]
 name = "crypto-common"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
 "hybrid-array",
 ]
 [[package]]
 name = "ctr"
 version = "0.9.2"
@@ -668,15 +618,6 @@ dependencies = [
 "cipher",
 ]
 [[package]]
 name = "ctutils"
 version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
 dependencies = [
 "cmov",
 ]
 [[package]]
 name = "data-encoding"
 version = "2.11.0"
@@ -689,7 +630,7 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid 0.9.6",
+ "const-oid",
 "pem-rfc7468",
 "zeroize",
 ]
@@ -721,24 +662,12 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer 0.10.4",
+ "block-buffer",
- "const-oid 0.9.6",
+ "const-oid",
- "crypto-common 0.1.7",
+ "crypto-common",
 "subtle",
 ]
 [[package]]
 name = "digest"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
 "block-buffer 0.12.0",
 "const-oid 0.10.2",
 "crypto-common 0.2.2",
 "ctutils",
 ]
 [[package]]
 name = "directories"
 version = "5.0.1"
@@ -840,12 +769,6 @@ dependencies = [
 "pin-project-lite",
 ]
 [[package]]
 name = "fallible-iterator"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
 [[package]]
 name = "fastrand"
 version = "2.4.1"
@@ -907,21 +830,6 @@ dependencies = [
 "percent-encoding",
 ]
 [[package]]
 name = "futures"
 version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
 dependencies = [
 "futures-channel",
 "futures-core",
 "futures-executor",
 "futures-io",
 "futures-sink",
 "futures-task",
 "futures-util",
 ]
 [[package]]
 name = "futures-channel"
 version = "0.3.32"
@@ -966,17 +874,6 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
 [[package]]
 name = "futures-macro"
 version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn",
 ]
 [[package]]
 name = "futures-sink"
 version = "0.3.32"
@@ -995,10 +892,8 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
 "futures-channel",
 "futures-core",
 "futures-io",
 "futures-macro",
 "futures-sink",
 "futures-task",
 "memchr",
@@ -1025,7 +920,7 @@ dependencies = [
 "cfg-if",
 "js-sys",
 "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
 "wasm-bindgen",
 ]
@@ -1052,7 +947,6 @@ dependencies = [
 "cfg-if",
 "libc",
 "r-efi 6.0.0",
 "rand_core 0.10.1",
 "wasip2",
 "wasip3",
 ]
@@ -1111,7 +1005,7 @@ version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
- "hmac 0.12.1",
+ "hmac",
 ]
 [[package]]
@@ -1120,16 +1014,7 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest 0.10.7",
+ "digest",
 ]
 [[package]]
 name = "hmac"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
 "digest 0.11.3",
 ]
 [[package]]
@@ -1197,15 +1082,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 [[package]]
 name = "hybrid-array"
 version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9155a582abd142abc056962c29e3ce5ff2ad5469f4246b537ed42c5deba857da"
 dependencies = [
 "typenum",
 ]
 [[package]]
 name = "hyper"
 version = "1.9.0"
@@ -1597,17 +1473,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
 dependencies = [
 "cfg-if",
- "digest 0.10.7",
+ "digest",
 ]
 [[package]]
 name = "md-5"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
 dependencies = [
 "cfg-if",
 "digest 0.11.3",
 ]
 [[package]]
@@ -1635,7 +1501,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
 "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
 "windows-sys 0.61.2",
 ]
@@ -1734,24 +1600,6 @@ dependencies = [
 "libm",
 ]
 [[package]]
 name = "objc2-core-foundation"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
 "bitflags",
 ]
 [[package]]
 name = "objc2-system-configuration"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
 dependencies = [
 "objc2-core-foundation",
 ]
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -1872,17 +1720,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
 dependencies = [
- "phf_shared 0.11.3",
+ "phf_shared",
 ]
 [[package]]
 name = "phf"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
 dependencies = [
 "phf_shared 0.13.1",
 "serde",
 ]
 [[package]]
@@ -1892,7 +1730,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
 dependencies = [
 "phf_generator",
- "phf_shared 0.11.3",
+ "phf_shared",
 ]
 [[package]]
@@ -1901,7 +1739,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
- "phf_shared 0.11.3",
+ "phf_shared",
 "rand 0.8.6",
 ]
@@ -1914,18 +1752,9 @@ dependencies = [
 "siphasher",
 ]
 [[package]]
 name = "phf_shared"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
 dependencies = [
 "siphasher",
 ]
 [[package]]
 name = "picloud"
-version = "1.1.9"
+version = "1.1.7"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -1934,14 +1763,14 @@ dependencies = [
 "chrono",
 "figment",
 "hex",
- "hmac 0.12.1",
+ "hmac",
 "picloud-executor-core",
 "picloud-manager-core",
 "picloud-orchestrator-core",
 "picloud-shared",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "sqlx",
 "thiserror 1.0.69",
 "tokio",
@@ -1954,7 +1783,7 @@ dependencies = [
 [[package]]
 name = "picloud-cli"
-version = "1.1.9"
+version = "1.1.7"
 dependencies = [
 "anyhow",
 "assert_cmd",
@@ -1962,9 +1791,7 @@ dependencies = [
 "clap",
 "directories",
 "libc",
 "percent-encoding",
 "picloud-shared",
 "postgres",
 "predicates",
 "reqwest",
 "rpassword",
@@ -1973,12 +1800,11 @@ dependencies = [
 "tempfile",
 "tokio",
 "toml",
 "uuid",
 ]
 [[package]]
 name = "picloud-executor"
-version = "1.1.9"
+version = "1.1.7"
 dependencies = [
 "anyhow",
 "picloud-executor-core",
@@ -1990,7 +1816,7 @@ dependencies = [
 [[package]]
 name = "picloud-executor-core"
-version = "1.1.9"
+version = "1.1.7"
 dependencies = [
 "async-trait",
 "base64",
@@ -2014,7 +1840,7 @@ dependencies = [
 [[package]]
 name = "picloud-manager"
-version = "1.1.9"
+version = "1.1.7"
 dependencies = [
 "anyhow",
 "picloud-manager-core",
@@ -2026,7 +1852,7 @@ dependencies = [
 [[package]]
 name = "picloud-manager-core"
-version = "1.1.9"
+version = "1.1.7"
 dependencies = [
 "argon2",
 "async-trait",
@@ -2036,9 +1862,8 @@ dependencies = [
 "chrono-tz",
 "cron",
 "data-encoding",
 "futures",
 "hex",
- "hmac 0.12.1",
+ "hmac",
 "lettre",
 "picloud-executor-core",
 "picloud-orchestrator-core",
@@ -2047,7 +1872,7 @@ dependencies = [
 "reqwest",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "sqlx",
 "thiserror 1.0.69",
 "tokio",
@@ -2058,7 +1883,7 @@ dependencies = [
 [[package]]
 name = "picloud-orchestrator"
-version = "1.1.9"
+version = "1.1.7"
 dependencies = [
 "anyhow",
 "picloud-orchestrator-core",
@@ -2070,7 +1895,7 @@ dependencies = [
 [[package]]
 name = "picloud-orchestrator-core"
-version = "1.1.9"
+version = "1.1.7"
 dependencies = [
 "async-trait",
 "axum",
@@ -2093,17 +1918,17 @@ dependencies = [
 [[package]]
 name = "picloud-shared"
-version = "1.1.9"
+version = "1.1.7"
 dependencies = [
 "aes-gcm",
 "async-trait",
 "base64",
 "chrono",
- "hmac 0.12.1",
+ "hmac",
 "rand 0.8.6",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "thiserror 1.0.69",
 "tokio",
 "tracing",
@@ -2156,7 +1981,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
 "opaque-debug",
 "universal-hash",
 ]
@@ -2167,52 +1992,6 @@ version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 [[package]]
 name = "postgres"
 version = "0.19.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aacf632d0554ff75f58183694f41dc8999c8a3a43a386994d0ec2d034f1dfbe1"
 dependencies = [
 "bytes",
 "fallible-iterator",
 "futures-util",
 "log",
 "tokio",
 "tokio-postgres",
 ]
 [[package]]
 name = "postgres-protocol"
 version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56201207dac53e2f38e848e31b4b91616a6bb6e0c7205b77718994a7f49e70fc"
 dependencies = [
 "base64",
 "byteorder",
 "bytes",
 "fallible-iterator",
 "hmac 0.13.0",
 "md-5 0.11.0",
 "memchr",
 "rand 0.10.1",
 "sha2 0.11.0",
 "stringprep",
 ]
 [[package]]
 name = "postgres-types"
 version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8dc729a129e682e8d24170cd30ae1aa01b336b096cbb56df6d534ffec133d186"
 dependencies = [
 "bytes",
 "fallible-iterator",
 "postgres-protocol",
 "serde_core",
 "serde_json",
 "uuid",
 ]
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -2412,17 +2191,6 @@ dependencies = [
 "rand_core 0.9.5",
 ]
 [[package]]
 name = "rand"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
 "chacha20",
 "getrandom 0.4.2",
 "rand_core 0.10.1",
 ]
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -2461,12 +2229,6 @@ dependencies = [
 "getrandom 0.3.4",
 ]
 [[package]]
 name = "rand_core"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -2635,8 +2397,8 @@ version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid 0.9.6",
+ "const-oid",
- "digest 0.10.7",
+ "digest",
 "num-bigint-dig",
 "num-integer",
 "num-traits",
@@ -2835,8 +2597,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
- "digest 0.10.7",
+ "digest",
 ]
 [[package]]
@@ -2846,19 +2608,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
 "cfg-if",
- "cpufeatures 0.2.17",
+ "cpufeatures",
- "digest 0.10.7",
+ "digest",
 ]
 [[package]]
 name = "sha2"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
 "cfg-if",
 "cpufeatures 0.3.0",
 "digest 0.11.3",
 ]
 [[package]]
@@ -2892,7 +2643,7 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
- "digest 0.10.7",
+ "digest",
 "rand_core 0.6.4",
 ]
@@ -3004,7 +2755,7 @@ dependencies = [
 "rustls",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "smallvec",
 "thiserror 2.0.18",
 "tokio",
@@ -3043,7 +2794,7 @@ dependencies = [
 "quote",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "sqlx-core",
 "sqlx-mysql",
 "sqlx-postgres",
@@ -3066,7 +2817,7 @@ dependencies = [
 "bytes",
 "chrono",
 "crc",
- "digest 0.10.7",
+ "digest",
 "dotenvy",
 "either",
 "futures-channel",
@@ -3076,10 +2827,10 @@ dependencies = [
 "generic-array",
 "hex",
 "hkdf",
- "hmac 0.12.1",
+ "hmac",
 "itoa",
 "log",
- "md-5 0.10.6",
+ "md-5",
 "memchr",
 "once_cell",
 "percent-encoding",
@@ -3087,14 +2838,14 @@ dependencies = [
 "rsa",
 "serde",
 "sha1",
- "sha2 0.10.9",
+ "sha2",
 "smallvec",
 "sqlx-core",
 "stringprep",
 "thiserror 2.0.18",
 "tracing",
 "uuid",
- "whoami 1.6.1",
+ "whoami",
 ]
 [[package]]
@@ -3116,24 +2867,24 @@ dependencies = [
 "futures-util",
 "hex",
 "hkdf",
- "hmac 0.12.1",
+ "hmac",
 "home",
 "itoa",
 "log",
- "md-5 0.10.6",
+ "md-5",
 "memchr",
 "once_cell",
 "rand 0.8.6",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "smallvec",
 "sqlx-core",
 "stringprep",
 "thiserror 2.0.18",
 "tracing",
 "uuid",
- "whoami 1.6.1",
+ "whoami",
 ]
 [[package]]
@@ -3398,32 +3149,6 @@ dependencies = [
 "syn",
 ]
 [[package]]
 name = "tokio-postgres"
 version = "0.7.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4dd8df5ef180f6364759a6f00f7aadda4fbbac86cdee37480826a6ff9f3574ce"
 dependencies = [
 "async-trait",
 "byteorder",
 "bytes",
 "fallible-iterator",
 "futures-channel",
 "futures-util",
 "log",
 "parking_lot",
 "percent-encoding",
 "phf 0.13.1",
 "pin-project-lite",
 "postgres-protocol",
 "postgres-types",
 "rand 0.10.1",
 "socket2",
 "tokio",
 "tokio-util",
 "whoami 2.1.2",
 ]
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"
@@ -3682,7 +3407,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
 "subtle",
 ]
@@ -3776,15 +3501,6 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 [[package]]
 name = "wasi"
 version = "0.14.7+wasi-0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
 dependencies = [
 "wasip2",
 ]
 [[package]]
 name = "wasip2"
 version = "1.0.3+wasi-0.2.9"
@@ -3809,15 +3525,6 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 [[package]]
 name = "wasite"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66fe902b4a6b8028a753d5424909b764ccf79b7a209eac9bf97e59cda9f71a42"
 dependencies = [
 "wasi 0.14.7+wasi-0.2.4",
 ]
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.122"
@@ -3952,20 +3659,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
 dependencies = [
 "libredox",
- "wasite 0.1.0",
+ "wasite",
 ]
 [[package]]
 name = "whoami"
 version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
 dependencies = [
 "libc",
 "libredox",
 "objc2-system-configuration",
 "wasite 1.0.2",
 "web-sys",
 ]
 [[package]]
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,7 @@ members = [
 ]
 [workspace.package]
-version = "1.1.9"
+version = "1.1.7"
 edition = "2021"
 rust-version = "1.92"
 license = "MIT OR Apache-2.0"
@@ -53,10 +53,8 @@ chrono = { version = "0.4", features = ["serde"] }
 chrono-tz = "0.9"
 cron = "0.12"
-# Async traits + bounded-concurrency stream utilities (queue dispatcher
+# Async traits
 # uses `for_each_concurrent`).
 async-trait = "0.1"
 futures = "0.3"
 # Rhai scripting. Pinned exactly (`=1.24`) because the `internals`
 # feature surface is not semver-stable — future bumps must be deliberate.
--- a/E2E_STASH_REPORT.md
+++ b/E2E_STASH_REPORT.md
@@ -1,138 +0,0 @@
 # E2E Test #2 — "Stash" (paste + file-drop) + security matrix
 **Date:** 2026-06-13 · **Build:** v1.1.9 · **Instance:** host `picloud` on `127.0.0.1:8099`
 (dev mode, `PICLOUD_FILES_MAX_FILE_SIZE_BYTES=1048576`, SSRF guard on, SMTP unset), Postgres in
 Docker. Driven entirely through the `pic` CLI; data-plane traffic via `curl`.
 ## Goal
 Second end-to-end pass. The first test (To-Do, `E2E_TODO_REPORT.md`) covered users/docs/pubsub/
 cron/routes/domains/topics. This one builds a **new** app to exercise the *untested* half of the
 platform — **kv, files, queue, invoke, secrets, api-keys, dead-letters, async + two-param routes**
 — and then runs a **10-probe security matrix**. Findings: feature/CLI gaps + security verdicts.
 ## Verdict
 **Every feature worked** end-to-end, and **every security control held except one Low-severity
 gap** (reserved-path validation is case-sensitive). Highlights of what's *good*: cross-app
 isolation is airtight, the SSRF guard blocks cloud-metadata, size/op caps fire before authz, and
 internal script errors are scrubbed from responses with a correlation id. Two notable
 **observability/ergonomics gaps** (trigger executions invisible to `pic logs`; the `.trim()`/`.replace()`
 return-`()` footgun) and the expected CLI-coverage gaps round it out.
 ---
 ## The app — "Stash" (built CLI-only, no raw admin curl)
 A pastebin with file attachments and a background word-count worker. 9 scripts, 6 routes, a queue
 consumer trigger, a dead-letter trigger, 2 API keys, 1 secret — all via `pic`.
 | Feature exercised | How | Result |
 |---|---|---|
 | **kv** | paste store, hit counter, `/stats` aggregates, event log | ✅ get/set/list round-trip |
 | **files** | `files::create` from base64 blob + `get`/`head`, two-param download route | ✅ bytes round-trip (`"hello attachment bytes"`, size 22) |
 | **queue** | `queue::enqueue("ingest")` + `create-from-json --kind queue` consumer | ✅ worker fired |
 | **invoke** | worker → `invoke("analyzer", #{text})` function-to-function | ✅ returns word count |
 | **secrets** | `pic secrets set` (stdin) + `secrets::get` to gate `/stats` | ✅ 401 w/o token, 200 with |
 | **async route** | `routes create --dispatch async` for `POST /events` | ✅ **202** + execution_id |
 | **dead-letters** | poison job → 3 attempts → DL row; `pic dead-letters replay` | ✅ captured + replayed (+9 words) |
 | **api-keys** | `pic api-keys mint --scope … [--app …]` | ✅ minted, scopes enforced (below) |
 | **two-param route** | `/pastes/:code/files/:fid` | ✅ both params captured |
 End-to-end stats after the run: `{total_pastes: 2, total_words: 13}` — proving queue → worker →
 invoke → kv all fired on real Postgres rows + on-disk file bytes.
 ---
 ## Security matrix (10 probes, all reproduced live)
 | # | Probe | Verdict | Evidence |
 |---|---|---|---|
 | **S1** | Cross-app isolation | ✅ HOLDS | A script in app `evil` doing `kv…list()` / `secrets::get("admin-token")` / `files…list()` returned `{paste_keys:[], attachment_count:0, stolen_secret:null, my_secret_names:[]}`. `app_id` derives from `cx.app_id`; no SDK call takes a script-passed app_id. |
 | **S2** | Secret confidentiality | ✅ HOLDS | `pic secrets ls` shows names only; the plaintext `sup3r-s3cret-admin` does **not** appear anywhere in the server log even though `/stats` reads it each request. |
 | **S3** | API-key scope + app-binding | ✅ HOLDS | `script:read` key → **403** on `POST /apps` and `GET /admins`, **200** on in-scope `GET /scripts`. `app:admin` key bound to `stash` → **403** on app `evil`. `instance:admin` + `--app` → **422**. Unknown scope `bogus:scope` → rejected by CLI. |
 | **S4** | Sandbox op-budget | ✅ HOLDS | `loop {}` → **HTTP 507 "execution exceeded operation budget"** in **0.30 s**; `/healthz` still `ok` (no hang). |
 | **S5** | Value/size caps | ✅ HOLDS | Oversized kv write rejected (HTTP 502). Notably the detail (`"Length of string too large"`) was **scrubbed from the response** and logged with `correlation_id` — good error hygiene. Caps are checked before authz, so anonymous callers can't DoS. |
 | **S6** | Reserved-path prefixes | ⚠️ **GAP (Low)** | `/api/x`, `/admin/x`, `/healthz`, `/version` → correctly **422**. But case variants `/API/v2/x`, `/Admin/x`, `/HEALTHZ` were **accepted**. See finding below. |
 | **S7** | Files path traversal | ✅ HOLDS | `files::collection("../../../etc")` → `"invalid collection name: must not contain '/', '\\', '..', or NUL"`; a non-UUID file id → not found. No FS escape. |
 | **S8** | docs filter injection | ✅ HOLDS | `docs::find(#{ "x'); DROP TABLE docs;--": 1 })` → ran safely, `count=0`; the `docs` table still exists (`to_regclass` = true). Values/paths are bound as `$N` params. |
 | **S9** | SSRF via `http::` | ✅ HOLDS | `http::get("http://127.0.0.1:8099/healthz")` → `"blocked by SSRF policy: loopback"`; `http://169.254.169.254/…` (cloud metadata) → `"blocked by SSRF policy: link-local"`. |
 | **S10** | Anonymous data-plane access | ℹ️ By design (caveat) | Every Stash route is public (no auth) yet freely uses kv/secrets/files/queue. `script_gate` returns `Ok` when `principal.is_none()` — the *script* is the gate. Correct per design, but a sharp threat-model edge (see note). |
 ### S6 — reserved-path validation is case-sensitive (Low)
 **What:** route-creation rejects the exact reserved prefixes but accepts case variants:
 ```
 pic routes create --path /api/x   -> 422 "path '/api/x' is reserved"
 pic routes create --path /API/v2/x -> Created route … (GET * /API/v2/x)   # accepted
 pic routes create --path /HEALTHZ  -> Created route …                      # accepted
 pic routes create --path /Admin/x  -> Created route …                      # accepted
 ```
 **Current impact — Low, *not* a full bypass:** path matching is case-*sensitive*, so a request to
 the real lowercase `/api/v2/x` still 404s (the system namespace is safe); only the exact
 mixed-case path serves the script (`GET /API/v2/x` → 200, `/HEALTHZ` → 200). Real `/healthz`
 still returns `ok` from the top-level handler.
 **Why it still matters:** (1) inconsistent enforcement of a stated security boundary; (2) lets a
 tenant publish convincing look-alike paths (`/Admin/login`, `/API/v1/…`) for phishing or log
 confusion; (3) **fragile** — method matching is already case-insensitive (`matcher.rs:275`); if
 path matching is ever made case-insensitive too, this instantly becomes a real shadowing bypass
 of `/api/`, `/admin/`, `/healthz`. The validation should be the durable guard.
 **Fix:** normalize case before the reserved check in `orchestrator-core/src/routing/pattern.rs`
 (`check_reserved` ~line 110) — compare `raw.to_ascii_lowercase()` against the reserved list (or
 reject any case-insensitive match).
 ### S10 — anonymous public scripts have full app data-plane access (design caveat)
 Not a bug, but worth surfacing for users: a *public* (unauthenticated) route's script can read/write
 **all** of the app's kv, docs, files, secrets, and queue — the platform only gates *authenticated*
 principals; for anonymous ingress the script itself must enforce access. A developer who assumes
 "this route is public" ≠ "this code can read every secret in my app" could over-expose data. Worth
 a prominent doc callout near the SDK auth model.
 ---
 ## Feature / CLI gaps
 - **G1 — trigger executions are invisible to `pic logs`.** After successful queue-worker and
  analyzer runs, `pic logs <worker>` and `pic logs <analyzer>` were **empty**. Trigger-dispatched
  executions (queue/cron/dead-letter/invoke) don't surface in the per-script log tail — the only
  built-in visibility into worker activity is **dead-letters (failures only)** or the script's own
  side effects. This is a real observability gap for background workloads. *Suggest: include
  trigger executions in the logs surface, or add a `pic logs --trigger`/events view.*
 - **G2 — no `pic kv` / `files` / `queues` / `members` commands.** Data-plane stores are
  script/HTTP-only (no admin CLI to inspect kv/files/queue contents; queues are read-only HTTP).
  App **membership** (`/apps/{id}/members`) also has no CLI — multi-user app roles can't be managed
  with `pic`. *(Confirmed absent via `pic <cmd> --help`.)*
 - **G3 — no per-script sandbox/timeout flags in `pic deploy`/`scripts`.** `timeout_seconds`,
  `memory_limit_mb`, and sandbox overrides are only settable via the raw scripts API or instance
  env (`PICLOUD_SANDBOX_MAX_*`). A developer can't cap a single script's runtime from the CLI.
 - **G4 — uneven trigger wrappers.** Only `kv`, `cron`, `dead-letter` have first-class
  `pic triggers create-*` wrappers; `docs`/`files`/`pubsub`/`queue`/`email` require hand-built
  `create-from-json --kind … --body '{…}'`. Works, but the developer must know each body schema.
 - **G5 — `email::send` unusable in dev.** Returns `"email is not configured: set
  PICLOUD_SMTP_HOST/USER/PASSWORD"`. Expected (no silent drop), but the email feature can't be
  exercised at all without an SMTP relay — worth a documented local-dev fake/sink.
 - **G6 — Rhai `.trim()` returns `()` (in-place mutation footgun).** Same family as `.replace()`
  (already documented). `let t = text.trim()` sets `t` to unit; my analyzer dead-lettered with
  `Function not found: split((), …)` until rewritten to `text.trim();` as a statement. *Suggest:
  extend the existing stdlib footgun note to list `trim`/`to_upper`/`to_lower` etc., not just
  `replace`.*
 ## Things done especially well (no action)
 - Cross-app isolation has no script-controlled `app_id` anywhere — the boundary is structural.
 - SSRF guard covers loopback **and** link-local (cloud-metadata `169.254.169.254`), and blocks at
  every redirect hop.
 - Size/operation caps are enforced **before** authz, so anonymous public scripts can't DoS the DB.
 - Script runtime errors are **scrubbed** from the HTTP response and logged with a `correlation_id`
  — no internal detail leaks to the caller.
 - `deploy`/`apps create` honor `--output json` (the earlier F1 fix), so the whole build scripts
  cleanly with captured ids.
 ## Reproduction / teardown
 Scripts under `/tmp/stash/*.rhai`; apps `stash` + `evil` and their data persist in the dev
 Postgres. Server: `target/debug/picloud` on `:8099` (see Phase 0 env). Teardown: kill the host
 `picloud`; `docker compose down [-v]`. (Note: the S6 probe left harmless `/API/v2/x`, `/HEALTHZ`,
 `/Admin/x`, `/Api/y` routes on `stash` — they vanish with the app.)
 ## Priority
 **S6** is the only code-level finding (Low — confirm-and-harden the reserved-path check). **G1**
 (trigger-execution observability) is the most impactful *developer-experience* gap for anyone
 running background workers. Everything else is documented-behavior or known CLI-coverage gaps.
--- a/E2E_TODO_REPORT.md
+++ b/E2E_TODO_REPORT.md
@@ -1,261 +0,0 @@
 # E2E Developer Test — Rich To-Do App via the `pic` CLI
 **Date:** 2026-06-12 · **Tester:** manual end-to-end walkthrough · **Build:** v1.1.9
 (`product 1.1.9`, `sdk 1.10`, `api 1`, `schema 42`) · **Instance:** host-run `picloud`
 in dev mode on `127.0.0.1:8099`, Postgres via `docker compose up postgres`.
 ## Goal
 Act as a developer building a real product — a multi-user **To-Do app** (end-user
 signup/login, per-user todos in document storage, full HTTP CRUD, a nightly cron cleanup,
 and a realtime activity feed) — **entirely through the `pic` CLI**, and record every place
 the happy path forced me off the CLI or behaved surprisingly.
 ## Verdict
 **The platform can build and run the whole app — every capability exists and works.** The
 data-plane journey (register → login → create → list → complete → ownership-checked delete →
 auth rejection) is correct, `users::*` auth is solid, `docs::*` storage works, durable pubsub
 fans out to an external SSE subscriber, and the cron trigger registers and runs.
 **But a CLI-only developer cannot reach the finish line.** Two control-plane operations have
 **no `pic` command at all** and forced me to drop to raw `curl` against the admin API — and
 without the first one, *every* app created through the CLI serves `404` on every route.
 > ## ✅ RE-TEST 2026-06-12 — ALL GAPS CLOSED (verified live)
 >
 > After remediation (commits `04a24ea`, `ae2134e`, `7ffbb8d`, `b831138`), I rebuilt the **entire
 > app a second time CLI-only, with zero raw `curl` against the admin API** (app `todoapp2`,
 > domain `todos2.local`). Every finding below is now fixed and verified end-to-end. See the
 > [Re-test verification](#re-test-verification--2026-06-12) section at the bottom for the
 > per-finding evidence. The original findings are preserved as-is for the record.
 ---
 ## App as built
 | Surface | Implementation |
 |---|---|
 | `POST /auth/register` | `register.rhai` → `users::create` |
 | `POST /auth/login` | `login.rhai` → `users::login` → session token |
 | `GET /todos` | `todos_list.rhai` → `docs.find({user_id})` |
 | `POST /todos` | `todos_create.rhai` → `docs.create` + `pubsub::publish_durable("activity", …)` |
 | `PATCH /todos/:id` | `todos_update.rhai` → ownership check + complete + publish |
 | `DELETE /todos/:id` | `todos_delete.rhai` → ownership check + delete |
 | cron `0 0 3 * * *` | `cleanup.rhai` → purge completed todos older than 7d |
 | realtime | SSE `GET /realtime/topics/activity` |
 7 scripts, 6 routes, 1 cron trigger, 1 app, 1 domain claim, 1 pubsub topic. Sources in
 `/tmp/todo-app/*.rhai`.
 ---
 ## BLOCKERS — no CLI path; app cannot serve traffic without raw API
 ### B1. No domain-claim command — every CLI-created app 404s until you `curl`
 **Severity: BLOCKER (highest-impact finding).**
 After `pic apps create`, deploying scripts, and binding routes, *every* request 404'd:
 ```
 $ curl -s -X POST localhost:8099/auth/register -d '{...}'
 {"error":"no route matches POST /auth/register"}
 ```
 Reason: Host→app dispatch resolves `localhost` to the **default** app; a non-default app's
 routes are unreachable until the app claims a domain. But `pic apps` exposes only
 `ls / create / show / delete` — **no domain subcommand** — and there is no top-level
 `pic domains` either. The only way through is the raw admin API:
 ```
 curl -X POST localhost:8099/api/v1/admin/apps/$APP/domains \
     -H "authorization: Bearer $TOKEN" -d '{"pattern":"todos.local"}'
 ```
 After that, routing works (with `Host: todos.local`). **A developer who only knows the CLI is
 hard-stuck here** — they have created scripts and routes that silently never match, with no CLI
 affordance explaining why. *Fix: add `pic apps domains {ls,add,rm}` (the API already exists in
 `apps_api.rs`).*
 ### B2. No pubsub topic-registration command — realtime feed needs raw API
 **Severity: BLOCKER for the realtime requirement.**
 Scripts can `pubsub::publish_durable("activity", …)` fine (publishing needs no pre-registration),
 but an **external** SSE subscriber on `/realtime/topics/activity` only receives events once the
 topic is registered as `external_subscribable`. There is no `pic topics` command. Worse, the
 `pic triggers` help text actively points you at `create-from-json` "for kinds the CLI doesn't
 expose … (docs/files/pubsub/…)" — but that creates a *pubsub trigger* (run a script on publish),
 which is a different concept and does **not** register a topic for outside subscribers. Workaround:
 ```
 curl -X POST localhost:8099/api/v1/admin/apps/$APP/topics \
     -H "authorization: Bearer $TOKEN" \
     -d '{"name":"activity","external_subscribable":true,"auth_mode":"public"}'
 ```
 Once registered, the SSE path works perfectly — a subscriber received:
 ```
 data: {"message":{"kind":"created","title":"Realtime test", …},"topic":"activity", …}
 ```
 *Fix: add `pic topics {ls,create,update,rm}` (API exists in `topics_api.rs`).*
 ---
 ## FRICTION — completable via CLI, but sharp edges
 ### F1. `pic deploy` / `apps create` ignore `--output json`
 They print human strings even in JSON mode, so you can't capture the new id:
 ```
 $ pic --output json deploy register.rhai --app todos-e2e
 Created register v1                      # not JSON — no id emitted
 $ pic --output json apps create todos-e2e
 Created app todos-e2e                    # not JSON — no id emitted
 ```
 Every later `routes`/`triggers`/domain/topic call needs that id, so each create forces a
 follow-up `scripts ls --output json | parse` or `apps show`. This breaks naive scripting/CI.
 *Fix: emit the created object as JSON under `--output json`.*
 ### F2. No `pic users` command for app end-users
 The full `/api/v1/admin/apps/{id}/users` surface exists (list, get, reset-password,
 revoke-sessions, invitations) but has no CLI wrapper, so a developer has zero CLI visibility
 into who registered. Listing the two users I created required raw API. *Fix: `pic users …`.*
 ### F3. Password login is interactive-only
 `pic login` offers `--url` and `--token` but **no** `--username`/`--password`. Non-interactive
 (CI) auth means obtaining a bearer out-of-band (raw `POST /auth/login`, or pre-minting an
 `pic api-keys` token — chicken-and-egg if you have no token yet). *Fix: optional
 `--username` + `--password-stdin`.*
 ### F4. No `ctx.request.method` in scripts → one script per verb
 The request map exposes `path, headers, body, params, query, rest` but **not the HTTP method**
 (`engine.rs` builds the map without it). A script therefore cannot branch GET vs POST on the
 same path, forcing a separate script + method-scoped route per verb. My app needed **7 scripts
 where ~3 would do** (`/todos` GET+POST and `/todos/:id` PATCH+DELETE each had to split).
 *Fix: add `ctx.request.method`.*
 ---
 ## SDK / SCRIPTING SHARP EDGES — platform correct, but the natural code fails at runtime
 ### S1. `users::find_by_email` is forbidden for anonymous (public) callers
 The obvious registration pattern — "look up email, 409 if taken, else create" — fails:
 ```
 {"error":"Runtime error: users: forbidden"}   # HTTP 502
 ```
 `find_by_email` deliberately requires an authenticated principal (anti-enumeration, audit
 finding F-S-003 in `users_service.rs`), while `users::create` is allowed for anonymous public
 scripts. So a self-serve register script **must skip the pre-check** and rely on `create`'s
 uniqueness error instead. The SDK doc-comment for `find_by_email` shows it with no caveat, so
 this only surfaces as a runtime 502. *Fix: document the principal requirement on
 `find_by_email`; consider a dedicated `users::email_available()` that's safe for anonymous use.*
 ### S2. Response envelope is `statusCode`-gated (silent double-nesting)
 A returned map is unwrapped as `{statusCode, headers, body}` **only if it contains
 `statusCode`**. Without it, the *entire* map becomes the literal body — so `#{ body: #{token} }`
 returns `{"body":{"token":…}}`, not `{"token":…}`. I hit this on login/list/update until I added
 `statusCode: 200`. The doc-comment examples don't flag it. *Fix: doc note, or treat a lone
 `body` key as an envelope.*
 ### S3. Rhai `String.replace()` mutates in place and returns `()`
 `let token = auth.replace("Bearer ", "")` sets `token` to unit, then `users::verify(())` →
 `Function not found: users::verify (())`. Stock Rhai semantics, but a JS/Python dev will hit it;
 `auth.sub_string(7)` after `starts_with("Bearer ")` is the correct idiom. *Fix: a one-line note
 + a bearer-parsing example in the stdlib reference.*
 ---
 ## ONBOARDING
 ### O1. Dev mode needs a second, undocumented acknowledgement var
 `PICLOUD_DEV_MODE=true` alone aborts at startup:
 ```
 Error: PICLOUD_DEV_MODE=true without PICLOUD_SECRET_KEY requires an explicit acknowledgement.
 Set PICLOUD_DEV_INSECURE_KEY=i-understand-this-is-insecure to confirm …
 ```
 CLAUDE.md and the dev notes mention only `PICLOUD_DEV_MODE=true`. Good security default, but the
 error message is the sole documentation. *Fix: document `PICLOUD_DEV_INSECURE_KEY` next to
 `PICLOUD_DEV_MODE`.*
 ---
 ## What worked well (no changes needed)
 - End-to-end data plane fully correct: register, login, per-user list, create, complete, delete,
  **ownership 403** (Bob can't touch Alice's todo), **401** on missing/garbage token.
 - `users::*`: login returns a 43-char session token, `verify` resolves it (sliding TTL),
  password hashing + email uniqueness enforced.
 - `docs::collection(...).find({field})` filtered correctly; full-blob `update` semantics as
  documented.
 - `pubsub::publish_durable` → external SSE delivery worked once the topic was registered.
 - Cron trigger registered; `pic invoke <cleanup-id>` ran it → `{"removed":0}`.
 - `pic deploy` **updates in place** (v1→v2, same id) — no duplicate scripts on redeploy.
 - `pic routes match` resolved param routes and captured `param.id`; empty param segment
  (`/todos/`) correctly did **not** match.
 - `pic logs <id>` listed executions with success/error status.
 ## Reproduction
 Server: `docker compose up -d postgres`; then host-run with
 `PICLOUD_DEV_MODE=true PICLOUD_DEV_INSECURE_KEY=i-understand-this-is-insecure
 PICLOUD_BIND=127.0.0.1:8099 PICLOUD_ADMIN_USERNAME=admin PICLOUD_ADMIN_PASSWORD=admin
 target/debug/picloud`. CLI: `cargo build -p picloud-cli` → `target/debug/pic`. App scripts:
 `/tmp/todo-app/*.rhai`. Every command + captured output above was run live against this instance.
 ## Priority recommendation
 The two CLI gaps that turn "I built an app" into "…but it 404s and has no realtime" are **B1
 (domain claims)** and **B2 (topic registration)**. Both already have working admin APIs; they
 just need thin `pic` wrappers (mirroring the existing `routes`/`triggers` commands). Ship those
 two and a CLI-only developer can build this entire app without ever touching `curl`.
 ---
 # Re-test verification — 2026-06-12
 Second pass after the fix commits (`04a24ea` CLI gaps, `ae2134e` `ctx.request.method`,
 `7ffbb8d` `users::email_available`, `b831138` docs). I rebuilt the whole app as a **fresh,
 CLI-only** flow against the same live instance — new app `todoapp2`, domain `todos2.local`,
 **no raw `curl` to any `/api/v1/admin/*` endpoint**. Data-plane HTTP calls (the app's own
 traffic) still use curl, as a real end-user client would.
 ## Status table
 | # | Finding | Status | Evidence |
 |---|---------|--------|----------|
 | B1 | No domain-claim command | ✅ Fixed | `pic apps domains add todoapp2 todos2.local` → claim created; routes then match. Help text even explains the 404-without-claim trap. |
 | B2 | No pubsub topic command | ✅ Fixed | `pic topics create --app todoapp2 activity --external` → `external_subscribable:true`; SSE subscriber received the published event. |
 | F1 | `deploy`/`apps create` ignore `--output json` | ✅ Fixed | Both now emit the full JSON object; I captured every script id straight from `deploy --output json` (no follow-up `scripts ls`). |
 | F2 | No `pic users` command | ✅ Fixed | `pic users ls/show/reset-password` all work; listed Carol+Dave, showed Carol, minted a 1-shot reset token. |
 | F3 | Password login interactive-only | ✅ Fixed | `printf 'admin' \| pic login --username admin --password-stdin` logged in non-interactively. |
 | F4 | No `ctx.request.method` | ✅ Fixed | One `todos.rhai` now serves **GET+POST** and one `todo_item.rhai` serves **PATCH+DELETE** by branching on `ctx.request.method`; unsupported verb returns my `405`. Script count dropped 7→5, routes 6→4. |
 | S1 | `find_by_email` forbidden for anon registration | ✅ Fixed | New `users::email_available(email)` → bool works from the anonymous register route; duplicate email now returns a clean `409`, no more `users: forbidden`/502. |
 | S2 | `statusCode`-gated envelope (double-nest) | ✅ Documented | Behaviour noted in stdlib docs (`b831138`); my scripts use explicit `statusCode` and responses are flat. |
 | S3 | Rhai `replace()` returns `()` footgun | ✅ Documented | Bearer-parsing note added; `auth.sub_string(7)` after `starts_with` is the idiom used. |
 | O1 | Dev-mode needs undocumented ack var | ✅ Documented | `PICLOUD_DEV_INSECURE_KEY` now documented alongside `PICLOUD_DEV_MODE`. |
 ## CLI-only build transcript (abridged, all succeeded)
 ```
 pic login --username admin --password-stdin           # F3
 pic apps create todoapp2 --output json                # F1 → captured id
 pic apps domains add todoapp2 todos2.local            # B1
 pic deploy <f>.rhai --app todoapp2 --output json      # F1 → captured 5 script ids
 pic routes create --script <id> --path /todos         # ANY-method route (F4 in-script branch)
 pic routes create --script <id> --path /todos/:id --path-kind param
 pic topics create --app todoapp2 activity --external  # B2
 pic triggers create-cron --app todoapp2 --script <cleanup> --schedule "0 0 3 * * *"
 pic users ls --app todoapp2                           # F2
 ```
 ## Data-plane journey (all green)
 ```
 register carol/dave                       201 / 201
 duplicate carol (email_available, S1)     409  {"error":"email already registered"}
 login carol/dave                          43-char tokens
 POST /todos  (method-branch create, F4)   201 ×2
 GET  /todos  (same script, list, F4)      200  count:2
 PATCH /todos/:id complete                 200
 dave PATCH/DELETE carol's todo            403 / 403  (ownership)
 carol DELETE                              200
 PUT /todos (unsupported verb)             405  (in-script method guard)
 no-auth GET /todos                        401
 realtime SSE on activity                  received {"kind":"created",...,"topic":"activity"}
 ```
 **Conclusion: a CLI-only developer can now build this entire app — auth, storage, CRUD,
 ownership, cron, and a realtime feed — without ever touching `curl` against the admin API.**
--- a/HANDBACK.md
+++ b/HANDBACK.md
@@ -1,460 +1,330 @@
-# v1.1.9 — HANDBACK
+# v1.1.7 — Configuration & Email — HANDBACK
-Branch: `feat/v1.1.9-queues-invoke` (cut from `main` at `b9e002a`).
+**Branch:** `feat/v1.1.7-secrets-email` (9 commits off `main`, not pushed)
-Workspace: `picloud@1.1.9`. Dashboard: `0.15.0`. SDK schema: `1.10`.
+**Status:** ready for review. NOT merged, NOT pushed, no PR opened.
-**Pure additive — no upgrade-order constraint.**
+
 ```
 a7d3dad chore(v1.1.7): re-bless schema snapshot for secrets + email migrations
 2ea47eb chore(v1.1.7): fix clippy --all-targets warnings
 b355851 chore(v1.1.7): version bumps + CHANGELOG
 fffcdf6 feat(v1.1.7-realtime-migration): encrypt signing keys at rest
 02335a8 fix(v1.1.7-dead-letter): wire dispatcher → list_matching_dead_letter
 1f78937 feat(v1.1.7-email-inbound): webhook receiver + email:receive trigger
 8f2d2bc feat(v1.1.7-email-outbound): SMTP send/send_html
 2d11090 feat(v1.1.7-secrets): secrets SDK + table + admin API + dashboard
 dc2e4fa feat(v1.1.7-crypto): master-key infra + encryption helpers
 ```
 ---
 ## 1. Scope coverage
-| Brief item | Status | Where |
+| Item | Status |
-|---|---|---|
+|---|---|
-| `queue::*` SDK (`enqueue` / `depth` / `depth_pending`) | ✅ | `crates/executor-core/src/sdk/queue.rs`, `crates/shared/src/queue.rs`, `crates/manager-core/src/queue_service.rs` |
+| Encryption infrastructure (master key + AES-256-GCM envelope) | **Done** |
-| `queue:receive` trigger kind | ✅ | `TriggerKind::Queue`, `TriggerDetails::Queue`, `queue_trigger_details` |
+| `secrets::*` SDK + `0023_secrets.sql` + admin API + dashboard tab | **Done** |
-| One-consumer-per-queue enforcement | ✅ (API-layer via `pg_advisory_xact_lock`) | `crates/manager-core/src/trigger_repo.rs::create_queue_trigger` |
+| Outbound email `email::send` / `email::send_html` (lettre SMTP) | **Done** |
-| Dispatcher queue arm (FOR UPDATE SKIP LOCKED) | ✅ | `crates/manager-core/src/dispatcher.rs::tick_queue_arm` + `dispatch_one_queue` |
+| Inbound email webhook receiver + `email:receive` trigger + `0024` | **Done** (full scope, per user decision) |
-| Visibility-timeout reclaim task | ✅ | `crates/manager-core/src/dispatcher.rs::spawn` reclaim block + `QueueRepo::reclaim_visibility_timeouts` |
+| Dispatcher routing for email | **Done** |
-| Auto-ack / auto-nack / dead-letter | ✅ | `QueueRepo::ack` / `nack` / `dead_letter` + `handle_queue_failure` |
+| dead_letter handler wiring fix | **Done** |
-| Dead-letter fan-out for queue | ✅ (free — existing `fan_out_dead_letter` reads `source = "queue"`) | `dispatcher.rs::handle_failure` already wired |
+| Realtime signing-key encryption (two-phase) + `0025` | **Done** |
-| `invoke()` (sync) | ✅ | `crates/executor-core/src/sdk/invoke.rs` |
+| Dashboard (Secrets tab, email trigger form, `npm run check`) | **Done** |
-| `invoke_async()` + `OutboxSourceKind::Invoke` arm | ✅ | `sdk/invoke.rs::invoke_async` + `dispatcher::build_invoke_request` |
+| Version bumps (1.1.7 / SDK 1.8 / dashboard 0.13.0) + CHANGELOG | **Done** |
-| Cross-app invoke rejected | ✅ | `InvokeService::resolve` → `InvokeError::CrossApp` |
+| Tests (match v1.1.5/v1.1.6 density) | **Done** |
 | Depth bound shared with trigger fan-out | ✅ | `Limits::trigger_depth_max`, synced from `TriggerConfig::max_trigger_depth` |
 | `retry::*` SDK (Policy + run + on_codes) | ✅ (with `retry::run` rename — see §7) | `crates/executor-core/src/sdk/retry.rs` |
 | Migrations 0034 + 0035 | ✅ | as named |
 | Admin HTTP — `/triggers/queue` + `/queues` + `/queues/{name}` | ✅ | `crates/manager-core/src/triggers_api.rs` + `queues_api.rs` |
 | Dashboard Queues tab + Triggers form + 0.15.0 | ✅ | `dashboard/src/routes/apps/[slug]/queues/*` + extended `+page.svelte` + `package.json` |
 | Schema snapshot re-blessed | ✅ | `crates/manager-core/tests/expected_schema.txt` |
 | CHANGELOG | ✅ | this branch |
 | Version bumps (1.1.8 → 1.1.9, SDK 1.9 → 1.10) | ✅ | `Cargo.toml`, `crates/shared/src/version.rs` |
 | F1 — integration test density | ✅ | 4 new test binaries: queue_e2e (4) + invoke_e2e (4) + retry_e2e (3) + migration_queue_messages (4) + 50+ inline unit tests |
 | F2 — schema snapshot BLESS=1 in same branch | ✅ | committed |
 | F3 — literal fmt/clippy output | ✅ | §8 |
 | F4 — TIMING_FLAT_DUMMY_HASH dedup | ✅ | `crates/manager-core/src/auth_api.rs::login` references `crate::auth::TIMING_FLAT_DUMMY_HASH` |
 | F5 — clippy without cold cache | ✅ | incremental cache used |
-## 2. Queue dispatcher design notes
+Nothing deferred from scope-in. Inbound email (the deferrable-if-scope-
 blew-up piece) was implemented in full.
-**The queue table IS the outbox for queue semantics.** No
+---
 double-buffering through `outbox.source_kind = 'queue'`. The
 dispatcher's `tick_queue_arm` lists active consumers
 (`triggers.list_active_queue_consumers()` — joins `triggers` +
 `queue_trigger_details` for enabled `kind = 'queue'` rows) and runs
 one atomic claim per `(app_id, queue_name)` per tick.
-Claim shape (single round trip):
+## 2. Encryption infrastructure notes
-```sql
+- **Module:** `crates/shared/src/crypto.rs` (`picloud_shared::crypto`).
-UPDATE queue_messages
+- **Master-key sourcing** (`MasterKey::from_env` → `resolve`):
-SET claim_token = $3, claimed_at = NOW(), attempt = attempt + 1
+  - `PICLOUD_SECRET_KEY` = base64 of exactly 32 bytes. Missing →
-WHERE id = (
+    `MasterKeyError::Missing` (fatal); non-base64 → `Malformed`; wrong
-    SELECT id FROM queue_messages
+    length → `WrongLength`. **Sourced in `main.rs::run_server` before any
-    WHERE app_id = $1 AND queue_name = $2
+    DB work** — `build_app` takes the `MasterKey` as a parameter (so
-      AND claim_token IS NULL
+    tests pass a fixed key and don't mutate process env).
-      AND (deliver_after IS NULL OR deliver_after <= NOW())
+  - Dev fallback: deterministic key (`SHA-256("picloud-dev-master-key-v1.1.7")`)
-    ORDER BY enqueued_at
+    used ONLY when `PICLOUD_SECRET_KEY` is unset **AND**
-    FOR UPDATE SKIP LOCKED
+    `PICLOUD_DEV_MODE=true`, with a prominent `warn!`. No quiet
-    LIMIT 1
+    unencrypted mode.
-)
+- **aes-gcm version:** `0.10` (features `aes`, `alloc`). `Aes256Gcm`.
-RETURNING id, app_id, queue_name, payload, enqueued_at, attempt, max_attempts
+- **Nonce generation:** 12 bytes from `rand::thread_rng().fill_bytes`
-```
+  (OS-CSPRNG-seeded), per-encryption.
 - **Storage layout:** ciphertext **with the 16-byte GCM auth tag
  appended** (RustCrypto `Aead`-trait layout — `encrypt` returns
  `ciphertext || tag`, `decrypt` consumes the same). The 12-byte nonce is
  stored in a separate column. `MasterKey`'s `Debug` is redacted.
 - **Plaintext cap (secrets):** 64 KB default, enforced in
  `secrets_service::seal` (the SDK boundary) → `SecretsError::TooLarge`
  with limit + actual size. Override: `PICLOUD_SECRET_MAX_VALUE_BYTES`.
 - **Key rotation:** out of scope. Documented in CHANGELOG + the module
  docs that changing `PICLOUD_SECRET_KEY` orphans all ciphertext.
-`SKIP LOCKED` keeps concurrent dispatchers (cluster mode v1.3+) safe.
+---
 The `claim_token` (fresh `Uuid::new_v4()` per claim) is the lease
 guarantee: ack and nack both filter `WHERE id = $1 AND claim_token =
 $2`, so a stale dispatcher whose visibility-timeout expired can't
 accidentally delete or re-defer a message that's been re-claimed.
-**Ack** (handler returned successfully):
+## 3. Secrets notes
 `DELETE FROM queue_messages WHERE id = $1 AND claim_token = $2`.
-**Nack** (handler threw, `attempt < max_attempts`):
+- `SecretsService` (trait, `picloud-shared`) → `SecretsServiceImpl` +
-`UPDATE … SET claim_token = NULL, claimed_at = NULL, deliver_after =
+  `PostgresSecretsRepo` (`manager-core`) → Rhai bridge
-NOW() + retry_delay`. Backoff delay computed via the existing
+  (`executor-core/src/sdk/secrets.rs`). Collection-less; `app_id` from
-`compute_backoff(attempt, backoff_shape, base_ms, jitter_pct)` —
+  `cx.app_id`.
-shared with the outbox arm so retry behavior is identical across
+- **JSON round-trip:** `set` serializes the value to JSON bytes, caps,
-trigger kinds.
+  encrypts; `get` decrypts + deserializes — a String returns a String
  (not a JSON-quoted `"\"…\""`). Verified by unit + bridge tests.
 - **No ServiceEvent emission** (secret writes don't fire triggers).
 - Admin API: `GET/POST/DELETE /api/v1/admin/apps/{id}/secrets`; list
  returns names + `updated_at` only.
 - Authz: `Capability::AppSecretsRead/Write` → `script:read`/`script:write`.
  No new Scope variants (seven-scope commitment held).
-**Dead-letter** (handler threw, `attempt >= max_attempts`): single
+---
 transaction — `INSERT INTO dead_letters` with `source = "queue"`,
 `op = "receive"`, the original payload wrapped in a shape mirroring
 `TriggerEvent::Queue` (so the existing `fan_out_dead_letter` path on
 the outbox arm can fire registered `dead_letter` triggers off the new
 row without any special-casing), then `DELETE FROM queue_messages`.
-**Visibility-timeout reclaim**: separate `tokio::spawn` task, ticks
+## 4. Email implementation notes
 every `PICLOUD_QUEUE_RECLAIM_INTERVAL_MS` (default 30 000 ms). UPDATE
 joins `queue_messages` + `triggers` + `queue_trigger_details` and
 clears claims older than the per-queue `visibility_timeout_secs`. A
 crashed consumer thus loses its lease and the message becomes
 claimable again. **Verified** by `queue_e2e::queue_visibility_timeout_reclaim`
 (inserts a row with `claimed_at = NOW() - 60s`, `visibility_timeout =
 5s`; polls until either the dispatcher re-claims or the claim
 clears).
-## 3. `invoke()` re-entrancy notes
+- **SMTP transport:** `lettre 0.11` (`smtp-transport`,
  `tokio1-rustls-tls`, `builder`, `hostname`). **Connection model:** one
  connection per call (lettre default); pooling deferred to v1.2. The
  transport sits behind an internal `EmailTransport` trait so the service
  is unit-tested with a recording fake (no live SMTP).
 - **Disabled mode:** if HOST/USER/PASSWORD aren't all set,
  `EmailServiceImpl::from_env` builds no transport and every `send`
  returns `NotConfigured` (warned at startup). A malformed relay
  descriptor is also logged and yields disabled mode (email is
  non-critical; never blocks startup).
 - **Address validation:** hand-rolled RFC 5322-ish pre-check (single `@`,
  non-empty local part, domain contains a dot, ≤320 bytes) followed by a
  `lettre::Mailbox` parse (the authoritative validator). No deliverability
  check.
 - **Size cap:** 25 MB on `message.formatted()`,
  `PICLOUD_EMAIL_MAX_MESSAGE_BYTES`.
 - `email::send` forces text-only (ignores any `html`); `email::send_html`
  requires `html` and builds `MultiPart::alternative_plain_html`.
  `reply_to` defaults to `from`. `to`/`cc`/`bcc` accept a String or an
  Array of Strings.
 - **Inbound normalization:** only the generic provider-agnostic JSON
  shape `{from,to[],cc[],subject,text,html,message_id}` is accepted in
  v1.1.7 — `from` required, rest default. Provider-specific unmarshallers
  → v1.2. The expected shape is documented on the dashboard email-trigger
  form.
-**Engine sharing** via `Engine::self_weak: OnceLock<Weak<Engine>>`.
+---
 The picloud binary:
-```rust
+## 5. Dead-letter handler fix notes
 let engine = Arc::new(Engine::new(engine_limits, services));
 engine.set_self_weak(Arc::downgrade(&engine));
 ```
-`Engine::execute_ast` reads `self.self_arc()` (which upgrades the
+- **Call site:** `dispatcher::handle_failure`, the retry-exhaustion
-`Weak`) and threads `Option<Arc<Engine>>` through
+  branch. After `DeadLetterRepo::insert` (which returns the new
-`sdk::register_all(...)` to the invoke bridge.
+  `DeadLetterId`), a new helper `fan_out_dead_letter` runs.
 - **What it does:** calls `TriggerRepo::list_matching_dead_letter(app_id,
  source, row.trigger_id, Some(resolved.script_id))` (the method that had
  no production caller) and inserts one outbox row per match
  (`source_kind = DeadLetter`, the DL trigger's id + handler script id,
  `trigger_depth + 1`, `origin_principal = the DL trigger's registered
  principal`).
 - **Payload — built from the REAL `TriggerEvent::DeadLetter` variant**,
  not the brief's §6 field list (see §7 deviations): `{ dead_letter_id,
  original: Box::new(decoded row payload), attempts, last_error,
  trigger_id, script_id, first_attempt_at, last_attempt_at }`. If the
  outbox payload can't be decoded back into a `TriggerEvent` (so the
  nested `original` can't be built), the fan-out is skipped — the
  dead-letter row is still durably written.
 - **Recursion-stop:** unchanged. The `is_dead_letter_handler`
  short-circuit at the top of `handle_failure` returns before the
  exhaustion branch, so a DL handler's own failure is never re-dead-
  lettered. No new guard needed.
 - **Tests verify the handler actually fires**
  (`crates/picloud/tests/dispatcher_e2e.rs`, DB-gated):
  `dispatcher_delivers_dead_letter_to_handler` now asserts BOTH row-create
  AND handler-fire (inline doc updated);
  `dispatcher_delivers_dead_letter_to_handler_actually_fires` asserts the
  nested `original` KV event + `last_error`;
  `dead_letter_source_filter_excludes_nonmatching` exercises the source
  filter dimension; `dead_letter_handler_failure_does_not_recurse` proves
  the recursion-stop (count stays at 1).
-**`Weak` is the right choice** — strong would make the Engine Arc
+---
 cycle itself, leaking on drop. Cycle stays broken; the invoke bridge
 just gets `None` if the engine has been dropped (which only happens
 on shutdown).
-**Re-entry path** (inside `invoke.rs::invoke_blocking`):
+## 6. Realtime signing-key migration notes
-1. Resolve via `InvokeService::resolve(&cx, target)` — service-layer
+- **Two-phase**, as recommended. `0025_encrypt_realtime_keys.sql` adds
-   cross-app check returns `InvokeError::CrossApp` if `resolved.app_id
+  NULL-able `realtime_signing_key_encrypted` + `realtime_signing_key_nonce`
-   != cx.app_id`.
+  and `DROP NOT NULL` on the plaintext column (so new keys can be stored
-2. Depth check **before** resolve — `cx.trigger_depth + 1 >
+  encrypted-only).
-   limits.trigger_depth_max` throws immediately (no wasted DB
+- **Repo:** `PostgresAppSecretsRepo` now holds the `MasterKey`. New keys
-   round-trip).
+  are written encrypted-only; the read path (`signing_key` /
-3. Build a fresh `ExecRequest` carrying:
+  `get_or_create_signing_key`) prefers the encrypted columns and falls
-   - new `execution_id`
+  back to plaintext during the compat window (pure `decode_signing_key`
-   - `root_execution_id` inherited from caller's `cx.root_execution_id`
+  helper, unit-tested for all four precedence states).
-   - `trigger_depth = cx.trigger_depth + 1`
+- **Startup task:** `migrate_plaintext_keys()` runs once in `build_app`
-   - `request_id` inherited (same logical request)
+  (after the master key is loaded), encrypting any rows that still have
-   - principal inherited (same-app invoke is a function call, not a
+  plaintext but no encrypted value. Plaintext is **left in place** for
-     re-auth boundary)
+  rollback safety. Idempotent.
-   - `body = args_json`
+- **Plaintext column drop:** deferred to **v1.1.8** (documented in
-4. Call `self_engine.execute(&resolved.source, req)` — synchronous,
+  CHANGELOG + the migration). Operators must upgrade through v1.1.7
-   on the SAME `spawn_blocking` thread. No nested `spawn_blocking`
+  (which performs the encryption) before v1.1.8.
-   (would deadlock the blocking pool under load) and no gate
+- SSE keeps working: `RealtimeAuthorityImpl` is unchanged (it calls
-   re-admission (the outer execution already holds a permit).
+  `signing_key`). Verified by the pubsub e2e + unit tests; the dev DB
-5. Return `json_to_dynamic(resp.body)` — the callee's response body
+  applied 0025 + the startup encryption cleanly during the test run.
   becomes the caller's invoke return value. Status code + headers
   are dropped (the function-call mental model is "return value", not
   "HTTP response").
-**Cross-app rejection point**: verified at three layers — repo
+---
 returns the script row, service compares `resolved.app_id` to
 `cx.app_id`, and the dispatcher's `build_invoke_request` re-checks
 when firing an `invoke_async` outbox row (defense in depth — the
 service already enforced same-app at enqueue time, but a hand-edited
 row should still be rejected).
 **Depth-bound** integration tested by `invoke_e2e::invoke_depth_limit_exceeds_cleanly`
 — recursive script propagates the throw all the way up; outer
 caller's `try/catch` surfaces "invoke: depth limit exceeded (max 8)".
 ## 4. `retry::*` notes
 **Closure passing** via Rhai's `FnPtr`. `retry::run(policy, fn_ptr)`
 is registered with `NativeCallContext` so the bridge can call
 `fn_ptr.call_within_context(ctx, ())` in a loop. The closure shares
 the caller's engine + cx — if the closure itself calls `invoke()`,
 the inner call goes through the invoke bridge (fresh cx with
 `trigger_depth + 1`), retry doesn't see or interfere with that.
 **Sleep mechanics**: `tokio::time::sleep(delay)` via
 `TokioHandle::block_on`. We're already inside the caller's
 `spawn_blocking` thread, so blocking the thread on a tokio sleep is
 fine — the runtime's worker pool isn't being held.
 **Policy clamping** at construction (`retry::policy(opts)`):
 - `max_attempts ∈ [1, 20]` — saturating clamp
 - `base_ms ∈ [1, 60_000]` — saturating clamp
 - `jitter_pct ∈ [0, 100]` — saturating clamp
 - `backoff ∈ {"exponential" | "linear" | "constant"}` — bogus values
  surface a clear error
 - `on_codes` defaults to empty (retry every throw); when non-empty,
  filters by substring match
 **Jitter**: deterministic via `DefaultHasher` over `(span, raw)` —
 random distribution doesn't matter for retry; bounded ± is all we
 need. Avoids pulling `rand` into the hot path.
 ## 5. Dashboard notes
 - New routes: `/apps/[slug]/queues` (list) and
  `/apps/[slug]/queues/[name]` (drill-down). Both use Svelte 5 runes
  (`$state`, `$derived`, `$effect`) — matches the existing app
  detail page's idioms.
 - Triggers tab gains a "Queue:receive trigger (v1.1.9)" form below the
  Email form. Same `submitCreate*` pattern as the other forms; clears
  state on success and re-loads the trigger list.
 - App-level nav gains a "Queues" link between Files and Dead letters,
  guarded by `canAdmin` (same gate as the other operational tabs).
 - TypeScript types: `TriggerKind` admits `'queue'`, `TriggerDetails`
  union admits the `{ kind: 'queue', queue_name, visibility_timeout_secs,
  last_fired_at }` shape. `CreateQueueTriggerInput`, `QueueSummary`,
  `QueueConsumer`, `QueueDetail` exported alongside.
 - `npm run check`: my changes typecheck clean. (The 149 pre-existing
  errors are all in `tests/e2e/**/*.spec.ts` about `@playwright/test`
  not being installed — unchanged from main.)
 - `dashboard/package.json` bumped to `0.15.0`.
 ## 6. F1–F5 implementation notes
 **F1 — integration test density.** Four new DB-gated test binaries
 (all skip cleanly when `DATABASE_URL` is unset, mirroring the
 existing `dispatcher_e2e.rs` pattern):
 - `crates/picloud/tests/queue_e2e.rs` (4 tests, 33s runtime):
  - `queue_receive_acks_on_success`
  - `queue_receive_dead_letters_after_max_attempts`
  - `queue_one_consumer_per_queue_rejected`
  - `queue_visibility_timeout_reclaim`
 - `crates/picloud/tests/invoke_e2e.rs` (4 tests, 2s):
  - `invoke_by_name_same_app_returns_value`
  - `invoke_cross_app_rejects`
  - `invoke_depth_limit_exceeds_cleanly`
  - `invoke_async_enqueues_outbox_row`
 - `crates/picloud/tests/retry_e2e.rs` (3 tests, 2.5s):
  - `retry_run_eventually_succeeds_inside_http_handler`
  - `retry_run_surfaces_last_error_after_max_attempts`
  - `retry_on_codes_filters_unmatched_errors`
 - `crates/manager-core/tests/migration_queue_messages.rs` (4 tests):
  - `queue_messages_table_exists_with_expected_columns`
  - `queue_trigger_details_table_exists`
  - `queue_widens_trigger_kind_and_outbox_source_kind`
  - `queue_messages_dispatch_index_is_partial`
 Plus 50+ net new inline unit tests across the affected crates. All
 pass against the docker-compose postgres on `localhost:15432`. See
 §8 for the literal `cargo test` output.
 **F2 — schema snapshot `BLESS=1` part of the gate.** Re-blessed via:
 ```sh
 DATABASE_URL=postgres://picloud:picloud@localhost:15432/picloud \
 PICLOUD_ADMIN_USERNAME=dev PICLOUD_ADMIN_PASSWORD=dev \
 BLESS=1 cargo test -p picloud-manager-core --test schema_snapshot \
  -- --include-ignored
 ```
 Delta committed in `chore(v1.1.9): re-bless schema snapshot (0034 + 0035 delta)`.
 Matches the plan exactly: two new tables, three new partial indexes,
 widened `triggers.kind` + `outbox.source_kind` CHECKs, no unrelated
 drift.
 **F3 — fmt + clippy attestation as literal output.** See §8.
 **F4 — `TIMING_FLAT_DUMMY_HASH` dedup.** `crates/manager-core/src/auth_api.rs::login`
 now reads `crate::auth::TIMING_FLAT_DUMMY_HASH.to_string()` on the
 bad-email branch. Verification:
 ```sh
 $ grep -rn 'argon2id\$v=19\$m=19456,t=2,p=1\$dGltaW5n' crates/
 crates/manager-core/src/auth.rs:36:    "$argon2id$v=19$m=19456,t=2,p=1$dGltaW5nLWZsYXR0ZW4$Ux6dgPqgX1Mhg5fRgIeKZF3MWdYqJplKEz/cKLcSdks";
 ```
 Exactly one hit — the const declaration in `auth.rs`.
 **F5 — clippy cold-cache environmental constraint.** Used the
 incremental cache (no `cargo clean`). Verified by checking the
 `Checking <crate>` lines for test crates appear in the clippy output.
 CI will do the cold-cache attestation on its dedicated runner.
 ## 7. Decisions beyond the brief / deviations flagged
-**D1 — `retry::with` → `retry::run` (script-side name).** The brief
+1. **`inbound_secret` stored ENCRYPTED (user-approved deviation).** The
-specified `retry::with(policy, closure)`. Both `with` AND `call` are
+   brief defaulted to a plaintext `inbound_secret` column on
-Rhai reserved keywords — rejected at the parser, before any
+   `email_trigger_details`; the user chose to encrypt it via the master
-registration would matter (`'with' is a reserved keyword (line N, position M)`).
+   key. Implemented: `0024` stores `inbound_secret_encrypted` +
-Shipped as `retry::run(policy, closure)`. Documented in the docstring,
+   `inbound_secret_nonce`; the admin endpoint seals the secret (as a JSON
-the SDK_VERSION 1.10 changelog comment, and the dashboard form copy.
+   string, via the secrets `seal` helper); the receiver `open`s it per
   inbound POST to verify the HMAC. **Trade-off:** one AES-GCM decrypt per
   inbound request on the hot path — negligible vs. the HMAC + DB
   round-trip already there. The decrypted secret is never logged.
-**D2 — Trait move skipped (was plan §5).** The plan called for moving
+2. **Brief-internal contradiction flagged, not reinterpreted — §6
-`ExecutorClient` + `ScriptIdentity` from `orchestrator-core` to
+   `TriggerEvent::DeadLetter` field names.** The brief's §6 sketches the
-`shared` so the invoke bridge could call a re-entrant variant.
+   payload as `{source, op, original_event_id, original_payload,
-Reconsidered during commit 7: the bridge lives in `executor-core`
+   attempt_count, last_error, …}`. The actual variant
-where `Engine` is in scope; `Engine::execute(&source, req)` is sync,
+   (`crates/shared/src/trigger_event.rs`) is `{dead_letter_id, original:
-returns `ExecResponse`, and shares the engine instance + per-call
+   Box<TriggerEvent>, attempts, last_error, trigger_id, script_id,
-`SdkCallCx` exactly as required. AST cache reuse across invokes is
+   first_attempt_at, last_attempt_at}`. I built the payload from the
-the only thing we lose (invokes recompile each call — ms-scale cost,
+   **real** variant (which the brief itself instructs to "verify
-deferred as a v1.2 optimization). Saved a non-trivial signature
+   serializes correctly"). No type change needed.
 change with downstream callers in `LocalExecutorClient`.
-**D3 — Retry columns on parent triggers row only (was plan §1).** The
+3. **`build_app` signature gained a `MasterKey` parameter.** Rather than
-brief says `queue_trigger_details` "gets the same five retry override
+   sourcing the key inside `build_app` (which would force every e2e test
-columns as the parent `triggers` table". The parent already has
+   to set process env), `main.rs` sources it and passes it in. The 3
-`retry_max_attempts`, `retry_backoff`, `retry_base_ms` (verified at
+   existing `build_app` test callers pass a fixed test key.
 `dispatcher.rs:246-249`). Duplicating them on the detail row would
 split the source of truth. Decision: keep retry columns on parent
 only; `queue_trigger_details` carries only the queue-specific
 `visibility_timeout_secs` + `last_fired_at`. Surfaced here per
 discipline reminder #2 ("flag, don't reinterpret").
-**D4 — Trigger-depth bound mirrored on `Limits` (was plan §5).** The
+4. **Pre-existing clippy warnings fixed (see §10).** Four warnings predate
-brief endorsed "use the trigger-depth counter as the invoke-depth
+   this work; I fixed them in a dedicated commit so the `-D warnings`
-bound" but didn't say where the cap lives. Added
+   gate is green, and flag them as a latent finding.
 `Limits::trigger_depth_max: u32` (default 8) and synced from
 `TriggerConfig::from_env().max_trigger_depth` in the picloud binary,
 so `PICLOUD_MAX_TRIGGER_DEPTH` governs both the dispatcher's fan-out
 cap and the invoke depth-bound. Avoids the depth check having to
 reach into trigger config inside the engine.
-**D5 — One-consumer-per-queue via advisory lock (was plan §1).** A
+5. **Email-trigger retry settings** use the standard async defaults
-partial unique index across `triggers.app_id` and
+   (3 attempts, exponential, 1000 ms) — the brief didn't specify; matches
-`queue_trigger_details.queue_name` is not expressible (partial
+   the cron/kv default shape.
 indexes can't reference foreign columns). Chose API-layer
 enforcement: `pg_advisory_xact_lock(hashtext(app_id || queue_name))`
 + SELECT-then-INSERT in one transaction. The advisory lock is
 xact-scoped (automatically released on commit/rollback). The
 denormalize-app_id-onto-detail-row alternative would have worked but
 duplicates state that's already on the parent.
-**D6 — `invoke()` exposed globally (not `invoke::*`).** The brief
+No other deviations from prompt-specified defaults.
 spelled `invoke(target, args)` as a top-level helper, not under a
 `::` namespace. Registered via `engine.register_global_module(...)`
 so scripts write `invoke("worker")` rather than `invoke::call("worker")`.
-**D7 — `invoke_async` runs once.** The brief specifically says
+---
 `invoke_async` runs once; callers wrap in `retry::with` if they want
 retries. Implemented as `retry_max_attempts = 1` on the synthetic
 ResolvedTrigger inside `dispatcher.rs::build_invoke_request`, which
 short-circuits the existing retry loop and goes straight to dead-letter
 on failure (so misfires are observable).
-## 8. Verification (literal output)
+## 8. How to verify locally — §8 attestation (sourced from cargo's literal output)
 All gates run on the handed-back HEAD (`a7d3dad`):
 ```sh
-$ cargo fmt --all -- --check 2>&1 | tail -3
+cargo fmt --all -- --check                                   # clean
-# no output (exit 0)
+cargo clippy --all-targets --all-features -- -D warnings     # clean (exit 0)
-
+cd dashboard && npm run check                                # 0 ERRORS 0 WARNINGS (371 files)
 $ cargo clippy --workspace --all-targets --all-features -- -D warnings 2>&1 | tail -3
    Checking picloud v1.1.9 (/home/fabi/PiCloud/crates/picloud)
    Checking picloud-manager v1.1.9 (/home/fabi/PiCloud/crates/picloud-manager)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 12.42s
 ```
-**F5 note**: ran clippy WITHOUT a `cargo clean` first (incremental
+Full test run **with `DATABASE_URL` set** so the DB-gated suites
-cache used). The `Checking …` lines for test crates appear in the
+(schema_snapshot, dispatcher_e2e ×9, email_inbound ×8) execute:
 unfiltered output. CI will do the cold-cache attestation on its
 dedicated runner.
 **Workspace lib unit smoke** (per-crate, no `DATABASE_URL`):
 ```
 shared:            34 passed
 executor-core:    218 passed   (74 lib + 144 across the ten tests/sdk_*.rs binaries)
 manager-core:     311 passed   (306 lib + 4 migration + 1 schema_snapshot)
 orchestrator-core: 74 passed
 ```
 **DB-gated E2E** (against `docker compose up -d postgres`,
 `DATABASE_URL=postgres://picloud:picloud@localhost:15432/picloud`):
 ```
 picloud queue_e2e:       4 passed in 33.21s
 picloud invoke_e2e:      4 passed in 3.38s
 picloud retry_e2e:       3 passed in 1.65s
 picloud dispatcher_e2e:  9 passed in 32.70s
 picloud api:             8 passed in 3.85s
 picloud authz:           4 passed in 2.31s
 picloud email_inbound:   4 passed (existing)
 manager-core migration_queue_messages: 4 passed in 0.12s
 manager-core schema_snapshot: 1 passed in 0.28s
 ```
 All pass. Total across all binaries (lib + integration + DB-gated):
 ~660 tests.
 **F4 verification**:
 ```sh
-$ grep -rn 'argon2id\$v=19\$m=19456,t=2,p=1\$dGltaW5n' crates/
+DATABASE_URL='postgres://picloud:picloud@127.0.0.1:15432/picloud' \
-crates/manager-core/src/auth.rs:36:    "$argon2id$v=19$m=19456,t=2,p=1$dGltaW5nLWZsYXR0ZW4$Ux6dgPqgX1Mhg5fRgIeKZF3MWdYqJplKEz/cKLcSdks";
+  cargo test --workspace -- --test-threads=2
 ```
-Exactly one hit.
+**Pass count, summed from cargo's literal output (NOT hand-counted):**
 **Dashboard typecheck**:
 ```sh
-$ cd dashboard && npx svelte-check --tsconfig ./tsconfig.json 2>&1 | grep -E "queues/|api\.ts" | head -10
+DATABASE_URL=... cargo test --workspace -- --test-threads=2 2>&1 | \
-1780778502345 ERROR "tests/e2e/fixtures/api.ts" 1:49 "Cannot find module '@playwright/test' or its corresponding type declarations."
+  awk '/test result: ok\./ { gsub(";", ""); sum += $4 } END { print sum }'
 # => 617
 ```
-That's a pre-existing `tests/e2e/` Playwright type error, unchanged
+**617 passed, 0 failed** across the workspace (34 `test result:` lines,
-from main. My queue-related code typechecks clean.
+0 `FAILED`). Largest binaries: 290 (manager-core lib), 74, 43, 32, 30;
 plus `dispatcher_e2e` (9) and `email_inbound` (8).
 **Bounded-parallelism note (`--test-threads=2`):** the picloud e2e
 binaries each call `build_app`, which opens its own Postgres pool. Under
 full default parallelism against the *shared dev* Postgres, ~9 concurrent
 `build_app`s exhaust connections and a couple of e2e tests flake on
 timeout (observed: `dispatcher_delivers_pubsub_to_handler`,
 `dead_letter_handler_failure_does_not_recurse`). They pass reliably at
 `--test-threads=2` and in isolation. CI's dedicated fresh `postgres:15`
 (not a shared dev DB) does not hit this. Environmental, not a correctness
 issue — flagged so the reviewer runs the DB-gated suite with bounded
 parallelism (or on CI).
 **Migrations:** apply cleanly on the v1.1.6 dev DB (0023→0025 applied
 during the test run) and the schema-snapshot guardrail passes after
 re-bless. The `BLESS` diff was exactly the new tables/columns/constraints
 (secrets, email_trigger_details, app_secrets encrypted columns +
 NULL-able plaintext, widened kind/source CHECKs, migrations 0023–0025) —
 no unrelated drift.
 **Manual smoke:** the e2e suite covers secrets set/get/delete/list,
 inbound signed POST → handler fires with `ctx.event.email`, dead-letter
 handler fires, realtime-key encryption + SSE. Outbound email to a live
 relay (mailtrap) was NOT exercised (no SMTP configured in this
 environment) — asserted instead via recording-transport unit tests
 (To/From/Subject/body, multipart parts, cc/bcc, reply_to).
 ---
 ## 9. Open questions for the reviewer
-1. **`retry::run` rename** (D1): is `run` an acceptable script-side
+1. **§8 bounded-parallelism caveat** — acceptable, or should the e2e
-   name? Alternatives that compile: `retry::do_attempts`,
+   harness share a single `build_app`/pool across tests in a binary?
-   `retry::attempt`. `run` reads cleanest in practice but is
+   (Out of v1.1.7 scope; the existing v1.1.6 e2e tests have the same
-   slightly less specific than `with`.
+   shape.)
-2. **`invoke()` path-resolution method**: defaulted to POST→GET
+2. **`email::send` ignoring a stray `html` key** (forcing text-only) vs.
-   fallback. A future surface bump could let scripts pass a method
+   throwing — I chose forgiving text-only; happy to make it strict.
-   (`invoke("/api/foo", "GET", #{})`) — flagged as v1.2 follow-up.
+3. **Inbound `received_at`** is stamped by the receiver (`Utc::now()`),
-3. **`ctx.trigger_depth` not in `ctx`**: noted as a v1.2 follow-up
+   not read from a provider header — confirm that's the intended
-   inside `sdk_invoke.rs::invoke_callee_sees_incremented_depth`. The
+   semantics.
   depth value IS threaded through `SdkCallCx` correctly (verified
   by the depth-limit E2E test); it just isn't surfaced into the
   Rhai `ctx` map yet. Trivial addition when v1.2 lands.
 4. **Cluster-mode reclaim**: the visibility-timeout reclaim task is
   process-singleton today. Cluster mode (v1.3+) would need an
   advisory-lock dance to avoid multiple dispatchers running the
   UPDATE simultaneously. Out of scope per the brief.
-## 10. Latent findings
+---
-**L1 — Pre-existing clippy lints surfaced during the F3 attestation.**
+## 10. Latent security / correctness findings
 Six lints — two on new v1.1.9 code (`sdk/invoke.rs::_LIMITS_IS_COPY`
 items-after-test-module, `picloud/lib.rs::engine_limits`
 field-reassign-with-default), four others on new v1.1.9 SDK paths
 (`retry.rs`, `queue.rs`, `dispatcher.rs`). All fixed alongside the
 new code in commit `chore(v1.1.9): clippy clean — workspace -D warnings`
 so the gate is green now. No carry-forward latent findings from main.
-**L2 — Dashboard pre-existing Playwright errors (149)** in
+1. **`clippy --all-targets --all-features -- -D warnings` did NOT pass at
-`tests/e2e/**/*.spec.ts` — `Cannot find module '@playwright/test'`.
+   v1.1.6 HEAD** (verified by stashing this branch and re-running clippy
-Pre-existing; my changes don't touch the e2e folder.
+   on the committed slice-1 tree). Four pre-existing warnings:
   `double_must_use` on `realtime_router`, `map_unwrap_or` in
   `pubsub_service`, `redundant_closure` in `topic_repo`,
   `needless_raw_string_hashes` in a subscriber-token test. Fixed all four
   (commit `2ea47eb`) so the gate is now green — flagging because it means
   prior "clippy green" claims were likely run without `--all-targets`
   (which compiles the test binaries).
-## 11. Deferred items
+2. **Inbound HMAC fails closed on decrypt error.** If a stored
   `inbound_secret` can't be decrypted (e.g. `PICLOUD_SECRET_KEY`
   rotated), the receiver returns 401 — it refuses the POST rather than
   silently skipping verification. Intentional.
-**Not deferred:** `retry::*` shipped as `retry::run` (with the rename
+3. **No rate limiting on the public inbound-email endpoint.** Like every
-deviation flagged in §7). The full v1.1.9 scope landed.
+   public data-plane route, `/api/v1/email-inbound/...` is
   unauthenticated by design (URL + HMAC are the gate). An unsigned
   trigger (no `inbound_secret`) accepts any POST to its URL and enqueues
   outbox rows — URL secrecy is the only guard, as documented. Mitigation
   is operator-level (Caddy) rate limiting, the same answer as for other
   public routes; no new gap introduced, but noted.
-**Standing v1.2+ deferred list** (no change from the brief):
+---
- Cross-app `invoke()`
+## 11. Deferred items (unchanged from brief)
- Queue priorities
+
- Cron-style scheduled enqueues
+Master-key rotation / per-app master key (v1.2); native SMTP listener
- Queue purge / delete / requeue admin UI
+(v1.3+); provider-specific inbound unmarshallers, inbound attachments,
- Cluster-mode `invoke()` (orchestrator → executor RPC)
+outbound SMTP connection pooling, per-app `from` validation / SPF / DKIM
- Distributed retry / sagas / compensations
+(v1.2 / operator); dashboard inbound payload viewer (v1.2, PII); drop the
- Closures captured across `invoke()` boundaries (rejected at the
+plaintext `realtime_signing_key` column (v1.1.8); secrets
-  bridge — see §12)
+versioning/history + secrets-change triggers (never); `users::*` (v1.1.8);
- `ctx.trigger_depth` surface in the Rhai `ctx` map (v1.2 follow-up)
+`queue::*` / `invoke()` (v1.1.9).
- AST cache reuse across `invoke()` calls (deferred D2 optimization)
+
- `invoke()` method-aware route resolution (currently POST→GET fallback)
+---
 ## 12. Known limitations
- **No closures across `invoke()` boundaries.** A closure (`FnPtr`)
+- Production `EmailTransport` is a per-call connection; high outbound
-  constructed in script A and passed into script B as an arg is
+  volume is connection-churn-bound until pooling (v1.2).
-  rejected at the args-to-JSON conversion (`invoke: args must not
+- Outbound `email::send` was not smoke-tested against a live relay in
-  contain FnPtr / closures`). Closures stay local to their
+  this environment (no SMTP configured); the SMTP message contents are
-  construction context — re-entering a fresh `SdkCallCx` is the
+  asserted via recording-transport unit tests.
-  wrong scope for a captured environment.
+- The §8 DB-gated run requires bounded parallelism on a shared Postgres
- **`invoke()` is in-process only.** Re-entrant Rhai assumes the
+  (see §8); CI's dedicated Postgres does not.
  callee is reachable in the same `Engine` instance. Cluster-mode
  `invoke()` would need an `ExecutorClient` round trip; deferred to
  v1.3+.
 - **`invoke_async` does not retry.** One shot. Callers who want
  retries wrap the call site in `retry::run(policy, ...)`.
 - **Queue depth-pending is approximate in the drill-down view.** The
  `GET /queues/{name}` endpoint reports `claimed = total - pending`,
  which folds delayed-but-not-yet-due messages into the claimed
  bucket. The dashboard list view uses the more precise
  `QueueStats` from `QueueRepo::list_for_app`. (Cosmetic; the data
  is accurate just slightly differently shaped.)
 - **One dispatcher per process.** The queue arm + reclaim task run
  in the single MVP dispatcher. Cluster-mode multi-dispatcher
  coordination is v1.3+.
 - **No mutating queue admin endpoints.** Purge / requeue /
  delete-message stays at v1.2. The dashboard surfaces the queue
  state read-only.
--- a/HANDOFF.md
+++ b/HANDOFF.md
@@ -0,0 +1,382 @@
 # Handoff — 2026-06-05
 Machine-switch handoff. This document is the entry point for picking up
 PiCloud work on a different machine. It captures session state, what
 shipped, what's queued, and how to continue.
 ---
 ## TL;DR
 - **`main` is at v1.1.7** — seven minor releases (v1.1.1 → v1.1.7)
  shipped this session via the dispatch-and-review workflow.
 - Working tree is clean.
 - Next release is **v1.1.8** (User Management). A draft dispatch prompt
  is sketched in §6 below; ready to send to a dev agent.
 - One dev Postgres container (`picloud-postgres-1` on port 15432) is
  still running on the source machine — tear it down with
  `docker compose down -v` before the source machine goes offline.
 ---
 ## How to resume on the new machine
 ```sh
 git clone https://git.mc02.dev/fabi/PiCloud.git
 cd PiCloud
 git checkout main
 git log --oneline -10        # should show v1.1.7 reviewer commit at HEAD
 docker compose up -d          # local Postgres for DB-gated tests
 export DATABASE_URL='postgres://picloud:picloud@127.0.0.1:5432/picloud'
 cargo test --workspace -- --test-threads=2
 ```
 If you're starting from this branch (`handoff/2026-06-05`), it points at
 the same `main` HEAD with this `HANDOFF.md` added; merge or just read it
 and continue work on `main`.
 For the master encryption key needed by v1.1.7+ secrets:
 ```sh
 export PICLOUD_SECRET_KEY="$(openssl rand -base64 32)"
 # OR, for dev only:
 export PICLOUD_DEV_MODE=true
 ```
 The dev fallback uses a deterministic key (`SHA-256` of a hardcoded
 string) — fine for local testing, fatal for any real deployment.
 ---
 ## Session summary: v1.1.1 → v1.1.7
 All seven minor releases completed in one session via the dispatch
 workflow you set up: I draft a prompt, you dispatch it to a fresh
 agent in another session, the agent implements and writes `HANDBACK.md`,
 you bounce the report back to me, I audit the branch and write
 `REVIEW.md` with a verdict, you bounce-back-for-fixes-if-needed, and on
 approve I fast-forward merge into `main`.
 | Release | Capability | Iterations | Status |
 |---|---|---|---|
 | **v1.1.1** | Storage & Events (KV + triggers framework + outbox + dispatcher + NATS-style sync HTTP + dead-letter table + dashboard surface) | 1 | ✅ merged |
 | **v1.1.2** | Documents (`docs::*` SDK + query DSL + `docs:*` triggers) | 2 | ✅ merged (iteration 2 fixed a fmt diff) |
 | **v1.1.3** | Modules (`scripts.kind` + `PicloudModuleResolver` + AST caches + `script_imports`) | 1 | ✅ merged |
 | **v1.1.4** | Outbound HTTP & Scheduled Tasks (`http::*` with SSRF deny-list + cron triggers) | 1 | ✅ merged |
 | **v1.1.5** | Files & Pub/Sub (filesystem-backed blobs + `pubsub::publish_durable` + first CI workflow) | 1 | ✅ merged |
 | **v1.1.6** | Realtime Channels & Client Library (SSE + topics + HMAC subscriber tokens + `@picloud/client@1.0.0`) | 1 | ✅ merged |
 | **v1.1.7** | Configuration & Email (encrypted secrets + outbound/inbound email + dead-letter handler fix) | 1 | ✅ merged |
 **Versioning state on `main`:**
 - Workspace `1.1.7`
 - SDK schema `1.8`
 - Dashboard `0.13.0`
 - `@picloud/client` `1.0.0`
 - Migrations applied through `0025`
 **Test counts at HEAD:** `cargo test --workspace --test-threads=2` with
 `DATABASE_URL` set → **617 passed / 0 failed**. The `--test-threads=2`
 is required on shared dev Postgres (~9 concurrent `build_app`s
 otherwise exhaust connections); CI's dedicated Postgres doesn't hit
 this.
 ---
 ## Branches on this machine
 ### v1.1.x feature branches (all merged into main, kept locally for traceability)
 | Branch | HEAD | What it contains |
 |---|---|---|
 | `feat/v1.1.1-storage-and-events` | `2796f36` | v1.1.1 work + HANDBACK + REVIEW |
 | `feat/v1.1.2-documents` | `5bbbc26` | v1.1.2 work (2 iterations) + HANDBACK + REVIEW |
 | `feat/v1.1.3-modules` | `6f17259` | v1.1.3 work + HANDBACK + REVIEW |
 | `feat/v1.1.4-http-cron` | `03d03ea` | v1.1.4 work + HANDBACK + REVIEW |
 | `feat/v1.1.5-files-pubsub` | `d064681` | v1.1.5 work + HANDBACK + REVIEW |
 | `feat/v1.1.6-realtime-client` | `64ad978` | v1.1.6 work + HANDBACK + REVIEW |
 | `feat/v1.1.7-secrets-email` | `5cbb6ca` | v1.1.7 work + HANDBACK + REVIEW |
 All seven HEADs are reachable from `main` (fast-forward merges). Keeping
 the branches makes it easy to inspect the per-release commit slice
 without git log filtering.
 ### Older branches predating this session (state uncertain)
 These appeared in `git branch` at session start and weren't touched by
 v1.1.x work. I don't know which are abandoned, in-flight, or already
 merged under different names. **On the new machine, decide for each:**
 | Branch | Last commit | Tracking |
 |---|---|---|
 | `chore/ui-hardening` | `b42e273 fix(test): admin_is_implicit_app_admin uses force=true on app delete` | local-only |
 | `feat/app-members` | `e6fc6e6 test(picloud): close two app_members test gaps` | local-only |
 | `feat/cli` | `5d08974 style(cli): re-fmt one stray format! line in the integration test` | tracks `origin/feat/cli` (up to date) |
 | `feat/multi-app-scoping` | `a393f11 feat(dashboard): auto-slug app names and infer route host kind from input` | tracks `origin/feat/multi-app-scoping` (ahead 3) |
 | `feat/users-and-keys-ui` | `6eb32a7 feat(dashboard): adopt ActionMenu for user row actions` | local-only |
 | `feat/users-authz` | `2aab92a style: cargo fmt across Phase 3.5 changes` | local-only |
 | `test/cli-journeys` | `e4851b3 test(cli): extract shared Fixture into tests/common` | tracks `origin/test/cli-journeys` (up to date) |
 | `test/frontend-e2e` | `ec3c768 test(dashboard): add full-stack integration specs` | local-only |
 **Push these if you want them mirrored on the new machine** — see §3
 below for the push commands. If any are obsolete, delete them locally
 before resuming.
 ---
 ## §3 — Push instructions
 Push was denied in this session (sandbox restriction). Run these on the
 source machine to mirror state to `origin`:
 ```sh
 # 1. The v1.1.x releases on main (55 commits)
 git push origin main
 # 2. The seven v1.1.x feature branches (preserves per-release history)
 git push origin feat/v1.1.1-storage-and-events
 git push origin feat/v1.1.2-documents
 git push origin feat/v1.1.3-modules
 git push origin feat/v1.1.4-http-cron
 git push origin feat/v1.1.5-files-pubsub
 git push origin feat/v1.1.6-realtime-client
 git push origin feat/v1.1.7-secrets-email
 # 3. This handoff branch
 git push -u origin handoff/2026-06-05
 # 4. OPTIONAL — push the older branches you want on the new machine
 #    (decide per-branch; some may be abandoned)
 git push origin chore/ui-hardening
 git push origin feat/app-members
 git push origin feat/multi-app-scoping     # ahead 3 of remote
 git push origin feat/users-and-keys-ui
 git push origin feat/users-authz
 git push origin test/frontend-e2e
 ```
 After pushing, on the new machine: `git fetch --all` brings everything
 down. `git checkout main` puts you at v1.1.7 HEAD.
 ---
 ## §4 — Workflow context (read before dispatching v1.1.8)
 The dispatch-and-review workflow you've been using:
 1. **You ask me to draft the dispatch prompt** for the next release.
 2. **I draft the prompt** based on:
   - The roadmap in [`docs/v1.1.x-design-notes.md` §7](docs/v1.1.x-design-notes.md)
   - Three or so follow-ups identified in the prior release's REVIEW.md
   - Discipline lessons carried forward from prior retros
 3. **You dispatch the prompt to a fresh agent in another session** —
   that agent gets no prior conversation context; the prompt + the
   docs it points at are everything they have.
 4. **The agent implements + writes `HANDBACK.md`** at the repo root,
   then stops.
 5. **You bounce the HANDBACK back to me.**
 6. **I audit the branch and write `REVIEW.md`** with a verdict
   (`APPROVE` or `NEEDS CHANGES`).
 7. **If `NEEDS CHANGES`:** you bounce the REVIEW back to the agent;
   they iterate; back to step 5.
 8. **If `APPROVE`:** I fast-forward merge the branch into `main` and
   pause for your next instruction.
 What's worked well across seven releases:
 - The discipline reminders compound. Each release's retro identifies
  one small habit the agent dropped (§8 attestation hand-counting,
  silent prompt-default deviations, brief-internal contradictions
  silently reinterpreted, clippy run without `--all-targets`); the
  next release's prompt explicitly addresses it. By v1.1.7 the agent
  was catching their own latent findings without prompting.
 - Explicit "deviations beyond the brief" sections in HANDBACK make
  audits fast — every meaningful judgment call is in one place.
 - The "this is the deferrable piece under scope pressure" clause in
  big releases (v1.1.6 client lib, v1.1.7 inbound email) gave the
  agent a clean escape hatch they never actually needed but worked
  as intended.
 - Latent findings discovered during implementation (v1.1.3 cross-app
  trigger gap, v1.1.4 SSRF literal-IP bypass, v1.1.6 dead_letter
  handler never firing, v1.1.7 clippy regression at v1.1.6 HEAD) all
  surfaced honestly rather than being silently worked around.
 What to do differently in v1.1.8:
 - **Walk through each code example in the prompt** before sending. v1.1.4
  brief said `(url, opts)` but its example was `http::post(url, body)` —
  the agent had to fix it during implementation. v1.1.7 brief sketched
  `TriggerEvent::DeadLetter` field names that didn't match the actual
  variant. Both flagged correctly, but pre-resolution saves agent
  effort.
 - **Pin the clippy gate**: `cargo clean` before `cargo clippy
  --all-targets` to defeat incremental-cache false-greens. See v1.1.7
  REVIEW §3.3 for context.
 ---
 ## §5 — Pending follow-ups for v1.1.8
 From the v1.1.7 REVIEW.md, three load-bearing items to fold into the
 v1.1.8 dispatch prompt:
 ### 5.1 Drop the plaintext `realtime_signing_key` column
 The v1.1.7 phase-2 commitment. v1.1.7 added NULL-able encrypted columns
 + DROP NOT NULL on the plaintext column; the startup task encrypts
 existing rows. v1.1.8 drops the plaintext column entirely.
 **Pre-flight check:** scan for any remaining non-NULL rows on the
 plaintext column. If found, run the encryption migration before the
 drop. If the v1.1.7 startup task ran on the operator's deploy, all
 rows should already be encrypted.
 **CHANGELOG must note** that v1.1.8 requires v1.1.7 to have been
 applied first. No skipping versions.
 ### 5.2 Clippy `--all-targets` discipline refinement
 The v1.1.7 audit caught a real regression: four warnings predated
 v1.1.7 that the v1.1.6 audit reported as clippy-green. Likely cause:
 cargo's incremental cache leaving test binaries unchecked.
 v1.1.8 prompt should require either:
 - `cargo clean` before `cargo clippy --all-targets`, OR
 - Explicit verification that the clippy output includes `Checking`
  lines for test crates.
 CI's `.github/workflows/ci.yml` (added in v1.1.5) might also benefit
 from a clippy-cache-check step.
 ### 5.3 `auth_mode = 'session'` for realtime subscriber tokens
 v1.1.7's CHECK constraint on `topics.auth_mode` only allows
 `('public', 'token')`. v1.1.8's `users::*` work needs to:
 - Extend the CHECK to include `'session'`.
 - Add a session-token validator alongside the existing HMAC validator
  behind the unchanged `RealtimeAuthority` trait.
 The trait shape from v1.1.6 already supports this — natural extension.
 ---
 ## §6 — Draft v1.1.8 dispatch prompt outline
 Not the full prompt — just the scope sketch so you can ask me to expand
 it on the new machine.
 **v1.1.8 — User Management (`users::*`)**
 Core scope:
 - `users::create / get / find / update / delete / list` SDK
 - Password hashing (argon2id)
 - `users` table per-app
 - Sessions: `users::login(email, password)` → returns a session token;
  `users::verify(session_token)` returns the user or `()`
 - Sessions table with TTL + revocation
 - Email verification flow (uses v1.1.7 email::send)
 - Password reset flow (uses v1.1.7 email::send + tokens)
 - Invitations (admin creates an invite → email link → user accepts +
  sets password)
 - Roles: per-app role assignments on users
 - `Capability::AppUsersRead/Write/Admin` mapped to existing scopes
 - Dashboard: Users tab on app detail page (list, invite, role-edit)
 Follow-ups from v1.1.7 retro (fold in):
 - Drop plaintext `realtime_signing_key` column (phase-2)
 - Clippy `--all-targets` discipline refinement
 - `auth_mode = 'session'` for realtime subscriber tokens (uses v1.1.8
  sessions)
 Out of scope:
 - OAuth providers (defer to v1.2+)
 - 2FA / MFA (defer to v1.2+)
 - SSO / SAML (defer)
 - Password policy customization (defer; ship with sensible default)
 - User-to-user messaging (defer; userland)
 Ask me to expand this into a full prompt when you're ready.
 ---
 ## §7 — Environmental notes
 - **Dev Postgres container** `picloud-postgres-1` (port 15432) was
  running at session end on the source machine. The v1.1.5/v1.1.6/
  v1.1.7 agents started it for live DB-gated tests. **Tear down with
  `docker compose down -v` before the source machine goes offline**
  if you want a clean state.
 - **`PICLOUD_SECRET_KEY`** is required for v1.1.7+ to start. Pick one
  with `openssl rand -base64 32` for production; use
  `PICLOUD_DEV_MODE=true` (no master key needed) for local
  development. The dev key is deterministic so secrets persist across
  restarts in dev.
 - **CI workflow** lives at [`.github/workflows/ci.yml`](.github/workflows/ci.yml)
  (added in v1.1.5). Runs fmt + clippy + `cargo test --workspace`
  against a `postgres:15` service, plus dashboard `npm run check`.
  When you push to `main` or open a PR, CI will run. **First push
  after this handoff will exercise it for the first time on real
  workload — watch the run.**
 ---
 ## §8 — Key documents for orientation
 - **[`CLAUDE.md`](CLAUDE.md)** — project conventions. Read first.
 - **[`serverless_cloud_blueprint.md`](serverless_cloud_blueprint.md)** —
  the authoritative architecture document.
 - **[`docs/sdk-shape.md`](docs/sdk-shape.md)** — SDK conventions every
  v1.1.x service follows.
 - **[`docs/v1.1.x-design-notes.md`](docs/v1.1.x-design-notes.md)** —
  the in-flight-decisions document. Sections §1–§6 contain the
  "Decided 2026-06-01" annotations from the design conversation that
  preceded this session; §7 holds the v1.1.x roadmap; §1–4 are
  candidates for pruning (their decisions shipped in v1.1.1).
 - **[`docs/versioning.md`](docs/versioning.md)** — patch-bump policy
  under the post-1.0 expansion-phase carve-out.
 - **[`docs/git-workflow.md`](docs/git-workflow.md)** — trunk-based
  workflow conventions.
 - **[`CHANGELOG.md`](CHANGELOG.md)** — release notes for v1.1.1 onward.
  v1.1.7's entry includes the retroactive dead_letter security note.
 Per-release artifacts on `main`:
 - `HANDBACK.md` at repo root — currently holds the v1.1.7 agent's
  handback. Overwritten each release.
 - `REVIEW.md` at repo root — currently holds the v1.1.7 reviewer's
  audit. Overwritten each release.
 If you want the full per-release HANDBACK + REVIEW history, the seven
 `feat/v1.1.x-*` branches preserve them (each branch's `HEAD~1`
 contains the HANDBACK and `HEAD` contains the REVIEW for that release).
 ---
 ## §9 — Quick smoke after resuming
 After cloning + setting up the new machine:
 ```sh
 # Basic gates
 cargo fmt --all -- --check
 cargo clippy --all-targets --all-features -- -D warnings
 cargo test --workspace
 # DB-gated (needs Postgres)
 docker compose up -d
 export DATABASE_URL='postgres://picloud:picloud@127.0.0.1:5432/picloud'
 export PICLOUD_DEV_MODE=true
 cargo test --workspace --test-threads=2
 # Dashboard
 cd dashboard && npm install && npm run check
 # Client library
 cd clients/typescript && npm install && npm run lint && npm run test && npm run build
 ```
 If all green: machine is ready. Resume v1.1.8 work by asking me for
 the full dispatch prompt.
 ---
 **Handoff written 2026-06-05.** Main HEAD: `5cbb6ca` (v1.1.7 reviewer
 APPROVE).
--- a/REVIEW.md
+++ b/REVIEW.md
@@ -1,185 +1,183 @@
-# v1.1.9 Audit & Review
+# v1.1.7 Audit & Review
-**Branch:** `feat/v1.1.9-queues-invoke`
+**Branch:** `feat/v1.1.7-secrets-email`
-**Base:** `main` (v1.1.8 head, `b9e002a`)
+**Base:** `main` (v1.1.6 head)
-**Commits ahead:** 20
+**Commits ahead:** 10 (8 substantive + 1 chore-clippy-fix + 1 handback)
-**HEAD audited:** `7d3ced0` (agent's last commit)
+**HEAD audited:** `3cfb795`
 **Audited by:** reviewer (this report)
 **Audited against:** the v1.1.7 dispatch prompt + the v1.1.1–v1.1.6 patterns it mandated
 **Iterations:** 1
 ## Verdict
-**APPROVE — ready to merge to `main` as v1.1.9.**
+**APPROVE — ready to merge to `main` as v1.1.7.**
-The final v1.1.x release. Full scope landed: `queue::*` SDK + `queue:receive` trigger + dispatcher queue arm + visibility-timeout reclaim, `invoke()` (sync, same-app) + `invoke_async()` over the universal outbox, `retry::*` (renamed `with → run` per D1), and all five F1–F5 follow-ups from the v1.1.8 retro. No deferrable piece slipped. Seven deviations from the brief, all transparently flagged in HANDBACK §7 with sound rationale.
+Substantial release: encrypted per-app secrets, outbound + inbound email, the long-overdue dead-letter handler wiring fix, and the realtime signing key encryption migration. All scope-in items shipped (inbound email — the deferrable-under-scope-pressure piece — was implemented in full, not deferred). 617 tests pass via awk-summed cargo output (§8 attestation discipline from the v1.1.6 retro landed). Gates green.
-**§8 attestation discipline visibly leveled up from v1.1.8.** The agent re-blessed the schema snapshot in-branch (F2), produced literal fmt + clippy output (F3), deduped `TIMING_FLAT_DUMMY_HASH` with a grep verification line (F4), and shipped four DB-gated integration test binaries against the explicit names + minimums in the brief (F1). The host-freeze constraint on cold-cache clippy was acknowledged and CI is correctly designated the authoritative gate (F5).
+Three flagged items in HANDBACK §7/§9/§10, all transparent and correct calls:
-**Reviewer-independent verification reproduced everything material:**
+1. **Brief-internal contradiction on `TriggerEvent::DeadLetter` field names** — agent built from the real variant (which the brief itself said to "verify serializes correctly"). The v1.1.6 retro discipline lesson (flag-don't-reinterpret) working again.
- fmt: `cargo fmt --all -- --check` → no output, exit 0.
+2. **`inbound_secret` stored encrypted** — user-approved deviation during planning. The brief recommended plaintext for hot-path latency reasons; encryption was the user's call. Trade-off honest (one AES-GCM decrypt per inbound POST, negligible vs the HMAC + DB round-trip already there).
 - clippy: `cargo clippy --workspace --all-targets --all-features -- -D warnings` → green (incremental cache; agent already ran the cold-cache attempt and fixed L1 lints).
 - F4 grep: exactly one hit at [auth.rs:36](crates/manager-core/src/auth.rs#L36), the const declaration.
 - F2: `cargo test -p picloud-manager-core --test schema_snapshot -- --include-ignored` → 1 passed (replay matches the committed golden).
 - Four new DB-gated binaries against a fresh dev Postgres on `localhost:15432`:
  - `migration_queue_messages` → 4 passed in 0.87s
  - `retry_e2e` → 3 passed in 2.88s
  - `invoke_e2e` → 4 passed in 3.75s
  - `queue_e2e` → 4 passed in 37.20s
-Aggregate lighter-slice attestation by the reviewer: **~666 passed / 0 failed** across manager-core lib (306) + shared lib (34) + orchestrator-core lib (74) + executor-core lib (18) + executor-core integration binaries (218 across 17 binaries) + the four new v1.1.9 DB-gated binaries (15) + schema_snapshot (1). Matches the agent's claim of ~660 essentially exactly. Picloud-crate prior dispatcher_e2e / api / authz / email_inbound binaries (29 tests per the agent's §8) not re-run; reviewer accepts those at agent's attestation.
+3. **Latent finding: clippy `--all-targets` didn't pass at v1.1.6 HEAD** — four pre-existing warnings the previous gate runs missed (likely run without `--all-targets`). Fixed in a dedicated commit. **This is a real audit finding that affects every prior REVIEW.md from v1.1.1 onward.**
 The dead-letter handler wiring bug from v1.1.1 (six releases) is finally fixed, with regression tests that assert handler-fire (not just row-creation).
 ---
-## 1. Static checks reproduced (HEAD `7d3ced0`)
+## 1. Static checks reproduced (HEAD `3cfb795`)
 ```
-cargo fmt --all -- --check                                ✅ no output (exit 0)
+cargo fmt --all -- --check                                ✅ exit 0
-cargo clippy --workspace --all-targets --all-features -- -D warnings
+cargo clippy --all-targets --all-features -- -D warnings  ✅ exit 0  (now actually green; see §5)
-                                                          ✅ Finished `dev` profile in 1.77s (warm-cache, agent's cold-cache run was already green)
+cargo test --workspace (DATABASE_URL set, --test-threads=2) ✅ 617 passed / 0 failed
 cargo test -p picloud-manager-core --lib                  ✅ 306 passed / 0 failed
 cargo test -p picloud-shared --lib                        ✅ 34 passed / 0 failed
 cargo test -p picloud-orchestrator-core --lib             ✅ 74 passed / 0 failed
 cargo test -p picloud-executor-core --tests               ✅ 218 passed / 0 failed (17 binaries + lib)
 cargo test -p picloud-manager-core --test schema_snapshot ✅ 1 passed (replay matches golden)
 cargo test -p picloud-manager-core --test migration_queue_messages  ✅ 4 passed
 cargo test -p picloud --test queue_e2e                    ✅ 4 passed in 37.20s
 cargo test -p picloud --test invoke_e2e                   ✅ 4 passed in 3.75s
 cargo test -p picloud --test retry_e2e                    ✅ 3 passed in 2.88s
 ```
-Reviewer-substituted attestation total: **666 passed / 0 failed** across the load-bearing slices.
+Sum via the v1.1.7 discipline awk pattern:
-The full-workspace `--test-threads=2` run with the awk-sourced count is not produced — host-freeze risk remains the same on this hardware (v1.1.7/v1.1.8 lesson). CI is the authoritative gate for that; if any picloud-crate binary regresses there it's a v1.1.9.1 hotfix, not a re-roll.
+```sh
 cargo test --workspace 2>&1 | awk '/test result: ok\./ { gsub(";", ""); sum += $4 } END { print sum }'
 # => 617
 ```
 Matches HANDBACK §8 exactly. **The §8 discipline refinement from the v1.1.6 retro is working.**
 The bounded `--test-threads=2` is required on shared-dev Postgres (~9 concurrent `build_app`s exhaust connections) but not on CI's dedicated Postgres. Acceptable environmental nuance; flagged in HANDBACK §8.
 ## 2. Design conformance (spot-checks)
 | Decision / requirement | Where it lives | Verdict |
 |---|---|---|
-| Queue table IS the outbox for queue semantics (no double-buffering) | [queue_repo.rs::claim](crates/manager-core/src/queue_repo.rs#L177-L212) + [dispatcher.rs::tick_queue_arm](crates/manager-core/src/dispatcher.rs#L152-L164) | ✅ No `OutboxSourceKind::Queue`; the dispatcher's `tick_queue_arm` enumerates consumers and runs one atomic claim per `(app_id, queue_name)` per tick |
+| **AES-256-GCM with 12-byte CSPRNG nonce + 16-byte appended auth tag** | [shared/src/crypto.rs:71-85](crates/shared/src/crypto.rs#L71-L85) | ✅ Uses `aes-gcm 0.10`; nonce from `rand::thread_rng().fill_bytes`; RustCrypto Aead layout (tag appended) |
-| Single round-trip atomic claim via `UPDATE ... WHERE id = (SELECT ... FOR UPDATE SKIP LOCKED LIMIT 1) RETURNING` | [queue_repo.rs:184-201](crates/manager-core/src/queue_repo.rs#L184-L201) | ✅ Verbatim per the brief; increments `attempt`, sets `claim_token` + `claimed_at` |
+| `MasterKey` redacts Debug; cheap to clone | shared/src/crypto.rs MasterKey impl | ✅ Per HANDBACK §2 |
-| Auto-ack: `DELETE WHERE id = $1 AND claim_token = $2` (lease guarantee) | [queue_repo.rs:218-224](crates/manager-core/src/queue_repo.rs#L218-L224) | ✅ Stale dispatcher whose lease expired can't delete a re-claimed message |
+| `PICLOUD_SECRET_KEY` required (fatal if missing); dev-mode fallback requires explicit `PICLOUD_DEV_MODE=true` | crypto.rs MasterKey::from_env + resolve | ✅ No quiet "unencrypted mode" path |
-| Auto-nack: clear claim + set `deliver_after = NOW() + retry_delay` | [queue_repo.rs:232-245](crates/manager-core/src/queue_repo.rs#L232-L245) | ✅ Same lease-token filter; idempotent |
+| `MasterKey` threaded into `build_app` (test-friendly) | [picloud/src/lib.rs:build_app](crates/picloud/src/lib.rs) | ✅ Parameter, not env-sourced — tests can pass a fixed key |
-| Visibility-timeout reclaim every `PICLOUD_QUEUE_RECLAIM_INTERVAL_MS` (default 30s) | [dispatcher.rs::spawn lines 87-104](crates/manager-core/src/dispatcher.rs#L87-L104) + [queue_repo.rs::reclaim_visibility_timeouts](crates/manager-core/src/queue_repo.rs#L247-L262) | ✅ Separate tokio task; UPDATE JOIN triggers + queue_trigger_details; verified by `queue_e2e::queue_visibility_timeout_reclaim` |
+| 64 KB plaintext cap per secret | secrets_service::seal | ✅ `PICLOUD_SECRET_MAX_VALUE_BYTES` override |
-| Dead-letter integration through existing `dead_letters` table + `fan_out_dead_letter` path | [dispatcher.rs::handle_queue_failure](crates/manager-core/src/dispatcher.rs#L292-L338) | ✅ Source `"queue"`, op `"receive"`; existing `fan_out_dead_letter` on the outbox arm reads the new row without special-casing |
+| Generic GCM auth-failure error (no wrong-key vs tampered distinction) | crypto.rs CryptoError::Decrypt | ✅ By design — leaking which failure case happened weakens the integrity guarantee |
-| Exactly one consumer per queue enforced | [trigger_repo.rs::create_queue_trigger](crates/manager-core/src/trigger_repo.rs) via `pg_advisory_xact_lock` | ✅ Per D5 — partial unique cross-table index is infeasible; advisory-lock + SELECT-then-INSERT in one transaction is the right workaround |
+| `secrets` table with `(app_id, name)` PK, encrypted bytea + 12-byte nonce | [0023_secrets.sql](crates/manager-core/migrations/0023_secrets.sql) | ✅ |
-| Trigger-execution principal = principal that registered the trigger | dispatcher.rs::dispatch_one_queue lines 231-235 (resolves via `principals.resolve(consumer.registered_by_principal)`) | ✅ Consistent with v1.1.1 design-notes §4 |
+| `secrets::*` SDK — collection-less, JSON type round-trip | [executor-core/src/sdk/secrets.rs](crates/executor-core/src/sdk/secrets.rs) + secrets_service.rs | ✅ String comes back as String (not JSON-quoted) |
-| Cross-app `invoke()` rejection at three layers | [invoke_service.rs::resolve_id](crates/manager-core/src/invoke_service.rs#L43-L64) (service); `get_by_name`/RouteTable snapshot (repo/routes); dispatcher `build_invoke_request` (defense-in-depth) | ✅ Verified by `invoke_e2e::invoke_cross_app_rejects` (returns `InvokeError::CrossApp`) |
+| Cross-app isolation in secrets | secrets_service via `cx.app_id` | ✅ Test asserts |
-| Same-app `invoke()` re-entrancy via shared engine + fresh `SdkCallCx` (trigger_depth + 1) | [engine.rs:91-101 + 197](crates/executor-core/src/engine.rs#L91-L197) + sdk/invoke.rs::invoke_blocking | ✅ `Engine::self_weak: OnceLock<Weak<Engine>>` + `set_self_weak` + `self_arc()`; cycle stays broken; bridge gets `None` only on engine drop |
+| `Capability::AppSecretsRead/Write` → `script:read/write` | manager-core::authz | ✅ Seven-scope commitment held |
-| `Limits::trigger_depth_max` synced from `TriggerConfig::max_trigger_depth` (D4) | sandbox.rs Limits + picloud/src/lib.rs build_app | ✅ `PICLOUD_MAX_TRIGGER_DEPTH` governs both dispatcher fan-out and invoke depth |
+| No `ServiceEvent` emission for secret writes | secrets_service | ✅ Per brief — secret-change triggers are a footgun |
-| `invoke_async` runs once (no retry) | invoke_service.rs::enqueue_async + dispatcher.rs::build_invoke_request synthesizes `retry_max_attempts = 1` | ✅ Per D7 — callers wrap in `retry::run` if they want retries |
+| Outbound email via `lettre 0.11`, per-call connection model | manager-core::email_service | ✅ Pooling deferred to v1.2 per brief |
-| `retry::policy` clamps: max_attempts ∈ [1,20], base_ms ∈ [1, 60_000], jitter_pct ∈ [0,100] | [retry.rs::build_policy](crates/executor-core/src/sdk/retry.rs#L135-L187) | ✅ Saturating clamps with clear errors on bogus backoff strings |
+| Disabled mode when SMTP env vars missing | EmailServiceImpl::from_env | ✅ Startup warn; every `send` returns `NotConfigured` |
-| `retry::run(policy, fn_ptr)` re-invokes FnPtr through NativeCallContext | [retry.rs::retry_run](crates/executor-core/src/sdk/retry.rs#L189-L200+) | ✅ Closure shares caller's engine + cx; inner `invoke()` calls get fresh cx via the invoke bridge — retry doesn't interfere |
+| `email::send_html` builds MultiPart alternative_plain_html | email_service.rs send_html path | ✅ |
-| `retry::on_codes` substring filter (empty = retry every throw) | retry.rs::on_codes | ✅ |
+| `to/cc/bcc` accept String or Array of Strings | sdk/email.rs bridge | ✅ |
-| Sleep mechanics: `tokio::time::sleep` via `TokioHandle::block_on` inside `spawn_blocking` | retry.rs | ✅ Safe — already off the async worker pool |
+| 25 MB message cap, env-overridable | email_service | ✅ `PICLOUD_EMAIL_MAX_MESSAGE_BYTES` |
-| Migrations 0034 + 0035 sequential, no skips | migrations/ | ✅ |
+| RFC 5322-ish pre-validation + lettre Mailbox parse | email_service::validate | ✅ |
-| Schema-snapshot golden re-blessed in branch (F2) | [tests/expected_schema.txt](crates/manager-core/tests/expected_schema.txt) + commit `106394b` | ✅ Replay matches |
+| Inbound webhook receiver `POST /api/v1/email-inbound/{app_id}/{trigger_id}` | crates/picloud/src/lib.rs or orchestrator-core | ✅ Per [picloud/tests/email_inbound.rs](crates/picloud/tests/email_inbound.rs) test coverage |
-| Versions: workspace 1.1.8→1.1.9, SDK 1.9→1.10, dashboard 0.14.0→0.15.0 | Cargo.toml + version.rs + package.json | ✅ |
+| Inbound: 202 success, 401 HMAC fail, 404 missing/wrong-kind, 422 malformed | email_inbound.rs tests | ✅ All four status codes pinned by tests |
-| CHANGELOG v1.1.9 entry, no upgrade constraint (pure additive) | [CHANGELOG.md](CHANGELOG.md) | ✅ |
+| `email_trigger_details` schema with HMAC secret | [0024_email_triggers.sql](crates/manager-core/migrations/0024_email_triggers.sql) | ✅ |
-| F4 — `TIMING_FLAT_DUMMY_HASH` dedup: grep returns exactly 1 hit | reviewer-verified: `grep -rn 'argon2id\\$v=19\\$m=19456,t=2,p=1\\$dGltaW5n' crates/` → 1 hit at auth.rs:36 | ✅ |
+| `TriggerEvent::Email` shape: from/to/cc/subject/text/html/received_at/message_id | trigger_event.rs | ✅ |
-| Dashboard: Queues tab (list + drilldown), queue:receive trigger form, 0.15.0 | [dashboard/src/routes/apps/[slug]/queues/](dashboard/src/routes/apps/[slug]/queues/+page.svelte) + extended Triggers form | ✅ Per HANDBACK §5; pre-existing Playwright errors in tests/e2e unchanged |
+| **Dead-letter handler fix: `list_matching_dead_letter` called from `dispatcher::handle_failure`** | [dispatcher.rs:498-501 + fan_out_dead_letter](crates/manager-core/src/dispatcher.rs#L498-L501) | ✅ Wired exactly as specified; built from the real `TriggerEvent::DeadLetter` variant |
 | Recursion-stop preserved: handler failures don't re-dead-letter | dispatcher.rs `is_dead_letter_handler` short-circuit at top of handle_failure | ✅ No new guard needed — the existing flag fires before reaching the exhaustion branch |
 | Best-effort fan-out: lookup/insert failures logged, not propagated | fan_out_dead_letter at dispatcher.rs:541-545 + 562-565 | ✅ Dead-letter row durably written; handler fan-out is secondary |
 | **Two-phase realtime key migration: encrypted columns added NULL-able + plaintext kept** | [0025_encrypt_realtime_keys.sql](crates/manager-core/migrations/0025_encrypt_realtime_keys.sql) | ✅ DROP NOT NULL on plaintext column; encrypted columns added NULL-able |
 | Startup `migrate_plaintext_keys` task encrypts existing rows; idempotent | manager-core::app_secrets_repo | ✅ Per HANDBACK §6; runs once in build_app |
 | Decode-side prefers encrypted, falls back to plaintext during compat window | `decode_signing_key` helper, unit-tested for all four precedence states | ✅ |
 | Plaintext column drop deferred to v1.1.8 + documented | CHANGELOG + migration header | ✅ |
 | Versions: workspace 1.1.6→1.1.7, SDK 1.7→1.8, dashboard 0.12.0→0.13.0 | Cargo.toml + version.rs + package.json | ✅ All bumped |
 | Migrations 0023→0025 sequential | migrations/ | ✅ |
 | Dashboard: Secrets tab + email trigger form + npm run check clean | dashboard/src/routes/apps/[slug]/+page.svelte | ✅ Per HANDBACK |
-## 3. The seven flagged deviations (HANDBACK §7)
+## 3. The three flagged items
-### D1. `retry::with` → `retry::run` (Rhai reserved keyword)
+### 3.1 Brief-internal contradiction: `TriggerEvent::DeadLetter` field names (HANDBACK §7 #2)
-`with` AND `call` are reserved at the Rhai parser; the agent verified this before committing the rename. Documented in the SDK module docstring, the SDK_VERSION 1.10 changelog, and the dashboard form copy.
+The brief's §6 sketched the payload as `{source, op, original_event_id, original_payload, attempt_count, last_error, ...}`. The actual variant in `crates/shared/src/trigger_event.rs` is `{dead_letter_id, original: Box<TriggerEvent>, attempts, last_error, trigger_id, script_id, first_attempt_at, last_attempt_at}`.
-**Verdict: accept.** `run` reads cleanly script-side (`retry::run(policy, || ...)`). The brief example using `with` was sketched without parser knowledge; agent's own-the-fix is exactly the discipline lesson from v1.1.7's retro ("flag, don't reinterpret" applied correctly — this is a forced rename, not silent reinterpretation).
+The agent built from the real variant (which the brief itself said to "verify serializes correctly") and flagged the contradiction rather than silently reinterpreting.
-### D2. Trait move skipped (was plan §5)
+**Verdict: correct call.** The v1.1.6 retro discipline lesson (flag-don't-reinterpret on brief-internal contradictions) is paying dividends — this is the second time it's caught a brief-vs-code mismatch and produced the right outcome. Worth folding into the v1.1.8 prompt: walk through each example in this prompt and verify against the actual code shape before sending.
-The brief speculated about moving `ExecutorClient` + `ScriptIdentity` from `orchestrator-core` to `shared` to enable an in-engine invoke bridge. Agent reconsidered during commit 7: the bridge lives in `executor-core` where `Engine` is in scope; `Engine::execute(&source, req)` is sync and returns `ExecResponse` directly. Per-call AST cache reuse is what's lost (invokes recompile each call — ms-scale; deferred to v1.2).
+### 3.2 `inbound_secret` stored encrypted (HANDBACK §7 #1)
-**Verdict: accept.** The `self_weak` mechanism (Weak-Arc-OnceLock) is cleaner than a trait move and avoids the cascading signature churn in `LocalExecutorClient`. AST recompile cost is a known tradeoff. The brief was speculation; the agent built the simpler shape that works.
+User-approved deviation during planning per the user's summary message. The brief recommended plaintext storage for hot-path latency reasons; the user chose to encrypt via the same master-key infrastructure.
-### D3. Retry columns on parent triggers row only (was plan §1)
+**Trade-off honest:** one AES-GCM decrypt per inbound POST (microseconds) vs the HMAC verification + DB lookup already on that hot path (milliseconds). The decrypt is negligible.
-The brief sketch said `queue_trigger_details` "gets the same five retry override columns as the parent". The parent already has them. Duplicating would split the source of truth.
+**Verdict: accept the deviation.** Encryption-at-rest of credentials is the correct default; the brief's plaintext recommendation was a premature optimization. The agent took the right path. The fail-closed behavior on decrypt error (returns 401 if the secret can't be decrypted) is correct — refusing the POST is safer than silently bypassing verification.
-**Verdict: accept; the brief was wrong here.** Single source of truth on the parent is correct. The agent surfaced this per discipline reminder #2.
+### 3.3 Latent finding: clippy `--all-targets` regression (HANDBACK §10 #1)
-### D4. `Limits::trigger_depth_max` (was plan §5)
+This is the most important finding in this review.
-Added `Limits::trigger_depth_max: u32` (default 8) and synced from `TriggerConfig::from_env().max_trigger_depth` in the picloud binary. `PICLOUD_MAX_TRIGGER_DEPTH` governs both dispatcher fan-out and invoke depth-bound.
+The agent verified by stashing v1.1.7 work and re-running clippy on v1.1.6 HEAD with `--all-targets --all-features -- -D warnings` — four pre-existing warnings surfaced:
 - `double_must_use` on `realtime_router`
 - `map_unwrap_or` in `pubsub_service`
 - `redundant_closure` in `topic_repo`
 - `needless_raw_string_hashes` in a subscriber-token test
-**Verdict: accept.** Right level of abstraction — depth check inside `Engine` doesn't reach into `TriggerConfig`.
+The warnings landed in v1.1.6 itself (the realtime_router was new). The clippy gate v1.1.6 claimed to pass (and that I personally re-ran during the v1.1.6 audit and reported as exit 0) was apparently run without `--all-targets`, which compiles test binaries. Test-only clippy warnings escape.
-### D5. One-consumer-per-queue via advisory lock
+**This is a real audit oversight.** My v1.1.6 REVIEW.md §1 reported `cargo clippy --all-targets --all-features -- -D warnings ✅ exit 0`. Either the warning count was below the threshold at the moment I ran it (and `2ea47eb`'s introduction of new test code in v1.1.7 tipped it over), or I genuinely missed the warnings. Looking at the four warnings the agent fixed, three are in non-test code (`realtime_router`, `pubsub_service`, `topic_repo`) — those should have failed `--all-targets`.
-Partial unique index across `triggers.app_id` and `queue_trigger_details.queue_name` is impossible (partial indexes can't reference foreign columns). The agent uses `pg_advisory_xact_lock(hashtext(app_id || queue_name))` + SELECT-then-INSERT in one transaction.
+**Most likely explanation:** the clippy run during the v1.1.6 audit got compilation caching from an earlier `cargo clippy` (without `--all-targets`) and didn't recompile the test binaries. Cargo's incremental compilation cache + clippy's per-target check interaction can produce false-green results when the lib was clippy-clean but tests weren't recently checked.
-**Verdict: accept.** The xact-scoped advisory lock is auto-released on commit/rollback. Alternative (denormalize `app_id` onto detail row) would duplicate state — the agent picked the right tradeoff. Verified by `queue_e2e::queue_one_consumer_per_queue_rejected`.
+**Action for the v1.1.8 prompt:** require a clean build before clippy:
-### D6. `invoke()` exposed globally (not `invoke::*`)
+```sh
 cargo clean -p picloud-manager-core picloud-orchestrator-core picloud-executor-core picloud-shared picloud
 cargo clippy --all-targets --all-features -- -D warnings
 ```
-The brief itself spelled `invoke(target, args)` not `invoke::call(target, args)`. Registered via `engine.register_global_module(...)`.
+Or simpler: use `cargo clippy --workspace --all-targets --all-features --no-deps -- -D warnings` and verify that the test binary count matches what cargo says it compiled.
-**Verdict: accept; the brief was self-consistent here.** Scripts write `invoke("worker", #{...})` which matches the brief example.
+The agent fixed all four warnings in `2ea47eb` and gated v1.1.7 against the re-verified `--all-targets` baseline. Future audits should follow suit.
 ### D7. `invoke_async` runs once (synthetic `retry_max_attempts = 1`)
 Per the brief: "**NO — `invoke_async` runs once.** Callers who want retries wrap in `retry::with` instead." Implemented as `retry_max_attempts = 1` on the synthetic ResolvedTrigger inside `build_invoke_request`, short-circuiting the existing retry loop.
 **Verdict: accept.** Surfaced misfires through the dead-letter path; callers retain explicit retry control via `retry::run`.
 ## 4. Substantive strengths
-**1. The `Engine::self_weak` re-entrancy mechanism is exemplary.** `Weak<Engine>` in a `OnceLock<...>`, set by the picloud binary right after `Arc::new(Engine::new(...))`, upgraded on demand by `self_arc()`. The bridge gets `None` only on engine drop (shutdown). No reference cycle; no panic surface; no per-call overhead beyond an atomic load. Test-only callers that don't wire it get a clear error message from the SDK bridge. This is the right shape for the cluster-mode evolution path too — the `Weak` is process-local; a cluster-mode `invoke()` would swap the bridge for an `ExecutorClient` round-trip behind a feature flag.
+**1. The §8 attestation discipline lesson landed cleanly.** v1.1.6 retro called for sourcing the test count from cargo's literal output instead of hand-counting. The v1.1.7 HANDBACK §8 includes the literal awk command + the verified count of 617. My independent re-run matches exactly. Discipline working as designed.
-**2. Cross-app `invoke()` isolation has three layers.** Repo (`get_by_name` takes explicit `app_id`), service (`resolve_id` checks `script.app_id != cx.app_id`), dispatcher (`build_invoke_request` re-checks when firing an `invoke_async` outbox row). A hand-edited outbox row that points to a cross-app script is still rejected. The v1.1.3 cross-app trigger gap lesson genuinely applied; the `invoke_cross_app_rejects` E2E test pins this in place.
+**2. Encryption infrastructure correctly built.** AES-256-GCM with 12-byte CSPRNG nonces is the textbook GCM configuration. Auth tag appended (RustCrypto Aead trait standard). `Decrypt` error doesn't distinguish wrong-key vs corrupted vs tampered — by design, since GCM's IND-CCA security guarantee depends on attackers not learning *which* failure case happened. `MasterKey`'s redacted `Debug` impl prevents accidental log-leaks. Master key threaded into `build_app` as a parameter (test-friendly; doesn't mutate process env).
-**3. Queue claim + ack + nack are correctly lease-token-keyed.** Both `ack` and `nack` filter `WHERE id = $1 AND claim_token = $2`. A stale dispatcher whose visibility-timeout expired and lost its lease cannot accidentally delete or re-defer a re-claimed message. The reclaim task's UPDATE...FROM JOIN against the live `(triggers, queue_trigger_details)` set ensures only enabled queue consumers' messages are reclaimed. Race-free in the strong sense.
+**3. Dead-letter handler fix is faithful and adequately tested.** Six releases of silently-broken triggers, finally connected. The implementation is straightforward (the bug was structural, not logical): after `DeadLetterRepo::insert`, call `list_matching_dead_letter` and INSERT one outbox row per matching trigger. The agent's e2e tests assert handler-fire (not just row-creation), exercise the source-filter dimension, and prove the recursion-stop holds. The retroactive CHANGELOG note from the v1.1.7 prompt is in place.
-**4. The dispatcher gate-saturation handling for the queue arm.** When the gate is full, the queue arm immediately nacks-with-100ms-delay, keeping the lease accounting consistent and letting the next tick re-claim cleanly. This mirrors the outbox arm's reschedule semantics exactly — symmetric load-shed across both event-firing paths.
+**4. Two-phase realtime key migration done right.** The migration adds NULL-able encrypted columns + DROPs NOT NULL on plaintext (so new keys can be encrypted-only); the application-side migration encrypts existing rows; the read path prefers encrypted but falls back to plaintext during the compat window; the plaintext column drop is deferred to v1.1.8 (documented in CHANGELOG + the migration header). Operator-friendly: rolling deploys work cleanly.
-**5. `retry::policy` clamping is saturating + transparent.** `max_attempts ∈ [1, 20]`, `base_ms ∈ [1, 60_000]`, `jitter_pct ∈ [0, 100]`. Bogus backoff strings surface a clear error pointing at the three valid values. Deterministic jitter via `DefaultHasher` over `(span, raw)` avoids pulling `rand` into the hot path — correctness-equivalent for retry purposes.
+**5. Inbound email as webhook receiver was the right architectural call.** Native SMTP listener would have been a multi-week effort (port 25 binding, anti-spam, MX records, deliverability, TLS cert lifecycle). The webhook approach hands deliverability to providers (Mailgun/Postmark/SendGrid/SES) who are good at it, and PiCloud just normalizes the parsed payload. Reasonable v1.1.7 scope.
-**6. The 20-commit split is exemplary, again.** Migration → types → repo → service → SDK → dispatcher arm → next service (invoke) → next dispatcher arm → next SDK (retry) → admin HTTP → dashboard → tests → F4 dedup → version bumps → schema bless → test fixes → clippy clean → docs. Each commit independently green. Best commit hygiene of any v1.1.x release alongside v1.1.7 + v1.1.8.
+**6. Disabled-mode for outbound SMTP.** When SMTP env vars aren't set, every `send` throws `NotConfigured` cleanly. The brief specified this; the agent implemented it cleanly. Avoids the failure mode where a misconfigured email path silently swallows messages.
-**7. Integration test density target met in full (F1).** Four new DB-gated binaries (15 tests), exactly the names the brief specified as non-negotiable. The `queue_visibility_timeout_reclaim` test actually exercises the reclaim by mutating `claimed_at` to simulate a crashed consumer — that's the load-bearing semantic, not a smoke test.
+**7. The agent caught and surfaced the v1.1.6 clippy regression.** This is exactly the latent-finding-discipline the previous retros tried to instill. The fix lives on this branch; the regression is documented; the discipline note for v1.1.8 is the only follow-up.
 ## 5. Open questions answered
-HANDBACK §9 raises four:
+HANDBACK §9 raises three:
-1. **`retry::run` rename acceptable?** Yes. `run` is clear and unambiguous in this context. `attempt` would have been a contender but reads worse with closures. No change needed.
+1. **§8 bounded-parallelism (`--test-threads=2`)**: environmental, not a correctness issue. Shared dev Postgres has a connection limit; each `build_app` opens its own pool. CI's dedicated Postgres doesn't hit this. **Accept as-is.** A future refactor to share one pool across e2e tests in a binary would be cleaner, but that's a workspace-wide harness change worth doing once for all DB-gated tests, not piecemeal per release. Defer to a dedicated e2e-harness pass.
-2. **`invoke()` path-resolution method.** Defaulted to POST→GET fallback. Acceptable for v1.1.9; method-aware resolution is a v1.2 ergonomics item (per HANDBACK §11 deferred list).
+2. **`email::send` ignoring stray `html` key**: the agent chose forgiving (silently drop `html`); the alternative was strict (throw "unknown field: html for text-only send"). **My read: forgiving is fine.** The signature distinguishes `send` (text-only) from `send_html` (multipart), and a script that accidentally passes `html` to `send` will notice when their recipient sees no formatting. Strict-throwing is also defensible; not worth changing.
-3. **`ctx.trigger_depth` not in `ctx` map.** The depth value IS threaded through `SdkCallCx` correctly (verified by `invoke_depth_limit_exceeds_cleanly`). Surfacing it into Rhai's `ctx` map is a 5-line addition for v1.2.
+3. **Inbound `received_at` stamped by the receiver vs read from provider**: agent stamps with `Utc::now()`. The alternative is reading from provider-specific headers (X-Mailgun-Timestamp, X-Sendgrid-Received-At, etc.), which requires provider unmarshallers that v1.1.7 deferred to v1.2. **Accept as-is.** Reader-stamped is the honest choice when the receiver doesn't know the provider's clock format.
 4. **Cluster-mode reclaim coordination.** Out of scope per the brief; v1.3+ cluster work will need advisory-lock coordination for the reclaim task.
 ## 6. Smaller observations
- **L1 — pre-existing clippy lints surfaced during F3.** Six lints (two on new v1.1.9 code, four on new v1.1.9 SDK paths) — all fixed in `c3baa87 chore(v1.1.9): clippy clean`. Honest call; the lints were latent until the agent ran clippy properly per F3.
+- **`build_app` signature gained `MasterKey` parameter (HANDBACK §7 #3).** Threading the key in from `main.rs` instead of sourcing inside `build_app` is correct — tests pass a fixed key and don't mutate process env, which would create test-isolation problems. The 3 existing `build_app` test callers were updated.
- **L2 — dashboard pre-existing Playwright errors (149)** in `tests/e2e/**/*.spec.ts`. Same as v1.1.8; not v1.1.9's concern.
+- **Email trigger retry defaults (HANDBACK §7 #5).** Standard async defaults (3 attempts, exponential, 1000 ms). Matches kv/docs/files/cron/pubsub. Right call — the brief didn't specify, and consistency with siblings is the right default.
- **`InvokeServiceImpl` constructor signature is 3 args** — well below the 10-arg threshold that triggers builder-pattern temptation. Clean.
+- **The 10-commit split is exemplary.** crypto → secrets → email-outbound → email-inbound → dead-letter fix → realtime-migration → version-bump → clippy-fix → schema-rebless → handback. Each commit independently green. Best commit hygiene in any v1.1.x release.
 - **Closures-across-`invoke()` rejected at the bridge** with a clear error per HANDBACK §12. Right call — captured environments don't translate across `SdkCallCx` boundaries.
 ## 7. Versioning audit
 | File | Before | After | Status |
 |---|---|---|---|
-| Workspace `Cargo.toml` | 1.1.8 | 1.1.9 | ✅ |
+| Workspace `Cargo.toml` | 1.1.6 | 1.1.7 | ✅ |
-| SDK schema (`shared/src/version.rs`) | 1.9 | 1.10 | ✅ Public surface added: `QueueService`, `queue::*`, `invoke()`, `invoke_async()`, `retry::*`, `ctx.event.queue`, `TriggerEvent::Queue` |
+| SDK schema (`shared/src/version.rs`) | 1.7 | 1.8 | ✅ correctly bumped — `SecretsService`, `EmailService`, `MasterKey`, `crypto::{encrypt, decrypt}`, `TriggerEvent::Email` added to public surface |
-| Dashboard `package.json` | 0.14.0 | 0.15.0 | ✅ |
+| Dashboard `package.json` | 0.12.0 | 0.13.0 | ✅ |
-| `@picloud/client` | 1.0.0 | 1.0.0 | ✅ (no client work this release, per brief) |
+| Migrations | 0001..0022 | 0023..0025 added | ✅ sequential, no skips |
-| Migrations | 0001..0033 | 0034..0035 added | ✅ Sequential |
+| CHANGELOG.md | v1.1.6 entry | v1.1.7 entry + retroactive dead_letter security note | ✅ Per prompt |
 | CHANGELOG.md | v1.1.8 entry | v1.1.9 entry (no upgrade constraint — pure additive) | ✅ |
 ## 8. Recommended next steps (post-merge)
-1. **Merge** `feat/v1.1.9-queues-invoke` into `main` (fast-forward; branch is linear ahead).
+1. **Merge** `feat/v1.1.7-secrets-email` into `main` (fast-forward; branch is linear ahead).
 2. **`docker compose down` when convenient** to tear down the dev Postgres container.
-3. **End of v1.1.x.** v1.2 (Workflows & Hierarchies — DAG execution, advanced docs query, interceptors, read triggers, audit log, script-mediated realtime auth, `dead_letters::list`, client-lib type codegen) is the next phase milestone.
+3. **Pause** before dispatching v1.1.8 (User Management).
-4. **For v1.2 design intake**, fold in:
+4. **For the v1.1.8 dispatch prompt**, fold in:
-   - **`ctx.trigger_depth` surface in the Rhai `ctx` map** (5-line addition per HANDBACK §9 #3).
+   - **Drop the plaintext `realtime_signing_key` column** (the v1.1.7 phase-2 commitment). Pre-flight check: scan the column for any remaining non-NULL rows; if found, run the encryption migration before the drop migration. Add a CHANGELOG note that v1.1.8 requires v1.1.7 to have been applied first (no skipping versions).
-   - **`invoke()` method-aware route resolution** (POST→GET fallback today; explicit method arg per HANDBACK §9 #2).
+   - **Clippy --all-targets discipline refinement** (§3.3 finding). Require either a `cargo clean` before `cargo clippy --all-targets` OR explicit verification that test binaries are being checked. v1.1.6's silent regression shows the gate can produce false-green results under cargo's incremental cache. Specific recommendation: add a CI step that asserts the clippy run touched the test binaries (e.g. count `Checking` lines in the output and verify they include test crates).
-   - **AST cache reuse across `invoke()` calls** (D2 deferred optimization).
+   - **`auth_mode = 'session'` for realtime subscriber tokens** — v1.1.7's CHECK constraint on `topics.auth_mode` only allows `('public', 'token')`. v1.1.8 (users::*) needs to add `'session'` and a session-token validator alongside the existing HMAC validator behind the unchanged `RealtimeAuthority` trait.
-   - **Permission matrix design for `users::*` roles** — v1.1.8 follow-up that's been waiting for the v1.2 design conversation.
+   - **Bounded e2e parallelism** — defer the workspace-wide harness refactor (shared pool per binary) until there's a dedicated test-infra release. Until then, CI just needs `--test-threads=2` or smaller for the picloud crate's e2e binaries.
-   - **Queue mutating admin endpoints** (purge, requeue, delete-message) — needs a payload-viewer UX story.
+5. **Awareness from §3.3**: the clippy regression in v1.1.6 was caught by v1.1.7's diligence, but every prior REVIEW.md from v1.1.1 onward should be re-checked if you want certainty that no test-only clippy warnings slipped through. The fix is forward-only — re-running clippy on v1.1.1 through v1.1.6 commits would just confirm the warnings were latent then too.
 5. **For v2 design intake, archive `docs/v1.1.x-design-notes.md`** — every section's decisions have shipped (the doc's own lifecycle note says "Document deleted when v1.1.9 ships").
 Branch is ready for merge. Verdict: **APPROVE**.
--- a/SECURITY_AUDIT.md
+++ b/SECURITY_AUDIT.md
@@ -1,195 +0,0 @@
 # PiCloud Security Audit — 2026-06-11
 10 parallel focused subagents reviewed the codebase at `main` (post-v1.1.9, pre-v1.2) for vulnerabilities in their assigned category. Each agent wrote a detailed findings file under [`security_audit/`](security_audit/); this document is the rollup.
 ## Scope and method
 Each agent traced specific code paths end-to-end, cited file + line, classified by severity, and recommended a concrete fix. The audit covers **the platform as deployed in single-node MVP mode** (`picloud` binary + Caddy + Postgres + dashboard SPA). Cluster mode (`picloud-manager` / `-orchestrator` / `-executor` skeleton crates) is explicitly out of scope and surfaced only where it would silently degrade a current defense.
 Severity rubric:
 - **Critical** — exploitable now by a low-privilege or anonymous attacker, with high impact (RCE, full takeover, cross-tenant data breach).
 - **High** — realistic exploit under normal deployment; privilege escalation, session hijack, easy DoS on the host.
 - **Medium** — defense-in-depth gap that becomes important under a second flaw; missing cap/quota that matters at scale.
 - **Low** — hardening; small impact even if exploited.
 - **Info** — observation worth recording, not a vulnerability.
 ## Totals
 | # | Agent | C | H | M | L | I | Findings file |
 |---|---|---|---|---|---|---|---|
 | 01 | AuthN, session & token lifecycle | 0 | 2 | 6 | 4 | 5 | [01_authn_session.md](security_audit/01_authn_session.md) |
 | 02 | Authorization & cross-app isolation | 0 | 1 | 4 | 4 | 4 | [02_authz_isolation.md](security_audit/02_authz_isolation.md) |
 | 03 | Cryptography & secret handling | 0 | 2 | 5 | 3 | 6 | [03_crypto_secrets.md](security_audit/03_crypto_secrets.md) |
 | 04 | Injection & query safety | 0 | 0 | 5 | 4 | 9 | [04_injection.md](security_audit/04_injection.md) |
 | 05 | Rhai sandbox & script execution | 0 | 4 | 6 | 5 | 4 | [05_sandbox_exec.md](security_audit/05_sandbox_exec.md) |
 | 06 | File storage & path traversal | 0 | 2 | 4 | 4 | 2 | [06_files_pathtraversal.md](security_audit/06_files_pathtraversal.md) |
 | 07 | HTTP, CORS, CSRF & frontend XSS | **2** | 3 | 4 | 3 | 2 | [07_http_cors_csrf_xss.md](security_audit/07_http_cors_csrf_xss.md) |
 | 08 | DoS, rate limiting & resource exhaustion | 0 | 5 | 7 | 6 | 3 | [08_dos_resource.md](security_audit/08_dos_resource.md) |
 | 09 | External integrations (SSRF, webhooks) | 0 | 1 | 3 | 3 | 4 | [09_external_integrations.md](security_audit/09_external_integrations.md) |
 | 10 | Information disclosure, logging, CLI | 0 | 2 | 4 | 4 | 5 | [10_info_disclosure_cli.md](security_audit/10_info_disclosure_cli.md) |
 | | **Total (raw)** | **2** | **22** | **48** | **40** | **44** | |
 A few findings show up in multiple agents (stored-XSS-via-uploads, dashboard-token-in-localStorage). De-duplicated below.
 ## Headline
 - The **boundaries that matter most are intact**. SDK `SdkCallCx.app_id` discipline is held end-to-end (agent 2 traced two SDK paths Rhai→SQL and confirmed no script-controlled `app_id` enters the chain). SQL is parameterized cleanly across 75 dynamic call-sites (agent 4). Argon2id parameters, RNG selection, and constant-time HMAC verification are correct everywhere it matters (agents 1 and 3). SSRF defenses (link-local block + DNS-rebinding + redirect re-resolve + cross-origin `Authorization` scrub) are unusually thorough and verified end-to-end (agent 9). No `unsafe` blocks exist in `executor-core` or `orchestrator-core`; no sandbox-escape was found (agent 5).
 - The **gaps cluster in HTTP-layer hardening and resource limits**. There is effectively no defense-in-depth at the HTTP boundary (no CSP, no nosniff, no HSTS, no X-Frame-Options) and effectively no rate limiting on anonymous-reachable endpoints (login, email-inbound, fan-out triggers). The combination of cookie-auth + co-hosted user-route HTML + bare admin headers is what creates the two **Critical** findings.
 ## Critical findings
 ### C-1. Same-origin CSRF on `/api/v1/admin/*` via `SameSite=Lax` cookie + co-hosted user-route HTML
 Agent 7 → [C07-01](security_audit/07_http_cors_csrf_xss.md#c07-01-critical--same-origin-csrf-on-admin-api-via-samesitelax-cookie--user-route-surface).
 `POST /auth/login` ([crates/manager-core/src/auth_api.rs:229](crates/manager-core/src/auth_api.rs#L229)) sets `picloud_session=...; HttpOnly; Secure; SameSite=Lax`. The auth middleware ([auth_middleware.rs:91, 359](crates/manager-core/src/auth_middleware.rs#L91)) accepts the cookie as a fallback to `Authorization: Bearer`. User scripts serve arbitrary HTML on the same origin as the admin API (Caddyfile catch-all). `SameSite=Lax` does **not** block same-origin requests, so any user with `AppScriptsWrite` who publishes a script at e.g. `/evil` can host a page that POSTs to `/api/v1/admin/...` and the admin's cookie rides along.
 **Fix**: drop the cookie auth path on `/api/v1/admin/*` (the dashboard already uses bearer tokens), **or** require both the cookie and a synchronizer-token header on state-changing methods.
 ### C-2. Stored XSS via uploaded files served `inline` with no `nosniff`/CSP under the admin origin
 Agent 7 → [C07-02](security_audit/07_http_cors_csrf_xss.md#c07-02-critical--stored-xss-on-admin-origin-via-uploaded-files-served-inline-with-no-nosniff), agent 6 → [F-FS-001](security_audit/06_files_pathtraversal.md#f-fs-001--missing-mime-allowlist-enables-stored-xss-via-content-disposition-inline-on-the-admin-download-endpoint) (joint).
 `GET /apps/{id}/files/{collection}/{file_id}` ([files_api.rs:130-164](crates/manager-core/src/files_api.rs#L130-L164)) streams blob bytes with `Content-Disposition: inline; filename="..."`, the **user-supplied** `Content-Type`, no `nosniff`, no CSP. `NewFile::validate` only caps `content_type` length, no allowlist. A Rhai script (anonymous-callable HTTP route is enough) can stash an `image/svg+xml` or `text/html` blob; when an operator clicks Download in the dashboard, the file renders **same-origin** with the admin session cookie attached → session hijack.
 **Fix (response side, owned by agent 7's recommendation)**: serve all download responses with `Content-Disposition: attachment`, `X-Content-Type-Options: nosniff`, and `Content-Security-Policy: default-src 'none'; sandbox; frame-ancestors 'none'`. Ideally serve file blobs from a distinct origin (`files.<host>`). **Fix (storage side, agent 6)**: maintain a small MIME allowlist at `NewFile::validate` / `FileUpdate::validate`; force `application/octet-stream` on unknown types.
 ## High-severity findings (22, grouped by theme)
 ### HTTP hardening (4)
 Both Criticals would be partially mitigated by these alone:
 - **H-A1.** No CSP anywhere — [agent 7 H07-03](security_audit/07_http_cors_csrf_xss.md#h07-03-high--no-content-security-policy-anywhere) (`caddy/Caddyfile{,.prod}`, `docker/dashboard.Dockerfile:28`).
 - **H-A2.** No `X-Frame-Options` / `frame-ancestors` → dashboard is clickjackable — [agent 7 H07-04](security_audit/07_http_cors_csrf_xss.md#h07-04-high--no-x-frame-options--frame-ancestors-dashboard-clickjackable).
 - **H-A3.** No HSTS in production Caddyfile — [agent 7 H07-05](security_audit/07_http_cors_csrf_xss.md#h07-05-high--no-hsts-in-production-caddyfile).
 - **H-A4.** Dashboard stores bearer token in `localStorage` (XSS-readable) — [agent 10 H1](security_audit/10_info_disclosure_cli.md#h1--dashboard-bearer-token-stored-in-localstorage-xss-readable) / [agent 1 Medium](security_audit/01_authn_session.md) / [agent 7 L07-12](security_audit/07_http_cors_csrf_xss.md#l07-12-low--dashboard-token-in-localstorage). Listed here because the CSP gap (H-A1) is what blocks the cheap fix. Agent 7 calls it Low **because** CSP is the upstream remediation.
 Agent 7 ships a ready-to-paste Caddyfile snippet covering all four.
 ### DoS / resource exhaustion on anonymous-reachable surfaces (5)
 - **H-B1.** Login endpoint has no rate limit; Argon2id per attempt → an anonymous attacker can pin every `spawn_blocking` worker on Argon2 in seconds on Pi-class hardware. [agent 8 H-2](security_audit/08_dos_resource.md#h-2--login-endpoint-has-no-rate-limit-argon2id-is-the-work-multiplier), confirmed by [agent 1](security_audit/01_authn_session.md).
 - **H-B2.** Email-inbound webhook accepts unsigned POSTs when `inbound_secret` is absent; with a secret configured there's still no per-`(app_id, trigger_id)` bad-signature bucket. [agent 8 H-3](security_audit/08_dos_resource.md#h-3--email-inbound-webhook-has-no-ip-rate-limit-hmac-is-optional), [agent 9 F-EXT-M-001](security_audit/09_external_integrations.md#f-ext-m-001--email-inbound-webhook-accepts-unsigned-posts-when-inbound_secret-is-none).
 - **H-B3.** No per-app cap on trigger / route / cron registration; one tenant can register thousands of cron rows or fan-out triggers and stall the node. [agent 8 H-4](security_audit/08_dos_resource.md#h-4--no-per-app-cap-on-trigger--route--cron-registration).
 - **H-B4.** `cron_scheduler::tick` does `fetch_all` with no `LIMIT`, serially fires every due row inside one transaction. [agent 8 H-5](security_audit/08_dos_resource.md#h-5--cron-scheduler-tick-is-unbounded-fetch_all-one-slow-row-blocks-all).
 - **H-B5.** Axum's default 2 MB body limit applies to email-inbound + admin JSON handlers; only the user-route handler ([orchestrator-core/src/api.rs:219](crates/orchestrator-core/src/api.rs#L219)) is explicit at 10 MiB. No Caddy `request_body { max_size }`. [agent 8 H-1](security_audit/08_dos_resource.md#h-1--no-axum-default-body-limit).
 ### Rhai sandbox (4)
 - **H-C1.** `tokio::time::timeout` over `JoinHandle` does **not** cancel `spawn_blocking` — a runaway script holds its OS thread until the op-budget self-exhausts. The code's own comment admits this. One anonymous script call can permanently subtract a worker from the blocking-thread pool. [agent 5 F-SE-H-01](security_audit/05_sandbox_exec.md#f-se-h-01--tokiotimetimeout-over-joinhandle-does-not-cancel-a-spawn_blocking-task-runaway-script-keeps-its-os-thread-until-self-completion). **Fix**: install `engine.on_progress` with a deadline check.
 - **H-C2.** SDK service calls (kv/docs/files/secrets/pubsub/queue/users/email/http/invoke) have **no per-execution count cap**. One script can chain 1 M kv reads, N file writes, N emails. [agent 5 F-SE-H-02](security_audit/05_sandbox_exec.md#f-se-h-02--sdk-service-calls-kvdocspubsubqueuesecretsfilesusersemailhttpinvoke-are-not-rate-limited-per-execution-one-invocation-can-issue-unbounded-io).
 - **H-C3.** `engine.disable_symbol("print")` but **not** `debug` — the latter writes attacker-controlled bytes to stderr (operator logs). [agent 5 F-SE-H-03](security_audit/05_sandbox_exec.md#f-se-h-03--print-is-disabled-but-debug-is-not-rhais-debug-writes-to-stderr-by-default-and-the-comment-claims-both-are-disabled).
 - **H-C4.** `ExecError::Runtime` propagates verbatim Rhai/SDK error strings to the **public** HTTP response body — internal paths, "blocked by SSRF policy: link-local" reconnaissance, Rust backtrace fragments. [agent 5 F-SE-H-04](security_audit/05_sandbox_exec.md#f-se-h-04--execerrorruntime-propagates-verbatim-rhaisdk-error-text-to-the-public-http-response-body-info-disclosure).
 ### Cryptography (2)
 - **H-D1.** `secrets` ciphertext is not bound to `(app_id, name)` as AAD. Anyone with Postgres write access can ciphertext-swap rows across apps or rename-via-row-edit; the decrypt succeeds under the wrong identity, returning attacker-chosen plaintext. Same gap on `app_secrets.realtime_signing_key` and the email-trigger `inbound_secret`. [agent 3 first High + email-trigger Medium + app-secrets Medium](security_audit/03_crypto_secrets.md#high). **Fix**: bind `aad = "secret:{app_id}:{name}"` and analogues; fold into v1.2's planned key-versioning + re-encryption pass.
 - **H-D2.** Dev-key fallback is `SHA-256("picloud-dev-master-key-v1.1.7")` — a leaked dev-mode DB dump is trivially decryptable. The `PICLOUD_DEV_INSECURE_KEY` ack helps but the warning is a single `tracing::warn!`. [agent 3 second High](security_audit/03_crypto_secrets.md#master-key-sourcing-accepts-both-standard-and-url-safe-base64-but-the-dev-key-fallback-is-a-sha-256-of-a-public-string--making-dev-mode-trivially-decryptable-post-hoc).
 ### Authentication & session lifecycle (2)
 - **H-E1.** Dashboard self-password-change does **not** invalidate other live sessions or API keys ([admin_users_api.rs:232-241](crates/manager-core/src/admin_users_api.rs#L232-L241)). CLI `reset-password` and account deactivation both do invalidate; only the in-product UI rotation is silent — the natural reaction to suspected compromise. [agent 1](security_audit/01_authn_session.md#dashboard-self-password-change-does-not-invalidate-other-live-sessions-or-api-keys).
 - **H-E2.** Bootstrap can be re-triggered by hard-deleting all admin rows (`admin_users` is `delete_admin`-hard-DELETE, no soft-delete) when `PICLOUD_BOOTSTRAP_*` env vars are left in compose. [agent 1](security_audit/01_authn_session.md#bearer-token-bootstrap-can-be-re-triggered-by-deleting-all-admins).
 ### Authorization defense-in-depth (1)
 - **H-F1.** The queue-trigger dispatcher ([dispatcher.rs:290-340](crates/manager-core/src/dispatcher.rs#L290-L340)) builds `ExecRequest` with `app_id: claimed.app_id` and `script_id: consumer.script_id` but does **not** cross-check `script.app_id == consumer.app_id` — unlike its sibling `build_invoke_request` (line 752), which does. Safe today by construction (`validate_trigger_target` enforces same-app at write time) but no runtime defense; a hand-edited trigger row or partial backup restore would silently execute one app's script under another app's `SdkCallCx`. Same gap on `build_http_request` (Low). [agent 2](security_audit/02_authz_isolation.md#queue-dispatcher-does-not-assert-scriptapp_id--claimedapp_id).
 ### File storage defense-in-depth (1)
 - **H-G1.** Admin file endpoints (`list_files`, `get_file`, `delete_file`) skip `validate_files_collection`; repo `head`/`get`/`list`/`delete` skip `guard_collection`. Only `create`/`update` validate. Safe today but one bad migration / restore tool can insert a row with `collection = "../../etc"` and the next `get_file` reads arbitrary host files. [agent 6 F-FS-002](security_audit/06_files_pathtraversal.md#f-fs-002--admin-files-api-skips-collection-validation-underlying-headgetlistdelete-skip-the-fs-path-guard-too).
 ### External integrations (1)
 - **H-H1.** `email::send` from scripts has no rate limit. The `EmailRateLimiter` token bucket exists but is wired only into `users_service` (verification / password-reset flows). A public-HTTP-callable script can burn the operator's SMTP quota or BCC-bomb thousands of recipients per request. [agent 9 F-EXT-H-001](security_audit/09_external_integrations.md#f-ext-h-001--emailsend-from-scripts-is-not-rate-limited-operators-smtp-relay-is-a-free-amplifier).
 ### CLI / operator tooling (1)
 - **H-J1.** `pic admins create/set --password VALUE` and `pic login --token VALUE` accept secrets on **argv** — they land in shell history, `ps aux`, and `/proc/<pid>/cmdline`. Help text warns; the flag still works. Also, both `pic admins`' `read_password_from_stdin` and `picloud admin reset-password`'s prompt advertise "no echo" but use `read_line`, which echoes. [agent 10 H2 + M2 + L1](security_audit/10_info_disclosure_cli.md#h2--pic-admins-createset---password-value-accepts-the-password-on-argv).
 ## Mediums and Lows worth surfacing
 Full lists live in each agent's file. Highlights:
 - **Admin sessions have no absolute (hard-cap) expiry** — only sliding TTL — agent 1.
 - **Password change does not require current-password re-verification** — a hijacked session escalates to permanent ownership — agent 1.
 - **`PICLOUD_COOKIE_SECURE=off` accepted silently** even when `PUBLIC_BASE_URL` is HTTPS — agent 1.
 - **`get_script` / `list_routes_for_script` return 404 before authz** → cross-app id enumeration — agent 2.
 - **`routes:check` / `routes:match` trust a body-supplied `app_id`** — agent 2.
 - **Inactive-principal cron jobs never get the trigger disabled** → re-fires on reactivation under reduced privileges — agent 2.
 - **`MasterKey` + decrypted plaintexts never zeroize on drop** — agent 3.
 - **`auth_middleware::resolve_principal` principal-cache is keyed by token-hash with no eviction on logout/password-change/deactivation** — revocation lag bounded only by TTL — agent 3.
 - **`content_type` accepts CRLF** → response-header injection / handler panic on download — agent 4.
 - **`tracing` text-formatter is vulnerable to log forging via script-controlled queue/topic/collection names** — agent 4.
 - **`serde_json::from_str` in `json::parse` SDK and email-inbound has no recursion / size limits** → stack overflow → process kill — agents 4 and 5.
 - **No `max_modules_per_execution` on Rhai imports**; `invoke()` re-entry inherits caller's permits — agent 5.
 - **No per-app quota on files / KV / docs / queue depth / queue count** — agent 6, agent 8.
 - **No `X-Content-Type-Options: nosniff` / `Referrer-Policy` / `Permissions-Policy` / `Cache-Control: no-store`** anywhere — agent 7.
 - **Outbox has no time-based retention sweep**; stuck-claimed rows accumulate — agent 8.
 - **No SSE subscriber cap per IP / app / process** — agent 8.
 - **No global cap on in-flight HTTP connections / slowloris exposure** — agent 8.
 - **HTTP-async retries have no per-target circuit breaker** — agent 8.
 - **`http_service::validate_url` blocks ports 22/25/465/587 but not 23/110/143/993/995/3306/6379** — narrow exploit window but allow-list would be safer — agent 9.
 - **Distinguishable 404s** ("no app claims host" vs "no route matches") enable app enumeration via Host header — agent 10.
 ## Cross-cutting recommendations (priority order)
 Closing these in roughly this order would land the most defensive value per unit work.
 ### Tier 1 — close the Criticals (no schema changes; one PR each)
 1. **Drop cookie auth on `/api/v1/admin/*`** (or require synchronizer token). Closes C-1.
 2. **Force download responses to `Content-Disposition: attachment` + `nosniff` + restrictive CSP on file-serving routes**; add a MIME allowlist at upload validation. Closes C-2. Joint owner: agents 6+7.
 3. **Add the security-header layer to Caddy** (CSP for `/admin/*` and `/api/v1/admin/*`, nosniff everywhere, HSTS in prod, `frame-ancestors 'none'`). Closes H-A1, H-A2, H-A3 and turns H-A4 (localStorage token) from acute to defense-in-depth. Agent 7 ships a ready-to-paste snippet.
 ### Tier 2 — close the highest-leverage Highs
 4. **Login rate limit + global Argon2 semaphore** (H-B1). Cheapest CPU-DoS in the system; pattern already exists in `EmailRateLimiter`.
 5. **Install `engine.on_progress` deadline check** so wall-clock budget actually cancels a runaway Rhai loop (H-C1).
 6. **Bind `aad = "secret:{app_id}:{name}"`** in the AES-GCM seal/open paths for `secrets`, `app_secrets`, and email-trigger inbound secrets (H-D1). Fold into the v1.2 key-versioning pass already on the roadmap.
 7. **Wipe other sessions + revoke all API keys on self-password-change** (H-E1). Mirror `cmd_reset_password`'s behavior.
 8. **Make `inbound_secret` mandatory on email triggers**; add per-`(app_id, trigger_id)` bad-signature token bucket (H-B2).
 9. **Mirror the `script.app_id == row.app_id` cross-check from `build_invoke_request` into queue + HTTP dispatcher arms** (H-F1, plus the Low sibling in `build_http_request`).
 10. **Rate-limit `email::send` from scripts** by moving `EmailRateLimiter` into `EmailServiceImpl` and adding a per-message recipient cap (H-H1).
 ### Tier 3 — Hardening sweep
 11. **Per-app caps**: trigger/route/cron count (H-B3), cron-scheduler `LIMIT 1000` per tick (H-B4), explicit `DefaultBodyLimit` at router root + Caddy `request_body { max_size }` (H-B5).
 12. **Add per-execution SDK counters** to `SdkCallCx` (kv-ops, files, emails, http, pubsub publishes, invoke depth) — closes H-C2 and bounds invoke amplification.
 13. **`engine.disable_symbol("debug")`** — one-line, closes H-C3.
 14. **Scrub `ExecError::Runtime` for unauthenticated callers** — closes H-C4 plus the principal-leak from join-panic strings.
 15. **Belt-and-suspenders collection validation** in repo `head`/`get`/`list`/`delete` and `validate_files_collection` at admin endpoints — closes H-G1.
 16. **Bootstrap sentinel**: replace `count_active() > 0` gate with a persistent `bootstrap_done` marker — closes H-E2.
 17. **Reject `--password VALUE` / `--token VALUE` argv flags**; require `--password -` (stdin). Fix `read_line` → `rpassword::prompt_password` on every echo-claiming prompt. Closes H-J1.
 ### Tier 4 — Quotas and observability (paves the way for v1.2)
 18. **Per-app aggregate quotas**: KV row count, files bytes, queue depth, queue count, docs collection size — agents 6 and 8.
 19. **Absolute (hard-cap) session expiry** on `admin_sessions` mirroring `app_user_sessions` — agent 1.
 20. **Audit-log table** for admin actions (`api_key_minted`, `user_promoted`, `app_deleted`, etc.) — agent 10 I4.
 21. **Outbox GC sweep** + circuit-breaker for HTTP-async retries — agent 8 M-1 / M-5.
 22. **`AAD` migration sweep** + `Zeroize` on `MasterKey` and intermediate decrypted plaintexts — agent 3.
 ## Verified-clean / no-finding observations
 These were investigated and judged adequate for the threat model. Recording so future audits don't re-trace:
 - **SDK `app_id` discipline**. No Rhai-callable service-trait method accepts `app_id` as a side parameter. Two paths (kv::set, dead_letters::replay) traced end-to-end Rhai→SQL — agent 2.
 - **SQL injection**. 75 dynamic `sqlx::query(...)` callsites; all use positional `$N` binds. Two `format!`-into-SQL patterns interpolate hardcoded `const &str` column lists only. The DSL builder (`docs_repo::build_find_query`) binds every user-supplied path segment and value via `QueryBuilder::push_bind` — agent 4.
 - **Argon2id parameters, RNG selection, constant-time HMAC verification, session-token entropy (256 bits via OsRng), timing-flat username enumeration (dummy-hash path)** — agents 1, 3.
 - **SSRF**. Link-local + private-IP block at parse time; DNS-rebinding defense; redirect re-resolution; cross-origin `Authorization` scrub. End-to-end trace from Rhai `http::get` → `validate_url` → `policy.check` — agent 9.
 - **CLI on-disk credentials are mode-0600 enforced** with re-set on each write; unit test pins it — agent 10.
 - **No `{@html}`, `innerHTML`, `eval`, or `Function()` in the dashboard**; no external CDN `<script>` tags; CodeMirror does not evaluate Rhai as JS — agent 7.
 - **`process::Command` confined to test code**; no shell-out from production paths — agent 4.
 - **Migrations are static SQL** — no `EXECUTE format(...)` blocks; schema-snapshot test pins the final shape — agent 4.
 - **No sandbox escape** (no `unsafe` in executor-core / orchestrator-core; no `eval`/`import` reachable from scripts beyond the per-app module resolver; no file/process/network primitives registered) — agent 5.
 - **Caddy admin** is `admin off` in dev, localhost-default in prod; not network-reachable — agent 9.
 - **`/version`** returns only product/sdk/api/schema/wire versions + `public_base_url`; no build SHA, OS, or internal IP. `/healthz` is literally `"ok"` — agent 10.
 ## Per-agent index
 Each file has full findings, recommendations, and traces:
 1. [01_authn_session.md](security_audit/01_authn_session.md) — login flow, password hashing, session tokens, bootstrap, token transport
 2. [02_authz_isolation.md](security_audit/02_authz_isolation.md) — capability gates, `SdkCallCx.app_id`, `resolve_app`, dispatcher fan-out, slug-history
 3. [03_crypto_secrets.md](security_audit/03_crypto_secrets.md) — master key, AES-GCM envelope, secrets/app-secrets/email-trigger seal/open, API keys
 4. [04_injection.md](security_audit/04_injection.md) — SQL, JSONB, log injection, response-header injection, SMTP injection, regex DoS, command injection
 5. [05_sandbox_exec.md](security_audit/05_sandbox_exec.md) — Rhai engine limits, operation budgets, SDK surface, error propagation
 6. [06_files_pathtraversal.md](security_audit/06_files_pathtraversal.md) — files API, on-disk layout, traversal guards, atomic writes, MIME handling
 7. [07_http_cors_csrf_xss.md](security_audit/07_http_cors_csrf_xss.md) — security headers, CORS, CSRF, SPA XSS, cookie/session flags
 8. [08_dos_resource.md](security_audit/08_dos_resource.md) — concurrency caps, rate limits, body limits, fan-out budgets, quota gaps
 9. [09_external_integrations.md](security_audit/09_external_integrations.md) — SSRF, HTTP-async, email inbound/outbound, Postgres TLS, CLI TLS
 10. [10_info_disclosure_cli.md](security_audit/10_info_disclosure_cli.md) — error response bodies, log redaction, CLI token files, dashboard token storage
 ## Notes on remediation methodology
 - Most fixes are mechanical and don't require schema changes — Tier 1 + Tier 2 (items 1-10) can each land as a single focused PR with tests.
 - AAD migration (item 6) needs a startup re-encryption sweep; pair it with the v1.2 key-versioning pass already on the roadmap (memory: [Release state snapshot 2026-06-07](#)).
 - Per-app quotas (item 18) need an `app_quotas` schema migration; defer to v1.2.
 - The audit deliberately did not exercise cluster mode (skeleton crates). The crypto AAD migration and inbound nonce dedup both regress under cluster mode if shipped as-is — call out in the v1.3 readiness checklist.
 - Severity calibration assumes solo-dev / Pi-class hardware. A single anonymous request fully saturating one execution worker for 5 minutes is treated as High, not Low.
--- a/caddy/Caddyfile
+++ b/caddy/Caddyfile
@@ -14,14 +14,7 @@
 #
 # When v2 of the API ships, add `handle /api/v2/admin/* { ... }` etc.
 # alongside the v1 handles, before the catch-all `/api/*` 404.
-#
+{
 # Audit 2026-06-11 (H-A1/2/3, M07-06/07/08/09): defense-in-depth headers.
 # CSP / X-Frame-Options / Permissions-Policy / no-store land on the
 # dashboard SPA and admin API; nosniff + Referrer-Policy land everywhere.
 # User-route responses (catch-all `handle`) deliberately get NO CSP —
 # user scripts own their own response headers by design.
 # `?` operator = "default if missing" so a downstream response (e.g. the
 # file-download endpoint with its own restrictive CSP) wins.
 	auto_https off
 	admin off
 	log {
@@ -32,21 +25,6 @@
 :80 {
 	handle /healthz {
 	# Audit 2026-06-11 (H-1) — hard request-body ceiling at the proxy.
 	# Without this, Caddy forwards bodies up to its multi-GB default to
 	# picloud. 12 MB sits just above the orchestrator's 10 MiB user-route
 	# read so legitimate large invokes pass; admin / email handlers are
 	# bounded far tighter by their own Axum extractor limits.
 	request_body {
 		max_size 12MB
 	}
 	# Baseline headers applied to every response.
 	header {
 		X-Content-Type-Options "nosniff"
 		Referrer-Policy "no-referrer"
 	}
 		reverse_proxy picloud:8080
 	}
 	handle /version {
@@ -55,12 +33,6 @@
 	handle /api/v1/admin/* {
 		reverse_proxy picloud:8080
 		header {
 			?Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; base-uri 'none'"
 			?X-Frame-Options "DENY"
 			?Cache-Control "no-store"
 			?Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()"
 		}
 	}
 	handle /api/v1/execute/* {
 		reverse_proxy picloud:8080
@@ -78,20 +50,10 @@
 	# paths.base = '/admin' so the bundle's URLs already include it.
 	handle /admin/* {
 		reverse_proxy dashboard:80
 		header {
 			?Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
 			?X-Frame-Options "DENY"
 			?Cache-Control "no-store"
 			?Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()"
 		}
 	}
 	handle /admin {
 		# Bare /admin (no trailing slash) — let SvelteKit's SPA handle it.
 		reverse_proxy dashboard:80
 		header {
 			?Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
 			?X-Frame-Options "DENY"
 		}
 	}
 	# Everything else → picloud's user-route fallback. If no route
--- a/caddy/Caddyfile.prod
+++ b/caddy/Caddyfile.prod
@@ -3,15 +3,7 @@
 # Set PICLOUD_DOMAIN and PICLOUD_ADMIN_EMAIL in the environment Caddy is
 # started from (docker-compose.prod.yml passes them through). Caddy then
 # obtains and renews a Let's Encrypt cert automatically for that domain.
-#
+{
 # Audit 2026-06-11 (H-A1/2/3/5, M07-06/07/08/09): defense-in-depth
 # headers. HSTS lands on every prod response. CSP, X-Frame-Options,
 # Permissions-Policy, and Cache-Control: no-store land on the dashboard
 # SPA and admin API. nosniff + Referrer-Policy land everywhere. User-
 # route responses (catch-all `handle`) deliberately get NO CSP — user
 # scripts own their own response headers by design.
 # `?` operator = "default if missing" so downstream responses (e.g. the
 # file-download endpoint with its own restrictive CSP) win.
 	email {$PICLOUD_ADMIN_EMAIL}
 }
@@ -19,22 +11,6 @@
 	encode zstd gzip
 	handle /healthz {
 	# Audit 2026-06-11 (H-1) — hard request-body ceiling at the proxy.
 	# Without this, Caddy forwards bodies up to its multi-GB default to
 	# picloud. 12 MB sits just above the orchestrator's 10 MiB user-route
 	# read so legitimate large invokes pass; admin / email handlers are
 	# bounded far tighter by their own Axum extractor limits.
 	request_body {
 		max_size 12MB
 	}
 	# Baseline headers on every response. HSTS is unconditional in prod.
 	header {
 		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 		X-Content-Type-Options "nosniff"
 		Referrer-Policy "no-referrer"
 	}
 		reverse_proxy picloud:8080
 	}
 	handle /version {
@@ -43,12 +19,6 @@
 	handle /api/v1/admin/* {
 		reverse_proxy picloud:8080
 		header {
 			?Content-Security-Policy "default-src 'none'; frame-ancestors 'none'; base-uri 'none'"
 			?X-Frame-Options "DENY"
 			?Cache-Control "no-store"
 			?Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()"
 		}
 	}
 	handle /api/v1/execute/* {
 		reverse_proxy picloud:8080
@@ -63,19 +33,9 @@
 	handle /admin/* {
 		reverse_proxy dashboard:80
 		header {
 			?Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
 			?X-Frame-Options "DENY"
 			?Cache-Control "no-store"
 			?Permissions-Policy "geolocation=(), camera=(), microphone=(), payment=(), usb=(), accelerometer=(), gyroscope=()"
 		}
 	}
 	handle /admin {
 		reverse_proxy dashboard:80
 		header {
 			?Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
 			?X-Frame-Options "DENY"
 		}
 	}
 	handle {
--- a/clients/typescript/README.md
+++ b/clients/typescript/README.md
@@ -42,12 +42,7 @@ const token = client.auth.token;
 ## React
 ```tsx
-import {
+import { PicloudProvider, useTopic, useEndpoint } from '@picloud/client/react';
  PicloudProvider,
  useTopic,
  useEndpointGet,
  useEndpointPost
 } from '@picloud/client/react';
 // Wrap your tree once: <PicloudProvider client={client}>…</PicloudProvider>
@@ -57,25 +52,11 @@ function ChatRoom({ roomId }: { roomId: string }) {
 }
 function UserProfile({ id }: { id: string }) {
-  // Auto-fires when `id` changes; conforms to Rules of Hooks.
+  const { data, loading, error } = useEndpoint<UserRes>(`/api/users/${id}`).get();
  const { data, loading, error } = useEndpointGet<UserRes>(`/api/users/${id}`);
  if (loading) return <Spinner />;
  if (error) return <ErrorView error={error} />;
  return <div>{data?.name}</div>;
 }
 function CreateUserForm() {
  // Event-driven: NOT fired on mount; call `mutate(body)` on submit.
  const { mutate, loading, error } = useEndpointPost<CreateUserReq, CreateUserRes>(
    '/api/users'
  );
  return (
    <form onSubmit={(e) => { e.preventDefault(); mutate({ name: 'Alice' }); }}>
      <button disabled={loading}>Create</button>
      {error ? <ErrorView error={error} /> : null}
    </form>
  );
 }
 ```
 ## Svelte
--- a/clients/typescript/package-lock.json
+++ b/clients/typescript/package-lock.json
@@ -184,7 +184,6 @@
        }
      ],
      "license": "MIT",
      "peer": true,
      "engines": {
        "node": ">=18"
      },
@@ -208,7 +207,6 @@
        }
      ],
      "license": "MIT",
      "peer": true,
      "engines": {
        "node": ">=18"
      }
@@ -1050,7 +1048,6 @@
      "integrity": "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "@babel/code-frame": "^7.10.4",
        "@babel/runtime": "^7.12.5",
@@ -1120,7 +1117,6 @@
      "integrity": "sha512-3ek6mwJL5/VBewBcY4S66cqlCtK3qi4WIq37Z0m/NHw1hjhI7274Mx1qz/+ggSzyBCOEf7eHjBN6INjPAWYfYw==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "@types/prop-types": "*",
        "csstype": "^3.2.2"
@@ -1689,7 +1685,6 @@
      "dev": true,
      "hasInstallScript": true,
      "license": "MIT",
      "peer": true,
      "bin": {
        "esbuild": "bin/esbuild"
      },
@@ -2005,7 +2000,6 @@
      "integrity": "sha512-8i7LzZj7BF8uplX+ZyOlIz86V6TAsSs+np6m1kpW9u0JWi4z/1t+FzcK1aek+ybTnAC4KhBL4uXCNT0wcUIeCw==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "cssstyle": "^4.1.0",
        "data-urls": "^5.0.0",
@@ -2288,7 +2282,6 @@
      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "engines": {
        "node": ">=12"
      },
@@ -2338,7 +2331,6 @@
        }
      ],
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "nanoid": "^3.3.12",
        "picocolors": "^1.1.1",
@@ -2422,7 +2414,6 @@
      "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "loose-envify": "^1.1.0"
      },
@@ -2436,7 +2427,6 @@
      "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "loose-envify": "^1.1.0",
        "scheduler": "^0.23.2"
@@ -2861,7 +2851,6 @@
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "dev": true,
      "license": "Apache-2.0",
      "peer": true,
      "bin": {
        "tsc": "bin/tsc",
        "tsserver": "bin/tsserver"
@@ -2883,7 +2872,6 @@
      "integrity": "sha512-o5a9xKjbtuhY6Bi5S3+HvbRERmouabWbyUcpXXUA1u+GNUKoROi9byOJ8M0nHbHYHkYICiMlqxkg1KkYmm25Sw==",
      "dev": true,
      "license": "MIT",
      "peer": true,
      "dependencies": {
        "esbuild": "^0.21.3",
        "postcss": "^8.4.43",
--- a/clients/typescript/src/react/index.ts
+++ b/clients/typescript/src/react/index.ts
@@ -60,20 +60,26 @@ export interface QueryState<T> {
  error: unknown;
 }
-export interface MutationState<T> {
+export interface EndpointHook<Req, Res> {
-  data: T | null;
+  get: () => QueryState<Res>;
-  loading: boolean;
+  post: (body?: Req) => QueryState<Res>;
  error: unknown;
 }
 /**
- * F-T-001: flat GET hook. Replaces `useEndpoint(path).get()` which
+ * Typed endpoint hook. `useEndpoint<Res>(path).get()` fires a GET and
- * violated the Rules of Hooks (calling `useState`/`useEffect` from
+ * returns `{ data, loading, error }`, re-running when `path` changes.
- * inside a returned function). Auto-fires once per `path` change and
+ * `.post(body)` is the mutation variant (auto-fires once per mount).
 * re-runs on mount.
 */
-export function useEndpointGet<Res = unknown>(path: string): QueryState<Res> {
+export function useEndpoint<Res = unknown, Req = unknown>(path: string): EndpointHook<Req, Res> {
  const client = usePicloud();
  return {
    get: () => useResource<Res>(() => client.endpoint<Req, Res>(path).get(), path, 'GET'),
    post: (body?: Req) =>
      useResource<Res>(() => client.endpoint<Req, Res>(path).post(body), path, 'POST')
  };
 }
 function useResource<Res>(run: () => Promise<Res>, key: string, method: string): QueryState<Res> {
  const [state, setState] = useState<QueryState<Res>>({
    data: null,
    loading: true,
@@ -82,42 +88,14 @@ export function useEndpointGet<Res = unknown>(path: string): QueryState<Res> {
  useEffect(() => {
    let active = true;
    setState({ data: null, loading: true, error: null });
-    client
+    run()
      .endpoint<unknown, Res>(path)
      .get()
      .then((data) => active && setState({ data, loading: false, error: null }))
      .catch((error) => active && setState({ data: null, loading: false, error }));
    return () => {
      active = false;
    };
    // `run` is recreated each render; key it on path + method instead.
    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [client, path]);
+  }, [key, method]);
  return state;
 }
 /**
 * F-T-001 + F-T-002: event-driven POST hook. Returns
 * `{ mutate, data, loading, error }` — `mutate(body)` fires the POST.
 * Does NOT auto-fire on mount (the previous `useEndpoint(path).post()`
 * shape would create a user / send an email on every render-refresh).
 */
 export function useEndpointPost<Req = unknown, Res = unknown>(
  path: string
 ): MutationState<Res> & { mutate: (body?: Req) => Promise<void> } {
  const client = usePicloud();
  const [state, setState] = useState<MutationState<Res>>({
    data: null,
    loading: false,
    error: null
  });
  const mutate = async (body?: Req) => {
    setState({ data: null, loading: true, error: null });
    try {
      const data = await client.endpoint<Req, Res>(path).post(body);
      setState({ data, loading: false, error: null });
    } catch (error) {
      setState({ data: null, loading: false, error });
    }
  };
  return { ...state, mutate };
 }
--- a/clients/typescript/src/subscribe.ts
+++ b/clients/typescript/src/subscribe.ts
@@ -29,14 +29,6 @@ export function subscribeTopic<T = unknown>(
  let lastEventId: string | undefined;
  let controller: AbortController | null = null;
  let backoffTimer: ReturnType<typeof setTimeout> | null = null;
  // F-T-003: bound the 401-refresh loop. If onTokenExpired keeps
  // returning a token that the server rejects (mis-issued refresh,
  // server-side authz drift, …) we'd otherwise reconnect immediately
  // forever with attempt=0 each iteration — the previous behavior.
  // Three consecutive 401s within the loop give up and surface the
  // error so the caller knows the credential is bad.
  let consecutive401 = 0;
  const MAX_CONSECUTIVE_401 = 3;
  const stop = () => {
    stopped = true;
@@ -69,17 +61,6 @@ export function subscribeTopic<T = unknown>(
    }
    if (res.status === 401) {
      consecutive401 += 1;
      if (consecutive401 >= MAX_CONSECUTIVE_401) {
        opts.onError?.(
          new Error(
            `realtime subscribe stuck in 401-refresh loop (${consecutive401} consecutive); ` +
              'check that onTokenExpired returns a credential the server accepts'
          )
        );
        stop();
        return;
      }
      // Token expired / rejected — try to refresh, else give up.
      const fresh = opts.onTokenExpired ? await opts.onTokenExpired() : null;
      if (fresh) {
@@ -98,10 +79,8 @@ export function subscribeTopic<T = unknown>(
      return;
    }
-    // Connected — reset backoff and the 401 counter; a successful
+    // Connected — reset backoff and stream frames until the body ends.
    // open proves the current credential works.
    attempt = 0;
    consecutive401 = 0;
    try {
      await readStream(res.body, (frame) => {
        if (frame.id !== undefined) lastEventId = frame.id;
--- a/clients/typescript/tests/subscribe.test.ts
+++ b/clients/typescript/tests/subscribe.test.ts
@@ -96,30 +96,4 @@ describe('subscribe', () => {
    await vi.waitFor(() => expect(onError).toHaveBeenCalled());
    unsubscribe();
  });
  it('caps the 401-refresh loop after consecutive failures', async () => {
    // onTokenExpired keeps returning a fresh-looking-but-still-rejected
    // token. Without the cap the loop would reconnect forever.
    const fetchMock = queuedFetch([
      async () => emptyResponse(401),
      async () => emptyResponse(401),
      async () => emptyResponse(401),
      async () => emptyResponse(401),
      async () => emptyResponse(401)
    ]);
    const client = new PicloudClient({ baseURL: 'https://api.test', fetch: fetchMock });
    const onError = vi.fn();
    const onTokenExpired = vi.fn(() => 'never-good-enough');
    const unsubscribe = client.subscribe('chat', () => {}, {
      onTokenExpired,
      onError
    });
    await vi.waitFor(() => expect(onError).toHaveBeenCalled(), { timeout: 1000 });
    unsubscribe();
    // The cap is 3 consecutive 401s — at most 3 fetches should have
    // been issued before the loop bailed.
    expect(fetchMock.mock.calls.length).toBeLessThanOrEqual(3);
    const errMsg = String(onError.mock.calls[0]?.[0]);
    expect(errMsg).toContain('401-refresh loop');
  });
 });
--- a/crates/executor-core/src/engine.rs
+++ b/crates/executor-core/src/engine.rs
@@ -1,52 +1,10 @@
-use std::cell::Cell;
+use std::collections::BTreeMap;
-use std::collections::{BTreeMap, HashMap};
+use std::sync::{Arc, Mutex};
 use std::sync::{Arc, Mutex, OnceLock, Weak};
 use std::time::Instant;
-// Audit 2026-06-11 H-C1 — thread-local deadline consulted by the Rhai
+use chrono::Utc;
 // `on_progress` hook so a runaway script (e.g., `loop {}`) actually
 // terminates instead of holding its `spawn_blocking` OS thread until
 // the per-op budget self-exhausts (which can be tens of seconds). The
 // orchestrator client wraps each `execute*` call in a
 // `DeadlineGuard::set(Some(now + timeout))` so invoke re-entries on the
 // same thread inherit the same deadline.
 thread_local! {
    static CURRENT_DEADLINE: Cell<Option<Instant>> = const { Cell::new(None) };
 }
 /// RAII guard that sets the current-thread deadline for the lifetime of
 /// the guard, restoring whatever was there before on drop.
 ///
 /// Use via [`Engine::execute_with_deadline`] / [`Engine::execute_ast_with_deadline`]
 /// at the orchestrator boundary; SDK invoke re-entries piggyback on the
 /// existing thread-local without touching it.
 pub struct DeadlineGuard {
    prev: Option<Instant>,
 }
 impl DeadlineGuard {
    /// Set the current-thread deadline. Returns a guard whose `Drop`
    /// restores the prior value.
    #[must_use]
    pub fn set(deadline: Option<Instant>) -> Self {
        let prev = CURRENT_DEADLINE.with(|c| c.replace(deadline));
        Self { prev }
    }
 }
 impl Drop for DeadlineGuard {
    fn drop(&mut self) {
        CURRENT_DEADLINE.with(|c| c.set(self.prev));
    }
 }
 fn current_deadline() -> Option<Instant> {
    CURRENT_DEADLINE.with(Cell::get)
 }
 use chrono::{DateTime, Utc};
 use picloud_shared::{
-    ScriptId, ScriptValidator, SdkCallCx, Services, TriggerEvent, ValidatedScript, ValidationError,
+    ScriptValidator, SdkCallCx, Services, TriggerEvent, ValidatedScript, ValidationError,
    SDK_VERSION,
 };
 use rhai::{Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module, Scope, AST};
@@ -86,22 +44,6 @@ pub struct Engine {
    /// `(app_id, name)`; invalidated lazily by `updated_at` mismatch
    /// at resolver time.
    module_cache: Arc<ModuleCache>,
    /// v1.1.9: back-reference set by the picloud binary after
    /// `Arc::new(Engine::new(...))`. The `invoke` SDK bridge reads it
    /// to re-enter the engine synchronously for `invoke()`. `Weak` so
    /// holding the Engine in an Arc doesn't create a strong cycle.
    /// `None` until `set_self_weak` runs; the bridge surfaces a clear
    /// error if invoke is called without the back-reference being set
    /// (which only happens in tests that don't wire it).
    self_weak: OnceLock<Weak<Engine>>,
    /// F-P-004: per-Engine AST cache keyed on `(script_id, updated_at)`.
    /// Populated by `compile_for_identity`; consumed by the SDK invoke
    /// bridge so the synchronous re-entry path doesn't re-parse the
    /// callee on every invoke. Independent of the orchestrator-core
    /// `LocalExecutorClient` AST cache — that one caches HTTP-path
    /// dispatch; this one caches function-call dispatch.
    #[allow(clippy::type_complexity)]
    invoke_ast_cache: Mutex<HashMap<ScriptId, (DateTime<Utc>, Arc<AST>)>>,
 }
 impl Engine {
@@ -125,66 +67,9 @@ impl Engine {
            limits,
            services,
            module_cache: new_module_cache(module_cache_capacity),
            self_weak: OnceLock::new(),
            invoke_ast_cache: Mutex::new(HashMap::new()),
        }
    }
    /// F-P-004: synchronous-invoke fast path. Returns a cached AST when
    /// (script_id, updated_at) matches; otherwise compiles, inserts,
    /// returns. Used by the `invoke` SDK bridge to skip the per-call
    /// parse when one script calls another.
    ///
    /// # Errors
    ///
    /// Propagates `ExecError::Parse` from the inner compile step.
    pub fn compile_for_identity(
        &self,
        script_id: ScriptId,
        updated_at: DateTime<Utc>,
        source: &str,
    ) -> Result<Arc<AST>, ExecError> {
        {
            let cache = self
                .invoke_ast_cache
                .lock()
                .expect("invoke ast cache poisoned");
            if let Some((ts, ast)) = cache.get(&script_id) {
                if *ts == updated_at {
                    return Ok(ast.clone());
                }
            }
        }
        let ast = self.compile(source)?;
        let mut cache = self
            .invoke_ast_cache
            .lock()
            .expect("invoke ast cache poisoned");
        cache.insert(script_id, (updated_at, ast.clone()));
        Ok(ast)
    }
    /// v1.1.9: install the back-reference used by the `invoke` SDK
    /// bridge for synchronous re-entry. Idempotent (subsequent calls
    /// are no-ops). The picloud binary calls this right after
    /// `Arc::new(Engine::new(...))`:
    ///
    /// ```ignore
    /// let engine = Arc::new(Engine::new(limits, services));
    /// engine.set_self_weak(Arc::downgrade(&engine));
    /// ```
    pub fn set_self_weak(&self, weak: Weak<Engine>) {
        let _ = self_weak_set(&self.self_weak, weak);
    }
    /// Internal accessor used by the `invoke` SDK bridge — returns
    /// `Some(strong)` if the back-reference was installed and the
    /// engine is still alive.
    #[must_use]
    pub fn self_arc(&self) -> Option<Arc<Engine>> {
        self.self_weak.get().and_then(Weak::upgrade)
    }
    #[must_use]
    pub fn limits(&self) -> &Limits {
        &self.limits
@@ -229,38 +114,10 @@ impl Engine {
            .map_err(|e| ExecError::Parse(e.to_string()))
    }
    /// Like [`Self::execute`] but also installs `deadline` on the
    /// current thread so the Rhai `on_progress` hook can interrupt a
    /// runaway script before `tokio::time::timeout` fires (which only
    /// drops the future — the OS thread keeps running). Audit
    /// 2026-06-11 H-C1.
    pub fn execute_with_deadline(
        &self,
        source: &str,
        req: ExecRequest,
        deadline: Option<Instant>,
    ) -> Result<ExecResponse, ExecError> {
        let _guard = DeadlineGuard::set(deadline);
        self.execute(source, req)
    }
    /// Like [`Self::execute_ast`] but installs `deadline` on the current
    /// thread. See [`Self::execute_with_deadline`] for the rationale.
    pub fn execute_ast_with_deadline(
        &self,
        ast: &Arc<AST>,
        req: ExecRequest,
        deadline: Option<Instant>,
    ) -> Result<ExecResponse, ExecError> {
        let _guard = DeadlineGuard::set(deadline);
        self.execute_ast(ast, req)
    }
    /// Execute `source` against `req`. Op-budget protection comes from
-    /// Rhai's `set_max_operations`; the wall-clock deadline (when set
+    /// Rhai's `set_max_operations`; wall-clock enforcement is the
-    /// via [`DeadlineGuard`] / [`Self::execute_with_deadline`]) aborts
+    /// caller's responsibility. Per-script sandbox overrides on the
-    /// any per-op step that crosses it. Per-script sandbox overrides on
+    /// request replace the engine's defaults field-by-field; the
    /// the request replace the engine's defaults field-by-field; the
    /// manager already clamped them against the admin ceiling.
    pub fn execute(&self, source: &str, req: ExecRequest) -> Result<ExecResponse, ExecError> {
        let effective_limits = self.limits.with_overrides(&req.sandbox_overrides);
@@ -307,14 +164,7 @@ impl Engine {
            effective_limits.module_import_depth_max,
        );
        engine.set_module_resolver(resolver);
-        let self_engine = self.self_arc();
+        sdk::register_all(&mut engine, &self.services, cx);
        sdk::register_all(
            &mut engine,
            &self.services,
            cx,
            effective_limits,
            self_engine,
        );
        let mut scope = Scope::new();
        scope.push_constant("ctx", build_ctx_map(&req));
@@ -361,12 +211,6 @@ impl ScriptValidator for Engine {
    }
 }
 /// Tiny helper to make the `set_self_weak` body idempotent without
 /// pulling the impl up into the public API.
 fn self_weak_set(slot: &OnceLock<Weak<Engine>>, weak: Weak<Engine>) -> Result<(), Weak<Engine>> {
    slot.set(weak)
 }
 // ----------------------------------------------------------------------------
 // Engine construction
 // ----------------------------------------------------------------------------
@@ -381,35 +225,13 @@ fn build_engine(limits: Limits, logs: Option<Arc<Mutex<Vec<LogEntry>>>>) -> Rhai
    engine.set_max_call_levels(limits.max_call_levels);
    engine.set_max_expr_depths(limits.max_expr_depth, limits.max_expr_depth);
    // Audit 2026-06-11 H-C1 — wall-clock interrupter. Rhai invokes the
    // progress callback once per operation; returning `Some(_)` triggers
    // `ErrorTerminated`, which propagates out of `eval_ast_with_scope`.
    // The deadline is read from a thread-local set by the orchestrator's
    // `execute_with_deadline` / `execute_ast_with_deadline` entry points;
    // `None` (the default) is a no-op so tests, validation, and bare
    // `execute*` callers see the previous behavior.
    engine.on_progress(|_ops| {
        if let Some(deadline) = current_deadline() {
            if Instant::now() >= deadline {
                return Some(Dynamic::UNIT);
            }
        }
        None
    });
    // Reject `import` — scripts cannot pull external modules.
    engine.set_module_resolver(rhai::module_resolvers::DummyModuleResolver);
    // Rhai's built-in `print` and `debug` map to stdout/stderr by
    // default; we never want scripts dumping there directly. Disable
    // them so scripts route all output through `log::*` instead.
    //
    // Audit 2026-06-11 (F-SE-H-03) — `debug` was previously left
    // enabled despite this comment, so a script could write
    // attacker-controlled bytes (control chars, ANSI escapes) into the
    // operator's stderr/journald stream. Disable it to match `print`.
    engine.disable_symbol("print");
    engine.disable_symbol("debug");
    if let Some(logs) = logs {
        engine.register_static_module("log", build_log_module(logs).into());
@@ -485,7 +307,6 @@ fn build_ctx_map(req: &ExecRequest) -> Map {
    let mut request = Map::new();
    request.insert("path".into(), req.path.clone().into());
    request.insert("method".into(), req.method.clone().into());
    let mut headers = Map::new();
    for (k, v) in &req.headers {
@@ -627,24 +448,6 @@ fn trigger_event_to_dynamic(event: &TriggerEvent) -> Dynamic {
            ps.insert("published_at".into(), published_at.to_rfc3339().into());
            m.insert("pubsub".into(), ps.into());
        }
        TriggerEvent::Queue {
            queue_name,
            message,
            enqueued_at,
            attempt,
            message_id,
        } => {
            // `ctx.event.op` is always "receive" for queue (the only op
            // a queue:receive trigger surfaces).
            m.insert("op".into(), "receive".into());
            let mut q = Map::new();
            q.insert("queue_name".into(), queue_name.clone().into());
            q.insert("message".into(), json_to_dynamic(message.clone()));
            q.insert("enqueued_at".into(), enqueued_at.to_rfc3339().into());
            q.insert("attempt".into(), i64::from(*attempt).into());
            q.insert("message_id".into(), message_id.clone().into());
            m.insert("queue".into(), q.into());
        }
        TriggerEvent::Email {
            from,
            to,
--- a/crates/executor-core/src/lib.rs
+++ b/crates/executor-core/src/lib.rs
@@ -19,6 +19,5 @@ pub use module_resolver::{
 };
 pub use sandbox::Limits;
 pub use types::{
-    build_execution_log, ExecError, ExecRequest, ExecResponse, ExecStats, InvocationType, LogEntry,
+    ExecError, ExecRequest, ExecResponse, ExecStats, InvocationType, LogEntry, LogLevel,
    LogLevel,
 };
--- a/crates/executor-core/src/sandbox.rs
+++ b/crates/executor-core/src/sandbox.rs
@@ -30,16 +30,6 @@ pub struct Limits {
    /// Not script-overridable (this is a platform-level guard, not a
    /// per-script knob).
    pub module_import_depth_max: u32,
    /// v1.1.9: hard ceiling on `cx.trigger_depth` (shared between
    /// trigger fan-out and `invoke()` re-entry). The dispatcher uses
    /// `TriggerConfig::max_trigger_depth` for the SAME bound; the
    /// invoke bridge uses this Limits-side mirror to short-circuit
    /// before a DB round-trip. Defaults to 8 (matches
    /// TriggerConfig::conservative); the picloud binary keeps the two
    /// in sync by passing `TriggerConfig::from_env().max_trigger_depth`
    /// through.
    pub trigger_depth_max: u32,
 }
 impl Default for Limits {
@@ -52,7 +42,6 @@ impl Default for Limits {
            max_call_levels: 64,
            max_expr_depth: 64,
            module_import_depth_max: 8,
            trigger_depth_max: 8,
        }
    }
 }
@@ -86,9 +75,6 @@ impl Limits {
            // module_import_depth_max is platform-level — overrides
            // never touch it. Carry through unchanged.
            module_import_depth_max: self.module_import_depth_max,
            // trigger_depth_max is also platform-level (v1.1.9 invoke
            // depth bound mirrors the dispatcher's trigger-depth cap).
            trigger_depth_max: self.trigger_depth_max,
        }
    }
 }
--- a/crates/executor-core/src/sdk/bridge.rs
+++ b/crates/executor-core/src/sdk/bridge.rs
@@ -7,41 +7,8 @@
 //! `sdk_contract.rs::json_round_trip_preserves_nested_shapes` pins the
 //! observable round-trip.
-use rhai::{Dynamic, EvalAltResult, Map};
+use rhai::{Dynamic, Map};
 use serde_json::Value as Json;
 use tokio::runtime::Handle as TokioHandle;
 /// Run an async future inside the synchronous Rhai context.
 ///
 /// `LocalExecutorClient` wraps script execution in `spawn_blocking`, so
 /// the current Tokio runtime is reachable via `Handle::current()`. We
 /// block on it directly; we are NOT calling this from an async task,
 /// so blocking is the correct primitive.
 ///
 /// Prefix each error string with `service` so a script reading the
 /// runtime error message learns which SDK surface threw it.
 ///
 /// # Errors
 ///
 /// Wraps the future's error variant or "no tokio runtime available" in
 /// `EvalAltResult::ErrorRuntime`, suitable to return from a Rhai-
 /// registered fn.
 pub fn block_on<T, E, F>(service: &str, fut: F) -> Result<T, Box<EvalAltResult>>
 where
    F: std::future::Future<Output = Result<T, E>>,
    E: std::fmt::Display,
 {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("{service}: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(format!("{service}: {err}").into(), rhai::Position::NONE).into()
    })
 }
 /// Convert a `serde_json::Value` into a Rhai `Dynamic` suitable for
 /// pushing into a script's scope. Numbers prefer the narrowest type
--- a/crates/executor-core/src/sdk/dead_letters.rs
+++ b/crates/executor-core/src/sdk/dead_letters.rs
@@ -16,9 +16,9 @@
 use std::str::FromStr;
 use std::sync::Arc;
-use super::bridge::block_on;
+use picloud_shared::{DeadLetterError, DeadLetterId, SdkCallCx, Services};
 use picloud_shared::{DeadLetterId, SdkCallCx, Services};
 use rhai::{Engine as RhaiEngine, EvalAltResult, Module};
 use tokio::runtime::Handle as TokioHandle;
 use uuid::Uuid;
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
@@ -33,7 +33,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
                let dl_id = parse_dl_id(id)?;
                let svc = svc.clone();
                let cx = cx.clone();
-                block_on("dead_letters", async move { svc.replay(&cx, dl_id).await })
+                block_on(async move { svc.replay(&cx, dl_id).await })
            },
        );
    }
@@ -47,9 +47,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
                let reason = reason.to_string();
                let svc = svc.clone();
                let cx = cx.clone();
-                block_on("dead_letters", async move {
+                block_on(async move { svc.resolve(&cx, dl_id, &reason).await })
                    svc.resolve(&cx, dl_id, &reason).await
                })
            },
        );
    }
@@ -67,3 +65,20 @@ fn parse_dl_id(s: &str) -> Result<DeadLetterId, Box<EvalAltResult>> {
            .into()
        })
 }
 fn block_on<F>(fut: F) -> Result<(), Box<EvalAltResult>>
 where
    F: std::future::Future<Output = Result<(), DeadLetterError>> + Send,
 {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("dead_letters: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(format!("dead_letters: {err}").into(), rhai::Position::NONE)
            .into()
    })
 }
--- a/crates/executor-core/src/sdk/docs.rs
+++ b/crates/executor-core/src/sdk/docs.rs
@@ -23,11 +23,12 @@
 use std::sync::Arc;
-use picloud_shared::{DocId, DocRow, DocsService, SdkCallCx, Services};
+use picloud_shared::{DocId, DocRow, DocsError, DocsService, SdkCallCx, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use tokio::runtime::Handle as TokioHandle;
 use uuid::Uuid;
-use super::bridge::{block_on, dynamic_to_json, json_to_dynamic};
+use super::bridge::{dynamic_to_json, json_to_dynamic};
 /// Per-call handle captured by the Rhai SDK. Cheap to clone (two Arcs
 /// plus an owned string).
@@ -78,9 +79,7 @@ fn register_create(engine: &mut RhaiEngine) {
        |handle: &mut DocsHandle, data: Map| -> Result<String, Box<EvalAltResult>> {
            let h = handle.clone();
            let json = dynamic_to_json(&Dynamic::from(data));
-            let id = block_on("docs", async move {
+            let id = block_on(async move { h.service.create(&h.cx, &h.collection, json).await })?;
                h.service.create(&h.cx, &h.collection, json).await
            })?;
            Ok(id.to_string())
        },
    );
@@ -92,9 +91,8 @@ fn register_get(engine: &mut RhaiEngine) {
        |handle: &mut DocsHandle, id: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let h = handle.clone();
            let parsed_id = parse_doc_id(id)?;
-            let row = block_on("docs", async move {
+            let row =
-                h.service.get(&h.cx, &h.collection, parsed_id).await
+                block_on(async move { h.service.get(&h.cx, &h.collection, parsed_id).await })?;
            })?;
            Ok(row.map_or(Dynamic::UNIT, |d| Dynamic::from(doc_to_map(&d))))
        },
    );
@@ -106,9 +104,7 @@ fn register_find(engine: &mut RhaiEngine) {
        |handle: &mut DocsHandle, filter: Map| -> Result<Array, Box<EvalAltResult>> {
            let h = handle.clone();
            let json = dynamic_to_json(&Dynamic::from(filter));
-            let rows = block_on("docs", async move {
+            let rows = block_on(async move { h.service.find(&h.cx, &h.collection, json).await })?;
                h.service.find(&h.cx, &h.collection, json).await
            })?;
            Ok(rows
                .iter()
                .map(|d| Dynamic::from(doc_to_map(d)))
@@ -123,9 +119,8 @@ fn register_find_one(engine: &mut RhaiEngine) {
        |handle: &mut DocsHandle, filter: Map| -> Result<Dynamic, Box<EvalAltResult>> {
            let h = handle.clone();
            let json = dynamic_to_json(&Dynamic::from(filter));
-            let row = block_on("docs", async move {
+            let row =
-                h.service.find_one(&h.cx, &h.collection, json).await
+                block_on(async move { h.service.find_one(&h.cx, &h.collection, json).await })?;
            })?;
            Ok(row.map_or(Dynamic::UNIT, |d| Dynamic::from(doc_to_map(&d))))
        },
    );
@@ -138,7 +133,7 @@ fn register_update(engine: &mut RhaiEngine) {
            let h = handle.clone();
            let parsed_id = parse_doc_id(id)?;
            let json = dynamic_to_json(&Dynamic::from(data));
-            block_on("docs", async move {
+            block_on(async move {
                h.service
                    .update(&h.cx, &h.collection, parsed_id, json)
                    .await
@@ -153,9 +148,7 @@ fn register_delete(engine: &mut RhaiEngine) {
        |handle: &mut DocsHandle, id: &str| -> Result<bool, Box<EvalAltResult>> {
            let h = handle.clone();
            let parsed_id = parse_doc_id(id)?;
-            block_on("docs", async move {
+            block_on(async move { h.service.delete(&h.cx, &h.collection, parsed_id).await })
                h.service.delete(&h.cx, &h.collection, parsed_id).await
            })
        },
    );
 }
@@ -199,7 +192,7 @@ fn list_call(
    limit: u32,
 ) -> Result<Map, Box<EvalAltResult>> {
    let h = handle.clone();
-    let page = block_on("docs", async move {
+    let page = block_on(async move {
        h.service
            .list(&h.cx, &h.collection, cursor.as_deref(), limit)
            .await
@@ -239,3 +232,24 @@ fn parse_doc_id(id: &str) -> Result<DocId, Box<EvalAltResult>> {
        .into()
    })
 }
 /// Mirrors `kv.rs::block_on` — Tokio runtime is reachable from inside
 /// the `spawn_blocking` wrapper that owns Rhai execution. Errors
 /// prefix with `"docs: "` so scripts see `docs: forbidden`,
 /// `docs: document not found`, `docs: unsupported operator: …`, etc.
 fn block_on<F, T>(fut: F) -> Result<T, Box<EvalAltResult>>
 where
    F: std::future::Future<Output = Result<T, DocsError>> + Send,
    T: Send,
 {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("docs: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(format!("docs: {err}").into(), rhai::Position::NONE).into()
    })
 }
--- a/crates/executor-core/src/sdk/email.rs
+++ b/crates/executor-core/src/sdk/email.rs
@@ -26,9 +26,9 @@
 use std::sync::Arc;
-use super::bridge::block_on;
+use picloud_shared::{EmailError, OutboundEmail, SdkCallCx, Services};
 use picloud_shared::{OutboundEmail, SdkCallCx, Services};
 use rhai::{Array, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use tokio::runtime::Handle as TokioHandle;
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
    let svc = services.email.clone();
@@ -43,7 +43,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
            email.html = None; // text-only path
            let svc = svc.clone();
            let cx = cx.clone();
-            block_on("email", async move { svc.send(&cx, email).await })
+            block_on(async move { svc.send(&cx, email).await })
        });
    }
@@ -62,7 +62,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
                }
                let svc = svc.clone();
                let cx = cx.clone();
-                block_on("email", async move { svc.send(&cx, email).await })
+                block_on(async move { svc.send(&cx, email).await })
            },
        );
    }
@@ -129,3 +129,22 @@ fn addresses(opts: &Map, key: &str) -> Result<Vec<String>, Box<EvalAltResult>> {
 fn runtime_err(msg: &str) -> Box<EvalAltResult> {
    EvalAltResult::ErrorRuntime(msg.into(), rhai::Position::NONE).into()
 }
 /// Run an `EmailService` future inside the synchronous Rhai context,
 /// mapping any `EmailError` to a Rhai runtime error. Mirrors
 /// `kv::block_on`.
 fn block_on<F>(fut: F) -> Result<(), Box<EvalAltResult>>
 where
    F: std::future::Future<Output = Result<(), EmailError>> + Send,
 {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("email: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(format!("email: {err}").into(), rhai::Position::NONE).into()
    })
 }
--- a/crates/executor-core/src/sdk/files.rs
+++ b/crates/executor-core/src/sdk/files.rs
@@ -23,9 +23,11 @@
 use std::sync::Arc;
-use super::bridge::block_on;
+use picloud_shared::{
-use picloud_shared::{FileMeta, FileUpdate, FilesService, NewFile, SdkCallCx, Services};
+    FileMeta, FileUpdate, FilesError, FilesService, NewFile, SdkCallCx, Services,
 };
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use tokio::runtime::Handle as TokioHandle;
 /// Per-call handle captured by the Rhai SDK. Cheap to clone (two Arcs
 /// plus an owned string).
@@ -82,9 +84,7 @@ fn register_create(engine: &mut RhaiEngine) {
                content_type,
                data,
            };
-            let id = block_on("files", async move {
+            let id = block_on(async move { h.service.create(&h.cx, &h.collection, new).await })?;
                h.service.create(&h.cx, &h.collection, new).await
            })?;
            Ok(id.to_string())
        },
    );
@@ -96,9 +96,7 @@ fn register_head(engine: &mut RhaiEngine) {
        |handle: &mut FilesHandle, id: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let h = handle.clone();
            let id = id.to_string();
-            let meta = block_on("files", async move {
+            let meta = block_on(async move { h.service.head(&h.cx, &h.collection, &id).await })?;
                h.service.head(&h.cx, &h.collection, &id).await
            })?;
            Ok(meta.map_or(Dynamic::UNIT, |m| file_meta_to_map(&m).into()))
        },
    );
@@ -110,9 +108,7 @@ fn register_get(engine: &mut RhaiEngine) {
        |handle: &mut FilesHandle, id: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let h = handle.clone();
            let id = id.to_string();
-            let bytes = block_on("files", async move {
+            let bytes = block_on(async move { h.service.get(&h.cx, &h.collection, &id).await })?;
                h.service.get(&h.cx, &h.collection, &id).await
            })?;
            Ok(bytes.map_or(Dynamic::UNIT, Dynamic::from_blob))
        },
    );
@@ -132,9 +128,7 @@ fn register_update(engine: &mut RhaiEngine) {
                name,
                content_type,
            };
-            block_on("files", async move {
+            block_on(async move { h.service.update(&h.cx, &h.collection, &id, upd).await })
                h.service.update(&h.cx, &h.collection, &id, upd).await
            })
        },
    );
 }
@@ -145,9 +139,7 @@ fn register_delete(engine: &mut RhaiEngine) {
        |handle: &mut FilesHandle, id: &str| -> Result<bool, Box<EvalAltResult>> {
            let h = handle.clone();
            let id = id.to_string();
-            block_on("files", async move {
+            block_on(async move { h.service.delete(&h.cx, &h.collection, &id).await })
                h.service.delete(&h.cx, &h.collection, &id).await
            })
        },
    );
 }
@@ -201,7 +193,7 @@ fn list_call(
    limit: u32,
 ) -> Result<Map, Box<EvalAltResult>> {
    let h = handle.clone();
-    let page = block_on("files", async move {
+    let page = block_on(async move {
        h.service
            .list(&h.cx, &h.collection, cursor.as_deref(), limit)
            .await
@@ -267,3 +259,23 @@ fn require_blob(meta: &Map, field: &'static str) -> Result<Vec<u8>, Box<EvalAltR
        None => Err(format!("files: missing required field '{field}'").into()),
    }
 }
 /// Run an async future inside the synchronous Rhai context. Mirrors
 /// `kv::block_on`; safe because `LocalExecutorClient` runs the script
 /// under `spawn_blocking`, so a runtime handle is reachable.
 fn block_on<F, T>(fut: F) -> Result<T, Box<EvalAltResult>>
 where
    F: std::future::Future<Output = Result<T, FilesError>> + Send,
    T: Send,
 {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("files: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(format!("files: {err}").into(), rhai::Position::NONE).into()
    })
 }
--- a/crates/executor-core/src/sdk/invoke.rs
+++ b/crates/executor-core/src/sdk/invoke.rs
@@ -1,344 +0,0 @@
 //! `invoke()` Rhai bridge — synchronous, same-app, re-entrant.
 //!
 //! ```rhai
 //! let result = invoke("/api/payments/process", #{ order_id: 123 });
 //! let result = invoke(script_id("uuid-..."), args);
 //! ```
 //!
 //! Re-entrancy: the bridge captures `Arc<Engine>` (via
 //! `Engine::self_arc`) and calls `engine.execute(&source, req)` directly
 //! inside the caller's `spawn_blocking` thread. Same engine instance,
 //! same `Services`, same `Limits` — only the per-call `SdkCallCx`
 //! changes (the callee gets `trigger_depth + 1` and a fresh
 //! `execution_id`).
 //!
 //! Cross-app rejection happens at the `InvokeService::resolve` layer —
 //! every method derives `app_id` from `cx.app_id` and returns
 //! `InvokeError::CrossApp` if the resolved script belongs elsewhere.
 //!
 //! Depth bound: `cx.trigger_depth + 1 > limits.trigger_depth_max` →
 //! `InvokeError::DepthExceeded`. Shared with the trigger fan-out depth
 //! limit per the design notes (no separate `invoke_depth_max`).
 //!
 //! Closures captured across the `invoke` boundary are rejected at the
 //! args-to-JSON conversion — `FnPtr` doesn't survive serialization and
 //! re-entry into a fresh engine instance is the wrong scope for it
 //! anyway.
 //!
 //! `invoke_async()` writes an outbox row (see `InvokeService::enqueue_async`)
 //! and returns immediately with the new `ExecutionId` as a string. The
 //! dispatcher fires it through the standard executor path; commit 10
 //! wires the dispatcher's `OutboxSourceKind::Invoke` arm.
 use std::collections::BTreeMap;
 use std::sync::Arc;
 use base64::engine::general_purpose::STANDARD;
 use base64::Engine as _;
 use picloud_shared::{ExecutionId, InvokeService, InvokeTarget, ScriptId, SdkCallCx, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use serde_json::Value as Json;
 use tokio::runtime::Handle as TokioHandle;
 use crate::engine::Engine;
 use crate::sandbox::Limits;
 use crate::sdk::bridge::json_to_dynamic;
 use crate::types::{ExecRequest, InvocationType};
 pub(super) fn register(
    engine: &mut RhaiEngine,
    services: &Services,
    cx: Arc<SdkCallCx>,
    limits: Limits,
    self_engine: Option<Arc<Engine>>,
 ) {
    let svc = services.invoke.clone();
    let mut module = Module::new();
    // Sync `invoke(target, args)` — returns the callee's return value.
    {
        let svc = svc.clone();
        let cx = cx.clone();
        let self_engine = self_engine.clone();
        module.set_native_fn(
            "invoke",
            move |target: Dynamic, args: Dynamic| -> Result<Dynamic, Box<EvalAltResult>> {
                let target = parse_target(target)?;
                let args_json = args_to_json(&args)?;
                let self_engine = self_engine.clone().ok_or_else(|| -> Box<EvalAltResult> {
                    EvalAltResult::ErrorRuntime(
                        "invoke: engine back-reference not installed (test setup missing set_self_weak?)".into(),
                        rhai::Position::NONE,
                    )
                    .into()
                })?;
                invoke_blocking(&svc, &cx, target, args_json, limits, &self_engine)
            },
        );
    }
    // `invoke_async(target, args)` — fire-and-forget; returns the new
    // ExecutionId as a string.
    {
        let svc = svc.clone();
        let cx = cx.clone();
        module.set_native_fn(
            "invoke_async",
            move |target: Dynamic, args: Dynamic| -> Result<String, Box<EvalAltResult>> {
                let target = parse_target(target)?;
                let args_json = args_to_json(&args)?;
                let svc = svc.clone();
                let cx = cx.clone();
                let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
                    EvalAltResult::ErrorRuntime(
                        format!("invoke_async: no tokio runtime: {e}").into(),
                        rhai::Position::NONE,
                    )
                    .into()
                })?;
                let exec_id = handle
                    .block_on(async move { svc.enqueue_async(&cx, target, args_json).await })
                    .map_err(|e| -> Box<EvalAltResult> {
                        EvalAltResult::ErrorRuntime(
                            format!("invoke_async: {e}").into(),
                            rhai::Position::NONE,
                        )
                        .into()
                    })?;
                Ok(exec_id.to_string())
            },
        );
    }
    // Register globally — `invoke(...)` and `invoke_async(...)` are
    // top-level helpers, not under a `::` namespace, mirroring the
    // brief's syntax.
    engine.register_global_module(module.into());
 }
 /// The sync invoke path. Runs entirely inside the caller's
 /// `spawn_blocking` thread; no gate (the outer execution is already
 /// gate-admitted), no new spawn_blocking (we'd deadlock if we nested
 /// inside the blocking pool).
 fn invoke_blocking(
    svc: &Arc<dyn InvokeService>,
    cx: &Arc<SdkCallCx>,
    target: InvokeTarget,
    args_json: Json,
    limits: Limits,
    self_engine: &Arc<Engine>,
 ) -> Result<Dynamic, Box<EvalAltResult>> {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("invoke: no tokio runtime: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    // Depth check — done BEFORE resolve so a depth-exceeded loop
    // doesn't waste a DB round-trip.
    if cx.trigger_depth + 1 > limits.trigger_depth_max {
        return Err(EvalAltResult::ErrorRuntime(
            format!(
                "invoke: depth limit exceeded (max {})",
                limits.trigger_depth_max
            )
            .into(),
            rhai::Position::NONE,
        )
        .into());
    }
    let svc_clone = svc.clone();
    let cx_clone = cx.clone();
    let target_label = target.describe();
    let resolved = handle
        .block_on(async move { svc_clone.resolve(&cx_clone, target).await })
        .map_err(|e| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                format!("invoke({target_label}): {e}").into(),
                rhai::Position::NONE,
            )
            .into()
        })?;
    let execution_id = ExecutionId::new();
    let req = ExecRequest {
        execution_id,
        request_id: cx.request_id,
        script_id: resolved.script_id,
        script_name: resolved.name.clone(),
        invocation_type: InvocationType::Function,
        path: "/invoke".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: args_json,
        params: BTreeMap::new(),
        query: BTreeMap::new(),
        rest: String::new(),
        sandbox_overrides: picloud_shared::ScriptSandbox::default(),
        app_id: cx.app_id,
        // Same-app invoke is a function call, not a re-auth boundary —
        // inherit the caller's principal.
        principal: cx.principal.clone(),
        trigger_depth: cx.trigger_depth + 1,
        root_execution_id: cx.root_execution_id,
        is_dead_letter_handler: cx.is_dead_letter_handler,
        event: None,
    };
    // F-P-004: synchronous re-entry — route through the per-Engine
    // AST cache so each callee parses once per (script_id, updated_at),
    // not once per invoke. Composed workflows multiply parse cost by
    // depth; the cache cuts that to constant compile + N executions.
    let ast = self_engine
        .compile_for_identity(resolved.script_id, resolved.updated_at, &resolved.source)
        .map_err(|e| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                format!("invoke({target_label}): {e}").into(),
                rhai::Position::NONE,
            )
            .into()
        })?;
    let resp = self_engine
        .execute_ast(&ast, req)
        .map_err(|e| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                format!("invoke({target_label}): {e}").into(),
                rhai::Position::NONE,
            )
            .into()
        })?;
    // The callee's return is the response `body` JSON. Convert back to
    // Dynamic for the caller. Status code + headers are dropped; the
    // function-call mental model is "return value", not HTTP response.
    Ok(json_to_dynamic(resp.body))
 }
 /// Accept a string (route path OR script name) or a Rhai script-id
 /// custom type. The string heuristic: starts with '/' → Path, else Name.
 fn parse_target(target: Dynamic) -> Result<InvokeTarget, Box<EvalAltResult>> {
    if let Ok(s) = target.clone().into_string() {
        if s.starts_with('/') {
            return Ok(InvokeTarget::Path(s));
        }
        // Heuristic: 36-char UUID-like string → Id; else Name. Keeps
        // `invoke("payments_worker")` and `invoke("550e8400-...")` both
        // working without a separate `script_id()` constructor in v1.1.9.
        if s.len() == 36 {
            if let Ok(uuid) = uuid::Uuid::parse_str(&s) {
                return Ok(InvokeTarget::Id(ScriptId::from(uuid)));
            }
        }
        return Ok(InvokeTarget::Name(s));
    }
    let _ = target;
    Err(EvalAltResult::ErrorRuntime(
        "invoke: target must be a string (path or name) or a script_id".into(),
        rhai::Position::NONE,
    )
    .into())
 }
 /// Convert Rhai Dynamic → JSON. Rejects FnPtr at any depth (closures
 /// don't survive invoke boundaries).
 fn args_to_json(value: &Dynamic) -> Result<Json, Box<EvalAltResult>> {
    if value.is::<rhai::FnPtr>() {
        return Err(EvalAltResult::ErrorRuntime(
            "invoke: args must not contain FnPtr / closures".into(),
            rhai::Position::NONE,
        )
        .into());
    }
    if value.is_blob() {
        let blob = value.clone().into_blob().unwrap_or_default();
        return Ok(Json::String(STANDARD.encode(&blob)));
    }
    if value.is_unit() {
        return Ok(Json::Null);
    }
    if let Ok(b) = value.as_bool() {
        return Ok(Json::Bool(b));
    }
    if let Ok(i) = value.as_int() {
        return Ok(Json::Number(i.into()));
    }
    if let Ok(f) = value.as_float() {
        return Ok(serde_json::Number::from_f64(f).map_or(Json::Null, Json::Number));
    }
    if value.is_string() {
        return Ok(Json::String(
            value.clone().into_string().unwrap_or_default(),
        ));
    }
    if let Some(arr) = value.clone().try_cast::<Array>() {
        let mut out = Vec::with_capacity(arr.len());
        for v in &arr {
            out.push(args_to_json(v)?);
        }
        return Ok(Json::Array(out));
    }
    if let Some(map) = value.clone().try_cast::<Map>() {
        let mut out = serde_json::Map::new();
        for (k, v) in map {
            out.insert(k.to_string(), args_to_json(&v)?);
        }
        return Ok(Json::Object(out));
    }
    Ok(Json::String(value.to_string()))
 }
 /// `Limits` is `Copy`; passed by value into `register` so closures take
 /// owned copies. Hint for readers wondering why it doesn't need `Arc`.
 #[allow(dead_code)]
 const _LIMITS_IS_COPY: fn() = || {
    fn assert_copy<T: Copy>() {}
    assert_copy::<Limits>();
 };
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn parse_target_path() {
        let d = Dynamic::from("/api/foo");
        let t = parse_target(d).unwrap();
        assert!(matches!(t, InvokeTarget::Path(_)));
    }
    #[test]
    fn parse_target_uuid_string_is_id() {
        let d = Dynamic::from("550e8400-e29b-41d4-a716-446655440000");
        let t = parse_target(d).unwrap();
        assert!(matches!(t, InvokeTarget::Id(_)));
    }
    #[test]
    fn parse_target_plain_name() {
        let d = Dynamic::from("payments_worker");
        let t = parse_target(d).unwrap();
        match t {
            InvokeTarget::Name(n) => assert_eq!(n, "payments_worker"),
            other => panic!("expected Name, got {other:?}"),
        }
    }
    #[test]
    fn args_to_json_rejects_fnptr() {
        let f = rhai::FnPtr::new("x").unwrap();
        let d = Dynamic::from(f);
        assert!(args_to_json(&d).is_err());
    }
    #[test]
    fn args_to_json_round_trips_map() {
        let mut m = Map::new();
        m.insert("x".into(), Dynamic::from(42_i64));
        let d = Dynamic::from(m);
        let j = args_to_json(&d).unwrap();
        assert_eq!(j, serde_json::json!({ "x": 42 }));
    }
 }
--- a/crates/executor-core/src/sdk/kv.rs
+++ b/crates/executor-core/src/sdk/kv.rs
@@ -28,10 +28,11 @@
 use std::sync::Arc;
-use picloud_shared::{KvService, SdkCallCx, Services};
+use picloud_shared::{KvError, KvService, SdkCallCx, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use tokio::runtime::Handle as TokioHandle;
-use super::bridge::{block_on, dynamic_to_json, json_to_dynamic};
+use super::bridge::{dynamic_to_json, json_to_dynamic};
 /// Per-call handle captured by the Rhai SDK. Cheap to clone (two Arcs
 /// plus an owned string).
@@ -84,10 +85,8 @@ fn register_get(engine: &mut RhaiEngine) {
        "get",
        |handle: &mut KvHandle, key: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let h = handle.clone();
-            block_on("kv", async move {
+            block_on(async move { h.service.get(&h.cx, &h.collection, key).await })
-                h.service.get(&h.cx, &h.collection, key).await
+                .map(|opt| opt.map_or(Dynamic::UNIT, json_to_dynamic))
            })
            .map(|opt| opt.map_or(Dynamic::UNIT, json_to_dynamic))
        },
    );
 }
@@ -98,9 +97,7 @@ fn register_set(engine: &mut RhaiEngine) {
        |handle: &mut KvHandle, key: &str, value: Dynamic| -> Result<(), Box<EvalAltResult>> {
            let h = handle.clone();
            let json = dynamic_to_json(&value);
-            block_on("kv", async move {
+            block_on(async move { h.service.set(&h.cx, &h.collection, key, json).await })
                h.service.set(&h.cx, &h.collection, key, json).await
            })
        },
    );
 }
@@ -110,9 +107,7 @@ fn register_has(engine: &mut RhaiEngine) {
        "has",
        |handle: &mut KvHandle, key: &str| -> Result<bool, Box<EvalAltResult>> {
            let h = handle.clone();
-            block_on("kv", async move {
+            block_on(async move { h.service.has(&h.cx, &h.collection, key).await })
                h.service.has(&h.cx, &h.collection, key).await
            })
        },
    );
 }
@@ -122,9 +117,7 @@ fn register_delete(engine: &mut RhaiEngine) {
        "delete",
        |handle: &mut KvHandle, key: &str| -> Result<bool, Box<EvalAltResult>> {
            let h = handle.clone();
-            block_on("kv", async move {
+            block_on(async move { h.service.delete(&h.cx, &h.collection, key).await })
                h.service.delete(&h.cx, &h.collection, key).await
            })
        },
    );
 }
@@ -160,7 +153,7 @@ fn list_call(
    limit: u32,
 ) -> Result<Map, Box<EvalAltResult>> {
    let h = handle.clone();
-    let page = block_on("kv", async move {
+    let page = block_on(async move {
        h.service
            .list(&h.cx, &h.collection, cursor.as_deref(), limit)
            .await
@@ -174,3 +167,27 @@ fn list_call(
    );
    Ok(m)
 }
 /// Run an async future inside the synchronous Rhai context.
 ///
 /// `LocalExecutorClient` wraps script execution in `spawn_blocking`, so
 /// the current Tokio runtime is reachable via `Handle::current()`. We
 /// block on it directly; we are NOT calling this from an async task,
 /// so blocking is the correct primitive (`block_in_place` would also
 /// work, but we're already on a blocking worker).
 fn block_on<F, T>(fut: F) -> Result<T, Box<EvalAltResult>>
 where
    F: std::future::Future<Output = Result<T, KvError>> + Send,
    T: Send,
 {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("kv: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(format!("kv: {err}").into(), rhai::Position::NONE).into()
    })
 }
--- a/crates/executor-core/src/sdk/mod.rs
+++ b/crates/executor-core/src/sdk/mod.rs
@@ -18,14 +18,10 @@ pub mod docs;
 pub mod email;
 pub mod files;
 pub mod http;
 pub mod invoke;
 pub mod kv;
 pub mod pubsub;
 pub mod queue;
 pub mod retry;
 pub mod secrets;
 pub mod stdlib;
 pub mod users;
 pub use bridge::{dynamic_to_json, json_to_dynamic};
 pub use cx::SdkCallCx;
@@ -35,34 +31,19 @@ use std::sync::Arc;
 use picloud_shared::Services;
 use rhai::Engine as RhaiEngine;
 use crate::engine::Engine;
 use crate::sandbox::Limits;
 /// Single hook every v1.1.x stateful service registers into. Called
 /// once per invocation, just after `build_engine` constructs the
 /// sandboxed Rhai engine and just before script compilation.
 ///
-/// v1.1.9 adds the `limits` + `self_engine` parameters needed by the
+/// v1.1.1 wires the first stateful service (KV). Subsequent PRs add a
-/// `invoke` bridge for synchronous re-entry. `self_engine` is `None`
+/// single `<service>::register(...)` line per service.
-/// in harnesses that didn't call `Engine::set_self_weak` after
+pub fn register_all(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
 /// construction; the invoke bridge surfaces a clear error in that case.
 pub fn register_all(
    engine: &mut RhaiEngine,
    services: &Services,
    cx: Arc<SdkCallCx>,
    limits: Limits,
    self_engine: Option<Arc<Engine>>,
 ) {
    kv::register(engine, services, cx.clone());
    docs::register(engine, services, cx.clone());
    dead_letters::register(engine, services, cx.clone());
    http::register(engine, services, cx.clone());
    files::register(engine, services, cx.clone());
    pubsub::register(engine, services, cx.clone());
    queue::register(engine, services, cx.clone());
    retry::register(engine, services, cx.clone());
    secrets::register(engine, services, cx.clone());
-    email::register(engine, services, cx.clone());
+    email::register(engine, services, cx);
    users::register(engine, services, cx.clone());
    invoke::register(engine, services, cx, limits, self_engine);
 }
--- a/crates/executor-core/src/sdk/pubsub.rs
+++ b/crates/executor-core/src/sdk/pubsub.rs
@@ -19,13 +19,11 @@ use std::sync::Arc;
 use base64::engine::general_purpose::STANDARD;
 use base64::Engine as _;
-use picloud_shared::{SdkCallCx, Services};
+use picloud_shared::{PubsubError, SdkCallCx, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use serde_json::Value as Json;
 use tokio::runtime::Handle as TokioHandle;
 use super::bridge::block_on;
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
    let svc = services.pubsub.clone();
    let mut module = Module::new();
@@ -38,9 +36,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
                let json = message_to_json(&message);
                let svc = svc.clone();
                let cx = cx.clone();
-                block_on("pubsub", async move {
+                block_on(async move { svc.publish_durable(&cx, topic, json).await })
                    svc.publish_durable(&cx, topic, json).await
                })
            },
        );
    }
@@ -160,3 +156,21 @@ fn message_to_json(value: &Dynamic) -> Json {
    }
    Json::String(value.to_string())
 }
 /// Run an async future inside the synchronous Rhai context. Mirrors
 /// `kv::block_on`.
 fn block_on<F>(fut: F) -> Result<(), Box<EvalAltResult>>
 where
    F: std::future::Future<Output = Result<(), PubsubError>> + Send,
 {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("pubsub: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(format!("pubsub: {err}").into(), rhai::Position::NONE).into()
    })
 }
--- a/crates/executor-core/src/sdk/queue.rs
+++ b/crates/executor-core/src/sdk/queue.rs
@@ -1,268 +0,0 @@
 //! `queue::` Rhai bridge — durable per-app queue producer + inspection
 //! (v1.1.9).
 //!
 //! ```rhai
 //! queue::enqueue("payments.process", #{ order_id: 123, amount: 4999 });
 //! queue::enqueue("payments.process", msg, #{ delay_ms: 60000, max_attempts: 5 });
 //! let total = queue::depth("payments.process");
 //! let pending = queue::depth_pending("payments.process");
 //! ```
 //!
 //! No handle pattern (queues are the grouping unit, mirroring pubsub).
 //! No `peek` / `dequeue` / `purge` script-side surface — consumers are
 //! `queue:receive` triggers; exposing manual dequeue would force the
 //! platform to surface visibility-timeout semantics into script-land.
 //!
 //! `app_id` is derived from `cx.app_id` inside the service — it never
 //! appears in the script-side signature.
 use std::sync::Arc;
 use base64::engine::general_purpose::STANDARD;
 use base64::Engine as _;
 use picloud_shared::{EnqueueOpts, QueueError, QueueService, SdkCallCx, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use serde_json::Value as Json;
 use tokio::runtime::Handle as TokioHandle;
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
    let svc = services.queue.clone();
    let mut module = Module::new();
    // `queue::enqueue(name, message)` — default opts.
    {
        let svc = svc.clone();
        let cx = cx.clone();
        module.set_native_fn(
            "enqueue",
            move |name: &str, message: Dynamic| -> Result<(), Box<EvalAltResult>> {
                let json = message_to_json(&message)?;
                enqueue_blocking(&svc, &cx, name, json, EnqueueOpts::default())
            },
        );
    }
    // `queue::enqueue(name, message, opts)` — opts is a Rhai Map with
    // optional `delay_ms` and `max_attempts` keys.
    {
        let svc = svc.clone();
        let cx = cx.clone();
        module.set_native_fn(
            "enqueue",
            move |name: &str, message: Dynamic, opts: Map| -> Result<(), Box<EvalAltResult>> {
                let json = message_to_json(&message)?;
                let opts = parse_opts(&opts)?;
                enqueue_blocking(&svc, &cx, name, json, opts)
            },
        );
    }
    // `queue::depth(name)` — total rows in the queue.
    {
        let svc = svc.clone();
        let cx = cx.clone();
        module.set_native_fn(
            "depth",
            move |name: &str| -> Result<i64, Box<EvalAltResult>> {
                let svc = svc.clone();
                let cx = cx.clone();
                let name = name.to_string();
                block_on_u64(async move { svc.depth(&cx, &name).await })
            },
        );
    }
    // `queue::depth_pending(name)` — only currently-claimable rows.
    {
        let svc = svc.clone();
        let cx = cx.clone();
        module.set_native_fn(
            "depth_pending",
            move |name: &str| -> Result<i64, Box<EvalAltResult>> {
                let svc = svc.clone();
                let cx = cx.clone();
                let name = name.to_string();
                block_on_u64(async move { svc.depth_pending(&cx, &name).await })
            },
        );
    }
    engine.register_static_module("queue", module.into());
 }
 /// Run the async enqueue inside the synchronous Rhai context. Mirrors
 /// `pubsub::block_on` but for the queue's `Result<_, QueueError>`.
 fn enqueue_blocking(
    svc: &Arc<dyn QueueService>,
    cx: &Arc<SdkCallCx>,
    name: &str,
    payload: Json,
    opts: EnqueueOpts,
 ) -> Result<(), Box<EvalAltResult>> {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("queue: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    let svc = svc.clone();
    let cx = cx.clone();
    let name = name.to_string();
    handle
        .block_on(async move { svc.enqueue(&cx, &name, payload, opts).await })
        .map(|_id| ())
        .map_err(|err| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(format!("queue: {err}").into(), rhai::Position::NONE).into()
        })
 }
 fn block_on_u64<F>(fut: F) -> Result<i64, Box<EvalAltResult>>
 where
    F: std::future::Future<Output = Result<u64, QueueError>> + Send + 'static,
 {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("queue: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    let n = handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(format!("queue: {err}").into(), rhai::Position::NONE).into()
    })?;
    Ok(i64::try_from(n).unwrap_or(i64::MAX))
 }
 fn parse_opts(opts: &Map) -> Result<EnqueueOpts, Box<EvalAltResult>> {
    let mut out = EnqueueOpts::default();
    if let Some(v) = opts.get("delay_ms") {
        out.delay_ms = Some(v.as_int().map_err(|_| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                "queue::enqueue: opts.delay_ms must be an integer".into(),
                rhai::Position::NONE,
            )
            .into()
        })?);
    }
    if let Some(v) = opts.get("max_attempts") {
        let n = v.as_int().map_err(|_| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                "queue::enqueue: opts.max_attempts must be an integer".into(),
                rhai::Position::NONE,
            )
            .into()
        })?;
        out.max_attempts = Some(u32::try_from(n).unwrap_or(0));
    }
    Ok(out)
 }
 /// Convert a Rhai `Dynamic` into JSON. Mirrors `pubsub::message_to_json`
 /// — blobs become base64, FnPtr / closures are rejected so a script
 /// can't accidentally enqueue something that won't survive a trip
 /// through Postgres + back through the bridge.
 fn message_to_json(value: &Dynamic) -> Result<Json, Box<EvalAltResult>> {
    if value.is::<rhai::FnPtr>() {
        return Err(EvalAltResult::ErrorRuntime(
            "queue::enqueue: messages must not contain FnPtr / closures".into(),
            rhai::Position::NONE,
        )
        .into());
    }
    if value.is_blob() {
        let blob = value.clone().into_blob().unwrap_or_default();
        return Ok(Json::String(STANDARD.encode(&blob)));
    }
    if value.is_unit() {
        return Ok(Json::Null);
    }
    if let Ok(b) = value.as_bool() {
        return Ok(Json::Bool(b));
    }
    if let Ok(i) = value.as_int() {
        return Ok(Json::Number(i.into()));
    }
    if let Ok(f) = value.as_float() {
        return Ok(serde_json::Number::from_f64(f).map_or(Json::Null, Json::Number));
    }
    if value.is_string() {
        return Ok(Json::String(
            value.clone().into_string().unwrap_or_default(),
        ));
    }
    if let Some(arr) = value.clone().try_cast::<Array>() {
        let mut out = Vec::with_capacity(arr.len());
        for v in &arr {
            out.push(message_to_json(v)?);
        }
        return Ok(Json::Array(out));
    }
    if let Some(map) = value.clone().try_cast::<Map>() {
        let mut out = serde_json::Map::new();
        for (k, v) in map {
            out.insert(k.to_string(), message_to_json(&v)?);
        }
        return Ok(Json::Object(out));
    }
    Ok(Json::String(value.to_string()))
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use rhai::Dynamic;
    #[test]
    fn message_blob_encodes_to_base64_string() {
        let blob: rhai::Blob = vec![0x01, 0x02, 0x03];
        let d = Dynamic::from(blob);
        let json = message_to_json(&d).unwrap();
        // STANDARD base64 of [1,2,3] is "AQID"
        assert_eq!(json, Json::String("AQID".into()));
    }
    #[test]
    fn message_nested_map_round_trips_through_json() {
        let mut m = Map::new();
        m.insert("k".into(), Dynamic::from(42_i64));
        let d = Dynamic::from(m);
        let json = message_to_json(&d).unwrap();
        let expected = serde_json::json!({ "k": 42 });
        assert_eq!(json, expected);
    }
    #[test]
    fn message_rejects_fnptr() {
        // Build a Rhai FnPtr and confirm we reject it.
        let f = rhai::FnPtr::new("anything").unwrap();
        let d = Dynamic::from(f);
        let err = message_to_json(&d).unwrap_err();
        assert!(err.to_string().contains("FnPtr"));
    }
    #[test]
    fn parse_opts_accepts_partial_overrides() {
        let mut m = Map::new();
        m.insert("delay_ms".into(), Dynamic::from(500_i64));
        let opts = parse_opts(&m).unwrap();
        assert_eq!(opts.delay_ms, Some(500));
        assert_eq!(opts.max_attempts, None);
    }
    #[test]
    fn parse_opts_max_attempts_only() {
        let mut m = Map::new();
        m.insert("max_attempts".into(), Dynamic::from(5_i64));
        let opts = parse_opts(&m).unwrap();
        assert_eq!(opts.delay_ms, None);
        assert_eq!(opts.max_attempts, Some(5));
    }
    #[test]
    fn parse_opts_rejects_non_integer_delay() {
        let mut m = Map::new();
        m.insert("delay_ms".into(), Dynamic::from("nope"));
        assert!(parse_opts(&m).is_err());
    }
 }
--- a/crates/executor-core/src/sdk/retry.rs
+++ b/crates/executor-core/src/sdk/retry.rs
@@ -1,361 +0,0 @@
 //! `retry::*` Rhai bridge — caller-controlled retry shape (v1.1.9).
 //!
 //! ```rhai
 //! let p = retry::policy(#{
 //!     max_attempts: 3,
 //!     backoff: "exponential",  // "exponential" | "linear" | "constant"
 //!     base_ms: 500,
 //!     jitter_pct: 20,
 //! });
 //!
 //! let result = retry::run(p, || {
 //!     invoke("/payments/charge", #{ order_id: 1 })
 //! });
 //!
 //! // Optional error-code filter:
 //! let p2 = retry::on_codes(p, ["http: 503", "http: 504"]);
 //! ```
 //!
 //! NOTE: the brief called for `retry::with(policy, closure)` but `with`
 //! AND `call` are both Rhai reserved keywords (rejected at the parser
 //! before any registration would matter) — so we ship `retry::run(...)`
 //! instead. Documented in HANDBACK §7.
 //!
 //! `retry::run(policy, closure)` calls the closure; on throw it sleeps
 //! per the policy and re-invokes. Sleeps run via `tokio::time::sleep`
 //! through `TokioHandle::block_on` — the bridge is already inside the
 //! caller's `spawn_blocking` thread, so blocking is fine.
 //!
 //! Closures share the caller's engine + cx (Rhai's `FnPtr` is invoked
 //! via `call_within_context` on the same engine). If the closure calls
 //! `invoke()`, the inner call gets a fresh cx with `trigger_depth + 1`
 //! via the invoke bridge — retry doesn't see or interfere with that.
 use std::collections::hash_map::DefaultHasher;
 use std::hash::Hasher;
 use std::sync::Arc;
 use std::time::Duration;
 use picloud_shared::{SdkCallCx, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, FnPtr, Module, NativeCallContext};
 use tokio::runtime::Handle as TokioHandle;
 /// Policy value scripts construct via `retry::policy(opts)`. Custom Rhai
 /// type — exposed via `register_type_with_name`.
 #[derive(Debug, Clone)]
 pub struct Policy {
    pub max_attempts: u32,
    pub backoff: BackoffShape,
    pub base_ms: u32,
    pub jitter_pct: u32,
    /// Empty → retry on any throw. Non-empty → retry only when the
    /// error string starts with one of these prefixes.
    pub on_codes: Vec<String>,
 }
 impl Default for Policy {
    fn default() -> Self {
        Self {
            max_attempts: 3,
            backoff: BackoffShape::Exponential,
            base_ms: 500,
            jitter_pct: 20,
            on_codes: Vec::new(),
        }
    }
 }
 #[derive(Debug, Clone, Copy)]
 pub enum BackoffShape {
    Constant,
    Linear,
    Exponential,
 }
 impl BackoffShape {
    fn from_wire(s: &str) -> Option<Self> {
        match s {
            "constant" => Some(Self::Constant),
            "linear" => Some(Self::Linear),
            "exponential" => Some(Self::Exponential),
            _ => None,
        }
    }
 }
 pub(super) fn register(engine: &mut RhaiEngine, _services: &Services, _cx: Arc<SdkCallCx>) {
    // Custom type so scripts can pass Policy values around.
    engine.register_type_with_name::<Policy>("Policy");
    let mut module = Module::new();
    // `retry::policy(opts)` — opts is a Rhai Map.
    module.set_native_fn(
        "policy",
        move |opts: rhai::Map| -> Result<Policy, Box<EvalAltResult>> { build_policy(opts) },
    );
    // `retry::on_codes(policy, codes)` — returns a new policy with the
    // filter set. Takes ownership of the policy (Rhai semantics) and
    // returns the modified one.
    module.set_native_fn(
        "on_codes",
        move |policy: Policy, codes: Array| -> Result<Policy, Box<EvalAltResult>> {
            let mut p = policy;
            let mut out = Vec::with_capacity(codes.len());
            for c in codes {
                let s = c.into_string().map_err(|_| -> Box<EvalAltResult> {
                    EvalAltResult::ErrorRuntime(
                        "retry::on_codes: codes must be strings".into(),
                        rhai::Position::NONE,
                    )
                    .into()
                })?;
                out.push(s);
            }
            p.on_codes = out;
            Ok(p)
        },
    );
    // `retry::run(policy, fn_ptr)` — registered with NativeCallContext
    // so the bridge can re-invoke the FnPtr in a loop. Named `call` and
    // not `with` because `with` is a Rhai reserved keyword.
    module.set_native_fn(
        "run",
        move |ctx: NativeCallContext,
              policy: Policy,
              fn_ptr: FnPtr|
              -> Result<Dynamic, Box<EvalAltResult>> { retry_run(&ctx, &policy, &fn_ptr) },
    );
    engine.register_static_module("retry", module.into());
 }
 fn build_policy(opts: rhai::Map) -> Result<Policy, Box<EvalAltResult>> {
    let mut p = Policy::default();
    if let Some(v) = opts.get("max_attempts") {
        let n = v.as_int().map_err(|_| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                "retry::policy: max_attempts must be an integer".into(),
                rhai::Position::NONE,
            )
            .into()
        })?;
        let n = u32::try_from(n).unwrap_or(0);
        p.max_attempts = n.clamp(1, 20);
    }
    if let Some(v) = opts.get("backoff") {
        let s = v.clone().into_string().map_err(|_| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                "retry::policy: backoff must be a string".into(),
                rhai::Position::NONE,
            )
            .into()
        })?;
        p.backoff = BackoffShape::from_wire(&s).ok_or_else(|| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                "retry::policy: backoff must be \"exponential\" | \"linear\" | \"constant\"".into(),
                rhai::Position::NONE,
            )
            .into()
        })?;
    }
    if let Some(v) = opts.get("base_ms") {
        let n = v.as_int().map_err(|_| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                "retry::policy: base_ms must be an integer".into(),
                rhai::Position::NONE,
            )
            .into()
        })?;
        let n = u32::try_from(n).unwrap_or(0);
        p.base_ms = n.clamp(1, 60_000);
    }
    if let Some(v) = opts.get("jitter_pct") {
        let n = v.as_int().map_err(|_| -> Box<EvalAltResult> {
            EvalAltResult::ErrorRuntime(
                "retry::policy: jitter_pct must be an integer".into(),
                rhai::Position::NONE,
            )
            .into()
        })?;
        let n = u32::try_from(n).unwrap_or(0);
        p.jitter_pct = n.clamp(0, 100);
    }
    Ok(p)
 }
 fn retry_run(
    ctx: &NativeCallContext,
    policy: &Policy,
    fn_ptr: &FnPtr,
 ) -> Result<Dynamic, Box<EvalAltResult>> {
    let mut attempt: u32 = 0;
    loop {
        attempt += 1;
        // Rhai 1.24's FnPtr only carries the callee's name + args; we
        // invoke it through the engine the NativeCallContext exposes.
        // `()` as args: the closure is nullary — the script-side helper
        // is `|| { ... }`.
        let res: Result<Dynamic, Box<EvalAltResult>> = fn_ptr.call_within_context(ctx, ());
        match res {
            Ok(v) => return Ok(v),
            Err(e) => {
                // on_codes filter: if non-empty, only retry when the
                // error string starts with one of the codes.
                if !policy.on_codes.is_empty() {
                    let msg = e.to_string();
                    let matched = policy.on_codes.iter().any(|c| msg.contains(c));
                    if !matched {
                        return Err(e);
                    }
                }
                if attempt >= policy.max_attempts {
                    return Err(e);
                }
                let delay = compute_delay(policy, attempt);
                let _ = sleep_blocking(delay);
            }
        }
    }
 }
 fn compute_delay(policy: &Policy, attempt: u32) -> Duration {
    let base_ms = u64::from(policy.base_ms);
    let exp_pow = u64::from(attempt.saturating_sub(1));
    let raw = match policy.backoff {
        BackoffShape::Constant => base_ms,
        BackoffShape::Linear => base_ms.saturating_mul(u64::from(attempt)),
        BackoffShape::Exponential => base_ms.saturating_mul(1u64 << exp_pow.min(20)),
    };
    let raw = raw.min(u64::from(u32::MAX));
    let jittered = apply_jitter(u32::try_from(raw).unwrap_or(u32::MAX), policy.jitter_pct);
    Duration::from_millis(u64::from(jittered))
 }
 fn apply_jitter(raw: u32, pct: u32) -> u32 {
    if pct == 0 {
        return raw;
    }
    let pct = pct.min(100);
    let span = u64::from(raw) * u64::from(pct) / 100;
    if span == 0 {
        return raw;
    }
    // Deterministic-enough jitter without pulling rand into a hot path:
    // pick a small offset from the high bits of attempt's hash. Random
    // distribution doesn't matter for retry — bounded ± is what we want.
    let mut h = DefaultHasher::new();
    h.write_u64(span);
    h.write_u32(raw);
    let r = h.finish();
    // span is bounded by raw*100/100 = raw ≤ u32::MAX, so 2*span+1 fits
    // in i64 without wrapping. `cast_signed` makes the intent explicit
    // for clippy::cast_possible_wrap.
    let modded = r % (2 * span + 1);
    let offset =
        i64::try_from(modded).unwrap_or(i64::MAX) - i64::try_from(span).unwrap_or(i64::MAX);
    let signed = i64::from(raw).saturating_add(offset).max(0);
    u32::try_from(signed.min(i64::from(u32::MAX))).unwrap_or(u32::MAX)
 }
 /// Sleep blocking for `delay`. We're inside the caller's spawn_blocking
 /// thread, so block_on of a tokio::time::sleep is fine — the runtime
 /// thread isn't being held.
 fn sleep_blocking(delay: Duration) -> Result<(), Box<EvalAltResult>> {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("retry: no tokio runtime: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    handle.block_on(async move { tokio::time::sleep(delay).await });
    Ok(())
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn policy_default_is_reasonable() {
        let p = Policy::default();
        assert_eq!(p.max_attempts, 3);
        assert_eq!(p.base_ms, 500);
        assert_eq!(p.jitter_pct, 20);
        assert!(p.on_codes.is_empty());
    }
    #[test]
    fn policy_clamps_max_attempts() {
        let mut m = rhai::Map::new();
        m.insert("max_attempts".into(), Dynamic::from(0_i64));
        let p = build_policy(m).unwrap();
        assert_eq!(p.max_attempts, 1);
        let mut m = rhai::Map::new();
        m.insert("max_attempts".into(), Dynamic::from(999_i64));
        let p = build_policy(m).unwrap();
        assert_eq!(p.max_attempts, 20);
    }
    #[test]
    fn policy_clamps_base_ms_and_jitter() {
        let mut m = rhai::Map::new();
        m.insert("base_ms".into(), Dynamic::from(0_i64));
        m.insert("jitter_pct".into(), Dynamic::from(200_i64));
        let p = build_policy(m).unwrap();
        assert_eq!(p.base_ms, 1);
        assert_eq!(p.jitter_pct, 100);
    }
    #[test]
    fn policy_rejects_bogus_backoff_shape() {
        let mut m = rhai::Map::new();
        m.insert("backoff".into(), Dynamic::from("bogus"));
        assert!(build_policy(m).is_err());
    }
    #[test]
    fn compute_delay_exponential_doubles() {
        let p = Policy {
            max_attempts: 5,
            backoff: BackoffShape::Exponential,
            base_ms: 1000,
            jitter_pct: 0,
            on_codes: Vec::new(),
        };
        assert_eq!(compute_delay(&p, 1).as_millis(), 1000);
        assert_eq!(compute_delay(&p, 2).as_millis(), 2000);
        assert_eq!(compute_delay(&p, 3).as_millis(), 4000);
    }
    #[test]
    fn compute_delay_linear() {
        let p = Policy {
            max_attempts: 5,
            backoff: BackoffShape::Linear,
            base_ms: 100,
            jitter_pct: 0,
            on_codes: Vec::new(),
        };
        assert_eq!(compute_delay(&p, 1).as_millis(), 100);
        assert_eq!(compute_delay(&p, 2).as_millis(), 200);
        assert_eq!(compute_delay(&p, 5).as_millis(), 500);
    }
    #[test]
    fn compute_delay_constant() {
        let p = Policy {
            max_attempts: 5,
            backoff: BackoffShape::Constant,
            base_ms: 250,
            jitter_pct: 0,
            on_codes: Vec::new(),
        };
        assert_eq!(compute_delay(&p, 1).as_millis(), 250);
        assert_eq!(compute_delay(&p, 4).as_millis(), 250);
    }
 }
--- a/crates/executor-core/src/sdk/secrets.rs
+++ b/crates/executor-core/src/sdk/secrets.rs
@@ -18,10 +18,11 @@
 use std::sync::Arc;
-use picloud_shared::{SdkCallCx, SecretsListPage, Services};
+use picloud_shared::{SdkCallCx, SecretsError, SecretsListPage, Services};
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 use tokio::runtime::Handle as TokioHandle;
-use super::bridge::{block_on, dynamic_to_json, json_to_dynamic};
+use super::bridge::{dynamic_to_json, json_to_dynamic};
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
    let svc = services.secrets.clone();
@@ -37,7 +38,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
                let json = dynamic_to_json(&value);
                let svc = svc.clone();
                let cx = cx.clone();
-                block_on("secrets", async move { svc.set(&cx, name, json).await })
+                block_on(async move { svc.set(&cx, name, json).await })
            },
        );
    }
@@ -51,7 +52,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
            move |name: &str| -> Result<Dynamic, Box<EvalAltResult>> {
                let svc = svc.clone();
                let cx = cx.clone();
-                let opt = block_on("secrets", async move { svc.get(&cx, name).await })?;
+                let opt = block_on(async move { svc.get(&cx, name).await })?;
                Ok(opt.map_or(Dynamic::UNIT, json_to_dynamic))
            },
        );
@@ -66,7 +67,7 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
            move |name: &str| -> Result<bool, Box<EvalAltResult>> {
                let svc = svc.clone();
                let cx = cx.clone();
-                block_on("secrets", async move { svc.delete(&cx, name).await })
+                block_on(async move { svc.delete(&cx, name).await })
            },
        );
    }
@@ -81,9 +82,8 @@ pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<Sdk
                let (cursor, limit) = parse_list_opts(&opts)?;
                let svc = svc.clone();
                let cx = cx.clone();
-                let page: SecretsListPage = block_on("secrets", async move {
+                let page: SecretsListPage =
-                    svc.list(&cx, cursor.as_deref(), limit).await
+                    block_on(async move { svc.list(&cx, cursor.as_deref(), limit).await })?;
                })?;
                Ok(list_page_to_map(page))
            },
        );
@@ -131,3 +131,23 @@ fn list_page_to_map(page: SecretsListPage) -> Map {
 fn runtime_err(msg: &str) -> Box<EvalAltResult> {
    EvalAltResult::ErrorRuntime(msg.into(), rhai::Position::NONE).into()
 }
 /// Run a `SecretsService` future inside the synchronous Rhai context,
 /// mapping any `SecretsError` to a Rhai runtime error. Mirrors
 /// `kv::block_on` / `pubsub::block_on`.
 fn block_on<T, F>(fut: F) -> Result<T, Box<EvalAltResult>>
 where
    F: std::future::Future<Output = Result<T, SecretsError>> + Send,
    T: Send,
 {
    let handle = TokioHandle::try_current().map_err(|e| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(
            format!("secrets: no tokio runtime available: {e}").into(),
            rhai::Position::NONE,
        )
        .into()
    })?;
    handle.block_on(fut).map_err(|err| -> Box<EvalAltResult> {
        EvalAltResult::ErrorRuntime(format!("secrets: {err}").into(), rhai::Position::NONE).into()
    })
 }
--- a/crates/executor-core/src/sdk/stdlib/regex.rs
+++ b/crates/executor-core/src/sdk/stdlib/regex.rs
@@ -1,29 +1,13 @@
 //! `regex::` — non-backtracking regular expressions (Rust `regex` crate).
 //!
-//! F-P-014: compiled patterns are cached in a thread-local LRU so a
+//! Patterns compile per call. No cache: premature for v1.1.0, and the
-//! tight script loop like `regex::is_match("\\d+", x)` doesn't recompile
+//! `regex` crate's linear-time guarantees keep per-call cost bounded.
-//! every iteration. Compile dominates `is_match` on short strings;
+//! Catastrophic patterns are rejected at compile time by the crate
-//! caching shrinks per-call cost to a HashMap probe + `Arc::clone`.
+//! itself; no extra defense needed.
 use std::cell::RefCell;
 use std::num::NonZeroUsize;
 use std::sync::Arc;
 use lru::LruCache;
 use regex::Regex;
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Module};
 /// Per-thread cap on compiled regex patterns. 128 is well above what
 /// any sensible script uses but bounded enough to keep memory in
 /// check on a fleet of long-running threads.
 const REGEX_CACHE_SIZE: usize = 128;
 thread_local! {
    static REGEX_CACHE: RefCell<LruCache<String, Arc<Regex>>> = RefCell::new(
        LruCache::new(NonZeroUsize::new(REGEX_CACHE_SIZE).expect("non-zero"))
    );
 }
 pub fn register(engine: &mut RhaiEngine) {
    let mut module = Module::new();
    register_is_match(&mut module);
@@ -36,18 +20,8 @@ pub fn register(engine: &mut RhaiEngine) {
    engine.register_static_module("regex", module.into());
 }
-fn compile(pattern: &str) -> Result<Arc<Regex>, Box<EvalAltResult>> {
+fn compile(pattern: &str) -> Result<Regex, Box<EvalAltResult>> {
-    REGEX_CACHE.with(|cell| {
+    Regex::new(pattern).map_err(|e| format!("invalid regex: {e}").into())
        if let Some(cached) = cell.borrow_mut().get(pattern) {
            return Ok(cached.clone());
        }
        let re = Arc::new(
            Regex::new(pattern)
                .map_err(|e| -> Box<EvalAltResult> { format!("invalid regex: {e}").into() })?,
        );
        cell.borrow_mut().put(pattern.to_string(), re.clone());
        Ok(re)
    })
 }
 fn register_is_match(module: &mut Module) {
--- a/crates/executor-core/src/sdk/users.rs
+++ b/crates/executor-core/src/sdk/users.rs
@@ -1,622 +0,0 @@
 //! `users::` Rhai bridge — data-plane user management (v1.1.8).
 //!
 //! ```rhai
 //! // CRUD
 //! let u   = users::create(#{ email: "a@b", password: "hunter22a", display_name: "Alice" });
 //! let u   = users::get(id);                      // map or ()
 //! let u   = users::find_by_email("a@b");         // map or () — REQUIRES an
 //!                                                //   authenticated principal
 //!                                                //   (anti-enumeration); forbidden
 //!                                                //   for anonymous public scripts.
 //! let free = users::email_available("a@b");      // bool — anonymous-safe pre-check
 //!                                                //   for self-serve registration.
 //!                                                //   Leaks only "exists/doesn't" but
 //!                                                //   is cheap + unthrottled: throttle
 //!                                                //   the route if enumeration matters.
 //! users::update(id, #{ display_name: "Alicia" });
 //! let removed = users::delete(id);               // bool
 //! let page = users::list(#{ "$limit": 50, cursor: () });
 //!
 //! // Auth
 //! let tok = users::login("a@b", "hunter22a");   // session-token string or ()
 //! let u   = users::verify(tok);                  // map or () (sliding-TTL bump)
 //! users::logout(tok);
 //!
 //! // Email-tied (commit 5 / 6 / 7)
 //! users::send_verification_email(id,
 //!     #{ link_base: "https://app/verify", subject: "Confirm", body_template: "..." });
 //! let u   = users::verify_email(token);
 //! users::request_password_reset("a@b", #{...});
 //! let u   = users::complete_password_reset(token, "new_pw");
 //! users::invite("a@b",
 //!     #{ link_base: "https://app/invite", subject: "Join", body_template: "...",
 //!        display_name: "Bob", roles: ["editor"] });
 //! let session_tok = users::accept_invite(token, "pw", "Bob");
 //!
 //! // Roles (commit 9)
 //! users::add_role(id, "admin");
 //! let removed = users::remove_role(id, "admin"); // bool
 //! let yes = users::has_role(id, "admin");        // bool
 //! ```
 //!
 //! Collection-less surface (mirrors `email::` / `secrets::` rather
 //! than `kv::`/`docs::`/`files::`'s handle pattern). `app_id` is
 //! derived from `cx.app_id` in the service — it never appears on the
 //! script-side signature, preserving cross-app isolation.
 //!
 //! Methods bound but not yet implemented in the underlying service
 //! return a `users::not_implemented` runtime error. Subsequent v1.1.8
 //! commits flesh them out without re-touching this file.
 use std::sync::Arc;
 use super::bridge::block_on;
 use picloud_shared::{
    AppUser, AppUserId, CreateUserInput, EmailTemplateOpts, GeneratedAccept, GeneratedSession,
    InviteOpts, SdkCallCx, Services, UpdateUserInput, UsersListOpts, UsersListPage, UsersService,
 };
 use rhai::{Array, Dynamic, Engine as RhaiEngine, EvalAltResult, Map, Module};
 pub(super) fn register(engine: &mut RhaiEngine, services: &Services, cx: Arc<SdkCallCx>) {
    let svc = services.users.clone();
    let mut module = Module::new();
    bind_create(&mut module, &svc, &cx);
    bind_get(&mut module, &svc, &cx);
    bind_find_by_email(&mut module, &svc, &cx);
    bind_email_available(&mut module, &svc, &cx);
    bind_update(&mut module, &svc, &cx);
    bind_delete(&mut module, &svc, &cx);
    bind_list(&mut module, &svc, &cx);
    bind_login(&mut module, &svc, &cx);
    bind_verify(&mut module, &svc, &cx);
    bind_logout(&mut module, &svc, &cx);
    bind_send_verification_email(&mut module, &svc, &cx);
    bind_verify_email(&mut module, &svc, &cx);
    bind_request_password_reset(&mut module, &svc, &cx);
    bind_complete_password_reset(&mut module, &svc, &cx);
    bind_invite(&mut module, &svc, &cx);
    bind_accept_invite(&mut module, &svc, &cx);
    bind_add_role(&mut module, &svc, &cx);
    bind_remove_role(&mut module, &svc, &cx);
    bind_has_role(&mut module, &svc, &cx);
    engine.register_static_module("users", module.into());
 }
 // ----------------------------------------------------------------------------
 // CRUD
 // ----------------------------------------------------------------------------
 fn bind_create(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "create",
        move |opts: Map| -> Result<Map, Box<EvalAltResult>> {
            let email = required_string(&opts, "email", "users::create")?;
            let password = required_string(&opts, "password", "users::create")?;
            let display_name = optional_string(&opts, "display_name");
            let svc = svc.clone();
            let cx = cx.clone();
            let user = block_on("users", async move {
                svc.create(
                    &cx,
                    CreateUserInput {
                        email,
                        password,
                        display_name,
                    },
                )
                .await
            })?;
            Ok(user_to_map(&user))
        },
    );
 }
 fn bind_get(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "get",
        move |id: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let id = parse_user_id(id, "users::get")?;
            let svc = svc.clone();
            let cx = cx.clone();
            let user_opt = block_on("users", async move { svc.get(&cx, id).await })?;
            Ok(user_opt.map_or(Dynamic::UNIT, |u| Dynamic::from(user_to_map(&u))))
        },
    );
 }
 fn bind_find_by_email(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "find_by_email",
        move |email: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let email = email.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            let user_opt = block_on("users", async move { svc.find_by_email(&cx, &email).await })?;
            Ok(user_opt.map_or(Dynamic::UNIT, |u| Dynamic::from(user_to_map(&u))))
        },
    );
 }
 /// `users::email_available(email)` → `bool`. Anonymous-safe pre-check for
 /// self-serve registration (unlike `find_by_email`, which forbids
 /// anonymous callers). Lets a public register script branch on a free vs
 /// taken email without relying on `create`'s uniqueness error/502.
 fn bind_email_available(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "email_available",
        move |email: &str| -> Result<bool, Box<EvalAltResult>> {
            let email = email.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            block_on(
                "users",
                async move { svc.email_available(&cx, &email).await },
            )
        },
    );
 }
 fn bind_update(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "update",
        move |id: &str, patch: Map| -> Result<Map, Box<EvalAltResult>> {
            let id = parse_user_id(id, "users::update")?;
            // display_name as Some(None) means "clear"; absent means
            // "leave alone". Differentiation: present-with-() vs absent.
            let display_name = if patch.contains_key("display_name") {
                Some(optional_string(&patch, "display_name"))
            } else {
                None
            };
            let patch = UpdateUserInput { display_name };
            let svc = svc.clone();
            let cx = cx.clone();
            let user = block_on("users", async move { svc.update(&cx, id, patch).await })?;
            Ok(user_to_map(&user))
        },
    );
 }
 fn bind_delete(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "delete",
        move |id: &str| -> Result<bool, Box<EvalAltResult>> {
            let id = parse_user_id(id, "users::delete")?;
            let svc = svc.clone();
            let cx = cx.clone();
            block_on("users", async move { svc.delete(&cx, id).await })
        },
    );
 }
 fn bind_list(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "list",
        move |opts: Map| -> Result<Map, Box<EvalAltResult>> {
            let limit = match opts.get("$limit").or_else(|| opts.get("limit")) {
                None => None,
                Some(d) if d.is_unit() => None,
                Some(d) => Some(
                    d.as_int()
                        .map_err(|_| runtime_err("users::list: '$limit' must be an integer"))?,
                ),
            };
            let cursor = match opts.get("cursor") {
                None => None,
                Some(d) if d.is_unit() => None,
                Some(d) if d.is_string() => Some(d.clone().into_string().unwrap_or_default()),
                Some(_) => return Err(runtime_err("users::list: cursor must be a string or ()")),
            };
            let svc = svc.clone();
            let cx = cx.clone();
            let page: UsersListPage = block_on("users", async move {
                svc.list(&cx, UsersListOpts { cursor, limit }).await
            })?;
            Ok(list_page_to_map(&page))
        },
    );
 }
 // ----------------------------------------------------------------------------
 // Auth
 // ----------------------------------------------------------------------------
 fn bind_login(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "login",
        move |email: &str, password: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let email = email.to_string();
            let password = password.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            let session_opt: Option<GeneratedSession> =
                block_on(
                    "users",
                    async move { svc.login(&cx, &email, &password).await },
                )?;
            Ok(session_opt.map_or(Dynamic::UNIT, |s| Dynamic::from(s.token)))
        },
    );
 }
 fn bind_verify(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "verify",
        move |token: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let token = token.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            let user_opt = block_on("users", async move { svc.verify(&cx, &token).await })?;
            Ok(user_opt.map_or(Dynamic::UNIT, |u| Dynamic::from(user_to_map(&u))))
        },
    );
 }
 fn bind_logout(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "logout",
        move |token: &str| -> Result<(), Box<EvalAltResult>> {
            let token = token.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            block_on("users", async move { svc.logout(&cx, &token).await })
        },
    );
 }
 // ----------------------------------------------------------------------------
 // Email-tied (commit 5 / 6 / 7 fill the service impl behind these)
 // ----------------------------------------------------------------------------
 fn bind_send_verification_email(
    module: &mut Module,
    svc: &Arc<dyn UsersService>,
    cx: &Arc<SdkCallCx>,
 ) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "send_verification_email",
        move |id: &str, opts: Map| -> Result<(), Box<EvalAltResult>> {
            let id = parse_user_id(id, "users::send_verification_email")?;
            let opts = parse_email_template(&opts, "users::send_verification_email")?;
            let svc = svc.clone();
            let cx = cx.clone();
            block_on("users", async move {
                svc.send_verification_email(&cx, id, opts).await
            })
        },
    );
 }
 fn bind_verify_email(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "verify_email",
        move |token: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let token = token.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            let user_opt = block_on("users", async move { svc.verify_email(&cx, &token).await })?;
            Ok(user_opt.map_or(Dynamic::UNIT, |u| Dynamic::from(user_to_map(&u))))
        },
    );
 }
 fn bind_request_password_reset(
    module: &mut Module,
    svc: &Arc<dyn UsersService>,
    cx: &Arc<SdkCallCx>,
 ) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "request_password_reset",
        move |email: &str, opts: Map| -> Result<(), Box<EvalAltResult>> {
            let email = email.to_string();
            let opts = parse_email_template(&opts, "users::request_password_reset")?;
            let svc = svc.clone();
            let cx = cx.clone();
            block_on("users", async move {
                svc.request_password_reset(&cx, &email, opts).await
            })
        },
    );
 }
 fn bind_complete_password_reset(
    module: &mut Module,
    svc: &Arc<dyn UsersService>,
    cx: &Arc<SdkCallCx>,
 ) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "complete_password_reset",
        move |token: &str, new_password: &str| -> Result<Dynamic, Box<EvalAltResult>> {
            let token = token.to_string();
            let new_password = new_password.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            let user_opt = block_on("users", async move {
                svc.complete_password_reset(&cx, &token, &new_password)
                    .await
            })?;
            Ok(user_opt.map_or(Dynamic::UNIT, |u| Dynamic::from(user_to_map(&u))))
        },
    );
 }
 fn bind_invite(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "invite",
        move |email: &str, opts: Map| -> Result<(), Box<EvalAltResult>> {
            let email = email.to_string();
            let opts = parse_invite_opts(&opts)?;
            let svc = svc.clone();
            let cx = cx.clone();
            block_on("users", async move { svc.invite(&cx, &email, opts).await })
        },
    );
 }
 fn bind_accept_invite(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    // Two-arg overload: (token, password). The display_name overload is
    // bound separately because Rhai resolves functions by arity.
    {
        let svc = svc.clone();
        let cx = cx.clone();
        module.set_native_fn(
            "accept_invite",
            move |token: &str, password: &str| -> Result<Dynamic, Box<EvalAltResult>> {
                let token = token.to_string();
                let password = password.to_string();
                let svc = svc.clone();
                let cx = cx.clone();
                let accept_opt: Option<GeneratedAccept> = block_on("users", async move {
                    svc.accept_invite(&cx, &token, &password, None).await
                })?;
                Ok(accept_opt.map_or(Dynamic::UNIT, |a| Dynamic::from(a.session.token)))
            },
        );
    }
    {
        let svc = svc.clone();
        let cx = cx.clone();
        module.set_native_fn(
            "accept_invite",
            move |token: &str,
                  password: &str,
                  display_name: &str|
                  -> Result<Dynamic, Box<EvalAltResult>> {
                let token = token.to_string();
                let password = password.to_string();
                let display_name = if display_name.trim().is_empty() {
                    None
                } else {
                    Some(display_name.trim().to_string())
                };
                let svc = svc.clone();
                let cx = cx.clone();
                let accept_opt: Option<GeneratedAccept> = block_on("users", async move {
                    svc.accept_invite(&cx, &token, &password, display_name)
                        .await
                })?;
                Ok(accept_opt.map_or(Dynamic::UNIT, |a| Dynamic::from(a.session.token)))
            },
        );
    }
 }
 // ----------------------------------------------------------------------------
 // Roles (commit 9 fills the service impl)
 // ----------------------------------------------------------------------------
 fn bind_add_role(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "add_role",
        move |id: &str, role: &str| -> Result<(), Box<EvalAltResult>> {
            let id = parse_user_id(id, "users::add_role")?;
            let role = role.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            block_on("users", async move { svc.add_role(&cx, id, &role).await })
        },
    );
 }
 fn bind_remove_role(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "remove_role",
        move |id: &str, role: &str| -> Result<bool, Box<EvalAltResult>> {
            let id = parse_user_id(id, "users::remove_role")?;
            let role = role.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            block_on(
                "users",
                async move { svc.remove_role(&cx, id, &role).await },
            )
        },
    );
 }
 fn bind_has_role(module: &mut Module, svc: &Arc<dyn UsersService>, cx: &Arc<SdkCallCx>) {
    let svc = svc.clone();
    let cx = cx.clone();
    module.set_native_fn(
        "has_role",
        move |id: &str, role: &str| -> Result<bool, Box<EvalAltResult>> {
            let id = parse_user_id(id, "users::has_role")?;
            let role = role.to_string();
            let svc = svc.clone();
            let cx = cx.clone();
            block_on("users", async move { svc.has_role(&cx, id, &role).await })
        },
    );
 }
 // ----------------------------------------------------------------------------
 // Shape conversion helpers
 // ----------------------------------------------------------------------------
 fn user_to_map(user: &AppUser) -> Map {
    let mut m = Map::new();
    m.insert("id".into(), Dynamic::from(user.id.to_string()));
    m.insert("email".into(), Dynamic::from(user.email.clone()));
    m.insert(
        "display_name".into(),
        user.display_name
            .clone()
            .map_or(Dynamic::UNIT, Dynamic::from),
    );
    m.insert(
        "email_verified_at".into(),
        user.email_verified_at
            .map_or(Dynamic::UNIT, |d| Dynamic::from(d.to_rfc3339())),
    );
    m.insert(
        "last_login_at".into(),
        user.last_login_at
            .map_or(Dynamic::UNIT, |d| Dynamic::from(d.to_rfc3339())),
    );
    m.insert(
        "created_at".into(),
        Dynamic::from(user.created_at.to_rfc3339()),
    );
    m.insert(
        "updated_at".into(),
        Dynamic::from(user.updated_at.to_rfc3339()),
    );
    let roles: Array = user.roles.iter().cloned().map(Dynamic::from).collect();
    m.insert("roles".into(), roles.into());
    m
 }
 fn list_page_to_map(page: &UsersListPage) -> Map {
    let mut m = Map::new();
    let items: Array = page
        .items
        .iter()
        .map(|u| Dynamic::from(user_to_map(u)))
        .collect();
    m.insert("users".into(), items.into());
    m.insert(
        "next_cursor".into(),
        page.next_cursor
            .as_ref()
            .map_or(Dynamic::UNIT, |s| Dynamic::from(s.clone())),
    );
    m
 }
 fn parse_user_id(s: &str, ctx: &str) -> Result<AppUserId, Box<EvalAltResult>> {
    uuid::Uuid::parse_str(s)
        .map(AppUserId::from)
        .map_err(|e| runtime_err(&format!("{ctx}: id must be a UUID: {e}")))
 }
 fn parse_email_template(opts: &Map, ctx: &str) -> Result<EmailTemplateOpts, Box<EvalAltResult>> {
    Ok(EmailTemplateOpts {
        link_base: required_string(opts, "link_base", ctx)?,
        from: required_string(opts, "from", ctx)?,
        subject: required_string(opts, "subject", ctx)?,
        body_template: required_string(opts, "body_template", ctx)?,
    })
 }
 fn parse_invite_opts(opts: &Map) -> Result<InviteOpts, Box<EvalAltResult>> {
    // The template fields are optional only when invite is configured
    // to ship without an email; the service decides which is the
    // hard error. Here we forward whatever the script gave us.
    let template = if opts.contains_key("link_base")
        || opts.contains_key("subject")
        || opts.contains_key("body_template")
    {
        Some(parse_email_template(opts, "users::invite")?)
    } else {
        None
    };
    let display_name = optional_string(opts, "display_name");
    let roles = match opts.get("roles") {
        None => Vec::new(),
        Some(d) if d.is_unit() => Vec::new(),
        Some(d) => {
            if let Some(arr) = d.clone().try_cast::<Array>() {
                let mut out = Vec::with_capacity(arr.len());
                for el in arr {
                    if !el.is_string() {
                        return Err(runtime_err(
                            "users::invite: 'roles' must be an array of strings",
                        ));
                    }
                    out.push(el.into_string().unwrap_or_default());
                }
                out
            } else {
                return Err(runtime_err(
                    "users::invite: 'roles' must be an array of strings",
                ));
            }
        }
    };
    Ok(InviteOpts {
        template,
        display_name,
        roles,
    })
 }
 fn required_string(opts: &Map, key: &str, ctx: &str) -> Result<String, Box<EvalAltResult>> {
    match opts.get(key) {
        Some(d) if d.is_string() => Ok(d.clone().into_string().unwrap_or_default()),
        _ => Err(runtime_err(&format!(
            "{ctx}: '{key}' must be a string and is required"
        ))),
    }
 }
 fn optional_string(opts: &Map, key: &str) -> Option<String> {
    match opts.get(key) {
        None => None,
        Some(d) if d.is_unit() => None,
        Some(d) if d.is_string() => Some(d.clone().into_string().unwrap_or_default()),
        Some(d) => Some(d.to_string()),
    }
 }
 #[allow(clippy::unnecessary_box_returns)]
 fn runtime_err(msg: &str) -> Box<EvalAltResult> {
    EvalAltResult::ErrorRuntime(msg.into(), rhai::Position::NONE).into()
 }
--- a/crates/executor-core/src/types.rs
+++ b/crates/executor-core/src/types.rs
@@ -2,12 +2,10 @@ use std::collections::BTreeMap;
 use chrono::{DateTime, Utc};
 use picloud_shared::{
-    AppId, ExecutionId, ExecutionLog, ExecutionSource, ExecutionStatus, Principal, RequestId,
+    AppId, ExecutionId, Principal, RequestId, ScriptId, ScriptSandbox, TriggerEvent,
    ScriptId, ScriptSandbox, TriggerEvent,
 };
 use serde::{Deserialize, Serialize};
 use thiserror::Error;
 use uuid::Uuid;
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "lowercase")]
@@ -29,15 +27,6 @@ pub struct ExecRequest {
    pub script_name: String,
    pub invocation_type: InvocationType,
    pub path: String,
    /// HTTP method of the originating request, uppercased (`GET`, `POST`,
    /// …). Exposed to scripts as `ctx.request.method` so a single script
    /// can branch on the verb instead of needing one script per method.
    /// Empty for non-HTTP trigger invocations (cron/kv/docs/…), matching
    /// how `path`/`rest` are empty there.
    #[serde(default)]
    pub method: String,
    pub headers: BTreeMap<String, String>,
    pub body: serde_json::Value,
@@ -140,12 +129,7 @@ pub struct ExecStats {
    pub operations: u64,
 }
-/// Serialize/Deserialize are derived for `RemoteExecutorClient` (cluster
+#[derive(Debug, Error)]
 /// mode v1.3+) — the executor returns this shape over the wire so the
 /// orchestrator can reconstruct the variant rather than collapsing to a
 /// generic string. Audit F-N-001 follow-up.
 #[derive(Debug, Error, serde::Serialize, serde::Deserialize)]
 #[serde(rename_all = "snake_case", tag = "kind")]
 pub enum ExecError {
    #[error("script failed to parse: {0}")]
    Parse(String),
@@ -169,77 +153,3 @@ pub enum ExecError {
    #[error("execution declined: server at capacity (retry after {retry_after_secs}s)")]
    Overloaded { retry_after_secs: u32 },
 }
 /// Build an `ExecutionLog` row from one invocation's outcome.
 ///
 /// Shared by every execution path so the log shape stays identical
 /// regardless of who ran the script: the orchestrator's sync/direct HTTP
 /// handlers pass `ExecutionSource::Http`, while the manager's trigger
 /// dispatcher passes the trigger's kind (`Kv`, `Cron`, `Invoke`, …). That
 /// `source` is what lets `pic logs` surface background runs that were
 /// previously invisible. `Overloaded` is never logged — admission is
 /// refused before a row exists — but it maps to `Error` defensively.
 #[allow(clippy::too_many_arguments)]
 #[must_use]
 pub fn build_execution_log(
    app_id: AppId,
    script_id: ScriptId,
    request_id: RequestId,
    request_path: String,
    request_headers: BTreeMap<String, String>,
    request_body: serde_json::Value,
    source: ExecutionSource,
    outcome: &Result<ExecResponse, ExecError>,
    started: DateTime<Utc>,
    finished: DateTime<Utc>,
 ) -> ExecutionLog {
    let duration_ms = u64::try_from(
        finished
            .signed_duration_since(started)
            .num_milliseconds()
            .max(0),
    )
    .unwrap_or(0);
    let (status, response_code, response_body, script_logs) = match outcome {
        Ok(resp) => {
            let logs = serde_json::to_value(&resp.logs).unwrap_or(serde_json::Value::Array(vec![]));
            (
                ExecutionStatus::Success,
                Some(resp.status_code),
                Some(resp.body.clone()),
                logs,
            )
        }
        Err(e) => {
            let status = match e {
                ExecError::Timeout(_) => ExecutionStatus::Timeout,
                ExecError::OperationBudgetExceeded => ExecutionStatus::BudgetExceeded,
                _ => ExecutionStatus::Error,
            };
            (
                status,
                None,
                Some(serde_json::json!({ "error": e.to_string() })),
                serde_json::Value::Array(vec![]),
            )
        }
    };
    ExecutionLog {
        id: Uuid::new_v4(),
        app_id,
        script_id,
        request_id,
        request_path,
        request_headers,
        request_body,
        response_code,
        response_body,
        script_logs,
        duration_ms,
        status,
        source,
        created_at: started,
    }
 }
--- a/crates/executor-core/tests/engine.rs
+++ b/crates/executor-core/tests/engine.rs
@@ -15,7 +15,6 @@ fn req(body: serde_json::Value) -> ExecRequest {
        script_name: "test".into(),
        invocation_type: InvocationType::Http,
        path: "/test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body,
        params: BTreeMap::new(),
@@ -50,22 +49,6 @@ fn validate_rejects_syntax_errors() {
    assert!(matches!(err, ExecError::Parse(_)));
 }
 #[test]
 fn debug_and_print_symbols_are_disabled() {
    // Audit 2026-06-11 (F-SE-H-03) — neither `print` nor `debug` may
    // reach the host's stdout/stderr; both are disabled at the symbol
    // level, so a script that calls them fails to parse/validate.
    for src in [r#"print("x")"#, r#"debug("x")"#] {
        let err = engine()
            .validate(src)
            .expect_err("disabled output symbol should be rejected");
        assert!(
            matches!(err, ExecError::Parse(_)),
            "{src} should be a parse-time rejection, got {err:?}"
        );
    }
 }
 #[test]
 fn returns_unwrapped_value_as_200_body() {
    let resp = engine()
@@ -104,7 +87,6 @@ fn ctx_exposes_request_data() {
    ";
    let r = ExecRequest {
        path: "/payments".into(),
        method: String::new(),
        body: json!({ "amount": 1234 }),
        script_name: "payments".into(),
        ..req(json!(null))
@@ -116,19 +98,6 @@ fn ctx_exposes_request_data() {
    );
 }
 #[test]
 fn ctx_exposes_request_method() {
    // A single script can branch on the verb instead of needing one
    // script per method (E2E report F4).
    let src = r"#{ statusCode: 200, body: #{ method: ctx.request.method } }";
    let r = ExecRequest {
        method: "PATCH".into(),
        ..req(json!(null))
    };
    let resp = engine().execute(src, r).unwrap();
    assert_eq!(resp.body, json!({ "method": "PATCH" }));
 }
 #[test]
 fn captures_log_calls() {
    let src = r#"
@@ -204,54 +173,6 @@ fn override_only_replaces_specified_field() {
    assert_eq!(resp.body, json!("hello"));
 }
 #[test]
 fn deadline_terminates_a_runaway_loop() {
    // Audit 2026-06-11 H-C1 closure. With a generous op budget the
    // previous engine ran a `loop {}` body until `max_operations`
    // self-exhausted (potentially seconds on Pi-class hardware) and the
    // outer `tokio::time::timeout` only dropped the awaiting future —
    // not the OS thread. With `on_progress` consulting the deadline,
    // a 100 ms deadline aborts within a few hundred ms even when the
    // op budget would allow far more work.
    let limits = Limits {
        max_operations: u64::MAX,
        ..Limits::default()
    };
    let engine = Engine::new(limits, Services::default());
    let src = r"let n = 0; loop { n += 1; }";
    let deadline = Some(std::time::Instant::now() + std::time::Duration::from_millis(100));
    let started = std::time::Instant::now();
    let err = engine
        .execute_with_deadline(src, req(json!(null)), deadline)
        .expect_err("runaway loop must terminate");
    let elapsed = started.elapsed();
    assert!(
        elapsed < std::time::Duration::from_secs(2),
        "deadline should fire within ~hundreds of ms, took {elapsed:?}"
    );
    // ErrorTerminated maps to ExecError::Runtime via map_eval_error.
    assert!(
        matches!(err, ExecError::Runtime(_)),
        "expected Runtime, got {err:?}"
    );
 }
 #[test]
 fn no_deadline_set_does_not_abort() {
    // Smoke: a deadline-less execute is unchanged from the pre-audit
    // behavior — the per-op budget is what stops things.
    let limits = Limits {
        max_operations: 100,
        ..Limits::default()
    };
    let engine = Engine::new(limits, Services::default());
    let src = r"let n = 0; for i in 0..10000 { n += 1; } n";
    let err = engine
        .execute_with_deadline(src, req(json!(null)), None)
        .expect_err("budget should still bite");
    assert!(matches!(err, ExecError::OperationBudgetExceeded));
 }
 #[test]
 fn runtime_error_is_mapped_to_runtime_variant() {
    let err = engine()
--- a/crates/executor-core/tests/module_redaction_logging.rs
+++ b/crates/executor-core/tests/module_redaction_logging.rs
@@ -66,7 +66,6 @@ fn req(app_id: AppId) -> ExecRequest {
        script_name: "redaction-test".into(),
        invocation_type: InvocationType::Http,
        path: "/x".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
@@ -104,9 +103,6 @@ async fn original_backend_error_is_logged_at_error_level() {
        Arc::new(picloud_shared::NoopPubsubService),
        Arc::new(picloud_shared::NoopSecretsService),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    );
    let engine = Engine::new(Limits::default(), services);
--- a/crates/executor-core/tests/modules.rs
+++ b/crates/executor-core/tests/modules.rs
@@ -101,9 +101,6 @@ fn services_with(modules: Arc<dyn ModuleSource>) -> Services {
        Arc::new(picloud_shared::NoopPubsubService),
        Arc::new(picloud_shared::NoopSecretsService),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    )
 }
@@ -120,7 +117,6 @@ fn req(app_id: AppId) -> ExecRequest {
        script_name: "test".into(),
        invocation_type: InvocationType::Http,
        path: "/test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: serde_json::Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/sdk_contract.rs
+++ b/crates/executor-core/tests/sdk_contract.rs
@@ -43,7 +43,6 @@ fn baseline_request() -> ExecRequest {
        script_name: "contract".into(),
        invocation_type: InvocationType::Http,
        path: "/contract-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/sdk_docs.rs
+++ b/crates/executor-core/tests/sdk_docs.rs
@@ -232,9 +232,6 @@ fn make_engine() -> Arc<Engine> {
        Arc::new(picloud_shared::NoopPubsubService),
        Arc::new(picloud_shared::NoopSecretsService),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
@@ -248,7 +245,6 @@ fn baseline_request(app_id: AppId) -> ExecRequest {
        script_name: "docs-test".into(),
        invocation_type: InvocationType::Http,
        path: "/docs-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/sdk_email.rs
+++ b/crates/executor-core/tests/sdk_email.rs
@@ -41,9 +41,6 @@ fn engine_with(rec: Arc<RecordingEmail>) -> Arc<Engine> {
        Arc::new(picloud_shared::NoopPubsubService),
        Arc::new(picloud_shared::NoopSecretsService),
        rec,
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
@@ -57,7 +54,6 @@ fn baseline_request(app_id: AppId) -> ExecRequest {
        script_name: "email-test".into(),
        invocation_type: InvocationType::Http,
        path: "/email-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/sdk_files.rs
+++ b/crates/executor-core/tests/sdk_files.rs
@@ -169,9 +169,6 @@ fn make_engine() -> Arc<Engine> {
        Arc::new(picloud_shared::NoopPubsubService),
        Arc::new(picloud_shared::NoopSecretsService),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
@@ -185,7 +182,6 @@ fn baseline_request(app_id: AppId) -> ExecRequest {
        script_name: "files-test".into(),
        invocation_type: InvocationType::Http,
        path: "/files-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/sdk_http.rs
+++ b/crates/executor-core/tests/sdk_http.rs
@@ -92,9 +92,6 @@ fn engine_with(http: Arc<dyn HttpService>) -> Arc<Engine> {
        Arc::new(picloud_shared::NoopPubsubService),
        Arc::new(picloud_shared::NoopSecretsService),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
@@ -108,7 +105,6 @@ fn baseline_request(app_id: AppId, script_id: ScriptId) -> ExecRequest {
        script_name: "http-test".into(),
        invocation_type: InvocationType::Http,
        path: "/http-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/sdk_invoke.rs
+++ b/crates/executor-core/tests/sdk_invoke.rs
@@ -1,253 +0,0 @@
 //! `invoke()` SDK bridge integration tests — runs a real Rhai engine
 //! against an in-memory `InvokeService` that fakes script resolution.
 //! Verifies sync re-entry via `Engine::set_self_weak`, the cx-threading
 //! that gives the callee `trigger_depth + 1`, cross-app rejection, depth
 //! limit, FnPtr-in-args rejection, and `invoke_async` payload shape.
 use std::collections::BTreeMap;
 use std::sync::{Arc, Mutex};
 use async_trait::async_trait;
 use chrono::Utc;
 use picloud_executor_core::{Engine, ExecRequest, InvocationType, Limits};
 use picloud_shared::{
    AppId, ExecutionId, InvokeError, InvokeService, InvokeTarget, NoopDeadLetterService,
    NoopDocsService, NoopEmailService, NoopEventEmitter, NoopFilesService, NoopHttpService,
    NoopKvService, NoopModuleSource, NoopPubsubService, NoopQueueService, NoopSecretsService,
    NoopUsersService, RequestId, ResolvedScript, ScriptId, ScriptSandbox, SdkCallCx, Services,
 };
 use serde_json::{json, Value};
 #[derive(Default)]
 struct FakeInvokeService {
    scripts: Mutex<Vec<(ScriptId, AppId, String, String)>>, // (id, app, name, source)
    async_payloads: Mutex<Vec<Value>>,
 }
 impl FakeInvokeService {
    fn register(&self, app: AppId, name: &str, source: &str) -> ScriptId {
        let id = ScriptId::new();
        self.scripts
            .lock()
            .unwrap()
            .push((id, app, name.to_string(), source.to_string()));
        id
    }
 }
 #[async_trait]
 impl InvokeService for FakeInvokeService {
    async fn resolve(
        &self,
        cx: &SdkCallCx,
        target: InvokeTarget,
    ) -> Result<ResolvedScript, InvokeError> {
        let entries = self.scripts.lock().unwrap().clone();
        let hit = entries.iter().find(|(id, _app, name, _)| match &target {
            InvokeTarget::Id(t) => t == id,
            // Test stashes route paths in the `name` column, so Path
            // and Name match the same field.
            InvokeTarget::Name(t) | InvokeTarget::Path(t) => t == name,
        });
        let (id, app, name, source): (ScriptId, AppId, String, String) = hit
            .ok_or_else(|| InvokeError::NotFound(target.describe()))?
            .clone();
        if app != cx.app_id {
            return Err(InvokeError::CrossApp);
        }
        Ok(ResolvedScript {
            script_id: id,
            app_id: app,
            source,
            updated_at: Utc::now(),
            name,
        })
    }
    async fn enqueue_async(
        &self,
        _cx: &SdkCallCx,
        _target: InvokeTarget,
        args: Value,
    ) -> Result<ExecutionId, InvokeError> {
        self.async_payloads.lock().unwrap().push(args);
        Ok(ExecutionId::new())
    }
 }
 fn build_engine(svc: Arc<FakeInvokeService>) -> Arc<Engine> {
    let services = Services::new(
        Arc::new(NoopKvService),
        Arc::new(NoopDocsService),
        Arc::new(NoopDeadLetterService),
        Arc::new(NoopEventEmitter),
        Arc::new(NoopModuleSource),
        Arc::new(NoopHttpService),
        Arc::new(NoopFilesService),
        Arc::new(NoopPubsubService),
        Arc::new(NoopSecretsService),
        Arc::new(NoopEmailService),
        Arc::new(NoopUsersService),
        Arc::new(NoopQueueService),
        svc,
    );
    let engine = Arc::new(Engine::new(Limits::default(), services));
    engine.set_self_weak(Arc::downgrade(&engine));
    engine
 }
 fn baseline_request(app_id: AppId) -> ExecRequest {
    let execution_id = ExecutionId::new();
    ExecRequest {
        execution_id,
        request_id: RequestId::new(),
        script_id: ScriptId::new(),
        script_name: "caller".into(),
        invocation_type: InvocationType::Http,
        path: "/caller".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
        query: BTreeMap::new(),
        rest: String::new(),
        sandbox_overrides: ScriptSandbox::default(),
        app_id,
        principal: None,
        trigger_depth: 0,
        root_execution_id: execution_id,
        is_dead_letter_handler: false,
        event: None,
    }
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn invoke_returns_callee_value() {
    let app = AppId::new();
    let svc = Arc::new(FakeInvokeService::default());
    svc.register(app, "worker", "ctx.request.body.x + 1");
    let engine = build_engine(svc);
    let src = r#"
        let n = invoke("worker", #{ x: 41 });
        #{ statusCode: 200, body: n }
    "#
    .to_string();
    let req = baseline_request(app);
    let resp = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap()
        .unwrap();
    assert_eq!(resp.body, json!(42));
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn invoke_cross_app_rejects() {
    let caller_app = AppId::new();
    let other_app = AppId::new();
    let svc = Arc::new(FakeInvokeService::default());
    svc.register(other_app, "worker", "0"); // belongs to other_app
    let engine = build_engine(svc);
    let src = r#"invoke("worker", #{});"#.to_string();
    let req = baseline_request(caller_app);
    let res = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap();
    let err = res.unwrap_err().to_string();
    assert!(
        err.contains("different app") || err.contains("CrossApp"),
        "expected cross-app rejection, got: {err}"
    );
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn invoke_depth_limit_exceeded() {
    let app = AppId::new();
    let svc = Arc::new(FakeInvokeService::default());
    // recursive: calls itself again — would loop without the bound.
    svc.register(app, "loop", r#"invoke("loop", #{})"#);
    let engine = build_engine(svc);
    let src = r#"invoke("loop", #{});"#.to_string();
    let req = baseline_request(app);
    let res = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap();
    let err = res.unwrap_err().to_string();
    assert!(
        err.contains("depth limit"),
        "expected depth limit error, got: {err}"
    );
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn invoke_callee_sees_incremented_depth() {
    let app = AppId::new();
    let svc = Arc::new(FakeInvokeService::default());
    // The callee returns its own trigger_depth so the caller can assert
    // it bumped from 0 → 1.
    svc.register(app, "depth_probe", "ctx.trigger_depth");
    let engine = build_engine(svc);
    let src = r#"
        let d = invoke("depth_probe", #{});
        #{ statusCode: 200, body: d }
    "#
    .to_string();
    let req = baseline_request(app);
    let resp = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap()
        .unwrap();
    // ctx exposes trigger_depth? — not yet (it's not in build_ctx_map).
    // Skip the strict assertion — the test still ensures the invoke
    // chain didn't throw. (See HANDBACK §11 for cx.trigger_depth surface
    // exposure as a v1.2 follow-up.)
    let _ = resp;
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn invoke_rejects_fnptr_in_args() {
    let app = AppId::new();
    let svc = Arc::new(FakeInvokeService::default());
    svc.register(app, "worker", "0");
    let engine = build_engine(svc);
    let src = r#"
        let f = |x| x + 1;
        invoke("worker", #{ cb: f });
    "#
    .to_string();
    let req = baseline_request(app);
    let res = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap();
    let err = res.unwrap_err().to_string();
    assert!(
        err.contains("FnPtr") || err.contains("closure"),
        "expected FnPtr rejection, got: {err}"
    );
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn invoke_async_returns_execution_id_string() {
    let app = AppId::new();
    let svc = Arc::new(FakeInvokeService::default());
    svc.register(app, "worker", "0");
    let engine = build_engine(svc.clone());
    let src = r#"
        let id = invoke_async("worker", #{ x: 1 });
        #{ statusCode: 200, body: id }
    "#
    .to_string();
    let req = baseline_request(app);
    let resp = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap()
        .unwrap();
    // Body is a string — a UUID — surfaced as Json::String.
    let id = resp.body.as_str().expect("body should be a string");
    assert!(
        uuid::Uuid::parse_str(id).is_ok(),
        "expected UUID, got: {id}"
    );
    let payloads = svc.async_payloads.lock().unwrap().clone();
    assert_eq!(payloads.len(), 1);
    assert_eq!(payloads[0], json!({ "x": 1 }));
 }
--- a/crates/executor-core/tests/sdk_kv.rs
+++ b/crates/executor-core/tests/sdk_kv.rs
@@ -111,9 +111,6 @@ fn make_engine() -> Arc<Engine> {
        Arc::new(picloud_shared::NoopPubsubService),
        Arc::new(picloud_shared::NoopSecretsService),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
@@ -127,7 +124,6 @@ fn baseline_request(app_id: AppId) -> ExecRequest {
        script_name: "kv-test".into(),
        invocation_type: InvocationType::Http,
        path: "/kv-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/sdk_pubsub.rs
+++ b/crates/executor-core/tests/sdk_pubsub.rs
@@ -49,9 +49,6 @@ fn make_engine(svc: Arc<RecordingPubsub>) -> Arc<Engine> {
        svc,
        Arc::new(picloud_shared::NoopSecretsService),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
@@ -65,7 +62,6 @@ fn baseline_request(app_id: AppId) -> ExecRequest {
        script_name: "pubsub-test".into(),
        invocation_type: InvocationType::Http,
        path: "/pubsub-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/sdk_queue.rs
+++ b/crates/executor-core/tests/sdk_queue.rs
@@ -1,209 +0,0 @@
 //! `queue::` SDK bridge integration tests — runs a real Rhai engine
 //! against an in-memory `QueueService` that records the enqueued
 //! `(queue_name, payload, opts)`. Verifies opts handling, blob
 //! base64 encoding, depth/depth_pending pass-through.
 use std::collections::BTreeMap;
 use std::sync::{Arc, Mutex};
 use async_trait::async_trait;
 use picloud_executor_core::{Engine, ExecRequest, InvocationType, Limits};
 use picloud_shared::{
    AppId, EnqueueOpts, ExecutionId, NoopDeadLetterService, NoopDocsService, NoopEventEmitter,
    NoopFilesService, NoopHttpService, NoopKvService, NoopModuleSource, NoopPubsubService,
    QueueError, QueueMessageId, QueueService, RequestId, ScriptId, ScriptSandbox, SdkCallCx,
    Services,
 };
 use serde_json::{json, Value};
 #[derive(Default)]
 struct RecordingQueue {
    enqueues: Mutex<Vec<(String, Value, EnqueueOpts)>>,
    depth: Mutex<u64>,
    depth_pending: Mutex<u64>,
 }
 #[async_trait]
 impl QueueService for RecordingQueue {
    async fn enqueue(
        &self,
        _cx: &SdkCallCx,
        queue_name: &str,
        payload: Value,
        opts: EnqueueOpts,
    ) -> Result<QueueMessageId, QueueError> {
        if queue_name.is_empty() {
            return Err(QueueError::EmptyName);
        }
        self.enqueues
            .lock()
            .unwrap()
            .push((queue_name.to_string(), payload, opts));
        Ok(QueueMessageId::new())
    }
    async fn depth(&self, _cx: &SdkCallCx, _queue_name: &str) -> Result<u64, QueueError> {
        Ok(*self.depth.lock().unwrap())
    }
    async fn depth_pending(&self, _cx: &SdkCallCx, _queue_name: &str) -> Result<u64, QueueError> {
        Ok(*self.depth_pending.lock().unwrap())
    }
 }
 fn make_engine(svc: Arc<RecordingQueue>) -> Arc<Engine> {
    let services = Services::new(
        Arc::new(NoopKvService),
        Arc::new(NoopDocsService),
        Arc::new(NoopDeadLetterService),
        Arc::new(NoopEventEmitter),
        Arc::new(NoopModuleSource),
        Arc::new(NoopHttpService),
        Arc::new(NoopFilesService),
        Arc::new(NoopPubsubService),
        Arc::new(picloud_shared::NoopSecretsService),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        svc,
        Arc::new(picloud_shared::NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
 fn baseline_request(app_id: AppId) -> ExecRequest {
    let execution_id = ExecutionId::new();
    ExecRequest {
        execution_id,
        request_id: RequestId::new(),
        script_id: ScriptId::new(),
        script_name: "queue-test".into(),
        invocation_type: InvocationType::Http,
        path: "/queue-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
        query: BTreeMap::new(),
        rest: String::new(),
        sandbox_overrides: ScriptSandbox::default(),
        app_id,
        principal: None,
        trigger_depth: 0,
        root_execution_id: execution_id,
        is_dead_letter_handler: false,
        event: None,
    }
 }
 async fn run(engine: Arc<Engine>, src: &str, req: ExecRequest) {
    let src = src.to_string();
    tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .expect("spawn_blocking should not panic")
        .expect("script execution should succeed");
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn enqueue_map_payload() {
    let svc = Arc::new(RecordingQueue::default());
    let engine = make_engine(svc.clone());
    run(
        engine,
        r#"queue::enqueue("jobs", #{ id: 1, name: "x" });"#,
        baseline_request(AppId::new()),
    )
    .await;
    let (qn, msg, opts) = svc.enqueues.lock().unwrap()[0].clone();
    assert_eq!(qn, "jobs");
    assert_eq!(msg, json!({ "id": 1, "name": "x" }));
    assert!(opts.delay_ms.is_none());
    assert!(opts.max_attempts.is_none());
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn enqueue_with_opts_threads_through() {
    let svc = Arc::new(RecordingQueue::default());
    let engine = make_engine(svc.clone());
    run(
        engine,
        r#"queue::enqueue("jobs", #{ x: 1 }, #{ delay_ms: 60000, max_attempts: 5 });"#,
        baseline_request(AppId::new()),
    )
    .await;
    let (qn, _msg, opts) = svc.enqueues.lock().unwrap()[0].clone();
    assert_eq!(qn, "jobs");
    assert_eq!(opts.delay_ms, Some(60_000));
    assert_eq!(opts.max_attempts, Some(5));
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn enqueue_blob_base64_encodes() {
    let svc = Arc::new(RecordingQueue::default());
    let engine = make_engine(svc.clone());
    run(
        engine,
        r#"
            let data = base64::decode("aGVsbG8=");
            queue::enqueue("blobs", #{ raw: data });
        "#,
        baseline_request(AppId::new()),
    )
    .await;
    let (_qn, msg, _opts) = svc.enqueues.lock().unwrap()[0].clone();
    assert_eq!(msg, json!({ "raw": "aGVsbG8=" }));
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn depth_returns_service_value() {
    let svc = Arc::new(RecordingQueue::default());
    *svc.depth.lock().unwrap() = 99;
    let engine = make_engine(svc.clone());
    // Stash result via a known-shape map; the engine returns the eval value.
    let src = r#"
        let n = queue::depth("any");
        #{ statusCode: 200, body: n }
    "#
    .to_string();
    let req = baseline_request(AppId::new());
    let resp = tokio::task::spawn_blocking({
        let engine = engine.clone();
        move || engine.execute(&src, req)
    })
    .await
    .expect("spawn_blocking should not panic")
    .expect("script execution should succeed");
    assert_eq!(resp.body, json!(99));
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn enqueue_rejects_fnptr_in_payload() {
    let svc = Arc::new(RecordingQueue::default());
    let engine = make_engine(svc.clone());
    let src = r#"
        let f = |x| x + 1;
        queue::enqueue("jobs", #{ closure: f });
    "#
    .to_string();
    let req = baseline_request(AppId::new());
    let res = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .expect("spawn_blocking should not panic");
    let err = res.unwrap_err();
    let msg = err.to_string();
    assert!(
        msg.contains("FnPtr") || msg.contains("closure"),
        "expected FnPtr rejection, got: {msg}"
    );
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn enqueue_empty_name_throws() {
    let svc = Arc::new(RecordingQueue::default());
    let engine = make_engine(svc.clone());
    let src = r#"queue::enqueue("", 1);"#.to_string();
    let req = baseline_request(AppId::new());
    let res = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .expect("spawn_blocking should not panic");
    assert!(res.is_err(), "empty queue_name should throw");
 }
--- a/crates/executor-core/tests/sdk_retry.rs
+++ b/crates/executor-core/tests/sdk_retry.rs
@@ -1,172 +0,0 @@
 //! `retry::*` SDK bridge integration tests — runs real Rhai scripts
 //! that build a Policy, wrap a closure, and verify the retry / on_codes
 //! behavior end-to-end. Sleep delays are kept to 1ms so the suite runs
 //! fast.
 use std::collections::BTreeMap;
 use std::sync::{Arc, Mutex};
 use picloud_executor_core::{Engine, ExecRequest, InvocationType, Limits};
 use picloud_shared::{
    AppId, ExecutionId, NoopDeadLetterService, NoopDocsService, NoopEmailService, NoopEventEmitter,
    NoopFilesService, NoopHttpService, NoopInvokeService, NoopKvService, NoopModuleSource,
    NoopPubsubService, NoopQueueService, NoopSecretsService, NoopUsersService, RequestId, ScriptId,
    ScriptSandbox, Services,
 };
 use serde_json::Value;
 fn build_engine() -> Arc<Engine> {
    let services = Services::new(
        Arc::new(NoopKvService),
        Arc::new(NoopDocsService),
        Arc::new(NoopDeadLetterService),
        Arc::new(NoopEventEmitter),
        Arc::new(NoopModuleSource),
        Arc::new(NoopHttpService),
        Arc::new(NoopFilesService),
        Arc::new(NoopPubsubService),
        Arc::new(NoopSecretsService),
        Arc::new(NoopEmailService),
        Arc::new(NoopUsersService),
        Arc::new(NoopQueueService),
        Arc::new(NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
 fn baseline_request(app_id: AppId) -> ExecRequest {
    let execution_id = ExecutionId::new();
    ExecRequest {
        execution_id,
        request_id: RequestId::new(),
        script_id: ScriptId::new(),
        script_name: "retry-test".into(),
        invocation_type: InvocationType::Http,
        path: "/retry-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
        query: BTreeMap::new(),
        rest: String::new(),
        sandbox_overrides: ScriptSandbox::default(),
        app_id,
        principal: None,
        trigger_depth: 0,
        root_execution_id: execution_id,
        is_dead_letter_handler: false,
        event: None,
    }
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn retry_run_succeeds_first_try() {
    let engine = build_engine();
    let src = r"
        let p = retry::policy(#{ max_attempts: 3, base_ms: 1 });
        let v = retry::run(p, || 42);
        #{ statusCode: 200, body: v }
    "
    .to_string();
    let req = baseline_request(AppId::new());
    let resp = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap()
        .unwrap();
    assert_eq!(resp.body, serde_json::json!(42));
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn retry_run_surfaces_after_max_attempts() {
    let engine = build_engine();
    let src = r#"
        let p = retry::policy(#{ max_attempts: 3, base_ms: 1, jitter_pct: 0 });
        retry::run(p, || { throw "boom" });
    "#
    .to_string();
    let req = baseline_request(AppId::new());
    let res = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap();
    let err = res.unwrap_err().to_string();
    assert!(err.contains("boom"), "expected 'boom' in error, got: {err}");
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn retry_on_codes_filters_unmatched_errors() {
    let engine = build_engine();
    // Throw a message NOT in the filter; retry::run must surface
    // immediately (no retries).
    let src = r#"
        let p = retry::policy(#{ max_attempts: 5, base_ms: 1, jitter_pct: 0 });
        let p2 = retry::on_codes(p, ["http: 503"]);
        retry::run(p2, || { throw "other failure" });
    "#
    .to_string();
    let req = baseline_request(AppId::new());
    let res = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap();
    let err = res.unwrap_err().to_string();
    assert!(
        err.contains("other failure"),
        "expected immediate surface, got: {err}"
    );
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn retry_policy_clamps_visible_at_script_layer() {
    // jitter_pct = 999 should clamp to 100 silently; the policy is then
    // usable.
    let engine = build_engine();
    let src = r#"
        let p = retry::policy(#{
            max_attempts: 30, base_ms: 100, jitter_pct: 999, backoff: "constant"
        });
        let v = retry::run(p, || 1);
        #{ statusCode: 200, body: v }
    "#
    .to_string();
    let req = baseline_request(AppId::new());
    let resp = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap()
        .unwrap();
    assert_eq!(resp.body, serde_json::json!(1));
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn retry_policy_rejects_bogus_backoff() {
    let engine = build_engine();
    let src = r#"retry::policy(#{ backoff: "bogus" });"#.to_string();
    let req = baseline_request(AppId::new());
    let res = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap();
    assert!(res.is_err());
 }
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn retry_run_eventually_succeeds() {
    // Use an in-engine counter to simulate "fails 2 times then succeeds".
    let engine = build_engine();
    let counter = Arc::new(Mutex::new(0_i64));
    let _ = counter; // counter via Rhai-side `let` instead
    let src = r#"
        let attempts = 0;
        let p = retry::policy(#{ max_attempts: 5, base_ms: 1, jitter_pct: 0 });
        let v = retry::run(p, || {
            attempts += 1;
            if attempts < 3 { throw "transient" } else { attempts }
        });
        #{ statusCode: 200, body: v }
    "#
    .to_string();
    let req = baseline_request(AppId::new());
    let resp = tokio::task::spawn_blocking(move || engine.execute(&src, req))
        .await
        .unwrap()
        .unwrap();
    assert_eq!(resp.body, serde_json::json!(3));
 }
--- a/crates/executor-core/tests/sdk_secrets.rs
+++ b/crates/executor-core/tests/sdk_secrets.rs
@@ -102,9 +102,6 @@ fn make_engine() -> Arc<Engine> {
        Arc::new(picloud_shared::NoopPubsubService),
        Arc::new(InMemorySecrets::default()),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
@@ -118,7 +115,6 @@ fn baseline_request(app_id: AppId) -> ExecRequest {
        script_name: "secrets-test".into(),
        invocation_type: InvocationType::Http,
        path: "/secrets-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/sdk_subscriber_token.rs
+++ b/crates/executor-core/tests/sdk_subscriber_token.rs
@@ -96,9 +96,6 @@ fn make_engine() -> Arc<Engine> {
        Arc::new(FakeMintPubsub),
        Arc::new(picloud_shared::NoopSecretsService),
        Arc::new(picloud_shared::NoopEmailService),
        Arc::new(picloud_shared::NoopUsersService),
        Arc::new(picloud_shared::NoopQueueService),
        Arc::new(picloud_shared::NoopInvokeService),
    );
    Arc::new(Engine::new(Limits::default(), services))
 }
@@ -112,7 +109,6 @@ fn request(app_id: AppId, with_principal: bool) -> ExecRequest {
        script_name: "token-test".into(),
        invocation_type: InvocationType::Http,
        path: "/token-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/executor-core/tests/stdlib.rs
+++ b/crates/executor-core/tests/stdlib.rs
@@ -29,7 +29,6 @@ fn baseline_request() -> ExecRequest {
        script_name: "stdlib".into(),
        invocation_type: InvocationType::Http,
        path: "/stdlib-test".into(),
        method: String::new(),
        headers: BTreeMap::new(),
        body: Value::Null,
        params: BTreeMap::new(),
--- a/crates/manager-core/Cargo.toml
+++ b/crates/manager-core/Cargo.toml
@@ -14,7 +14,6 @@ picloud-executor-core.workspace = true
 picloud-orchestrator-core.workspace = true
 async-trait.workspace = true
 futures.workspace = true
 axum.workspace = true
 rand.workspace = true
 serde.workspace = true
--- a/crates/manager-core/migrations/0026_app_users.sql
+++ b/crates/manager-core/migrations/0026_app_users.sql
@@ -1,31 +0,0 @@
 -- v1.1.8 User Management — data-plane app users.
 --
 -- Distinct from `admin_users` (control-plane operators). These are the
 -- end-users of apps built on PiCloud — created and managed by user
 -- scripts via the `users::*` SDK, surfaced to the dashboard via
 -- `/api/v1/admin/apps/{id}/users/*`.
 --
 -- Identity tuple is `(app_id, id)`; uniqueness is enforced on
 -- `(app_id, lower(email))` so the same email can exist across two apps
 -- but not twice within one app. Email case is preserved in storage and
 -- normalized only at the index / lookup boundary.
 --
 -- Password hash is Argon2id PHC (same algorithm as `admin_users` — the
 -- script-end-user trust shape and the operator-account trust shape
 -- happen to coincide on the hashing primitive even though everything
 -- else about the two tables is independent).
 CREATE TABLE app_users (
    id                 UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    app_id             UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
    email              TEXT NOT NULL,
    password_hash      TEXT NOT NULL,
    display_name       TEXT,
    email_verified_at  TIMESTAMPTZ,
    last_login_at      TIMESTAMPTZ,
    created_at         TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at         TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 CREATE UNIQUE INDEX idx_app_users_app_email_lower ON app_users (app_id, lower(email));
 CREATE INDEX idx_app_users_app ON app_users (app_id);
--- a/crates/manager-core/migrations/0027_app_user_sessions.sql
+++ b/crates/manager-core/migrations/0027_app_user_sessions.sql
@@ -1,35 +0,0 @@
 -- v1.1.8 User Management — app-user sessions.
 --
 -- Distinct from `admin_sessions`. Mirror the schema shape (token_hash
 -- PK, user FK cascading) but add:
 --
 --   * app_id   — every v1.1+ data-plane table starts with the app_id
 --                FK so cross-app isolation is bright at the SQL level
 --                and ON DELETE CASCADE wipes sessions when an app is
 --                deleted (in addition to the user-FK cascade).
 --   * absolute_expires_at — hard cap on the sliding window. The
 --                application caps new_expires_at at this value on each
 --                touch; beyond it, force re-login.
 --   * revoked_at — explicit revocation (admin "revoke all sessions"
 --                button, password reset, logout). The lookup query
 --                rejects revoked rows so a revoked session is dead
 --                immediately, before the GC sweep runs.
 --
 -- `token_hash` stores SHA-256(raw_token) as hex; the raw lives only in
 -- the script's return value from `users::login` / `users::accept_invite`
 -- and the realtime subscriber's Authorization header.
 CREATE TABLE app_user_sessions (
    token_hash           TEXT PRIMARY KEY,
    app_id               UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
    user_id              UUID NOT NULL REFERENCES app_users(id) ON DELETE CASCADE,
    created_at           TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    last_used_at         TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    expires_at           TIMESTAMPTZ NOT NULL,
    absolute_expires_at  TIMESTAMPTZ NOT NULL,
    revoked_at           TIMESTAMPTZ
 );
 CREATE INDEX idx_app_user_sessions_user ON app_user_sessions (app_id, user_id);
 CREATE INDEX idx_app_user_sessions_expiry
    ON app_user_sessions (expires_at) WHERE revoked_at IS NULL;
--- a/crates/manager-core/migrations/0028_app_user_email_verifications.sql
+++ b/crates/manager-core/migrations/0028_app_user_email_verifications.sql
@@ -1,19 +0,0 @@
 -- v1.1.8 User Management — email verification tokens.
 --
 -- Created by `users::send_verification_email`; consumed by
 -- `users::verify_email`. Same SHA-256 token-hash shape as
 -- `app_user_sessions`. Single-use: the consume path is an atomic
 -- UPDATE WHERE consumed_at IS NULL so a replayed token returns
 -- "missing" the second time around without spurious side effects.
 CREATE TABLE app_user_email_verifications (
    token_hash    TEXT PRIMARY KEY,
    app_id        UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
    user_id       UUID NOT NULL REFERENCES app_users(id) ON DELETE CASCADE,
    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    expires_at    TIMESTAMPTZ NOT NULL,
    consumed_at   TIMESTAMPTZ
 );
 CREATE INDEX idx_app_user_email_verifications_user
    ON app_user_email_verifications (app_id, user_id);
--- a/crates/manager-core/migrations/0029_app_user_password_resets.sql
+++ b/crates/manager-core/migrations/0029_app_user_password_resets.sql
@@ -1,23 +0,0 @@
 -- v1.1.8 User Management — password reset tokens.
 --
 -- Identical shape to `app_user_email_verifications`. Same one-shot
 -- semantics via atomic UPDATE WHERE consumed_at IS NULL. Default TTL
 -- is shorter (1h vs 48h) — reset tokens are higher-risk than email
 -- verification (whoever holds them can change the password).
 --
 -- `users::request_password_reset` deliberately returns no signal to
 -- script-land about whether the email matched, so probing this table
 -- via mass-replay isn't a clean enumeration vector. The application
 -- enforces "no existence leak"; this migration is just storage.
 CREATE TABLE app_user_password_resets (
    token_hash    TEXT PRIMARY KEY,
    app_id        UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
    user_id       UUID NOT NULL REFERENCES app_users(id) ON DELETE CASCADE,
    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    expires_at    TIMESTAMPTZ NOT NULL,
    consumed_at   TIMESTAMPTZ
 );
 CREATE INDEX idx_app_user_password_resets_user
    ON app_user_password_resets (app_id, user_id);
--- a/crates/manager-core/migrations/0030_app_user_invitations.sql
+++ b/crates/manager-core/migrations/0030_app_user_invitations.sql
@@ -1,29 +0,0 @@
 -- v1.1.8 User Management — invitations.
 --
 -- Unlike verification + reset tokens, invitations don't carry a
 -- user_id — the user doesn't exist yet. Instead they pre-stage the
 -- email, an optional display name, and a roles array applied on
 -- accept (once the per-app role table exists in migration 0031).
 --
 -- token_hash UNIQUE is the lookup key; the surrogate `id` UUID is
 -- what the admin invitations UI references (rotation-safe; an
 -- admin can list pending invites by id without leaking tokens).
 --
 -- accepted_at gates one-shot semantics: the consume path is an
 -- atomic UPDATE WHERE accepted_at IS NULL. Stale accept attempts get
 -- nothing, so a leaked / cached token can't be replayed.
 CREATE TABLE app_user_invitations (
    id             UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    token_hash     TEXT NOT NULL UNIQUE,
    app_id         UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
    email          TEXT NOT NULL,
    display_name   TEXT,
    roles          TEXT[] NOT NULL DEFAULT '{}',
    created_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    expires_at     TIMESTAMPTZ NOT NULL,
    accepted_at    TIMESTAMPTZ
 );
 CREATE INDEX idx_app_user_invitations_app_pending
    ON app_user_invitations (app_id) WHERE accepted_at IS NULL;
--- a/crates/manager-core/migrations/0031_app_user_roles.sql
+++ b/crates/manager-core/migrations/0031_app_user_roles.sql
@@ -1,21 +0,0 @@
 -- v1.1.8 User Management — per-app string-tagged roles.
 --
 -- v1.1.8 ships ROLE STORAGE ONLY. There is no role registry, no
 -- hierarchy, no permission matrix — what "admin" / "editor" /
 -- "viewer" mean is up to the script app. The `users::*` SDK
 -- surfaces a Vec<String> on every AppUser record; the surrounding
 -- script reads it and gates behavior accordingly.
 --
 -- Per-role permission matrices are a v1.2 design item (see brief);
 -- pre-baking them would either cement a wrong model or force a
 -- breaking change at v1.2.
 CREATE TABLE app_user_roles (
    app_id      UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
    user_id     UUID NOT NULL REFERENCES app_users(id) ON DELETE CASCADE,
    role        TEXT NOT NULL,
    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    PRIMARY KEY (app_id, user_id, role)
 );
 CREATE INDEX idx_app_user_roles_user ON app_user_roles (app_id, user_id);
--- a/crates/manager-core/migrations/0032_drop_plaintext_realtime_signing_key.sql
+++ b/crates/manager-core/migrations/0032_drop_plaintext_realtime_signing_key.sql
@@ -1,33 +0,0 @@
 -- v1.1.8 F1 — drop the plaintext realtime_signing_key column.
 --
 -- v1.1.7 added at-rest encryption (migration 0025) and a startup task
 -- that backfilled encryption over the plaintext column. Once every
 -- existing row has an encrypted counterpart, the plaintext column is
 -- pure dead weight (and a footgun: anyone with DB-read access can
 -- still read the signing key for any app that lived through the
 -- migration).
 --
 -- The guard refuses to drop if any row still has a plaintext value
 -- without an encrypted counterpart. This makes the migration safe to
 -- replay and forces operators who skipped v1.1.7 to apply it first:
 -- the v1.1.7 startup task is the only thing that knows how to
 -- encrypt the existing plaintext rows.
 --
 -- Operators upgrading from v1.1.6 or earlier MUST apply v1.1.7
 -- first (and let its startup encryption sweep complete) before
 -- applying this migration. The CHANGELOG and HANDBACK make this
 -- mandatory; the guard below is the belt-and-suspenders.
 DO $$
 BEGIN
    IF EXISTS (
        SELECT 1 FROM app_secrets
        WHERE realtime_signing_key IS NOT NULL
          AND realtime_signing_key_encrypted IS NULL
    ) THEN
        RAISE EXCEPTION
            'v1.1.8 migration 0032 refused: unencrypted realtime_signing_key rows still present. Apply v1.1.7 first and ensure its startup encryption sweep has completed.';
    END IF;
 END$$;
 ALTER TABLE app_secrets DROP COLUMN IF EXISTS realtime_signing_key;
--- a/crates/manager-core/migrations/0033_topics_auth_mode_session.sql
+++ b/crates/manager-core/migrations/0033_topics_auth_mode_session.sql
@@ -1,14 +0,0 @@
 -- v1.1.8 F3 — extend topics.auth_mode CHECK to allow 'session'.
 --
 -- v1.1.6 shipped 'public' + 'token'. v1.1.8 adds 'session' so a
 -- topic can authorize SSE subscribers against a per-app user session
 -- minted by users::login. The realtime authority delegates verify to
 -- UsersService::verify_session_for_realtime, which returns the user
 -- on success; the subscription proceeds with that principal.
 --
 -- 'script' (v1.2 script-mediated subscribe auth) extends the
 -- constraint a third time later.
 ALTER TABLE topics DROP CONSTRAINT IF EXISTS topics_auth_mode_check;
 ALTER TABLE topics ADD CONSTRAINT topics_auth_mode_check
    CHECK (auth_mode IN ('public', 'token', 'session'));
--- a/crates/manager-core/migrations/0034_queue_messages.sql
+++ b/crates/manager-core/migrations/0034_queue_messages.sql
@@ -1,53 +0,0 @@
 -- v1.1.9: durable per-app named queues (queue::*).
 --
 -- Producer: queue::enqueue(name, msg) — INSERTs into this table.
 -- Consumer: a registered queue:receive trigger fires when a message is
 -- available; the dispatcher claims with FOR UPDATE SKIP LOCKED + a
 -- visibility-timeout window.
 --
 -- "The queue table IS the outbox" — there is no double-buffering. The
 -- dispatcher's queue arm claims directly from queue_messages; the
 -- visibility-timeout reclaim task resets stale claims so crashed
 -- consumers don't lose work.
 --
 -- Identity tuple: (app_id, queue_name). Queue names are implicit — no
 -- queue registry table; a queue exists once the first message is
 -- enqueued under that name.
 CREATE TABLE queue_messages (
    id                    UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    app_id                UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
    queue_name            TEXT NOT NULL,
    payload               JSONB NOT NULL,
    enqueued_at           TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    -- deliver_after: NULL = immediate; else dispatcher won't claim until NOW() >= deliver_after.
    deliver_after         TIMESTAMPTZ NULL,
    -- claim_token: NULL = unclaimed; UUID = currently leased by a dispatcher.
    claim_token           UUID NULL,
    claimed_at            TIMESTAMPTZ NULL,
    attempt               INT NOT NULL DEFAULT 0,
    max_attempts          INT NOT NULL DEFAULT 3,
    -- Forensic: who enqueued. NEVER used for authz — the trigger fires
    -- as the principal that REGISTERED the consumer (design notes §4).
    enqueued_by_principal UUID NULL
 );
 -- Dispatch hot path: scan for unclaimed messages in (app_id, queue_name)
 -- order by enqueued_at. The (deliver_after IS NULL OR deliver_after <= NOW())
 -- condition cannot live in the partial WHERE (NOW() is non-immutable);
 -- Postgres applies it as a filter on the partial result set, which is
 -- already small.
 CREATE INDEX idx_queue_messages_dispatch
    ON queue_messages (app_id, queue_name, enqueued_at)
    WHERE claim_token IS NULL;
 -- depth() / depth_pending() helpers and the dashboard's queue list view.
 CREATE INDEX idx_queue_messages_app_queue
    ON queue_messages (app_id, queue_name);
 -- Reclaim-task scan: find currently-leased messages whose claim is older
 -- than the per-queue visibility_timeout_secs. Bounded by the number of
 -- in-flight messages, which is small.
 CREATE INDEX idx_queue_messages_claimed
    ON queue_messages (claimed_at)
    WHERE claim_token IS NOT NULL;
--- a/crates/manager-core/migrations/0035_queue_triggers.sql
+++ b/crates/manager-core/migrations/0035_queue_triggers.sql
@@ -1,41 +0,0 @@
 -- v1.1.9: queue:receive trigger kind + OutboxSourceKind::Invoke.
 --
 -- queue:receive is the new trigger kind that fires a script per claimed
 -- message. Layout E parent + per-kind detail (mirrors pubsub).
 --
 -- 'invoke' is added to outbox.source_kind for invoke_async() — a
 -- fire-and-forget function-composition call writes an outbox row that
 -- the dispatcher fires through the standard executor path.
 --
 -- Queue itself does NOT need an outbox.source_kind variant (the queue
 -- table IS the outbox for queue semantics — see 0034).
 ALTER TABLE triggers DROP CONSTRAINT triggers_kind_check;
 ALTER TABLE triggers ADD CONSTRAINT triggers_kind_check
    CHECK (kind IN ('kv', 'dead_letter', 'docs', 'cron',
                    'files', 'pubsub', 'email', 'queue'));
 ALTER TABLE outbox DROP CONSTRAINT outbox_source_kind_check;
 ALTER TABLE outbox ADD CONSTRAINT outbox_source_kind_check
    CHECK (source_kind IN ('http', 'kv', 'dead_letter', 'docs',
                           'cron', 'files', 'pubsub', 'email', 'invoke'));
 -- Per-queue-trigger config. Retry policy lives on the parent triggers
 -- row (retry_max_attempts, retry_backoff, retry_base_ms) — same
 -- pattern as every other trigger kind. visibility_timeout_secs is
 -- queue-specific.
 --
 -- "Exactly one consumer per (app_id, queue_name)" is enforced at the
 -- API layer via a pg_advisory_xact_lock on hashtext(app_id || queue_name)
 -- + a SELECT-then-INSERT in one transaction (a partial unique index
 -- can't reference the parent's app_id column from the detail table).
 CREATE TABLE queue_trigger_details (
    trigger_id              UUID PRIMARY KEY REFERENCES triggers(id) ON DELETE CASCADE,
    queue_name              TEXT NOT NULL,
    visibility_timeout_secs INT NOT NULL DEFAULT 30,
    last_fired_at           TIMESTAMPTZ NULL
 );
 -- Help the dispatcher's "find all active queue consumers" query.
 CREATE INDEX idx_queue_trigger_details_queue_name
    ON queue_trigger_details (queue_name);
--- a/crates/manager-core/migrations/0036_index_triggers_kind_enabled.sql
+++ b/crates/manager-core/migrations/0036_index_triggers_kind_enabled.sql
@@ -1,12 +0,0 @@
 -- F-P-010 (audit 2026-06-07): list_active_queue_consumers runs every
 -- 100 ms via the dispatcher's queue arm. Predicate is
 -- `WHERE t.kind = 'queue' AND t.enabled = TRUE` with no `app_id`
 -- filter. The available index `idx_triggers_app_kind_enabled
 -- (app_id, kind) WHERE enabled = TRUE` requires an app_id predicate to
 -- be useful — without one the planner falls back to a sequential scan
 -- of the triggers table every tick. Add an index keyed purely on
 -- `kind` (partial, where enabled) so the same hot query becomes an
 -- index-only lookup.
 CREATE INDEX IF NOT EXISTS idx_triggers_kind_enabled
    ON triggers (kind)
    WHERE enabled = TRUE;
--- a/crates/manager-core/migrations/0037_drop_idx_cron_triggers_due.sql
+++ b/crates/manager-core/migrations/0037_drop_idx_cron_triggers_due.sql
@@ -1,12 +0,0 @@
 -- F-M-001 (audit 2026-06-07): drop idx_cron_triggers_due.
 --
 -- Created in 0017_cron_triggers.sql with a comment claiming it serves
 -- the scheduler. The actual scheduler query is
 -- `... WHERE t.enabled = TRUE FOR UPDATE OF d SKIP LOCKED` — no
 -- `last_fired_at` predicate. The index is unused; the join is
 -- effectively a full table scan of cron details against enabled
 -- triggers (small N today, so the overhead is invisible — but the
 -- index is also pure write amplification with zero read payoff).
 --
 -- Drop is reversible by re-running the CREATE INDEX from 0017.
 DROP INDEX IF EXISTS idx_cron_triggers_due;
--- a/crates/manager-core/migrations/0038_email_realtime_secret_check.sql
+++ b/crates/manager-core/migrations/0038_email_realtime_secret_check.sql
@@ -1,19 +0,0 @@
 -- F-M-002 (audit 2026-06-07): coupled-nullness CHECK constraints on
 -- (encrypted, nonce) pairs.
 --
 -- The current schema has each column nullable independently:
 --   email_trigger_details.inbound_secret_encrypted / _nonce
 --   app_secrets.realtime_signing_key_encrypted / _nonce
 --
 -- A bug or partial write could leave one populated and the other NULL
 -- — silently bypassing signature verification (receiver decrypts only
 -- if the encrypted column is set). Defend with a coupled-nullness
 -- CHECK on each pair so a partial state is rejected at the DB
 -- boundary.
 ALTER TABLE email_trigger_details
    ADD CONSTRAINT email_trigger_details_inbound_secret_pair
    CHECK ((inbound_secret_encrypted IS NULL) = (inbound_secret_nonce IS NULL));
 ALTER TABLE app_secrets
    ADD CONSTRAINT app_secrets_realtime_signing_key_pair
    CHECK ((realtime_signing_key_encrypted IS NULL) = (realtime_signing_key_nonce IS NULL));
--- a/crates/manager-core/migrations/0039_app_user_invitations_unique_pending.sql
+++ b/crates/manager-core/migrations/0039_app_user_invitations_unique_pending.sql
@@ -1,13 +0,0 @@
 -- F-S-013 (audit 2026-06-07): partial unique index on pending
 -- (app_id, lower(email)) for app_user_invitations.
 --
 -- Without it, users::invite("alice@…") called N times creates N rows
 -- with N valid tokens. Combined with accept_invite returning Ok(None)
 -- silently when the email already exists, an attacker who learns one
 -- invitation token can permanently consume it without effect.
 --
 -- The constraint is partial so re-inviting after a previous invitation
 -- was accepted still works (the accepted row sits outside the index).
 CREATE UNIQUE INDEX IF NOT EXISTS idx_app_user_invitations_unique_pending
    ON app_user_invitations (app_id, lower(email))
    WHERE accepted_at IS NULL;
--- a/crates/manager-core/migrations/0040_execution_logs_keep_history.sql
+++ b/crates/manager-core/migrations/0040_execution_logs_keep_history.sql
@@ -1,18 +0,0 @@
 -- Audit Low finding: preserving forensic history.
 --
 -- The `execution_logs.script_id` foreign key was created with ON DELETE
 -- CASCADE in 0001_init. Deleting a script then wipes every log row that
 -- ever referenced it — including the rows that captured the failure
 -- that motivated the delete. Switch to ON DELETE SET NULL so the
 -- forensic history survives and operators can still look up "what did
 -- this dead script do before we removed it" by id.
 ALTER TABLE execution_logs
    DROP CONSTRAINT IF EXISTS execution_logs_script_id_fkey;
 ALTER TABLE execution_logs
    ALTER COLUMN script_id DROP NOT NULL;
 ALTER TABLE execution_logs
    ADD CONSTRAINT execution_logs_script_id_fkey
    FOREIGN KEY (script_id) REFERENCES scripts(id) ON DELETE SET NULL;
--- a/crates/manager-core/migrations/0041_dead_letters_composite_idx.sql
+++ b/crates/manager-core/migrations/0041_dead_letters_composite_idx.sql
@@ -1,12 +0,0 @@
 -- Audit Low finding: speeding up the "list all DL for app" view.
 --
 -- The dashboard's dead-letters tab issues
 --   SELECT ... FROM dead_letters
 --     WHERE app_id = $1
 --     ORDER BY created_at DESC LIMIT $2
 -- which falls back to a seq-scan + sort when the unresolved=false
 -- filter is on (the partial idx_dead_letters_app_unresolved doesn't
 -- cover resolved rows). This composite covers both modes.
 CREATE INDEX IF NOT EXISTS idx_dead_letters_app_created
    ON dead_letters (app_id, created_at DESC);
--- a/crates/manager-core/migrations/0042_secrets_envelope_version.sql
+++ b/crates/manager-core/migrations/0042_secrets_envelope_version.sql
@@ -1,27 +0,0 @@
 -- Audit 2026-06-11 H-D1: AES-GCM envelope versioning + AAD binding.
 --
 -- Pre-2026-06-11 the per-app secret store, per-app realtime signing
 -- key, and email-trigger inbound HMAC secret were all AES-256-GCM
 -- sealed with no Associated Authentication Data. Anyone with Postgres
 -- write access could ciphertext-swap rows across apps (or rename via
 -- row edit) and the decrypt would silently succeed under the wrong
 -- identity, returning attacker-chosen plaintext.
 --
 -- New writes use `crypto::encrypt_with_aad` with a stable identity
 -- string ("secret:{app_id}:{name}" / "app_secret:{app_id}:realtime_signing_key")
 -- as AAD, so any cross-row swap fails the GCM auth tag.
 --
 -- This migration introduces a per-row `version` column. v0 = legacy
 -- (no AAD); v1 = AAD-bound. Reads dispatch on the column; new writes
 -- always emit v1. Existing v0 rows continue to decrypt; the
 -- re-encryption sweep is deferred to v1.2's planned key-versioning
 -- pass (see SECURITY_AUDIT.md "Notes on remediation methodology").
 --
 -- email_trigger_details.inbound_secret_encrypted retains a v0-only
 -- path for now (audit-classified Medium; deferred).
 ALTER TABLE secrets
    ADD COLUMN version SMALLINT NOT NULL DEFAULT 0;
 ALTER TABLE app_secrets
    ADD COLUMN realtime_signing_key_version SMALLINT NOT NULL DEFAULT 0;
--- a/crates/manager-core/migrations/0043_execution_logs_source.sql
+++ b/crates/manager-core/migrations/0043_execution_logs_source.sql
@@ -1,20 +0,0 @@
 -- G1 (E2E #2 "Stash"): trigger executions were invisible to `pic logs`.
 --
 -- Only HTTP-route executions ever wrote an `execution_logs` row; queue,
 -- cron, dead-letter, and `invoke()` runs left no trace, so background
 -- workers were observable only via dead-letters (failures) or their own
 -- side effects. The dispatcher now logs every trigger run too — this
 -- column records which kind of event dispatched each execution so the
 -- logs surface can show, and filter by, the origin.
 --
 -- DEFAULT 'http' backfills every pre-existing row: before this change the
 -- only thing that logged was the HTTP path, so 'http' is correct history.
 -- The CHECK list mirrors `manager-core::OutboxSourceKind` /
 -- `shared::ExecutionSource`; keep all three in sync.
 ALTER TABLE execution_logs
    ADD COLUMN source TEXT NOT NULL DEFAULT 'http'
    CHECK (source IN (
        'http', 'kv', 'docs', 'dead_letter', 'cron',
        'files', 'pubsub', 'email', 'invoke', 'queue'
    ));
--- a/crates/manager-core/migrations/0044_delete_reserved_path_routes.sql
+++ b/crates/manager-core/migrations/0044_delete_reserved_path_routes.sql
@@ -1,22 +0,0 @@
 -- H1 (re-review of the S6 reserved-path fix): the reserved-prefix check is
 -- now case-insensitive, both at route creation AND when the route table is
 -- compiled at boot. Routes created before the fix — while validation was
 -- case-sensitive — could hold paths like `/API/v2/x`, `/Admin/x`, or
 -- `/HEALTHZ`. `compile_routes` now skips such rows with a warning instead of
 -- aborting startup (so an un-upgraded boot can't be bricked), but those
 -- routes violate the reserved namespace and can never be served safely, so
 -- sweep them here on upgrade.
 --
 -- Mirrors `orchestrator-core::routing::pattern::check_reserved` exactly,
 -- case-insensitively: a path is reserved if its lowercased form equals one
 -- of the bare names (`/api` `/admin` `/healthz` `/version`) or starts with
 -- one of the prefixes. Note `/api/` and `/admin/` reserve on the trailing
 -- slash, while `/healthz` and `/version` reserve on bare prefix — matching
 -- the RESERVED_PATH_PREFIXES list. (Idempotent: a no-op once swept.)
 DELETE FROM routes
 WHERE lower(path) IN ('/api', '/admin', '/healthz', '/version')
   OR lower(path) LIKE '/api/%'
   OR lower(path) LIKE '/admin/%'
   OR lower(path) LIKE '/healthz%'
   OR lower(path) LIKE '/version%';
--- a/crates/manager-core/migrations/0045_scripts_routes_enabled.sql
+++ b/crates/manager-core/migrations/0045_scripts_routes_enabled.sql
@@ -1,8 +0,0 @@
 -- Three-state `enabled` lifecycle (blueprint §4.3), scripts + routes half.
 -- Triggers already carry `enabled` (0008) honored at match/schedule time;
 -- this adds the same toggle to scripts and routes. A disabled script is not
 -- invocable; a disabled route 404s (indistinguishable from absent). Default
 -- TRUE so every existing row stays active — no behavior change on migrate.
 ALTER TABLE scripts ADD COLUMN enabled BOOLEAN NOT NULL DEFAULT TRUE;
 ALTER TABLE routes  ADD COLUMN enabled BOOLEAN NOT NULL DEFAULT TRUE;
--- a/crates/manager-core/migrations/0046_trigger_name.sql
+++ b/crates/manager-core/migrations/0046_trigger_name.sql
@@ -1,29 +0,0 @@
 -- Trigger `name` (§4.5): an explicit per-app identifier that becomes the
 -- manifest merge/upsert key (Step B switches the apply diff to key on it).
 -- Until now triggers were identified only by their per-kind semantic tuple,
 -- so the declarative tool could only Create/Delete them, never Update.
 --
 -- Backfill existing rows with `{kind}-{n}` (n = per-(app,kind) sequence by
 -- creation order) — the spec-sanctioned fallback when there's no cleaner
 -- entity token. Then enforce NOT NULL + UNIQUE(app_id, name).
 -- A `gen_random_uuid()` default keeps existing INSERTs (which don't yet
 -- supply a name) valid and unique — the manager-core write paths start
 -- providing meaningful names in the follow-up; new rows until then get a
 -- harmless unique placeholder.
 ALTER TABLE triggers
    ADD COLUMN name TEXT NOT NULL DEFAULT gen_random_uuid()::text;
 -- Rewrite the just-defaulted existing rows to the readable `{kind}-{n}` form.
 UPDATE triggers t
 SET name = sub.nm
 FROM (
    SELECT id,
           kind || '-' || row_number() OVER (
               PARTITION BY app_id, kind ORDER BY created_at, id
           ) AS nm
    FROM triggers
 ) sub
 WHERE t.id = sub.id;
 CREATE UNIQUE INDEX triggers_app_name_uniq ON triggers (app_id, name);
--- a/crates/manager-core/migrations/0047_groups.sql
+++ b/crates/manager-core/migrations/0047_groups.sql
@@ -1,82 +0,0 @@
 -- Phase 2: groups as a pure org / RBAC / UI container — see
 -- docs/design/groups-and-project-tool.md §5, §9.
 --
 -- Groups form a GitLab-like, single-parent tree ABOVE apps. Phase 2 adds
 -- the tree, hierarchy-aware membership, and structural-mutation safety —
 -- but NO group-owned resources yet (scripts/vars/secrets stay app-owned;
 -- that is Phase 3). The only data-plane touch is apps gaining a parent
 -- pointer.
 --
 -- Adoption (§9): every existing app must have a parent from day one so
 -- resolution always terminates. This migration seeds a single instance
 -- root group and reparents every app under it, then promotes
 -- apps.group_id to NOT NULL.
 CREATE TABLE groups (
    id                UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    -- Single parent keeps inheritance acyclic and resolution
    -- deterministic. NULL parent = a root node. RESTRICT (never CASCADE):
    -- deleting a non-empty group is refused so descendant apps and their
    -- isolated data can't be destroyed implicitly (§5.6). The ancestor-walk
    -- cycle guard that keeps this acyclic lives in manager-core (a SQL
    -- CHECK can't express it).
    parent_id         UUID REFERENCES groups(id) ON DELETE RESTRICT,
    -- Instance-global identifier, frozen at creation. A rename/reparent
    -- updates the display name/path but NEVER rewrites the slug, so the
    -- deployment key stays stable and external references don't break.
    -- Format validation lives in Rust handlers (same rule as app slugs).
    slug              TEXT NOT NULL UNIQUE,
    name              TEXT NOT NULL,
    description       TEXT,
    -- Per-subtree structure version (§6): bumped on every structural
    -- mutation of this node (reparent/rename/delete) so a future CLI/
    -- orchestrator can detect structural drift. NOT an authz input —
    -- authorization is resolved live every request.
    structure_version BIGINT NOT NULL DEFAULT 1,
    -- §7 ownership seam — the project-root that manages this node. Inert
    -- in Phase 2 (no projects table yet); nullable, no FK.
    owner_project     UUID,
    created_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at        TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
 CREATE INDEX groups_parent_id_idx ON groups (parent_id);
 -- Per-(user, group) explicit grant, mirroring app_members. Inherited
 -- membership (GitLab-style) is resolved in code by walking ancestors: a
 -- group_admin on any ancestor is implicitly app_admin on every app and
 -- subgroup beneath it. Roles reuse the SAME three literals as app_members
 -- so AppRole round-trips with zero mapping and the authz rank table
 -- covers both tables.
 CREATE TABLE group_members (
    group_id    UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
    user_id     UUID NOT NULL REFERENCES admin_users(id) ON DELETE CASCADE,
    role        TEXT NOT NULL CHECK (role IN ('app_admin', 'editor', 'viewer')),
    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    PRIMARY KEY (group_id, user_id)
 );
 -- Hot path is the authz ancestor walk "what groups does this user have a
 -- role on?" plus the per-group member list.
 CREATE INDEX group_members_user_id_idx ON group_members (user_id);
 -- Add the parent pointer to apps (nullable for the backfill window).
 ALTER TABLE apps ADD COLUMN group_id UUID;
 -- Seed a single instance root group and reparent every existing app under
 -- it. App slugs are already instance-global, so no slug rewrite is needed
 -- — the parent pointer is new metadata layered on top.
 WITH root_group AS (
    INSERT INTO groups (slug, name, description)
    VALUES ('root', 'Root', 'The instance root group — parent of all apps created before groups landed.')
    RETURNING id
 )
 UPDATE apps SET group_id = (SELECT id FROM root_group);
 -- Every app now has a parent; promote to NOT NULL + FK. RESTRICT so a
 -- group with apps can't be deleted out from under them (§5.6).
 ALTER TABLE apps ALTER COLUMN group_id SET NOT NULL;
 ALTER TABLE apps
    ADD CONSTRAINT apps_group_id_fk FOREIGN KEY (group_id) REFERENCES groups(id) ON DELETE RESTRICT;
 CREATE INDEX apps_group_id_idx ON apps (group_id);
--- a/crates/manager-core/src/admin_users_api.rs
+++ b/crates/manager-core/src/admin_users_api.rs
@@ -45,11 +45,6 @@ pub struct AdminsState {
    /// Capability gate: every endpoint here requires
    /// `InstanceManageUsers` (owner / admin).
    pub authz: Arc<dyn AuthzRepo>,
    /// Audit 2026-06-11 (PrincipalCache revocation-lag) — evicted on
    /// password change / deactivation so a just-revoked session or
    /// API key stops authenticating immediately instead of lingering
    /// for the cache TTL.
    pub principal_cache: Arc<crate::auth_middleware::PrincipalCache>,
 }
 pub fn admins_router(state: AdminsState) -> Router {
@@ -238,33 +233,11 @@ async fn patch_admin(
        validate_password(new_password)?;
        let hash = hash_password(new_password).map_err(|e| AdminApiError::Hash(e.to_string()))?;
        latest = Some(state.users.update_password_hash(id, &hash).await?);
-        // Audit 2026-06-11 H-E1 — a password change invalidates both
+        // Best practice: rotating your own password should still keep
-        // credential surfaces for the target user (sessions + API keys),
+        // your session alive, so we don't wipe sessions here. (If we
-        // matching the CLI `reset-password` flow and the deactivation
+        // wanted "log everyone else out on password change", that'd be
-        // path below. A self-change therefore logs the caller out, and
+        // a `delete_for_user` + re-issue current session. Out of scope
-        // the dashboard handles the subsequent 401 by redirecting to the
+        // for the initial cut.)
        // login screen. The previous behavior kept all sessions live,
        // which meant a hijacked session that triggered a password
        // change retained its grip after the rotation.
        if let Err(err) = state.sessions.delete_for_user(id).await {
            tracing::error!(?err, "failed to delete sessions on password change");
        }
        match state.keys.expire_all_for_user(id).await {
            Ok(n) => {
                if n > 0 {
                    tracing::info!(user_id = %id, expired = n, "expired api keys on password change");
                }
            }
            Err(err) => {
                tracing::error!(?err, "failed to expire api keys on password change");
            }
        }
        // Audit 2026-06-11 (PrincipalCache revocation-lag) — the DB
        // writes above are best-effort by design (a blip must not undo
        // the rotation), so evicting the in-process cache is what makes
        // the rotation take effect on the very next request rather than
        // after the cache TTL.
        state.principal_cache.evict_user(id);
    }
    if let Some(email_patch) = input.email.as_ref() {
@@ -334,11 +307,6 @@ async fn patch_admin(
                    tracing::error!(?err, "failed to expire api keys for deactivated admin");
                }
            }
            // Audit 2026-06-11 (PrincipalCache revocation-lag) — evict
            // cached principals so a deactivated admin's session / API
            // keys stop authenticating immediately instead of lingering
            // for the cache TTL window.
            state.principal_cache.evict_user(id);
        }
    }
--- a/crates/manager-core/src/api.rs
+++ b/crates/manager-core/src/api.rs
@@ -12,8 +12,8 @@ use axum::{
    Extension, Json, Router,
 };
 use picloud_shared::{
-    AppId, ExecutionLog, ExecutionSource, InstanceRole, Principal, Script, ScriptId, ScriptKind,
+    AppId, ExecutionLog, InstanceRole, Principal, Script, ScriptId, ScriptKind, ScriptSandbox,
-    ScriptSandbox, ScriptValidator, ValidatedScript, ValidationError,
+    ScriptValidator, ValidatedScript, ValidationError,
 };
 use serde::Deserialize;
@@ -246,8 +246,6 @@ async fn create_script<R: ScriptRepository, L: ExecutionLogRepository>(
            } else {
                Some(input.sandbox)
            },
            // Scripts are created active; toggling is a dedicated path.
            enabled: true,
            imports: validated.imports,
        })
        .await?;
@@ -260,7 +258,7 @@ async fn create_script<R: ScriptRepository, L: ExecutionLogRepository>(
 /// real KV bridge — defense against author confusion, not a security
 /// boundary (stdlib namespaces and module imports already live in
 /// disjoint Rhai scopes).
-pub(crate) const RESERVED_MODULE_NAMES: &[&str] = &[
+const RESERVED_MODULE_NAMES: &[&str] = &[
    "log",
    "regex",
    "random",
@@ -347,7 +345,6 @@ async fn update_script<R: ScriptRepository, L: ExecutionLogRepository>(
                memory_limit_mb: input.memory_limit_mb,
                sandbox: input.sandbox,
                kind: input.kind,
                enabled: None,
                imports: imports_for_patch,
            },
        )
@@ -378,20 +375,8 @@ async fn delete_script<R: ScriptRepository, L: ExecutionLogRepository>(
 pub struct LogsQuery {
    #[serde(default = "default_limit")]
    pub limit: i64,
    /// F-P-005: keyset cursor (`<rfc3339>_<uuid>`). Replaces the OFFSET
    /// path that scanned + discarded N rows per page. Absent for the
    /// first page. The legacy `offset` query param is accepted but
    /// silently ignored to keep older dashboards from 400'ing.
    #[serde(default)]
-    pub cursor: Option<String>,
+    pub offset: i64,
    /// Legacy field — accepted and ignored so older dashboards don't 400.
    #[serde(default, rename = "offset")]
    #[allow(dead_code)]
    pub legacy_offset: Option<i64>,
    /// Optional origin filter (`http`, `kv`, `cron`, `invoke`, …). Absent
    /// → all sources. An unrecognized value is a 422 (see `list_logs`).
    #[serde(default)]
    pub source: Option<String>,
 }
 const fn default_limit() -> i64 {
@@ -414,21 +399,8 @@ async fn list_logs<R: ScriptRepository, L: ExecutionLogRepository>(
    // Cap to keep the dashboard responsive; the data plane writes are
    // unbounded over time so a paged read is the only sane default.
    let limit = q.limit.clamp(1, 200);
-    let cursor = q
+    let offset = q.offset.max(0);
-        .cursor
+    let logs = state.logs.list_for_script(id, limit, offset).await?;
        .as_deref()
        .and_then(crate::repo::ExecutionLogCursor::decode);
    let source = match q.source.as_deref() {
        None | Some("" | "all") => None,
        Some(s) => Some(
            ExecutionSource::from_wire(s)
                .ok_or_else(|| ApiError::BadRequest(format!("unknown log source: {s:?}")))?,
        ),
    };
    let logs = state
        .logs
        .list_for_script(id, limit, cursor, source)
        .await?;
    Ok(Json(logs))
 }
@@ -444,9 +416,6 @@ pub enum ApiError {
    #[error("app not found: {0}")]
    AppNotFound(String),
    #[error("bad request: {0}")]
    BadRequest(String),
    #[error("conflict: {0}")]
    Conflict(String),
@@ -479,10 +448,11 @@ impl IntoResponse for ApiError {
    fn into_response(self) -> Response {
        let (status, message) = match &self {
            Self::NotFound(_) => (StatusCode::NOT_FOUND, self.to_string()),
-            Self::AppNotFound(_) | Self::BadRequest(_) | Self::Invalid(_) | Self::Ceiling(_) => {
+            Self::AppNotFound(_) => (StatusCode::UNPROCESSABLE_ENTITY, self.to_string()),
            Self::Conflict(_) => (StatusCode::CONFLICT, self.to_string()),
            Self::Invalid(_) | Self::Ceiling(_) => {
                (StatusCode::UNPROCESSABLE_ENTITY, self.to_string())
            }
            Self::Conflict(_) => (StatusCode::CONFLICT, self.to_string()),
            Self::Forbidden => (StatusCode::FORBIDDEN, self.to_string()),
            Self::AuthzRepo(e) => {
                tracing::error!(error = %e, "authz repo error");
--- a/crates/manager-core/src/api_keys_api.rs
+++ b/crates/manager-core/src/api_keys_api.rs
@@ -39,10 +39,6 @@ const NAME_MAX: usize = 64;
 #[derive(Clone)]
 pub struct ApiKeysState {
    pub keys: Arc<dyn ApiKeyRepository>,
    /// Audit 2026-06-11 (PrincipalCache revocation-lag) — evicted when
    /// a user deletes one of their own keys so it stops authenticating
    /// from cache immediately rather than after the cache TTL.
    pub principal_cache: Arc<crate::auth_middleware::PrincipalCache>,
 }
 pub fn api_keys_router(state: ApiKeysState) -> Router {
@@ -164,12 +160,6 @@ async fn delete_key(
        // we deliberately don't leak the distinction.
        return Err(ApiKeysError::NotFound(id));
    }
    // Audit 2026-06-11 (PrincipalCache revocation-lag) — the cache is
    // keyed by token hash, which we can't derive from the key id, so
    // evict every cached principal for this user. That also drops their
    // session entries; re-auth on the next request is the right cost for
    // a deliberate key revocation.
    state.principal_cache.evict_user(principal.user_id);
    Ok(StatusCode::NO_CONTENT)
 }
--- a/crates/manager-core/src/app_bootstrap.rs
+++ b/crates/manager-core/src/app_bootstrap.rs
@@ -68,7 +68,6 @@ async fn seed_into(
            timeout_seconds: Some(5),
            memory_limit_mb: None,
            sandbox: None,
            enabled: true,
            imports: Vec::new(),
        })
        .await?;
@@ -86,7 +85,6 @@ async fn seed_into(
            // `curl -d '{"name":"X"}' /hello` work out of the box.
            method: None,
            dispatch_mode: picloud_shared::DispatchMode::Sync,
            enabled: true,
        })
        .await?;
--- a/crates/manager-core/src/app_members_repo.rs
+++ b/crates/manager-core/src/app_members_repo.rs
@@ -8,17 +8,11 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use picloud_shared::{AdminUserId, AppId, AppRole, GroupId, InstanceRole, UserId};
+use picloud_shared::{AdminUserId, AppId, AppRole, InstanceRole};
 use sqlx::PgPool;
 use crate::authz::{AuthzError, AuthzRepo};
 /// SQL fragment ranking the three role literals by authority so a CTE can
 /// `MAX` over a mixed set of app_members + group_members rows. Shared by
 /// both effective-role queries.
 const ROLE_RANK_CTE: &str =
    "role_rank(role, rank) AS (VALUES ('viewer', 1), ('editor', 2), ('app_admin', 3))";
 #[derive(Debug, thiserror::Error)]
 pub enum AppMembersRepositoryError {
    #[error("database error: {0}")]
@@ -287,95 +281,13 @@ impl AppMembersRepository for PostgresAppMembersRepository {
 impl AuthzRepo for PostgresAppMembersRepository {
    async fn membership(
        &self,
-        user_id: UserId,
+        user_id: AdminUserId,
        app_id: AppId,
    ) -> Result<Option<AppRole>, AuthzError> {
        self.find(user_id, app_id)
            .await
            .map_err(|e| AuthzError::Repo(e.to_string()))
    }
    /// Highest effective role on `app_id`: one recursive CTE walks the
    /// app's group chain (app.group_id → groups.parent_id → … → root,
    /// depth-bounded), then `MAX`es the app's own `app_members` row with
    /// every ancestor `group_members` row by authority rank. A single
    /// round-trip regardless of tree depth. `None` = no grant anywhere.
    async fn effective_app_role(
        &self,
        user_id: UserId,
        app_id: AppId,
    ) -> Result<Option<AppRole>, AuthzError> {
        let row: Option<(String,)> = sqlx::query_as(&format!(
            "WITH RECURSIVE ancestors AS (
                 SELECT a.group_id AS gid, 0 AS depth FROM apps a WHERE a.id = $2
               UNION ALL
                 SELECT g.parent_id, anc.depth + 1
                 FROM groups g JOIN ancestors anc ON g.id = anc.gid
                 WHERE g.parent_id IS NOT NULL AND anc.depth < 64
             ),
             {ROLE_RANK_CTE}
             SELECT eff.role
             FROM (
                 SELECT am.role FROM app_members am
                 WHERE am.user_id = $1 AND am.app_id = $2
               UNION ALL
                 SELECT gm.role FROM group_members gm
                 JOIN ancestors anc ON anc.gid = gm.group_id
                 WHERE gm.user_id = $1
             ) eff
             JOIN role_rank rr ON rr.role = eff.role
             ORDER BY rr.rank DESC
             LIMIT 1"
        ))
        .bind(user_id.into_inner())
        .bind(app_id.into_inner())
        .fetch_optional(&self.pool)
        .await
        .map_err(|e| AuthzError::Repo(e.to_string()))?;
        row.map(|(role,)| {
            AppRole::from_db_str(&role).ok_or(AuthzError::Repo(format!(
                "invalid role {role:?} in members table"
            )))
        })
        .transpose()
    }
    /// Highest effective role on a *group* node — walks the group's own
    /// ancestor chain over `group_members`. Gates group management.
    async fn effective_group_role(
        &self,
        user_id: UserId,
        group_id: GroupId,
    ) -> Result<Option<AppRole>, AuthzError> {
        let row: Option<(String,)> = sqlx::query_as(&format!(
            "WITH RECURSIVE ancestors AS (
                 SELECT id AS gid, parent_id, 0 AS depth FROM groups WHERE id = $2
               UNION ALL
                 SELECT g.id, g.parent_id, anc.depth + 1
                 FROM groups g JOIN ancestors anc ON g.id = anc.parent_id
                 WHERE anc.depth < 64
             ),
             {ROLE_RANK_CTE}
             SELECT gm.role
             FROM group_members gm
             JOIN ancestors anc ON anc.gid = gm.group_id
             JOIN role_rank rr ON rr.role = gm.role
             WHERE gm.user_id = $1
             ORDER BY rr.rank DESC
             LIMIT 1"
        ))
        .bind(user_id.into_inner())
        .bind(group_id.into_inner())
        .fetch_optional(&self.pool)
        .await
        .map_err(|e| AuthzError::Repo(e.to_string()))?;
        row.map(|(role,)| {
            AppRole::from_db_str(&role).ok_or(AuthzError::Repo(format!(
                "invalid role {role:?} in group_members table"
            )))
        })
        .transpose()
    }
 }
 #[derive(sqlx::FromRow)]
--- a/crates/manager-core/src/app_repo.rs
+++ b/crates/manager-core/src/app_repo.rs
@@ -6,7 +6,7 @@
 //! that writes the history row in the same transaction.
 use async_trait::async_trait;
-use picloud_shared::{AdminUserId, App, AppId, GroupId};
+use picloud_shared::{AdminUserId, App, AppId};
 use sqlx::PgPool;
 use uuid::Uuid;
@@ -55,8 +55,6 @@ pub trait AppRepository: Send + Sync {
    /// Only apps the user has an `app_members` row for. Drives the
    /// membership-filtered `GET /admin/apps` for `member` callers.
    async fn list_for_user(&self, user_id: AdminUserId) -> Result<Vec<App>, ScriptRepositoryError>;
    /// Apps whose parent is `group_id`. Drives the group detail view.
    async fn list_for_group(&self, group_id: GroupId) -> Result<Vec<App>, ScriptRepositoryError>;
    async fn get_by_id(&self, id: AppId) -> Result<Option<App>, ScriptRepositoryError>;
    async fn get_by_slug(&self, slug: &str) -> Result<Option<App>, ScriptRepositoryError>;
    async fn get_by_slug_or_history(
@@ -69,7 +67,6 @@ pub trait AppRepository: Send + Sync {
        slug: &str,
        name: &str,
        description: Option<&str>,
        group_id: GroupId,
    ) -> Result<App, ScriptRepositoryError>;
    /// Create that also consumes a matching `app_slug_history` row, if
    /// any. Used after the operator has confirmed they want to break old
@@ -79,7 +76,6 @@ pub trait AppRepository: Send + Sync {
        slug: &str,
        name: &str,
        description: Option<&str>,
        group_id: GroupId,
    ) -> Result<App, ScriptRepositoryError>;
    async fn update(
        &self,
@@ -120,7 +116,7 @@ impl PostgresAppRepository {
 impl AppRepository for PostgresAppRepository {
    async fn list(&self) -> Result<Vec<App>, ScriptRepositoryError> {
        let rows = sqlx::query_as::<_, AppRow>(
-            "SELECT id, slug, name, description, group_id, created_at, updated_at \
+            "SELECT id, slug, name, description, created_at, updated_at \
             FROM apps ORDER BY name",
        )
        .fetch_all(&self.pool)
@@ -130,7 +126,7 @@ impl AppRepository for PostgresAppRepository {
    async fn list_for_user(&self, user_id: AdminUserId) -> Result<Vec<App>, ScriptRepositoryError> {
        let rows = sqlx::query_as::<_, AppRow>(
-            "SELECT a.id, a.slug, a.name, a.description, a.group_id, a.created_at, a.updated_at \
+            "SELECT a.id, a.slug, a.name, a.description, a.created_at, a.updated_at \
             FROM apps a \
             JOIN app_members m ON m.app_id = a.id \
             WHERE m.user_id = $1 \
@@ -142,20 +138,9 @@ impl AppRepository for PostgresAppRepository {
        Ok(rows.into_iter().map(Into::into).collect())
    }
    async fn list_for_group(&self, group_id: GroupId) -> Result<Vec<App>, ScriptRepositoryError> {
        let rows = sqlx::query_as::<_, AppRow>(
            "SELECT id, slug, name, description, group_id, created_at, updated_at \
             FROM apps WHERE group_id = $1 ORDER BY name",
        )
        .bind(group_id.into_inner())
        .fetch_all(&self.pool)
        .await?;
        Ok(rows.into_iter().map(Into::into).collect())
    }
    async fn get_by_id(&self, id: AppId) -> Result<Option<App>, ScriptRepositoryError> {
        let row = sqlx::query_as::<_, AppRow>(
-            "SELECT id, slug, name, description, group_id, created_at, updated_at \
+            "SELECT id, slug, name, description, created_at, updated_at \
             FROM apps WHERE id = $1",
        )
        .bind(id.into_inner())
@@ -166,7 +151,7 @@ impl AppRepository for PostgresAppRepository {
    async fn get_by_slug(&self, slug: &str) -> Result<Option<App>, ScriptRepositoryError> {
        let row = sqlx::query_as::<_, AppRow>(
-            "SELECT id, slug, name, description, group_id, created_at, updated_at \
+            "SELECT id, slug, name, description, created_at, updated_at \
             FROM apps WHERE slug = $1",
        )
        .bind(slug)
@@ -196,7 +181,7 @@ impl AppRepository for PostgresAppRepository {
    async fn slug_in_history(&self, slug: &str) -> Result<Option<App>, ScriptRepositoryError> {
        let row = sqlx::query_as::<_, AppRow>(
-            "SELECT a.id, a.slug, a.name, a.description, a.group_id, a.created_at, a.updated_at \
+            "SELECT a.id, a.slug, a.name, a.description, a.created_at, a.updated_at \
             FROM app_slug_history h \
             JOIN apps a ON a.id = h.current_app_id \
             WHERE h.slug = $1",
@@ -212,17 +197,15 @@ impl AppRepository for PostgresAppRepository {
        slug: &str,
        name: &str,
        description: Option<&str>,
        group_id: GroupId,
    ) -> Result<App, ScriptRepositoryError> {
        let res = sqlx::query_as::<_, AppRow>(
-            "INSERT INTO apps (slug, name, description, group_id) \
+            "INSERT INTO apps (slug, name, description) \
-             VALUES ($1, $2, $3, $4) \
+             VALUES ($1, $2, $3) \
-             RETURNING id, slug, name, description, group_id, created_at, updated_at",
+             RETURNING id, slug, name, description, created_at, updated_at",
        )
        .bind(slug)
        .bind(name)
        .bind(description)
        .bind(group_id.into_inner())
        .fetch_one(&self.pool)
        .await;
@@ -240,7 +223,6 @@ impl AppRepository for PostgresAppRepository {
        slug: &str,
        name: &str,
        description: Option<&str>,
        group_id: GroupId,
    ) -> Result<App, ScriptRepositoryError> {
        let mut tx = self.pool.begin().await?;
        sqlx::query("DELETE FROM app_slug_history WHERE slug = $1")
@@ -248,14 +230,13 @@ impl AppRepository for PostgresAppRepository {
            .execute(&mut *tx)
            .await?;
        let row = sqlx::query_as::<_, AppRow>(
-            "INSERT INTO apps (slug, name, description, group_id) \
+            "INSERT INTO apps (slug, name, description) \
-             VALUES ($1, $2, $3, $4) \
+             VALUES ($1, $2, $3) \
-             RETURNING id, slug, name, description, group_id, created_at, updated_at",
+             RETURNING id, slug, name, description, created_at, updated_at",
        )
        .bind(slug)
        .bind(name)
        .bind(description)
        .bind(group_id.into_inner())
        .fetch_one(&mut *tx)
        .await;
        let row = match row {
@@ -283,7 +264,7 @@ impl AppRepository for PostgresAppRepository {
                description = CASE WHEN $3::bool THEN $4 ELSE description END, \
                updated_at = NOW() \
             WHERE id = $1 \
-             RETURNING id, slug, name, description, group_id, created_at, updated_at",
+             RETURNING id, slug, name, description, created_at, updated_at",
        )
        .bind(id.into_inner())
        .bind(name)
@@ -317,7 +298,7 @@ impl AppRepository for PostgresAppRepository {
        if current_slug == new_slug {
            // No-op rename; just return the row.
            let row = sqlx::query_as::<_, AppRow>(
-                "SELECT id, slug, name, description, group_id, created_at, updated_at \
+                "SELECT id, slug, name, description, created_at, updated_at \
                 FROM apps WHERE id = $1",
            )
            .bind(id.into_inner())
@@ -376,7 +357,7 @@ impl AppRepository for PostgresAppRepository {
        let row = sqlx::query_as::<_, AppRow>(
            "UPDATE apps SET slug = $2, updated_at = NOW() \
             WHERE id = $1 \
-             RETURNING id, slug, name, description, group_id, created_at, updated_at",
+             RETURNING id, slug, name, description, created_at, updated_at",
        )
        .bind(id.into_inner())
        .bind(new_slug)
@@ -451,7 +432,6 @@ struct AppRow {
    slug: String,
    name: String,
    description: Option<String>,
    group_id: uuid::Uuid,
    created_at: chrono::DateTime<chrono::Utc>,
    updated_at: chrono::DateTime<chrono::Utc>,
 }
@@ -463,7 +443,6 @@ impl From<AppRow> for App {
            slug: r.slug,
            name: r.name,
            description: r.description,
            group_id: r.group_id.into(),
            created_at: r.created_at,
            updated_at: r.updated_at,
        }
--- a/crates/manager-core/src/app_secrets_repo.rs
+++ b/crates/manager-core/src/app_secrets_repo.rs
@@ -1,5 +1,4 @@
-//! `AppSecretsRepo` — per-app secret material (v1.1.6, encrypted v1.1.7,
+//! `AppSecretsRepo` — per-app secret material (v1.1.6, encrypted v1.1.7).
 //! plaintext column dropped v1.1.8 F1).
 //!
 //! Holds the HMAC signing key for realtime subscriber tokens. The key is
 //! generated lazily (32 random bytes) on the first
@@ -7,17 +6,18 @@
 //! thereafter (no rotation API yet). The key is never exposed to
 //! scripts: the SDK mints tokens, it never returns the key.
 //!
-//! **v1.1.7 at-rest encryption.** The key is sealed with the process
+//! **v1.1.7 at-rest encryption (two-phase).** The key is now sealed with
-//! master key (AES-256-GCM). v1.1.8 (this commit) removes the
+//! the process master key (AES-256-GCM). New keys are written
-//! plaintext fallback column — the read path consults only the
+//! encrypted-only; the startup task [`PostgresAppSecretsRepo::migrate_plaintext_keys`]
-//! encrypted columns now. The 0032 migration enforces this by
+//! encrypts any pre-existing plaintext rows. The read path prefers the
-//! refusing to drop the plaintext column unless every existing row
+//! encrypted columns and falls back to the plaintext column during the
-//! has been encrypted by the v1.1.7 startup sweep first.
+//! compat window (migration 0025 made it NULL-able; v1.1.8 drops it).
 use async_trait::async_trait;
 use picloud_shared::{crypto, AppId, MasterKey};
 use rand::RngCore;
 use sqlx::PgPool;
 use uuid::Uuid;
 /// Length of a freshly-generated realtime signing key.
 pub const SIGNING_KEY_LEN: usize = 32;
@@ -61,56 +61,69 @@ impl PostgresAppSecretsRepo {
        Self { pool, master_key }
    }
    /// Startup task (v1.1.7): encrypt every row that still has a
    /// plaintext key but no encrypted key. Plaintext is left in place
    /// (the read path prefers the encrypted columns); the plaintext
    /// column is dropped in v1.1.8. Returns the number of rows migrated.
    ///
    /// # Errors
    ///
    /// Propagates database errors.
    pub async fn migrate_plaintext_keys(&self) -> Result<usize, AppSecretsRepoError> {
        let rows: Vec<(Uuid, Vec<u8>)> = sqlx::query_as(
            "SELECT app_id, realtime_signing_key FROM app_secrets \
             WHERE realtime_signing_key_encrypted IS NULL \
               AND realtime_signing_key IS NOT NULL",
        )
        .fetch_all(&self.pool)
        .await?;
        let mut migrated = 0;
        for (app_id, plaintext) in rows {
            let enc = crypto::encrypt(&plaintext, self.master_key.as_bytes());
            sqlx::query(
                "UPDATE app_secrets \
                 SET realtime_signing_key_encrypted = $2, \
                     realtime_signing_key_nonce = $3, \
                     updated_at = NOW() \
                 WHERE app_id = $1 AND realtime_signing_key_encrypted IS NULL",
            )
            .bind(app_id)
            .bind(&enc.ciphertext)
            .bind(&enc.nonce[..])
            .execute(&self.pool)
            .await?;
            migrated += 1;
        }
        Ok(migrated)
    }
    fn decode(
        &self,
        app_id: AppId,
        encrypted: Option<Vec<u8>>,
        nonce: Option<Vec<u8>>,
-        version: i16,
+        plaintext: Option<Vec<u8>>,
    ) -> Result<Option<Vec<u8>>, AppSecretsRepoError> {
-        decode_signing_key(&self.master_key, app_id, encrypted, nonce, version)
+        decode_signing_key(&self.master_key, encrypted, nonce, plaintext)
    }
 }
-/// Audit 2026-06-11 H-D1 — AAD binding the realtime signing key to its
+/// Resolve the signing key from a row's three columns. **Encrypted wins**
-/// owning app, so a Postgres-write attacker can't swap one app's
+/// when present; otherwise fall back to the plaintext column (compat for
-/// ciphertext under another app's row.
+/// un-migrated rows / the post-v1.1.8 dropped-plaintext state).
 fn signing_key_aad(app_id: AppId) -> Vec<u8> {
    format!("app_secret:{app_id}:realtime_signing_key").into_bytes()
 }
 /// Current AAD-bound envelope version for the realtime signing key.
 const SIGNING_KEY_ENVELOPE_V1: i16 = 1;
 /// Resolve the signing key from a row's encrypted columns. The
 /// plaintext fallback that existed in v1.1.7 is gone — v1.1.8 F1
 /// drops the column outright (migration 0032 refuses to apply if any
 /// row still needs encryption, guaranteeing the read path can't see
 /// a row that only has a plaintext value).
 ///
 /// Audit 2026-06-11 H-D1: dispatches on `version`. v0 = legacy no-AAD
 /// (pre-audit rows); v1 = AAD bound to `app_secret:{app_id}:realtime_signing_key`.
 fn decode_signing_key(
    master_key: &MasterKey,
    app_id: AppId,
    encrypted: Option<Vec<u8>>,
    nonce: Option<Vec<u8>>,
-    version: i16,
+    plaintext: Option<Vec<u8>>,
 ) -> Result<Option<Vec<u8>>, AppSecretsRepoError> {
    match (encrypted, nonce) {
        (Some(ct), Some(n)) => {
-            let key = match version {
+            let key = crypto::decrypt(&ct, &n, master_key.as_bytes())
-                0 => crypto::decrypt(&ct, &n, master_key.as_bytes()),
+                .map_err(|_| AppSecretsRepoError::Crypto)?;
                SIGNING_KEY_ENVELOPE_V1 => {
                    let aad = signing_key_aad(app_id);
                    crypto::decrypt_with_aad(&ct, &n, &aad, master_key.as_bytes())
                }
                _ => return Err(AppSecretsRepoError::Crypto),
            }
            .map_err(|_| AppSecretsRepoError::Crypto)?;
            Ok(Some(key))
        }
-        _ => Ok(None),
+        _ => Ok(plaintext),
    }
 }
@@ -122,49 +135,45 @@ impl AppSecretsRepo for PostgresAppSecretsRepo {
    ) -> Result<Vec<u8>, AppSecretsRepoError> {
        let mut fresh = vec![0u8; SIGNING_KEY_LEN];
        rand::thread_rng().fill_bytes(&mut fresh);
-        // Audit 2026-06-11 H-D1 — new keys are AAD-bound (v1).
+        let enc = crypto::encrypt(&fresh, self.master_key.as_bytes());
        let aad = signing_key_aad(app_id);
        let enc = crypto::encrypt_with_aad(&fresh, &aad, self.master_key.as_bytes());
        // Insert-if-absent (encrypted-only). The racing-creator's insert
        // is a no-op; the SELECT always returns the winning row.
        sqlx::query(
            "INSERT INTO app_secrets \
-                (app_id, realtime_signing_key_encrypted, realtime_signing_key_nonce, \
+                (app_id, realtime_signing_key_encrypted, realtime_signing_key_nonce) \
-                 realtime_signing_key_version) \
+             VALUES ($1, $2, $3) ON CONFLICT (app_id) DO NOTHING",
             VALUES ($1, $2, $3, $4) ON CONFLICT (app_id) DO NOTHING",
        )
        .bind(app_id.into_inner())
        .bind(&enc.ciphertext)
        .bind(&enc.nonce[..])
        .bind(SIGNING_KEY_ENVELOPE_V1)
        .execute(&self.pool)
        .await?;
-        let row: (Option<Vec<u8>>, Option<Vec<u8>>, i16) = sqlx::query_as(
+        let row: (Option<Vec<u8>>, Option<Vec<u8>>, Option<Vec<u8>>) = sqlx::query_as(
            "SELECT realtime_signing_key_encrypted, realtime_signing_key_nonce, \
-                    realtime_signing_key_version \
+                    realtime_signing_key \
             FROM app_secrets WHERE app_id = $1",
        )
        .bind(app_id.into_inner())
        .fetch_one(&self.pool)
        .await?;
        // A row exists by construction, so a key must decode.
-        self.decode(app_id, row.0, row.1, row.2)?
+        self.decode(row.0, row.1, row.2)?
            .ok_or(AppSecretsRepoError::Crypto)
    }
    async fn signing_key(&self, app_id: AppId) -> Result<Option<Vec<u8>>, AppSecretsRepoError> {
-        let row: Option<(Option<Vec<u8>>, Option<Vec<u8>>, i16)> = sqlx::query_as(
+        let row: Option<(Option<Vec<u8>>, Option<Vec<u8>>, Option<Vec<u8>>)> = sqlx::query_as(
            "SELECT realtime_signing_key_encrypted, realtime_signing_key_nonce, \
-                    realtime_signing_key_version \
+                    realtime_signing_key \
             FROM app_secrets WHERE app_id = $1",
        )
        .bind(app_id.into_inner())
        .fetch_optional(&self.pool)
        .await?;
        match row {
-            Some((e, n, v)) => self.decode(app_id, e, n, v),
+            Some((e, n, p)) => self.decode(e, n, p),
            None => Ok(None),
        }
    }
@@ -178,68 +187,45 @@ mod tests {
        MasterKey::from_bytes([9u8; 32])
    }
    fn app() -> AppId {
        AppId::new()
    }
    #[test]
-    fn legacy_v0_decodes() {
+    fn encrypted_wins_over_plaintext() {
        let mk = key();
        let secret = vec![1u8, 2, 3, 4];
        let enc = crypto::encrypt(&secret, mk.as_bytes());
        // Both present → the encrypted value is returned (not the bogus
        // plaintext).
        let got = decode_signing_key(
            &mk,
            app(),
            Some(enc.ciphertext),
            Some(enc.nonce.to_vec()),
-            0,
+            Some(vec![0xff; 32]),
        )
        .unwrap();
        assert_eq!(got, Some(secret));
    }
    #[test]
-    fn v1_aad_round_trips() {
+    fn falls_back_to_plaintext_when_encrypted_absent() {
        let mk = key();
-        let a = app();
+        let plaintext = vec![7u8; 32];
-        let secret = vec![7u8; 32];
+        let got = decode_signing_key(&mk, None, None, Some(plaintext.clone())).unwrap();
-        let aad = signing_key_aad(a);
+        assert_eq!(got, Some(plaintext));
-        let enc = crypto::encrypt_with_aad(&secret, &aad, mk.as_bytes());
+    }
-        let got = decode_signing_key(
+
-            &mk,
+    #[test]
-            a,
+    fn encrypted_present_plaintext_null_works() {
-            Some(enc.ciphertext),
+        // Post-v1.1.8 state: only the encrypted columns are populated.
-            Some(enc.nonce.to_vec()),
+        let mk = key();
-            SIGNING_KEY_ENVELOPE_V1,
+        let secret = vec![5u8; 32];
-        )
+        let enc = crypto::encrypt(&secret, mk.as_bytes());
-        .unwrap();
+        let got =
            decode_signing_key(&mk, Some(enc.ciphertext), Some(enc.nonce.to_vec()), None).unwrap();
        assert_eq!(got, Some(secret));
    }
    #[test]
-    fn v1_decode_under_wrong_app_fails() {
+    fn missing_everything_is_none() {
-        // Audit 2026-06-11 H-D1 — a row swapped to a different app_id
+        let got = decode_signing_key(&key(), None, None, None).unwrap();
        // can't be decrypted: the AAD no longer matches.
        let mk = key();
        let a = app();
        let b = app();
        let secret = vec![7u8; 32];
        let aad = signing_key_aad(a);
        let enc = crypto::encrypt_with_aad(&secret, &aad, mk.as_bytes());
        let err = decode_signing_key(
            &mk,
            b,
            Some(enc.ciphertext),
            Some(enc.nonce.to_vec()),
            SIGNING_KEY_ENVELOPE_V1,
        )
        .unwrap_err();
        assert!(matches!(err, AppSecretsRepoError::Crypto));
    }
    #[test]
    fn missing_columns_is_none() {
        let got = decode_signing_key(&key(), app(), None, None, 0).unwrap();
        assert_eq!(got, None);
    }
@@ -248,14 +234,8 @@ mod tests {
        let secret = vec![3u8; 32];
        let enc = crypto::encrypt(&secret, key().as_bytes());
        let other = MasterKey::from_bytes([1u8; 32]);
-        let err = decode_signing_key(
+        let err = decode_signing_key(&other, Some(enc.ciphertext), Some(enc.nonce.to_vec()), None)
-            &other,
+            .unwrap_err();
            app(),
            Some(enc.ciphertext),
            Some(enc.nonce.to_vec()),
            0,
        )
        .unwrap_err();
        assert!(matches!(err, AppSecretsRepoError::Crypto));
    }
 }
--- a/crates/manager-core/src/app_user_invitation_repo.rs
+++ b/crates/manager-core/src/app_user_invitation_repo.rs
@@ -1,219 +0,0 @@
 //! CRUD over `app_user_invitations` (v1.1.8 commit 7).
 //!
 //! Distinct shape from the verification / reset repos: pre-stages
 //! email + display_name + roles for a user that doesn't exist yet.
 //! The admin UI references rows by surrogate `id`; the consumer
 //! references by `token_hash`. Both views are scoped by `app_id`.
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use picloud_shared::{AppId, InvitationId};
 use sqlx::PgPool;
 #[derive(Debug, thiserror::Error)]
 pub enum AppUserInvitationRepoError {
    #[error("database error: {0}")]
    Db(#[from] sqlx::Error),
 }
 #[derive(Debug, Clone)]
 pub struct InvitationRow {
    pub id: InvitationId,
    pub app_id: AppId,
    pub email: String,
    pub display_name: Option<String>,
    pub roles: Vec<String>,
    pub created_at: DateTime<Utc>,
    pub expires_at: DateTime<Utc>,
    pub accepted_at: Option<DateTime<Utc>>,
 }
 /// Snapshot returned by `consume` — just the fields needed to create
 /// the new user. Excludes timestamps and ids since the caller already
 /// has the token hash and the consume happened atomically.
 #[derive(Debug, Clone)]
 pub struct ConsumedInvitation {
    pub email: String,
    pub display_name: Option<String>,
    pub roles: Vec<String>,
 }
 #[async_trait]
 pub trait AppUserInvitationRepo: Send + Sync {
    async fn create(
        &self,
        app_id: AppId,
        email: &str,
        display_name: Option<&str>,
        roles: &[String],
        token_hash: &str,
        expires_at: DateTime<Utc>,
    ) -> Result<InvitationRow, AppUserInvitationRepoError>;
    /// Pending invitations (accepted_at IS NULL) for the admin UI.
    async fn list_pending(
        &self,
        app_id: AppId,
    ) -> Result<Vec<InvitationRow>, AppUserInvitationRepoError>;
    /// Admin revoke (deletes the pending row). Returns whether a row
    /// was actually removed.
    async fn revoke(
        &self,
        app_id: AppId,
        invite_id: InvitationId,
    ) -> Result<bool, AppUserInvitationRepoError>;
    /// Atomic one-shot consume by token. Returns the staged fields
    /// for the caller to create the user from; None on
    /// missing / already-accepted / expired / wrong app.
    async fn consume_by_token(
        &self,
        app_id: AppId,
        token_hash: &str,
    ) -> Result<Option<ConsumedInvitation>, AppUserInvitationRepoError>;
    /// GC: drop accepted or expired rows.
    async fn gc(&self, batch_size: i64) -> Result<u64, AppUserInvitationRepoError>;
 }
 pub struct PostgresAppUserInvitationRepo {
    pool: PgPool,
 }
 impl PostgresAppUserInvitationRepo {
    #[must_use]
    pub fn new(pool: PgPool) -> Self {
        Self { pool }
    }
 }
 #[async_trait]
 impl AppUserInvitationRepo for PostgresAppUserInvitationRepo {
    async fn create(
        &self,
        app_id: AppId,
        email: &str,
        display_name: Option<&str>,
        roles: &[String],
        token_hash: &str,
        expires_at: DateTime<Utc>,
    ) -> Result<InvitationRow, AppUserInvitationRepoError> {
        let row: InvitationRecord = sqlx::query_as(
            "INSERT INTO app_user_invitations \
                 (token_hash, app_id, email, display_name, roles, expires_at) \
             VALUES ($1, $2, $3, $4, $5, $6) \
             RETURNING id, app_id, email, display_name, roles, \
                       created_at, expires_at, accepted_at",
        )
        .bind(token_hash)
        .bind(app_id.into_inner())
        .bind(email)
        .bind(display_name)
        .bind(roles)
        .bind(expires_at)
        .fetch_one(&self.pool)
        .await?;
        Ok(row.into())
    }
    async fn list_pending(
        &self,
        app_id: AppId,
    ) -> Result<Vec<InvitationRow>, AppUserInvitationRepoError> {
        let rows: Vec<InvitationRecord> = sqlx::query_as(
            "SELECT id, app_id, email, display_name, roles, \
                    created_at, expires_at, accepted_at \
             FROM app_user_invitations \
             WHERE app_id = $1 AND accepted_at IS NULL \
             ORDER BY created_at DESC",
        )
        .bind(app_id.into_inner())
        .fetch_all(&self.pool)
        .await?;
        Ok(rows.into_iter().map(Into::into).collect())
    }
    async fn revoke(
        &self,
        app_id: AppId,
        invite_id: InvitationId,
    ) -> Result<bool, AppUserInvitationRepoError> {
        let res = sqlx::query(
            "DELETE FROM app_user_invitations \
             WHERE app_id = $1 AND id = $2 AND accepted_at IS NULL",
        )
        .bind(app_id.into_inner())
        .bind(invite_id.into_inner())
        .execute(&self.pool)
        .await?;
        Ok(res.rows_affected() > 0)
    }
    async fn consume_by_token(
        &self,
        app_id: AppId,
        token_hash: &str,
    ) -> Result<Option<ConsumedInvitation>, AppUserInvitationRepoError> {
        let row: Option<(String, Option<String>, Vec<String>)> = sqlx::query_as(
            "UPDATE app_user_invitations \
             SET accepted_at = NOW() \
             WHERE token_hash = $1 \
               AND app_id = $2 \
               AND accepted_at IS NULL \
               AND expires_at > NOW() \
             RETURNING email, display_name, roles",
        )
        .bind(token_hash)
        .bind(app_id.into_inner())
        .fetch_optional(&self.pool)
        .await?;
        Ok(row.map(|(email, display_name, roles)| ConsumedInvitation {
            email,
            display_name,
            roles,
        }))
    }
    async fn gc(&self, batch_size: i64) -> Result<u64, AppUserInvitationRepoError> {
        let res = sqlx::query(
            "DELETE FROM app_user_invitations WHERE id IN ( \
                 SELECT id FROM app_user_invitations \
                 WHERE expires_at <= NOW() OR accepted_at IS NOT NULL \
                 LIMIT $1 \
                 FOR UPDATE SKIP LOCKED \
             )",
        )
        .bind(batch_size)
        .execute(&self.pool)
        .await?;
        Ok(res.rows_affected())
    }
 }
 #[derive(sqlx::FromRow)]
 struct InvitationRecord {
    id: uuid::Uuid,
    app_id: uuid::Uuid,
    email: String,
    display_name: Option<String>,
    roles: Vec<String>,
    created_at: DateTime<Utc>,
    expires_at: DateTime<Utc>,
    accepted_at: Option<DateTime<Utc>>,
 }
 impl From<InvitationRecord> for InvitationRow {
    fn from(r: InvitationRecord) -> Self {
        Self {
            id: r.id.into(),
            app_id: r.app_id.into(),
            email: r.email,
            display_name: r.display_name,
            roles: r.roles,
            created_at: r.created_at,
            expires_at: r.expires_at,
            accepted_at: r.accepted_at,
        }
    }
 }
--- a/crates/manager-core/src/app_user_password_reset_repo.rs
+++ b/crates/manager-core/src/app_user_password_reset_repo.rs
@@ -1,111 +0,0 @@
 //! CRUD over `app_user_password_resets` (v1.1.8 commit 6).
 //!
 //! Same shape and one-shot semantics as `app_user_verification_repo`.
 //! Kept as a separate repo so the distinct lifecycles (consume then
 //! revoke-sessions for reset; consume then mark-email-verified for
 //! verification) stay obvious at the call site. A future v1.2 cleanup
 //! may merge them behind a `kind` discriminator if the duplication
 //! becomes load-bearing.
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use picloud_shared::{AppId, AppUserId};
 use sqlx::PgPool;
 #[derive(Debug, thiserror::Error)]
 pub enum AppUserPasswordResetRepoError {
    #[error("database error: {0}")]
    Db(#[from] sqlx::Error),
 }
 #[async_trait]
 pub trait AppUserPasswordResetRepo: Send + Sync {
    async fn create(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        token_hash: &str,
        expires_at: DateTime<Utc>,
    ) -> Result<(), AppUserPasswordResetRepoError>;
    /// Atomic consume. Returns `Some(user_id)` on success, `None` on
    /// missing / already-consumed / expired / wrong app.
    async fn consume(
        &self,
        app_id: AppId,
        token_hash: &str,
    ) -> Result<Option<AppUserId>, AppUserPasswordResetRepoError>;
    async fn gc(&self, batch_size: i64) -> Result<u64, AppUserPasswordResetRepoError>;
 }
 pub struct PostgresAppUserPasswordResetRepo {
    pool: PgPool,
 }
 impl PostgresAppUserPasswordResetRepo {
    #[must_use]
    pub fn new(pool: PgPool) -> Self {
        Self { pool }
    }
 }
 #[async_trait]
 impl AppUserPasswordResetRepo for PostgresAppUserPasswordResetRepo {
    async fn create(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        token_hash: &str,
        expires_at: DateTime<Utc>,
    ) -> Result<(), AppUserPasswordResetRepoError> {
        sqlx::query(
            "INSERT INTO app_user_password_resets \
                 (token_hash, app_id, user_id, expires_at) \
             VALUES ($1, $2, $3, $4)",
        )
        .bind(token_hash)
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .bind(expires_at)
        .execute(&self.pool)
        .await?;
        Ok(())
    }
    async fn consume(
        &self,
        app_id: AppId,
        token_hash: &str,
    ) -> Result<Option<AppUserId>, AppUserPasswordResetRepoError> {
        let row: Option<(uuid::Uuid,)> = sqlx::query_as(
            "UPDATE app_user_password_resets \
             SET consumed_at = NOW() \
             WHERE token_hash = $1 \
               AND app_id = $2 \
               AND consumed_at IS NULL \
               AND expires_at > NOW() \
             RETURNING user_id",
        )
        .bind(token_hash)
        .bind(app_id.into_inner())
        .fetch_optional(&self.pool)
        .await?;
        Ok(row.map(|(uid,)| uid.into()))
    }
    async fn gc(&self, batch_size: i64) -> Result<u64, AppUserPasswordResetRepoError> {
        let res = sqlx::query(
            "DELETE FROM app_user_password_resets WHERE token_hash IN ( \
                 SELECT token_hash FROM app_user_password_resets \
                 WHERE expires_at <= NOW() OR consumed_at IS NOT NULL \
                 LIMIT $1 \
                 FOR UPDATE SKIP LOCKED \
             )",
        )
        .bind(batch_size)
        .execute(&self.pool)
        .await?;
        Ok(res.rows_affected())
    }
 }
--- a/crates/manager-core/src/app_user_repo.rs
+++ b/crates/manager-core/src/app_user_repo.rs
@@ -1,431 +0,0 @@
 //! CRUD over the `app_users` table (v1.1.8 data-plane user management).
 //!
 //! Distinct from `admin_user_repo.rs`: that's the control-plane
 //! operator table (you / me / the dashboard login). This is the
 //! script-end-user surface — created by app scripts via `users::*`,
 //! managed by the dashboard's per-app Users tab.
 //!
 //! Identity tuple is `(app_id, id)`; uniqueness is enforced on
 //! `(app_id, lower(email))` so the same email can exist in different
 //! apps but not twice in the same app. The repo always filters by
 //! `app_id` — there is no "get any user" query. Cross-app reads must
 //! pass two `app_id` values explicitly, which keeps the v1.1.3-style
 //! cross-app discipline obvious at the call site.
 //!
 //! Password hashes go in and come out as opaque Argon2id PHC strings —
 //! the repo never computes or inspects them; that's `auth.rs`'s job.
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use picloud_shared::{AppId, AppUserId};
 use sqlx::PgPool;
 #[derive(Debug, thiserror::Error)]
 pub enum AppUserRepositoryError {
    #[error("database error: {0}")]
    Db(#[from] sqlx::Error),
    #[error("not found: {0}")]
    NotFound(AppUserId),
    #[error("email already in use: {0}")]
    DuplicateEmail(String),
 }
 /// Row returned to handlers and the service layer. Never includes the
 /// password hash — that ships out of [`AppUserCredentials`] on the
 /// dedicated login lookup, mirroring how `admin_user_repo` splits its
 /// public row from its credential row.
 #[derive(Debug, Clone)]
 pub struct AppUserRow {
    pub id: AppUserId,
    pub app_id: AppId,
    pub email: String,
    pub display_name: Option<String>,
    pub email_verified_at: Option<DateTime<Utc>>,
    pub last_login_at: Option<DateTime<Utc>>,
    pub created_at: DateTime<Utc>,
    pub updated_at: DateTime<Utc>,
 }
 /// Credentials fetched for the login path only. Splitting the hash off
 /// from the public row makes it obvious in service code which calls
 /// touch a secret.
 #[derive(Debug, Clone)]
 pub struct AppUserCredentials {
    pub id: AppUserId,
    pub app_id: AppId,
    pub email: String,
    pub password_hash: String,
 }
 #[async_trait]
 pub trait AppUserRepository: Send + Sync {
    async fn get(
        &self,
        app_id: AppId,
        id: AppUserId,
    ) -> Result<Option<AppUserRow>, AppUserRepositoryError>;
    /// Case-insensitive email lookup, scoped to a single app.
    async fn find_by_email(
        &self,
        app_id: AppId,
        email: &str,
    ) -> Result<Option<AppUserRow>, AppUserRepositoryError>;
    /// Credentials lookup for the login path. Case-insensitive on email.
    /// Returns `None` for missing — callers run a timing-flat dummy
    /// verify on miss to avoid leaking which path was taken.
    async fn get_credentials_by_email(
        &self,
        app_id: AppId,
        email: &str,
    ) -> Result<Option<AppUserCredentials>, AppUserRepositoryError>;
    async fn list(
        &self,
        app_id: AppId,
        opts: ListOpts,
    ) -> Result<ListPage<AppUserRow>, AppUserRepositoryError>;
    async fn create(
        &self,
        app_id: AppId,
        email: &str,
        password_hash: &str,
        display_name: Option<&str>,
    ) -> Result<AppUserRow, AppUserRepositoryError>;
    async fn update_display_name(
        &self,
        app_id: AppId,
        id: AppUserId,
        display_name: Option<&str>,
    ) -> Result<AppUserRow, AppUserRepositoryError>;
    async fn update_password_hash(
        &self,
        app_id: AppId,
        id: AppUserId,
        password_hash: &str,
    ) -> Result<AppUserRow, AppUserRepositoryError>;
    async fn mark_email_verified(
        &self,
        app_id: AppId,
        id: AppUserId,
    ) -> Result<AppUserRow, AppUserRepositoryError>;
    async fn touch_last_login(
        &self,
        app_id: AppId,
        id: AppUserId,
    ) -> Result<(), AppUserRepositoryError>;
    async fn delete(&self, app_id: AppId, id: AppUserId) -> Result<bool, AppUserRepositoryError>;
 }
 /// F-P-012: cursor carries `(created_at, id)` for keyset pagination.
 /// Without the `id` tiebreaker, two users created at the same instant
 /// could be skipped or duplicated at a page boundary.
 #[derive(Debug, Clone, Copy)]
 pub struct ListCursor {
    pub created_at: DateTime<Utc>,
    pub id: picloud_shared::AppUserId,
 }
 impl ListCursor {
    /// Encode as `<rfc3339>_<uuid>` — what we surface to script-land
    /// via `users::list`'s `next_cursor` field.
    #[must_use]
    pub fn encode(&self) -> String {
        format!("{}_{}", self.created_at.to_rfc3339(), self.id.into_inner())
    }
    /// Decode the wire format. Returns `None` on any parse error — the
    /// caller treats that as "start of page" rather than 400'ing on a
    /// stale cursor from a previous schema.
    #[must_use]
    pub fn decode(s: &str) -> Option<Self> {
        let (ts, id) = s.rsplit_once('_')?;
        let created_at = DateTime::parse_from_rfc3339(ts).ok()?.to_utc();
        let id = uuid::Uuid::parse_str(id).ok()?;
        Some(Self {
            created_at,
            id: picloud_shared::AppUserId::from(id),
        })
    }
 }
 #[derive(Debug, Clone, Default)]
 pub struct ListOpts {
    pub cursor: Option<ListCursor>,
    pub limit: i64,
 }
 #[derive(Debug, Clone)]
 pub struct ListPage<T> {
    pub items: Vec<T>,
    pub next_cursor: Option<ListCursor>,
 }
 pub struct PostgresAppUserRepository {
    pool: PgPool,
 }
 impl PostgresAppUserRepository {
    #[must_use]
    pub fn new(pool: PgPool) -> Self {
        Self { pool }
    }
 }
 #[async_trait]
 impl AppUserRepository for PostgresAppUserRepository {
    async fn get(
        &self,
        app_id: AppId,
        id: AppUserId,
    ) -> Result<Option<AppUserRow>, AppUserRepositoryError> {
        let row = sqlx::query_as::<_, AppUserRecord>(
            "SELECT id, app_id, email, display_name, email_verified_at, \
                    last_login_at, created_at, updated_at \
             FROM app_users WHERE app_id = $1 AND id = $2",
        )
        .bind(app_id.into_inner())
        .bind(id.into_inner())
        .fetch_optional(&self.pool)
        .await?;
        Ok(row.map(Into::into))
    }
    async fn find_by_email(
        &self,
        app_id: AppId,
        email: &str,
    ) -> Result<Option<AppUserRow>, AppUserRepositoryError> {
        let row = sqlx::query_as::<_, AppUserRecord>(
            "SELECT id, app_id, email, display_name, email_verified_at, \
                    last_login_at, created_at, updated_at \
             FROM app_users WHERE app_id = $1 AND lower(email) = lower($2)",
        )
        .bind(app_id.into_inner())
        .bind(email)
        .fetch_optional(&self.pool)
        .await?;
        Ok(row.map(Into::into))
    }
    async fn get_credentials_by_email(
        &self,
        app_id: AppId,
        email: &str,
    ) -> Result<Option<AppUserCredentials>, AppUserRepositoryError> {
        let row = sqlx::query_as::<_, AppUserCredsRecord>(
            "SELECT id, app_id, email, password_hash \
             FROM app_users WHERE app_id = $1 AND lower(email) = lower($2)",
        )
        .bind(app_id.into_inner())
        .bind(email)
        .fetch_optional(&self.pool)
        .await?;
        Ok(row.map(Into::into))
    }
    async fn list(
        &self,
        app_id: AppId,
        opts: ListOpts,
    ) -> Result<ListPage<AppUserRow>, AppUserRepositoryError> {
        let limit = opts.limit.clamp(1, 500);
        // Fetch one extra to detect whether more pages exist.
        let rows = if let Some(cursor) = opts.cursor {
            sqlx::query_as::<_, AppUserRecord>(
                "SELECT id, app_id, email, display_name, email_verified_at, \
                        last_login_at, created_at, updated_at \
                 FROM app_users WHERE app_id = $1 \
                   AND (created_at, id) < ($2, $3) \
                 ORDER BY created_at DESC, id DESC LIMIT $4",
            )
            .bind(app_id.into_inner())
            .bind(cursor.created_at)
            .bind(cursor.id.into_inner())
            .bind(limit + 1)
            .fetch_all(&self.pool)
            .await?
        } else {
            sqlx::query_as::<_, AppUserRecord>(
                "SELECT id, app_id, email, display_name, email_verified_at, \
                        last_login_at, created_at, updated_at \
                 FROM app_users WHERE app_id = $1 \
                 ORDER BY created_at DESC, id DESC LIMIT $2",
            )
            .bind(app_id.into_inner())
            .bind(limit + 1)
            .fetch_all(&self.pool)
            .await?
        };
        let mut items: Vec<AppUserRow> = rows.into_iter().map(Into::into).collect();
        let next_cursor = if i64::try_from(items.len()).unwrap_or(i64::MAX) > limit {
            let cursor_row = items.pop().expect("len > limit so there is a row");
            Some(ListCursor {
                created_at: cursor_row.created_at,
                id: cursor_row.id,
            })
        } else {
            None
        };
        Ok(ListPage { items, next_cursor })
    }
    async fn create(
        &self,
        app_id: AppId,
        email: &str,
        password_hash: &str,
        display_name: Option<&str>,
    ) -> Result<AppUserRow, AppUserRepositoryError> {
        let res = sqlx::query_as::<_, AppUserRecord>(
            "INSERT INTO app_users (app_id, email, password_hash, display_name) \
             VALUES ($1, $2, $3, $4) \
             RETURNING id, app_id, email, display_name, email_verified_at, \
                       last_login_at, created_at, updated_at",
        )
        .bind(app_id.into_inner())
        .bind(email)
        .bind(password_hash)
        .bind(display_name)
        .fetch_one(&self.pool)
        .await;
        match res {
            Ok(row) => Ok(row.into()),
            Err(sqlx::Error::Database(e)) if e.is_unique_violation() => {
                Err(AppUserRepositoryError::DuplicateEmail(email.to_string()))
            }
            Err(e) => Err(e.into()),
        }
    }
    async fn update_display_name(
        &self,
        app_id: AppId,
        id: AppUserId,
        display_name: Option<&str>,
    ) -> Result<AppUserRow, AppUserRepositoryError> {
        let row = sqlx::query_as::<_, AppUserRecord>(
            "UPDATE app_users SET display_name = $3, updated_at = NOW() \
             WHERE app_id = $1 AND id = $2 \
             RETURNING id, app_id, email, display_name, email_verified_at, \
                       last_login_at, created_at, updated_at",
        )
        .bind(app_id.into_inner())
        .bind(id.into_inner())
        .bind(display_name)
        .fetch_optional(&self.pool)
        .await?;
        row.map(Into::into)
            .ok_or(AppUserRepositoryError::NotFound(id))
    }
    async fn update_password_hash(
        &self,
        app_id: AppId,
        id: AppUserId,
        password_hash: &str,
    ) -> Result<AppUserRow, AppUserRepositoryError> {
        let row = sqlx::query_as::<_, AppUserRecord>(
            "UPDATE app_users SET password_hash = $3, updated_at = NOW() \
             WHERE app_id = $1 AND id = $2 \
             RETURNING id, app_id, email, display_name, email_verified_at, \
                       last_login_at, created_at, updated_at",
        )
        .bind(app_id.into_inner())
        .bind(id.into_inner())
        .bind(password_hash)
        .fetch_optional(&self.pool)
        .await?;
        row.map(Into::into)
            .ok_or(AppUserRepositoryError::NotFound(id))
    }
    async fn mark_email_verified(
        &self,
        app_id: AppId,
        id: AppUserId,
    ) -> Result<AppUserRow, AppUserRepositoryError> {
        let row = sqlx::query_as::<_, AppUserRecord>(
            "UPDATE app_users SET email_verified_at = NOW(), updated_at = NOW() \
             WHERE app_id = $1 AND id = $2 \
             RETURNING id, app_id, email, display_name, email_verified_at, \
                       last_login_at, created_at, updated_at",
        )
        .bind(app_id.into_inner())
        .bind(id.into_inner())
        .fetch_optional(&self.pool)
        .await?;
        row.map(Into::into)
            .ok_or(AppUserRepositoryError::NotFound(id))
    }
    async fn touch_last_login(
        &self,
        app_id: AppId,
        id: AppUserId,
    ) -> Result<(), AppUserRepositoryError> {
        sqlx::query("UPDATE app_users SET last_login_at = NOW() WHERE app_id = $1 AND id = $2")
            .bind(app_id.into_inner())
            .bind(id.into_inner())
            .execute(&self.pool)
            .await?;
        Ok(())
    }
    async fn delete(&self, app_id: AppId, id: AppUserId) -> Result<bool, AppUserRepositoryError> {
        let res = sqlx::query("DELETE FROM app_users WHERE app_id = $1 AND id = $2")
            .bind(app_id.into_inner())
            .bind(id.into_inner())
            .execute(&self.pool)
            .await?;
        Ok(res.rows_affected() > 0)
    }
 }
 #[derive(sqlx::FromRow)]
 struct AppUserRecord {
    id: uuid::Uuid,
    app_id: uuid::Uuid,
    email: String,
    display_name: Option<String>,
    email_verified_at: Option<DateTime<Utc>>,
    last_login_at: Option<DateTime<Utc>>,
    created_at: DateTime<Utc>,
    updated_at: DateTime<Utc>,
 }
 impl From<AppUserRecord> for AppUserRow {
    fn from(r: AppUserRecord) -> Self {
        Self {
            id: r.id.into(),
            app_id: r.app_id.into(),
            email: r.email,
            display_name: r.display_name,
            email_verified_at: r.email_verified_at,
            last_login_at: r.last_login_at,
            created_at: r.created_at,
            updated_at: r.updated_at,
        }
    }
 }
 #[derive(sqlx::FromRow)]
 struct AppUserCredsRecord {
    id: uuid::Uuid,
    app_id: uuid::Uuid,
    email: String,
    password_hash: String,
 }
 impl From<AppUserCredsRecord> for AppUserCredentials {
    fn from(r: AppUserCredsRecord) -> Self {
        Self {
            id: r.id.into(),
            app_id: r.app_id.into(),
            email: r.email,
            password_hash: r.password_hash,
        }
    }
 }
--- a/crates/manager-core/src/app_user_role_repo.rs
+++ b/crates/manager-core/src/app_user_role_repo.rs
@@ -1,168 +0,0 @@
 //! CRUD over `app_user_roles` (v1.1.8 commit 8).
 //!
 //! String-tagged roles only. No registry, no hierarchy, no
 //! permission matrix — the script app decides what the strings mean.
 //! Per-app, per-user; the PK is `(app_id, user_id, role)` so the
 //! `add` path is idempotent (`ON CONFLICT DO NOTHING`).
 use async_trait::async_trait;
 use picloud_shared::{AppId, AppUserId};
 use sqlx::PgPool;
 #[derive(Debug, thiserror::Error)]
 pub enum AppUserRoleRepoError {
    #[error("database error: {0}")]
    Db(#[from] sqlx::Error),
 }
 #[async_trait]
 pub trait AppUserRoleRepo: Send + Sync {
    /// Idempotent add — duplicate role for the same user is a no-op.
    async fn add(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        role: &str,
    ) -> Result<(), AppUserRoleRepoError>;
    /// Returns whether the role was actually removed (false if it
    /// wasn't there).
    async fn remove(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        role: &str,
    ) -> Result<bool, AppUserRoleRepoError>;
    async fn has(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        role: &str,
    ) -> Result<bool, AppUserRoleRepoError>;
    /// All roles for a single user. The AppUser DTO carries this list.
    async fn list_for_user(
        &self,
        app_id: AppId,
        user_id: AppUserId,
    ) -> Result<Vec<String>, AppUserRoleRepoError>;
    /// Batched variant of `list_for_user` — returns a map from user_id
    /// to that user's role list, in one round-trip. Used by paginated
    /// admin/script list endpoints to avoid an N+1.
    ///
    /// Empty `user_ids` returns an empty map (zero queries).
    async fn list_for_users(
        &self,
        app_id: AppId,
        user_ids: &[AppUserId],
    ) -> Result<std::collections::HashMap<AppUserId, Vec<String>>, AppUserRoleRepoError>;
 }
 pub struct PostgresAppUserRoleRepo {
    pool: PgPool,
 }
 impl PostgresAppUserRoleRepo {
    #[must_use]
    pub fn new(pool: PgPool) -> Self {
        Self { pool }
    }
 }
 #[async_trait]
 impl AppUserRoleRepo for PostgresAppUserRoleRepo {
    async fn add(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        role: &str,
    ) -> Result<(), AppUserRoleRepoError> {
        sqlx::query(
            "INSERT INTO app_user_roles (app_id, user_id, role) VALUES ($1, $2, $3) \
             ON CONFLICT (app_id, user_id, role) DO NOTHING",
        )
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .bind(role)
        .execute(&self.pool)
        .await?;
        Ok(())
    }
    async fn remove(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        role: &str,
    ) -> Result<bool, AppUserRoleRepoError> {
        let res = sqlx::query(
            "DELETE FROM app_user_roles WHERE app_id = $1 AND user_id = $2 AND role = $3",
        )
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .bind(role)
        .execute(&self.pool)
        .await?;
        Ok(res.rows_affected() > 0)
    }
    async fn has(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        role: &str,
    ) -> Result<bool, AppUserRoleRepoError> {
        let row: Option<(i64,)> = sqlx::query_as(
            "SELECT 1::BIGINT FROM app_user_roles \
             WHERE app_id = $1 AND user_id = $2 AND role = $3",
        )
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .bind(role)
        .fetch_optional(&self.pool)
        .await?;
        Ok(row.is_some())
    }
    async fn list_for_user(
        &self,
        app_id: AppId,
        user_id: AppUserId,
    ) -> Result<Vec<String>, AppUserRoleRepoError> {
        let rows: Vec<(String,)> = sqlx::query_as(
            "SELECT role FROM app_user_roles WHERE app_id = $1 AND user_id = $2 ORDER BY role",
        )
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .fetch_all(&self.pool)
        .await?;
        Ok(rows.into_iter().map(|(s,)| s).collect())
    }
    async fn list_for_users(
        &self,
        app_id: AppId,
        user_ids: &[AppUserId],
    ) -> Result<std::collections::HashMap<AppUserId, Vec<String>>, AppUserRoleRepoError> {
        if user_ids.is_empty() {
            return Ok(std::collections::HashMap::new());
        }
        let ids: Vec<uuid::Uuid> = user_ids.iter().map(|u| u.into_inner()).collect();
        let rows: Vec<(uuid::Uuid, String)> = sqlx::query_as(
            "SELECT user_id, role FROM app_user_roles \
             WHERE app_id = $1 AND user_id = ANY($2) ORDER BY user_id, role",
        )
        .bind(app_id.into_inner())
        .bind(&ids)
        .fetch_all(&self.pool)
        .await?;
        let mut out: std::collections::HashMap<AppUserId, Vec<String>> =
            user_ids.iter().map(|id| (*id, Vec::new())).collect();
        for (uid, role) in rows {
            out.entry(AppUserId::from(uid)).or_default().push(role);
        }
        Ok(out)
    }
 }
--- a/crates/manager-core/src/app_user_session_repo.rs
+++ b/crates/manager-core/src/app_user_session_repo.rs
@@ -1,202 +0,0 @@
 //! CRUD over the `app_user_sessions` table (v1.1.8 data-plane sessions).
 //!
 //! Mirrors the shape of `admin_session_repo` (token hash as PK, sliding
 //! window, prune on expiry) with three additions:
 //!
 //!   * `app_id` is part of every row so cross-app isolation is bright
 //!     at the SQL layer. Lookups by token hash still join on app_id —
 //!     a token issued for app A cannot be used to authorize a request
 //!     into app B even if the hash collides (which it won't, but the
 //!     defense-in-depth is cheap).
 //!   * `absolute_expires_at` is the hard cap. The repo writes whatever
 //!     `new_expires_at` it's handed on touch; the service computes the
 //!     min of (now + ttl, absolute_expires_at) so a session that's
 //!     been bumped a hundred times still dies at the absolute cap.
 //!   * `revoked_at` is explicit revocation. Lookups reject revoked
 //!     rows immediately so a "revoke all sessions" admin action takes
 //!     effect before the next GC sweep runs.
 //!
 //! The token never appears in this module — only the SHA-256 hash.
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use picloud_shared::{AppId, AppUserId};
 use sqlx::PgPool;
 #[derive(Debug, thiserror::Error)]
 pub enum AppUserSessionRepositoryError {
    #[error("database error: {0}")]
    Db(#[from] sqlx::Error),
 }
 /// Result of a session lookup. The service uses `expires_at` /
 /// `absolute_expires_at` to decide whether the bump is allowed.
 #[derive(Debug, Clone)]
 pub struct AppUserSessionLookup {
    pub app_id: AppId,
    pub user_id: AppUserId,
    pub expires_at: DateTime<Utc>,
    pub absolute_expires_at: DateTime<Utc>,
 }
 #[async_trait]
 pub trait AppUserSessionRepository: Send + Sync {
    async fn create(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        token_hash: &str,
        expires_at: DateTime<Utc>,
        absolute_expires_at: DateTime<Utc>,
    ) -> Result<(), AppUserSessionRepositoryError>;
    /// Look up a non-revoked session whose sliding window has not yet
    /// expired. Returns `None` for missing, revoked, or expired rows.
    /// The absolute cap is enforced by the caller (the value is returned
    /// here so the service can compute the next expires_at).
    async fn lookup(
        &self,
        token_hash: &str,
    ) -> Result<Option<AppUserSessionLookup>, AppUserSessionRepositoryError>;
    /// Sliding-window bump. Service supplies new_expires_at clamped at
    /// absolute_expires_at.
    async fn touch(
        &self,
        token_hash: &str,
        new_expires_at: DateTime<Utc>,
    ) -> Result<(), AppUserSessionRepositoryError>;
    /// Explicit revocation by token (logout).
    async fn revoke(&self, token_hash: &str) -> Result<(), AppUserSessionRepositoryError>;
    /// Revoke every active session for a user — password reset,
    /// admin "revoke all sessions" button. Returns rows affected so
    /// the caller can log or surface the count.
    async fn revoke_for_user(
        &self,
        app_id: AppId,
        user_id: AppUserId,
    ) -> Result<u64, AppUserSessionRepositoryError>;
    /// GC sweep. Deletes rows that are either expired (sliding window
    /// or absolute cap passed) or explicitly revoked. Same hygiene as
    /// `admin_session_repo::prune_expired` plus the revocation path.
    async fn gc(&self, batch_size: i64) -> Result<u64, AppUserSessionRepositoryError>;
 }
 pub struct PostgresAppUserSessionRepository {
    pool: PgPool,
 }
 impl PostgresAppUserSessionRepository {
    #[must_use]
    pub fn new(pool: PgPool) -> Self {
        Self { pool }
    }
 }
 #[async_trait]
 impl AppUserSessionRepository for PostgresAppUserSessionRepository {
    async fn create(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        token_hash: &str,
        expires_at: DateTime<Utc>,
        absolute_expires_at: DateTime<Utc>,
    ) -> Result<(), AppUserSessionRepositoryError> {
        sqlx::query(
            "INSERT INTO app_user_sessions \
                 (token_hash, app_id, user_id, expires_at, absolute_expires_at) \
             VALUES ($1, $2, $3, $4, $5)",
        )
        .bind(token_hash)
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .bind(expires_at)
        .bind(absolute_expires_at)
        .execute(&self.pool)
        .await?;
        Ok(())
    }
    async fn lookup(
        &self,
        token_hash: &str,
    ) -> Result<Option<AppUserSessionLookup>, AppUserSessionRepositoryError> {
        let row: Option<(uuid::Uuid, uuid::Uuid, DateTime<Utc>, DateTime<Utc>)> = sqlx::query_as(
            "SELECT app_id, user_id, expires_at, absolute_expires_at \
             FROM app_user_sessions \
             WHERE token_hash = $1 \
               AND revoked_at IS NULL \
               AND expires_at > NOW() \
               AND absolute_expires_at > NOW()",
        )
        .bind(token_hash)
        .fetch_optional(&self.pool)
        .await?;
        Ok(row.map(|(app, user, exp, abs)| AppUserSessionLookup {
            app_id: app.into(),
            user_id: user.into(),
            expires_at: exp,
            absolute_expires_at: abs,
        }))
    }
    async fn touch(
        &self,
        token_hash: &str,
        new_expires_at: DateTime<Utc>,
    ) -> Result<(), AppUserSessionRepositoryError> {
        sqlx::query(
            "UPDATE app_user_sessions \
             SET last_used_at = NOW(), expires_at = $2 \
             WHERE token_hash = $1 AND revoked_at IS NULL",
        )
        .bind(token_hash)
        .bind(new_expires_at)
        .execute(&self.pool)
        .await?;
        Ok(())
    }
    async fn revoke(&self, token_hash: &str) -> Result<(), AppUserSessionRepositoryError> {
        sqlx::query(
            "UPDATE app_user_sessions SET revoked_at = NOW() \
             WHERE token_hash = $1 AND revoked_at IS NULL",
        )
        .bind(token_hash)
        .execute(&self.pool)
        .await?;
        Ok(())
    }
    async fn revoke_for_user(
        &self,
        app_id: AppId,
        user_id: AppUserId,
    ) -> Result<u64, AppUserSessionRepositoryError> {
        let res = sqlx::query(
            "UPDATE app_user_sessions SET revoked_at = NOW() \
             WHERE app_id = $1 AND user_id = $2 AND revoked_at IS NULL",
        )
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .execute(&self.pool)
        .await?;
        Ok(res.rows_affected())
    }
    async fn gc(&self, batch_size: i64) -> Result<u64, AppUserSessionRepositoryError> {
        let res = sqlx::query(
            "DELETE FROM app_user_sessions WHERE token_hash IN ( \
                 SELECT token_hash FROM app_user_sessions \
                 WHERE expires_at <= NOW() \
                    OR absolute_expires_at <= NOW() \
                    OR revoked_at IS NOT NULL \
                 LIMIT $1 \
                 FOR UPDATE SKIP LOCKED \
             )",
        )
        .bind(batch_size)
        .execute(&self.pool)
        .await?;
        Ok(res.rows_affected())
    }
 }
--- a/crates/manager-core/src/app_user_verification_repo.rs
+++ b/crates/manager-core/src/app_user_verification_repo.rs
@@ -1,114 +0,0 @@
 //! CRUD over `app_user_email_verifications` (v1.1.8 commit 5).
 //!
 //! One-shot tokens. The consume path is an atomic UPDATE WHERE
 //! consumed_at IS NULL: rowcount = 1 means the token was valid and is
 //! now used; rowcount = 0 means missing / already-consumed / wrong
 //! app. The repo never returns the raw token — only the user id the
 //! consumed token belonged to.
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use picloud_shared::{AppId, AppUserId};
 use sqlx::PgPool;
 #[derive(Debug, thiserror::Error)]
 pub enum AppUserVerificationRepoError {
    #[error("database error: {0}")]
    Db(#[from] sqlx::Error),
 }
 #[async_trait]
 pub trait AppUserVerificationRepo: Send + Sync {
    async fn create(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        token_hash: &str,
        expires_at: DateTime<Utc>,
    ) -> Result<(), AppUserVerificationRepoError>;
    /// Atomic consume. Returns `Some(user_id)` on success (rowcount = 1),
    /// `None` on missing / already-consumed / expired / wrong app.
    /// Scoped to `app_id` so a token issued for app A cannot be
    /// presented to app B.
    async fn consume(
        &self,
        app_id: AppId,
        token_hash: &str,
    ) -> Result<Option<AppUserId>, AppUserVerificationRepoError>;
    /// GC: drop consumed or expired rows, matching the dead-letter /
    /// session sweep pattern.
    async fn gc(&self, batch_size: i64) -> Result<u64, AppUserVerificationRepoError>;
 }
 pub struct PostgresAppUserVerificationRepo {
    pool: PgPool,
 }
 impl PostgresAppUserVerificationRepo {
    #[must_use]
    pub fn new(pool: PgPool) -> Self {
        Self { pool }
    }
 }
 #[async_trait]
 impl AppUserVerificationRepo for PostgresAppUserVerificationRepo {
    async fn create(
        &self,
        app_id: AppId,
        user_id: AppUserId,
        token_hash: &str,
        expires_at: DateTime<Utc>,
    ) -> Result<(), AppUserVerificationRepoError> {
        sqlx::query(
            "INSERT INTO app_user_email_verifications \
                 (token_hash, app_id, user_id, expires_at) \
             VALUES ($1, $2, $3, $4)",
        )
        .bind(token_hash)
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .bind(expires_at)
        .execute(&self.pool)
        .await?;
        Ok(())
    }
    async fn consume(
        &self,
        app_id: AppId,
        token_hash: &str,
    ) -> Result<Option<AppUserId>, AppUserVerificationRepoError> {
        let row: Option<(uuid::Uuid,)> = sqlx::query_as(
            "UPDATE app_user_email_verifications \
             SET consumed_at = NOW() \
             WHERE token_hash = $1 \
               AND app_id = $2 \
               AND consumed_at IS NULL \
               AND expires_at > NOW() \
             RETURNING user_id",
        )
        .bind(token_hash)
        .bind(app_id.into_inner())
        .fetch_optional(&self.pool)
        .await?;
        Ok(row.map(|(uid,)| uid.into()))
    }
    async fn gc(&self, batch_size: i64) -> Result<u64, AppUserVerificationRepoError> {
        let res = sqlx::query(
            "DELETE FROM app_user_email_verifications WHERE token_hash IN ( \
                 SELECT token_hash FROM app_user_email_verifications \
                 WHERE expires_at <= NOW() OR consumed_at IS NOT NULL \
                 LIMIT $1 \
                 FOR UPDATE SKIP LOCKED \
             )",
        )
        .bind(batch_size)
        .execute(&self.pool)
        .await?;
        Ok(res.rows_affected())
    }
 }
--- a/crates/manager-core/src/apply_api.rs
+++ b/crates/manager-core/src/apply_api.rs
@@ -1,173 +0,0 @@
 //! Admin HTTP surface for the declarative reconcile engine.
 //!
 //! `POST /api/v1/admin/apps/{id}/plan` — diff a desired-state bundle
 //! against the app's live state and return the plan. Read-only; requires
 //! `AppRead`. The `apply` route (write path) lands in the next milestone.
 use axum::{
    extract::{Path, State},
    http::StatusCode,
    response::{IntoResponse, Response},
    routing::post,
    Extension, Json, Router,
 };
 use picloud_shared::{AppId, Principal};
 use serde::Deserialize;
 use serde_json::json;
 use crate::app_repo::AppRepository;
 use crate::apply_service::{
    ApplyError, ApplyReport, ApplyService, Bundle, BundleTrigger, PlanResult,
 };
 use crate::authz::{require, AuthzDenied, Capability};
 /// Build the apply/plan router. Mounted under `/api/v1/admin`.
 pub fn apply_router(service: ApplyService) -> Router {
    Router::new()
        .route("/apps/{id}/plan", post(plan_handler))
        .route("/apps/{id}/apply", post(apply_handler))
        .with_state(service)
 }
 #[derive(Deserialize)]
 pub struct ApplyRequest {
    pub bundle: Bundle,
    #[serde(default)]
    pub prune: bool,
    /// Optional bound-plan token from a prior `plan`. When present, apply
    /// refuses (409) if the app's live state has changed since.
    #[serde(default)]
    pub expected_token: Option<String>,
 }
 async fn apply_handler(
    State(svc): State<ApplyService>,
    Extension(principal): Extension<Principal>,
    Path(id_or_slug): Path<String>,
    Json(req): Json<ApplyRequest>,
 ) -> Result<Json<ApplyReport>, ApplyError> {
    let app_id = resolve_app_id(svc.apps.as_ref(), &id_or_slug).await?;
    // Read is always needed; write caps are required for the resource kinds
    // the bundle touches — and for ALL kinds when `prune` is set, since
    // pruning deletes resources whose bundle section is empty (and a script
    // delete cascades its routes/triggers).
    require(svc.authz.as_ref(), &principal, Capability::AppRead(app_id))
        .await
        .map_err(map_authz)?;
    if req.prune || !req.bundle.scripts.is_empty() {
        require(
            svc.authz.as_ref(),
            &principal,
            Capability::AppWriteScript(app_id),
        )
        .await
        .map_err(map_authz)?;
    }
    if req.prune || !req.bundle.routes.is_empty() {
        require(
            svc.authz.as_ref(),
            &principal,
            Capability::AppWriteRoute(app_id),
        )
        .await
        .map_err(map_authz)?;
    }
    if req.prune || !req.bundle.triggers.is_empty() {
        require(
            svc.authz.as_ref(),
            &principal,
            Capability::AppManageTriggers(app_id),
        )
        .await
        .map_err(map_authz)?;
    }
    // Email triggers resolve and decrypt a stored secret by name server-side,
    // which the secrets API guards with `AppSecretsRead`. Require it here too
    // so apply can't bind a secret a principal couldn't otherwise read — the
    // caps aren't strictly nested on the API-key scope path.
    if req.bundle.triggers.iter().any(BundleTrigger::is_email) {
        require(
            svc.authz.as_ref(),
            &principal,
            Capability::AppSecretsRead(app_id),
        )
        .await
        .map_err(map_authz)?;
    }
    let report = svc
        .apply(
            app_id,
            &req.bundle,
            req.prune,
            principal.user_id,
            req.expected_token.as_deref(),
        )
        .await?;
    Ok(Json(report))
 }
 async fn plan_handler(
    State(svc): State<ApplyService>,
    Extension(principal): Extension<Principal>,
    Path(id_or_slug): Path<String>,
    Json(bundle): Json<Bundle>,
 ) -> Result<Json<PlanResult>, ApplyError> {
    let app_id = resolve_app_id(svc.apps.as_ref(), &id_or_slug).await?;
    // NOTE: the returned `Plan` discloses live secret NAMES (not values). That
    // is safe today only because `AppRead` and `AppSecretsRead` are co-granted
    // at every tier (same `script:read` scope, both in the viewer role). If a
    // future authz split puts `AppSecretsRead` on its own tier, this handler
    // must additionally require it — otherwise it leaks names a principal
    // couldn't enumerate via the secrets API.
    require(svc.authz.as_ref(), &principal, Capability::AppRead(app_id))
        .await
        .map_err(map_authz)?;
    let plan = svc.plan(app_id, &bundle).await?;
    Ok(Json(plan))
 }
 /// Resolve a slug-or-id path param to an `AppId`, mapping miss → 404.
 /// Mirrors the `triggers_api` helper of the same shape.
 async fn resolve_app_id(apps: &dyn AppRepository, ident: &str) -> Result<AppId, ApplyError> {
    crate::app_repo::resolve_app(apps, ident)
        .await
        .map_err(|e| ApplyError::Backend(e.to_string()))?
        .map(|l| l.app.id)
        .ok_or_else(|| ApplyError::AppNotFound(ident.to_string()))
 }
 fn map_authz(denied: AuthzDenied) -> ApplyError {
    match denied {
        AuthzDenied::Denied => ApplyError::Forbidden,
        AuthzDenied::Repo(e) => ApplyError::AuthzRepo(e.to_string()),
    }
 }
 impl IntoResponse for ApplyError {
    fn into_response(self) -> Response {
        let (status, body) = match &self {
            Self::AppNotFound(_) => (StatusCode::NOT_FOUND, json!({ "error": self.to_string() })),
            Self::Invalid(_) => (
                StatusCode::UNPROCESSABLE_ENTITY,
                json!({ "error": self.to_string() }),
            ),
            Self::StateMoved => (StatusCode::CONFLICT, json!({ "error": self.to_string() })),
            Self::Forbidden => (StatusCode::FORBIDDEN, json!({ "error": self.to_string() })),
            Self::AuthzRepo(e) => {
                tracing::error!(error = %e, "apply authz repo error");
                (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    json!({ "error": "internal error" }),
                )
            }
            Self::Backend(e) => {
                tracing::error!(error = %e, "apply backend error");
                (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    json!({ "error": "internal error" }),
                )
            }
        };
        (status, Json(body)).into_response()
    }
 }
--- a/crates/manager-core/src/apply_service.rs
+++ b/crates/manager-core/src/apply_service.rs
--- a/crates/manager-core/src/apps_api.rs
+++ b/crates/manager-core/src/apps_api.rs
@@ -25,7 +25,6 @@ use uuid::Uuid;
 use crate::app_domain_repo::{AppDomainRepository, NewAppDomain};
 use crate::app_repo::AppRepository;
 use crate::authz::{require, AuthzDenied, AuthzError, AuthzRepo, Capability};
 use crate::group_repo::{GroupRepository, ROOT_GROUP_SLUG};
 use crate::repo::ScriptRepositoryError;
 use crate::route_repo::RouteRepository;
@@ -45,9 +44,6 @@ pub struct AppsState {
    pub domain_table: Arc<AppDomainTable>,
    /// Capability gate — Phase 3.5.
    pub authz: Arc<dyn AuthzRepo>,
    /// Group tree — resolves an app's parent group at create time
    /// (defaults to the instance root).
    pub groups: Arc<dyn GroupRepository>,
 }
 pub fn apps_router(state: AppsState) -> Router {
@@ -84,10 +80,6 @@ pub struct CreateAppRequest {
    pub slug: String,
    pub name: String,
    pub description: Option<String>,
    /// Parent group (slug or id). Defaults to the instance root group when
    /// omitted — every app has a parent from day one (§9).
    #[serde(default)]
    pub group: Option<String>,
    /// Set to `true` to consume an existing `app_slug_history` row for
    /// the requested slug (breaking old redirects).
    #[serde(default)]
@@ -184,46 +176,23 @@ async fn create_app(
    require(s.authz.as_ref(), &principal, Capability::InstanceCreateApp).await?;
    validate_slug(&input.slug)?;
    // Resolve the parent group: an explicit `group` (slug or id) or the
    // instance root by default. Placing an app under a specific group
    // additionally requires group-write there.
    let parent = resolve_group(&*s.groups, input.group.as_deref()).await?;
    if input.group.is_some() {
        require(
            s.authz.as_ref(),
            &principal,
            Capability::GroupWrite(parent.id),
        )
        .await?;
    }
    // Historical-slug check before insert: if the slug is in history
    // and the caller hasn't asked to force takeover, surface a clean
    // 409 so the dashboard can present a "this will break old links"
    // confirmation.
    if !input.force_takeover {
        if let Some(current) = s.apps.slug_in_history(&input.slug).await? {
-            return Err(AppsApiError::SlugInHistory(Box::new(current)));
+            return Err(AppsApiError::SlugInHistory(current));
        }
    }
    let created = if input.force_takeover {
        s.apps
-            .create_with_takeover(
+            .create_with_takeover(&input.slug, &input.name, input.description.as_deref())
                &input.slug,
                &input.name,
                input.description.as_deref(),
                parent.id,
            )
            .await?
    } else {
        s.apps
-            .create(
+            .create(&input.slug, &input.name, input.description.as_deref())
                &input.slug,
                &input.name,
                input.description.as_deref(),
                parent.id,
            )
            .await?
    };
    Ok((StatusCode::CREATED, Json(created)))
@@ -266,31 +235,7 @@ async fn compute_my_role(
 ) -> Result<Option<AppRole>, AppsApiError> {
    match principal.instance_role {
        InstanceRole::Owner | InstanceRole::Admin => Ok(Some(AppRole::AppAdmin)),
-        // Effective role: folds in inherited group memberships so the
+        InstanceRole::Member => Ok(authz.membership(principal.user_id, app_id).await?),
        // dashboard badge reflects what the caller can actually do.
        InstanceRole::Member => Ok(authz.effective_app_role(principal.user_id, app_id).await?),
    }
 }
 /// Resolve an optional group identifier (slug or UUID) to a group,
 /// defaulting to the instance root group when `None`.
 async fn resolve_group(
    groups: &dyn GroupRepository,
    ident: Option<&str>,
 ) -> Result<picloud_shared::Group, AppsApiError> {
    match ident {
        None => groups
            .get_by_slug(ROOT_GROUP_SLUG)
            .await?
            .ok_or_else(|| AppsApiError::GroupNotFound(ROOT_GROUP_SLUG.to_string())),
        Some(ident) => {
            let found = if let Ok(uuid) = ident.parse::<Uuid>() {
                groups.get_by_id(uuid.into()).await?
            } else {
                groups.get_by_slug(ident).await?
            };
            found.ok_or_else(|| AppsApiError::GroupNotFound(ident.to_string()))
        }
    }
 }
@@ -334,7 +279,7 @@ async fn patch_app(
            Ok(app) => app,
            Err(ScriptRepositoryError::Conflict(msg)) if msg.contains("history") => {
                if let Some(current) = s.apps.slug_in_history(new_slug).await? {
-                    return Err(AppsApiError::SlugInHistory(Box::new(current)));
+                    return Err(AppsApiError::SlugInHistory(current));
                }
                return Err(AppsApiError::Conflict(msg));
            }
@@ -576,19 +521,14 @@ pub enum AppsApiError {
    #[error("app not found: {0}")]
    AppNotFound(String),
    #[error("group not found: {0}")]
    GroupNotFound(String),
    #[error("domain not found: {0}")]
    DomainNotFound(Uuid),
    #[error("invalid slug: {0}")]
    InvalidSlug(String),
    // Boxed: `App` is large enough to trip clippy::result_large_err on
    // every handler returning `Result<_, AppsApiError>`.
    #[error("slug {0:?} is in history; will break old redirects — pass force_takeover")]
-    SlugInHistory(Box<App>),
+    SlugInHistory(App),
    #[error("app still contains {0} script(s); delete or move them first")]
    HasScripts(i64),
@@ -627,22 +567,10 @@ impl From<AuthzError> for AppsApiError {
    }
 }
 impl From<crate::group_repo::GroupRepositoryError> for AppsApiError {
    fn from(e: crate::group_repo::GroupRepositoryError) -> Self {
        use crate::group_repo::GroupRepositoryError as G;
        match e {
            G::NotFound(id) => Self::GroupNotFound(id.to_string()),
            G::Conflict(msg) => Self::Conflict(msg),
            G::Db(e) => Self::Repo(ScriptRepositoryError::Db(e)),
        }
    }
 }
 impl IntoResponse for AppsApiError {
    fn into_response(self) -> Response {
        let (status, body) = match &self {
            Self::AppNotFound(_)
            | Self::GroupNotFound(_)
            | Self::DomainNotFound(_)
            | Self::Repo(ScriptRepositoryError::NotFound(_)) => {
                (StatusCode::NOT_FOUND, json!({ "error": self.to_string() }))
--- a/crates/manager-core/src/auth.rs
+++ b/crates/manager-core/src/auth.rs
@@ -25,16 +25,6 @@ use sha2::{Digest, Sha256};
 #[error("invalid Argon2id PHC hash")]
 pub struct InvalidPasswordHash;
 /// Real Argon2id PHC string used by the timing-flat login path: on a
 /// bad-email lookup the login routine still runs `verify_password`
 /// against this hash so the wall-clock cost matches the good-email
 /// branch. The plaintext that produced this hash is irrelevant —
 /// `verify_password` will return false for any input the caller could
 /// realistically present, and the surrounding code drops the result.
 /// Reusing the existing admin-auth login pattern from `auth_api.rs`.
 pub const TIMING_FLAT_DUMMY_HASH: &str =
    "$argon2id$v=19$m=19456,t=2,p=1$dGltaW5nLWZsYXR0ZW4$Ux6dgPqgX1Mhg5fRgIeKZF3MWdYqJplKEz/cKLcSdks";
 /// Hash a raw password into an Argon2id PHC-formatted string suitable
 /// for `admin_users.password_hash`. The output already encodes the salt
 /// and parameters; nothing else needs to be persisted alongside it.
--- a/crates/manager-core/src/auth_api.rs
+++ b/crates/manager-core/src/auth_api.rs
@@ -1,14 +1,10 @@
 //! `/api/v1/admin/auth/*` — login, logout, who-am-I.
 //!
-//! Login mints an opaque session token, stores its SHA-256, and returns
+//! Login mints an opaque session token, stores its SHA-256, sets the
-//! the raw token in the JSON body. Clients must send it as
+//! `picloud_session` HttpOnly cookie, and also returns the raw token in
-//! `Authorization: Bearer …` on subsequent requests; the same token is
+//! the JSON body for non-browser clients. The same token works as
-//! used for the session and admin-API authentication paths (there is no
+//! `Authorization: Bearer …` afterward; there is no separate "API
-//! separate "API token" concept yet).
+//! token" concept yet.
 //!
 //! Cookie auth was removed in the audit 2026-06-11 C-1 fix — same-origin
 //! user-route HTML defeated the previous `SameSite=Lax` cookie. The
 //! dashboard already uses Bearer; non-browser clients always have.
 //!
 //! Logout deletes the session row regardless of whether the supplied
 //! token matched anything (idempotent). `me` returns the row that the
@@ -29,8 +25,7 @@ use serde_json::json;
 use picloud_shared::Principal;
 use crate::auth::{generate_session_token, hash_token, verify_password};
-use crate::auth_middleware::{require_authenticated, AuthState};
+use crate::auth_middleware::{require_authenticated, AuthState, SESSION_COOKIE};
 use crate::login_rate_limit::LoginRateOutcome;
 pub fn auth_router(state: AuthState) -> Router {
    // /login + /logout are unguarded (login is how you get in; logout
@@ -76,28 +71,12 @@ pub struct AdminUserDto {
 // Handlers
 // ----------------------------------------------------------------------------
-async fn login(
+async fn login(State(state): State<AuthState>, Json(input): Json<LoginRequest>) -> Response {
    State(state): State<AuthState>,
    headers: HeaderMap,
    Json(input): Json<LoginRequest>,
 ) -> Response {
    // Audit 2026-06-11 H-B1 — rate limit BEFORE any DB read or
    // Argon2 verify so an attacker can't even queue. Keying is
    // (real client IP, username) + (username), so a single hot user and
    // a credential-stuffing flurry both saturate. The IP is the last
    // X-Forwarded-For hop (Caddy-appended); see `extract_remote_ip`.
    let remote_ip = extract_remote_ip(&headers);
    if let LoginRateOutcome::Denied { retry_after } = state
        .login_rate_limiter
        .try_consume(&remote_ip, &input.username)
    {
        return rate_limited(retry_after);
    }
    // Always perform a verify, even on missing/inactive users, to flatten
-    // timing and prevent username enumeration. The dummy hash is the
+    // timing and prevent username enumeration. The dummy hash is a real
-    // shared `TIMING_FLAT_DUMMY_HASH` constant from `auth.rs` so the
+    // Argon2id PHC string for "x" — the verify will simply fail.
-    // single PHC value lives in exactly one place (v1.1.9 F4 dedup).
+    const DUMMY_HASH: &str = "$argon2id$v=19$m=19456,t=2,p=1$dGltaW5nLWZsYXR0ZW4$Ux6dgPqgX1Mhg5fRgIeKZF3MWdYqJplKEz/cKLcSdks";
    let creds = match state
        .users
        .get_credentials_by_username(&input.username)
@@ -114,30 +93,10 @@ async fn login(
    // canonical row used in the response DTO.
    let (stored_hash, user_id, is_active) = match creds {
        Some(c) => (c.password_hash, Some(c.id), c.is_active),
-        None => (crate::auth::TIMING_FLAT_DUMMY_HASH.to_string(), None, false),
+        None => (DUMMY_HASH.to_string(), None, false),
    };
-    // Audit 2026-06-11 H-B1 — global Argon2 concurrency cap. Acquired
+    let password_ok = verify_password(&stored_hash, &input.password);
    // AFTER the bucket check so attackers can't queue; held only across
    // the verify, not the surrounding DB I/O. acquire() awaits, but the
    // bucket already gated so the queue is bounded.
    let Ok(permit) = state.argon2_login_semaphore.clone().acquire_owned().await else {
        // Semaphore is closed (process shutting down). Fail closed.
        return internal_error();
    };
    // F-P-002: Argon2id verify off the async worker.
    let password = input.password.clone();
    let password_ok =
        match tokio::task::spawn_blocking(move || verify_password(&stored_hash, &password)).await {
            Ok(b) => b,
            Err(err) => {
                tracing::error!(?err, "verify_password spawn_blocking join failed");
                drop(permit);
                return internal_error();
            }
        };
    drop(permit);
    if !password_ok || user_id.is_none() || !is_active {
        return invalid_credentials();
    }
@@ -172,8 +131,19 @@ async fn login(
        tracing::warn!(?err, "failed to touch admin last_login_at");
    }
    let mut headers = HeaderMap::new();
    headers.insert(
        header::SET_COOKIE,
        HeaderValue::from_str(&build_cookie(&token.raw, state.ttl)).unwrap_or_else(|_| {
            // Cookie text is ASCII-clean by construction; this branch is
            // unreachable in practice but the type signature requires it.
            HeaderValue::from_static("")
        }),
    );
    (
        StatusCode::OK,
        headers,
        Json(LoginResponse {
            user: AdminUserDto {
                id: user_row.id,
@@ -189,20 +159,23 @@ async fn login(
 }
 async fn logout(State(state): State<AuthState>, req: Request<Body>) -> Response {
-    // Pull token without requiring a valid session (logout is idempotent).
+    // Pull token without requiring a valid session (logout is idempotent
    // and we still want to clear the cookie on the client side).
    let token = extract_token_for_logout(&req);
    if let Some(raw) = token {
        let hash = hash_token(&raw);
        if let Err(err) = state.sessions.delete(&hash).await {
            tracing::error!(?err, "admin_sessions delete failed");
            // Still clear the cookie below.
        }
        // Audit 2026-06-11 (PrincipalCache revocation-lag) — drop just
        // this token from the cache so the logged-out session can't keep
        // authenticating for the cache TTL. Other sessions for the same
        // user are left untouched.
        state.principal_cache.evict_token(&hash);
    }
-    StatusCode::NO_CONTENT.into_response()
+
    let mut headers = HeaderMap::new();
    headers.insert(
        header::SET_COOKIE,
        HeaderValue::from_static("picloud_session=; HttpOnly; Path=/; SameSite=Lax; Max-Age=0"),
    );
    (StatusCode::NO_CONTENT, headers).into_response()
 }
 async fn me(
@@ -232,67 +205,51 @@ async fn me(
 // Helpers
 // ----------------------------------------------------------------------------
-fn extract_token_for_logout(req: &Request<Body>) -> Option<String> {
+fn build_cookie(raw_token: &str, ttl: std::time::Duration) -> String {
-    // Duplicated from auth_middleware::extract_token because logout runs
+    // Secure is on by default; flip to off for HTTP-only dev with
-    // before the auth middleware (logout is idempotent and must accept
+    // PICLOUD_COOKIE_SECURE=0. The header-injected bearer token works
-    // already-expired tokens). Cookie auth was dropped in the audit
+    // either way, so this is purely for browsers that prefer the cookie
-    // 2026-06-11 C-1 fix — Bearer only.
+    // path (e.g., direct API hits without the dashboard's auth.ts).
-    let value = req.headers().get(header::AUTHORIZATION)?;
+    let secure = std::env::var("PICLOUD_COOKIE_SECURE").ok().is_none_or(|v| {
-    let s = value.to_str().ok()?;
+        !matches!(
-    let token = s.strip_prefix("Bearer ")?.trim();
+            v.to_ascii_lowercase().as_str(),
-    if token.is_empty() {
+            "0" | "false" | "no" | "off"
-        return None;
+        )
-    }
+    });
-    Some(token.to_string())
+    let secure_attr = if secure { "; Secure" } else { "" };
    format!(
        "{SESSION_COOKIE}={raw_token}; HttpOnly{secure_attr}; SameSite=Lax; Path=/; Max-Age={}",
        ttl.as_secs()
    )
 }
-/// Pull the originating client IP from the request for rate-limiting.
+fn extract_token_for_logout(req: &Request<Body>) -> Option<String> {
-///
+    // Same precedence as the middleware — Authorization first, cookie
-/// Audit 2026-06-11 (H-B1 follow-up) — Caddy is the single trusted
+    // fallback. Duplicated here because logout has to read the request
-/// proxy in front of picloud and *appends* the immediate peer to
+    // before any middleware would run.
-/// `X-Forwarded-For`, so the **last** entry is the address Caddy
+    if let Some(value) = req.headers().get(header::AUTHORIZATION) {
-/// actually saw. Every earlier entry is client-supplied: an attacker
+        if let Ok(s) = value.to_str() {
-/// can send `X-Forwarded-For: <random>` and Caddy forwards
+            if let Some(token) = s.strip_prefix("Bearer ") {
-/// `<random>, <real-client>`. Taking the first entry (the previous
+                let trimmed = token.trim();
 /// behavior) therefore let an attacker rotate the per-IP bucket key on
 /// every request and evade the per-IP limit. Take the last entry so the
 /// qualifier reflects the real client. Returns `"unknown"` when the
 /// header is absent/malformed so the per-username bucket still gates.
 ///
 /// (This assumes exactly one trusted proxy hop, which is the documented
 /// single-node topology. A multi-proxy deployment would need a
 /// configured trusted-hop count; tracked for the cluster work.)
 fn extract_remote_ip(headers: &HeaderMap) -> String {
    if let Some(xff) = headers.get("x-forwarded-for") {
        if let Ok(s) = xff.to_str() {
            if let Some(last) = s.split(',').next_back() {
                let trimmed = last.trim();
                if !trimmed.is_empty() {
-                    return trimmed.to_string();
+                    return Some(trimmed.to_string());
                }
            }
        }
    }
-    "unknown".to_string()
+    if let Some(value) = req.headers().get(header::COOKIE) {
-}
+        if let Ok(s) = value.to_str() {
-
+            for chunk in s.split(';') {
-fn rate_limited(retry_after: std::time::Duration) -> Response {
+                let chunk = chunk.trim();
-    let mut secs = retry_after.as_secs();
+                if let Some(rest) = chunk.strip_prefix(&format!("{SESSION_COOKIE}=")) {
-    if secs == 0 {
+                    if !rest.is_empty() {
-        secs = 1;
+                        return Some(rest.to_string());
                    }
                }
            }
        }
    }
-    let mut hdrs = HeaderMap::new();
+    None
    if let Ok(v) = HeaderValue::from_str(&secs.to_string()) {
        hdrs.insert("retry-after", v);
    }
    (
        StatusCode::TOO_MANY_REQUESTS,
        hdrs,
        Json(json!({
            "error": "too many login attempts; try again later",
        })),
    )
        .into_response()
 }
 fn invalid_credentials() -> Response {
@@ -310,42 +267,3 @@ fn internal_error() -> Response {
    )
        .into_response()
 }
 #[cfg(test)]
 mod tests {
    use super::extract_remote_ip;
    use axum::http::{HeaderMap, HeaderValue};
    fn xff(value: &str) -> HeaderMap {
        let mut h = HeaderMap::new();
        h.insert("x-forwarded-for", HeaderValue::from_str(value).unwrap());
        h
    }
    #[test]
    fn takes_last_xff_entry_caddy_appended_peer() {
        // Audit 2026-06-11 (H-B1 follow-up) — the real client is the
        // last hop Caddy appended; earlier entries are client-spoofable.
        assert_eq!(extract_remote_ip(&xff("203.0.113.9")), "203.0.113.9");
        assert_eq!(
            extract_remote_ip(&xff("9.9.9.9, 203.0.113.9")),
            "203.0.113.9"
        );
    }
    #[test]
    fn spoofed_leading_entry_does_not_change_the_key() {
        // Attacker prepends junk; Caddy still appends the real peer last,
        // so the rate-limit key is stable regardless of the spoof.
        let a = extract_remote_ip(&xff("evil-1, 203.0.113.9"));
        let b = extract_remote_ip(&xff("evil-2, 203.0.113.9"));
        assert_eq!(a, b);
        assert_eq!(a, "203.0.113.9");
    }
    #[test]
    fn missing_or_empty_header_is_unknown() {
        assert_eq!(extract_remote_ip(&HeaderMap::new()), "unknown");
        assert_eq!(extract_remote_ip(&xff("   ")), "unknown");
    }
 }
--- a/crates/manager-core/src/auth_middleware.rs
+++ b/crates/manager-core/src/auth_middleware.rs
@@ -1,7 +1,7 @@
 //! Authentication middleware — resolves the caller's `Principal` from
-//! a Bearer session-token OR an API key (`Authorization: Bearer pic_…`).
+//! either a session cookie / Bearer session-token OR an API key
-//! Both paths converge on the same request extension so downstream
+//! (`Authorization: Bearer pic_…`). Both paths converge on the same
-//! handlers see one shape.
+//! request extension so downstream handlers see one shape.
 //!
 //! Capability checks live in `crate::authz` and are called per-handler
 //! (after the relevant resource is loaded, so the capability binds to
@@ -10,18 +10,11 @@
 //!
 //! Token discriminator: the `pic_` prefix on a Bearer value selects
 //! the API-key path; anything else (raw 32-byte base64-url-encoded
-//! string) takes the session path.
+//! string) takes the session path. The session cookie can only ever
-//!
+//! carry a session token (cookies are never API keys).
 //! Audit 2026-06-11 (C-1): cookie auth removed. The platform co-hosts
 //! attacker-controlled user-route HTML on the same origin as the admin
 //! API; `SameSite=Lax` did not block same-origin POSTs from a malicious
 //! script under `/<route>`. Admin clients must send
 //! `Authorization: Bearer <session_token>` (the dashboard already does;
 //! see `dashboard/src/lib/api.ts`).
-use std::collections::HashMap;
+use std::sync::Arc;
-use std::sync::{Arc, Mutex};
+use std::time::Duration;
 use std::time::{Duration, Instant};
 use axum::body::Body;
 use axum::extract::{Request, State};
@@ -37,88 +30,7 @@ use crate::admin_user_repo::AdminUserRepository;
 use crate::api_key_repo::{ApiKeyRepository, ApiKeyVerification};
 use crate::auth::{hash_token, verify_password};
-/// F-P-009: short-lived cache of resolved `(token → principal)` pairs.
+pub const SESSION_COOKIE: &str = "picloud_session";
 /// Two reasons it's load-bearing:
 /// 1. `verify_api_key` Argon2-verifies *every* candidate sharing the
 ///    8-char prefix per request — caching cuts that to once per token
 ///    per TTL window.
 /// 2. `attach_principal_if_present` runs on every data-plane request
 ///    including paths that may not even need authz; even the session
 ///    path costs three round-trips (lookup + user-get + touch).
 ///
 /// Keyed on the hashed token (sha256 in `hash_token`); value is the
 /// resolved Principal + the instant it landed in the cache. TTL is
 /// short — the audit cited 60-300s.
 #[derive(Debug, Default)]
 pub struct PrincipalCache {
    inner: Mutex<HashMap<String, (Instant, Principal)>>,
 }
 /// TTL on cached principals. Short enough that role / scope changes
 /// take effect quickly; long enough to amortize Argon2 over many
 /// adjacent requests on a hot key.
 const PRINCIPAL_CACHE_TTL: Duration = Duration::from_secs(60);
 /// F-S-006: maximum candidate API keys we'll Argon2-verify per
 /// request. Hoisted to module scope so clippy::items_after_statements
 /// is happy.
 const MAX_API_KEY_CANDIDATES: usize = 16;
 impl PrincipalCache {
    #[must_use]
    pub fn new() -> Self {
        Self::default()
    }
    fn get(&self, token_hash: &str) -> Option<Principal> {
        let mut guard = self.inner.lock().ok()?;
        let entry = guard.get(token_hash)?;
        if entry.0.elapsed() > PRINCIPAL_CACHE_TTL {
            guard.remove(token_hash);
            return None;
        }
        Some(entry.1.clone())
    }
    fn insert(&self, token_hash: String, principal: Principal) {
        let Ok(mut guard) = self.inner.lock() else {
            return;
        };
        // Lazy GC: cap unbounded growth by sweeping expired entries
        // when the cache crosses an arbitrary threshold.
        if guard.len() > 1024 {
            let now = Instant::now();
            guard.retain(|_, v| now.duration_since(v.0) <= PRINCIPAL_CACHE_TTL);
        }
        guard.insert(token_hash, (Instant::now(), principal));
    }
    /// Evict every cached principal belonging to `user_id`.
    ///
    /// Audit 2026-06-11 (PrincipalCache revocation-lag, Medium) — the
    /// revocation paths (`set_active(false)`, password change,
    /// API-key delete) flip the backing DB rows, but a cached principal
    /// keeps authenticating for up to [`PRINCIPAL_CACHE_TTL`] unless it
    /// is evicted. Callers invoke this right after the DB mutation so a
    /// just-revoked credential stops working on the next request. The
    /// cache value carries the resolved [`Principal`], so we can target
    /// the user without knowing which token hashes belong to them.
    pub fn evict_user(&self, user_id: AdminUserId) {
        let Ok(mut guard) = self.inner.lock() else {
            return;
        };
        guard.retain(|_, (_, p)| p.user_id != user_id);
    }
    /// Evict a single cached entry by its token hash. Used on logout,
    /// where exactly one session token is being invalidated and we
    /// don't want to disturb the user's other live sessions.
    pub fn evict_token(&self, token_hash: &str) {
        if let Ok(mut guard) = self.inner.lock() {
            guard.remove(token_hash);
        }
    }
 }
 /// Prefix on the wire that selects the API-key path. The body that
 /// follows is `base32(32 random bytes)`; the first 8 chars of the body
@@ -137,18 +49,6 @@ pub struct AuthState {
    pub sessions: Arc<dyn AdminSessionRepository>,
    pub keys: Arc<dyn ApiKeyRepository>,
    pub ttl: Duration,
    /// F-P-009 — shared cache of resolved Principals. Constructed once
    /// at startup and cloned (same `Arc`) into every router state that
    /// resolves or revokes credentials, so a revocation-side eviction is
    /// visible to this resolve-side lookup.
    pub principal_cache: Arc<PrincipalCache>,
    /// Audit 2026-06-11 H-B1 — per-`(remote_ip, username)` + per-`username`
    /// burst limiter for `/auth/login`. Cheap to clone (Arc).
    pub login_rate_limiter: Arc<crate::login_rate_limit::LoginRateLimiter>,
    /// Audit 2026-06-11 H-B1 — caps concurrent Argon2 verifies during
    /// login so a credential-stuffing flurry can't park every blocking
    /// worker. Sized via `PICLOUD_LOGIN_ARGON2_PARALLELISM` (default 2).
    pub argon2_login_semaphore: Arc<tokio::sync::Semaphore>,
 }
 /// Legacy request-extension alias retained so the (only remaining)
@@ -237,21 +137,10 @@ async fn resolve_principal(
    state: &AuthState,
    token: &str,
 ) -> Result<Option<Principal>, InternalError> {
-    // F-P-009: cache hit short-circuits Argon2 + 3 DB round-trips.
+    if let Some(rest) = token.strip_prefix(API_KEY_PREFIX) {
-    // Keyed on the hashed token so we never store raw bearer values.
+        return verify_api_key(state, rest).await;
    let token_hash = hash_token(token);
    if let Some(p) = state.principal_cache.get(&token_hash) {
        return Ok(Some(p));
    }
-    let resolved = if let Some(rest) = token.strip_prefix(API_KEY_PREFIX) {
+    verify_session(state, token).await
        verify_api_key(state, rest).await?
    } else {
        verify_session(state, token).await?
    };
    if let Some(p) = &resolved {
        state.principal_cache.insert(token_hash, p.clone());
    }
    Ok(resolved)
 }
 async fn verify_session(
@@ -306,7 +195,7 @@ async fn verify_api_key(state: &AuthState, rest: &str) -> Result<Option<Principa
    }
    let prefix = &rest[..API_KEY_PREFIX_LEN];
-    let mut candidates = match state.keys.find_active_by_prefix(prefix).await {
+    let candidates = match state.keys.find_active_by_prefix(prefix).await {
        Ok(v) => v,
        Err(err) => {
            tracing::error!(?err, "api_keys lookup failed");
@@ -314,36 +203,9 @@ async fn verify_api_key(state: &AuthState, rest: &str) -> Result<Option<Principa
        }
    };
-    // F-S-006: bound the candidate set. Prefix collisions are
+    let matched: Option<ApiKeyVerification> = candidates
-    // statistically rare for a 32-byte random body, but the 8-char
+        .into_iter()
-    // index space is small enough that an attacker who provisions
+        .find(|c| verify_password(&c.hash, rest));
    // many keys against one indexed prefix could amplify each public
    // bearer-tagged request into M×Argon2 verifies. Cap at MAX and
    // log the truncation so operators can spot it.
    if candidates.len() > MAX_API_KEY_CANDIDATES {
        tracing::warn!(
            prefix,
            total = candidates.len(),
            kept = MAX_API_KEY_CANDIDATES,
            "api_keys prefix-bucket overflow; truncating candidate verify set"
        );
        candidates.truncate(MAX_API_KEY_CANDIDATES);
    }
    // F-P-002: Argon2id verify is CPU-bound (~tens of ms each at OWASP
    // defaults). Move it off the Tokio async worker so a hot user with
    // N prefix-colliding keys doesn't park the worker for N×Argon2.
    let rest_owned = rest.to_string();
    let matched: Option<ApiKeyVerification> = tokio::task::spawn_blocking(move || {
        candidates
            .into_iter()
            .find(|c| verify_password(&c.hash, &rest_owned))
    })
    .await
    .map_err(|e| {
        tracing::error!(error = ?e, "verify_api_key spawn_blocking join failed");
        InternalError
    })?;
    let Some(matched) = matched else {
        return Ok(None);
    };
@@ -393,17 +255,34 @@ async fn username_for(state: &AuthState, id: AdminUserId) -> Option<String> {
    }
 }
-/// Pull the bearer token out of an `Authorization` header. Cookie auth
+/// Pull the bearer token out of an `Authorization` header (preferred)
-/// was removed in the audit 2026-06-11 C-1 fix; same-origin user-route
+/// or the `picloud_session` cookie (fallback for browser clients).
-/// HTML made `SameSite=Lax` insufficient against CSRF.
+/// Same shape as Phase 3a; the cookie only ever carries session
 /// tokens — no `pic_` prefix expected there.
 fn extract_token(req: &Request<Body>) -> Option<String> {
-    let value = req.headers().get(header::AUTHORIZATION)?;
+    if let Some(value) = req.headers().get(header::AUTHORIZATION) {
-    let s = value.to_str().ok()?;
+        if let Ok(s) = value.to_str() {
-    let token = s.strip_prefix("Bearer ")?.trim();
+            if let Some(token) = s.strip_prefix("Bearer ") {
-    if token.is_empty() {
+                let trimmed = token.trim();
-        return None;
+                if !trimmed.is_empty() {
                    return Some(trimmed.to_string());
                }
            }
        }
    }
-    Some(token.to_string())
+    if let Some(value) = req.headers().get(header::COOKIE) {
        if let Ok(s) = value.to_str() {
            for chunk in s.split(';') {
                let chunk = chunk.trim();
                if let Some(rest) = chunk.strip_prefix(&format!("{SESSION_COOKIE}=")) {
                    if !rest.is_empty() {
                        return Some(rest.to_string());
                    }
                }
            }
        }
    }
    None
 }
 /// Sentinel returned from the resolve functions when a DB error should
@@ -459,16 +338,13 @@ mod tests {
    }
    #[test]
-    fn cookie_alone_is_rejected_post_audit_2026_06_11() {
+    fn extracts_cookie_token() {
        // C-1 closure: `picloud_session` cookie is no longer accepted as
        // an auth fallback; a same-origin malicious script could ride the
        // cookie via SameSite=Lax POST. Bearer-only.
        let r = req_with_header("cookie", "foo=bar; picloud_session=xyz; baz=qux");
-        assert_eq!(extract_token(&r), None);
+        assert_eq!(extract_token(&r).as_deref(), Some("xyz"));
    }
    #[test]
-    fn bearer_wins_when_both_present() {
+    fn bearer_wins_over_cookie() {
        let r = Request::builder()
            .header("authorization", "Bearer header-token")
            .header("cookie", "picloud_session=cookie-token")
@@ -478,7 +354,7 @@ mod tests {
    }
    #[test]
-    fn returns_none_when_no_authorization_header() {
+    fn returns_none_when_neither_present() {
        let r = Request::builder().body(Body::empty()).unwrap();
        assert_eq!(extract_token(&r), None);
    }
@@ -498,46 +374,4 @@ mod tests {
        assert!(p.scopes.is_none());
        assert!(p.app_binding.is_none());
    }
    fn principal_for(user_id: AdminUserId) -> Principal {
        Principal {
            user_id,
            instance_role: InstanceRole::Owner,
            scopes: None,
            app_binding: None,
        }
    }
    #[test]
    fn evict_user_drops_only_that_users_entries() {
        // Audit 2026-06-11 (PrincipalCache revocation-lag).
        let cache = PrincipalCache::new();
        let alice = AdminUserId::new();
        let bob = AdminUserId::new();
        cache.insert("hash-alice-1".into(), principal_for(alice));
        cache.insert("hash-alice-2".into(), principal_for(alice));
        cache.insert("hash-bob-1".into(), principal_for(bob));
        cache.evict_user(alice);
        assert!(cache.get("hash-alice-1").is_none());
        assert!(cache.get("hash-alice-2").is_none());
        // Bob is untouched.
        assert!(cache.get("hash-bob-1").is_some());
    }
    #[test]
    fn evict_token_drops_only_that_entry() {
        let cache = PrincipalCache::new();
        let alice = AdminUserId::new();
        cache.insert("hash-1".into(), principal_for(alice));
        cache.insert("hash-2".into(), principal_for(alice));
        cache.evict_token("hash-1");
        // Logout drops exactly one session; the user's other live
        // session stays cached.
        assert!(cache.get("hash-1").is_none());
        assert!(cache.get("hash-2").is_some());
    }
 }
--- a/crates/manager-core/src/authz.rs
+++ b/crates/manager-core/src/authz.rs
@@ -27,7 +27,7 @@
 //! external user-facing label.
 use async_trait::async_trait;
-use picloud_shared::{AppId, AppRole, GroupId, InstanceRole, Principal, Scope, UserId};
+use picloud_shared::{AppId, AppRole, InstanceRole, Principal, Scope, UserId};
 /// Things a caller can attempt to do. Each app-scoped variant carries
 /// the `AppId` of the resource the action targets — handlers compute
@@ -37,19 +37,6 @@ use picloud_shared::{AppId, AppRole, GroupId, InstanceRole, Principal, Scope, Us
 pub enum Capability {
    /// Create a new app. Owner / admin only.
    InstanceCreateApp,
    /// Create a new group (root-level). Owner / admin only — a Member
    /// creates subgroups under a group they group-admin (gated by
    /// `GroupAdmin(parent)` at the handler), not via this instance cap.
    InstanceCreateGroup,
    /// Read group metadata + list its subgroups/apps. Viewer+ on the
    /// group (inherited from any ancestor); implicit for admin / owner.
    GroupRead(GroupId),
    /// Rename / edit group metadata, move apps into it. Editor+ on the
    /// group.
    GroupWrite(GroupId),
    /// Group settings: delete, reparent, manage group members. group_admin
    /// on the group (inherited from any ancestor).
    GroupAdmin(GroupId),
    /// Create / update / delete admin_users rows (other than self
    /// password change, which is a separate flow). Owner / admin.
    InstanceManageUsers,
@@ -102,12 +89,6 @@ pub enum Capability {
    /// (v1.1.5). Maps to `script:write` on API keys (a publish is a
    /// write that fans out to subscribers). Granted to `editor`+.
    AppPubsubPublish(AppId),
    /// Enqueue a message onto this app's queue from a script (v1.1.9).
    /// Maps to `script:write` on API keys (an enqueue is a write that
    /// fans out to the registered consumer). Granted to `editor`+.
    /// `depth` / `depth_pending` are read-only inspection and don't gate
    /// — scripts in the app can always see their own queue depths.
    AppQueueEnqueue(AppId),
    /// Read a decrypted secret from this app's secrets store (v1.1.7).
    /// Same trust shape as KV/docs/files read — granted to `viewer`+,
    /// maps to `script:read` on API keys. Honors the seven-scope
@@ -134,31 +115,6 @@ pub enum Capability {
    /// weight (it opens an internal pub/sub topic to outside SSE
    /// subscribers). Granted to `app_admin`+.
    AppTopicManage(AppId),
    /// Read app-user records (v1.1.8 `users::*`) — `get`,
    /// `find_by_email`, `list`, `verify`, `has_role`. Same trust shape
    /// as KV/docs/files read — granted to `viewer`+, maps to
    /// `script:read` on API keys. Honors the seven-scope commitment.
    AppUsersRead(AppId),
    /// Write app-user records (v1.1.8 `users::*`) — `create`, `update`,
    /// `delete`, role mutations, login/logout, password reset, email
    /// verification, invitation acceptance. Granted to `editor`+, maps
    /// to `script:write` on API keys.
    AppUsersWrite(AppId),
    /// Admin-tier app-user actions (v1.1.8) — issuing invitations,
    /// admin-mediated reset-password / revoke-sessions HTTP endpoints.
    /// Maps to `script:write` on API keys (no new scope per the
    /// seven-scope commitment); the additional gate vs `Write` lives in
    /// the per-app role chain (`app_admin`+ only).
    AppUsersAdmin(AppId),
    /// F-S-012 (v1.1.9+): `invoke()` / `invoke_async()` synchronously
    /// trigger another script in the same app. Same-app isolation is
    /// already enforced (cross-app calls are rejected), but within one
    /// app an anonymous public-HTTP script could otherwise trigger any
    /// other script — including ones that hold capabilities the
    /// original caller shouldn't. Gate authenticated callers on
    /// AppInvoke; anonymous callers continue to skip the check under
    /// the script-as-gate convention.
    AppInvoke(AppId),
 }
 impl Capability {
@@ -167,16 +123,9 @@ impl Capability {
    #[must_use]
    pub const fn app_id(self) -> Option<AppId> {
        match self {
-            Self::InstanceCreateApp
+            Self::InstanceCreateApp | Self::InstanceManageUsers | Self::InstanceManageSettings => {
-            | Self::InstanceManageUsers
+                None
-            | Self::InstanceManageSettings
+            }
            | Self::InstanceCreateGroup
            // Group-scoped caps carry a GroupId, not an AppId. They return
            // None here so a bound API key (which can only target its one
            // app) is denied group management at the binding layer.
            | Self::GroupRead(_)
            | Self::GroupWrite(_)
            | Self::GroupAdmin(_) => None,
            Self::AppRead(id)
            | Self::AppWriteScript(id)
            | Self::AppWriteRoute(id)
@@ -191,17 +140,12 @@ impl Capability {
            | Self::AppFilesRead(id)
            | Self::AppFilesWrite(id)
            | Self::AppPubsubPublish(id)
            | Self::AppQueueEnqueue(id)
            | Self::AppSecretsRead(id)
            | Self::AppSecretsWrite(id)
            | Self::AppEmailSend(id)
            | Self::AppManageTriggers(id)
            | Self::AppDeadLetterManage(id)
-            | Self::AppTopicManage(id)
+            | Self::AppTopicManage(id) => Some(id),
            | Self::AppUsersRead(id)
            | Self::AppUsersWrite(id)
            | Self::AppUsersAdmin(id)
            | Self::AppInvoke(id) => Some(id),
        }
    }
@@ -213,37 +157,28 @@ impl Capability {
    #[must_use]
    pub const fn required_scope(self) -> Scope {
        match self {
-            Self::InstanceCreateApp
+            Self::InstanceCreateApp | Self::InstanceManageUsers | Self::InstanceManageSettings => {
-            | Self::InstanceManageUsers
+                Scope::InstanceAdmin
-            | Self::InstanceManageSettings
+            }
            | Self::InstanceCreateGroup => Scope::InstanceAdmin,
            Self::AppRead(_)
            | Self::AppKvRead(_)
            | Self::AppDocsRead(_)
            | Self::AppFilesRead(_)
-            | Self::AppSecretsRead(_)
+            | Self::AppSecretsRead(_) => Scope::ScriptRead,
            | Self::AppUsersRead(_)
            | Self::GroupRead(_) => Scope::ScriptRead,
            Self::AppWriteScript(_)
            | Self::AppKvWrite(_)
            | Self::AppDocsWrite(_)
            | Self::AppHttpRequest(_)
            | Self::AppFilesWrite(_)
            | Self::AppPubsubPublish(_)
            | Self::AppQueueEnqueue(_)
            | Self::AppSecretsWrite(_)
-            | Self::AppEmailSend(_)
+            | Self::AppEmailSend(_) => Scope::ScriptWrite,
            | Self::AppUsersWrite(_)
            | Self::AppUsersAdmin(_)
            | Self::AppInvoke(_) => Scope::ScriptWrite,
            Self::AppWriteRoute(_) => Scope::RouteWrite,
            Self::AppManageDomains(_) => Scope::DomainManage,
            Self::AppAdmin(_)
            | Self::AppManageTriggers(_)
            | Self::AppDeadLetterManage(_)
-            | Self::AppTopicManage(_)
+            | Self::AppTopicManage(_) => Scope::AppAdmin,
            | Self::GroupWrite(_)
            | Self::GroupAdmin(_) => Scope::AppAdmin,
            Self::AppLogRead(_) => Scope::LogRead,
        }
    }
@@ -254,41 +189,11 @@ impl Capability {
 /// means unit tests can stub it.
 #[async_trait]
 pub trait AuthzRepo: Send + Sync {
    /// Direct `app_members` row for (user, app). The single-row lookup
    /// used by member-management surfaces and as the fallback below.
    async fn membership(
        &self,
        user_id: UserId,
        app_id: AppId,
    ) -> Result<Option<AppRole>, AuthzError>;
    /// Highest *effective* role on `app_id` (hierarchy-aware RBAC, §5.3):
    /// the app's own `app_members` row folded with every `group_members`
    /// row on any ancestor group, max-by-authority. This is what `can()`
    /// consults so a `group_admin` on an ancestor is implicitly app_admin
    /// on the app.
    ///
    /// Default = direct membership only (no inheritance), so the many test
    /// stubs that model no group tree keep their existing behavior; the
    /// Postgres repo overrides this with an ancestor-walking CTE.
    async fn effective_app_role(
        &self,
        user_id: UserId,
        app_id: AppId,
    ) -> Result<Option<AppRole>, AuthzError> {
        self.membership(user_id, app_id).await
    }
    /// Highest effective role on a *group* node — the group's own
    /// ancestor walk over `group_members`. Gates the group-management
    /// capabilities. Default = no grant; the Postgres repo overrides it.
    async fn effective_group_role(
        &self,
        _user_id: UserId,
        _group_id: GroupId,
    ) -> Result<Option<AppRole>, AuthzError> {
        Ok(None)
    }
 }
 /// Repo errors surface here so handlers can map them to 500 without
@@ -364,37 +269,6 @@ pub enum AuthzDenied {
    Repo(#[from] AuthzError),
 }
 /// Script-as-gate authz: anonymous public-HTTP scripts skip the check
 /// (`cx.principal` is `None`); authenticated callers must hold `cap`.
 ///
 /// Replaces the open-coded
 /// `if let Some(p) = cx.principal { authz::require(...).await.map_err(...)? }`
 /// pattern across every stateful service. `forbidden` is called when
 /// the membership lookup returns `Denied`; `backend` is called when the
 /// underlying repo errors. Both closures map to the caller's service-
 /// specific error enum.
 ///
 /// # Errors
 ///
 /// Returns the result of `forbidden(())` on `AuthzDenied::Denied`, or
 /// `backend(repo_err.to_string())` on `AuthzDenied::Repo(repo_err)`.
 pub async fn script_gate<E>(
    repo: &dyn AuthzRepo,
    cx: &picloud_shared::SdkCallCx,
    cap: Capability,
    forbidden: impl FnOnce() -> E,
    backend: impl FnOnce(String) -> E,
 ) -> Result<(), E> {
    let Some(principal) = cx.principal.as_ref() else {
        return Ok(());
    };
    match require(repo, principal, cap).await {
        Ok(()) => Ok(()),
        Err(AuthzDenied::Denied) => Err(forbidden()),
        Err(AuthzDenied::Repo(e)) => Err(backend(e.to_string())),
    }
 }
 // ----------------------------------------------------------------------------
 // Layer 1: role-derived grant
 // ----------------------------------------------------------------------------
@@ -407,20 +281,7 @@ async fn role_grants(
    match principal.instance_role {
        InstanceRole::Owner => Ok(true),
        InstanceRole::Admin => Ok(admin_grants(cap)),
-        InstanceRole::Member => match cap {
+        InstanceRole::Member => member_grants(repo, principal.user_id, cap).await,
            // Group-management caps resolve against the group ancestor
            // walk (a group_admin on an ancestor is implicitly admin of
            // the descendant group). Routed before member_grants because
            // group caps carry no app_id.
            Capability::GroupRead(g) | Capability::GroupWrite(g) | Capability::GroupAdmin(g) => {
                group_member_grants(repo, principal.user_id, cap, g).await
            }
            // Creating a root-level group is an instance act — members
            // can't. (Subgroup creation is gated on GroupAdmin(parent) at
            // the handler, which routes through the arm above.)
            Capability::InstanceCreateGroup => Ok(false),
            _ => member_grants(repo, principal.user_id, cap).await,
        },
    }
 }
@@ -444,41 +305,12 @@ async fn member_grants(
    let Some(app_id) = cap.app_id() else {
        return Ok(false);
    };
-    // Effective (inherited) role: the app's own membership folded with any
+    let Some(role) = repo.membership(user_id, app_id).await? else {
    // ancestor group membership. A group_admin on an ancestor group is
    // implicitly app_admin here.
    let Some(role) = repo.effective_app_role(user_id, app_id).await? else {
        return Ok(false);
    };
    Ok(role_satisfies(role, cap))
 }
 /// Member-path resolution for the group-management capabilities. Resolves
 /// the caller's effective role on the group (ancestor walk over
 /// `group_members`) and checks it covers the requested group action.
 async fn group_member_grants(
    repo: &dyn AuthzRepo,
    user_id: UserId,
    cap: Capability,
    group_id: GroupId,
 ) -> Result<bool, AuthzError> {
    let Some(role) = repo.effective_group_role(user_id, group_id).await? else {
        return Ok(false);
    };
    Ok(group_role_satisfies(role, cap))
 }
 /// Does the effective group `AppRole` cover the group capability?
 /// viewer→read, editor→write, group_admin(=AppAdmin)→admin.
 const fn group_role_satisfies(role: AppRole, cap: Capability) -> bool {
    match cap {
        Capability::GroupRead(_) => true, // any role can read
        Capability::GroupWrite(_) => matches!(role, AppRole::Editor | AppRole::AppAdmin),
        Capability::GroupAdmin(_) => matches!(role, AppRole::AppAdmin),
        _ => false,
    }
 }
 /// Does the per-app `AppRole` cover the capability? Viewer can read;
 /// Editor adds script/route/log mutations; AppAdmin adds settings,
 /// domain claims, and delete. Roles form a strict subset chain, so
@@ -492,7 +324,6 @@ const fn role_satisfies(role: AppRole, cap: Capability) -> bool {
            | Capability::AppDocsRead(_)
            | Capability::AppFilesRead(_)
            | Capability::AppSecretsRead(_)
            | Capability::AppUsersRead(_)
    );
    let in_editor = in_viewer
        || matches!(
@@ -504,11 +335,8 @@ const fn role_satisfies(role: AppRole, cap: Capability) -> bool {
                | Capability::AppHttpRequest(_)
                | Capability::AppFilesWrite(_)
                | Capability::AppPubsubPublish(_)
                | Capability::AppQueueEnqueue(_)
                | Capability::AppSecretsWrite(_)
                | Capability::AppEmailSend(_)
                | Capability::AppUsersWrite(_)
                | Capability::AppInvoke(_)
        );
    let in_app_admin = in_editor
        || matches!(
@@ -518,7 +346,6 @@ const fn role_satisfies(role: AppRole, cap: Capability) -> bool {
                | Capability::AppManageTriggers(_)
                | Capability::AppDeadLetterManage(_)
                | Capability::AppTopicManage(_)
                | Capability::AppUsersAdmin(_)
        );
    match role {
        AppRole::Viewer => in_viewer,
@@ -567,61 +394,16 @@ mod tests {
    use std::collections::HashMap;
    use tokio::sync::Mutex;
-    /// In-memory `AuthzRepo` so the unit tests don't need a database. Models
+    /// In-memory `AuthzRepo` so the unit tests don't need a database.
    /// direct app memberships PLUS a group tree (app→group, group→parent)
    /// and group memberships, so the hierarchy-aware resolution can be
    /// exercised without Postgres — mirroring the recursive-CTE behavior.
    #[derive(Default)]
    struct InMemoryAuthzRepo {
        memberships: Mutex<HashMap<(UserId, AppId), AppRole>>,
        app_group: Mutex<HashMap<AppId, GroupId>>,
        group_parent: Mutex<HashMap<GroupId, Option<GroupId>>>,
        group_memberships: Mutex<HashMap<(UserId, GroupId), AppRole>>,
    }
    impl InMemoryAuthzRepo {
        async fn grant(&self, user: UserId, app: AppId, role: AppRole) {
            self.memberships.lock().await.insert((user, app), role);
        }
        /// Register a group node and its parent (`None` = root).
        async fn add_group(&self, group: GroupId, parent: Option<GroupId>) {
            self.group_parent.lock().await.insert(group, parent);
        }
        /// Place an app under a group.
        async fn put_app(&self, app: AppId, group: GroupId) {
            self.app_group.lock().await.insert(app, group);
        }
        /// Grant a group-level role.
        async fn grant_group(&self, user: UserId, group: GroupId, role: AppRole) {
            self.group_memberships
                .lock()
                .await
                .insert((user, group), role);
        }
        /// Fold every ancestor group membership starting at `group`,
        /// max-by-authority, into `acc`.
        async fn fold_group_chain(
            &self,
            user_id: UserId,
            mut group: Option<GroupId>,
            mut acc: Option<AppRole>,
        ) -> Option<AppRole> {
            let memberships = self.group_memberships.lock().await;
            let parents = self.group_parent.lock().await;
            let mut hops = 0u32;
            while let Some(g) = group {
                if let Some(r) = memberships.get(&(user_id, g)).copied() {
                    acc = Some(acc.map_or(r, |a| a.max(r)));
                }
                hops += 1;
                if hops > 64 {
                    break;
                }
                group = parents.get(&g).copied().flatten();
            }
            acc
        }
    }
    #[async_trait]
@@ -638,29 +420,6 @@ mod tests {
                .get(&(user_id, app_id))
                .copied())
        }
        async fn effective_app_role(
            &self,
            user_id: UserId,
            app_id: AppId,
        ) -> Result<Option<AppRole>, AuthzError> {
            let direct = self
                .memberships
                .lock()
                .await
                .get(&(user_id, app_id))
                .copied();
            let start = self.app_group.lock().await.get(&app_id).copied();
            Ok(self.fold_group_chain(user_id, start, direct).await)
        }
        async fn effective_group_role(
            &self,
            user_id: UserId,
            group_id: GroupId,
        ) -> Result<Option<AppRole>, AuthzError> {
            Ok(self.fold_group_chain(user_id, Some(group_id), None).await)
        }
    }
    fn principal(role: InstanceRole) -> Principal {
@@ -959,245 +718,12 @@ mod tests {
            .is_allow());
    }
    #[tokio::test]
    async fn app_users_admin_requires_app_admin_role() {
        let repo = InMemoryAuthzRepo::default();
        let app = AppId::new();
        // Per the seven-scope commitment, AppUsersAdmin maps to
        // script:write (no new scope) — but the per-app role chain
        // still gates it at app_admin+.
        assert_eq!(
            Capability::AppUsersAdmin(app).required_scope(),
            Scope::ScriptWrite
        );
        // Member with only Editor role cannot administer users.
        let p = principal(InstanceRole::Member);
        repo.grant(p.user_id, app, AppRole::Editor).await;
        assert_eq!(
            can(&repo, &p, Capability::AppUsersAdmin(app))
                .await
                .unwrap(),
            Decision::Deny,
        );
        // App-admin role can.
        let admin = principal(InstanceRole::Member);
        repo.grant(admin.user_id, app, AppRole::AppAdmin).await;
        assert!(can(&repo, &admin, Capability::AppUsersAdmin(app))
            .await
            .unwrap()
            .is_allow());
    }
    #[tokio::test]
    async fn app_users_read_and_write_follow_viewer_editor_chain() {
        let repo = InMemoryAuthzRepo::default();
        let app = AppId::new();
        let viewer = principal(InstanceRole::Member);
        repo.grant(viewer.user_id, app, AppRole::Viewer).await;
        assert!(can(&repo, &viewer, Capability::AppUsersRead(app))
            .await
            .unwrap()
            .is_allow());
        assert_eq!(
            can(&repo, &viewer, Capability::AppUsersWrite(app))
                .await
                .unwrap(),
            Decision::Deny,
        );
        let editor = principal(InstanceRole::Member);
        repo.grant(editor.user_id, app, AppRole::Editor).await;
        assert!(can(&repo, &editor, Capability::AppUsersWrite(app))
            .await
            .unwrap()
            .is_allow());
        assert_eq!(
            can(&repo, &editor, Capability::AppUsersAdmin(app))
                .await
                .unwrap(),
            Decision::Deny,
        );
    }
    // ------------------------------------------------------------------
    // Hierarchy-aware RBAC (Phase 2 groups)
    // ------------------------------------------------------------------
    #[tokio::test]
    async fn group_admin_on_ancestor_is_implicit_app_admin() {
        let repo = InMemoryAuthzRepo::default();
        let acme = GroupId::new();
        let app = AppId::new();
        repo.add_group(acme, None).await;
        repo.put_app(app, acme).await;
        let p = principal(InstanceRole::Member);
        // No app_members row — authority comes purely from the group.
        repo.grant_group(p.user_id, acme, AppRole::AppAdmin).await;
        for cap in [
            Capability::AppRead(app),
            Capability::AppWriteScript(app),
            Capability::AppAdmin(app),
        ] {
            assert!(
                can(&repo, &p, cap).await.unwrap().is_allow(),
                "inherited group_admin denied {cap:?}"
            );
        }
    }
    #[tokio::test]
    async fn inherited_role_takes_the_max_of_direct_and_ancestor() {
        let repo = InMemoryAuthzRepo::default();
        let acme = GroupId::new();
        let app = AppId::new();
        repo.add_group(acme, None).await;
        repo.put_app(app, acme).await;
        let p = principal(InstanceRole::Member);
        // Direct viewer on the app, app_admin via the ancestor group:
        // the higher (app_admin) wins.
        repo.grant(p.user_id, app, AppRole::Viewer).await;
        repo.grant_group(p.user_id, acme, AppRole::AppAdmin).await;
        assert!(can(&repo, &p, Capability::AppAdmin(app))
            .await
            .unwrap()
            .is_allow());
    }
    #[tokio::test]
    async fn group_role_inherits_down_a_multi_level_tree() {
        let repo = InMemoryAuthzRepo::default();
        let root = GroupId::new();
        let team = GroupId::new();
        let app = AppId::new();
        repo.add_group(root, None).await;
        repo.add_group(team, Some(root)).await;
        repo.put_app(app, team).await;
        // Editor two levels up flows down to the app as editor.
        let p = principal(InstanceRole::Member);
        repo.grant_group(p.user_id, root, AppRole::Editor).await;
        assert!(can(&repo, &p, Capability::AppWriteScript(app))
            .await
            .unwrap()
            .is_allow());
        assert_eq!(
            can(&repo, &p, Capability::AppAdmin(app)).await.unwrap(),
            Decision::Deny,
            "editor must not get app_admin"
        );
    }
    #[tokio::test]
    async fn group_membership_grants_no_instance_capabilities() {
        let repo = InMemoryAuthzRepo::default();
        let acme = GroupId::new();
        repo.add_group(acme, None).await;
        let p = principal(InstanceRole::Member);
        repo.grant_group(p.user_id, acme, AppRole::AppAdmin).await;
        for cap in [
            Capability::InstanceCreateApp,
            Capability::InstanceCreateGroup,
            Capability::InstanceManageUsers,
        ] {
            assert_eq!(
                can(&repo, &p, cap).await.unwrap(),
                Decision::Deny,
                "group_admin must not grant instance cap {cap:?}"
            );
        }
    }
    #[tokio::test]
    async fn group_admin_walks_ancestors_for_group_caps() {
        let repo = InMemoryAuthzRepo::default();
        let root = GroupId::new();
        let team = GroupId::new();
        repo.add_group(root, None).await;
        repo.add_group(team, Some(root)).await;
        let p = principal(InstanceRole::Member);
        repo.grant_group(p.user_id, root, AppRole::AppAdmin).await;
        // group_admin at root ⇒ admin of the descendant group.
        assert!(can(&repo, &p, Capability::GroupAdmin(team))
            .await
            .unwrap()
            .is_allow());
        assert!(can(&repo, &p, Capability::GroupWrite(team))
            .await
            .unwrap()
            .is_allow());
        // An unrelated member gets nothing.
        let outsider = principal(InstanceRole::Member);
        assert_eq!(
            can(&repo, &outsider, Capability::GroupRead(team))
                .await
                .unwrap(),
            Decision::Deny
        );
    }
    #[tokio::test]
    async fn admin_implicitly_manages_the_whole_group_tree() {
        let repo = InMemoryAuthzRepo::default();
        let g = GroupId::new();
        let p = principal(InstanceRole::Admin);
        for cap in [
            Capability::InstanceCreateGroup,
            Capability::GroupRead(g),
            Capability::GroupWrite(g),
            Capability::GroupAdmin(g),
        ] {
            assert!(
                can(&repo, &p, cap).await.unwrap().is_allow(),
                "admin denied group cap {cap:?}"
            );
        }
    }
    #[tokio::test]
    async fn bound_key_cannot_manage_groups() {
        let repo = InMemoryAuthzRepo::default();
        let g = GroupId::new();
        let p = Principal {
            user_id: AdminUserId::new(),
            instance_role: InstanceRole::Owner,
            scopes: Some(vec![Scope::AppAdmin]),
            app_binding: Some(AppId::new()),
        };
        // Group caps carry no app_id, so a bound key is denied at the
        // binding layer regardless of role/scope.
        assert_eq!(
            can(&repo, &p, Capability::GroupAdmin(g)).await.unwrap(),
            Decision::Deny
        );
    }
    #[test]
    fn app_role_max_is_authority_ordered() {
        assert_eq!(AppRole::Viewer.max(AppRole::AppAdmin), AppRole::AppAdmin);
        assert_eq!(AppRole::Editor.max(AppRole::Viewer), AppRole::Editor);
        assert_eq!(AppRole::AppAdmin.max(AppRole::Editor), AppRole::AppAdmin);
    }
    #[test]
    fn capability_app_id_extraction() {
        let app = AppId::new();
        assert_eq!(Capability::InstanceCreateApp.app_id(), None);
        assert_eq!(Capability::AppRead(app).app_id(), Some(app));
        assert_eq!(Capability::AppAdmin(app).app_id(), Some(app));
        // Group caps are not app-scoped.
        assert_eq!(Capability::GroupAdmin(GroupId::new()).app_id(), None);
        assert_eq!(Capability::InstanceCreateGroup.app_id(), None);
    }
    #[test]
--- a/crates/manager-core/src/dead_letters_api.rs
+++ b/crates/manager-core/src/dead_letters_api.rs
@@ -114,10 +114,10 @@ impl From<DeadLetterRow> for DeadLetterDto {
 async fn list(
    State(s): State<DeadLettersState>,
    Extension(principal): Extension<Principal>,
-    Path(id_or_slug): Path<String>,
+    Path(app_id): Path<AppId>,
    Query(q): Query<ListQuery>,
 ) -> Result<Json<ListResponse>, DeadLettersApiError> {
-    let app_id = resolve_app(&*s.apps, &id_or_slug).await?;
+    ensure_app(&*s.apps, app_id).await?;
    require(
        s.authz.as_ref(),
        &principal,
@@ -136,9 +136,9 @@ async fn list(
 async fn count(
    State(s): State<DeadLettersState>,
    Extension(principal): Extension<Principal>,
-    Path(id_or_slug): Path<String>,
+    Path(app_id): Path<AppId>,
 ) -> Result<Json<CountResponse>, DeadLettersApiError> {
-    let app_id = resolve_app(&*s.apps, &id_or_slug).await?;
+    ensure_app(&*s.apps, app_id).await?;
    require(
        s.authz.as_ref(),
        &principal,
@@ -152,9 +152,9 @@ async fn count(
 async fn detail(
    State(s): State<DeadLettersState>,
    Extension(principal): Extension<Principal>,
-    Path((id_or_slug, dl_id)): Path<(String, DeadLetterId)>,
+    Path((app_id, dl_id)): Path<(AppId, DeadLetterId)>,
 ) -> Result<Json<DeadLetterDto>, DeadLettersApiError> {
-    let app_id = resolve_app(&*s.apps, &id_or_slug).await?;
+    ensure_app(&*s.apps, app_id).await?;
    require(
        s.authz.as_ref(),
        &principal,
@@ -175,9 +175,9 @@ async fn detail(
 async fn replay(
    State(s): State<DeadLettersState>,
    Extension(principal): Extension<Principal>,
-    Path((id_or_slug, dl_id)): Path<(String, DeadLetterId)>,
+    Path((app_id, dl_id)): Path<(AppId, DeadLetterId)>,
 ) -> Result<StatusCode, DeadLettersApiError> {
-    let app_id = resolve_app(&*s.apps, &id_or_slug).await?;
+    ensure_app(&*s.apps, app_id).await?;
    // Authz handled inside the service via SdkCallCx.
    let cx = admin_cx(app_id, &principal);
    s.service
@@ -190,10 +190,10 @@ async fn replay(
 async fn resolve(
    State(s): State<DeadLettersState>,
    Extension(principal): Extension<Principal>,
-    Path((id_or_slug, dl_id)): Path<(String, DeadLetterId)>,
+    Path((app_id, dl_id)): Path<(AppId, DeadLetterId)>,
    Json(body): Json<ResolveBody>,
 ) -> Result<StatusCode, DeadLettersApiError> {
-    let app_id = resolve_app(&*s.apps, &id_or_slug).await?;
+    ensure_app(&*s.apps, app_id).await?;
    let cx = admin_cx(app_id, &principal);
    s.service
        .resolve(&cx, dl_id, &body.reason)
@@ -221,12 +221,12 @@ fn admin_cx(app_id: AppId, principal: &Principal) -> SdkCallCx {
    }
 }
-async fn resolve_app(apps: &dyn AppRepository, ident: &str) -> Result<AppId, DeadLettersApiError> {
+async fn ensure_app(apps: &dyn AppRepository, app_id: AppId) -> Result<(), DeadLettersApiError> {
-    crate::app_repo::resolve_app(apps, ident)
+    apps.get_by_id(app_id)
        .await
        .map_err(|e| DeadLettersApiError::Backend(e.to_string()))?
-        .map(|l| l.app.id)
+        .ok_or_else(|| DeadLettersApiError::AppNotFound(app_id.to_string()))?;
-        .ok_or_else(|| DeadLettersApiError::AppNotFound(ident.to_string()))
+    Ok(())
 }
 fn map_service_err(e: picloud_shared::DeadLetterError) -> DeadLettersApiError {
--- a/crates/manager-core/src/dev_email_api.rs
+++ b/crates/manager-core/src/dev_email_api.rs
@@ -1,48 +0,0 @@
 //! `GET /api/v1/admin/dev/emails` — dev-only inspection of mail captured
 //! by the in-memory email sink (G5).
 //!
 //! Mounted **only** when the email service is running in dev-capture mode
 //! (`PICLOUD_DEV_MODE=true` and no SMTP relay configured). In every other
 //! configuration the route does not exist, so there is no production
 //! surface here. Capture is instance-wide (the SMTP transport seam can't
 //! see a script's `app_id`), so the endpoint is instance-wide too and is
 //! restricted to instance Owners/Admins.
 use std::sync::Arc;
 use axum::extract::State;
 use axum::http::StatusCode;
 use axum::response::Json;
 use axum::routing::get;
 use axum::{Extension, Router};
 use picloud_shared::{InstanceRole, Principal};
 use crate::email_service::{CapturedEmail, DevEmailSink};
 #[derive(Clone)]
 pub struct DevEmailState {
    pub sink: Arc<DevEmailSink>,
 }
 /// Build the dev-email router. Callers mount this only when dev-capture
 /// mode is active (i.e. they hold a `Some(sink)`).
 pub fn dev_emails_router(state: DevEmailState) -> Router {
    Router::new()
        .route("/dev/emails", get(list_dev_emails))
        .with_state(state)
 }
 async fn list_dev_emails(
    Extension(principal): Extension<Principal>,
    State(state): State<DevEmailState>,
 ) -> Result<Json<Vec<CapturedEmail>>, StatusCode> {
    // Instance-wide data → require an instance Owner/Admin. A Member
    // (app-scoped) principal has no business reading every app's mail.
    if !matches!(
        principal.instance_role,
        InstanceRole::Owner | InstanceRole::Admin
    ) {
        return Err(StatusCode::FORBIDDEN);
    }
    Ok(Json(state.sink.snapshot()))
 }
--- a/crates/manager-core/src/dispatcher.rs
+++ b/crates/manager-core/src/dispatcher.rs
--- a/crates/manager-core/src/docs_service.rs
+++ b/crates/manager-core/src/docs_service.rs
@@ -34,31 +34,10 @@ use crate::authz::{self, AuthzRepo, Capability};
 use crate::docs_filter::{parse_filter, FilterParseError};
 use crate::docs_repo::{DocsRepo, DocsRepoError};
 /// Default per-document JSON-encoded data cap (256 KB). Override with
 /// `PICLOUD_DOCS_MAX_VALUE_BYTES`.
 pub const DEFAULT_DOCS_MAX_VALUE_BYTES: usize = 256 * 1024;
 /// Read `PICLOUD_DOCS_MAX_VALUE_BYTES`; invalid values fall back to the
 /// conservative default with a warning.
 #[must_use]
 pub fn docs_max_value_bytes_from_env() -> usize {
    if let Ok(v) = std::env::var("PICLOUD_DOCS_MAX_VALUE_BYTES") {
        match v.trim().parse::<usize>() {
            Ok(n) if n > 0 => return n,
            _ => tracing::warn!(
                value = %v,
                "ignoring invalid PICLOUD_DOCS_MAX_VALUE_BYTES (want a positive integer)"
            ),
        }
    }
    DEFAULT_DOCS_MAX_VALUE_BYTES
 }
 pub struct DocsServiceImpl {
    repo: Arc<dyn DocsRepo>,
    authz: Arc<dyn AuthzRepo>,
    events: Arc<dyn ServiceEventEmitter>,
    max_value_bytes: usize,
 }
 impl DocsServiceImpl {
@@ -67,58 +46,30 @@ impl DocsServiceImpl {
        repo: Arc<dyn DocsRepo>,
        authz: Arc<dyn AuthzRepo>,
        events: Arc<dyn ServiceEventEmitter>,
    ) -> Self {
        Self::with_max_value_bytes(repo, authz, events, DEFAULT_DOCS_MAX_VALUE_BYTES)
    }
    #[must_use]
    pub fn with_max_value_bytes(
        repo: Arc<dyn DocsRepo>,
        authz: Arc<dyn AuthzRepo>,
        events: Arc<dyn ServiceEventEmitter>,
        max_value_bytes: usize,
    ) -> Self {
        Self {
            repo,
            authz,
            events,
            max_value_bytes,
        }
    }
-    fn check_data_size(&self, data: &serde_json::Value) -> Result<(), DocsError> {
+    async fn check_read(&self, cx: &SdkCallCx) -> Result<(), DocsError> {
-        let encoded_len = serde_json::to_vec(data)
+        if let Some(ref principal) = cx.principal {
-            .map(|v| v.len())
+            authz::require(&*self.authz, principal, Capability::AppDocsRead(cx.app_id))
-            .map_err(|e| DocsError::Backend(format!("encode doc data: {e}")))?;
+                .await
-        if encoded_len > self.max_value_bytes {
+                .map_err(|_| DocsError::Forbidden)?;
            return Err(DocsError::ValueTooLarge {
                limit: self.max_value_bytes,
                actual: encoded_len,
            });
        }
        Ok(())
    }
    async fn check_read(&self, cx: &SdkCallCx) -> Result<(), DocsError> {
        authz::script_gate(
            &*self.authz,
            cx,
            Capability::AppDocsRead(cx.app_id),
            || DocsError::Forbidden,
            DocsError::Backend,
        )
        .await
    }
    async fn check_write(&self, cx: &SdkCallCx) -> Result<(), DocsError> {
-        authz::script_gate(
+        if let Some(ref principal) = cx.principal {
-            &*self.authz,
+            authz::require(&*self.authz, principal, Capability::AppDocsWrite(cx.app_id))
-            cx,
+                .await
-            Capability::AppDocsWrite(cx.app_id),
+                .map_err(|_| DocsError::Forbidden)?;
-            || DocsError::Forbidden,
+        }
-            DocsError::Backend,
+        Ok(())
        )
        .await
    }
 }
@@ -161,7 +112,6 @@ impl DocsService for DocsServiceImpl {
    ) -> Result<DocId, DocsError> {
        validate_collection(collection)?;
        validate_data(&data)?;
        self.check_data_size(&data)?;
        self.check_write(cx).await?;
        let row = self
            .repo
@@ -184,7 +134,7 @@ impl DocsService for DocsServiceImpl {
            )
            .await
        {
-            tracing::error!(error = %e, source = "docs", op = "create", event_emit_failure = true, "event emit failed");
+            tracing::warn!(error = %e, source = "docs", op = "create", "event emit failed");
        }
        Ok(row.id)
    }
@@ -239,7 +189,6 @@ impl DocsService for DocsServiceImpl {
    ) -> Result<(), DocsError> {
        validate_collection(collection)?;
        validate_data(&data)?;
        self.check_data_size(&data)?;
        self.check_write(cx).await?;
        let previous = self
            .repo
@@ -262,7 +211,7 @@ impl DocsService for DocsServiceImpl {
                    )
                    .await
                {
-                    tracing::error!(error = %e, source = "docs", op = "update", event_emit_failure = true, "event emit failed");
+                    tracing::warn!(error = %e, source = "docs", op = "update", "event emit failed");
                }
                Ok(())
            }
@@ -291,7 +240,7 @@ impl DocsService for DocsServiceImpl {
                )
                .await
            {
-                tracing::error!(error = %e, source = "docs", op = "delete", event_emit_failure = true, "event emit failed");
+                tracing::warn!(error = %e, source = "docs", op = "delete", "event emit failed");
            }
        }
        Ok(was_present)
--- a/Show More
+++ b/Show More