style(cli): re-fmt one stray format! line in the integration test

A trailing fmt drift on tests/cli.rs:95 — `format!()` arg was wrapped across three lines where rustfmt wants one. Running `cargo fmt --all` collapses it; no behavior change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
test(cli): bare-metal end-to-end integration test
2026-05-28 20:57:50 +02:00 · 2026-05-28 20:53:56 +02:00 · 2026-05-28 20:53:49 +02:00 · 2026-05-28 20:21:38 +02:00 · 2026-05-28 20:10:45 +02:00 · 2026-05-28 19:41:51 +02:00
60 changed files with 6198 additions and 227 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -30,6 +30,17 @@ config.local.toml
 /dashboard/build
 /dashboard/.env
 # Dashboard — Playwright E2E
 /dashboard/tests/e2e/.auth
 /dashboard/tests/e2e/.results
 /dashboard/playwright-report
 /dashboard/test-results
 /dashboard/.playwright
 # When playwright is invoked from the repo root by accident, these
 # also land here.
 /playwright-report
 /test-results
 # Caddy
 /caddy/data
 /caddy/config
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -40,6 +40,56 @@ dependencies = [
 "libc",
 ]
 [[package]]
 name = "anstream"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
 dependencies = [
 "anstyle",
 "anstyle-parse",
 "anstyle-query",
 "anstyle-wincon",
 "colorchoice",
 "is_terminal_polyfill",
 "utf8parse",
 ]
 [[package]]
 name = "anstyle"
 version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 [[package]]
 name = "anstyle-parse"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
 dependencies = [
 "utf8parse",
 ]
 [[package]]
 name = "anstyle-query"
 version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "anstyle-wincon"
 version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
 "anstyle",
 "once_cell_polyfill",
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "anyhow"
 version = "1.0.102"
@@ -68,6 +118,21 @@ dependencies = [
 "serde_json",
 ]
 [[package]]
 name = "assert_cmd"
 version = "2.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2aa3a22042e45de04255c7bf3626e239f450200fd0493c1e382263544b20aea6"
 dependencies = [
 "anstyle",
 "bstr",
 "libc",
 "predicates",
 "predicates-core",
 "predicates-tree",
 "wait-timeout",
 ]
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -236,6 +301,17 @@ dependencies = [
 "generic-array",
 ]
 [[package]]
 name = "bstr"
 version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab"
 dependencies = [
 "memchr",
 "regex-automata",
 "serde",
 ]
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -302,6 +378,52 @@ dependencies = [
 "windows-link",
 ]
 [[package]]
 name = "clap"
 version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
 dependencies = [
 "clap_builder",
 "clap_derive",
 ]
 [[package]]
 name = "clap_builder"
 version = "4.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
 dependencies = [
 "anstream",
 "anstyle",
 "clap_lex",
 "strsim",
 ]
 [[package]]
 name = "clap_derive"
 version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
 dependencies = [
 "heck",
 "proc-macro2",
 "quote",
 "syn",
 ]
 [[package]]
 name = "clap_lex"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -440,6 +562,12 @@ version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "56254986775e3233ffa9c4d7d3faaf6d36a2c09d30b20687e9f88bc8bafc16c8"
 [[package]]
 name = "difflib"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -452,6 +580,27 @@ dependencies = [
 "subtle",
 ]
 [[package]]
 name = "directories"
 version = "5.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a49173b84e034382284f27f1af4dcbbd231ffa358c0fe316541a7337f376a35"
 dependencies = [
 "dirs-sys",
 ]
 [[package]]
 name = "dirs-sys"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
 dependencies = [
 "libc",
 "option-ext",
 "redox_users",
 "windows-sys 0.48.0",
 ]
 [[package]]
 name = "displaydoc"
 version = "0.2.5"
@@ -516,6 +665,12 @@ dependencies = [
 "pin-project-lite",
 ]
 [[package]]
 name = "fastrand"
 version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 [[package]]
 name = "figment"
 version = "0.10.19"
@@ -536,6 +691,15 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 [[package]]
 name = "float-cmp"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b09cf3155332e944990140d967ff5eceb70df778b34f77d8075db46e4704e6d8"
 dependencies = [
 "num-traits",
 ]
 [[package]]
 name = "flume"
 version = "0.11.1"
@@ -1010,6 +1174,12 @@ version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -1077,6 +1247,12 @@ dependencies = [
 "vcpkg",
 ]
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 [[package]]
 name = "litemap"
 version = "0.8.2"
@@ -1161,6 +1337,12 @@ dependencies = [
 "spin 0.5.2",
 ]
 [[package]]
 name = "normalize-line-endings"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be"
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -1231,6 +1413,18 @@ dependencies = [
 "portable-atomic",
 ]
 [[package]]
 name = "once_cell_polyfill"
 version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 [[package]]
 name = "option-ext"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -1335,6 +1529,25 @@ dependencies = [
 "uuid",
 ]
 [[package]]
 name = "picloud-cli"
 version = "0.6.0"
 dependencies = [
 "anyhow",
 "assert_cmd",
 "clap",
 "directories",
 "picloud-shared",
 "predicates",
 "reqwest",
 "rpassword",
 "serde",
 "serde_json",
 "tempfile",
 "tokio",
 "toml",
 ]
 [[package]]
 name = "picloud-executor"
 version = "0.6.0"
@@ -1509,6 +1722,36 @@ dependencies = [
 "zerocopy",
 ]
 [[package]]
 name = "predicates"
 version = "3.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ada8f2932f28a27ee7b70dd6c1c39ea0675c55a36879ab92f3a715eaa1e63cfe"
 dependencies = [
 "anstyle",
 "difflib",
 "float-cmp",
 "normalize-line-endings",
 "predicates-core",
 "regex",
 ]
 [[package]]
 name = "predicates-core"
 version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cad38746f3166b4031b1a0d39ad9f954dd291e7854fcc0eed52ee41a0b50d144"
 [[package]]
 name = "predicates-tree"
 version = "1.0.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0de1b847b39c8131db0467e9df1ff60e6d0562ab8e9a16e568ad0fdb372e2f2"
 dependencies = [
 "predicates-core",
 "termtree",
 ]
 [[package]]
 name = "pretty_assertions"
 version = "1.4.1"
@@ -1704,6 +1947,29 @@ dependencies = [
 "bitflags",
 ]
 [[package]]
 name = "redox_users"
 version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
 dependencies = [
 "getrandom 0.2.17",
 "libredox",
 "thiserror 1.0.69",
 ]
 [[package]]
 name = "regex"
 version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
 dependencies = [
 "aho-corasick",
 "memchr",
 "regex-automata",
 "regex-syntax",
 ]
 [[package]]
 name = "regex-automata"
 version = "0.4.14"
@@ -1729,7 +1995,9 @@ checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
 "base64",
 "bytes",
 "futures-channel",
 "futures-core",
 "futures-util",
 "http",
 "http-body",
 "http-body-util",
@@ -1812,6 +2080,17 @@ dependencies = [
 "windows-sys 0.52.0",
 ]
 [[package]]
 name = "rpassword"
 version = "7.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "835a57a69104632d64deb0df2e09a69945cd7a6eab4070fc9b1d7e50cf6c3edc"
 dependencies = [
 "libc",
 "rtoolbox",
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "rsa"
 version = "0.9.10"
@@ -1832,6 +2111,16 @@ dependencies = [
 "zeroize",
 ]
 [[package]]
 name = "rtoolbox"
 version = "0.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "50a0e551c1e27e1731aba276dbeaeac73f53c7cd34d1bda485d02bd1e0f36844"
 dependencies = [
 "libc",
 "windows-sys 0.59.0",
 ]
 [[package]]
 name = "rust-multipart-rfc7578_2"
 version = "0.8.0"
@@ -1853,6 +2142,19 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
 [[package]]
 name = "rustix"
 version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
 "bitflags",
 "errno",
 "libc",
 "linux-raw-sys",
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "rustls"
 version = "0.23.40"
@@ -2327,6 +2629,12 @@ dependencies = [
 "unicode-properties",
 ]
 [[package]]
 name = "strsim"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -2364,6 +2672,25 @@ dependencies = [
 "syn",
 ]
 [[package]]
 name = "tempfile"
 version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
 "getrandom 0.4.2",
 "once_cell",
 "rustix",
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "termtree"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 [[package]]
 name = "thin-vec"
 version = "0.2.18"
@@ -2783,6 +3110,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 [[package]]
 name = "uuid"
 version = "1.23.1"
@@ -2813,6 +3146,15 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 [[package]]
 name = "wait-timeout"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ac3b126d3914f9849036f826e054cbabdc8519970b8998ddaf3b5bd3c65f11"
 dependencies = [
 "libc",
 ]
 [[package]]
 name = "want"
 version = "0.3.1"
@@ -3066,6 +3408,15 @@ dependencies = [
 "windows-targets 0.52.6",
 ]
 [[package]]
 name = "windows-sys"
 version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
 "windows-targets 0.52.6",
 ]
 [[package]]
 name = "windows-sys"
 version = "0.60.2"
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,6 +9,7 @@ members = [
    "crates/picloud-manager",
    "crates/picloud-orchestrator",
    "crates/picloud-executor",
    "crates/picloud-cli",
 ]
 [workspace.package]
--- a/crates/manager-core/src/api.rs
+++ b/crates/manager-core/src/api.rs
@@ -270,10 +270,13 @@ async fn delete_script<R: ScriptRepository, L: ExecutionLogRepository>(
    Path(id): Path<ScriptId>,
 ) -> Result<StatusCode, ApiError> {
    let script = state.repo.get(id).await?.ok_or(ApiError::NotFound(id))?;
    // Delete is gated tighter than Save: editors can edit scripts but
    // only app_admin / instance admin / owner can remove them. See
    // blueprint §11.6.
    require(
        state.authz.as_ref(),
        &principal,
-        Capability::AppWriteScript(script.app_id),
+        Capability::AppAdmin(script.app_id),
    )
    .await?;
    state.repo.delete(id).await?;
--- a/crates/manager-core/src/app_members_api.rs
+++ b/crates/manager-core/src/app_members_api.rs
@@ -0,0 +1,331 @@
 //! `/api/v1/admin/apps/{id_or_slug}/members/*` — CRUD over the
 //! `app_members` table (blueprint §11.6).
 //!
 //! Every endpoint is gated on `Capability::AppAdmin(app_id)` after
 //! resolving the app from `id_or_slug`. Editors and viewers receive
 //! 403 from list and never see the dashboard's Members tab.
 //!
 //! POST is **non-idempotent on purpose**: a duplicate `(app_id,
 //! user_id)` returns 409 rather than upsert-200, so the UI can show
 //! "already a member — promote / demote them instead" cleanly. Role
 //! changes go through PATCH.
 //!
 //! No last-app-admin guard: owners always implicitly satisfy
 //! `Capability::AppAdmin(_)` (authz::role_grants), so removing the
 //! final explicit `app_admin` membership cannot orphan an app.
 use std::sync::Arc;
 use axum::extract::{Path, State};
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Json, Response};
 use axum::routing::{get, patch};
 use axum::{Extension, Router};
 use chrono::{DateTime, Utc};
 use picloud_shared::{AdminUserId, AppRole, InstanceRole, Principal};
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use uuid::Uuid;
 use crate::admin_user_repo::{AdminUserRepository, AdminUserRepositoryError, AdminUserRow};
 use crate::app_members_repo::{
    AppMembersRepository, AppMembersRepositoryError, AppMembershipDetail, AppMembershipRow,
 };
 use crate::app_repo::AppRepository;
 use crate::authz::{require, AuthzDenied, AuthzRepo, Capability};
 use crate::repo::ScriptRepositoryError;
 #[derive(Clone)]
 pub struct AppMembersState {
    pub apps: Arc<dyn AppRepository>,
    pub users: Arc<dyn AdminUserRepository>,
    pub members: Arc<dyn AppMembersRepository>,
    pub authz: Arc<dyn AuthzRepo>,
 }
 pub fn app_members_router(state: AppMembersState) -> Router {
    Router::new()
        .route(
            "/apps/{id_or_slug}/members",
            get(list_members).post(grant_member),
        )
        .route(
            "/apps/{id_or_slug}/members/{user_id}",
            patch(patch_member).delete(remove_member),
        )
        .with_state(state)
 }
 // ----------------------------------------------------------------------------
 // DTOs
 // ----------------------------------------------------------------------------
 #[derive(Debug, Serialize)]
 pub struct AppMemberDto {
    pub user_id: AdminUserId,
    pub username: String,
    pub email: Option<String>,
    pub instance_role: InstanceRole,
    pub is_active: bool,
    pub role: AppRole,
    pub created_at: DateTime<Utc>,
 }
 impl From<AppMembershipDetail> for AppMemberDto {
    fn from(d: AppMembershipDetail) -> Self {
        Self {
            user_id: d.user_id,
            username: d.username,
            email: d.email,
            instance_role: d.instance_role,
            is_active: d.is_active,
            role: d.role,
            created_at: d.created_at,
        }
    }
 }
 /// Compose a DTO from an `AdminUserRow` (fetched for validation) and
 /// the `AppMembershipRow` returned by `upsert`. Saves a re-fetch on
 /// POST/PATCH at the cost of trusting the two inputs reference the
 /// same user_id — caller's responsibility.
 fn compose_dto(user: AdminUserRow, membership: AppMembershipRow) -> AppMemberDto {
    AppMemberDto {
        user_id: user.id,
        username: user.username,
        email: user.email,
        instance_role: user.instance_role,
        is_active: user.is_active,
        role: membership.role,
        created_at: membership.created_at,
    }
 }
 #[derive(Debug, Deserialize)]
 pub struct GrantMemberRequest {
    pub user_id: AdminUserId,
    pub role: AppRole,
 }
 #[derive(Debug, Deserialize)]
 pub struct PatchMemberRequest {
    pub role: AppRole,
 }
 // ----------------------------------------------------------------------------
 // Handlers
 // ----------------------------------------------------------------------------
 async fn list_members(
    State(s): State<AppMembersState>,
    Extension(principal): Extension<Principal>,
    Path(id_or_slug): Path<String>,
 ) -> Result<Json<Vec<AppMemberDto>>, AppMembersApiError> {
    let app = resolve_app(&*s.apps, &id_or_slug).await?;
    require(s.authz.as_ref(), &principal, Capability::AppAdmin(app.id)).await?;
    let rows = s.members.list_for_app_enriched(app.id).await?;
    Ok(Json(rows.into_iter().map(Into::into).collect()))
 }
 async fn grant_member(
    State(s): State<AppMembersState>,
    Extension(principal): Extension<Principal>,
    Path(id_or_slug): Path<String>,
    Json(input): Json<GrantMemberRequest>,
 ) -> Result<(StatusCode, Json<AppMemberDto>), AppMembersApiError> {
    let app = resolve_app(&*s.apps, &id_or_slug).await?;
    require(s.authz.as_ref(), &principal, Capability::AppAdmin(app.id)).await?;
    let user = s
        .users
        .get(input.user_id)
        .await?
        .ok_or(AppMembersApiError::UserNotFound(input.user_id))?;
    validate_grant_target(&user)?;
    // Atomic insert — if a row already exists, returns None and we 409.
    // Avoids the find-then-upsert race where two concurrent POSTs would
    // both pass the existence check and the second `upsert` would
    // silently rewrite the role.
    let row = s
        .members
        .try_insert(app.id, user.id, input.role)
        .await?
        .ok_or_else(|| AppMembersApiError::AlreadyMember {
            username: user.username.clone(),
        })?;
    Ok((StatusCode::CREATED, Json(compose_dto(user, row))))
 }
 async fn patch_member(
    State(s): State<AppMembersState>,
    Extension(principal): Extension<Principal>,
    Path((id_or_slug, user_id)): Path<(String, Uuid)>,
    Json(input): Json<PatchMemberRequest>,
 ) -> Result<Json<AppMemberDto>, AppMembersApiError> {
    let app = resolve_app(&*s.apps, &id_or_slug).await?;
    require(s.authz.as_ref(), &principal, Capability::AppAdmin(app.id)).await?;
    let user_id = AdminUserId::from(user_id);
    let user = s
        .users
        .get(user_id)
        .await?
        .ok_or(AppMembersApiError::UserNotFound(user_id))?;
    // Atomic update — returns None if no row exists, so 404 is decided
    // by the same statement that does the write. Eliminates the
    // find-then-upsert race where a concurrent DELETE between the two
    // calls would let PATCH silently re-create the row.
    let row = s
        .members
        .update_role(app.id, user_id, input.role)
        .await?
        .ok_or(AppMembersApiError::MembershipNotFound)?;
    Ok(Json(compose_dto(user, row)))
 }
 async fn remove_member(
    State(s): State<AppMembersState>,
    Extension(principal): Extension<Principal>,
    Path((id_or_slug, user_id)): Path<(String, Uuid)>,
 ) -> Result<StatusCode, AppMembersApiError> {
    let app = resolve_app(&*s.apps, &id_or_slug).await?;
    require(s.authz.as_ref(), &principal, Capability::AppAdmin(app.id)).await?;
    s.members.remove(app.id, AdminUserId::from(user_id)).await?;
    Ok(StatusCode::NO_CONTENT)
 }
 // ----------------------------------------------------------------------------
 // Validation + helpers
 // ----------------------------------------------------------------------------
 fn validate_grant_target(user: &AdminUserRow) -> Result<(), AppMembersApiError> {
    if !user.is_active {
        return Err(AppMembersApiError::TargetInactive {
            username: user.username.clone(),
        });
    }
    if user.instance_role != InstanceRole::Member {
        return Err(AppMembersApiError::TargetNotMember {
            username: user.username.clone(),
            instance_role: user.instance_role,
        });
    }
    Ok(())
 }
 async fn resolve_app(
    apps: &dyn AppRepository,
    ident: &str,
 ) -> Result<picloud_shared::App, AppMembersApiError> {
    crate::app_repo::resolve_app(apps, ident)
        .await?
        .map(|l| l.app)
        .ok_or_else(|| AppMembersApiError::AppNotFound(ident.to_string()))
 }
 // ----------------------------------------------------------------------------
 // Errors
 // ----------------------------------------------------------------------------
 #[derive(Debug, thiserror::Error)]
 pub enum AppMembersApiError {
    #[error("app not found: {0}")]
    AppNotFound(String),
    #[error("user not found: {0}")]
    UserNotFound(AdminUserId),
    #[error("no membership exists for this user on this app")]
    MembershipNotFound,
    #[error("{username} is already a member of this app — use PATCH to change their role")]
    AlreadyMember { username: String },
    #[error("{username} is deactivated and cannot be added as a member")]
    TargetInactive { username: String },
    #[error(
        "{username} has instance_role {instance_role:?} and already has implicit access \
         on every app — no explicit membership needed"
    )]
    TargetNotMember {
        username: String,
        instance_role: InstanceRole,
    },
    #[error("forbidden")]
    Forbidden,
    #[error("authorization repo error: {0}")]
    AuthzRepo(String),
    #[error("repository error: {0}")]
    Members(#[from] AppMembersRepositoryError),
    #[error("user repository error: {0}")]
    Users(#[from] AdminUserRepositoryError),
    #[error("repository error: {0}")]
    Apps(#[from] ScriptRepositoryError),
 }
 impl From<AuthzDenied> for AppMembersApiError {
    fn from(d: AuthzDenied) -> Self {
        match d {
            AuthzDenied::Denied => Self::Forbidden,
            AuthzDenied::Repo(e) => Self::AuthzRepo(e.to_string()),
        }
    }
 }
 impl IntoResponse for AppMembersApiError {
    fn into_response(self) -> Response {
        let (status, body) = match &self {
            Self::AppNotFound(_)
            | Self::UserNotFound(_)
            | Self::MembershipNotFound
            | Self::Apps(ScriptRepositoryError::NotFound(_)) => {
                (StatusCode::NOT_FOUND, json!({ "error": self.to_string() }))
            }
            Self::AlreadyMember { .. } | Self::Apps(ScriptRepositoryError::Conflict(_)) => {
                (StatusCode::CONFLICT, json!({ "error": self.to_string() }))
            }
            Self::TargetInactive { .. } | Self::TargetNotMember { .. } => (
                StatusCode::UNPROCESSABLE_ENTITY,
                json!({ "error": self.to_string() }),
            ),
            Self::Forbidden => (StatusCode::FORBIDDEN, json!({ "error": self.to_string() })),
            Self::AuthzRepo(e) => {
                tracing::error!(error = %e, "app members authz repo error");
                (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    json!({ "error": "internal error" }),
                )
            }
            Self::Members(e) => {
                tracing::error!(error = %e, "app members repo error");
                (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    json!({ "error": "internal error" }),
                )
            }
            Self::Users(e) => {
                tracing::error!(error = %e, "admin users repo error");
                (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    json!({ "error": "internal error" }),
                )
            }
            Self::Apps(ScriptRepositoryError::Db(e)) => {
                tracing::error!(error = %e, "apps repo error in app_members");
                (
                    StatusCode::INTERNAL_SERVER_ERROR,
                    json!({ "error": "internal error" }),
                )
            }
        };
        (status, Json(body)).into_response()
    }
 }
--- a/crates/manager-core/src/app_members_repo.rs
+++ b/crates/manager-core/src/app_members_repo.rs
@@ -8,7 +8,7 @@
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use picloud_shared::{AdminUserId, AppId, AppRole};
+use picloud_shared::{AdminUserId, AppId, AppRole, InstanceRole};
 use sqlx::PgPool;
 use crate::authz::{AuthzError, AuthzRepo};
@@ -36,6 +36,20 @@ pub struct AppMembershipRow {
    pub created_at: DateTime<Utc>,
 }
 /// `app_members` row joined with `admin_users` so the dashboard's
 /// Members tab can render usernames / emails / status without an N+1
 /// fetch per row. Drives `GET /apps/{id}/members`.
 #[derive(Debug, Clone)]
 pub struct AppMembershipDetail {
    pub user_id: AdminUserId,
    pub username: String,
    pub email: Option<String>,
    pub instance_role: InstanceRole,
    pub is_active: bool,
    pub role: AppRole,
    pub created_at: DateTime<Utc>,
 }
 #[async_trait]
 pub trait AppMembersRepository: Send + Sync {
    /// Single (user, app) lookup. Returns `None` for non-members and
@@ -55,6 +69,27 @@ pub trait AppMembersRepository: Send + Sync {
        role: AppRole,
    ) -> Result<AppMembershipRow, AppMembersRepositoryError>;
    /// Atomic insert. Returns `Some(row)` on success, `None` if a
    /// membership already exists. Lets the HTTP handler return 409
    /// without a separate `find` round-trip (no TOCTOU between check
    /// and insert).
    async fn try_insert(
        &self,
        app_id: AppId,
        user_id: AdminUserId,
        role: AppRole,
    ) -> Result<Option<AppMembershipRow>, AppMembersRepositoryError>;
    /// Atomic role update. Returns `Some(row)` on success, `None` if no
    /// membership row exists. Lets PATCH return 404 without a separate
    /// `find` round-trip (no TOCTOU between check and update).
    async fn update_role(
        &self,
        app_id: AppId,
        user_id: AdminUserId,
        role: AppRole,
    ) -> Result<Option<AppMembershipRow>, AppMembersRepositoryError>;
    /// Remove a membership. No-op (Ok) when the row doesn't exist —
    /// the user wasn't a member, which is the desired post-condition.
    async fn remove(
@@ -78,6 +113,14 @@ pub trait AppMembersRepository: Send + Sync {
        &self,
        app_id: AppId,
    ) -> Result<Vec<AppMembershipRow>, AppMembersRepositoryError>;
    /// Like `list_for_app` but joined with `admin_users` so the
    /// dashboard can render member rows in one round-trip. Ordered by
    /// username for a stable list.
    async fn list_for_app_enriched(
        &self,
        app_id: AppId,
    ) -> Result<Vec<AppMembershipDetail>, AppMembersRepositoryError>;
 }
 pub struct PostgresAppMembersRepository {
@@ -143,6 +186,45 @@ impl AppMembersRepository for PostgresAppMembersRepository {
        Ok(())
    }
    async fn try_insert(
        &self,
        app_id: AppId,
        user_id: AdminUserId,
        role: AppRole,
    ) -> Result<Option<AppMembershipRow>, AppMembersRepositoryError> {
        let row = sqlx::query_as::<_, AppMembershipRecord>(
            "INSERT INTO app_members (app_id, user_id, role) \
             VALUES ($1, $2, $3) \
             ON CONFLICT (app_id, user_id) DO NOTHING \
             RETURNING app_id, user_id, role, created_at",
        )
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .bind(role.as_str())
        .fetch_optional(&self.pool)
        .await?;
        row.map(TryInto::try_into).transpose()
    }
    async fn update_role(
        &self,
        app_id: AppId,
        user_id: AdminUserId,
        role: AppRole,
    ) -> Result<Option<AppMembershipRow>, AppMembersRepositoryError> {
        let row = sqlx::query_as::<_, AppMembershipRecord>(
            "UPDATE app_members SET role = $1 \
             WHERE app_id = $2 AND user_id = $3 \
             RETURNING app_id, user_id, role, created_at",
        )
        .bind(role.as_str())
        .bind(app_id.into_inner())
        .bind(user_id.into_inner())
        .fetch_optional(&self.pool)
        .await?;
        row.map(TryInto::try_into).transpose()
    }
    async fn list_for_user(
        &self,
        user_id: AdminUserId,
@@ -172,6 +254,24 @@ impl AppMembersRepository for PostgresAppMembersRepository {
        .await?;
        rows.into_iter().map(TryInto::try_into).collect()
    }
    async fn list_for_app_enriched(
        &self,
        app_id: AppId,
    ) -> Result<Vec<AppMembershipDetail>, AppMembersRepositoryError> {
        let rows = sqlx::query_as::<_, AppMembershipDetailRecord>(
            "SELECT au.id, au.username, au.email, au.instance_role, au.is_active, \
                    am.role, am.created_at \
             FROM app_members am \
             JOIN admin_users au ON au.id = am.user_id \
             WHERE am.app_id = $1 \
             ORDER BY au.username",
        )
        .bind(app_id.into_inner())
        .fetch_all(&self.pool)
        .await?;
        rows.into_iter().map(TryInto::try_into).collect()
    }
 }
 /// Forwarding impl so the Postgres repo satisfies `AuthzRepo` directly
@@ -210,3 +310,31 @@ impl TryFrom<AppMembershipRecord> for AppMembershipRow {
        })
    }
 }
 #[derive(sqlx::FromRow)]
 struct AppMembershipDetailRecord {
    id: uuid::Uuid,
    username: String,
    email: Option<String>,
    instance_role: String,
    is_active: bool,
    role: String,
    created_at: DateTime<Utc>,
 }
 impl TryFrom<AppMembershipDetailRecord> for AppMembershipDetail {
    type Error = AppMembersRepositoryError;
    fn try_from(r: AppMembershipDetailRecord) -> Result<Self, Self::Error> {
        Ok(Self {
            user_id: r.id.into(),
            username: r.username,
            email: r.email,
            instance_role: InstanceRole::from_db_str(&r.instance_role)
                .ok_or(AppMembersRepositoryError::InvalidRole(r.instance_role))?,
            is_active: r.is_active,
            role: AppRole::from_db_str(&r.role)
                .ok_or(AppMembersRepositoryError::InvalidRole(r.role))?,
            created_at: r.created_at,
        })
    }
 }
--- a/crates/manager-core/src/app_repo.rs
+++ b/crates/manager-core/src/app_repo.rs
@@ -8,6 +8,7 @@
 use async_trait::async_trait;
 use picloud_shared::{AdminUserId, App, AppId};
 use sqlx::PgPool;
 use uuid::Uuid;
 use crate::repo::ScriptRepositoryError;
@@ -20,6 +21,32 @@ pub struct AppLookup {
    pub redirected: bool,
 }
 /// Resolve a free-form path param (UUID *or* slug *or* historical slug)
 /// to an `AppLookup`. UUID lookups never set `redirected`; slug lookups
 /// fall through to `app_slug_history` and set `redirected: true` when
 /// they hit it.
 ///
 /// Returns `Ok(None)` when nothing matches — callers map that to their
 /// own not-found error variant.
 ///
 /// # Errors
 /// Propagates any underlying repository error.
 pub async fn resolve_app(
    apps: &dyn AppRepository,
    ident: &str,
 ) -> Result<Option<AppLookup>, ScriptRepositoryError> {
    if let Ok(uuid) = ident.parse::<Uuid>() {
        return Ok(apps
            .get_by_id(AppId::from(uuid))
            .await?
            .map(|app| AppLookup {
                app,
                redirected: false,
            }));
    }
    apps.get_by_slug_or_history(ident).await
 }
 #[async_trait]
 pub trait AppRepository: Send + Sync {
    /// Every app on the instance. For owner/admin callers — `member`
--- a/crates/manager-core/src/apps_api.rs
+++ b/crates/manager-core/src/apps_api.rs
@@ -17,14 +17,14 @@ use axum::response::{IntoResponse, Json, Response};
 use axum::routing::{delete, get, post};
 use axum::{Extension, Router};
 use picloud_orchestrator_core::routing::{pattern, AppDomainTable, CompiledAppDomain};
-use picloud_shared::{App, AppDomain, AppId, InstanceRole, Principal};
+use picloud_shared::{App, AppDomain, AppId, AppRole, InstanceRole, Principal};
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use uuid::Uuid;
 use crate::app_domain_repo::{AppDomainRepository, NewAppDomain};
 use crate::app_repo::AppRepository;
-use crate::authz::{require, AuthzDenied, AuthzRepo, Capability};
+use crate::authz::{require, AuthzDenied, AuthzError, AuthzRepo, Capability};
 use crate::repo::ScriptRepositoryError;
 use crate::route_repo::RouteRepository;
@@ -141,6 +141,12 @@ pub struct AppLookupResponse {
    /// at the live slug so dashboards can redirect.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub redirect_to: Option<String>,
    /// The caller's role on this app, used by the dashboard to decide
    /// whether to render admin-only surfaces (Members tab, settings).
    /// `Owner` and `Admin` both map to `app_admin` (implicit per
    /// blueprint §11.6); `Member` carries its explicit
    /// `app_members.role`.
    pub my_role: Option<AppRole>,
 }
 // ----------------------------------------------------------------------------
@@ -209,12 +215,30 @@ async fn get_app(
    } else {
        None
    };
    let my_role = compute_my_role(s.authz.as_ref(), &principal, lookup.app.id).await?;
    Ok(Json(AppLookupResponse {
        app: lookup.app,
        redirect_to,
        my_role,
    }))
 }
 /// Compute the caller's effective `AppRole` on a specific app. Mirrors
 /// the implicit-grant logic in `authz::role_grants` but returns the
 /// role itself (for UI gating) rather than a yes/no decision. `Owner`
 /// and `Admin` are both implicit `AppAdmin` everywhere; `Member`
 /// consults `app_members`.
 async fn compute_my_role(
    authz: &dyn AuthzRepo,
    principal: &Principal,
    app_id: AppId,
 ) -> Result<Option<AppRole>, AppsApiError> {
    match principal.instance_role {
        InstanceRole::Owner | InstanceRole::Admin => Ok(Some(AppRole::AppAdmin)),
        InstanceRole::Member => Ok(authz.membership(principal.user_id, app_id).await?),
    }
 }
 async fn patch_app(
    State(s): State<AppsState>,
    Extension(principal): Extension<Principal>,
@@ -429,16 +453,7 @@ async fn resolve_app(
    apps: &dyn AppRepository,
    ident: &str,
 ) -> Result<crate::app_repo::AppLookup, AppsApiError> {
-    if let Ok(uuid) = ident.parse::<Uuid>() {
+    crate::app_repo::resolve_app(apps, ident)
        if let Some(app) = apps.get_by_id(AppId::from(uuid)).await? {
            return Ok(crate::app_repo::AppLookup {
                app,
                redirected: false,
            });
        }
        return Err(AppsApiError::AppNotFound(ident.to_string()));
    }
    apps.get_by_slug_or_history(ident)
        .await?
        .ok_or_else(|| AppsApiError::AppNotFound(ident.to_string()))
 }
@@ -546,6 +561,12 @@ impl From<AuthzDenied> for AppsApiError {
    }
 }
 impl From<AuthzError> for AppsApiError {
    fn from(e: AuthzError) -> Self {
        Self::AuthzRepo(e.to_string())
    }
 }
 impl IntoResponse for AppsApiError {
    fn into_response(self) -> Response {
        let (status, body) = match &self {
--- a/crates/manager-core/src/authz.rs
+++ b/crates/manager-core/src/authz.rs
@@ -199,21 +199,14 @@ async fn role_grants(
    }
 }
-/// Admin is implicit `editor` on every app (per blueprint §11.6). They
+/// Admin is implicit `app_admin` on every app (per blueprint §11.6).
-/// can create apps and manage users, but NOT touch instance-wide
+/// They can create apps, manage users, and take any app-scoped action
-/// settings or take app-admin-only actions on apps they're not
+/// on any app without an explicit `app_members` row — single-human
-/// explicitly app_admin of. Everything not in this set falls through
+/// installs would otherwise need to add themselves to every new app.
-/// to deny (`InstanceManageSettings`, `AppManageDomains`, `AppAdmin`).
+/// Only `InstanceManageSettings` (sandbox ceiling, etc.) stays
 /// owner-only.
 const fn admin_grants(cap: Capability) -> bool {
-    matches!(
+    !matches!(cap, Capability::InstanceManageSettings)
        cap,
        Capability::InstanceCreateApp
            | Capability::InstanceManageUsers
            | Capability::AppRead(_)
            | Capability::AppWriteScript(_)
            | Capability::AppWriteRoute(_)
            | Capability::AppLogRead(_)
    )
 }
 /// Member has zero instance authority. App authority requires an
@@ -357,10 +350,23 @@ mod tests {
    }
    #[tokio::test]
-    async fn admin_cannot_manage_instance_settings_or_app_admin_actions() {
+    async fn admin_cannot_manage_instance_settings() {
        let repo = InMemoryAuthzRepo::default();
        let p = principal(InstanceRole::Admin);
        assert_eq!(
            can(&repo, &p, Capability::InstanceManageSettings)
                .await
                .unwrap(),
            Decision::Deny,
        );
    }
    #[tokio::test]
    async fn admin_is_implicit_app_admin_on_every_app() {
        let repo = InMemoryAuthzRepo::default();
        let p = principal(InstanceRole::Admin);
        let app = AppId::new();
        // Instance-scoped allowances.
        assert_eq!(
            can(&repo, &p, Capability::InstanceCreateApp).await.unwrap(),
            Decision::Allow,
@@ -371,36 +377,22 @@ mod tests {
                .unwrap(),
            Decision::Allow,
        );
-        assert_eq!(
+        // Editor-like + app-admin grants both succeed without any
-            can(&repo, &p, Capability::InstanceManageSettings)
+        // app_members row.
-                .await
+        for cap in [
-                .unwrap(),
+            Capability::AppRead(app),
-            Decision::Deny,
+            Capability::AppWriteScript(app),
-        );
+            Capability::AppWriteRoute(app),
-        // Editor-like grants succeed
+            Capability::AppLogRead(app),
-        assert_eq!(
+            Capability::AppManageDomains(app),
-            can(&repo, &p, Capability::AppWriteScript(app))
+            Capability::AppAdmin(app),
-                .await
+        ] {
-                .unwrap(),
+            assert_eq!(
-            Decision::Allow,
+                can(&repo, &p, cap).await.unwrap(),
-        );
+                Decision::Allow,
-        assert_eq!(
+                "admin denied app-scoped capability {cap:?}"
-            can(&repo, &p, Capability::AppWriteRoute(app))
+            );
-                .await
+        }
                .unwrap(),
            Decision::Allow,
        );
        // App-admin grants do not
        assert_eq!(
            can(&repo, &p, Capability::AppManageDomains(app))
                .await
                .unwrap(),
            Decision::Deny,
        );
        assert_eq!(
            can(&repo, &p, Capability::AppAdmin(app)).await.unwrap(),
            Decision::Deny,
        );
    }
    #[tokio::test]
@@ -474,6 +466,29 @@ mod tests {
        );
    }
    /// Editors hold `AppWriteScript` (Save) but **not** `AppAdmin`
    /// (Delete). The script-delete handler gates on the latter so the
    /// API can't be tricked into letting an editor remove the script
    /// they were only allowed to edit.
    #[tokio::test]
    async fn editor_can_write_scripts_but_not_delete_them() {
        let repo = InMemoryAuthzRepo::default();
        let p = principal(InstanceRole::Member);
        let app = AppId::new();
        repo.grant(p.user_id, app, AppRole::Editor).await;
        assert!(can(&repo, &p, Capability::AppWriteScript(app))
            .await
            .unwrap()
            .is_allow());
        // Delete is gated on AppAdmin in the handler — editors must be
        // denied here for that gate to bite.
        assert_eq!(
            can(&repo, &p, Capability::AppAdmin(app)).await.unwrap(),
            Decision::Deny,
        );
    }
    #[tokio::test]
    async fn member_with_app_admin_role_can_do_app_admin_actions() {
        let repo = InMemoryAuthzRepo::default();
--- a/crates/manager-core/src/lib.rs
+++ b/crates/manager-core/src/lib.rs
@@ -12,6 +12,7 @@ pub mod api_key_repo;
 pub mod api_keys_api;
 pub mod app_bootstrap;
 pub mod app_domain_repo;
 pub mod app_members_api;
 pub mod app_members_repo;
 pub mod app_repo;
 pub mod apps_api;
@@ -45,10 +46,12 @@ pub use api_key_repo::{
 pub use api_keys_api::{api_keys_router, ApiKeysState};
 pub use app_bootstrap::{seed_hello_world_if_fresh, HelloWorldOutcome};
 pub use app_domain_repo::{AppDomainRepository, NewAppDomain, PostgresAppDomainRepository};
 pub use app_members_api::{app_members_router, AppMembersApiError, AppMembersState};
 pub use app_members_repo::{
-    AppMembersRepository, AppMembersRepositoryError, AppMembershipRow, PostgresAppMembersRepository,
+    AppMembersRepository, AppMembersRepositoryError, AppMembershipDetail, AppMembershipRow,
    PostgresAppMembersRepository,
 };
-pub use app_repo::{AppLookup, AppRepository, PostgresAppRepository};
+pub use app_repo::{resolve_app, AppLookup, AppRepository, PostgresAppRepository};
 pub use apps_api::{apps_router, AppsState};
 pub use auth_api::auth_router;
 pub use auth_bootstrap::{
--- a/crates/picloud-cli/Cargo.toml
+++ b/crates/picloud-cli/Cargo.toml
@@ -0,0 +1,31 @@
 [package]
 name = "picloud-cli"
 version.workspace = true
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
 repository.workspace = true
 authors.workspace = true
 description = "PiCloud command-line client"
 [[bin]]
 name = "pic"
 path = "src/main.rs"
 [dependencies]
 picloud-shared.workspace = true
 reqwest = { workspace = true, features = ["json"] }
 serde.workspace = true
 serde_json.workspace = true
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
 clap = { version = "4", features = ["derive"] }
 toml = "0.8"
 directories = "5"
 rpassword = "7"
 anyhow = "1"
 [dev-dependencies]
 assert_cmd = "2"
 predicates = "3"
 tempfile = "3"
 reqwest = { workspace = true, features = ["json", "blocking"] }
--- a/crates/picloud-cli/src/client.rs
+++ b/crates/picloud-cli/src/client.rs
@@ -0,0 +1,333 @@
 //! Reqwest-backed HTTP client + minimal wire DTOs.
 //!
 //! The CLI deliberately re-declares small request/response structs here
 //! rather than depending on `manager-core` (and pulling its Postgres
 //! transitive surface). Fields kept to what the CLI actually sends or
 //! reads.
 use std::collections::BTreeMap;
 use anyhow::{anyhow, Context, Result};
 use picloud_shared::{App, AppId, AppRole, ExecutionLog, InstanceRole, Script};
 use reqwest::{header, Method, RequestBuilder, StatusCode};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use crate::config::Credentials;
 pub struct Client {
    http: reqwest::Client,
    url: String,
    token: String,
 }
 impl Client {
    pub fn from_creds(creds: &Credentials) -> Result<Self> {
        Self::new(&creds.url, &creds.token)
    }
    pub fn new(url: &str, token: &str) -> Result<Self> {
        let http = reqwest::Client::builder()
            .user_agent(concat!("pic/", env!("CARGO_PKG_VERSION")))
            .build()
            .context("building HTTP client")?;
        Ok(Self {
            http,
            url: url.trim_end_matches('/').to_string(),
            token: token.to_string(),
        })
    }
    pub fn url(&self) -> &str {
        &self.url
    }
    fn request(&self, method: Method, path: &str) -> RequestBuilder {
        self.http
            .request(method, format!("{}{path}", self.url))
            .header(header::AUTHORIZATION, format!("Bearer {}", self.token))
    }
    /// `GET /api/v1/admin/auth/me`
    pub async fn auth_me(&self) -> Result<AuthMeDto> {
        let resp = self
            .request(Method::GET, "/api/v1/admin/auth/me")
            .send()
            .await?;
        decode(resp).await
    }
    /// `GET /api/v1/admin/apps`
    pub async fn apps_list(&self) -> Result<Vec<App>> {
        let resp = self
            .request(Method::GET, "/api/v1/admin/apps")
            .send()
            .await?;
        decode(resp).await
    }
    /// `GET /api/v1/admin/apps/{id_or_slug}` — slug or UUID accepted.
    pub async fn apps_get(&self, ident: &str) -> Result<AppLookupDto> {
        let resp = self
            .request(Method::GET, &format!("/api/v1/admin/apps/{ident}"))
            .send()
            .await?;
        decode(resp).await
    }
    /// `POST /api/v1/admin/apps`
    pub async fn apps_create(&self, body: &CreateAppBody<'_>) -> Result<App> {
        let resp = self
            .request(Method::POST, "/api/v1/admin/apps")
            .json(body)
            .send()
            .await?;
        decode(resp).await
    }
    /// `GET /api/v1/admin/scripts?app={ident}`
    pub async fn scripts_list_by_app(&self, ident: &str) -> Result<Vec<Script>> {
        let resp = self
            .request(
                Method::GET,
                &format!("/api/v1/admin/scripts?app={}", urlencoded(ident)),
            )
            .send()
            .await?;
        decode(resp).await
    }
    /// `POST /api/v1/admin/scripts`
    pub async fn scripts_create(&self, body: &CreateScriptBody<'_>) -> Result<Script> {
        let resp = self
            .request(Method::POST, "/api/v1/admin/scripts")
            .json(body)
            .send()
            .await?;
        decode(resp).await
    }
    /// `PUT /api/v1/admin/scripts/{id}` — matches the dashboard, which
    /// uses PUT despite the field-level update semantics.
    pub async fn scripts_update_source(&self, id: &str, source: &str) -> Result<Script> {
        let body = UpdateScriptBody { source };
        let resp = self
            .request(Method::PUT, &format!("/api/v1/admin/scripts/{id}"))
            .json(&body)
            .send()
            .await?;
        decode(resp).await
    }
    /// `POST /api/v1/execute/{id}` — returns the raw HTTP status, headers,
    /// and JSON body (the orchestrator marshals the script's output as
    /// the HTTP response itself, not a wrapper object).
    pub async fn execute(
        &self,
        id: &str,
        body: Value,
        headers: &[(String, String)],
    ) -> Result<ExecuteResponse> {
        let mut req = self
            .request(Method::POST, &format!("/api/v1/execute/{id}"))
            .json(&body);
        for (k, v) in headers {
            req = req.header(k, v);
        }
        let resp = req.send().await?;
        let status = resp.status().as_u16();
        let mut headers_out: BTreeMap<String, String> = BTreeMap::new();
        for (k, v) in resp.headers() {
            if let Ok(val) = v.to_str() {
                headers_out.insert(k.as_str().to_string(), val.to_string());
            }
        }
        let bytes = resp.bytes().await.context("reading execute response")?;
        let body_json: Value = if bytes.is_empty() {
            Value::Null
        } else {
            serde_json::from_slice(&bytes)
                .unwrap_or(Value::String(String::from_utf8_lossy(&bytes).into_owned()))
        };
        Ok(ExecuteResponse {
            status_code: status,
            headers: headers_out,
            body: body_json,
        })
    }
    /// `GET /api/v1/admin/scripts/{id}/logs?limit=N`
    pub async fn logs_list(&self, script_id: &str, limit: u32) -> Result<Vec<ExecutionLog>> {
        let resp = self
            .request(
                Method::GET,
                &format!("/api/v1/admin/scripts/{script_id}/logs?limit={limit}"),
            )
            .send()
            .await?;
        decode(resp).await
    }
 }
 // ---------- DTOs (CLI-local, wire-shape-matched) ----------
 #[allow(dead_code)]
 #[derive(Debug, Deserialize)]
 pub struct AuthMeDto {
    // Part of the wire shape (and kept for symmetry with the dashboard's
    // MeDto), even though the CLI never displays it.
    pub id: String,
    pub username: String,
    pub instance_role: InstanceRole,
    #[serde(default)]
    pub email: Option<String>,
 }
 #[allow(dead_code)]
 #[derive(Debug, Deserialize)]
 pub struct AppLookupDto {
    #[serde(flatten)]
    pub app: App,
    // Not surfaced yet — `pic apps ls` only shows what `apps_list` returns.
    // Kept on the DTO so future `pic apps inspect <slug>` work is one-line.
    #[serde(default)]
    pub my_role: Option<AppRole>,
 }
 #[derive(Debug, Serialize)]
 pub struct CreateAppBody<'a> {
    pub slug: &'a str,
    pub name: &'a str,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub description: Option<&'a str>,
 }
 #[derive(Debug, Serialize)]
 pub struct CreateScriptBody<'a> {
    pub app_id: AppId,
    pub name: &'a str,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub description: Option<&'a str>,
    pub source: &'a str,
 }
 #[derive(Debug, Serialize)]
 struct UpdateScriptBody<'a> {
    source: &'a str,
 }
 #[allow(dead_code)]
 #[derive(Debug)]
 pub struct ExecuteResponse {
    pub status_code: u16,
    // Captured for completeness; not displayed today, but `pic invoke -v`
    // could surface them later without changing this struct.
    pub headers: BTreeMap<String, String>,
    pub body: Value,
 }
 // ---------- helpers ----------
 /// Parse `-H "Key: value"` or `-H "Key=value"` into a `(name, value)`
 /// pair. Trims surrounding whitespace on both sides.
 pub fn parse_kv_header(raw: &str) -> Result<(String, String), String> {
    let (k, v) = raw
        .split_once(':')
        .or_else(|| raw.split_once('='))
        .ok_or_else(|| format!("expected `Key: value` or `Key=value`, got {raw:?}"))?;
    let k = k.trim();
    let v = v.trim();
    if k.is_empty() {
        return Err(format!("empty header name in {raw:?}"));
    }
    Ok((k.to_string(), v.to_string()))
 }
 fn urlencoded(s: &str) -> String {
    // Minimal pass: percent-encode the few chars that break the query.
    // Slugs and UUIDs don't contain them in practice, but be safe.
    let mut out = String::with_capacity(s.len());
    for ch in s.chars() {
        match ch {
            '&' | '=' | '?' | '#' | ' ' => {
                out.push_str(&format!("%{:02X}", u32::from(ch)));
            }
            _ => out.push(ch),
        }
    }
    out
 }
 async fn decode<T: for<'de> Deserialize<'de>>(resp: reqwest::Response) -> Result<T> {
    if resp.status().is_success() {
        return resp.json::<T>().await.context("parsing response body");
    }
    Err(server_error(resp).await)
 }
 async fn server_error(resp: reqwest::Response) -> anyhow::Error {
    let status = resp.status();
    let body = resp.text().await.unwrap_or_default();
    let msg = parse_error_body(&body).unwrap_or(body);
    let hint = role_hint(status);
    if hint.is_empty() {
        anyhow!("HTTP {}: {}", status.as_u16(), msg)
    } else {
        anyhow!("HTTP {}: {} ({})", status.as_u16(), msg, hint)
    }
 }
 fn parse_error_body(s: &str) -> Option<String> {
    let v: Value = serde_json::from_str(s).ok()?;
    let obj = v.as_object()?;
    if let Some(m) = obj.get("message").and_then(Value::as_str) {
        return Some(m.to_string());
    }
    if let Some(e) = obj.get("error").and_then(Value::as_str) {
        return Some(e.to_string());
    }
    None
 }
 fn role_hint(status: StatusCode) -> &'static str {
    match status {
        StatusCode::FORBIDDEN => "your role may lack the required capability; check `pic whoami`",
        StatusCode::UNAUTHORIZED => "token rejected; re-run `pic login`",
        _ => "",
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn parse_kv_colon() {
        let (k, v) = parse_kv_header("X-Foo: bar").unwrap();
        assert_eq!(k, "X-Foo");
        assert_eq!(v, "bar");
    }
    #[test]
    fn parse_kv_equals() {
        let (k, v) = parse_kv_header("X-Foo=bar").unwrap();
        assert_eq!(k, "X-Foo");
        assert_eq!(v, "bar");
    }
    #[test]
    fn parse_kv_rejects_no_separator() {
        assert!(parse_kv_header("X-Foo").is_err());
    }
    #[test]
    fn parse_kv_rejects_empty_name() {
        assert!(parse_kv_header(": bar").is_err());
    }
    #[test]
    fn url_strip_trailing_slash() {
        let c = Client::new("http://localhost:8000/", "pic_x").unwrap();
        assert_eq!(c.url(), "http://localhost:8000");
    }
 }
--- a/crates/picloud-cli/src/cmds/apps.rs
+++ b/crates/picloud-cli/src/cmds/apps.rs
@@ -0,0 +1,40 @@
 //! `pic apps ls` and `pic apps create`.
 use anyhow::Result;
 use crate::client::{Client, CreateAppBody};
 use crate::config::load;
 use crate::output::Table;
 pub async fn ls() -> Result<()> {
    let creds = load()?;
    let client = Client::from_creds(&creds)?;
    let apps = client.apps_list().await?;
    let mut table = Table::new(["slug", "name", "my_role", "created_at"]);
    for app in apps {
        // The list endpoint returns App without my_role. We do a per-app
        // lookup only on demand; for `ls` we leave the column dashed so
        // the call stays cheap (one HTTP request).
        table.row([
            app.slug.clone(),
            app.name.clone(),
            "-".to_string(),
            app.created_at.to_rfc3339(),
        ]);
    }
    table.print();
    Ok(())
 }
 pub async fn create(slug: &str, name: Option<&str>, description: Option<&str>) -> Result<()> {
    let creds = load()?;
    let client = Client::from_creds(&creds)?;
    let body = CreateAppBody {
        slug,
        name: name.unwrap_or(slug),
        description,
    };
    let app = client.apps_create(&body).await?;
    println!("Created app {}", app.slug);
    Ok(())
 }
--- a/crates/picloud-cli/src/cmds/login.rs
+++ b/crates/picloud-cli/src/cmds/login.rs
@@ -0,0 +1,66 @@
 //! `pic login` — interactively (or via PICLOUD_URL/PICLOUD_TOKEN env
 //! shortcut for non-interactive contexts like CI and integration tests)
 //! capture the URL + bearer token, validate against `/auth/me`, save.
 use std::io::{self, BufRead, Write};
 use anyhow::Result;
 use crate::client::Client;
 use crate::config::{save, Credentials};
 const DEFAULT_URL: &str = "http://localhost:8000";
 pub async fn run() -> Result<()> {
    let (url, token) = collect_credentials()?;
    let client = Client::new(&url, &token)?;
    let me = client.auth_me().await?;
    let creds = Credentials {
        url: client.url().to_string(),
        token,
        username: me.username.clone(),
    };
    save(&creds)?;
    println!(
        "Logged in as {} ({}) at {}",
        me.username,
        instance_role_label(&me.instance_role),
        creds.url
    );
    Ok(())
 }
 fn collect_credentials() -> Result<(String, String)> {
    // Non-interactive shortcut: both vars set → use as-is. Used by the
    // integration test and any CI flow that wants to skip the prompts.
    if let (Ok(url), Ok(tok)) = (std::env::var("PICLOUD_URL"), std::env::var("PICLOUD_TOKEN")) {
        if !url.is_empty() && !tok.is_empty() {
            return Ok((url, tok));
        }
    }
    let url = prompt_with_default("PiCloud URL", DEFAULT_URL)?;
    let token = rpassword::prompt_password("API token: ")?;
    Ok((url, token))
 }
 fn prompt_with_default(label: &str, default: &str) -> Result<String> {
    print!("{label} [{default}]: ");
    io::stdout().flush()?;
    let mut buf = String::new();
    io::stdin().lock().read_line(&mut buf)?;
    let trimmed = buf.trim();
    Ok(if trimmed.is_empty() {
        default.to_string()
    } else {
        trimmed.to_string()
    })
 }
 fn instance_role_label(role: &picloud_shared::InstanceRole) -> &'static str {
    use picloud_shared::InstanceRole as R;
    match role {
        R::Owner => "owner",
        R::Admin => "admin",
        R::Member => "member",
    }
 }
--- a/crates/picloud-cli/src/cmds/logs.rs
+++ b/crates/picloud-cli/src/cmds/logs.rs
@@ -0,0 +1,58 @@
 //! `pic logs <script-id>` — print recent execution log rows.
 use anyhow::Result;
 use picloud_shared::ExecutionStatus;
 use crate::client::Client;
 use crate::config::load;
 pub async fn run(script_id: &str, limit: u32) -> Result<()> {
    let creds = load()?;
    let client = Client::from_creds(&creds)?;
    let entries = client.logs_list(script_id, limit).await?;
    for e in entries {
        let summary = summarize(&e.response_body, &e.script_logs);
        println!(
            "{}\t{}\t{}",
            e.created_at.to_rfc3339(),
            status_label(&e.status),
            truncate(&summary, 120),
        );
    }
    Ok(())
 }
 fn status_label(s: &ExecutionStatus) -> &'static str {
    match s {
        ExecutionStatus::Success => "success",
        ExecutionStatus::Error => "error",
        ExecutionStatus::Timeout => "timeout",
        ExecutionStatus::BudgetExceeded => "budget_exceeded",
    }
 }
 fn summarize(response_body: &Option<serde_json::Value>, script_logs: &serde_json::Value) -> String {
    // Prefer the last script-side log line (often the most useful for
    // grepping). Fall back to the response body.
    if let Some(arr) = script_logs.as_array() {
        if let Some(last) = arr.last() {
            if let Some(msg) = last.get("message").and_then(|m| m.as_str()) {
                return msg.to_string();
            }
        }
    }
    response_body
        .as_ref()
        .map(ToString::to_string)
        .unwrap_or_else(|| "-".to_string())
 }
 fn truncate(s: &str, n: usize) -> String {
    let normalized = s.replace('\n', " ");
    if normalized.chars().count() <= n {
        normalized
    } else {
        let head: String = normalized.chars().take(n).collect();
        format!("{head}…")
    }
 }
--- a/crates/picloud-cli/src/cmds/mod.rs
+++ b/crates/picloud-cli/src/cmds/mod.rs
@@ -0,0 +1,5 @@
 pub mod apps;
 pub mod login;
 pub mod logs;
 pub mod scripts;
 pub mod whoami;
--- a/crates/picloud-cli/src/cmds/scripts.rs
+++ b/crates/picloud-cli/src/cmds/scripts.rs
@@ -0,0 +1,178 @@
 //! `pic scripts ls | deploy | invoke`.
 use std::io::{self, Read, Write};
 use std::path::Path;
 use anyhow::{anyhow, Context, Result};
 use serde_json::Value;
 use crate::client::{Client, CreateScriptBody};
 use crate::config::load;
 use crate::output::Table;
 pub async fn ls(app: Option<&str>) -> Result<()> {
    let creds = load()?;
    let client = Client::from_creds(&creds)?;
    let mut table = Table::new(["id", "app_slug", "name", "version", "updated_at"]);
    if let Some(ident) = app {
        let app = client.apps_get(ident).await?;
        let scripts = client.scripts_list_by_app(&app.app.slug).await?;
        for s in scripts {
            table.row([
                s.id.to_string(),
                app.app.slug.clone(),
                s.name,
                s.version.to_string(),
                s.updated_at.to_rfc3339(),
            ]);
        }
    } else {
        // No filter → walk every accessible app. One request per app is
        // fine at MVP scale (handful of apps); a bulk endpoint can come
        // later if the count grows.
        let apps = client.apps_list().await?;
        for a in apps {
            let scripts = client.scripts_list_by_app(&a.slug).await?;
            for s in scripts {
                table.row([
                    s.id.to_string(),
                    a.slug.clone(),
                    s.name,
                    s.version.to_string(),
                    s.updated_at.to_rfc3339(),
                ]);
            }
        }
    }
    table.print();
    Ok(())
 }
 pub async fn deploy(
    file: &Path,
    app_ident: &str,
    name_override: Option<&str>,
    description: Option<&str>,
 ) -> Result<()> {
    let creds = load()?;
    let client = Client::from_creds(&creds)?;
    let source =
        std::fs::read_to_string(file).with_context(|| format!("reading {}", file.display()))?;
    let name = match name_override {
        Some(n) => n.to_string(),
        None => file
            .file_stem()
            .and_then(|s| s.to_str())
            .map(str::to_string)
            .ok_or_else(|| {
                anyhow!(
                    "could not derive script name from path {} (use --name)",
                    file.display()
                )
            })?,
    };
    // Slug-or-id resolution: a single GET satisfies both lookups and
    // gives us the canonical app_id needed for create.
    let app = client.apps_get(app_ident).await?;
    let existing = client.scripts_list_by_app(app_ident).await?;
    if let Some(s) = existing.into_iter().find(|s| s.name == name) {
        let updated = client
            .scripts_update_source(&s.id.to_string(), &source)
            .await?;
        println!("Updated {} v{}", updated.name, updated.version);
    } else {
        let body = CreateScriptBody {
            app_id: app.app.id,
            name: &name,
            description,
            source: &source,
        };
        let created = client.scripts_create(&body).await?;
        println!("Created {} v{}", created.name, created.version);
    }
    Ok(())
 }
 pub async fn invoke(id: &str, body_arg: Option<&str>, headers: &[(String, String)]) -> Result<()> {
    let creds = load()?;
    let client = Client::from_creds(&creds)?;
    let body = parse_body_arg(body_arg)?;
    let resp = client.execute(id, body, headers).await?;
    // Status to stderr so stdout stays JSON for piping into jq.
    let _ = writeln!(io::stderr(), "<- HTTP {}", resp.status_code);
    let pretty = serde_json::to_string_pretty(&resp.body).unwrap_or_else(|_| resp.body.to_string());
    println!("{pretty}");
    if (200..400).contains(&resp.status_code) {
        Ok(())
    } else {
        Err(anyhow!("execute returned HTTP {}", resp.status_code))
    }
 }
 fn parse_body_arg(arg: Option<&str>) -> Result<Value> {
    match arg {
        None => Ok(Value::Object(serde_json::Map::new())),
        Some("@-") => {
            let mut buf = String::new();
            io::stdin()
                .read_to_string(&mut buf)
                .context("reading stdin")?;
            parse_or_string(&buf)
        }
        Some(raw) if raw.starts_with('@') => {
            let path = &raw[1..];
            let text = std::fs::read_to_string(path)
                .with_context(|| format!("reading body file {path}"))?;
            parse_or_string(&text)
        }
        Some(raw) => parse_or_string(raw),
    }
 }
 fn parse_or_string(s: &str) -> Result<Value> {
    let trimmed = s.trim();
    if trimmed.is_empty() {
        return Ok(Value::Object(serde_json::Map::new()));
    }
    serde_json::from_str(trimmed)
        .with_context(|| format!("body is not valid JSON: {}", truncate(trimmed, 80)))
 }
 fn truncate(s: &str, n: usize) -> String {
    if s.len() <= n {
        s.to_string()
    } else {
        format!("{}…", &s[..n])
    }
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn parse_body_inline_json() {
        let v = parse_body_arg(Some(r#"{"x":1}"#)).unwrap();
        assert_eq!(v["x"], 1);
    }
    #[test]
    fn parse_body_none_is_empty_object() {
        let v = parse_body_arg(None).unwrap();
        assert!(v.is_object());
        assert_eq!(v.as_object().unwrap().len(), 0);
    }
    #[test]
    fn parse_body_invalid_json_reports() {
        let err = parse_body_arg(Some("not-json{")).unwrap_err();
        let msg = format!("{err:#}");
        assert!(msg.contains("not valid JSON"), "got: {msg}");
    }
 }
--- a/crates/picloud-cli/src/cmds/whoami.rs
+++ b/crates/picloud-cli/src/cmds/whoami.rs
@@ -0,0 +1,22 @@
 //! `pic whoami` — re-validates the saved token by hitting `/auth/me`
 //! every time. Cached username in the credentials file is for
 //! display-only contexts; this command is the source of truth.
 use anyhow::Result;
 use crate::client::Client;
 use crate::config::load;
 pub async fn run() -> Result<()> {
    let creds = load()?;
    let client = Client::from_creds(&creds)?;
    let me = client.auth_me().await?;
    let role = match me.instance_role {
        picloud_shared::InstanceRole::Owner => "owner",
        picloud_shared::InstanceRole::Admin => "admin",
        picloud_shared::InstanceRole::Member => "member",
    };
    let email = me.email.as_deref().unwrap_or("-");
    println!("{}\t{role}\t{email}\t{}", me.username, creds.url);
    Ok(())
 }
--- a/crates/picloud-cli/src/config.rs
+++ b/crates/picloud-cli/src/config.rs
@@ -0,0 +1,118 @@
 //! On-disk credentials store.
 //!
 //! Path is resolved via `directories::ProjectDirs` so the file lives in
 //! the platform-appropriate config dir (XDG on Linux, Library on macOS,
 //! AppData on Windows). On POSIX the file is forced to mode 0600 so the
 //! pasted bearer token isn't world-readable.
 use std::fs;
 use std::io::Write;
 use std::path::{Path, PathBuf};
 use anyhow::{anyhow, Context, Result};
 use directories::ProjectDirs;
 use serde::{Deserialize, Serialize};
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct Credentials {
    pub url: String,
    pub token: String,
    pub username: String,
 }
 /// Resolve the credentials file path. Honors `PICLOUD_CONFIG_DIR` as an
 /// override (used by tests to redirect to a tempdir) before falling
 /// back to the platform default.
 pub fn credentials_path() -> Result<PathBuf> {
    if let Ok(dir) = std::env::var("PICLOUD_CONFIG_DIR") {
        return Ok(PathBuf::from(dir).join("credentials"));
    }
    let dirs = ProjectDirs::from("dev", "picloud", "picloud")
        .ok_or_else(|| anyhow!("could not determine config directory"))?;
    Ok(dirs.config_dir().join("credentials"))
 }
 pub fn load() -> Result<Credentials> {
    let path = credentials_path()?;
    let body = fs::read_to_string(&path).with_context(|| {
        format!(
            "no credentials at {}. run `pic login` first",
            path.display()
        )
    })?;
    toml::from_str(&body).with_context(|| format!("failed to parse {}", path.display()))
 }
 pub fn save(creds: &Credentials) -> Result<()> {
    let path = credentials_path()?;
    if let Some(parent) = path.parent() {
        fs::create_dir_all(parent).with_context(|| format!("creating {}", parent.display()))?;
    }
    let body = toml::to_string(creds).context("serializing credentials")?;
    write_private(&path, body.as_bytes())?;
    Ok(())
 }
 #[cfg(unix)]
 fn write_private(path: &Path, bytes: &[u8]) -> Result<()> {
    use std::os::unix::fs::OpenOptionsExt;
    let mut f = fs::OpenOptions::new()
        .write(true)
        .create(true)
        .truncate(true)
        .mode(0o600)
        .open(path)
        .with_context(|| format!("opening {}", path.display()))?;
    f.write_all(bytes)
        .with_context(|| format!("writing {}", path.display()))?;
    // Belt-and-suspenders: re-set perms in case the file already existed
    // with a wider mode (mode() on create doesn't downgrade existing).
    let mut perms = fs::metadata(path)?.permissions();
    use std::os::unix::fs::PermissionsExt;
    perms.set_mode(0o600);
    fs::set_permissions(path, perms)?;
    Ok(())
 }
 #[cfg(not(unix))]
 fn write_private(path: &Path, bytes: &[u8]) -> Result<()> {
    fs::write(path, bytes).with_context(|| format!("writing {}", path.display()))?;
    Ok(())
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    use tempfile::tempdir;
    #[test]
    fn roundtrip_toml() {
        let creds = Credentials {
            url: "http://localhost:8000".to_string(),
            token: "pic_abc".to_string(),
            username: "admin".to_string(),
        };
        let serialized = toml::to_string(&creds).unwrap();
        let parsed: Credentials = toml::from_str(&serialized).unwrap();
        assert_eq!(creds, parsed);
    }
    #[cfg(unix)]
    #[test]
    fn posix_mode_is_0600() {
        use std::os::unix::fs::PermissionsExt;
        let dir = tempdir().unwrap();
        std::env::set_var("PICLOUD_CONFIG_DIR", dir.path());
        let creds = Credentials {
            url: "http://localhost:8000".to_string(),
            token: "pic_secret".to_string(),
            username: "admin".to_string(),
        };
        save(&creds).unwrap();
        let path = credentials_path().unwrap();
        let mode = fs::metadata(&path).unwrap().permissions().mode() & 0o777;
        assert_eq!(mode, 0o600, "credentials must be readable only by owner");
        std::env::remove_var("PICLOUD_CONFIG_DIR");
    }
 }
--- a/crates/picloud-cli/src/main.rs
+++ b/crates/picloud-cli/src/main.rs
@@ -0,0 +1,142 @@
 //! PiCloud command-line client.
 //!
 //! Thin client over the existing admin + execute HTTP surface — the
 //! server gains nothing for the CLI; the CLI is just a developer
 //! ergonomics layer over endpoints the dashboard already uses.
 use std::path::PathBuf;
 use std::process::ExitCode;
 use clap::{Args, Parser, Subcommand};
 mod client;
 mod cmds;
 mod config;
 mod output;
 #[derive(Parser)]
 #[command(name = "pic", version, about = "PiCloud command-line client")]
 struct Cli {
    #[command(subcommand)]
    cmd: Cmd,
 }
 #[derive(Subcommand)]
 enum Cmd {
    /// Save URL + bearer token to `~/.picloud/credentials`.
    Login,
    /// Print the principal the saved token resolves to.
    Whoami,
    /// App management.
    Apps {
        #[command(subcommand)]
        cmd: AppsCmd,
    },
    /// Script management.
    Scripts {
        #[command(subcommand)]
        cmd: ScriptsCmd,
    },
    /// Tail recent execution logs for a script.
    Logs(LogsArgs),
 }
 #[derive(Subcommand)]
 enum AppsCmd {
    /// List apps the caller can see.
    Ls,
    /// Create a new app.
    Create {
        slug: String,
        #[arg(long)]
        name: Option<String>,
        #[arg(long)]
        description: Option<String>,
    },
 }
 #[derive(Subcommand)]
 enum ScriptsCmd {
    /// List scripts. With `--app`, scoped to one app; without,
    /// iterates over every app the caller can see.
    Ls {
        #[arg(long)]
        app: Option<String>,
    },
    /// Upload a `.rhai` file. Patches the existing script with the
    /// matching name in `--app` if one exists, otherwise creates it.
    Deploy {
        file: PathBuf,
        #[arg(long)]
        app: String,
        #[arg(long)]
        name: Option<String>,
        #[arg(long)]
        description: Option<String>,
    },
    /// POST to `/api/v1/execute/{id}`. Body via `--body @path`,
    /// `--body @-` for stdin, or inline JSON.
    Invoke {
        id: String,
        #[arg(long)]
        body: Option<String>,
        #[arg(short = 'H', long = "header", value_parser = client::parse_kv_header)]
        headers: Vec<(String, String)>,
    },
 }
 #[derive(Args)]
 struct LogsArgs {
    script_id: String,
    #[arg(long, default_value_t = 50)]
    limit: u32,
 }
 #[tokio::main(flavor = "current_thread")]
 async fn main() -> ExitCode {
    let cli = Cli::parse();
    let result = match cli.cmd {
        Cmd::Login => cmds::login::run().await,
        Cmd::Whoami => cmds::whoami::run().await,
        Cmd::Apps { cmd: AppsCmd::Ls } => cmds::apps::ls().await,
        Cmd::Apps {
            cmd:
                AppsCmd::Create {
                    slug,
                    name,
                    description,
                },
        } => cmds::apps::create(&slug, name.as_deref(), description.as_deref()).await,
        Cmd::Scripts {
            cmd: ScriptsCmd::Ls { app },
        } => cmds::scripts::ls(app.as_deref()).await,
        Cmd::Scripts {
            cmd:
                ScriptsCmd::Deploy {
                    file,
                    app,
                    name,
                    description,
                },
        } => cmds::scripts::deploy(&file, &app, name.as_deref(), description.as_deref()).await,
        Cmd::Scripts {
            cmd: ScriptsCmd::Invoke { id, body, headers },
        } => cmds::scripts::invoke(&id, body.as_deref(), &headers).await,
        Cmd::Logs(LogsArgs { script_id, limit }) => cmds::logs::run(&script_id, limit).await,
    };
    match result {
        Ok(()) => ExitCode::SUCCESS,
        Err(err) => {
            output::print_error(&err);
            ExitCode::FAILURE
        }
    }
 }
--- a/crates/picloud-cli/src/output.rs
+++ b/crates/picloud-cli/src/output.rs
@@ -0,0 +1,103 @@
 //! Tab-separated table writer + error formatting.
 //!
 //! Aligned columns are nice for humans but `\t`-separated stays
 //! pipe-friendly: `pic apps ls | awk -F'\t' '{print $1}'` works without
 //! parsing box-drawing.
 use std::io::{self, Write};
 pub struct Table {
    headers: Vec<String>,
    rows: Vec<Vec<String>>,
 }
 impl Table {
    pub fn new<I, S>(headers: I) -> Self
    where
        I: IntoIterator<Item = S>,
        S: Into<String>,
    {
        Self {
            headers: headers.into_iter().map(Into::into).collect(),
            rows: Vec::new(),
        }
    }
    pub fn row<I, S>(&mut self, cells: I) -> &mut Self
    where
        I: IntoIterator<Item = S>,
        S: Into<String>,
    {
        self.rows.push(cells.into_iter().map(Into::into).collect());
        self
    }
    pub fn render(&self) -> String {
        let mut widths: Vec<usize> = self.headers.iter().map(String::len).collect();
        for row in &self.rows {
            for (i, cell) in row.iter().enumerate() {
                if i >= widths.len() {
                    widths.push(cell.len());
                } else if cell.len() > widths[i] {
                    widths[i] = cell.len();
                }
            }
        }
        let mut out = String::new();
        write_row(&mut out, &self.headers, &widths);
        for row in &self.rows {
            write_row(&mut out, row, &widths);
        }
        out
    }
    pub fn print(&self) {
        let s = self.render();
        // Best-effort write — broken pipe from `| head` etc. shouldn't
        // surface as an error.
        let _ = io::stdout().write_all(s.as_bytes());
    }
 }
 fn write_row(out: &mut String, row: &[String], widths: &[usize]) {
    for (i, cell) in row.iter().enumerate() {
        if i > 0 {
            out.push('\t');
        }
        out.push_str(cell);
        // Right-pad with spaces so tabs land on the column grid for
        // human readers. Skip on the final column.
        if i + 1 < row.len() {
            let w = widths.get(i).copied().unwrap_or(cell.len());
            for _ in cell.len()..w {
                out.push(' ');
            }
        }
    }
    out.push('\n');
 }
 pub fn print_error(err: &anyhow::Error) {
    let mut stderr = io::stderr();
    let _ = writeln!(stderr, "error: {err:#}");
 }
 #[cfg(test)]
 mod tests {
    use super::*;
    #[test]
    fn table_aligns_columns() {
        let mut t = Table::new(["slug", "name"]);
        t.row(["a", "Alpha"]).row(["bravo", "B"]);
        let out = t.render();
        assert_eq!(out, "slug \tname\na    \tAlpha\nbravo\tB\n");
    }
    #[test]
    fn table_empty_rows() {
        let t = Table::new(["a", "b"]);
        assert_eq!(t.render(), "a\tb\n");
    }
 }
--- a/crates/picloud-cli/tests/cli.rs
+++ b/crates/picloud-cli/tests/cli.rs
@@ -0,0 +1,371 @@
 //! Bare-metal end-to-end integration test.
 //!
 //! Spawns a `picloud` subprocess against `DATABASE_URL` on a private
 //! port, logs in over HTTP to mint a bearer token, then drives the
 //! `pic` binary through the full edit-deploy-invoke-tail loop and
 //! cleans up the app it created.
 //!
 //! Gated on `DATABASE_URL`. To run:
 //!
 //!   docker compose up -d postgres
 //!   DATABASE_URL=postgres://picloud:picloud@127.0.0.1:15432/picloud \
 //!     cargo test -p picloud-cli --test cli -- --include-ignored
 #![allow(clippy::too_many_lines)]
 use std::io::{BufRead, BufReader};
 use std::path::PathBuf;
 use std::process::{Child, Command as StdCommand, Stdio};
 use std::sync::mpsc;
 use std::thread;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 use assert_cmd::Command as AssertCommand;
 use predicates::prelude::*;
 use serde_json::Value;
 use tempfile::TempDir;
 // The bootstrap env vars are inert once any admin row exists, so we
 // can't carve out a dedicated test admin against the dev database. The
 // dev stack seeds `admin`/`admin` (see CLAUDE.md); we use those.
 // `PICLOUD_CLI_E2E_USERNAME` / `_PASSWORD` let CI override.
 fn admin_username() -> String {
    std::env::var("PICLOUD_CLI_E2E_USERNAME").unwrap_or_else(|_| "admin".to_string())
 }
 fn admin_password() -> String {
    std::env::var("PICLOUD_CLI_E2E_PASSWORD").unwrap_or_else(|_| "admin".to_string())
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[test]
 fn end_to_end_login_deploy_invoke_logs() {
    let Ok(database_url) = std::env::var("DATABASE_URL") else {
        eprintln!("skipping: DATABASE_URL not set");
        return;
    };
    let port = pick_free_port();
    let url = format!("http://127.0.0.1:{port}");
    let mut server = spawn_picloud(&database_url, port);
    if let Err(e) = wait_for_health(&url, Duration::from_secs(60)) {
        kill_subprocess(&mut server);
        panic!("picloud failed to become healthy: {e}");
    }
    let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
        run_flow(&url);
    }));
    // Always tear down regardless of outcome so a failed test doesn't
    // leak a child process.
    kill_subprocess(&mut server);
    if let Err(p) = outcome {
        std::panic::resume_unwind(p);
    }
 }
 fn run_flow(url: &str) {
    let token = login_for_bearer_token(url);
    let cfg_dir = TempDir::new().expect("tempdir");
    let home = TempDir::new().expect("home tempdir");
    let env = TestEnv {
        url: url.to_string(),
        token,
        config_dir: cfg_dir.path().to_path_buf(),
        home: home.path().to_path_buf(),
    };
    // Slug carries the wall-clock so reruns against a long-lived dev
    // database don't collide on the unique-slug constraint.
    let slug = format!(
        "pic-cli-e2e-{}",
        SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .unwrap()
            .as_millis()
    );
    let username = admin_username();
    // 1) login
    pic(&env)
        .args(["login"])
        .assert()
        .success()
        .stdout(predicate::str::contains(format!("Logged in as {username}")));
    let creds_path = env.config_dir.join("credentials");
    assert!(
        creds_path.exists(),
        "credentials file should exist after login"
    );
    let body = std::fs::read_to_string(&creds_path).unwrap();
    assert!(body.contains(&env.url), "creds should contain url: {body}");
    assert!(
        body.contains(&username),
        "creds should contain username: {body}"
    );
    // 2) whoami
    pic(&env)
        .args(["whoami"])
        .assert()
        .success()
        .stdout(predicate::str::contains(username.clone()));
    // 3) apps create
    pic(&env)
        .args(["apps", "create", &slug])
        .assert()
        .success()
        .stdout(predicate::str::contains(format!("Created app {slug}")));
    // Ensure the app is cleaned up no matter what subsequent assertions do.
    let _guard = AppGuard {
        url: env.url.clone(),
        token: env.token.clone(),
        slug: slug.clone(),
    };
    // 4) apps ls
    pic(&env)
        .args(["apps", "ls"])
        .assert()
        .success()
        .stdout(predicate::str::contains(slug.as_str()));
    // 5) scripts deploy (create then update)
    let fixture = fixture_path("hello.rhai");
    pic(&env)
        .args([
            "scripts",
            "deploy",
            fixture.to_str().unwrap(),
            "--app",
            &slug,
        ])
        .assert()
        .success()
        .stdout(predicate::str::contains("Created hello v1"));
    pic(&env)
        .args([
            "scripts",
            "deploy",
            fixture.to_str().unwrap(),
            "--app",
            &slug,
        ])
        .assert()
        .success()
        .stdout(predicate::str::contains("Updated hello v2"));
    // 6) scripts ls and capture the id
    let ls_out = pic(&env)
        .args(["scripts", "ls", "--app", &slug])
        .output()
        .expect("scripts ls");
    assert!(ls_out.status.success(), "scripts ls failed: {ls_out:?}");
    let id = parse_first_id(std::str::from_utf8(&ls_out.stdout).unwrap())
        .expect("scripts ls should print at least one row");
    // 7) invoke
    let invoke_out = pic(&env)
        .args(["scripts", "invoke", &id])
        .output()
        .expect("scripts invoke");
    assert!(
        invoke_out.status.success(),
        "invoke failed: {}",
        String::from_utf8_lossy(&invoke_out.stderr)
    );
    let parsed: Value =
        serde_json::from_slice(&invoke_out.stdout).expect("invoke stdout should be JSON");
    assert_eq!(
        parsed["ok"], true,
        "expected hello.rhai response, got {parsed}"
    );
    // 8) logs (the invoke above should have produced exactly one row)
    let logs_out = pic(&env).args(["logs", &id]).output().expect("pic logs");
    assert!(logs_out.status.success(), "logs failed: {logs_out:?}");
    let stdout = String::from_utf8_lossy(&logs_out.stdout);
    assert!(
        stdout.lines().any(|l| !l.trim().is_empty()),
        "logs should have at least one row, got: {stdout}"
    );
 }
 // --------------------------------------------------------------------
 // Helpers
 // --------------------------------------------------------------------
 struct TestEnv {
    url: String,
    token: String,
    config_dir: PathBuf,
    home: PathBuf,
 }
 fn pic(env: &TestEnv) -> AssertCommand {
    let mut cmd = AssertCommand::cargo_bin("pic").expect("pic binary");
    cmd.env("PICLOUD_URL", &env.url)
        .env("PICLOUD_TOKEN", &env.token)
        .env("PICLOUD_CONFIG_DIR", &env.config_dir)
        .env("HOME", &env.home);
    cmd
 }
 fn fixture_path(name: &str) -> PathBuf {
    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
        .join("tests")
        .join("fixtures")
        .join(name)
 }
 fn picloud_binary_path() -> PathBuf {
    // The integration test binary lives at
    // `<target>/debug/deps/cli-<hash>`. CARGO_MANIFEST_DIR points at the
    // crate; the workspace target dir is two levels up. `picloud` lands
    // next to our own test executable.
    let exe = std::env::current_exe().expect("current_exe");
    // current_exe is `.../target/debug/deps/cli-<hash>`. Walk up twice
    // to reach `.../target/debug`, then look for `picloud`.
    let debug_dir = exe
        .parent()
        .and_then(|p| p.parent())
        .expect("test binary should live under target/debug/deps");
    debug_dir.join(if cfg!(windows) {
        "picloud.exe"
    } else {
        "picloud"
    })
 }
 fn pick_free_port() -> u16 {
    // Bind to :0, read the assigned port, drop the listener.
    let listener =
        std::net::TcpListener::bind("127.0.0.1:0").expect("bind 127.0.0.1:0 to pick port");
    listener.local_addr().expect("local addr").port()
 }
 fn spawn_picloud(database_url: &str, port: u16) -> Child {
    // Execute the pre-built `picloud` binary directly. Going through
    // `cargo run -p picloud` while inside `cargo test` would contend on
    // the same build lock and can deadlock. We assume the binary was
    // built as part of the workspace compile that produced this test —
    // and check explicitly so the panic is informative if not.
    let binary = picloud_binary_path();
    assert!(
        binary.exists(),
        "expected picloud binary at {}. Run `cargo build -p picloud` first \
         (or use `cargo test --workspace -- --include-ignored` which builds it)",
        binary.display()
    );
    let mut child = StdCommand::new(&binary)
        .env("PICLOUD_BIND", format!("127.0.0.1:{port}"))
        .env("DATABASE_URL", database_url)
        .env("PICLOUD_ADMIN_USERNAME", admin_username())
        .env("PICLOUD_ADMIN_PASSWORD", admin_password())
        .env("RUST_LOG", "warn")
        .stdout(Stdio::null())
        .stderr(Stdio::piped())
        .spawn()
        .expect("spawn picloud");
    // Drain stderr in a side thread so the pipe buffer doesn't fill and
    // block the server. We only echo to test output on failure.
    if let Some(err) = child.stderr.take().map(BufReader::new) {
        let (tx, _rx) = mpsc::channel::<String>();
        thread::spawn(move || {
            for line in err.lines().map_while(Result::ok) {
                let _ = tx.send(line);
            }
        });
    }
    child
 }
 fn wait_for_health(url: &str, timeout: Duration) -> Result<(), String> {
    let deadline = Instant::now() + timeout;
    let client = reqwest::blocking::Client::builder()
        .timeout(Duration::from_secs(2))
        .build()
        .map_err(|e| e.to_string())?;
    while Instant::now() < deadline {
        if let Ok(resp) = client.get(format!("{url}/healthz")).send() {
            if resp.status().is_success() {
                return Ok(());
            }
        }
        thread::sleep(Duration::from_millis(250));
    }
    Err(format!("/healthz never returned 200 within {timeout:?}"))
 }
 fn login_for_bearer_token(url: &str) -> String {
    let client = reqwest::blocking::Client::new();
    let resp = client
        .post(format!("{url}/api/v1/admin/auth/login"))
        .json(&serde_json::json!({
            "username": admin_username(),
            "password": admin_password(),
        }))
        .send()
        .expect("login request");
    assert!(
        resp.status().is_success(),
        "login should succeed, got {}: {}",
        resp.status(),
        resp.text().unwrap_or_default()
    );
    let v: Value = resp.json().expect("login json");
    v["token"]
        .as_str()
        .expect("login returns token")
        .to_string()
 }
 fn parse_first_id(table: &str) -> Option<String> {
    // The header line starts with "id"; the first row's first
    // tab-delimited cell is the script UUID.
    let mut lines = table.lines().filter(|l| !l.trim().is_empty());
    let header = lines.next()?;
    if !header.starts_with("id") {
        return None;
    }
    let row = lines.next()?;
    let first = row.split('\t').next()?.trim();
    if first.is_empty() {
        None
    } else {
        Some(first.to_string())
    }
 }
 fn kill_subprocess(child: &mut Child) {
    let _ = child.kill();
    let _ = child.wait();
 }
 struct AppGuard {
    url: String,
    token: String,
    slug: String,
 }
 impl Drop for AppGuard {
    fn drop(&mut self) {
        let client = reqwest::blocking::Client::new();
        let _ = client
            .delete(format!(
                "{}/api/v1/admin/apps/{}?force=true",
                self.url, self.slug
            ))
            .bearer_auth(&self.token)
            .send();
    }
 }
--- a/crates/picloud-cli/tests/fixtures/hello.rhai
+++ b/crates/picloud-cli/tests/fixtures/hello.rhai
@@ -0,0 +1,4 @@
 // Smallest possible Rhai script for the integration test: returns a JSON
 // object so the orchestrator wraps it as the HTTP response body.
 let body = #{ ok: true, greeting: "hello from pic" };
 body
--- a/crates/picloud/src/lib.rs
+++ b/crates/picloud/src/lib.rs
@@ -10,14 +10,15 @@ use axum::middleware::from_fn_with_state;
 use axum::{routing::get, Json, Router};
 use picloud_executor_core::{Engine, Limits};
 use picloud_manager_core::{
-    admin_router, admins_router, api_keys_router, apps_api, apps_router, auth_router,
+    admin_router, admins_router, api_keys_router, app_members_router, apps_api, apps_router,
-    compile_routes, migrations, require_authenticated, route_admin_router, AdminSessionRepository,
+    auth_router, compile_routes, migrations, require_authenticated, route_admin_router,
-    AdminState, AdminUserRepository, AdminsState, ApiKeyRepository, ApiKeysState,
+    AdminSessionRepository, AdminState, AdminUserRepository, AdminsState, ApiKeyRepository,
-    AppDomainRepository, AppRepository, AppsState, AuthState, AuthzRepo,
+    ApiKeysState, AppDomainRepository, AppMembersRepository, AppMembersState, AppRepository,
-    PostgresAdminSessionRepository, PostgresAdminUserRepository, PostgresApiKeyRepository,
+    AppsState, AuthState, AuthzRepo, PostgresAdminSessionRepository, PostgresAdminUserRepository,
-    PostgresAppDomainRepository, PostgresAppMembersRepository, PostgresAppRepository,
+    PostgresApiKeyRepository, PostgresAppDomainRepository, PostgresAppMembersRepository,
-    PostgresExecutionLogRepository, PostgresExecutionLogSink, PostgresRouteRepository,
+    PostgresAppRepository, PostgresExecutionLogRepository, PostgresExecutionLogSink,
-    PostgresScriptRepository, RepoResolver, RouteAdminState, RouteRepository, SandboxCeiling,
+    PostgresRouteRepository, PostgresScriptRepository, RepoResolver, RouteAdminState,
    RouteRepository, SandboxCeiling,
 };
 use picloud_orchestrator_core::routing::{AppDomainTable, RouteTable};
 use picloud_orchestrator_core::{
@@ -79,6 +80,7 @@ fn read_session_ttl() -> Duration {
 /// the `require_admin` middleware. The data plane
 /// (`/api/v1/execute/{id}`, the user-route fallthrough, `/healthz`,
 /// `/version`) stays open — it's the public ingress for user scripts.
 #[allow(clippy::too_many_lines)]
 pub async fn build_app(pool: PgPool, auth: AuthDeps) -> anyhow::Result<Router> {
    let engine = Arc::new(Engine::new(Limits::default()));
@@ -89,9 +91,13 @@ pub async fn build_app(pool: PgPool, auth: AuthDeps) -> anyhow::Result<Router> {
    let apps_repo: Arc<dyn AppRepository> = Arc::new(PostgresAppRepository::new(pool.clone()));
    let domains_repo: Arc<dyn AppDomainRepository> =
        Arc::new(PostgresAppDomainRepository::new(pool.clone()));
-    // Authz: app_members repo doubles as the AuthzRepo impl for the
+    // The Postgres app_members repo implements both `AppMembersRepository`
-    // per-handler capability checks introduced in Phase 3.5.
+    // (CRUD over the table) and `AuthzRepo` (single-row membership lookup
-    let authz: Arc<dyn AuthzRepo> = Arc::new(PostgresAppMembersRepository::new(pool));
+    // for capability checks). Construct it once and clone the Arc into
    // both trait views — same allocation, two vtables.
    let members_concrete = Arc::new(PostgresAppMembersRepository::new(pool));
    let members: Arc<dyn AppMembersRepository> = members_concrete.clone();
    let authz: Arc<dyn AuthzRepo> = members_concrete;
    // Compile the routes table once at startup; admin writes refresh it.
    let route_table = Arc::new(RouteTable::new());
@@ -159,9 +165,15 @@ pub async fn build_app(pool: PgPool, auth: AuthDeps) -> anyhow::Result<Router> {
        ttl: auth.ttl,
    };
    let admins_state = AdminsState {
-        users: auth.users,
+        users: auth.users.clone(),
        sessions: auth.sessions,
        keys: auth.keys.clone(),
        authz: authz.clone(),
    };
    let app_members_state = AppMembersState {
        apps: apps_state.apps.clone(),
        users: auth.users,
        members,
        authz,
    };
    let api_keys_state = ApiKeysState { keys: auth.keys };
@@ -177,6 +189,7 @@ pub async fn build_app(pool: PgPool, auth: AuthDeps) -> anyhow::Result<Router> {
        .merge(route_admin_router(route_admin))
        .merge(admins_router(admins_state))
        .merge(apps_router(apps_state))
        .merge(app_members_router(app_members_state))
        .merge(api_keys_router(api_keys_state))
        .layer(from_fn_with_state(
            auth_state.clone(),
--- a/crates/picloud/tests/authz.rs
+++ b/crates/picloud/tests/authz.rs
@@ -160,6 +160,72 @@ async fn mint_key(server: &TestServer, cred_token: &str, body: Value) -> axum_te
        .await
 }
 // --- app members helpers ----------------------------------------------------
 async fn list_members(
    server: &TestServer,
    token: &str,
    app_ident: &str,
 ) -> axum_test::TestResponse {
    server
        .get(&format!("/api/v1/admin/apps/{app_ident}/members"))
        .add_header("authorization", format!("Bearer {token}"))
        .await
 }
 async fn add_member(
    server: &TestServer,
    token: &str,
    app_ident: &str,
    user_id: AdminUserId,
    role: AppRole,
 ) -> axum_test::TestResponse {
    server
        .post(&format!("/api/v1/admin/apps/{app_ident}/members"))
        .add_header("authorization", format!("Bearer {token}"))
        .json(&json!({ "user_id": user_id, "role": role.as_str() }))
        .await
 }
 async fn patch_member_role(
    server: &TestServer,
    token: &str,
    app_ident: &str,
    user_id: AdminUserId,
    role: AppRole,
 ) -> axum_test::TestResponse {
    server
        .patch(&format!("/api/v1/admin/apps/{app_ident}/members/{user_id}",))
        .add_header("authorization", format!("Bearer {token}"))
        .json(&json!({ "role": role.as_str() }))
        .await
 }
 async fn remove_member(
    server: &TestServer,
    token: &str,
    app_ident: &str,
    user_id: AdminUserId,
 ) -> axum_test::TestResponse {
    server
        .delete(&format!("/api/v1/admin/apps/{app_ident}/members/{user_id}",))
        .add_header("authorization", format!("Bearer {token}"))
        .await
 }
 /// Direct-DB inactive-user seed — the create-then-deactivate dance
 /// through the API is more ceremony than the test needs.
 async fn seed_inactive_user(pool: &PgPool, username: &str, password: &str) -> AdminUserId {
    let repo = PostgresAdminUserRepository::new(pool.clone());
    let hash = hash_password(password).expect("hash");
    let row = repo
        .create(username, &hash, InstanceRole::Member, None)
        .await
        .expect("seed user");
    repo.set_active(row.id, false).await.expect("deactivate");
    row.id
 }
 // ----------------------------------------------------------------------------
 // 1. Bootstrap admin → owner
 // ----------------------------------------------------------------------------
@@ -227,7 +293,7 @@ async fn owner_access_matrix(pool: PgPool) {
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
-async fn admin_can_manage_users_but_not_app_admin_settings(pool: PgPool) {
+async fn admin_is_implicit_app_admin_on_every_app(pool: PgPool) {
    let s = boot(pool.clone()).await;
    seed_user(&s.pool, "alice", "alice-pw", InstanceRole::Admin).await;
    let token = login_token(&s.server, "alice", "alice-pw").await;
@@ -239,24 +305,34 @@ async fn admin_can_manage_users_but_not_app_admin_settings(pool: PgPool) {
        .await
        .assert_status_ok();
-    // Allowed: read default app (admin is implicit editor everywhere).
+    // Allowed: read default app — admin is implicit app_admin
    // everywhere (per blueprint §11.6).
    s.server
        .get("/api/v1/admin/apps/default")
        .add_header("authorization", format!("Bearer {token}"))
        .await
        .assert_status_ok();
-    // Allowed: write scripts (implicit editor).
+    // Allowed: write scripts.
    let script = create_script_via_api(&s.server, &token, s.default_app, "admin-write").await;
    assert!(script["id"].is_string());
-    // Denied: delete the default app (AppAdmin only).
+    // Allowed: list app members (AppAdmin gate). Pre-3.5.x this
-    let denied = s
+    // 403'd; now it's the same allow as the owner sees.
-        .server
+    s.server
-        .delete("/api/v1/admin/apps/default")
+        .get("/api/v1/admin/apps/default/members")
        .add_header("authorization", format!("Bearer {token}"))
-        .await;
+        .await
-    assert_eq!(denied.status_code(), axum::http::StatusCode::FORBIDDEN);
+        .assert_status_ok();
    // Allowed: delete the default app (AppAdmin). ?force=true because
    // the script we created above pushes us past the soft no-cascade
    // guard — this test is about the capability, not the cascade.
    s.server
        .delete("/api/v1/admin/apps/default?force=true")
        .add_header("authorization", format!("Bearer {token}"))
        .await
        .assert_status(axum::http::StatusCode::NO_CONTENT);
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
@@ -645,3 +721,389 @@ async fn list_active_owners_drives_the_multi_owner_warning(pool: PgPool) {
        .expect("count");
    assert_eq!(remaining, 1, "one other owner should remain (owner2)");
 }
 // ----------------------------------------------------------------------------
 // 12. `my_role` on GET /apps/{id_or_slug} reflects the caller's effective role
 // ----------------------------------------------------------------------------
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn my_role_field_matches_caller_role(pool: PgPool) {
    let s = boot(pool).await;
    // Owner → implicit app_admin everywhere.
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let r = s
        .server
        .get("/api/v1/admin/apps/default")
        .add_header("authorization", format!("Bearer {owner_token}"))
        .await;
    r.assert_status_ok();
    assert_eq!(
        r.json::<Value>()["my_role"].as_str(),
        Some("app_admin"),
        "owner reports app_admin"
    );
    // Admin → implicit app_admin everywhere (post-§11.6 update).
    seed_user(&s.pool, "alice", "alice-pw", InstanceRole::Admin).await;
    let admin_token = login_token(&s.server, "alice", "alice-pw").await;
    let r = s
        .server
        .get("/api/v1/admin/apps/default")
        .add_header("authorization", format!("Bearer {admin_token}"))
        .await;
    r.assert_status_ok();
    assert_eq!(
        r.json::<Value>()["my_role"].as_str(),
        Some("app_admin"),
        "admin reports app_admin"
    );
    // Member with explicit `viewer` membership → viewer.
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    grant_membership(&s.pool, bob, s.default_app, AppRole::Viewer).await;
    let bob_token = login_token(&s.server, "bob", "bob-pw").await;
    let r = s
        .server
        .get("/api/v1/admin/apps/default")
        .add_header("authorization", format!("Bearer {bob_token}"))
        .await;
    r.assert_status_ok();
    assert_eq!(
        r.json::<Value>()["my_role"].as_str(),
        Some("viewer"),
        "member with viewer row reports viewer"
    );
 }
 // ----------------------------------------------------------------------------
 // 13. App members CRUD — `/api/v1/admin/apps/{id_or_slug}/members[/{user_id}]`
 // ----------------------------------------------------------------------------
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn list_members_includes_seeded_member(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    grant_membership(&s.pool, bob, s.default_app, AppRole::Viewer).await;
    let r = list_members(&s.server, &owner_token, "default").await;
    r.assert_status_ok();
    let rows = r.json::<Vec<Value>>();
    let bob_row = rows
        .iter()
        .find(|v| v["username"] == "bob")
        .expect("bob in list");
    assert_eq!(bob_row["role"], "viewer");
    assert_eq!(bob_row["instance_role"], "member");
    assert_eq!(bob_row["is_active"], true);
    assert!(bob_row["created_at"].is_string(), "carries created_at");
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn list_members_requires_app_admin(pool: PgPool) {
    let s = boot(pool).await;
    // Bob has explicit editor on default app — enough to read scripts,
    // not enough to see the member list.
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    grant_membership(&s.pool, bob, s.default_app, AppRole::Editor).await;
    let bob_token = login_token(&s.server, "bob", "bob-pw").await;
    let r = list_members(&s.server, &bob_token, "default").await;
    r.assert_status(axum::http::StatusCode::FORBIDDEN);
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn add_member_creates_row(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    let r = add_member(&s.server, &owner_token, "default", bob, AppRole::Viewer).await;
    r.assert_status(axum::http::StatusCode::CREATED);
    let body = r.json::<Value>();
    assert_eq!(body["username"], "bob");
    assert_eq!(body["role"], "viewer");
    assert_eq!(body["instance_role"], "member");
    // Visible on subsequent list.
    let rows = list_members(&s.server, &owner_token, "default")
        .await
        .json::<Vec<Value>>();
    assert!(rows.iter().any(|v| v["username"] == "bob"));
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn add_member_duplicate_returns_409(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    grant_membership(&s.pool, bob, s.default_app, AppRole::Viewer).await;
    let r = add_member(&s.server, &owner_token, "default", bob, AppRole::Editor).await;
    r.assert_status(axum::http::StatusCode::CONFLICT);
    let err = r.json::<Value>()["error"]
        .as_str()
        .expect("error message")
        .to_string();
    assert!(err.contains("already a member"), "got: {err}");
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn add_member_inactive_user_returns_422(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_inactive_user(&s.pool, "bob", "bob-pw").await;
    let r = add_member(&s.server, &owner_token, "default", bob, AppRole::Viewer).await;
    r.assert_status(axum::http::StatusCode::UNPROCESSABLE_ENTITY);
    let err = r.json::<Value>()["error"]
        .as_str()
        .expect("error message")
        .to_string();
    assert!(err.contains("deactivated"), "got: {err}");
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn add_member_admin_target_returns_422(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let alice = seed_user(&s.pool, "alice", "alice-pw", InstanceRole::Admin).await;
    let r = add_member(&s.server, &owner_token, "default", alice, AppRole::Viewer).await;
    r.assert_status(axum::http::StatusCode::UNPROCESSABLE_ENTITY);
    let err = r.json::<Value>()["error"]
        .as_str()
        .expect("error message")
        .to_string();
    assert!(err.contains("implicit access"), "got: {err}");
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn add_member_owner_target_returns_422(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let other_owner = seed_user(&s.pool, "owner2", "ow2-pw", InstanceRole::Owner).await;
    let r = add_member(
        &s.server,
        &owner_token,
        "default",
        other_owner,
        AppRole::Viewer,
    )
    .await;
    r.assert_status(axum::http::StatusCode::UNPROCESSABLE_ENTITY);
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn patch_member_promotes_role(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    grant_membership(&s.pool, bob, s.default_app, AppRole::Viewer).await;
    let r = patch_member_role(&s.server, &owner_token, "default", bob, AppRole::Editor).await;
    r.assert_status_ok();
    assert_eq!(r.json::<Value>()["role"], "editor");
    // Editor can now create a script (capability promotion observable
    // end-to-end, not just via the role string).
    let bob_token = login_token(&s.server, "bob", "bob-pw").await;
    create_script_via_api(&s.server, &bob_token, s.default_app, "bob-script").await;
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn patch_member_without_existing_returns_404(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    // No grant yet — PATCH must 404.
    let r = patch_member_role(&s.server, &owner_token, "default", bob, AppRole::Editor).await;
    r.assert_status(axum::http::StatusCode::NOT_FOUND);
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn patch_member_same_role_is_idempotent(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    grant_membership(&s.pool, bob, s.default_app, AppRole::Viewer).await;
    let r = patch_member_role(&s.server, &owner_token, "default", bob, AppRole::Viewer).await;
    r.assert_status_ok();
    assert_eq!(r.json::<Value>()["role"], "viewer");
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn delete_member_removes_row(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    grant_membership(&s.pool, bob, s.default_app, AppRole::Viewer).await;
    let r = remove_member(&s.server, &owner_token, "default", bob).await;
    r.assert_status(axum::http::StatusCode::NO_CONTENT);
    let rows = list_members(&s.server, &owner_token, "default")
        .await
        .json::<Vec<Value>>();
    assert!(rows.iter().all(|v| v["username"] != "bob"));
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn delete_member_missing_returns_204(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    // No grant ever happened — delete is idempotent.
    let r = remove_member(&s.server, &owner_token, "default", bob).await;
    r.assert_status(axum::http::StatusCode::NO_CONTENT);
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn mutating_endpoints_require_app_admin(pool: PgPool) {
    let s = boot(pool).await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    grant_membership(&s.pool, bob, s.default_app, AppRole::Viewer).await;
    let bob_token = login_token(&s.server, "bob", "bob-pw").await;
    let target = seed_user(&s.pool, "carol", "carol-pw", InstanceRole::Member).await;
    let r = add_member(&s.server, &bob_token, "default", target, AppRole::Viewer).await;
    r.assert_status(axum::http::StatusCode::FORBIDDEN);
    let r = patch_member_role(&s.server, &bob_token, "default", bob, AppRole::Editor).await;
    r.assert_status(axum::http::StatusCode::FORBIDDEN);
    let r = remove_member(&s.server, &bob_token, "default", bob).await;
    r.assert_status(axum::http::StatusCode::FORBIDDEN);
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn members_endpoint_resolves_by_id_or_slug(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let by_slug = list_members(&s.server, &owner_token, "default").await;
    by_slug.assert_status_ok();
    let by_id = list_members(&s.server, &owner_token, &s.default_app.to_string()).await;
    by_id.assert_status_ok();
    assert_eq!(
        by_slug.json::<Value>(),
        by_id.json::<Value>(),
        "id and slug return identical bodies",
    );
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn member_app_admin_can_manage_members(pool: PgPool) {
    let s = boot(pool).await;
    // Bob is a member with explicit app_admin role on default.
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    grant_membership(&s.pool, bob, s.default_app, AppRole::AppAdmin).await;
    let bob_token = login_token(&s.server, "bob", "bob-pw").await;
    // Bob can list members.
    let r = list_members(&s.server, &bob_token, "default").await;
    r.assert_status_ok();
    // Bob can add carol as viewer.
    let carol = seed_user(&s.pool, "carol", "carol-pw", InstanceRole::Member).await;
    let r = add_member(&s.server, &bob_token, "default", carol, AppRole::Viewer).await;
    r.assert_status(axum::http::StatusCode::CREATED);
    // Bob can promote carol to editor.
    let r = patch_member_role(&s.server, &bob_token, "default", carol, AppRole::Editor).await;
    r.assert_status_ok();
    // Bob can remove carol.
    let r = remove_member(&s.server, &bob_token, "default", carol).await;
    r.assert_status(axum::http::StatusCode::NO_CONTENT);
    // And bob can even remove himself — owner's implicit AppAdmin
    // means the app isn't orphaned. This is the load-bearing test for
    // the no-last-app-admin-guard decision.
    let r = remove_member(&s.server, &bob_token, "default", bob).await;
    r.assert_status(axum::http::StatusCode::NO_CONTENT);
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn membership_makes_app_appear_in_members_app_list(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    let bob = seed_user(&s.pool, "bob", "bob-pw", InstanceRole::Member).await;
    let bob_token = login_token(&s.server, "bob", "bob-pw").await;
    // Before grant: bob sees no apps.
    let r = s
        .server
        .get("/api/v1/admin/apps")
        .add_header("authorization", format!("Bearer {bob_token}"))
        .await;
    r.assert_status_ok();
    assert!(
        r.json::<Vec<Value>>().is_empty(),
        "bob has no memberships → empty apps list"
    );
    // Grant via the public POST endpoint — exercises the full
    // round-trip the dashboard goes through, not just the repo seam.
    let r = add_member(&s.server, &owner_token, "default", bob, AppRole::Viewer).await;
    r.assert_status(axum::http::StatusCode::CREATED);
    // After grant: bob sees the default app.
    let r = s
        .server
        .get("/api/v1/admin/apps")
        .add_header("authorization", format!("Bearer {bob_token}"))
        .await;
    r.assert_status_ok();
    let apps = r.json::<Vec<Value>>();
    assert_eq!(apps.len(), 1);
    assert_eq!(apps[0]["slug"], "default");
 }
 #[ignore = "needs DATABASE_URL pointing at a running Postgres"]
 #[sqlx::test(migrations = "../manager-core/migrations")]
 async fn add_member_with_missing_user_id_is_rejected(pool: PgPool) {
    let s = boot(pool).await;
    let owner_token = login_token(&s.server, "owner", "owner-pw").await;
    // Body missing `user_id` — Axum's Json extractor produces a 4xx
    // before our handler runs. Pinning the status to keep the contract
    // honest if anyone ever swaps the extractor.
    let r = s
        .server
        .post("/api/v1/admin/apps/default/members")
        .add_header("authorization", format!("Bearer {owner_token}"))
        .json(&json!({ "role": "viewer" }))
        .await;
    let status = r.status_code().as_u16();
    assert!(
        (400..500).contains(&status),
        "malformed body should produce a 4xx, got {status}"
    );
 }
--- a/dashboard/.prettierignore
+++ b/dashboard/.prettierignore
@@ -2,3 +2,9 @@
 build
 node_modules
 package-lock.json
 # Playwright generated artifacts
 playwright-report
 test-results
 tests/e2e/.auth
 tests/e2e/.results
--- a/dashboard/package-lock.json
+++ b/dashboard/package-lock.json
@@ -20,6 +20,7 @@
      },
      "devDependencies": {
        "@eslint/js": "^9.18.0",
        "@playwright/test": "^1.60.0",
        "@sveltejs/adapter-static": "^3.0.8",
        "@sveltejs/kit": "^2.17.0",
        "@sveltejs/vite-plugin-svelte": "^5.0.3",
@@ -885,6 +886,22 @@
      "integrity": "sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g==",
      "license": "MIT"
    },
    "node_modules/@playwright/test": {
      "version": "1.60.0",
      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.60.0.tgz",
      "integrity": "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
        "playwright": "1.60.0"
      },
      "bin": {
        "playwright": "cli.js"
      },
      "engines": {
        "node": ">=18"
      }
    },
    "node_modules/@polka/url": {
      "version": "1.0.0-next.29",
      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
@@ -3010,6 +3027,53 @@
        "url": "https://github.com/sponsors/jonschlinkert"
      }
    },
    "node_modules/playwright": {
      "version": "1.60.0",
      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.60.0.tgz",
      "integrity": "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
        "playwright-core": "1.60.0"
      },
      "bin": {
        "playwright": "cli.js"
      },
      "engines": {
        "node": ">=18"
      },
      "optionalDependencies": {
        "fsevents": "2.3.2"
      }
    },
    "node_modules/playwright-core": {
      "version": "1.60.0",
      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.60.0.tgz",
      "integrity": "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==",
      "dev": true,
      "license": "Apache-2.0",
      "bin": {
        "playwright-core": "cli.js"
      },
      "engines": {
        "node": ">=18"
      }
    },
    "node_modules/playwright/node_modules/fsevents": {
      "version": "2.3.2",
      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
      "dev": true,
      "hasInstallScript": true,
      "license": "MIT",
      "optional": true,
      "os": [
        "darwin"
      ],
      "engines": {
        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
      }
    },
    "node_modules/postcss": {
      "version": "8.5.15",
      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -1,49 +1,53 @@
 {
-  "name": "picloud-dashboard",
+	"name": "picloud-dashboard",
-  "version": "0.6.0",
+	"version": "0.6.0",
-  "private": true,
+	"private": true,
-  "type": "module",
+	"type": "module",
-  "scripts": {
+	"scripts": {
-    "dev": "vite dev",
+		"dev": "vite dev",
-    "build": "vite build",
+		"build": "vite build",
-    "preview": "vite preview",
+		"preview": "vite preview",
-    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
-    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
-    "format": "prettier --write .",
+		"format": "prettier --write .",
-    "lint": "prettier --check . && eslint .",
+		"lint": "prettier --check . && eslint .",
-    "test": "vitest run"
+		"test": "vitest run",
-  },
+		"test:e2e": "playwright test",
-  "devDependencies": {
+		"test:e2e:ui": "playwright test --ui",
-    "@eslint/js": "^9.18.0",
+		"test:e2e:install": "playwright install --with-deps chromium"
-    "@sveltejs/adapter-static": "^3.0.8",
+	},
-    "@sveltejs/kit": "^2.17.0",
+	"devDependencies": {
-    "@sveltejs/vite-plugin-svelte": "^5.0.3",
+		"@eslint/js": "^9.18.0",
-    "@types/node": "^22.10.5",
+		"@playwright/test": "^1.60.0",
-    "eslint": "^9.18.0",
+		"@sveltejs/adapter-static": "^3.0.8",
-    "eslint-config-prettier": "^10.0.1",
+		"@sveltejs/kit": "^2.17.0",
-    "eslint-plugin-svelte": "^3.0.0",
+		"@sveltejs/vite-plugin-svelte": "^5.0.3",
-    "globals": "^15.14.0",
+		"@types/node": "^22.10.5",
-    "prettier": "^3.4.2",
+		"eslint": "^9.18.0",
-    "prettier-plugin-svelte": "^3.3.3",
+		"eslint-config-prettier": "^10.0.1",
-    "svelte": "^5.19.0",
+		"eslint-plugin-svelte": "^3.0.0",
-    "svelte-check": "^4.1.4",
+		"globals": "^15.14.0",
-    "typescript": "^5.7.3",
+		"prettier": "^3.4.2",
-    "typescript-eslint": "^8.20.0",
+		"prettier-plugin-svelte": "^3.3.3",
-    "vite": "^6.0.7",
+		"svelte": "^5.19.0",
-    "vitest": "^3.0.5"
+		"svelte-check": "^4.1.4",
-  },
+		"typescript": "^5.7.3",
-  "overrides": {
+		"typescript-eslint": "^8.20.0",
-    "cookie": "^0.7.2"
+		"vite": "^6.0.7",
-  },
+		"vitest": "^3.0.5"
-  "dependencies": {
+	},
-    "@codemirror/autocomplete": "^6.20.2",
+	"overrides": {
-    "@codemirror/commands": "^6.10.3",
+		"cookie": "^0.7.2"
-    "@codemirror/lang-json": "^6.0.2",
+	},
-    "@codemirror/language": "^6.12.3",
+	"dependencies": {
-    "@codemirror/search": "^6.7.0",
+		"@codemirror/autocomplete": "^6.20.2",
-    "@codemirror/state": "^6.6.0",
+		"@codemirror/commands": "^6.10.3",
-    "@codemirror/view": "^6.43.0",
+		"@codemirror/lang-json": "^6.0.2",
-    "@lezer/highlight": "^1.2.3",
+		"@codemirror/language": "^6.12.3",
-    "codemirror": "^6.0.2"
+		"@codemirror/search": "^6.7.0",
-  }
+		"@codemirror/state": "^6.6.0",
 		"@codemirror/view": "^6.43.0",
 		"@lezer/highlight": "^1.2.3",
 		"codemirror": "^6.0.2"
 	}
 }
--- a/dashboard/playwright.config.ts
+++ b/dashboard/playwright.config.ts
@@ -0,0 +1,51 @@
 import { defineConfig, devices } from '@playwright/test';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const DASHBOARD_PORT = Number(process.env.PICLOUD_DASHBOARD_PORT ?? 5173);
 // baseURL is the origin only — the SvelteKit dashboard is mounted at
 // `/admin` (svelte.config.js paths.base), so tests use full paths like
 // `/admin/login` rather than relying on baseURL path resolution.
 const DASHBOARD_BASE = process.env.E2E_BASE_URL ?? `http://localhost:${DASHBOARD_PORT}`;
 export default defineConfig({
 	testDir: './tests/e2e',
 	outputDir: './tests/e2e/.results',
 	fullyParallel: true,
 	forbidOnly: !!process.env.CI,
 	// Local: 1 retry to absorb dev-server warmup flakiness. CI: 2.
 	retries: process.env.CI ? 2 : 1,
 	// Cap at 4 workers locally to keep the shared Vite dev server
 	// from getting stampeded during cold-start compiles.
 	workers: process.env.CI ? 2 : 4,
 	reporter: process.env.CI ? [['html'], ['github']] : 'html',
 	globalSetup: './tests/e2e/global-setup.ts',
 	expect: { timeout: 5_000 },
 	use: {
 		baseURL: DASHBOARD_BASE,
 		actionTimeout: 10_000,
 		navigationTimeout: 30_000,
 		trace: 'on-first-retry',
 		screenshot: 'only-on-failure',
 		video: 'retain-on-failure'
 	},
 	projects: [
 		{
 			name: 'chromium',
 			use: {
 				...devices['Desktop Chrome'],
 				storageState: path.join(__dirname, 'tests/e2e/.auth/admin.json')
 			}
 		}
 	],
 	webServer: {
 		command: 'npm run dev',
 		url: `http://localhost:${DASHBOARD_PORT}/admin/`,
 		reuseExistingServer: !process.env.CI,
 		stdout: 'pipe',
 		stderr: 'pipe',
 		timeout: 60_000
 	}
 });
--- a/dashboard/src/lib/CodeEditor.svelte
+++ b/dashboard/src/lib/CodeEditor.svelte
@@ -25,12 +25,18 @@
 		value = $bindable(''),
 		language = 'rhai' as Language,
 		placeholder = '',
-		minHeight = '12rem'
+		minHeight = '12rem',
 		readOnly = false
 	}: {
 		value?: string;
 		language?: Language;
 		placeholder?: string;
 		minHeight?: string;
 		/** When true the editor renders without a cursor and rejects
 		 *  keystrokes. Parent-driven `value` changes still apply via
 		 *  the dispatch path below — this only blocks user edits.
 		 *  Not reactive after mount; re-mount via `{#key}` if needed. */
 		readOnly?: boolean;
 	} = $props();
 	let host: HTMLDivElement | null = null;
@@ -48,6 +54,12 @@
 			keymap.of([indentWithTab]),
 			dashboardSyntaxHighlighting,
 			dashboardTheme,
 			// readOnly + editable together: readOnly blocks the
 			// underlying transactions, editable suppresses the caret
 			// + selection visuals so the user can see it's not
 			// editable.
 			EditorState.readOnly.of(readOnly),
 			EditorView.editable.of(!readOnly),
 			EditorView.updateListener.of((update) => {
 				if (update.docChanged && !pushingFromOutside) {
 					value = update.state.doc.toString();
--- a/dashboard/src/lib/RoleChip.svelte
+++ b/dashboard/src/lib/RoleChip.svelte
@@ -1,15 +1,24 @@
 <script lang="ts">
 	import type { InstanceRole } from '$lib/auth';
 	import type { AppRole } from '$lib/api';
 	interface Props {
-		role: InstanceRole;
+		role?: InstanceRole;
 		appRole?: AppRole;
 		size?: 'sm' | 'md';
 	}
-	let { role, size = 'md' }: Props = $props();
+	let { role, appRole, size = 'md' }: Props = $props();
 	// Display label: app roles read better with a space ("app admin")
 	// than their wire form ("app_admin").
 	const label = $derived(
 		appRole ? appRole.replace('_', ' ') : (role ?? '')
 	);
 	const cls = $derived(appRole ? `chip-${appRole}` : `chip-${role}`);
 </script>
-<span class="chip chip-{role}" class:sm={size === 'sm'}>{role}</span>
+<span class="chip {cls}" class:sm={size === 'sm'}>{label}</span>
 <style>
 	.chip {
@@ -42,4 +51,19 @@
 		color: #cbd5e1;
 		border-color: #334155;
 	}
 	.chip-app_admin {
 		background: #4c1d95;
 		color: #c4b5fd;
 		border-color: #6d28d9;
 	}
 	.chip-editor {
 		background: #1e3a8a;
 		color: #93c5fd;
 		border-color: #1d4ed8;
 	}
 	.chip-viewer {
 		background: #1f2937;
 		color: #9ca3af;
 		border-color: #374151;
 	}
 </style>
--- a/dashboard/src/lib/api.ts
+++ b/dashboard/src/lib/api.ts
@@ -44,6 +44,8 @@ export interface App {
 	updated_at: string;
 }
 export type AppRole = 'app_admin' | 'editor' | 'viewer';
 export type DomainShape = 'exact' | 'wildcard' | 'parameterized';
 export interface AppDomain {
@@ -64,6 +66,11 @@ export interface AppLookupResponse {
 	updated_at: string;
 	/// Present only when the requested slug was a retired redirect.
 	redirect_to?: string;
 	/// The caller's role on this app — owners are implicit `app_admin`,
 	/// admins implicit `editor`, members carry their `app_members.role`.
 	/// `null` only when a member somehow reaches the endpoint without
 	/// a membership (the server normally 403s first).
 	my_role: AppRole | null;
 }
 export interface SlugCheckResponse {
@@ -289,6 +296,21 @@ export interface PatchAdminInput {
 	email?: string | null;
 }
 export interface AppMemberDto {
 	user_id: string;
 	username: string;
 	email: string | null;
 	instance_role: InstanceRole;
 	is_active: boolean;
 	role: AppRole;
 	created_at: string;
 }
 export interface GrantAppMemberInput {
 	user_id: string;
 	role: AppRole;
 }
 export interface ApiKeyDto {
 	id: string;
 	prefix: string;
@@ -472,6 +494,28 @@ export const api = {
 			)
 	},
 	appMembers: {
 		list: (idOrSlug: string) =>
 			adminRequest<AppMemberDto[]>(
 				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/members`
 			),
 		add: (idOrSlug: string, input: GrantAppMemberInput) =>
 			adminRequest<AppMemberDto>(
 				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/members`,
 				{ method: 'POST', body: JSON.stringify(input) }
 			),
 		setRole: (idOrSlug: string, userId: string, role: AppRole) =>
 			adminRequest<AppMemberDto>(
 				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/members/${userId}`,
 				{ method: 'PATCH', body: JSON.stringify({ role }) }
 			),
 		remove: (idOrSlug: string, userId: string) =>
 			adminRequest<null>(
 				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/members/${userId}`,
 				{ method: 'DELETE' }
 			)
 	},
 	execute: async (
 		id: string,
 		body: unknown,
--- a/dashboard/src/lib/capabilities.test.ts
+++ b/dashboard/src/lib/capabilities.test.ts
@@ -0,0 +1,60 @@
 import { describe, it, expect } from 'vitest';
 import type { AppRole, MeDto } from './api';
 import { canAdminApp, canCreateApp, canManageUsers, canWriteApp } from './capabilities';
 function me(role: MeDto['instance_role']): MeDto {
 	return { id: 'u', username: 'u', instance_role: role, email: null };
 }
 const ROLES: MeDto['instance_role'][] = ['owner', 'admin', 'member'];
 const APP_ROLES: (AppRole | null)[] = ['app_admin', 'editor', 'viewer', null];
 describe('capabilities', () => {
 	it('null caller is denied everything', () => {
 		expect(canCreateApp(null)).toBe(false);
 		expect(canManageUsers(null)).toBe(false);
 		expect(canWriteApp(null, 'app_admin')).toBe(false);
 		expect(canAdminApp(null, 'app_admin')).toBe(false);
 	});
 	it('canCreateApp + canManageUsers: owner/admin yes, member no', () => {
 		expect(canCreateApp(me('owner'))).toBe(true);
 		expect(canCreateApp(me('admin'))).toBe(true);
 		expect(canCreateApp(me('member'))).toBe(false);
 		expect(canManageUsers(me('owner'))).toBe(true);
 		expect(canManageUsers(me('admin'))).toBe(true);
 		expect(canManageUsers(me('member'))).toBe(false);
 	});
 	it('owner + admin can write and admin every app regardless of my_role', () => {
 		for (const role of ['owner', 'admin'] as const) {
 			for (const appRole of APP_ROLES) {
 				expect(canWriteApp(me(role), appRole)).toBe(true);
 				expect(canAdminApp(me(role), appRole)).toBe(true);
 			}
 		}
 	});
 	it('member: write requires app_admin or editor; admin requires app_admin', () => {
 		const m = me('member');
 		expect(canWriteApp(m, 'app_admin')).toBe(true);
 		expect(canWriteApp(m, 'editor')).toBe(true);
 		expect(canWriteApp(m, 'viewer')).toBe(false);
 		expect(canWriteApp(m, null)).toBe(false);
 		expect(canAdminApp(m, 'app_admin')).toBe(true);
 		expect(canAdminApp(m, 'editor')).toBe(false);
 		expect(canAdminApp(m, 'viewer')).toBe(false);
 		expect(canAdminApp(m, null)).toBe(false);
 	});
 	it('canAdminApp implies canWriteApp for every combination', () => {
 		for (const role of ROLES) {
 			for (const appRole of APP_ROLES) {
 				if (canAdminApp(me(role), appRole)) {
 					expect(canWriteApp(me(role), appRole)).toBe(true);
 				}
 			}
 		}
 	});
 });
--- a/dashboard/src/lib/capabilities.ts
+++ b/dashboard/src/lib/capabilities.ts
@@ -0,0 +1,43 @@
 // Permission predicates the dashboard uses to shadow create / edit /
 // delete affordances. Mirrors the canonical role → capability rules in
 // crates/manager-core/src/authz.rs:
 //
 //   owner / admin instance role → implicit app_admin on every app
 //   app_admin                   → settings, domain claims, delete app, delete scripts
 //   editor                      → CRUD on scripts, routes, sandbox config (no script delete)
 //   viewer                      → read scripts + execution logs
 //   member with no membership   → no access
 //
 // These helpers are read-only and have no Svelte runes — callers pass
 // the current `MeDto` and (when relevant) the per-app `my_role` they
 // already hold. Hiding here never authorizes anything; the backend's
 // `require(Capability::…)` is always the ground truth.
 import type { AppRole, MeDto } from './api';
 /** Owner + admin only. Members never see "New app". */
 export function canCreateApp(me: MeDto | null): boolean {
 	if (!me) return false;
 	return me.instance_role === 'owner' || me.instance_role === 'admin';
 }
 /** Owner + admin only — the "Users" admin page is also gated this way. */
 export function canManageUsers(me: MeDto | null): boolean {
 	if (!me) return false;
 	return me.instance_role === 'owner' || me.instance_role === 'admin';
 }
 /** Can mutate scripts and routes (Save, +Add route, remove route). */
 export function canWriteApp(me: MeDto | null, appMyRole: AppRole | null): boolean {
 	if (!me) return false;
 	if (me.instance_role === 'owner' || me.instance_role === 'admin') return true;
 	return appMyRole === 'app_admin' || appMyRole === 'editor';
 }
 /** Can take app-admin actions: app settings, domain claims, delete
 *  app, delete scripts, manage members. */
 export function canAdminApp(me: MeDto | null, appMyRole: AppRole | null): boolean {
 	if (!me) return false;
 	if (me.instance_role === 'owner' || me.instance_role === 'admin') return true;
 	return appMyRole === 'app_admin';
 }
--- a/dashboard/src/lib/password-gen.test.ts
+++ b/dashboard/src/lib/password-gen.test.ts
@@ -0,0 +1,54 @@
 import { describe, it, expect } from 'vitest';
 import { generatePassword } from './password-gen';
 const CHARSET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&*+-?@';
 describe('generatePassword', () => {
 	it('rejects lengths under 8', () => {
 		expect(() => generatePassword(7)).toThrowError(/at least 8/);
 	});
 	it('respects the requested length', () => {
 		for (const len of [8, 16, 32, 64]) {
 			expect(generatePassword(len)).toHaveLength(len);
 		}
 	});
 	it('uses only characters from the documented charset', () => {
 		const set = new Set(CHARSET);
 		for (let i = 0; i < 1000; i++) {
 			for (const c of generatePassword(32)) {
 				expect(set.has(c)).toBe(true);
 			}
 		}
 	});
 	// Rejection-sampling sanity. With N = 71 the expected count per
 	// char over 100k samples is ~1408 (σ ≈ 37). A 6σ band catches
 	// any byte-level bias (biased modulo would push the first 38
 	// chars by ~16 ppm — too small for this band to flag on its
 	// own, but a regression to `% N` over Uint16/Uint32 with a
 	// non-power-of-two charset would still produce visible drift in
 	// pathological codepaths). Mostly this guards against
 	// fundamental mistakes (off-by-one in the loop, returning the
 	// same byte stream every time, etc.).
 	it('distribution stays within a wide tolerance band', () => {
 		const samples = 100_000;
 		const counts = new Map<string, number>();
 		for (let i = 0; i < samples; i++) {
 			const c = generatePassword(8)[0];
 			counts.set(c, (counts.get(c) ?? 0) + 1);
 		}
 		const expected = samples / CHARSET.length;
 		const sigma = Math.sqrt(expected);
 		const band = 6 * sigma;
 		for (const c of CHARSET) {
 			const observed = counts.get(c) ?? 0;
 			const drift = Math.abs(observed - expected);
 			expect(
 				drift,
 				`char "${c}": observed ${observed}, expected ~${Math.round(expected)} (drift ${drift.toFixed(0)} > ${band.toFixed(0)})`
 			).toBeLessThan(band);
 		}
 	});
 });
--- a/dashboard/src/lib/password-gen.ts
+++ b/dashboard/src/lib/password-gen.ts
@@ -8,6 +8,11 @@
 // entropy at 16 chars (~95 bits) to be uncopyable by hand mistakes,
 // avoidant of characters that ship awkwardly through chat clients
 // (no quotes, slashes, or backticks).
 //
 // Sampling: rejection sampling against a Uint8 stream. The naive
 // `byte % CHARSET.length` would slightly overweight the first
 // (256 mod N) chars; with N = 71 that's ~16 ppm of bias which is
 // safe at 16 chars but easy to remove.
 const CHARSET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&*+-?@';
@@ -15,11 +20,18 @@ export function generatePassword(length = 16): string {
 	if (length < 8) {
 		throw new Error('password length must be at least 8');
 	}
-	const buf = new Uint32Array(length);
+	const n = CHARSET.length;
-	crypto.getRandomValues(buf);
+	// Largest multiple of `n` that fits in a Uint8 — bytes ≥ MAX get
 	// rejected to remove modulo bias.
 	const max = 256 - (256 % n);
 	const buf = new Uint8Array(length);
 	let out = '';
-	for (let i = 0; i < length; i++) {
+	while (out.length < length) {
-		out += CHARSET[buf[i] % CHARSET.length];
+		crypto.getRandomValues(buf);
 		for (let i = 0; i < buf.length && out.length < length; i++) {
 			const byte = buf[i];
 			if (byte < max) out += CHARSET[byte % n];
 		}
 	}
 	return out;
 }
--- a/dashboard/src/routes/apps/+page.svelte
+++ b/dashboard/src/routes/apps/+page.svelte
@@ -2,6 +2,11 @@
 	import { base } from '$app/paths';
 	import { api, ApiError, type App } from '$lib/api';
 	import { slugify, SLUG_MAX } from '$lib/slugify';
 	import { canCreateApp } from '$lib/capabilities';
 	import { currentUser } from '$lib/auth';
 	const me = $derived($currentUser);
 	const canCreate = $derived(canCreateApp(me));
 	let apps = $state<App[] | null>(null);
 	let listError = $state<string | null>(null);
@@ -99,18 +104,20 @@
 <section>
 	<header class="page-header">
 		<h1>Apps</h1>
-		<button
+		{#if canCreate}
-			type="button"
+			<button
-			onclick={() => {
+				type="button"
-				showCreate = !showCreate;
+				onclick={() => {
-				if (!showCreate) resetCreate();
+					showCreate = !showCreate;
-			}}
+					if (!showCreate) resetCreate();
-		>
+				}}
-			{showCreate ? 'Cancel' : 'New app'}
+			>
-		</button>
+				{showCreate ? 'Cancel' : 'New app'}
 			</button>
 		{/if}
 	</header>
-	{#if showCreate}
+	{#if showCreate && canCreate}
 		<form class="create-form" onsubmit={(e) => submitCreate(e)}>
 			<div class="row">
 				<label>
--- a/dashboard/src/routes/apps/[slug]/+page.svelte
+++ b/dashboard/src/routes/apps/[slug]/+page.svelte
@@ -5,26 +5,44 @@
 	import {
 		api,
 		ApiError,
 		type AdminDto,
 		type App,
 		type AppDomain,
 		type AppMemberDto,
 		type AppRole,
 		type Script
 	} from '$lib/api';
 	import CodeEditor from '$lib/CodeEditor.svelte';
 	import ConfirmModal from '$lib/ConfirmModal.svelte';
 	import ActionMenu from '$lib/ActionMenu.svelte';
 	import RoleChip from '$lib/RoleChip.svelte';
 	import { currentUser } from '$lib/auth';
 	import { canAdminApp, canWriteApp } from '$lib/capabilities';
 	const me = $derived($currentUser);
 	const SAMPLE_SOURCE =
 		'#{\n  statusCode: 200,\n  body: #{ ok: true, echo: ctx.request.body }\n}';
-	type Tab = 'scripts' | 'domains' | 'settings';
+	type Tab = 'scripts' | 'domains' | 'members' | 'settings';
 	let slug = $derived(page.params.slug ?? '');
 	let app = $state<App | null>(null);
 	let myRole = $state<AppRole | null>(null);
 	let loadError = $state<string | null>(null);
 	let loading = $state(true);
 	let activeTab = $state<Tab>('scripts');
 	let scripts = $state<Script[]>([]);
 	let domains = $state<AppDomain[]>([]);
 	let members = $state<AppMemberDto[]>([]);
 	// Derive UI gates from the capabilities helper so the rules stay
 	// in lockstep with the backend's `can()`. canAdminApp also covers
 	// the Members + Settings + Domains-mutation tabs; canWriteApp
 	// covers New script.
 	const canWrite = $derived(canWriteApp(me, myRole));
 	const canAdmin = $derived(canAdminApp(me, myRole));
 	// Script create
 	let showCreateScript = $state(false);
@@ -55,6 +73,19 @@
 	let removingDomain = $state(false);
 	let removeDomainError = $state<string | null>(null);
 	// Members tab
 	let eligibleUsers = $state<AdminDto[]>([]);
 	let eligibleLoadError = $state<string | null>(null);
 	let addMemberUserId = $state('');
 	let addMemberRole = $state<AppRole>('viewer');
 	let addingMember = $state(false);
 	let addMemberError = $state<string | null>(null);
 	let memberToRemove = $state<AppMemberDto | null>(null);
 	let removingMember = $state(false);
 	let removeMemberError = $state<string | null>(null);
 	let roleChangeBusy = $state<string | null>(null);
 	let memberActionError = $state<string | null>(null);
 	async function loadApp() {
 		loading = true;
 		loadError = null;
@@ -72,10 +103,15 @@
 				created_at: fetched.created_at,
 				updated_at: fetched.updated_at
 			};
 			myRole = fetched.my_role;
 			editName = app.name;
 			editDescription = app.description ?? '';
 			editSlug = app.slug;
-			await Promise.all([loadScripts(app.id), loadDomains(app.id)]);
+			const loaders: Promise<unknown>[] = [loadScripts(app.id), loadDomains(app.id)];
 			if (canAdmin) {
 				loaders.push(loadMembers(app.id), loadEligibleUsers());
 			}
 			await Promise.all(loaders);
 		} catch (e) {
 			loadError = e instanceof Error ? e.message : String(e);
 		} finally {
@@ -101,6 +137,42 @@
 		}
 	}
 	async function loadMembers(appId: string) {
 		try {
 			members = await api.appMembers.list(appId);
 		} catch (e) {
 			members = [];
 			memberActionError = e instanceof Error ? e.message : String(e);
 		}
 	}
 	async function loadEligibleUsers() {
 		eligibleLoadError = null;
 		try {
 			const all = await api.admins.list();
 			// Only inactive=false members are valid invite targets — the
 			// API rejects everyone else anyway, so filter upfront.
 			eligibleUsers = all.filter(
 				(u) => u.is_active && u.instance_role === 'member'
 			);
 		} catch (e) {
 			eligibleUsers = [];
 			// member-with-app_admin can hit /apps/.../members but cannot
 			// browse /admins (gated on InstanceManageUsers). The add form
 			// will render disabled with the explanatory message below.
 			eligibleLoadError =
 				e instanceof ApiError && e.status === 403
 					? 'Only instance owners/admins can browse the user directory to invite new members.'
 					: e instanceof Error
 						? e.message
 						: String(e);
 		}
 	}
 	const eligibleAfterFilter = $derived(
 		eligibleUsers.filter((u) => !members.some((m) => m.user_id === u.id))
 	);
 	async function submitCreateScript(event: Event) {
 		event.preventDefault();
 		if (!app) return;
@@ -201,6 +273,76 @@
 		}
 	}
 	async function submitAddMember(event: Event) {
 		event.preventDefault();
 		if (!app || !addMemberUserId) return;
 		addingMember = true;
 		addMemberError = null;
 		try {
 			await api.appMembers.add(app.id, {
 				user_id: addMemberUserId,
 				role: addMemberRole
 			});
 			addMemberUserId = '';
 			addMemberRole = 'viewer';
 			await loadMembers(app.id);
 		} catch (e) {
 			addMemberError = e instanceof Error ? e.message : String(e);
 		} finally {
 			addingMember = false;
 		}
 	}
 	async function changeMemberRole(member: AppMemberDto, role: AppRole) {
 		if (!app || member.role === role) return;
 		roleChangeBusy = member.user_id;
 		memberActionError = null;
 		try {
 			await api.appMembers.setRole(app.id, member.user_id, role);
 			await loadMembers(app.id);
 		} catch (e) {
 			memberActionError = e instanceof Error ? e.message : String(e);
 		} finally {
 			roleChangeBusy = null;
 		}
 	}
 	function askRemoveMember(member: AppMemberDto) {
 		removeMemberError = null;
 		memberToRemove = member;
 	}
 	async function confirmRemoveMember() {
 		if (!app || !memberToRemove) return;
 		removingMember = true;
 		removeMemberError = null;
 		try {
 			const removedSelf = !!me && memberToRemove.user_id === me.id;
 			await api.appMembers.remove(app.id, memberToRemove.user_id);
 			memberToRemove = null;
 			if (removedSelf) {
 				// We just revoked our own access to this app; the next
 				// fetch of /apps/{slug} would 403. Bounce back to the
 				// apps list rather than render a broken tab.
 				await goto(`${base}/apps`);
 				return;
 			}
 			await loadMembers(app.id);
 		} catch (e) {
 			removeMemberError = e instanceof Error ? e.message : String(e);
 		} finally {
 			removingMember = false;
 		}
 	}
 	function shortDate(iso: string): string {
 		try {
 			return new Date(iso).toLocaleDateString();
 		} catch {
 			return iso;
 		}
 	}
 	function askDeleteApp() {
 		deleteAppError = null;
 		confirmingDeleteApp = true;
@@ -226,6 +368,16 @@
 	$effect(() => {
 		void loadApp();
 	});
 	// Defense-in-depth: a viewer / editor following a stale link to
 	// the Settings or Members tab gets bounced back to Scripts. The
 	// backend still 403s the underlying calls, but no point showing an
 	// empty tab.
 	$effect(() => {
 		if (!canAdmin && (activeTab === 'settings' || activeTab === 'members')) {
 			activeTab = 'scripts';
 		}
 	});
 </script>
 {#if loading && !app}
@@ -258,26 +410,35 @@
 			class:active={activeTab === 'domains'}
 			onclick={() => (activeTab = 'domains')}>Domains ({domains.length})</button
 		>
-		<button
+		{#if canAdmin}
-			type="button"
+			<button
-			class:active={activeTab === 'settings'}
+				type="button"
-			onclick={() => (activeTab = 'settings')}>Settings</button
+				class:active={activeTab === 'members'}
-		>
+				onclick={() => (activeTab = 'members')}>Members ({members.length})</button
 			>
 			<button
 				type="button"
 				class:active={activeTab === 'settings'}
 				onclick={() => (activeTab = 'settings')}>Settings</button
 			>
 		{/if}
 	</nav>
 	{#if activeTab === 'scripts'}
 		<section>
 			<div class="row">
 				<h2>Scripts</h2>
-				<button
+				{#if canWrite}
-					type="button"
+					<button
-					onclick={() => (showCreateScript = !showCreateScript)}
+						type="button"
-				>
+						onclick={() => (showCreateScript = !showCreateScript)}
-					{showCreateScript ? 'Cancel' : 'New script'}
+					>
-				</button>
+						{showCreateScript ? 'Cancel' : 'New script'}
 					</button>
 				{/if}
 			</div>
-			{#if showCreateScript}
+			{#if showCreateScript && canWrite}
 				<form class="create-form" onsubmit={submitCreateScript}>
 					<div class="row">
 						<label>
@@ -330,18 +491,20 @@
 				these. Use <code>app.example.com</code> for exact, <code>*.example.com</code> for
 				wildcard, or <code>{'{'}tenant{'}'}.example.com</code> to bind a capture.
 			</p>
-			<form class="create-form inline" onsubmit={submitCreateDomain}>
+			{#if canAdmin}
-				<input
+				<form class="create-form inline" onsubmit={submitCreateDomain}>
-					bind:value={createDomainPattern}
+					<input
-					required
+						bind:value={createDomainPattern}
-					placeholder="app.example.com"
+						required
-				/>
+						placeholder="app.example.com"
-				<button type="submit" disabled={creatingDomain}>
+					/>
-					{creatingDomain ? 'Adding…' : 'Add domain'}
+					<button type="submit" disabled={creatingDomain}>
-				</button>
+						{creatingDomain ? 'Adding…' : 'Add domain'}
-			</form>
+					</button>
-			{#if createDomainError}
+				</form>
-				<div class="error">{createDomainError}</div>
+				{#if createDomainError}
 					<div class="error">{createDomainError}</div>
 				{/if}
 			{/if}
 			{#if domains.length === 0}
 				<p class="muted">No domain claims yet.</p>
@@ -353,19 +516,136 @@
 								<code>{d.pattern}</code>
 								<span class="muted">— {d.shape}</span>
 							</div>
-							<button
+							{#if canAdmin}
-								type="button"
+								<button
-								class="secondary danger"
+									type="button"
-								onclick={() => askRemoveDomain(d)}
+									class="secondary danger"
-							>
+									onclick={() => askRemoveDomain(d)}
-								Delete
+								>
-							</button>
+									Delete
 								</button>
 							{/if}
 						</li>
 					{/each}
 				</ul>
 			{/if}
 		</section>
-	{:else if activeTab === 'settings'}
+	{:else if activeTab === 'members' && canAdmin}
 		<section>
 			<h2>Members</h2>
 			<p class="muted">
 				Users with explicit access to this app. Instance owners and admins
 				already have implicit access — they are not listed here. Use the Users
 				page to invite a <code>member</code> first, then grant them app access
 				below.
 			</p>
 			<form class="create-form" onsubmit={submitAddMember}>
 				<div class="row">
 					<label class="grow">
 						<span>User</span>
 						<select
 							bind:value={addMemberUserId}
 							disabled={!!eligibleLoadError || eligibleAfterFilter.length === 0}
 							required
 						>
 							<option value="" disabled>Pick a member to invite…</option>
 							{#each eligibleAfterFilter as u (u.id)}
 								<option value={u.id}>{u.username}{u.email ? ` (${u.email})` : ''}</option>
 							{/each}
 						</select>
 					</label>
 					<label>
 						<span>Role</span>
 						<select bind:value={addMemberRole} disabled={!!eligibleLoadError}>
 							<option value="viewer">viewer</option>
 							<option value="editor">editor</option>
 							<option value="app_admin">app admin</option>
 						</select>
 					</label>
 				</div>
 				{#if eligibleLoadError}
 					<p class="muted">{eligibleLoadError}</p>
 				{:else if eligibleAfterFilter.length === 0}
 					<p class="muted">
 						No eligible users to invite. Create a <code>member</code> on the Users
 						page first.
 					</p>
 				{/if}
 				{#if addMemberError}
 					<div class="error">{addMemberError}</div>
 				{/if}
 				<div class="actions">
 					<button
 						type="submit"
 						disabled={addingMember || !addMemberUserId || !!eligibleLoadError}
 					>
 						{addingMember ? 'Adding…' : 'Add member'}
 					</button>
 				</div>
 			</form>
 			{#if memberActionError}
 				<div class="error">{memberActionError}</div>
 			{/if}
 			{#if members.length === 0}
 				<p class="muted">No explicit members yet.</p>
 			{:else}
 				<div class="table">
 					<div class="row head-row">
 						<div>User</div>
 						<div>Instance</div>
 						<div>App role</div>
 						<div>Joined</div>
 						<div class="actions-col"></div>
 					</div>
 					{#each members as m (m.user_id)}
 						<div class="row member-row" class:inactive={!m.is_active}>
 							<div>
 								<strong>{m.username}</strong>
 								{#if m.email}<span class="muted">{m.email}</span>{/if}
 								{#if !m.is_active}<span class="muted">(inactive)</span>{/if}
 							</div>
 							<div><RoleChip role={m.instance_role} size="sm" /></div>
 							<div><RoleChip appRole={m.role} size="sm" /></div>
 							<div>{shortDate(m.created_at)}</div>
 							<div class="actions-col">
 								<ActionMenu
 									label="Member actions for {m.username}"
 									items={[
 										{
 											label: 'Make app admin',
 											disabled:
 												m.role === 'app_admin' || roleChangeBusy === m.user_id,
 											onClick: () => changeMemberRole(m, 'app_admin')
 										},
 										{
 											label: 'Make editor',
 											disabled:
 												m.role === 'editor' || roleChangeBusy === m.user_id,
 											onClick: () => changeMemberRole(m, 'editor')
 										},
 										{
 											label: 'Make viewer',
 											disabled:
 												m.role === 'viewer' || roleChangeBusy === m.user_id,
 											onClick: () => changeMemberRole(m, 'viewer')
 										},
 										{
 											label: 'Remove from app',
 											danger: true,
 											onClick: () => askRemoveMember(m)
 										}
 									]}
 								/>
 							</div>
 						</div>
 					{/each}
 				</div>
 			{/if}
 		</section>
 	{:else if activeTab === 'settings' && canAdmin}
 		<section>
 			<h2>Settings</h2>
 			<form class="create-form" onsubmit={(e) => saveSettings(e)}>
@@ -502,6 +782,26 @@
 			{/if}
 		</ConfirmModal>
 	{/if}
 	{#if memberToRemove}
 		<ConfirmModal
 			title="Remove {memberToRemove.username} from {app.name}"
 			variant="danger"
 			confirmLabel="Remove member"
 			busyLabel="Removing…"
 			busy={removingMember}
 			onConfirm={confirmRemoveMember}
 			onCancel={() => (memberToRemove = null)}
 		>
 			<p>
 				<strong>{memberToRemove.username}</strong> will lose access to this
 				app. Their other app memberships and account are untouched.
 			</p>
 			{#if removeMemberError}
 				<p class="modal-error">{removeMemberError}</p>
 			{/if}
 		</ConfirmModal>
 	{/if}
 {/if}
 <style>
@@ -744,4 +1044,60 @@
 		border-radius: 0.5rem;
 		background: #1e0a0a;
 	}
 	.create-form select {
 		background: #0b1220;
 		color: #e2e8f0;
 		border: 1px solid #334155;
 		border-radius: 0.375rem;
 		padding: 0.5rem 0.75rem;
 		font: inherit;
 	}
 	.create-form .row > label.grow {
 		grid-column: span 2;
 	}
 	.table {
 		display: flex;
 		flex-direction: column;
 		gap: 0.25rem;
 	}
 	.table .row {
 		display: grid;
 		grid-template-columns: 2fr 1fr 1fr 1fr 3rem;
 		gap: 0.75rem;
 		padding: 0.85rem 1rem;
 		background: #1e293b;
 		border-radius: 0.375rem;
 		align-items: center;
 		margin: 0;
 	}
 	.table .head-row {
 		background: transparent;
 		padding: 0.25rem 1rem;
 		color: #64748b;
 		font-size: 0.75rem;
 		text-transform: uppercase;
 		letter-spacing: 0.05em;
 	}
 	.table .member-row.inactive {
 		opacity: 0.55;
 	}
 	.table .member-row strong {
 		margin-right: 0.4rem;
 	}
 	.table .member-row .muted {
 		font-size: 0.8rem;
 	}
 	.table .actions-col {
 		display: flex;
 		justify-content: flex-end;
 	}
 </style>
--- a/dashboard/src/routes/scripts/[id]/+page.svelte
+++ b/dashboard/src/routes/scripts/[id]/+page.svelte
@@ -6,12 +6,15 @@
 		api,
 		ApiError,
 		type AppDomain,
 		type AppRole,
 		type ExecutionLog,
 		type Route,
 		type RouteInput,
 		type Script,
 		type VersionInfo
 	} from '$lib/api';
 	import { currentUser } from '$lib/auth';
 	import { canAdminApp, canWriteApp } from '$lib/capabilities';
 	import { logLevelColor, statusColor } from '$lib/styles';
 	import {
 		checkHostAgainstClaims,
@@ -21,6 +24,7 @@
 		pathKindMismatchWarning
 	} from '$lib/route-utils';
 	import CodeEditor from '$lib/CodeEditor.svelte';
 	import ConfirmModal from '$lib/ConfirmModal.svelte';
 	import { format as formatRhai } from '$lib/rhai';
 	/// Pretty-print a JSON string in place, leaving it untouched if the
@@ -47,6 +51,11 @@
 	let appSlug = $state<string | null>(null);
 	let appDomains = $state<AppDomain[]>([]);
 	let appMyRole = $state<AppRole | null>(null);
 	const me = $derived($currentUser);
 	const canWrite = $derived(canWriteApp(me, appMyRole));
 	const canAdmin = $derived(canAdminApp(me, appMyRole));
 	async function loadScript() {
 		scriptLoading = true;
@@ -58,15 +67,16 @@
 			editableDescription = script.description ?? '';
 			editableTimeout = script.timeout_seconds;
 			editableSandbox = { ...(script.sandbox ?? {}) };
-			// Resolve the owning app's slug for the breadcrumb and its
+			// Resolve the owning app for the breadcrumb (slug),
-			// domain claims for the route form's suggestions + live
+			// route-form host suggestions (domain claims), and UI
-			// validation. Both are non-fatal — the page works without
+			// shadowing (my_role on this app). All non-fatal — the
-			// them.
+			// page renders without them, just with reduced fidelity.
 			const appId = script.app_id;
 			void api.apps
 				.get(appId)
 				.then((a) => {
 					appSlug = a.slug;
 					appMyRole = a.my_role ?? null;
 				})
 				.catch(() => {});
 			void api.domains
@@ -366,16 +376,25 @@
 	}
 	// ---------------- deletion ----------------
 	let confirmingDelete = $state(false);
 	let deleting = $state(false);
-	async function remove() {
+	let deleteError = $state<string | null>(null);
 	function askDelete() {
 		deleteError = null;
 		confirmingDelete = true;
 	}
 	async function confirmDelete() {
 		if (!script) return;
 		if (!confirm(`Delete script "${script.name}"? This cannot be undone.`)) return;
 		deleting = true;
 		deleteError = null;
 		try {
 			await api.scripts.remove(id);
 			await goto(base + '/');
 		} catch (e) {
-			alert(e instanceof Error ? e.message : String(e));
+			deleteError = e instanceof Error ? e.message : String(e);
 		} finally {
 			deleting = false;
 		}
 	}
@@ -386,6 +405,15 @@
 		void loadRoutes();
 		void loadLogs();
 	});
 	// Defense-in-depth: anyone non-admin who lands on the Settings
 	// tab via a stale link gets bounced back to Edit. The tab button
 	// itself is also hidden.
 	$effect(() => {
 		if (!canAdmin && tab === 'settings') {
 			tab = 'edit';
 		}
 	});
 </script>
 <section>
@@ -410,9 +438,11 @@
 					v{script.version} · timeout {script.timeout_seconds}s · {script.description ?? 'no description'}
 				</p>
 			</div>
-			<button type="button" class="danger" onclick={remove} disabled={deleting}>
+			{#if canAdmin}
-				{deleting ? 'Deleting…' : 'Delete'}
+				<button type="button" class="danger" onclick={askDelete} disabled={deleting}>
-			</button>
+					{deleting ? 'Deleting…' : 'Delete'}
 				</button>
 			{/if}
 		</header>
 		<nav class="tabs">
@@ -423,7 +453,9 @@
 					<span class="badge-count">{routes.length}</span>
 				{/if}
 			</button>
-			<button class:active={tab === 'settings'} onclick={() => (tab = 'settings')}>Settings</button>
+			{#if canAdmin}
 				<button class:active={tab === 'settings'} onclick={() => (tab = 'settings')}>Settings</button>
 			{/if}
 			<button class:active={tab === 'executions'} onclick={() => (tab = 'executions')}>
 				Executions
 			</button>
@@ -435,26 +467,35 @@
 				<section class="card">
 					<header class="editor-header">
 						<h2>Source</h2>
-						<button type="button" class="ghost small" onclick={formatRhaiSource}>
+						{#if canWrite}
-							Format
+							<button type="button" class="ghost small" onclick={formatRhaiSource}>
-						</button>
+								Format
 							</button>
 						{/if}
 					</header>
-					<CodeEditor bind:value={editableSource} language="rhai" minHeight="22rem" />
+					<CodeEditor
 						bind:value={editableSource}
 						language="rhai"
 						minHeight="22rem"
 						readOnly={!canWrite}
 					/>
 					{#if rhaiFormatError}
 						<div class="error inline">{rhaiFormatError}</div>
 					{/if}
 					{#if saveSourceError}
 						<div class="error inline">{saveSourceError}</div>
 					{/if}
-					<div class="actions">
+					{#if canWrite}
-						<button
+						<div class="actions">
-							type="button"
+							<button
-							onclick={saveSource}
+								type="button"
-							disabled={savingSource || editableSource === script.source}
+								onclick={saveSource}
-						>
+								disabled={savingSource || editableSource === script.source}
-							{savingSource ? 'Saving…' : 'Save'}
+							>
-						</button>
+								{savingSource ? 'Saving…' : 'Save'}
-					</div>
+							</button>
 						</div>
 					{/if}
 				</section>
 				<section class="card">
@@ -510,12 +551,14 @@
 			<section class="card wide">
 				<header class="card-header">
 					<h2>Routes</h2>
-					<button type="button" onclick={() => (showAddRoute = !showAddRoute)}>
+					{#if canWrite}
-						{showAddRoute ? 'Cancel' : '+ Add route'}
+						<button type="button" onclick={() => (showAddRoute = !showAddRoute)}>
-					</button>
+							{showAddRoute ? 'Cancel' : '+ Add route'}
 						</button>
 					{/if}
 				</header>
-				{#if showAddRoute}
+				{#if showAddRoute && canWrite}
 					<form class="route-form" onsubmit={submitRoute}>
 						<label class="full">
 							<span>Path</span>
@@ -626,9 +669,11 @@
 												: r.host}
 									</span>
 									<span class="path">{r.path}</span>
-									<button type="button" class="link danger" onclick={() => removeRoute(r.id)}>
+									{#if canWrite}
-										remove
+										<button type="button" class="link danger" onclick={() => removeRoute(r.id)}>
-									</button>
+											remove
 										</button>
 									{/if}
 								</div>
 								{#if info}
 									<div class="route-url muted">→ {fullUrlForRoute(r)}</div>
@@ -670,7 +715,7 @@
 			</section>
 			<!-- ===================================================== SETTINGS ===== -->
-		{:else if tab === 'settings'}
+		{:else if tab === 'settings' && canAdmin}
 			<section class="card wide">
 				<h2>General</h2>
 				<label>
@@ -786,6 +831,35 @@
 				{/if}
 			</section>
 		{/if}
 		{#if confirmingDelete && script}
 			<ConfirmModal
 				title="Delete script “{script.name}”"
 				variant="danger"
 				confirmLabel="Delete script"
 				busyLabel="Deleting…"
 				confirmPhrase={script.name}
 				confirmPhrasePrompt="Type the script name to confirm:"
 				busy={deleting}
 				onConfirm={confirmDelete}
 				onCancel={() => (confirmingDelete = false)}
 			>
 				<p>
 					This will <strong>permanently delete</strong>
 					<strong>{script.name}</strong>, all its routes, and all its
 					execution logs. There is no undo.
 				</p>
 				{#if routes.length > 0}
 					<p class="muted">
 						{routes.length} route{routes.length === 1 ? '' : 's'} bound to
 						this script will be removed.
 					</p>
 				{/if}
 				{#if deleteError}
 					<p class="modal-error">{deleteError}</p>
 				{/if}
 			</ConfirmModal>
 		{/if}
 	{/if}
 </section>
--- a/dashboard/src/routes/users/+page.svelte
+++ b/dashboard/src/routes/users/+page.svelte
@@ -79,6 +79,13 @@
 	let deleteTarget = $state<AdminDto | null>(null);
 	let deletePending = $state(false);
 	// Deactivate modal -------------------------------------------------------
 	// Reactivate is one-click (non-destructive); deactivate routes
 	// through the modal because it signs the user out and expires
 	// every API key they hold.
 	let deactivateTarget = $state<AdminDto | null>(null);
 	let deactivatePending = $state(false);
 	// Validation rules (mirror backend: 2-32, [a-z0-9._-]) -------------------
 	const USERNAME_RE = /^[a-z0-9._-]{2,32}$/;
 	const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
@@ -219,19 +226,36 @@
 		}
 	}
-	async function toggleActive(row: AdminDto) {
+	async function reactivate(row: AdminDto) {
 		try {
-			const updated = await api.admins.update(row.id, { is_active: !row.is_active });
+			const updated = await api.admins.update(row.id, { is_active: true });
 			admins = admins.map((a) => (a.id === updated.id ? updated : a));
-			flash(
+			flash('info', `${updated.username} reactivated.`);
 				'info',
 				`${updated.username} ${updated.is_active ? 'reactivated' : 'deactivated'}.`
 			);
 		} catch (e) {
 			flash('error', e instanceof ApiError ? e.message : 'failed to update user');
 		}
 	}
 	function askDeactivate(row: AdminDto) {
 		deactivateTarget = row;
 	}
 	async function confirmDeactivate() {
 		if (!deactivateTarget) return;
 		deactivatePending = true;
 		const target = deactivateTarget;
 		try {
 			const updated = await api.admins.update(target.id, { is_active: false });
 			admins = admins.map((a) => (a.id === updated.id ? updated : a));
 			deactivateTarget = null;
 			flash('info', `${updated.username} deactivated.`);
 		} catch (e) {
 			flash('error', e instanceof ApiError ? e.message : 'failed to update user');
 		} finally {
 			deactivatePending = false;
 		}
 	}
 	function openDelete(row: AdminDto) {
 		deleteTarget = row;
 	}
@@ -353,7 +377,8 @@
 							{ label: 'Edit', onClick: () => openEdit(row) },
 							{
 								label: row.is_active ? 'Deactivate' : 'Reactivate',
-								onClick: () => toggleActive(row)
+								onClick: () =>
 									row.is_active ? askDeactivate(row) : reactivate(row)
 							},
 							{
 								label: 'Delete',
@@ -571,6 +596,30 @@
 	</div>
 {/if}
 <!-- Deactivate confirmation -->
 {#if deactivateTarget}
 	{@const dt = deactivateTarget}
 	<ConfirmModal
 		title="Deactivate {dt.username}?"
 		variant="danger"
 		confirmLabel="Deactivate"
 		busyLabel="Deactivating…"
 		busy={deactivatePending}
 		onConfirm={confirmDeactivate}
 		onCancel={() => (deactivateTarget = null)}
 	>
 		<p>
 			Deactivating signs <strong>{dt.username}</strong> out immediately and
 			expires <strong>every API key</strong> they hold. Their sessions and keys
 			won't come back if you reactivate — they'll need to log in again and
 			mint new keys.
 		</p>
 		<p class="muted">
 			Reactivation is one click — this isn't permanent.
 		</p>
 	</ConfirmModal>
 {/if}
 <!-- Delete confirmation -->
 {#if deleteTarget}
 	{@const dt = deleteTarget}
--- a/dashboard/tests/e2e/README.md
+++ b/dashboard/tests/e2e/README.md
@@ -0,0 +1,75 @@
 # Dashboard E2E tests
 Browser-driven tests for the PiCloud dashboard, powered by [Playwright].
 ## Prerequisites
 The tests drive a real dashboard against a real backend. Bring up both
 before running:
 ```sh
 # 1. Postgres
 docker compose up -d postgres
 # 2. Backend (port 18080 matches dashboard/vite.config.ts dev proxy)
 PICLOUD_BIND=127.0.0.1:18080 \
 PICLOUD_ADMIN_USERNAME=admin \
 PICLOUD_ADMIN_PASSWORD=admin \
 DATABASE_URL=postgres://picloud:picloud@127.0.0.1:15432/picloud \
 cargo run -p picloud
 # 3. Browser binaries (one-time, ~200 MB)
 cd dashboard && npm run test:e2e:install
 ```
 The Vite dev server is started automatically by Playwright's `webServer`
 config — you do not need to run `npm run dev` yourself.
 ## Running
 ```sh
 cd dashboard
 npm run test:e2e          # headless, full suite
 npm run test:e2e:ui       # interactive UI runner
 npx playwright test smoke # run a single spec
 npx playwright show-report
 ```
 ## Env vars
 | Var                      | Default                  | Notes                                                             |
 | ------------------------ | ------------------------ | ----------------------------------------------------------------- |
 | `E2E_BASE_URL`           | `http://localhost:5173`  | Origin tests navigate against (dashboard is mounted at `/admin`). |
 | `E2E_API_BASE`           | `http://127.0.0.1:18080` | Backend used by globalSetup health probe + admin login.           |
 | `E2E_DASHBOARD_ORIGIN`   | `http://localhost:5173`  | Used to seed `localStorage` during globalSetup.                   |
 | `E2E_ADMIN_USERNAME`     | `admin`                  | Bootstrap admin to log in as.                                     |
 | `E2E_ADMIN_PASSWORD`     | `admin`                  | Match `PICLOUD_ADMIN_PASSWORD` above.                             |
 | `PICLOUD_DASHBOARD_PORT` | `5173`                   | Dev server port — picked up by both Vite and Playwright.          |
 ## How isolation works
 Tests share one backend + one Postgres. To avoid cross-test interference:
 - A shared bootstrap admin session is captured once in
  `tests/e2e/.auth/admin.json` (gitignored) and reused by every test via
  `storageState`.
 - Each test creates resources with a unique slug / username produced by
  `fixtures/ids.ts` (`e2e-<prefix>-w<worker>-<random>`).
 - Each test registers cleanup via `fixtures/cleanup.ts` and tears down
  in `afterEach`. Cleanup is best-effort: a missing resource doesn't
  fail the suite, so a test can pre-delete and still register the entry.
 ## Layout
 ```
 tests/e2e/
  global-setup.ts          # health probe + admin login + storageState seed
  smoke.spec.ts            # A.5 smoke
  fixtures/
    auth.ts                # UI login/logout helpers (for login-flow specs)
    api.ts                 # bearer-token-backed APIRequestContext
    ids.ts                 # unique slug/username generators (test-fixture)
    cleanup.ts             # afterEach resource teardown
 ```
 [Playwright]: https://playwright.dev
--- a/dashboard/tests/e2e/apps/apps.spec.ts
+++ b/dashboard/tests/e2e/apps/apps.spec.ts
@@ -0,0 +1,335 @@
 import { expect, type Page } from '@playwright/test';
 import { test } from '../fixtures/ids';
 import { CleanupRegistry } from '../fixtures/cleanup';
 import { adminApi } from '../fixtures/api';
 import { loginAsUserToken, pageWithUserToken } from '../fixtures/role-page';
 const MEMBER_PW = 'e2e-member-pw';
 async function seedAppAndMember(opts: {
 	slug: string;
 	username: string;
 	role: 'viewer' | 'editor' | 'app_admin';
 }): Promise<{ appId: string; userId: string }> {
 	const api = await adminApi();
 	try {
 		const appRes = await api.post('/api/v1/admin/apps', {
 			data: { slug: opts.slug, name: opts.slug }
 		});
 		expect(appRes.ok()).toBe(true);
 		const appId = ((await appRes.json()) as { id: string }).id;
 		const userRes = await api.post('/api/v1/admin/admins', {
 			data: { username: opts.username, password: MEMBER_PW, instance_role: 'member' }
 		});
 		expect(userRes.ok()).toBe(true);
 		const userId = ((await userRes.json()) as { id: string }).id;
 		const memberRes = await api.post(`/api/v1/admin/apps/${opts.slug}/members`, {
 			data: { user_id: userId, role: opts.role }
 		});
 		expect(memberRes.ok()).toBe(true);
 		return { appId, userId };
 	} finally {
 		await api.dispose();
 	}
 }
 // Phase B2 — Apps Lifecycle. Create, view, edit, delete, plus the
 // historical-slug takeover flow and adversarial inputs.
 const cleanup = new CleanupRegistry();
 test.afterEach(async () => {
 	await cleanup.run();
 });
 function failOnDialog(page: Page): void {
 	page.on('dialog', async (dialog) => {
 		await dialog.dismiss();
 		throw new Error(`Unexpected browser dialog fired: ${dialog.type()} — "${dialog.message()}"`);
 	});
 }
 async function openCreateForm(page: Page): Promise<void> {
 	await page.goto('/admin/apps');
 	await page.getByRole('button', { name: 'New app' }).click();
 }
 async function createApp(
 	page: Page,
 	opts: { name: string; slug: string; description?: string }
 ): Promise<void> {
 	await openCreateForm(page);
 	await page.getByLabel('Name').fill(opts.name);
 	// Clear the auto-derived slug and type the test-controlled one so
 	// we know exactly which slug we'll register for cleanup.
 	const slugInput = page.getByLabel('Slug');
 	await slugInput.fill('');
 	await slugInput.fill(opts.slug);
 	if (opts.description !== undefined) {
 		await page.getByLabel('Description').fill(opts.description);
 	}
 	await page.getByRole('button', { name: 'Create app' }).click();
 }
 test.describe('B2 apps lifecycle', () => {
 	test('create app: slug auto-derives from name, app appears in list', async ({
 		page,
 		uniqueSlug
 	}) => {
 		const slug = uniqueSlug('lifecycle');
 		const displayName = slug.replace(/-/g, ' ');
 		await openCreateForm(page);
 		await page.getByLabel('Name').fill(displayName);
 		// Slug auto-derives — the input value is set, no extra typing.
 		const slugInput = page.getByLabel('Slug');
 		await expect(slugInput).toHaveValue(slug);
 		await page.getByRole('button', { name: 'Create app' }).click();
 		cleanup.app(slug);
 		await expect(page.getByRole('link', { name: new RegExp(displayName) })).toBeVisible();
 	});
 	test('edit name + description in settings persists across reload', async ({
 		page,
 		uniqueSlug
 	}) => {
 		const slug = uniqueSlug('edit');
 		await createApp(page, { name: slug, slug });
 		cleanup.app(slug);
 		await page.getByRole('link', { name: new RegExp(slug) }).click();
 		await expect(page).toHaveURL(new RegExp(`/admin/apps/${slug}$`));
 		await page.getByRole('button', { name: 'Settings' }).click();
 		const newName = `${slug} renamed`;
 		const newDesc = 'updated description';
 		await page.getByLabel('Name').fill(newName);
 		await page.getByLabel('Description').fill(newDesc);
 		await page.getByRole('button', { name: 'Save changes' }).click();
 		// Wait for the network round-trip to settle — the busy label
 		// flips back to "Save changes" when done.
 		await expect(page.getByRole('button', { name: 'Save changes' })).toBeEnabled();
 		await page.reload();
 		await page.getByRole('button', { name: 'Settings' }).click();
 		await expect(page.getByLabel('Name')).toHaveValue(newName);
 		await expect(page.getByLabel('Description')).toHaveValue(newDesc);
 	});
 	test('delete: wrong phrase keeps button disabled, right phrase removes app', async ({
 		page,
 		uniqueSlug
 	}) => {
 		const slug = uniqueSlug('delete');
 		await createApp(page, { name: slug, slug });
 		cleanup.app(slug); // belt-and-braces; cleanup is best-effort
 		await page.getByRole('link', { name: new RegExp(slug) }).click();
 		await page.getByRole('button', { name: 'Settings' }).click();
 		await page.getByRole('button', { name: 'Delete app' }).click();
 		const dialog = page.getByRole('dialog');
 		await expect(dialog).toBeVisible();
 		const phraseInput = dialog.getByRole('textbox');
 		const confirmBtn = dialog.getByRole('button', { name: 'Delete app' });
 		await expect(confirmBtn).toBeDisabled();
 		await phraseInput.fill('wrong-phrase');
 		await expect(confirmBtn).toBeDisabled();
 		await phraseInput.fill(slug);
 		await expect(confirmBtn).toBeEnabled();
 		await confirmBtn.click();
 		await expect(page).toHaveURL(/\/admin\/apps$/);
 		await expect(page.getByRole('link', { name: new RegExp(slug) })).toHaveCount(0);
 	});
 	test('historical slug warning surfaces; force-takeover succeeds', async ({
 		page,
 		uniqueSlug
 	}) => {
 		const origSlug = uniqueSlug('hist');
 		const renamedSlug = `${origSlug}-r`;
 		// Historical-redirect rows are created on RENAME, not on
 		// delete. So: create app, rename it, original slug now lives
 		// in app_slug_history.
 		const api = await adminApi();
 		try {
 			const created = await api.post('/api/v1/admin/apps', {
 				data: { slug: origSlug, name: origSlug }
 			});
 			expect(created.ok()).toBe(true);
 			const renamed = await api.patch(
 				`/api/v1/admin/apps/${encodeURIComponent(origSlug)}`,
 				{ data: { slug: renamedSlug } }
 			);
 			expect(renamed.ok()).toBe(true);
 		} finally {
 			await api.dispose();
 		}
 		cleanup.app(renamedSlug); // the renamed app still exists
 		await openCreateForm(page);
 		await page.getByLabel('Name').fill(origSlug);
 		await page.getByLabel('Slug').fill('');
 		await page.getByLabel('Slug').fill(origSlug);
 		await page.getByRole('button', { name: 'Create app' }).click();
 		await expect(page.locator('.warning')).toBeVisible();
 		await expect(page.locator('.warning')).toContainText(/previously redirected/i);
 		await page.getByRole('button', { name: /claim slug anyway/i }).click();
 		cleanup.app(origSlug); // the takeover created a new app
 		await expect(page.getByRole('link', { name: new RegExp(origSlug) })).toBeVisible();
 	});
 });
 test.describe('B2 apps adversarial', () => {
 	test('slug with uppercase + spaces is normalized in-place', async ({ page, uniqueSlug }) => {
 		const base = uniqueSlug('norm');
 		await openCreateForm(page);
 		await page.getByLabel('Name').fill(base);
 		const slugInput = page.getByLabel('Slug');
 		await slugInput.fill('');
 		// Simulate the user typing/pasting an invalid slug. The
 		// oninput handler runs slugify() and rewrites the input value.
 		await slugInput.fill(`  Hello WORLD  ${base}!`);
 		await expect(slugInput).toHaveValue(`hello-world-${base}`);
 	});
 	test('xss in name and description renders as text everywhere', async ({ page, uniqueSlug }) => {
 		failOnDialog(page);
 		const slug = uniqueSlug('xss');
 		const payload = '<img src=x onerror=alert(1)><script>window.__xss=true;</script>';
 		await createApp(page, { name: payload, slug, description: payload });
 		cleanup.app(slug);
 		// List page — the link's accessible name contains the literal
 		// payload text, not the parsed HTML.
 		await expect(page.getByRole('link', { name: new RegExp('img src=x') })).toBeVisible();
 		// Detail page — open it; payload renders in the breadcrumb /
 		// header as text only.
 		await page.goto(`/admin/apps/${slug}`);
 		const xssRan = await page.evaluate(
 			() => (window as unknown as { __xss?: boolean }).__xss === true
 		);
 		expect(xssRan).toBe(false);
 		expect(await page.locator('script:has-text("__xss")').count()).toBe(0);
 	});
 	test('very long name does not crash the dashboard', async ({ page, uniqueSlug }) => {
 		// The backend currently has no name length cap; the dashboard
 		// just needs to keep rendering when handed an unusually long
 		// value. Guards against layout / locator regressions when a
 		// future test or user creates an oversized app.
 		const slug = uniqueSlug('long');
 		const longName = 'A'.repeat(10_000);
 		await openCreateForm(page);
 		await page.getByLabel('Name').fill(longName);
 		await page.getByLabel('Slug').fill('');
 		await page.getByLabel('Slug').fill(slug);
 		await page.getByRole('button', { name: 'Create app' }).click();
 		const errorVisible = await page
 			.locator('.create-form .error')
 			.isVisible()
 			.catch(() => false);
 		if (errorVisible) {
 			// Server rejected — fine, no cleanup needed.
 			await expect(page.getByRole('link', { name: new RegExp(slug) })).toHaveCount(0);
 			return;
 		}
 		// Server accepted — confirm the dashboard still renders and is
 		// navigable. Detail page must load too.
 		cleanup.app(slug);
 		await expect(page.getByRole('link', { name: new RegExp(slug) })).toBeVisible();
 		await page.goto(`/admin/apps/${slug}`);
 		await expect(page.getByRole('button', { name: 'Settings' })).toBeVisible();
 	});
 });
 test.describe('B2 apps role shadowing', () => {
 	test('viewer member sees no "New app" on the apps list', async ({
 		browser,
 		uniqueSlug,
 		uniqueUsername
 	}) => {
 		const slug = uniqueSlug('vlist');
 		const username = uniqueUsername('viewer');
 		const { userId } = await seedAppAndMember({ slug, username, role: 'viewer' });
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		const token = await loginAsUserToken(username, MEMBER_PW);
 		const page = await pageWithUserToken(browser, token);
 		try {
 			await page.goto('/admin/apps');
 			// Member can see the apps list (just the one they belong to)
 			// but the create-app affordance is hidden.
 			await expect(page.getByRole('link', { name: new RegExp(slug) })).toBeVisible();
 			await expect(page.getByRole('button', { name: /^New app$/ })).toHaveCount(0);
 		} finally {
 			await page.context().close();
 		}
 	});
 	test('viewer sees no Add domain form and no Settings tab on app detail', async ({
 		browser,
 		uniqueSlug,
 		uniqueUsername
 	}) => {
 		const slug = uniqueSlug('vdom');
 		const username = uniqueUsername('viewer');
 		const { userId } = await seedAppAndMember({ slug, username, role: 'viewer' });
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		const token = await loginAsUserToken(username, MEMBER_PW);
 		const page = await pageWithUserToken(browser, token);
 		try {
 			await page.goto(`/admin/apps/${slug}`);
 			await expect(
 				page.getByRole('button', { name: /^Scripts \(\d+\)$/ })
 			).toBeVisible();
 			// Settings tab is absent.
 			await expect(page.getByRole('button', { name: /^Settings$/ })).toHaveCount(0);
 			// Domains tab still listable, but no Add-domain submit.
 			await page.getByRole('button', { name: /^Domains \(\d+\)$/ }).click();
 			await expect(page.getByRole('button', { name: /^Add domain$/ })).toHaveCount(0);
 		} finally {
 			await page.context().close();
 		}
 	});
 	test('editor sees New script but no Settings tab', async ({
 		browser,
 		uniqueSlug,
 		uniqueUsername
 	}) => {
 		const slug = uniqueSlug('edit');
 		const username = uniqueUsername('editor');
 		const { userId } = await seedAppAndMember({ slug, username, role: 'editor' });
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		const token = await loginAsUserToken(username, MEMBER_PW);
 		const page = await pageWithUserToken(browser, token);
 		try {
 			await page.goto(`/admin/apps/${slug}`);
 			await expect(page.getByRole('button', { name: /^New script$/ })).toBeVisible();
 			await expect(page.getByRole('button', { name: /^Settings$/ })).toHaveCount(0);
 			await expect(
 				page.getByRole('button', { name: /^Members \(\d+\)$/ })
 			).toHaveCount(0);
 		} finally {
 			await page.context().close();
 		}
 	});
 });
--- a/dashboard/tests/e2e/auth/auth.spec.ts
+++ b/dashboard/tests/e2e/auth/auth.spec.ts
@@ -0,0 +1,118 @@
 import { expect, test, type Page } from '@playwright/test';
 import { loginAsAdmin, logout } from '../fixtures/auth';
 // Phase B1 — Auth & Navigation. Every interaction with the login form
 // and the layout-level redirects, plus the obvious adversarial inputs.
 const VALID_USERNAME = process.env.E2E_ADMIN_USERNAME ?? 'admin';
 const VALID_PASSWORD = process.env.E2E_ADMIN_PASSWORD ?? 'admin';
 function failOnDialog(page: Page): void {
 	page.on('dialog', async (dialog) => {
 		await dialog.dismiss();
 		throw new Error(`Unexpected browser dialog fired: ${dialog.type()} — "${dialog.message()}"`);
 	});
 }
 test.describe('B1 auth — unauthenticated', () => {
 	test.use({ storageState: { cookies: [], origins: [] } });
 	test('valid credentials land on the apps list', async ({ page }) => {
 		await loginAsAdmin(page);
 		await expect(page.getByRole('heading', { name: 'Apps', level: 1 })).toBeVisible();
 	});
 	test('wrong password shows an inline error and stays on /login', async ({ page }) => {
 		await page.goto('/admin/login');
 		await page.getByLabel('Username').fill(VALID_USERNAME);
 		await page.getByLabel('Password').fill('definitely-not-the-password');
 		await page.getByRole('button', { name: /sign in/i }).click();
 		const error = page.locator('.error');
 		await expect(error).toBeVisible();
 		await expect(error).not.toHaveText('');
 		await expect(page).toHaveURL(/\/admin\/login$/);
 		// localStorage must remain empty — a failed login should not
 		// leak a session token.
 		const token = await page.evaluate(() => localStorage.getItem('picloud.admin.token'));
 		expect(token).toBeNull();
 	});
 	test('empty submit is blocked by the browser and does not navigate', async ({ page }) => {
 		await page.goto('/admin/login');
 		await page.getByRole('button', { name: /sign in/i }).click();
 		// HTML5 validation prevents submission; URL is unchanged and the
 		// username input is reported invalid.
 		await expect(page).toHaveURL(/\/admin\/login$/);
 		const usernameInvalid = await page
 			.getByLabel('Username')
 			.evaluate((el: HTMLInputElement) => !el.validity.valid);
 		expect(usernameInvalid).toBe(true);
 		await expect(page.locator('.error')).toBeHidden();
 	});
 	test('visiting an authed route redirects to /login', async ({ page }) => {
 		await page.goto('/admin/apps');
 		await expect(page).toHaveURL(/\/admin\/login$/);
 		await expect(page.getByLabel('Username')).toBeVisible();
 	});
 	test('password field is type=password (no plaintext echo)', async ({ page }) => {
 		await page.goto('/admin/login');
 		await expect(page.getByLabel('Password')).toHaveAttribute('type', 'password');
 	});
 	test('xss payload in username is escaped and does not execute', async ({ page }) => {
 		failOnDialog(page);
 		const payload = '<script>window.__xss = true;</script><img src=x onerror=alert(1)>';
 		await page.goto('/admin/login');
 		await page.getByLabel('Username').fill(payload);
 		await page.getByLabel('Password').fill('whatever');
 		await page.getByRole('button', { name: /sign in/i }).click();
 		// Whatever the API does with that input, the page must remain
 		// safe: no script tag injected into the DOM, no global side
 		// effect, and a visible error (since the credentials don't
 		// match any user).
 		await expect(page.locator('.error')).toBeVisible();
 		const xssRan = await page.evaluate(
 			() => (window as unknown as { __xss?: boolean }).__xss === true
 		);
 		expect(xssRan).toBe(false);
 		const injectedScript = await page.locator('script:has-text("__xss")').count();
 		expect(injectedScript).toBe(0);
 		// The form must still be functional after the rejected attempt.
 		await page.getByLabel('Username').fill('');
 		await page.getByLabel('Username').fill(VALID_USERNAME);
 		await page.getByLabel('Password').fill('');
 		await page.getByLabel('Password').fill(VALID_PASSWORD);
 		await page.getByRole('button', { name: /sign in/i }).click();
 		await expect(page).toHaveURL(/\/admin\/apps$/);
 	});
 });
 test.describe('B1 auth — authenticated', () => {
 	test('visiting /login while signed in bounces to /apps', async ({ page }) => {
 		await page.goto('/admin/login');
 		await expect(page).toHaveURL(/\/admin\/apps$/);
 	});
 });
 test.describe('B1 auth — logout', () => {
 	// Logout must NOT use the shared storageState token, or it would
 	// invalidate the session every other test relies on. Each run
 	// here logs in fresh so its session is disposable.
 	test.use({ storageState: { cookies: [], origins: [] } });
 	test('logout clears the session and lands on /login', async ({ page }) => {
 		await loginAsAdmin(page);
 		await expect(page.getByRole('heading', { name: 'Apps', level: 1 })).toBeVisible();
 		await logout(page);
 		const token = await page.evaluate(() => localStorage.getItem('picloud.admin.token'));
 		expect(token).toBeNull();
 		// And the authed area is now gated again.
 		await page.goto('/admin/apps');
 		await expect(page).toHaveURL(/\/admin\/login$/);
 	});
 });
--- a/dashboard/tests/e2e/fixtures/api.ts
+++ b/dashboard/tests/e2e/fixtures/api.ts
@@ -0,0 +1,47 @@
 import { request, type APIRequestContext } from '@playwright/test';
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const API_BASE = process.env.E2E_API_BASE ?? 'http://127.0.0.1:18080';
 const STATE_PATH = path.join(__dirname, '..', '.auth', 'admin.json');
 interface StoredState {
 	origins: Array<{
 		origin: string;
 		localStorage: Array<{ name: string; value: string }>;
 	}>;
 }
 let cachedToken: string | null = null;
 async function readAdminToken(): Promise<string> {
 	if (cachedToken) return cachedToken;
 	const raw = await fs.readFile(STATE_PATH, 'utf8');
 	const state = JSON.parse(raw) as StoredState;
 	for (const origin of state.origins) {
 		const entry = origin.localStorage.find((e) => e.name === 'picloud.admin.token');
 		if (entry) {
 			cachedToken = entry.value;
 			return entry.value;
 		}
 	}
 	throw new Error(`No picloud.admin.token in ${STATE_PATH} — did globalSetup run?`);
 }
 // Thin wrapper around Playwright's request context that injects the
 // admin bearer token from the shared storageState. Use this for
 // setup/teardown shortcuts when the *test itself* is about something
 // else (e.g., a script-editor test that just needs an app to exist).
 export async function adminApi(): Promise<APIRequestContext> {
 	const token = await readAdminToken();
 	return request.newContext({
 		baseURL: API_BASE,
 		extraHTTPHeaders: {
 			authorization: `Bearer ${token}`,
 			'content-type': 'application/json'
 		}
 	});
 }
--- a/dashboard/tests/e2e/fixtures/auth.ts
+++ b/dashboard/tests/e2e/fixtures/auth.ts
@@ -0,0 +1,21 @@
 import type { Page } from '@playwright/test';
 import { expect } from '@playwright/test';
 const ADMIN_USERNAME = process.env.E2E_ADMIN_USERNAME ?? 'admin';
 const ADMIN_PASSWORD = process.env.E2E_ADMIN_PASSWORD ?? 'admin';
 // Drive the login form like a real user. globalSetup already saves a
 // storageState for the shared admin, so most tests don't need this —
 // it's reserved for specs that explicitly cover the login UI.
 export async function loginAsAdmin(page: Page): Promise<void> {
 	await page.goto('/admin/login');
 	await page.getByLabel('Username').fill(ADMIN_USERNAME);
 	await page.getByLabel('Password').fill(ADMIN_PASSWORD);
 	await page.getByRole('button', { name: /sign in/i }).click();
 	await expect(page).toHaveURL(/\/admin\/apps$/);
 }
 export async function logout(page: Page): Promise<void> {
 	await page.getByRole('button', { name: /logout/i }).click();
 	await expect(page).toHaveURL(/\/admin\/login$/);
 }
--- a/dashboard/tests/e2e/fixtures/cleanup.ts
+++ b/dashboard/tests/e2e/fixtures/cleanup.ts
@@ -0,0 +1,77 @@
 import type { APIRequestContext } from '@playwright/test';
 import { adminApi } from './api';
 // Resources to delete after a test, in LIFO order. Tests register
 // their creations and the registry tears everything down in
 // `run()` — typically called from `test.afterEach`.
 //
 // A non-2xx status (other than 404) is treated as a real failure and
 // logged to stderr. The previous shape silently swallowed every
 // error, so a backend that started returning 500 on cleanup would
 // have leaked orphans invisibly across runs. 404 stays tolerated —
 // the test may have already deleted the resource itself.
 interface CleanupItem {
 	label: string;
 	path: string;
 }
 export class CleanupRegistry {
 	private items: CleanupItem[] = [];
 	app(slugOrId: string): void {
 		this.items.push({
 			label: `app=${slugOrId}`,
 			path: `/api/v1/admin/apps/${encodeURIComponent(slugOrId)}?force=true`
 		});
 	}
 	adminUser(userId: string): void {
 		this.items.push({
 			label: `admin=${userId}`,
 			path: `/api/v1/admin/admins/${userId}`
 		});
 	}
 	apiKey(keyId: string): void {
 		this.items.push({
 			label: `key=${keyId}`,
 			path: `/api/v1/admin/api-keys/${keyId}`
 		});
 	}
 	async run(): Promise<void> {
 		if (this.items.length === 0) return;
 		const api = await adminApi();
 		try {
 			// Copy-then-reverse so a defensive double-`run()` (or a
 			// caller that inspects the registry after a partial
 			// teardown) doesn't see the items in a re-reversed order.
 			for (const item of [...this.items].reverse()) {
 				await deleteAndReport(api, item);
 			}
 		} finally {
 			await api.dispose();
 			this.items = [];
 		}
 	}
 }
 async function deleteAndReport(
 	api: APIRequestContext,
 	item: CleanupItem
 ): Promise<void> {
 	try {
 		const res = await api.delete(item.path);
 		// 2xx and 404 are both "this resource is no longer here" — fine.
 		if (!res.ok() && res.status() !== 404) {
 			console.warn(
 				`[cleanup] ${item.label} failed: HTTP ${res.status()} ${await res.text()}`
 			);
 		}
 	} catch (err) {
 		// Network-level failure (request never reached the server,
 		// timeout, etc.). Log so a leak doesn't accumulate silently.
 		console.warn(`[cleanup] ${item.label} failed: ${(err as Error).message}`);
 	}
 }
--- a/dashboard/tests/e2e/fixtures/ids.ts
+++ b/dashboard/tests/e2e/fixtures/ids.ts
@@ -0,0 +1,42 @@
 /* eslint-disable no-empty-pattern -- Playwright fixtures require an
   object-pattern first arg; these fixtures don't depend on any other
   fixture so the pattern is intentionally empty. */
 import { test as base } from '@playwright/test';
 import { randomBytes } from 'node:crypto';
 // Tests share a single backend/Postgres. To avoid collisions we tag
 // every resource the test creates with a short random suffix plus the
 // Playwright worker index. This way two workers running the same spec
 // in parallel never fight over the same slug or username.
 export function shortId(): string {
 	return randomBytes(3).toString('hex');
 }
 export function uniqueSlug(prefix: string, workerIndex: number): string {
 	const cleaned = prefix
 		.toLowerCase()
 		.replace(/[^a-z0-9]+/g, '-')
 		.replace(/^-|-$/g, '');
 	return `e2e-${cleaned}-w${workerIndex}-${shortId()}`;
 }
 export function uniqueUsername(prefix: string, workerIndex: number): string {
 	// Username regex is [a-z0-9._-]{2,32}. Mirror the slug format.
 	const cleaned = prefix.toLowerCase().replace(/[^a-z0-9]+/g, '');
 	return `e2e${cleaned}w${workerIndex}${shortId()}`.slice(0, 32);
 }
 export const test = base.extend<{
 	uniqueSlug: (prefix: string) => string;
 	uniqueUsername: (prefix: string) => string;
 }>({
 	uniqueSlug: async ({}, use, testInfo) => {
 		await use((prefix) => uniqueSlug(prefix, testInfo.workerIndex));
 	},
 	uniqueUsername: async ({}, use, testInfo) => {
 		await use((prefix) => uniqueUsername(prefix, testInfo.workerIndex));
 	}
 });
 export { expect } from '@playwright/test';
--- a/dashboard/tests/e2e/fixtures/role-page.ts
+++ b/dashboard/tests/e2e/fixtures/role-page.ts
@@ -0,0 +1,46 @@
 // Helpers for tests that drive the dashboard as a non-bootstrap admin
 // (member with an app-membership row, custom InstanceRole, etc.).
 //
 // `loginAsUserToken` exchanges username/password for a bearer token
 // via the admin API. `pageWithUserToken` opens a fresh browser
 // context, seeds the dashboard's localStorage entry, and returns the
 // page ready to navigate. Callers are responsible for closing the
 // returned page's context.
 import { expect, request, type Browser, type Page } from '@playwright/test';
 const API_BASE = process.env.E2E_API_BASE ?? 'http://127.0.0.1:18080';
 export async function loginAsUserToken(
 	username: string,
 	password: string
 ): Promise<string> {
 	const probe = await request.newContext({ baseURL: API_BASE });
 	try {
 		const res = await probe.post('/api/v1/admin/auth/login', {
 			data: { username, password },
 			headers: { 'content-type': 'application/json' }
 		});
 		expect(res.ok()).toBe(true);
 		return ((await res.json()) as { token: string }).token;
 	} finally {
 		await probe.dispose();
 	}
 }
 export async function pageWithUserToken(
 	browser: Browser,
 	token: string
 ): Promise<Page> {
 	const ctx = await browser.newContext({ storageState: undefined });
 	const page = await ctx.newPage();
 	// Seed localStorage on the right origin, then navigate normally.
 	await page.goto('/admin/login');
 	await page.evaluate(
 		([key, value]) => {
 			localStorage.setItem(key, value);
 		},
 		['picloud.admin.token', token]
 	);
 	return page;
 }
--- a/dashboard/tests/e2e/global-setup.ts
+++ b/dashboard/tests/e2e/global-setup.ts
@@ -0,0 +1,146 @@
 import { chromium, request } from '@playwright/test';
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const API_BASE = process.env.E2E_API_BASE ?? 'http://127.0.0.1:18080';
 const DASHBOARD_PORT = Number(process.env.PICLOUD_DASHBOARD_PORT ?? 5173);
 const DASHBOARD_ORIGIN = process.env.E2E_DASHBOARD_ORIGIN ?? `http://localhost:${DASHBOARD_PORT}`;
 const ADMIN_USERNAME = process.env.E2E_ADMIN_USERNAME ?? 'admin';
 const ADMIN_PASSWORD = process.env.E2E_ADMIN_PASSWORD ?? 'admin';
 const AUTH_DIR = path.join(__dirname, '.auth');
 const ADMIN_STATE_PATH = path.join(AUTH_DIR, 'admin.json');
 export default async function globalSetup(): Promise<void> {
 	await assertBackendUp();
 	await fs.mkdir(AUTH_DIR, { recursive: true });
 	const token = await loginAsAdmin();
 	await sweepOrphans(token);
 	await persistAdminStorageState(token);
 }
 async function assertBackendUp(): Promise<void> {
 	const probe = await request.newContext();
 	try {
 		const res = await probe.get(`${API_BASE}/healthz`, { timeout: 5_000 });
 		if (!res.ok()) {
 			throw new Error(
 				`backend /healthz returned ${res.status()} — is \`cargo run -p picloud\` listening on ${API_BASE}?`
 			);
 		}
 	} catch (err) {
 		throw new Error(
 			`Could not reach backend at ${API_BASE}/healthz. ` +
 				`Bring it up before running E2E tests:\n\n` +
 				`  docker compose up -d postgres\n` +
 				`  PICLOUD_BIND=127.0.0.1:18080 \\\n` +
 				`  PICLOUD_ADMIN_USERNAME=${ADMIN_USERNAME} \\\n` +
 				`  PICLOUD_ADMIN_PASSWORD=${ADMIN_PASSWORD} \\\n` +
 				`  DATABASE_URL=postgres://picloud:picloud@127.0.0.1:15432/picloud \\\n` +
 				`  cargo run -p picloud\n\n` +
 				`Underlying error: ${(err as Error).message}`
 		);
 	} finally {
 		await probe.dispose();
 	}
 }
 async function loginAsAdmin(): Promise<string> {
 	const ctx = await request.newContext();
 	try {
 		const res = await ctx.post(`${API_BASE}/api/v1/admin/auth/login`, {
 			data: { username: ADMIN_USERNAME, password: ADMIN_PASSWORD },
 			headers: { 'content-type': 'application/json' }
 		});
 		if (!res.ok()) {
 			const body = await res.text();
 			throw new Error(
 				`Admin login failed (${res.status()}): ${body}. ` +
 					`Verify PICLOUD_ADMIN_USERNAME / PICLOUD_ADMIN_PASSWORD match the seeded bootstrap admin.`
 			);
 		}
 		const payload = (await res.json()) as { token?: string };
 		if (!payload.token) {
 			throw new Error('Admin login response missing token field');
 		}
 		return payload.token;
 	} finally {
 		await ctx.dispose();
 	}
 }
 // Clean up apps + admin users left over from a previous crashed run.
 // The convention is that every e2e-created resource has a slug
 // starting with `e2e-` (apps) or a username starting with `e2e`
 // (admins) — see fixtures/ids.ts. Best-effort: a sweep failure must
 // not stop the suite from running.
 async function sweepOrphans(token: string): Promise<void> {
 	const ctx = await request.newContext({
 		baseURL: API_BASE,
 		extraHTTPHeaders: { authorization: `Bearer ${token}` }
 	});
 	try {
 		try {
 			const res = await ctx.get('/api/v1/admin/apps');
 			if (res.ok()) {
 				const apps = (await res.json()) as Array<{ slug: string }>;
 				for (const app of apps) {
 					if (!app.slug.startsWith('e2e-')) continue;
 					try {
 						await ctx.delete(
 							`/api/v1/admin/apps/${encodeURIComponent(app.slug)}?force=true`
 						);
 					} catch {
 						// Individual delete failure is non-fatal — the per-test
 						// cleanup will catch it on the next run.
 					}
 				}
 			}
 		} catch {
 			// Listing failed; nothing to do but proceed.
 		}
 		try {
 			const res = await ctx.get('/api/v1/admin/admins');
 			if (res.ok()) {
 				const admins = (await res.json()) as Array<{ id: string; username: string }>;
 				for (const a of admins) {
 					if (!/^e2e/.test(a.username)) continue;
 					try {
 						await ctx.delete(`/api/v1/admin/admins/${a.id}`);
 					} catch {
 						// Same per-row tolerance as above.
 					}
 				}
 			}
 		} catch {
 			// Listing failed; same as above.
 		}
 	} finally {
 		await ctx.dispose();
 	}
 }
 // The dashboard reads its session from localStorage under the key
 // `picloud.admin.token` (see src/lib/auth.ts). We can't write to
 // localStorage without a browser context, so launch a throwaway one,
 // seed the value, then save storageState for every test to reuse.
 async function persistAdminStorageState(token: string): Promise<void> {
 	const browser = await chromium.launch();
 	try {
 		const context = await browser.newContext();
 		const page = await context.newPage();
 		await page.goto(`${DASHBOARD_ORIGIN}/admin/login`);
 		await page.evaluate(
 			([key, value]) => {
 				localStorage.setItem(key, value);
 			},
 			['picloud.admin.token', token]
 		);
 		await context.storageState({ path: ADMIN_STATE_PATH });
 	} finally {
 		await browser.close();
 	}
 }
--- a/dashboard/tests/e2e/integration/integration.spec.ts
+++ b/dashboard/tests/e2e/integration/integration.spec.ts
@@ -0,0 +1,158 @@
 import { expect, request, type Page } from '@playwright/test';
 import { test } from '../fixtures/ids';
 import { CleanupRegistry } from '../fixtures/cleanup';
 import { adminApi } from '../fixtures/api';
 // Full-stack integration scenarios. Unlike the per-page B1–B8 specs,
 // these drive a complete user journey across multiple pages and then
 // verify the data plane / API surface behaves the way the dashboard
 // promised it would.
 const API_BASE = process.env.E2E_API_BASE ?? 'http://127.0.0.1:18080';
 const cleanup = new CleanupRegistry();
 test.afterEach(async () => {
 	await cleanup.run();
 });
 async function fillCodeMirror(page: Page, locator: string, text: string): Promise<void> {
 	const cm = page.locator(locator).first();
 	await cm.click();
 	await page.keyboard.press('ControlOrMeta+A');
 	await page.keyboard.press('Delete');
 	await page.keyboard.type(text);
 }
 test('end-to-end: app + domain + script + route via dashboard → invoke via public URL', async ({
 	page,
 	uniqueSlug
 }) => {
 	const slug = uniqueSlug('public');
 	const domain = `${slug}.local`;
 	const routePath = `/${slug}/hello`;
 	const scriptName = `${slug}-hello`;
 	const scriptSource = `return #{ statusCode: 200, body: #{ source: "public", slug: "${slug}" } };`;
 	// 1. Create the app from the apps list.
 	await page.goto('/admin/apps');
 	await page.getByRole('button', { name: 'New app' }).click();
 	await page.getByLabel('Name').fill(slug);
 	const slugInput = page.getByLabel('Slug');
 	await slugInput.fill('');
 	await slugInput.fill(slug);
 	await page.getByRole('button', { name: 'Create app' }).click();
 	cleanup.app(slug);
 	await expect(page.getByRole('link', { name: new RegExp(slug) })).toBeVisible();
 	// 2. Open the app and claim the domain on the Domains tab.
 	await page.getByRole('link', { name: new RegExp(slug) }).click();
 	await expect(page).toHaveURL(new RegExp(`/admin/apps/${slug}$`));
 	await page.getByRole('button', { name: /^Domains \(\d+\)$/ }).click();
 	const domainForm = page.locator('form.create-form.inline');
 	await domainForm.getByPlaceholder(/app\.example\.com/).fill(domain);
 	await domainForm.getByRole('button', { name: /^Add domain$/ }).click();
 	await expect(page.locator('.domain-row')).toContainText(domain);
 	// 3. Create the script on the Scripts tab.
 	await page.getByRole('button', { name: /^Scripts \(\d+\)$/ }).click();
 	await page.getByRole('button', { name: /^New script$/ }).click();
 	await page.getByLabel('Name').fill(scriptName);
 	await fillCodeMirror(page, '.cm-content', scriptSource);
 	await page.getByRole('button', { name: /^Create script$/ }).click();
 	// 4. Open the script and bind a route on the Routing tab.
 	await page.getByRole('link', { name: new RegExp(scriptName) }).click();
 	await page.getByRole('button', { name: 'Routing' }).click();
 	await page.getByRole('button', { name: '+ Add route' }).click();
 	const routeForm = page.locator('form.route-form');
 	await routeForm.getByLabel('Path', { exact: true }).fill(routePath);
 	await routeForm.getByLabel('Method').selectOption('GET');
 	await routeForm.getByLabel(/^Host/).fill(domain);
 	await page.getByRole('button', { name: /^Create route$/ }).click();
 	await expect(page.locator('.route-list')).toContainText(routePath);
 	// 5. Invoke via the public URL, with the Host header pointing at
 	//    the claimed domain. The dev backend listens on 127.0.0.1; the
 	//    orchestrator resolves the app from Host, then the route.
 	const publicCtx = await request.newContext({ baseURL: API_BASE });
 	try {
 		const res = await publicCtx.get(routePath, { headers: { host: domain } });
 		expect(res.status()).toBe(200);
 		const body = (await res.json()) as { source: string; slug: string };
 		expect(body.source).toBe('public');
 		expect(body.slug).toBe(slug);
 	} finally {
 		await publicCtx.dispose();
 	}
 });
 test('api key minted via dashboard works as a CLI bearer, then revoke disables it', async ({
 	page,
 	uniqueUsername
 }) => {
 	// Worker-aware unique helper instead of Date.now() — keeps two
 	// workers from minting the same name on the same millisecond.
 	const name = uniqueUsername('cli');
 	// 1. Mint the key from /profile and capture the revealed token.
 	await page.goto('/admin/profile');
 	await page.getByRole('button', { name: /\+ Mint API key/ }).click();
 	const mintForm = page.locator('form.mint');
 	await mintForm.getByPlaceholder('e.g. ci-deploy').fill(name);
 	// script:read is enough to read the scripts list — that's our
 	// "CLI verb" below.
 	await page.locator('label.scope-chip', { hasText: 'script:read' }).click();
 	await page.getByRole('button', { name: /^Mint key$/ }).click();
 	const reveal = page.locator('.reveal');
 	await expect(reveal).toBeVisible();
 	const rawToken = (await reveal.locator('code.token').textContent())?.trim();
 	expect(rawToken).toBeTruthy();
 	await reveal.getByRole('checkbox', { name: /saved this token/i }).check();
 	await reveal.getByRole('button', { name: /^Done$/ }).click();
 	// 2. Act like a CLI: call the API directly with Bearer <token>.
 	const cli = await request.newContext({
 		baseURL: API_BASE,
 		extraHTTPHeaders: { authorization: `Bearer ${rawToken}` }
 	});
 	try {
 		const ok = await cli.get('/api/v1/admin/scripts');
 		expect(ok.status()).toBe(200);
 		const body = (await ok.json()) as unknown;
 		expect(Array.isArray(body)).toBe(true);
 		// Sanity: a route the scope doesn't cover must reject.
 		// `script:read` cannot list instance admins (that's
 		// instance:admin territory).
 		const denied = await cli.get('/api/v1/admin/admins');
 		expect(denied.status()).toBe(403);
 		// 3. Revoke via the dashboard.
 		await page.reload();
 		const revokeBtn = page.getByRole('button', { name: `Revoke ${name}` });
 		await expect(revokeBtn).toBeVisible();
 		await revokeBtn.click();
 		await page.getByRole('dialog').getByRole('button', { name: /^Revoke$/ }).click();
 		await expect(revokeBtn).toHaveCount(0);
 		// 4. Same CLI call must now fail auth.
 		const afterRevoke = await cli.get('/api/v1/admin/scripts');
 		expect(afterRevoke.status()).toBe(401);
 	} finally {
 		await cli.dispose();
 	}
 	// Belt-and-braces cleanup: if the UI revoke missed, drop via API.
 	const api = await adminApi();
 	try {
 		const list = await api.get('/api/v1/admin/api-keys');
 		if (list.ok()) {
 			const all = (await list.json()) as Array<{ id: string; name: string }>;
 			const k = all.find((x) => x.name === name);
 			if (k) cleanup.apiKey(k.id);
 		}
 	} finally {
 		await api.dispose();
 	}
 });
--- a/dashboard/tests/e2e/members/members.spec.ts
+++ b/dashboard/tests/e2e/members/members.spec.ts
@@ -0,0 +1,168 @@
 import { expect } from '@playwright/test';
 import { test } from '../fixtures/ids';
 import { CleanupRegistry } from '../fixtures/cleanup';
 import { adminApi } from '../fixtures/api';
 import { loginAsUserToken, pageWithUserToken } from '../fixtures/role-page';
 // Phase B5 — App Members. Setup creates one or two extra admin
 // users via the API; tests drive the Members tab through the
 // dashboard like a real app admin would.
 const cleanup = new CleanupRegistry();
 test.afterEach(async () => {
 	await cleanup.run();
 });
 async function createApp(slug: string): Promise<string> {
 	const api = await adminApi();
 	try {
 		const res = await api.post('/api/v1/admin/apps', { data: { slug, name: slug } });
 		expect(res.ok()).toBe(true);
 		return ((await res.json()) as { id: string }).id;
 	} finally {
 		await api.dispose();
 	}
 }
 async function createMemberUser(username: string): Promise<string> {
 	const api = await adminApi();
 	try {
 		const res = await api.post('/api/v1/admin/admins', {
 			data: { username, password: 'e2e-member-pw', instance_role: 'member' }
 		});
 		expect(res.ok()).toBe(true);
 		return ((await res.json()) as { id: string }).id;
 	} finally {
 		await api.dispose();
 	}
 }
 test.describe('B5 app members', () => {
 	test('invite a member-role user, then remove them', async ({ page, uniqueSlug, uniqueUsername }) => {
 		const slug = uniqueSlug('mem');
 		const username = uniqueUsername('inv');
 		await createApp(slug);
 		const userId = await createMemberUser(username);
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		await page.goto(`/admin/apps/${slug}`);
 		await page.getByRole('button', { name: /^Members \(\d+\)$/ }).click();
 		// Invite. Both selects sit in `form.create-form`; locate them
 		// by position to avoid getByLabel ambiguity (the Svelte
 		// markup nests both labels in a flex row, which makes their
 		// accessible names overlap).
 		const form = page.locator('form.create-form');
 		await form.locator('select').nth(0).selectOption({ label: username });
 		await form.locator('select').nth(1).selectOption('editor');
 		await page.getByRole('button', { name: /^Add member$/ }).click();
 		await expect(page.locator('.member-row')).toContainText(username);
 		// Remove via action menu + confirm modal.
 		await page.getByRole('button', { name: new RegExp(`Member actions for ${username}`) }).click();
 		await page.getByRole('menuitem', { name: /^Remove from app$/ }).click();
 		const dialog = page.getByRole('dialog');
 		await expect(dialog).toBeVisible();
 		await dialog.getByRole('button', { name: /^Remove member$/ }).click();
 		await expect(page.locator('.member-row')).toHaveCount(0);
 	});
 	test('role change via action menu updates the role chip', async ({
 		page,
 		uniqueSlug,
 		uniqueUsername
 	}) => {
 		const slug = uniqueSlug('mem');
 		const username = uniqueUsername('role');
 		await createApp(slug);
 		const userId = await createMemberUser(username);
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		// Seed the membership via API to skip the invite UI.
 		const api = await adminApi();
 		try {
 			const res = await api.post(`/api/v1/admin/apps/${slug}/members`, {
 				data: { user_id: userId, role: 'viewer' }
 			});
 			expect(res.ok()).toBe(true);
 		} finally {
 			await api.dispose();
 		}
 		await page.goto(`/admin/apps/${slug}`);
 		await page.getByRole('button', { name: /^Members \(\d+\)$/ }).click();
 		await page.getByRole('button', { name: new RegExp(`Member actions for ${username}`) }).click();
 		await page.getByRole('menuitem', { name: /^Make editor$/ }).click();
 		const row = page.locator('.member-row', { hasText: username });
 		await expect(row).toContainText(/editor/i);
 	});
 	test('non-app-admin viewers do not see the Members tab', async ({
 		browser,
 		uniqueSlug,
 		uniqueUsername
 	}) => {
 		const slug = uniqueSlug('mem');
 		const username = uniqueUsername('viewer');
 		const password = 'e2e-member-pw';
 		await createApp(slug);
 		const userId = await createMemberUser(username);
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		// Grant viewer membership (not app_admin) so the user can see
 		// the app at all.
 		const api = await adminApi();
 		try {
 			const res = await api.post(`/api/v1/admin/apps/${slug}/members`, {
 				data: { user_id: userId, role: 'viewer' }
 			});
 			expect(res.ok()).toBe(true);
 		} finally {
 			await api.dispose();
 		}
 		const token = await loginAsUserToken(username, password);
 		const viewerPage = await pageWithUserToken(browser, token);
 		try {
 			await viewerPage.goto(`/admin/apps/${slug}`);
 			// Scripts tab loads — that's what a viewer sees.
 			await expect(
 				viewerPage.getByRole('button', { name: /^Scripts \(\d+\)$/ })
 			).toBeVisible();
 			// Members tab button is absent for non-app-admins.
 			await expect(
 				viewerPage.getByRole('button', { name: /^Members \(\d+\)$/ })
 			).toHaveCount(0);
 		} finally {
 			await viewerPage.context().close();
 		}
 	});
 });
 test.describe('B5 app members adversarial', () => {
 	test('role dropdown exposes only the documented values', async ({
 		page,
 		uniqueSlug,
 		uniqueUsername
 	}) => {
 		const slug = uniqueSlug('mem');
 		const username = uniqueUsername('rolelist');
 		await createApp(slug);
 		const userId = await createMemberUser(username);
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		await page.goto(`/admin/apps/${slug}`);
 		await page.getByRole('button', { name: /^Members \(\d+\)$/ }).click();
 		const form = page.locator('form.create-form');
 		const roleSelect = form.locator('select').nth(1);
 		const optionValues = await roleSelect.evaluate((el: HTMLSelectElement) =>
 			Array.from(el.options).map((o) => o.value)
 		);
 		expect(optionValues.sort()).toEqual(['app_admin', 'editor', 'viewer']);
 	});
 });
--- a/dashboard/tests/e2e/profile/profile.spec.ts
+++ b/dashboard/tests/e2e/profile/profile.spec.ts
@@ -0,0 +1,150 @@
 import { expect, type Page } from '@playwright/test';
 import { test } from '../fixtures/ids';
 import { CleanupRegistry } from '../fixtures/cleanup';
 import { adminApi } from '../fixtures/api';
 // Phase B7 — Profile + API Keys (/admin/profile). Covers the
 // mint/reveal/revoke flow, the app-binding mutual-exclusion guard,
 // and adversarial inputs.
 const cleanup = new CleanupRegistry();
 test.afterEach(async () => {
 	await cleanup.run();
 });
 async function createApp(slug: string): Promise<string> {
 	const api = await adminApi();
 	try {
 		const res = await api.post('/api/v1/admin/apps', { data: { slug, name: slug } });
 		expect(res.ok()).toBe(true);
 		return ((await res.json()) as { id: string }).id;
 	} finally {
 		await api.dispose();
 	}
 }
 async function openMintForm(page: Page): Promise<void> {
 	await page.goto('/admin/profile');
 	await page.getByRole('button', { name: /\+ Mint API key/ }).click();
 }
 async function registerKeyCleanupByName(name: string): Promise<void> {
 	const api = await adminApi();
 	try {
 		const res = await api.get('/api/v1/admin/api-keys');
 		const all = (await res.json()) as Array<{ id: string; name: string }>;
 		const k = all.find((x) => x.name === name);
 		if (k) cleanup.apiKey(k.id);
 	} finally {
 		await api.dispose();
 	}
 }
 test.describe('B7 profile + API keys', () => {
 	test('mint instance-wide key: reveal → ack → key appears in list', async ({ page }) => {
 		const name = `e2e-mint-${Date.now()}`;
 		await openMintForm(page);
 		await page.locator('form.mint').getByPlaceholder('e.g. ci-deploy').fill(name);
 		// Pick a non-instance scope so we don't need to worry about
 		// mutual exclusion here. The scope-chip is a <label> wrapping
 		// the checkbox — clicking the label toggles it.
 		await page.locator('label.scope-chip', { hasText: 'script:read' }).click();
 		await page.getByRole('button', { name: /^Mint key$/ }).click();
 		const reveal = page.locator('.reveal');
 		await expect(reveal).toBeVisible();
 		await expect(reveal.locator('code.token')).toContainText(/\S{16,}/);
 		await expect(reveal.getByRole('button', { name: /^Done$/ })).toBeDisabled();
 		await reveal.getByRole('checkbox', { name: /saved this token/i }).check();
 		await reveal.getByRole('button', { name: /^Done$/ }).click();
 		await registerKeyCleanupByName(name);
 		await expect(page.getByText(name)).toBeVisible();
 	});
 	test('binding to an app disables instance scopes', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('keyapp');
 		const appId = await createApp(slug);
 		cleanup.app(slug);
 		await openMintForm(page);
 		// Default binding is Instance-wide — instance scopes are
 		// enabled.
 		const instChip = page.locator('label.scope-chip', { hasText: 'instance:admin' });
 		await expect(instChip).not.toHaveClass(/disabled/);
 		// Switch binding to the app. The chip becomes disabled.
 		await page.getByLabel(/Binding/i).selectOption(appId);
 		await expect(instChip).toHaveClass(/disabled/);
 	});
 	test('revoke key removes it from the list', async ({ page }) => {
 		const name = `e2e-revoke-${Date.now()}`;
 		// Seed a key via API so the test focuses on the revoke UI.
 		const api = await adminApi();
 		try {
 			const res = await api.post('/api/v1/admin/api-keys', {
 				data: { name, scopes: ['script:read'] }
 			});
 			expect(res.ok()).toBe(true);
 			const body = (await res.json()) as { id: string };
 			cleanup.apiKey(body.id);
 		} finally {
 			await api.dispose();
 		}
 		await page.goto('/admin/profile');
 		const revokeBtn = page.getByRole('button', { name: `Revoke ${name}` });
 		await expect(revokeBtn).toBeVisible();
 		await revokeBtn.click();
 		const dialog = page.getByRole('dialog');
 		await dialog.getByRole('button', { name: /^Revoke$/ }).click();
 		// Assert the row's revoke button is gone (the flash banner
 		// also mentions the name, so a plain getByText would still
 		// match — anchor on the row-scoped button instead).
 		await expect(revokeBtn).toHaveCount(0);
 	});
 	test('denied=users banner shows when arriving from the users redirect', async ({ page }) => {
 		await page.goto('/admin/profile?denied=users');
 		await expect(page.getByText(/don.?t have access to the Users page/i)).toBeVisible();
 	});
 });
 test.describe('B7 profile adversarial', () => {
 	test('empty name keeps the mint button disabled', async ({ page }) => {
 		await openMintForm(page);
 		// Trying to click would HTML5-validate; instead verify the
 		// button is disabled while name is empty.
 		await page.locator('label.scope-chip', { hasText: 'script:read' }).click();
 		await expect(page.getByRole('button', { name: /^Mint key$/ })).toBeDisabled();
 	});
 	test('copy-token button copies the full token, not a truncated form', async ({
 		page,
 		context
 	}) => {
 		// Permission must be granted explicitly; chromium will throw
 		// otherwise when calling navigator.clipboard.readText().
 		await context.grantPermissions(['clipboard-read', 'clipboard-write']);
 		const name = `e2e-copy-${Date.now()}`;
 		await openMintForm(page);
 		await page.locator('form.mint').getByPlaceholder('e.g. ci-deploy').fill(name);
 		await page.locator('label.scope-chip', { hasText: 'script:read' }).click();
 		await page.getByRole('button', { name: /^Mint key$/ }).click();
 		const reveal = page.locator('.reveal');
 		const tokenInDom = await reveal.locator('code.token').textContent();
 		expect(tokenInDom).toBeTruthy();
 		await reveal.getByRole('button', { name: /^Copy$/ }).click();
 		const copied = await page.evaluate(() => navigator.clipboard.readText());
 		expect(copied).toBe(tokenInDom);
 		await reveal.getByRole('checkbox', { name: /saved this token/i }).check();
 		await reveal.getByRole('button', { name: /^Done$/ }).click();
 		await registerKeyCleanupByName(name);
 	});
 });
--- a/dashboard/tests/e2e/routing/routing.spec.ts
+++ b/dashboard/tests/e2e/routing/routing.spec.ts
@@ -0,0 +1,189 @@
 import { expect, type Page } from '@playwright/test';
 import { test } from '../fixtures/ids';
 import { CleanupRegistry } from '../fixtures/cleanup';
 import { adminApi } from '../fixtures/api';
 // Phase B4 — Routing tab in the script editor. Add / remove / match
 // preview + validation paths (host check, path-kind mismatch, reserved
 // prefix, duplicate conflict, adversarial paths).
 const HELLO_RHAI = `return #{ statusCode: 200, body: #{ ok: true } };`;
 const cleanup = new CleanupRegistry();
 test.afterEach(async () => {
 	await cleanup.run();
 });
 async function makeAppWithScript(slug: string): Promise<{ appId: string; scriptId: string }> {
 	const api = await adminApi();
 	try {
 		const appRes = await api.post('/api/v1/admin/apps', {
 			data: { slug, name: slug }
 		});
 		expect(appRes.ok()).toBe(true);
 		const appBody = (await appRes.json()) as { id: string };
 		const scriptRes = await api.post('/api/v1/admin/scripts', {
 			data: { app_id: appBody.id, name: 'route-target', source: HELLO_RHAI }
 		});
 		expect(scriptRes.ok()).toBe(true);
 		const scriptBody = (await scriptRes.json()) as { id: string };
 		return { appId: appBody.id, scriptId: scriptBody.id };
 	} finally {
 		await api.dispose();
 	}
 }
 async function gotoRoutingTab(page: Page, scriptId: string): Promise<void> {
 	await page.goto(`/admin/scripts/${scriptId}`);
 	await page.getByRole('button', { name: 'Routing' }).click();
 }
 async function addRoute(
 	page: Page,
 	opts: { path: string; pathKind?: 'exact' | 'param' | 'prefix'; method?: string; host?: string }
 ): Promise<void> {
 	await page.getByRole('button', { name: '+ Add route' }).click();
 	const form = page.locator('form.route-form');
 	await form.getByLabel('Path', { exact: true }).fill(opts.path);
 	if (opts.pathKind) {
 		await form.getByLabel('Path kind').selectOption(opts.pathKind);
 	}
 	if (opts.method !== undefined) {
 		await form.getByLabel('Method').selectOption(opts.method);
 	}
 	if (opts.host !== undefined) {
 		await form.getByLabel(/^Host/).fill(opts.host);
 	}
 }
 test.describe('B4 routing', () => {
 	test('add route appears in list and matches in the preview', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('addr');
 		const { scriptId } = await makeAppWithScript(slug);
 		cleanup.app(slug);
 		await gotoRoutingTab(page, scriptId);
 		await addRoute(page, { path: '/greet', method: 'GET' });
 		await page.getByRole('button', { name: /^Create route$/ }).click();
 		await expect(page.locator('.route-list')).toContainText('/greet');
 		// Match preview confirms the route resolves.
 		await page.getByLabel('URL').fill('http://localhost/greet');
 		await page.locator('.actions').getByRole('button', { name: 'Match' }).click();
 		await expect(page.locator('pre.preview')).toContainText('script_id');
 	});
 	test('remove route updates the list', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('remr');
 		const { scriptId } = await makeAppWithScript(slug);
 		cleanup.app(slug);
 		await gotoRoutingTab(page, scriptId);
 		await addRoute(page, { path: '/transient', method: 'GET' });
 		await page.getByRole('button', { name: /^Create route$/ }).click();
 		await expect(page.locator('.route-list')).toContainText('/transient');
 		// removeRoute() uses window.confirm — accept it.
 		page.once('dialog', (d) => void d.accept());
 		await page.locator('.route-list').getByRole('button', { name: 'remove' }).click();
 		await expect(page.locator('.route-list')).toHaveCount(0);
 		await expect(page.getByText(/no routes yet/i)).toBeVisible();
 	});
 	test('duplicate route surfaces a 409 conflict error inline', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('dupr');
 		const { scriptId } = await makeAppWithScript(slug);
 		cleanup.app(slug);
 		await gotoRoutingTab(page, scriptId);
 		await addRoute(page, { path: '/twice', method: 'GET' });
 		await page.getByRole('button', { name: /^Create route$/ }).click();
 		await expect(page.locator('.route-list')).toContainText('/twice');
 		// Same path + method again — must conflict.
 		await addRoute(page, { path: '/twice', method: 'GET' });
 		await page.getByRole('button', { name: /^Create route$/ }).click();
 		await expect(page.locator('.route-form .error.inline')).toBeVisible();
 	});
 	test('path-kind mismatch warns inline when /:name is set to exact', async ({
 		page,
 		uniqueSlug
 	}) => {
 		const slug = uniqueSlug('mism');
 		const { scriptId } = await makeAppWithScript(slug);
 		cleanup.app(slug);
 		await gotoRoutingTab(page, scriptId);
 		await page.getByRole('button', { name: '+ Add route' }).click();
 		await page.getByLabel('Path', { exact: true }).fill('/users/:id');
 		// Override to a wrong kind — auto-detect would have picked
 		// `param`; selecting `exact` should fire the warning.
 		await page.getByLabel('Path kind').selectOption('exact');
 		await expect(page.locator('.route-form .warning.inline')).toBeVisible();
 	});
 	test('host validation warns when the host is not a claimed domain', async ({
 		page,
 		uniqueSlug
 	}) => {
 		const slug = uniqueSlug('unclaim');
 		const { scriptId } = await makeAppWithScript(slug);
 		cleanup.app(slug);
 		await gotoRoutingTab(page, scriptId);
 		await page.getByRole('button', { name: '+ Add route' }).click();
 		await page.getByLabel('Path', { exact: true }).fill('/x');
 		await page.getByLabel(/^Host/).fill('example.test-not-claimed.local');
 		// One of the inline warnings is the unclaimed-host explainer.
 		await expect(page.locator('.route-form .warning.inline').first()).toBeVisible();
 	});
 });
 test.describe('B4 routing adversarial', () => {
 	test('reserved prefix /api/ is rejected with a visible error', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('reserv');
 		const { scriptId } = await makeAppWithScript(slug);
 		cleanup.app(slug);
 		await gotoRoutingTab(page, scriptId);
 		await addRoute(page, { path: '/api/v9/oops', method: 'GET' });
 		await page.getByRole('button', { name: /^Create route$/ }).click();
 		await expect(page.locator('.route-form .error.inline')).toBeVisible();
 		await expect(page.locator('.route-form .error.inline')).toContainText(
 			/reserved|api|prefix/i
 		);
 		// Empty-state copy renders when no routes exist; the path
 		// itself must not appear anywhere on the routing tab.
 		await expect(page.getByText(/no routes yet/i)).toBeVisible();
 	});
 	test('xss payload in path stored or rejected — never executes on render', async ({
 		page,
 		uniqueSlug
 	}) => {
 		page.on('dialog', async (d) => {
 			await d.dismiss();
 			throw new Error(`Unexpected dialog: ${d.message()}`);
 		});
 		const slug = uniqueSlug('pxss');
 		const { scriptId } = await makeAppWithScript(slug);
 		cleanup.app(slug);
 		await gotoRoutingTab(page, scriptId);
 		await addRoute(page, {
 			path: '/<script>alert(1)</script>',
 			method: 'GET'
 		});
 		await page.getByRole('button', { name: /^Create route$/ }).click();
 		// Either accepted (rendered as text in the list) or rejected
 		// (error inline). Both fine — what's NOT fine is an alert
 		// dialog or an injected <script> tag in the list.
 		const xssScripts = await page.locator('.route-list script:has-text("alert")').count();
 		expect(xssScripts).toBe(0);
 	});
 });
--- a/dashboard/tests/e2e/scripts/scripts.spec.ts
+++ b/dashboard/tests/e2e/scripts/scripts.spec.ts
@@ -0,0 +1,337 @@
 import { expect, type Page } from '@playwright/test';
 import { test } from '../fixtures/ids';
 import { CleanupRegistry } from '../fixtures/cleanup';
 import { adminApi } from '../fixtures/api';
 import { loginAsUserToken, pageWithUserToken } from '../fixtures/role-page';
 const MEMBER_PW = 'e2e-member-pw';
 async function seedAppScriptAndMember(opts: {
 	slug: string;
 	username: string;
 	role: 'viewer' | 'editor';
 }): Promise<{ scriptId: string; userId: string }> {
 	const api = await adminApi();
 	try {
 		const appRes = await api.post('/api/v1/admin/apps', {
 			data: { slug: opts.slug, name: opts.slug }
 		});
 		expect(appRes.ok()).toBe(true);
 		const appId = ((await appRes.json()) as { id: string }).id;
 		const scriptRes = await api.post('/api/v1/admin/scripts', {
 			data: { app_id: appId, name: `${opts.slug}-sc`, source: HELLO_RHAI }
 		});
 		expect(scriptRes.ok()).toBe(true);
 		const scriptId = ((await scriptRes.json()) as { id: string }).id;
 		const userRes = await api.post('/api/v1/admin/admins', {
 			data: { username: opts.username, password: MEMBER_PW, instance_role: 'member' }
 		});
 		expect(userRes.ok()).toBe(true);
 		const userId = ((await userRes.json()) as { id: string }).id;
 		const memberRes = await api.post(`/api/v1/admin/apps/${opts.slug}/members`, {
 			data: { user_id: userId, role: opts.role }
 		});
 		expect(memberRes.ok()).toBe(true);
 		return { scriptId, userId };
 	} finally {
 		await api.dispose();
 	}
 }
 // Phase B3 — Scripts CRUD + Editor. The script editor lives at
 // /admin/scripts/{id}. Setup uses the API to create the app (and
 // sometimes a baseline script) so each test can focus on the editor
 // flow it actually covers.
 const HELLO_RHAI = `return #{ statusCode: 200, body: #{ ok: true } };`;
 const cleanup = new CleanupRegistry();
 test.afterEach(async () => {
 	await cleanup.run();
 });
 async function createAppViaApi(slug: string): Promise<string> {
 	const api = await adminApi();
 	try {
 		const res = await api.post('/api/v1/admin/apps', {
 			data: { slug, name: slug }
 		});
 		expect(res.ok()).toBe(true);
 		const body = (await res.json()) as { id: string };
 		return body.id;
 	} finally {
 		await api.dispose();
 	}
 }
 async function createScriptViaApi(
 	appId: string,
 	name: string,
 	source = HELLO_RHAI
 ): Promise<string> {
 	const api = await adminApi();
 	try {
 		const res = await api.post('/api/v1/admin/scripts', {
 			data: { app_id: appId, name, source }
 		});
 		expect(res.ok()).toBe(true);
 		const body = (await res.json()) as { id: string };
 		return body.id;
 	} finally {
 		await api.dispose();
 	}
 }
 async function fillCodeMirror(page: Page, locator: string, text: string): Promise<void> {
 	const cm = page.locator(locator).first();
 	await cm.click();
 	await page.keyboard.press('ControlOrMeta+A');
 	await page.keyboard.press('Delete');
 	await page.keyboard.type(text);
 }
 test.describe('B3 scripts CRUD', () => {
 	test('create script via UI navigates to scripts list with the new entry', async ({
 		page,
 		uniqueSlug
 	}) => {
 		const slug = uniqueSlug('cscr');
 		await createAppViaApi(slug);
 		cleanup.app(slug);
 		await page.goto(`/admin/apps/${slug}`);
 		await page.getByRole('button', { name: /^New script$/ }).click();
 		await page.getByLabel('Name').fill('echo');
 		// The CodeMirror editor starts empty in create mode; type a
 		// minimal valid script.
 		await fillCodeMirror(page, '.cm-content', HELLO_RHAI);
 		await page.getByRole('button', { name: 'Create script' }).click();
 		await expect(page.getByRole('link', { name: /echo/i })).toBeVisible();
 	});
 	test('edit + save Rhai source persists across reload', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('edit');
 		const appId = await createAppViaApi(slug);
 		const scriptId = await createScriptViaApi(appId, 'edit-target');
 		cleanup.app(slug);
 		await page.goto(`/admin/scripts/${scriptId}`);
 		await expect(page.locator('.cm-content').first()).toContainText('statusCode');
 		const updated = `// edited by e2e\nreturn #{ statusCode: 201, body: #{ edited: true } };`;
 		await fillCodeMirror(page, '.cm-content', updated);
 		await page.getByRole('button', { name: /^Save$/ }).click();
 		// Save button becomes disabled once the buffer matches the
 		// just-saved source — that's our settle signal.
 		await expect(page.getByRole('button', { name: /^Save$/ })).toBeDisabled();
 		await page.reload();
 		await expect(page.locator('.cm-content').first()).toContainText('edited by e2e');
 	});
 	test('invalid Rhai source: Format shows a parse error', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('invrhai');
 		const appId = await createAppViaApi(slug);
 		const scriptId = await createScriptViaApi(appId, 'bad-syntax');
 		cleanup.app(slug);
 		await page.goto(`/admin/scripts/${scriptId}`);
 		await fillCodeMirror(page, '.cm-content', 'this is not rhai @@@ {{{');
 		await page
 			.locator('.editor-header')
 			.getByRole('button', { name: 'Format' })
 			.click();
 		await expect(page.locator('.error.inline').first()).toBeVisible();
 	});
 });
 test.describe('B3 test-invoke', () => {
 	test('valid JSON body returns status + body in the result panel', async ({
 		page,
 		uniqueSlug
 	}) => {
 		const slug = uniqueSlug('inv-ok');
 		const appId = await createAppViaApi(slug);
 		const scriptId = await createScriptViaApi(appId, 'invoke-ok');
 		cleanup.app(slug);
 		await page.goto(`/admin/scripts/${scriptId}`);
 		// Body editor is the second .cm-content (source is first).
 		const bodyEditor = page.locator('.cm-content').nth(1);
 		await bodyEditor.click();
 		await page.keyboard.press('ControlOrMeta+A');
 		await page.keyboard.press('Delete');
 		await page.keyboard.type('{"hello":"world"}');
 		await page.getByRole('button', { name: /^Send$/ }).click();
 		await expect(page.locator('.status')).toContainText('HTTP 200');
 		await expect(page.locator('.result pre')).toContainText('ok');
 	});
 	test('malformed JSON body: Format surfaces the parse error', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('inv-bad');
 		const appId = await createAppViaApi(slug);
 		const scriptId = await createScriptViaApi(appId, 'invoke-bad');
 		cleanup.app(slug);
 		await page.goto(`/admin/scripts/${scriptId}`);
 		const bodyEditor = page.locator('.cm-content').nth(1);
 		await bodyEditor.click();
 		await page.keyboard.press('ControlOrMeta+A');
 		await page.keyboard.press('Delete');
 		await page.keyboard.type('{not valid json,');
 		// The Format button for the request body sits inside the
 		// Test-invoke card next to the body editor.
 		await page
 			.locator('.json-block')
 			.first()
 			.getByRole('button', { name: 'Format' })
 			.click();
 		await expect(page.locator('.error.inline').first()).toBeVisible();
 	});
 });
 test.describe('B3 settings', () => {
 	test('timeout input rejects zero and non-positive values', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('settz');
 		const appId = await createAppViaApi(slug);
 		const scriptId = await createScriptViaApi(appId, 'settings-target');
 		cleanup.app(slug);
 		await page.goto(`/admin/scripts/${scriptId}`);
 		await page.getByRole('button', { name: 'Settings' }).click();
 		const timeout = page.getByLabel(/Timeout/);
 		await timeout.fill('0');
 		const invalid = await timeout.evaluate((el: HTMLInputElement) => !el.validity.valid);
 		expect(invalid).toBe(true);
 	});
 });
 test.describe('B3 scripts role shadowing', () => {
 	test('viewer: no Delete header, no Save/Format on Edit, no Add route on Routing', async ({
 		browser,
 		uniqueSlug,
 		uniqueUsername
 	}) => {
 		const slug = uniqueSlug('vscr');
 		const username = uniqueUsername('viewer');
 		const { scriptId, userId } = await seedAppScriptAndMember({
 			slug,
 			username,
 			role: 'viewer'
 		});
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		const token = await loginAsUserToken(username, MEMBER_PW);
 		const page = await pageWithUserToken(browser, token);
 		try {
 			await page.goto(`/admin/scripts/${scriptId}`);
 			// Header Delete is hidden for non-admins.
 			await expect(page.getByRole('button', { name: /^Delete$/ })).toHaveCount(0);
 			// Save/Format on the Edit tab are hidden for viewers.
 			await expect(page.getByRole('button', { name: /^Save$/ })).toHaveCount(0);
 			await expect(
 				page.locator('.editor-header').getByRole('button', { name: 'Format' })
 			).toHaveCount(0);
 			// Test invoke is still visible (everyone with read access).
 			await expect(page.getByRole('button', { name: /^Send$/ })).toBeVisible();
 			// Routing tab loads, no +Add route.
 			await page.getByRole('button', { name: /Routing/ }).click();
 			await expect(page.getByRole('button', { name: /\+ Add route/ })).toHaveCount(0);
 			// Settings tab is absent for non-admins.
 			await expect(page.getByRole('button', { name: /^Settings$/ })).toHaveCount(0);
 		} finally {
 			await page.context().close();
 		}
 	});
 	test('viewer: CodeMirror is read-only', async ({
 		browser,
 		uniqueSlug,
 		uniqueUsername
 	}) => {
 		const slug = uniqueSlug('vro');
 		const username = uniqueUsername('viewer');
 		const { scriptId, userId } = await seedAppScriptAndMember({
 			slug,
 			username,
 			role: 'viewer'
 		});
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		const token = await loginAsUserToken(username, MEMBER_PW);
 		const page = await pageWithUserToken(browser, token);
 		try {
 			await page.goto(`/admin/scripts/${scriptId}`);
 			const cm = page.locator('.cm-content').first();
 			await expect(cm).toBeVisible();
 			// CodeMirror sets contenteditable=false when EditorView.editable.of(false)
 			// is in effect; that's the canonical signal for read-only mode.
 			await expect(cm).toHaveAttribute('contenteditable', 'false');
 		} finally {
 			await page.context().close();
 		}
 	});
 	test('editor: Save visible, Delete header hidden', async ({
 		browser,
 		uniqueSlug,
 		uniqueUsername
 	}) => {
 		const slug = uniqueSlug('escr');
 		const username = uniqueUsername('editor');
 		const { scriptId, userId } = await seedAppScriptAndMember({
 			slug,
 			username,
 			role: 'editor'
 		});
 		cleanup.app(slug);
 		cleanup.adminUser(userId);
 		const token = await loginAsUserToken(username, MEMBER_PW);
 		const page = await pageWithUserToken(browser, token);
 		try {
 			await page.goto(`/admin/scripts/${scriptId}`);
 			// Editor sees Save (disabled until the buffer changes — that's fine).
 			await expect(page.getByRole('button', { name: /^Save$/ })).toBeVisible();
 			// Delete stays admin-only.
 			await expect(page.getByRole('button', { name: /^Delete$/ })).toHaveCount(0);
 			// Settings stays admin-only.
 			await expect(page.getByRole('button', { name: /^Settings$/ })).toHaveCount(0);
 		} finally {
 			await page.context().close();
 		}
 	});
 });
 test.describe('B3 adversarial', () => {
 	test('infinite loop script hits the sandbox timeout', async ({ page, uniqueSlug }) => {
 		const slug = uniqueSlug('loop');
 		const appId = await createAppViaApi(slug);
 		const scriptId = await createScriptViaApi(
 			appId,
 			'inf-loop',
 			'loop { let x = 1; }'
 		);
 		cleanup.app(slug);
 		await page.goto(`/admin/scripts/${scriptId}`);
 		await page.getByRole('button', { name: /^Send$/ }).click();
 		// Either the status renders with a 5xx code, or an error
 		// banner shows up. Either way, the page recovers.
 		await Promise.race([
 			expect(page.locator('.status')).toBeVisible({ timeout: 30_000 }),
 			expect(page.locator('.error.inline').last()).toBeVisible({ timeout: 30_000 })
 		]);
 		// The dashboard must remain interactive after the timeout.
 		await page.getByRole('button', { name: 'Settings' }).click();
 		await expect(page.getByLabel(/Timeout/)).toBeVisible();
 	});
 });
--- a/dashboard/tests/e2e/security/security.spec.ts
+++ b/dashboard/tests/e2e/security/security.spec.ts
@@ -0,0 +1,81 @@
 import { expect, test } from '@playwright/test';
 // Phase B8 — Cross-cutting security. Things that aren't tied to a
 // single page: session handling, secret leakage, error states for
 // missing resources, and a sanity check that no XSS sink fires
 // anywhere in the dashboard's main authed routes.
 const VALID_USERNAME = process.env.E2E_ADMIN_USERNAME ?? 'admin';
 const VALID_PASSWORD = process.env.E2E_ADMIN_PASSWORD ?? 'admin';
 test.describe('B8 cross-cutting security', () => {
 	test('expired/stale token: any authed call redirects to /login', async ({ page }) => {
 		// Replace the storageState token with an obvious garbage
 		// value; the fetch wrapper treats 401 as "go to /login".
 		await page.goto('/admin/login');
 		await page.evaluate(() => {
 			localStorage.setItem('picloud.admin.token', 'expired-or-bogus-token');
 		});
 		await page.goto('/admin/apps');
 		await expect(page).toHaveURL(/\/admin\/login$/);
 	});
 	test('login response cookie is HttpOnly', async ({ request }) => {
 		const res = await request.post('/api/v1/admin/auth/login', {
 			data: { username: VALID_USERNAME, password: VALID_PASSWORD },
 			headers: { 'content-type': 'application/json' }
 		});
 		expect(res.ok()).toBe(true);
 		const headers = res.headers();
 		const setCookie = headers['set-cookie'];
 		// Backend may or may not set a cookie (the dashboard primarily
 		// uses bearer-in-localStorage). If it does, it must be
 		// HttpOnly so XSS can't exfiltrate it.
 		if (setCookie) {
 			expect(setCookie.toLowerCase()).toContain('httponly');
 		}
 	});
 	test('bootstrap password is not present in the DOM after login', async ({ page }) => {
 		await page.goto('/admin/apps');
 		const body = await page.locator('body').innerText();
 		expect(body).not.toContain(VALID_PASSWORD);
 	});
 	test('non-existent app slug shows a recoverable error, not a crash', async ({ page }) => {
 		await page.goto('/admin/apps/does-not-exist-e2e-9999');
 		// Page must render *something* and the layout must remain
 		// intact (header link to Apps still works).
 		await expect(page.getByRole('link', { name: 'Apps' })).toBeVisible();
 		// And surface the failure to the user — either a "couldn't
 		// load" message or a "back to apps" link.
 		const errorOrBack = page.locator('.error, a[href$="/admin/apps"]');
 		await expect(errorOrBack.first()).toBeVisible();
 	});
 	test('xss probe across major surfaces never fires a dialog', async ({ page }) => {
 		page.on('dialog', async (dialog) => {
 			await dialog.dismiss();
 			throw new Error(
 				`XSS sink fired — got a ${dialog.type()} dialog: "${dialog.message()}"`
 			);
 		});
 		// Cover each main authed route. None should evaluate any
 		// payload that earlier tests may have stored, and none should
 		// inject inline <script> tags from server responses.
 		for (const path of ['/admin/apps', '/admin/profile', '/admin/users']) {
 			await page.goto(path);
 			await page.waitForLoadState('domcontentloaded');
 			const inlineScripts = await page.locator('script[src=""], script:not([src])').count();
 			// Svelte itself injects no inline <script> in the
 			// production bundle; vite dev does, but never with
 			// onerror/alert payload text in them.
 			const evilInline = await page
 				.locator('script:has-text("alert"), script:has-text("__xss")')
 				.count();
 			expect(evilInline, `evil inline script tag on ${path}`).toBe(0);
 			expect(inlineScripts).toBeGreaterThanOrEqual(0); // sanity assertion, no crash
 		}
 	});
 });
--- a/dashboard/tests/e2e/smoke.spec.ts
+++ b/dashboard/tests/e2e/smoke.spec.ts
@@ -0,0 +1,28 @@
 import { expect, test } from '@playwright/test';
 import { loginAsAdmin } from './fixtures/auth';
 // A1 smoke: prove globalSetup + webServer + fixtures + proxy all work.
 test.describe('smoke', () => {
 	test.describe('unauthenticated', () => {
 		test.use({ storageState: { cookies: [], origins: [] } });
 		test('root redirects to login and shows the form', async ({ page }) => {
 			await page.goto('/admin/');
 			await expect(page).toHaveURL(/\/admin\/login$/);
 			await expect(page.getByLabel('Username')).toBeVisible();
 			await expect(page.getByLabel('Password')).toBeVisible();
 			await expect(page.getByRole('button', { name: /sign in/i })).toBeVisible();
 		});
 		test('valid credentials land on the apps page', async ({ page }) => {
 			await loginAsAdmin(page);
 			await expect(page.getByRole('link', { name: 'Apps' })).toBeVisible();
 		});
 	});
 	test('admin storageState already lands on apps', async ({ page }) => {
 		await page.goto('/admin/');
 		await expect(page).toHaveURL(/\/admin\/apps$/);
 	});
 });
--- a/dashboard/tests/e2e/users/users.spec.ts
+++ b/dashboard/tests/e2e/users/users.spec.ts
@@ -0,0 +1,224 @@
 import { expect, type Browser, type Page, request } from '@playwright/test';
 import { test } from '../fixtures/ids';
 import { CleanupRegistry } from '../fixtures/cleanup';
 import { adminApi } from '../fixtures/api';
 // Phase B6 — Instance Users (/admin/users). Covers the bootstrap
 // admin's view of the user directory: invite, edit, deactivate,
 // search, delete, plus the member-role redirect and adversarial
 // inputs to the invite form.
 const API_BASE = process.env.E2E_API_BASE ?? 'http://127.0.0.1:18080';
 const cleanup = new CleanupRegistry();
 test.afterEach(async () => {
 	await cleanup.run();
 });
 async function createMember(username: string, password = 'e2e-member-pw'): Promise<string> {
 	const api = await adminApi();
 	try {
 		const res = await api.post('/api/v1/admin/admins', {
 			data: { username, password, instance_role: 'member' }
 		});
 		expect(res.ok()).toBe(true);
 		return ((await res.json()) as { id: string }).id;
 	} finally {
 		await api.dispose();
 	}
 }
 async function loginToken(username: string, password: string): Promise<string> {
 	const ctx = await request.newContext({ baseURL: API_BASE });
 	try {
 		const res = await ctx.post('/api/v1/admin/auth/login', {
 			data: { username, password },
 			headers: { 'content-type': 'application/json' }
 		});
 		expect(res.ok()).toBe(true);
 		return ((await res.json()) as { token: string }).token;
 	} finally {
 		await ctx.dispose();
 	}
 }
 async function pageWithToken(browser: Browser, token: string): Promise<Page> {
 	const ctx = await browser.newContext({ storageState: undefined });
 	const page = await ctx.newPage();
 	await page.goto('/admin/login');
 	await page.evaluate(
 		([key, value]) => {
 			localStorage.setItem(key, value);
 		},
 		['picloud.admin.token', token]
 	);
 	return page;
 }
 test.describe('B6 instance users', () => {
 	test('invite happy path: form → reveal modal → user in list', async ({
 		page,
 		uniqueUsername
 	}) => {
 		const username = uniqueUsername('inv');
 		await page.goto('/admin/users');
 		await page.getByRole('button', { name: '+ Invite user' }).click();
 		const modal = page.locator('form.modal');
 		await modal.getByLabel('Username').fill(username);
 		await modal.getByRole('radio', { name: /^Member/ }).check();
 		await modal.getByRole('button', { name: /^Create user$/ }).click();
 		// Reveal modal shows the one-time password.
 		const reveal = page.locator('.reveal-modal');
 		await expect(reveal).toBeVisible();
 		await expect(reveal).toContainText(/User created — /);
 		await expect(reveal.getByRole('button', { name: /^Done$/ })).toBeDisabled();
 		await reveal.getByRole('checkbox', { name: /shared this/i }).check();
 		await reveal.getByRole('button', { name: /^Done$/ }).click();
 		// Now in the table.
 		await expect(page.locator('.row:not(.head-row):not(.empty-row)', { hasText: username })).toBeVisible();
 		// API cleanup — we don't have the user id from the UI alone.
 		const api = await adminApi();
 		try {
 			const list = await api.get('/api/v1/admin/admins');
 			const all = (await list.json()) as Array<{ id: string; username: string }>;
 			const u = all.find((x) => x.username === username);
 			if (u) cleanup.adminUser(u.id);
 		} finally {
 			await api.dispose();
 		}
 	});
 	test('username live validation: bad chars → submit disabled', async ({ page }) => {
 		await page.goto('/admin/users');
 		await page.getByRole('button', { name: '+ Invite user' }).click();
 		const modal = page.locator('form.modal');
 		await modal.getByLabel('Username').fill('UPPER_CASE_invalid');
 		await expect(modal.locator('small.invalid')).toContainText(/allowed pattern/i);
 		await modal.getByRole('radio', { name: /^Member/ }).check();
 		await expect(modal.getByRole('button', { name: /^Create user$/ })).toBeDisabled();
 	});
 	test('search filters the table by username', async ({ page, uniqueUsername }) => {
 		const target = uniqueUsername('hit');
 		const decoy = uniqueUsername('miss');
 		const ids = await Promise.all([createMember(target), createMember(decoy)]);
 		ids.forEach((id) => cleanup.adminUser(id));
 		await page.goto('/admin/users');
 		await page.getByPlaceholder(/Search by username/).fill(target);
 		await expect(page.locator('.row', { hasText: target })).toBeVisible();
 		await expect(page.locator('.row', { hasText: decoy })).toHaveCount(0);
 	});
 	test('deactivate confirm modal: Cancel keeps active, Deactivate flips, reactivate is one click', async ({
 		page,
 		uniqueUsername
 	}) => {
 		const username = uniqueUsername('toggle');
 		const userId = await createMember(username);
 		cleanup.adminUser(userId);
 		await page.goto('/admin/users');
 		await page.getByPlaceholder(/Search by username/).fill(username);
 		const row = page.locator('.row:not(.head-row):not(.empty-row)', { hasText: username });
 		await expect(row).toBeVisible();
 		// Deactivate opens the confirm modal.
 		await row.getByRole('button', { name: new RegExp(`User actions for ${username}`) }).click();
 		await page.getByRole('menuitem', { name: /^Deactivate$/ }).click();
 		const dialog = page.getByRole('dialog');
 		await expect(dialog).toBeVisible();
 		await expect(dialog).toContainText(username);
 		// Cancel leaves the user active.
 		await dialog.getByRole('button', { name: /^Cancel$/ }).click();
 		await expect(dialog).toHaveCount(0);
 		await expect(row).not.toContainText(/inactive/i);
 		// Open again and confirm — user becomes inactive.
 		await row.getByRole('button', { name: new RegExp(`User actions for ${username}`) }).click();
 		await page.getByRole('menuitem', { name: /^Deactivate$/ }).click();
 		await page.getByRole('dialog').getByRole('button', { name: /^Deactivate$/ }).click();
 		await expect(row).toContainText(/inactive/i);
 		// Reactivate is still one-click (non-destructive — no modal).
 		await row.getByRole('button', { name: new RegExp(`User actions for ${username}`) }).click();
 		await page.getByRole('menuitem', { name: /^Reactivate$/ }).click();
 		await expect(row).not.toContainText(/inactive/i);
 	});
 	test('delete: wrong phrase keeps disabled, right phrase removes the user', async ({
 		page,
 		uniqueUsername
 	}) => {
 		const username = uniqueUsername('del');
 		const userId = await createMember(username);
 		cleanup.adminUser(userId);
 		await page.goto('/admin/users');
 		await page.getByPlaceholder(/Search by username/).fill(username);
 		const row = page.locator('.row:not(.head-row):not(.empty-row)', { hasText: username });
 		await row.getByRole('button', { name: new RegExp(`User actions for ${username}`) }).click();
 		await page.getByRole('menuitem', { name: /^Delete$/ }).click();
 		const dialog = page.getByRole('dialog');
 		const confirm = dialog.getByRole('button', { name: /^Delete user$/ });
 		await expect(confirm).toBeDisabled();
 		await dialog.getByRole('textbox').fill('not-the-username');
 		await expect(confirm).toBeDisabled();
 		await dialog.getByRole('textbox').fill(username);
 		await expect(confirm).toBeEnabled();
 		await confirm.click();
 		await expect(page.locator('.row:not(.head-row):not(.empty-row)', { hasText: username })).toHaveCount(0);
 	});
 	test('member-role user visiting /admin/users is bounced to profile with denied banner', async ({
 		browser,
 		uniqueUsername
 	}) => {
 		const username = uniqueUsername('memvw');
 		const password = 'e2e-member-pw';
 		const userId = await createMember(username, password);
 		cleanup.adminUser(userId);
 		const token = await loginToken(username, password);
 		const memberPage = await pageWithToken(browser, token);
 		try {
 			await memberPage.goto('/admin/users');
 			await expect(memberPage).toHaveURL(/\/admin\/profile\?denied=users$/);
 			await expect(memberPage.getByText(/don.?t have access to the Users page/i)).toBeVisible();
 		} finally {
 			await memberPage.context().close();
 		}
 	});
 });
 test.describe('B6 instance users adversarial', () => {
 	test('username too short: live invalid + submit disabled', async ({ page }) => {
 		await page.goto('/admin/users');
 		await page.getByRole('button', { name: '+ Invite user' }).click();
 		const modal = page.locator('form.modal');
 		await modal.getByLabel('Username').fill('a'); // 1 char — minimum is 2
 		await expect(modal.locator('small.invalid')).toBeVisible();
 		await modal.getByRole('radio', { name: /^Member/ }).check();
 		await expect(modal.getByRole('button', { name: /^Create user$/ })).toBeDisabled();
 	});
 	test('email with script tag fails validation, never executes', async ({ page }) => {
 		page.on('dialog', async (d) => {
 			await d.dismiss();
 			throw new Error(`Unexpected dialog: ${d.message()}`);
 		});
 		await page.goto('/admin/users');
 		await page.getByRole('button', { name: '+ Invite user' }).click();
 		const modal = page.locator('form.modal');
 		await modal.getByLabel(/Email/).fill('<script>alert(1)</script>@x');
 		await expect(modal.locator('small.invalid')).toContainText(/email/i);
 	});
 });
--- a/dashboard/vitest.config.ts
+++ b/dashboard/vitest.config.ts
@@ -9,7 +9,7 @@ import { defineConfig } from 'vitest/config';
 export default defineConfig({
 	test: {
-		include: ['src/lib/rhai/**/*.test.ts'],
+		include: ['src/lib/**/*.test.ts'],
 		environment: 'node'
 	}
 });
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -61,6 +61,7 @@ services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "${PICLOUD_HOST_PORT:-8000}:80"
    volumes:
--- a/serverless_cloud_blueprint.md
+++ b/serverless_cloud_blueprint.md
@@ -1,7 +1,7 @@
 # Project Blueprint: Lightweight Event-Based Serverless Cloud
 **Status**: Phase 4 — Blueprint Complete  
-**Last Updated**: 2026-04-10  
+**Last Updated**: 2026-05-27  
 **Audience**: Solo developer (DIY self-hosted)
 ---
@@ -1049,7 +1049,7 @@ pub struct Principal {
 | Role | Powers |
 |---|---|
 | `owner` | full instance control, manage other owners, implicit `app_admin` on every app. Multiple owners allowed. |
-| `admin` | create apps, invite users, implicit `editor` on every app. Cannot manage instance-wide settings or other owners. |
+| `admin` | create apps, invite users, implicit `app_admin` on every app. Cannot manage instance-wide settings (sandbox ceiling, etc.) or other owners. |
 | `member` | invited into specific apps only. Cannot create apps, cannot invite. **Strict isolation enforced at SQL** — list endpoints `WHERE app_id IN (SELECT app_id FROM app_members WHERE user_id = $1)`; the API never returns apps a member isn't part of. |
 The current Phase 3a `admin_users` rows all become `owner` via `DEFAULT 'owner'` on the new column. Multi-owner installs get a startup `tracing::warn!` listing the active owner usernames so the operator can demote extras via `PATCH /api/v1/admin/admins/{id}`.
@@ -1058,11 +1058,13 @@ The current Phase 3a `admin_users` rows all become `owner` via `DEFAULT 'owner'`
 | Role | Grants |
 |---|---|
-| `app_admin` | settings, domain claims, delete app |
+| `app_admin` | settings, domain claims, delete app, **delete scripts** |
-| `editor` | CRUD on scripts, routes, sandbox config |
+| `editor` | create + edit scripts, routes, sandbox config (no script delete) |
 | `viewer` | read scripts + execution logs |
-Implicit grants from instance role: every `owner` is `app_admin` on every app; every `admin` is `editor` on every app. Explicit `app_members` rows are the only path for `member` users.
+Implicit grants from instance role: every `owner` and every `admin` is `app_admin` on every app — a single-human install would otherwise have to add itself to each new app's `app_members`. Explicit `app_members` rows are the only path for `member` users.
 Script **save** uses `AppWriteScript` (editor+); script **delete** uses `AppAdmin` (app_admin+). Editors can iterate on a script's source freely but cannot remove it — destructive cleanup stays with the role that also owns the app.
 ### Auth Methods — Same Principal, Different Extractor
@@ -1156,6 +1158,35 @@ DELETE /api/v1/admin/api-keys/{id}   — caller's own only
 Every existing `/api/v1/admin/*` endpoint is re-gated from "any authed admin" to a specific `Capability`. Request/response shapes are unchanged; what changes is the set of callers each endpoint accepts (a `member` now gets 403 on app surfaces they're not part of, where before they would have been 401-or-200 depending only on session validity).
 ### App Member Management Endpoints
 Exposes the `app_members` table as a first-class CRUD surface so app admins can manage who they share an app with from the dashboard, not just from SQL.
 ```
 GET    /api/v1/admin/apps/{id_or_slug}/members              — list members (ordered by username),
                                                              joined with admin_users for
                                                              username / email / instance_role / is_active
 POST   /api/v1/admin/apps/{id_or_slug}/members              — { user_id, role } → 201 enriched DTO
                                                              409 on duplicate (promotions go through PATCH)
                                                              422 if target user is_active = false
                                                              422 if target user instance_role != 'member'
                                                                  (owners/admins have implicit authority;
                                                                  an explicit row would be dead weight)
 PATCH  /api/v1/admin/apps/{id_or_slug}/members/{user_id}    — { role } → 200 enriched DTO
                                                              404 if no existing membership
 DELETE /api/v1/admin/apps/{id_or_slug}/members/{user_id}    — 204 (idempotent — 204 also when missing)
 ```
 All four are gated on `Capability::AppAdmin(app_id)`. Editors and viewers get 403 on list and never see the dashboard's Members tab.
 **`my_role` on the app lookup endpoint.** `GET /api/v1/admin/apps/{id_or_slug}` now returns an additional `my_role: Option<AppRole>`, computed server-side from the principal: `Owner → app_admin`, `Admin → editor`, `Member → app_members.role`. The dashboard uses this single field to decide whether to render the Members tab (visible iff `my_role == app_admin`), keeping API and UI gate logic identical.
 **No last-app-admin guard.** Unlike the last-owner protection on `admin_users`, removing the final `app_admin` row from `app_members` is allowed. Every `owner` instance-role user implicitly satisfies `Capability::AppAdmin(_)` via the top-level `role_grants` branch, so no app can become permanently orphaned — an owner can always re-issue grants. The `admin` instance role is only implicit *editor*, so it does **not** provide a fallback path; the owner guarantee alone is what makes the no-guard position safe.
 **Dead-row sweep on promotion (deferred).** Promoting a user from `member` → `admin`/`owner` leaves their `app_members` rows in place. They become inert (implicit grants supersede), but are not auto-deleted. A future hook can sweep them; harmless for now.
 Additive within `/api/v1/admin/...` — no API major bump per [docs/versioning.md](docs/versioning.md).
 ### Out of Scope (Phase 3.5)
 Schema room only, not built:
@@ -1164,7 +1195,7 @@ Schema room only, not built:
 - **MFA / TOTP** — `mfa_secret` column reserved on `admin_users`.
 - **Service accounts** — reserved as a future table; for now, every API key belongs to a human `admin_users` row.
-Defer to follow-up sessions: dashboard surfaces for invites / member management / key minting (curl is the supported interface this phase), OIDC / SAML / SCIM, the `picloud` CLI binary itself, email/SMTP delivery of invites, audit log shipping.
+Defer to follow-up sessions: dashboard surfaces for invites / key minting (curl is the supported interface this phase — member management has a dashboard tab; see above), OIDC / SAML / SCIM, the `picloud` CLI binary itself, email/SMTP delivery of invites, audit log shipping.
 ---